@teammy/cli 0.0.5 → 0.0.6

package/dist/main.js

@@ -1,14 +1,15 @@
-// apps/client/control.ts
-import { setTimeout as setTimeout2 } from "node:timers/promises";
+// apps/client/main.ts
+import { parseArgs as parseArgs4 } from "node:util";
+import { resolve as resolve8 } from "node:path";
 
-// packages/protocol/devices.ts
+// packages/protocol/project.ts
 import { z as z3 } from "zod";
 
 // packages/protocol/identity.ts
 import { z } from "zod";
 var NameSchema = z.string().regex(/^[a-z][a-z0-9_-]{0,63}$/);
 var DeviceIdSchema = z.uuid();
-var BindRequestSchema = z.object({ deviceId: DeviceIdSchema }).strict();
+var BindRequestSchema = z.object({ deviceId: DeviceIdSchema, projectId: NameSchema.optional() }).strict();
 var BindingSchema = z.object({
   workspaceId: NameSchema,
   memberId: NameSchema,
@@ -82,193 +83,198 @@ var FileTreeSchema = z2.object({
 });
 var FileSelectionSchema = z2.object({ revision: RevisionSchema, file: FileEntrySchema });
 
-// packages/protocol/devices.ts
-var CredentialSchema = z3.string().regex(/^tmy_[a-f0-9]{64}$/);
-var EnrollmentSchema = z3.object({
-  operationId: z3.uuid(),
-  memberId: NameSchema,
-  deviceId: DeviceIdSchema,
-  credential: CredentialSchema
-}).strict();
-var EffectivePolicySchema = z3.object({
-  checkIntervalSeconds: z3.number().min(1).max(86400),
-  fileSettleSeconds: z3.number().min(0).max(86400)
-}).strict();
-var SyncSummarySchema = z3.object({
-  checkedAt: z3.string(),
-  published: z3.boolean(),
-  appliedFiles: z3.number().int().nonnegative(),
-  pendingFiles: z3.number().int().nonnegative(),
-  sessionSources: z3.number().int().nonnegative(),
-  errors: z3.array(z3.string().max(1e3)).max(20)
-}).strict();
-var DeviceStatusSchema = z3.object({
-  clientVersion: z3.string().max(64),
-  receivedRevision: RevisionSchema.nullable(),
-  appliedRevision: RevisionSchema.nullable(),
-  effectivePolicy: EffectivePolicySchema,
-  overrides: z3.array(z3.enum(["checkIntervalSeconds", "fileSettleSeconds"])).max(2),
-  configError: z3.string().max(2e3).nullable(),
-  reportError: z3.string().max(2e3).nullable(),
-  lastSync: SyncSummarySchema.nullable()
-}).strict();
-var WebDevicesSchema = z3.object({
-  devices: z3.array(
-    z3.object({
-      memberId: NameSchema,
-      bound: z3.boolean(),
-      lastSeenAt: z3.string().nullable(),
-      status: DeviceStatusSchema.nullable()
-    })
-  )
-});
-
 // packages/protocol/project.ts
-import { z as z4 } from "zod";
-var ServerUrlSchema = z4.string().url().max(2048).refine((value) => {
+var ServerUrlSchema = z3.string().url().max(2048).refine((value) => {
   const url = new URL(value);
   return ["http:", "https:"].includes(url.protocol) && !url.username && !url.password && !url.search && !url.hash;
 }, "Use an HTTP(S) server URL without credentials, query or fragment.");
-var SyncPolicySchema = z4.object({
-  checkIntervalSeconds: z4.number().int().min(1).max(86400),
-  fileSettleSeconds: z4.number().int().min(0).max(86400)
+var SyncPolicySchema = z3.object({
+  checkIntervalSeconds: z3.number().int().min(1).max(86400),
+  fileSettleSeconds: z3.number().int().min(0).max(86400)
 }).strict();
 var DEFAULT_POLICY = { checkIntervalSeconds: 60, fileSettleSeconds: 60 };
-var ProjectConfigSchema = z4.object({
-  schemaVersion: z4.literal(1),
+var ProjectConfigSchema = z3.object({
+  schemaVersion: z3.literal(1),
   projectId: NameSchema,
-  projectName: z4.string().trim().min(1).max(120),
-  description: z4.string().max(2e3),
+  projectName: z3.string().trim().min(1).max(120),
+  description: z3.string().max(2e3),
   publicServerUrl: ServerUrlSchema,
   configRevision: RevisionSchema,
-  scopeProfile: z4.literal("workspace-and-sessions-v1"),
+  scopeProfile: z3.literal("workspace-and-sessions-v1"),
   sync: SyncPolicySchema
 }).strict();
-var SetupSchema = z4.object({
-  operationId: z4.uuid(),
-  projectName: z4.string().trim().min(1).max(120),
-  description: z4.string().max(2e3).default(""),
+var SetupSchema = z3.object({
+  operationId: z3.uuid(),
+  projectName: z3.string().trim().min(1).max(120),
+  description: z3.string().max(2e3).default(""),
   publicServerUrl: ServerUrlSchema,
   adminId: NameSchema,
-  members: z4.array(NameSchema).max(100).default([]),
-  existingWorkspaceId: NameSchema.optional(),
+  members: z3.array(NameSchema).max(100).default([]),
   sync: SyncPolicySchema.default(DEFAULT_POLICY)
 }).strict();
-var SetupStatusSchema = z4.object({
-  initialized: z4.boolean(),
-  existingWorkspaces: z4.array(NameSchema)
+var SetupStatusSchema = z3.object({
+  initialized: z3.boolean()
 });
 var ConfigUpdateSchema = ProjectConfigSchema.pick({
   projectName: true,
-  description: true,
-  publicServerUrl: true,
-  sync: true
-}).extend({ expectedRevision: RevisionSchema }).strict();
-var MemberSchema = z4.object({
+  description: true
+}).extend({ expectedRevision: RevisionSchema.optional() }).strict();
+var MemberSchema = z3.object({
   id: NameSchema,
-  displayName: z4.string().max(120),
-  role: z4.enum(["admin", "member"]),
-  enabled: z4.boolean(),
+  displayName: z3.string().max(120),
+  enabled: z3.boolean(),
+  accountEnabled: z3.boolean(),
   revision: RevisionSchema,
-  bound: z4.boolean(),
+  bound: z3.boolean(),
   fileRevision: RevisionSchema,
-  lastPublishedAt: z4.string().nullable()
+  lastPublishedAt: z3.string().nullable()
 });
-var WebSessionSchema = z4.object({
-  workspaceId: NameSchema,
+var WebIdentitySchema = z3.object({
   memberId: NameSchema,
-  displayName: z4.string(),
-  role: z4.enum(["admin", "member"])
+  displayName: z3.string(),
+  siteRole: z3.enum(["admin", "member"])
+});
+var WebSessionSchema = WebIdentitySchema.extend({
+  workspaceId: NameSchema
+});
+var MemberCreateSchema = z3.object({
+  id: NameSchema
+}).strict();
+var MemberUpdateSchema = z3.object({
+  expectedRevision: RevisionSchema,
+  displayName: z3.string().trim().max(120).optional(),
+  enabled: z3.boolean().optional()
+}).strict();
+var ProjectCreateSchema = z3.object({
+  operationId: z3.uuid(),
+  projectName: z3.string().trim().min(1).max(120),
+  description: z3.string().max(2e3).default("")
+}).strict();
+var ProjectSummarySchema = z3.object({
+  projectId: NameSchema,
+  projectName: z3.string(),
+  description: z3.string()
+});
+var ProjectsSchema = z3.object({ projects: z3.array(ProjectSummarySchema) });
+var SiteConfigSchema = z3.object({
+  sync: SyncPolicySchema,
+  publicServerUrl: ServerUrlSchema,
+  revision: RevisionSchema
+});
+var SiteConfigUpdateSchema = z3.object({
+  publicServerUrl: ServerUrlSchema.optional(),
+  sync: SyncPolicySchema.optional(),
+  expectedRevision: RevisionSchema
+}).strict().refine(
+  (v) => v.publicServerUrl !== void 0 || v.sync !== void 0,
+  "Provide a setting to update."
+);
+var UserSchema = z3.object({
+  id: NameSchema,
+  displayName: z3.string(),
+  siteRole: z3.enum(["admin", "member"]),
+  enabled: z3.boolean(),
+  revision: RevisionSchema
 });
-var MemberCreateSchema = z4.object({ id: NameSchema, displayName: z4.string().trim().max(120).default("") }).strict();
-var MemberUpdateSchema = z4.object({
+var UserCreateSchema = z3.object({
+  id: NameSchema,
+  displayName: z3.string().trim().max(120).default(""),
+  siteRole: z3.enum(["admin", "member"]).default("member")
+}).strict();
+var UserUpdateSchema = z3.object({
   expectedRevision: RevisionSchema,
-  displayName: z4.string().trim().max(120).optional(),
-  enabled: z4.boolean().optional()
+  displayName: z3.string().trim().max(120).optional(),
+  enabled: z3.boolean().optional(),
+  siteRole: z3.enum(["admin", "member"]).optional()
 }).strict();
 
 // packages/protocol/sessions.ts
-import { z as z5 } from "zod";
-var AgentSchema = z5.enum(["claude-code", "codex", "cursor", "pi", "dsh"]);
-var SessionSnapshotSchema = z5.object({
-  formatVersion: z5.literal(1),
-  adapterVersion: z5.literal(1),
+import { z as z4 } from "zod";
+var AgentSchema = z4.enum(["claude-code", "codex", "cursor", "pi", "dsh"]);
+var SessionSnapshotSchema = z4.object({
+  formatVersion: z4.literal(1),
+  adapterVersion: z4.literal(1),
   agent: AgentSchema,
-  nativeId: z5.string().min(1).max(512),
-  cwd: z5.string().min(1).max(4096),
-  messages: z5.array(
-    z5.object({
-      id: z5.string().min(1).max(1024),
-      role: z5.enum(["user", "assistant"]),
-      text: z5.string().min(1).max(2 * 1024 * 1024),
-      source: z5.string().min(1).max(1024)
+  nativeId: z4.string().min(1).max(512),
+  cwd: z4.string().min(1).max(4096),
+  messages: z4.array(
+    z4.object({
+      id: z4.string().min(1).max(1024),
+      role: z4.enum(["user", "assistant"]),
+      text: z4.string().min(1).max(2 * 1024 * 1024),
+      source: z4.string().min(1).max(1024)
     }).strict()
   ).max(5e4)
 }).strict().refine(
   (s) => new Set(s.messages.map((m) => m.id)).size === s.messages.length,
   "Duplicate message IDs."
 );
-var SessionCommitSchema = z5.object({
-  operationId: z5.uuid(),
+var SessionCommitSchema = z4.object({
+  operationId: z4.uuid(),
   sessionKey: HashSchema,
   parentRevision: RevisionSchema,
   blob: BlobRefSchema
 }).strict();
-var SessionInfoSchema = z5.object({
+var SessionInfoSchema = z4.object({
   owner: NameSchema,
   sessionKey: HashSchema,
   agent: AgentSchema,
-  nativeId: z5.string(),
-  cwd: z5.string(),
-  title: z5.string(),
+  nativeId: z4.string(),
+  cwd: z4.string(),
+  title: z4.string(),
   revision: RevisionSchema,
-  updatedAt: z5.string(),
-  messageCount: z5.number().int().nonnegative(),
+  updatedAt: z4.string(),
+  messageCount: z4.number().int().nonnegative(),
   blob: BlobRefSchema
 });
-var SessionListSchema = z5.object({
-  sessions: z5.array(SessionInfoSchema),
+var SessionListSchema = z4.object({
+  sessions: z4.array(SessionInfoSchema),
   nextCursor: RevisionSchema.nullable()
 });
-var SessionStatsSchema = z5.object({
-  totalSessions: z5.number().int().nonnegative(),
-  totalMessages: z5.number().int().nonnegative(),
-  memberCount: z5.number().int().nonnegative(),
-  updatedAt: z5.string().nullable()
+var SessionStatsSchema = z4.object({
+  totalSessions: z4.number().int().nonnegative(),
+  totalMessages: z4.number().int().nonnegative(),
+  memberCount: z4.number().int().nonnegative(),
+  updatedAt: z4.string().nullable()
 });
-var SessionSearchSchema = z5.object({
-  matches: z5.array(
-    z5.object({
+var SessionScopeSchema = z4.object({
+  owner: NameSchema.optional(),
+  sessionKey: HashSchema.optional()
+}).strict().refine((v) => !v.sessionKey || !!v.owner, "A session scope requires an owner.");
+var SessionSearchSchema = z4.object({
+  matches: z4.array(
+    z4.object({
       owner: NameSchema,
       sessionKey: HashSchema,
       revision: RevisionSchema,
-      messageId: z5.string(),
-      role: z5.enum(["user", "assistant"]),
-      snippet: z5.string()
+      messageId: z4.string(),
+      role: z4.enum(["user", "assistant"]),
+      snippet: z4.string(),
+      title: z4.string()
     })
   ),
   nextCursor: RevisionSchema.nullable()
 });
 
 // packages/transport/hub-client.ts
-import { z as z7 } from "zod";
+import { z as z6 } from "zod";
 import { createHash } from "node:crypto";
 
 // packages/protocol/index.ts
-import { z as z6 } from "zod";
+import { z as z5 } from "zod";
 var PROTOCOL_VERSION = 1;
-var HealthSchema = z6.object({ status: z6.literal("ok") });
-var ServerInfoSchema = z6.object({
-  name: z6.literal("teammy"),
-  version: z6.string().min(1),
-  protocolVersion: z6.literal(PROTOCOL_VERSION),
-  capabilities: z6.array(z6.string())
+var HealthSchema = z5.object({ status: z5.literal("ok") });
+var ServerInfoSchema = z5.object({
+  name: z5.literal("teammy"),
+  version: z5.string().min(1),
+  protocolVersion: z5.literal(PROTOCOL_VERSION),
+  capabilities: z5.array(z5.string())
 });
-var ErrorResponseSchema = z6.object({
-  error: z6.object({
-    code: z6.string(),
-    message: z6.string(),
-    requestId: z6.string()
+var ErrorResponseSchema = z5.object({
+  error: z5.object({
+    code: z5.string(),
+    message: z5.string(),
+    requestId: z5.string()
   })
 });
 
@@ -312,8 +318,11 @@ var HubClient = class {
   get url() {
     return this.baseUrl.toString();
   }
-  bind(deviceId) {
-    return this.request("POST", "api/v1/bind", BindingSchema, { deviceId });
+  bind(deviceId, projectId) {
+    return this.request("POST", "api/v1/bind", BindingSchema, {
+      deviceId,
+      ...projectId ? { projectId } : {}
+    });
   }
   members() {
     return this.request("GET", "api/v1/members", MembersSchema);
@@ -331,18 +340,18 @@ var HubClient = class {
       "GET",
       `api/v1/blobs/${HashSchema.parse(hash2)}`
     );
-    if (!response.ok) return this.decode(response, signal, z7.never());
+    if (!response.ok) return this.decode(response, signal, z6.never());
     const reader = response.body?.getReader();
     if (!reader) throw new Error("Server returned no content body.");
     const parts = [];
     let size = 0;
     try {
       for (; ; ) {
-        const result = await reader.read();
-        if (result.done) break;
-        size += result.value.byteLength;
+        const result2 = await reader.read();
+        if (result2.done) break;
+        size += result2.value.byteLength;
         if (size > MAX_BLOB_BYTES) throw new Error("Downloaded content exceeds the size limit.");
-        parts.push(result.value);
+        parts.push(result2.value);
       }
     } finally {
       await reader.cancel();
@@ -376,7 +385,7 @@ var HubClient = class {
     return this.request(
       "PUT",
       "api/v1/devices/self/status",
-      z7.object({ ok: z7.literal(true) }),
+      z6.object({ ok: z6.literal(true) }),
       status
     );
   }
@@ -420,6 +429,8 @@ var HubClient = class {
     return this.decode(response, signal, schema);
   }
   async fetchResponse(method, path, requestBody) {
+    if (this.credentials?.workspaceId && path.startsWith("api/v1/") && !["api/v1/bind", "api/v1/server"].includes(path))
+      path = `api/v1/projects/${encodeURIComponent(this.credentials.workspaceId)}/${path.slice("api/v1/".length)}`;
     const timeout = AbortSignal.timeout(this.timeoutMs);
     const signal = this.abortSignal ? AbortSignal.any([timeout, this.abortSignal]) : timeout;
     const binary = requestBody instanceof Uint8Array;
@@ -470,64 +481,107 @@ var HubClient = class {
   }
 };
 
-// apps/client/project-state.ts
-import { randomBytes, randomUUID } from "node:crypto";
-var projectClientMigration = String.raw`
- CREATE TABLE client_enrollments(root TEXT PRIMARY KEY REFERENCES connections(root),server_url TEXT NOT NULL,request_json TEXT NOT NULL);
- CREATE TABLE client_project_config(root TEXT PRIMARY KEY REFERENCES connections(root),config_json TEXT NOT NULL,descriptor_hash TEXT NOT NULL);
+// apps/client/sessions/command.ts
+import { createHash as createHash6 } from "node:crypto";
+import { realpath as realpath4 } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname as dirname4, join as join6, resolve as resolve3 } from "node:path";
+import { parseArgs } from "node:util";
+
+// apps/client/runtime/state.ts
+var runtimeMigration = `
+ALTER TABLE file_index ADD COLUMN seen_local INTEGER NOT NULL DEFAULT 0;
+UPDATE file_index SET seen_local=1 WHERE signature IS NOT NULL OR hash IS NOT NULL;
+CREATE TABLE client_runtime(root TEXT PRIMARY KEY REFERENCES connections(root), enabled INTEGER NOT NULL DEFAULT 0, status_json TEXT);
+CREATE TABLE client_preparations(root TEXT PRIMARY KEY REFERENCES connections(root), identity TEXT NOT NULL, input_json TEXT NOT NULL, complete INTEGER NOT NULL DEFAULT 0);
 `;
-var ClientProjectState = class {
-  constructor(state, root) {
+var RuntimeState = class {
+  constructor(state) {
     this.state = state;
-    this.root = root;
   }
   state;
-  root;
-  enrollment(url, memberId, reconnect = false) {
-    const deviceId = this.state.deviceFor(this.root);
-    const row = this.state.db.prepare("SELECT * FROM client_enrollments WHERE root=?").get(this.root);
-    if (row && !reconnect) {
-      const request2 = EnrollmentSchema.parse(JSON.parse(String(row.request_json)));
-      if (row.server_url !== url || request2.memberId !== memberId)
-        throw new Error("Another enrollment is pending for this root; use the same member/server.");
-      return request2;
-    }
-    const request = {
-      operationId: randomUUID(),
-      memberId,
-      deviceId,
-      credential: `tmy_${randomBytes(32).toString("hex")}`
-    };
+  enabled(root) {
+    return Boolean(
+      this.state.db.prepare("SELECT enabled FROM client_runtime WHERE root=?").get(root)?.enabled
+    );
+  }
+  enable(root, enabled) {
+    if (!this.state.binding(root)) throw new Error("Connect this workspace first.");
     this.state.db.prepare(
-      "INSERT INTO client_enrollments VALUES (?,?,?) ON CONFLICT(root) DO UPDATE SET server_url=excluded.server_url,request_json=excluded.request_json"
-    ).run(this.root, url, JSON.stringify(request));
-    return request;
+      "INSERT INTO client_runtime(root,enabled) VALUES (?,?) ON CONFLICT(root) DO UPDATE SET enabled=excluded.enabled"
+    ).run(root, Number(enabled));
   }
-  completeEnrollment() {
-    this.state.db.prepare("DELETE FROM client_enrollments WHERE root=?").run(this.root);
+  roots() {
+    return this.state.db.prepare("SELECT root FROM client_runtime WHERE enabled=1").all().map((r) => String(r.root));
   }
-  cached() {
-    const row = this.state.db.prepare("SELECT * FROM client_project_config WHERE root=?").get(this.root);
-    return row ? {
-      config: ProjectConfigSchema.parse(JSON.parse(String(row.config_json))),
-      hash: String(row.descriptor_hash)
-    } : void 0;
+  status(root) {
+    const row = this.state.db.prepare("SELECT status_json FROM client_runtime WHERE root=?").get(root);
+    return row?.status_json ? JSON.parse(String(row.status_json)) : null;
   }
-  save(config, hash2) {
+  save(root, status) {
     this.state.db.prepare(
-      "INSERT INTO client_project_config VALUES (?,?,?) ON CONFLICT(root) DO UPDATE SET config_json=excluded.config_json,descriptor_hash=excluded.descriptor_hash"
-    ).run(this.root, JSON.stringify(config), hash2);
+      "INSERT INTO client_runtime(root,status_json) VALUES (?,?) ON CONFLICT(root) DO UPDATE SET status_json=excluded.status_json"
+    ).run(root, JSON.stringify(status));
   }
 };
 
-// apps/client/project-file.ts
-import { createHash as createHash3 } from "node:crypto";
+// apps/client/state.ts
+import { randomUUID as randomUUID3 } from "node:crypto";
+import { join as join4, relative as relative2, isAbsolute, sep as sep2 } from "node:path";
+import { z as z8 } from "zod";
+
+// packages/state/sqlite.ts
+import { chmodSync, mkdirSync } from "node:fs";
+import { dirname } from "node:path";
+import { DatabaseSync } from "node:sqlite";
+function transaction(db, action) {
+  db.exec("BEGIN IMMEDIATE");
+  try {
+    const result2 = action();
+    db.exec("COMMIT");
+    return result2;
+  } catch (error) {
+    db.exec("ROLLBACK");
+    throw error;
+  }
+}
+function openDatabase(path, migrations, busyTimeoutMs = 5e3) {
+  if (!Number.isSafeInteger(busyTimeoutMs) || busyTimeoutMs < 0)
+    throw new Error("Invalid SQLite busy timeout.");
+  mkdirSync(dirname(path), { recursive: true, mode: 448 });
+  const db = new DatabaseSync(path);
+  try {
+    chmodSync(path, 384);
+    db.exec(
+      `PRAGMA busy_timeout = ${busyTimeoutMs}; PRAGMA foreign_keys = ON; PRAGMA journal_mode = WAL; PRAGMA synchronous = FULL;`
+    );
+    transaction(db, () => {
+      const version = Number(db.prepare("PRAGMA user_version").get().user_version);
+      if (version > migrations.length)
+        throw new Error("Database was created by a newer Teammy version.");
+      for (let index = version; index < migrations.length; index++) {
+        db.exec(migrations[index]);
+        db.exec(`PRAGMA user_version = ${index + 1}`);
+      }
+    });
+    return db;
+  } catch (error) {
+    db.close();
+    throw error;
+  }
+}
+
+// apps/client/workspace.ts
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { lstat as lstat2, mkdir as mkdir2, realpath as realpath2, rmdir as rmdir2 } from "node:fs/promises";
+import { basename, dirname as dirname3, join as join2, resolve } from "node:path";
 
 // apps/client/files/local-fs.ts
-import { createHash as createHash2, randomUUID as randomUUID2 } from "node:crypto";
+import { createHash as createHash2, randomUUID } from "node:crypto";
 import { constants } from "node:fs";
 import { lstat, mkdir, open, readdir, realpath, rename, rmdir, unlink } from "node:fs/promises";
-import { dirname, join, relative, sep } from "node:path";
+import { dirname as dirname2, join, relative, sep } from "node:path";
 import { setImmediate } from "node:timers/promises";
 function missing(error) {
   return error instanceof Error && "code" in error && ["ENOENT", "ENOTDIR"].includes(String(error.code));
@@ -657,7 +711,7 @@ async function syncDirectory(directory) {
 }
 async function replaceFile(root, path, bytes, expected) {
   const target = await safePath(root, path, true);
-  const temporary = join(dirname(target), `.teammy-${randomUUID2()}.tmp`);
+  const temporary = join(dirname2(target), `.teammy-${randomUUID()}.tmp`);
   const file = await open(temporary, "wx", 384);
   try {
     try {
@@ -674,11 +728,11 @@ async function replaceFile(root, path, bytes, expected) {
       throw new Error(`Local file changed before replacement: ${path}`);
     await safePath(root, path);
     await rename(temporary, target);
-    let directory = dirname(target);
+    let directory = dirname2(target);
     for (; ; ) {
       await syncDirectory(directory);
-      if (directory === dirname(root)) break;
-      directory = dirname(directory);
+      if (directory === dirname2(root)) break;
+      directory = dirname2(directory);
     }
   } finally {
     await unlink(temporary).catch((error) => {
@@ -693,125 +747,420 @@ async function removeFile(root, path, expected) {
     throw new Error(`Local file changed before deletion: ${path}`);
   const target = await safePath(root, path);
   await unlink(target);
-  await syncDirectory(dirname(target));
-  let parent = dirname(target);
+  await syncDirectory(dirname2(target));
+  let parent = dirname2(target);
   while (parent !== root) {
     try {
       await rmdir(parent);
-      await syncDirectory(dirname(parent));
+      await syncDirectory(dirname2(parent));
     } catch {
       break;
     }
-    parent = dirname(parent);
+    parent = dirname2(parent);
   }
 }
 
-// apps/client/project-file.ts
-var name = ".teammy.json";
-async function applyProjectFile(local, input) {
-  const config = ProjectConfigSchema.parse(input);
-  const binding = local.state.binding(local.root);
-  if (!binding || binding.workspaceId !== config.projectId)
-    throw new Error("Project configuration does not match the local binding.");
-  const cached = local.cached();
-  if (cached && config.configRevision < cached.config.configRevision)
-    throw new Error("Server project configuration moved backwards.");
-  const bytes = Buffer.from(JSON.stringify(config, null, 2) + "\n");
-  const hash2 = createHash3("sha256").update(bytes).digest("hex");
-  const entry = await metadata(local.root, name);
-  let signature2 = null;
-  if (entry) {
-    if (entry.directory)
-      throw new Error("Project configuration path is a directory; preserving it.");
-    const existing = await readStable(local.root, name);
-    signature2 = existing.signature;
-    if (existing.sha256 !== hash2 && existing.sha256 !== cached?.hash)
+// apps/client/workspace.ts
+var exec = promisify(execFile);
+async function workspacePath(input) {
+  const path = resolve(input);
+  return join2(await realpath2(dirname3(path)), basename(path));
+}
+async function directoryIdentity(root) {
+  const stat2 = await lstat2(root, { bigint: true });
+  if (!stat2.isDirectory() || stat2.isSymbolicLink())
+    throw new Error("Workspace must be an ordinary directory.");
+  return `${stat2.dev}:${stat2.ino}`;
+}
+async function verifyWorkspace(state, root) {
+  const identity = await directoryIdentity(root);
+  const prior = state.db.prepare("SELECT identity FROM client_preparations WHERE root=?").get(root);
+  if (prior && prior.identity !== identity)
+    throw new Error(
+      "Workspace directory was replaced. Restore the original directory before syncing."
+    );
+}
+async function ignorePlan(root) {
+  const parent = dirname3(root), name2 = basename(root);
+  if (/[\r\n]/.test(name2)) throw new Error("Workspace name cannot contain a newline.");
+  let repo = false;
+  for (let p = parent; ; p = dirname3(p)) {
+    try {
+      await lstat2(join2(p, ".git"));
+      repo = true;
+      break;
+    } catch (e) {
+      if (!missing(e)) throw e;
+    }
+    if (p === dirname3(p)) break;
+  }
+  if (repo) {
+    let tracked;
+    try {
+      tracked = (await exec("git", ["-C", parent, "--literal-pathspecs", "ls-files", "-z", "--", name2], {
+        maxBuffer: 1024 * 1024
+      })).stdout;
+    } catch {
+      throw new Error("Cannot inspect the Git index. Check Git access before connecting.");
+    }
+    if (tracked)
       throw new Error(
-        "Existing .teammy.json is not the expected managed copy. Preserve it elsewhere before retrying."
+        "Git already tracks this workspace path. Remove it from the Git index yourself before connecting."
       );
-    if (existing.sha256 === hash2) {
-      local.save(config, hash2);
+    try {
+      await exec("git", ["-C", parent, "check-ignore", "--no-index", "-q", "--", name2 + "/"]);
       return;
+    } catch (e) {
+      if (e.code !== 1) throw new Error("Cannot check Git ignore rules.");
     }
   }
-  await replaceFile(local.root, name, bytes, signature2);
-  local.save(config, hash2);
+  const entry = await metadata(parent, ".gitignore");
+  if (entry?.directory) throw new Error(".gitignore is a directory.");
+  const original = entry ? await readStable(parent, ".gitignore") : null;
+  const content = original ? new TextDecoder("utf-8", { fatal: true }).decode(original.bytes) : "";
+  const rule = "/" + name2.replace(/[\\*?[\]#! ]/g, "\\$&") + "/";
+  if (content.split(/\r?\n/).includes(rule)) return;
+  const newline = content.includes("\r\n") ? "\r\n" : "\n";
+  return {
+    parent,
+    bytes: Buffer.from(
+      content + (content && !content.endsWith("\n") ? newline : "") + rule + newline
+    ),
+    signature: original?.signature ?? null
+  };
 }
-
-// apps/client/control.ts
-var controlClientMigration = "CREATE TABLE client_control(root TEXT PRIMARY KEY REFERENCES connections(root),status_json TEXT NOT NULL);";
-var ControlPlane = class {
-  constructor(state, root, version, overrides, apply) {
-    this.state = state;
-    this.root = root;
-    this.overrides = overrides;
-    this.apply = apply;
-    const binding = state.binding(root);
-    if (!binding) throw new Error("Connect this root first.");
-    this.client = new HubClient(binding.serverUrl, 1e4, binding, this.stop.signal);
-    this.local = new ClientProjectState(state, root);
-    const row = state.db.prepare("SELECT status_json FROM client_control WHERE root=?").get(root);
-    const prior = row ? DeviceStatusSchema.parse(JSON.parse(String(row.status_json))) : void 0;
-    const cached = this.local.cached();
-    this.status = {
-      clientVersion: version,
-      receivedRevision: cached?.config.configRevision ?? null,
-      appliedRevision: null,
-      effectivePolicy: EffectivePolicySchema.parse({
-        ...DEFAULT_POLICY,
-        ...cached?.config.sync,
-        ...overrides
-      }),
-      overrides: Object.keys(overrides),
-      configError: null,
-      reportError: null,
-      lastSync: prior?.lastSync ?? null
-    };
-    apply(this.status.effectivePolicy);
-  }
-  state;
-  root;
-  overrides;
-  apply;
-  client;
-  local;
-  status;
-  enabled = true;
-  stop = new AbortController();
-  running;
-  persist() {
-    this.state.db.prepare(
-      "INSERT INTO client_control VALUES (?,?) ON CONFLICT(root) DO UPDATE SET status_json=excluded.status_json"
-    ).run(this.root, JSON.stringify(this.status));
+async function prepareWorkspace(state, root, input, reconnect = false) {
+  state.assertRootAvailable(root);
+  const prior = state.db.prepare("SELECT * FROM client_preparations WHERE root=?").get(root);
+  let present = false;
+  try {
+    await lstat2(root);
+    present = true;
+  } catch (e) {
+    if (!missing(e)) throw e;
+  }
+  if (present) {
+    if (reconnect && state.binding(root)) {
+      await verifyWorkspace(state, root);
+      return;
+    }
+    if (prior && !prior.complete && prior.input_json === JSON.stringify(input)) {
+      await verifyWorkspace(state, root);
+      const ignore2 = await ignorePlan(root);
+      if (ignore2) await replaceFile(ignore2.parent, ".gitignore", ignore2.bytes, ignore2.signature);
+      return;
+    }
+    throw new Error(
+      'Workspace path already exists. Choose another directory; for a connected workspace use "teammy sync on".'
+    );
   }
-  updateSync(summary) {
-    this.status.lastSync = summary;
-    this.persist();
+  if (state.binding(root) || prior)
+    throw new Error("Connected workspace is missing. Restore its directory before syncing.");
+  const ignore = await ignorePlan(root);
+  await mkdir2(root);
+  try {
+    const identity = await directoryIdentity(root);
+    state.deviceFor(root);
+    state.db.prepare("INSERT INTO client_preparations(root,identity,input_json) VALUES (?,?,?)").run(root, identity, JSON.stringify(input));
+  } catch (e) {
+    await rmdir2(root).catch(() => {
+    });
+    throw e;
   }
-  async tick() {
-    if (this.stop.signal.aborted) return;
+  if (ignore) await replaceFile(ignore.parent, ".gitignore", ignore.bytes, ignore.signature);
+}
+function completePreparation(state, root) {
+  state.db.prepare("UPDATE client_preparations SET complete=1 WHERE root=?").run(root);
+}
+
+// apps/client/runtime/log.ts
+import { appendFileSync, mkdirSync as mkdirSync2, renameSync, statSync, unlinkSync, readFileSync } from "node:fs";
+import { join as join3 } from "node:path";
+import { createHash as createHash3 } from "node:crypto";
+function rootKey(root) {
+  return createHash3("sha256").update(root).digest("hex").slice(0, 16);
+}
+function redact(value) {
+  return value.replace(/tmy_[a-f0-9]+/gi, "[credential]").replace(/Bearer\s+\S+/gi, "Bearer [redacted]").replace(/(https?:\/\/)[^\s/]+@/gi, "$1[redacted]@").replace(/[\x00-\x1f\x7f]/g, " ").slice(0, 1500);
+}
+function diagnostic(error) {
+  if (!(error instanceof Error)) return "Operation failed.";
+  const fields2 = error;
+  return redact([error.message, fields2.code, fields2.requestId].filter(Boolean).join(" \xB7 "));
+}
+var ClientLog = class {
+  constructor(directory, limit = 1024 * 1024) {
+    this.limit = limit;
+    const logs = join3(directory, "logs");
+    mkdirSync2(logs, { recursive: true, mode: 448 });
+    this.path = join3(logs, "client.jsonl");
+  }
+  limit;
+  path;
+  write(event, root, detail) {
     try {
-      const config = await this.client.projectConfig();
-      this.status.receivedRevision = config.configRevision;
-      await applyProjectFile(this.local, config);
-      const effective = EffectivePolicySchema.parse({ ...config.sync, ...this.overrides });
-      this.apply(effective);
-      this.status.effectivePolicy = effective;
-      this.status.appliedRevision = config.configRevision;
-      this.status.configError = null;
-    } catch (error) {
-      if (!this.local.cached() && error instanceof HubRequestError && ["SETUP_REQUIRED", "PROJECT_NOT_FOUND", "NOT_FOUND"].includes(error.code)) {
-        this.enabled = false;
-        return;
+      let size = 0;
+      try {
+        size = statSync(this.path).size;
+      } catch {
       }
-      this.status.configError = (error instanceof Error ? error.message : "Configuration update failed.").slice(0, 2e3);
+      if (size >= this.limit) {
+        try {
+          unlinkSync(this.path + ".2");
+        } catch {
+        }
+        try {
+          renameSync(this.path + ".1", this.path + ".2");
+        } catch {
+        }
+        renameSync(this.path, this.path + ".1");
+      }
+      appendFileSync(
+        this.path,
+        JSON.stringify({
+          at: (/* @__PURE__ */ new Date()).toISOString(),
+          event,
+          root: root ? rootKey(root) : void 0,
+          detail: detail ? redact(detail) : void 0
+        }) + "\n",
+        { mode: 384 }
+      );
+    } catch {
+    }
+  }
+  tail(root, count = 20) {
+    const lines = [];
+    for (const suffix of [".2", ".1", ""])
+      try {
+        for (const line of readFileSync(this.path + suffix, "utf8").split("\n")) {
+          if (!line) continue;
+          try {
+            const item = JSON.parse(line);
+            if (!root || item.root === rootKey(root) || !item.root) lines.push(line);
+          } catch {
+          }
+        }
+      } catch {
+      }
+    return lines.slice(-count).map((line) => JSON.parse(line));
+  }
+};
+
+// apps/client/control.ts
+import { setTimeout as setTimeout2 } from "node:timers/promises";
+
+// packages/protocol/devices.ts
+import { z as z7 } from "zod";
+var CredentialSchema = z7.string().regex(/^tmy_[a-f0-9]{64}$/);
+var EnrollmentSchema = z7.object({
+  operationId: z7.uuid(),
+  projectId: NameSchema,
+  memberId: NameSchema,
+  deviceId: DeviceIdSchema,
+  credential: CredentialSchema
+}).strict();
+var EffectivePolicySchema = z7.object({
+  checkIntervalSeconds: z7.number().min(1).max(86400),
+  fileSettleSeconds: z7.number().min(0).max(86400)
+}).strict();
+var SyncSummarySchema = z7.object({
+  checkedAt: z7.string(),
+  published: z7.boolean(),
+  appliedFiles: z7.number().int().nonnegative(),
+  pendingFiles: z7.number().int().nonnegative(),
+  sessionSources: z7.number().int().nonnegative(),
+  errors: z7.array(z7.string().max(1e3)).max(20)
+}).strict();
+var DeviceStatusSchema = z7.object({
+  clientVersion: z7.string().max(64),
+  receivedRevision: RevisionSchema.nullable(),
+  appliedRevision: RevisionSchema.nullable(),
+  effectivePolicy: EffectivePolicySchema,
+  overrides: z7.array(z7.enum(["checkIntervalSeconds", "fileSettleSeconds"])).max(2),
+  configError: z7.string().max(2e3).nullable(),
+  reportError: z7.string().max(2e3).nullable(),
+  lastSync: SyncSummarySchema.nullable()
+}).strict();
+var WebDevicesSchema = z7.object({
+  devices: z7.array(
+    z7.object({
+      memberId: NameSchema,
+      bound: z7.boolean(),
+      lastSeenAt: z7.string().nullable(),
+      status: DeviceStatusSchema.nullable()
+    })
+  )
+});
+
+// apps/client/project-state.ts
+import { randomBytes, randomUUID as randomUUID2 } from "node:crypto";
+var projectClientMigration = String.raw`
+ CREATE TABLE client_enrollments(root TEXT PRIMARY KEY REFERENCES connections(root),server_url TEXT NOT NULL,request_json TEXT NOT NULL);
+ CREATE TABLE client_project_config(root TEXT PRIMARY KEY REFERENCES connections(root),config_json TEXT NOT NULL,descriptor_hash TEXT NOT NULL);
+`;
+var ClientProjectState = class {
+  constructor(state, root) {
+    this.state = state;
+    this.root = root;
+  }
+  state;
+  root;
+  enrollment(url, memberId, projectId, reconnect = false) {
+    const deviceId = this.state.deviceFor(this.root);
+    const row = this.state.db.prepare("SELECT * FROM client_enrollments WHERE root=?").get(this.root);
+    if (row && !reconnect) {
+      const request2 = EnrollmentSchema.parse(JSON.parse(String(row.request_json)));
+      if (row.server_url !== url || request2.memberId !== memberId || request2.projectId !== projectId)
+        throw new Error(
+          "Another enrollment is pending for this root; use the same member/server/project."
+        );
+      return request2;
+    }
+    const request = {
+      operationId: randomUUID2(),
+      memberId,
+      projectId,
+      deviceId,
+      credential: `tmy_${randomBytes(32).toString("hex")}`
+    };
+    this.state.db.prepare(
+      "INSERT INTO client_enrollments VALUES (?,?,?) ON CONFLICT(root) DO UPDATE SET server_url=excluded.server_url,request_json=excluded.request_json"
+    ).run(this.root, url, JSON.stringify(request));
+    return request;
+  }
+  completeEnrollment() {
+    this.state.db.prepare("DELETE FROM client_enrollments WHERE root=?").run(this.root);
+  }
+  cached() {
+    const row = this.state.db.prepare("SELECT * FROM client_project_config WHERE root=?").get(this.root);
+    return row ? {
+      config: ProjectConfigSchema.parse(JSON.parse(String(row.config_json))),
+      hash: String(row.descriptor_hash)
+    } : void 0;
+  }
+  save(config, hash2) {
+    this.state.db.prepare(
+      "INSERT INTO client_project_config VALUES (?,?,?) ON CONFLICT(root) DO UPDATE SET config_json=excluded.config_json,descriptor_hash=excluded.descriptor_hash"
+    ).run(this.root, JSON.stringify(config), hash2);
+  }
+};
+
+// apps/client/project-file.ts
+import { createHash as createHash4 } from "node:crypto";
+var name = ".teammy.json";
+async function applyProjectFile(local, input) {
+  const config = ProjectConfigSchema.parse(input);
+  const binding = local.state.binding(local.root);
+  if (!binding || binding.workspaceId !== config.projectId)
+    throw new Error("Project configuration does not match the local binding.");
+  const cached = local.cached();
+  if (cached && config.configRevision < cached.config.configRevision)
+    throw new Error("Server project configuration moved backwards.");
+  const bytes = Buffer.from(JSON.stringify(config, null, 2) + "\n");
+  const hash2 = createHash4("sha256").update(bytes).digest("hex");
+  const entry = await metadata(local.root, name);
+  let signature2 = null;
+  if (entry) {
+    if (entry.directory)
+      throw new Error("Project configuration path is a directory; preserving it.");
+    const existing = await readStable(local.root, name);
+    signature2 = existing.signature;
+    if (existing.sha256 !== hash2 && existing.sha256 !== cached?.hash)
+      throw new Error(
+        "Existing .teammy.json is not the expected managed copy. Preserve it elsewhere before retrying."
+      );
+    if (existing.sha256 === hash2) {
+      local.save(config, hash2);
+      return;
+    }
+  }
+  await replaceFile(local.root, name, bytes, signature2);
+  local.save(config, hash2);
+}
+
+// apps/client/control.ts
+var controlClientMigration = "CREATE TABLE client_control(root TEXT PRIMARY KEY REFERENCES connections(root),status_json TEXT NOT NULL);";
+var ControlPlane = class {
+  constructor(state, root, version, overrides, apply) {
+    this.state = state;
+    this.root = root;
+    this.overrides = overrides;
+    this.apply = apply;
+    const binding = state.binding(root);
+    if (!binding) throw new Error("Connect this root first.");
+    this.client = new HubClient(binding.serverUrl, 1e4, binding, this.stop.signal);
+    this.local = new ClientProjectState(state, root);
+    const row = state.db.prepare("SELECT status_json FROM client_control WHERE root=?").get(root);
+    const prior = row ? DeviceStatusSchema.parse(JSON.parse(String(row.status_json))) : void 0;
+    const cached = this.local.cached();
+    this.status = {
+      clientVersion: version,
+      receivedRevision: cached?.config.configRevision ?? null,
+      appliedRevision: null,
+      effectivePolicy: EffectivePolicySchema.parse({
+        ...DEFAULT_POLICY,
+        ...cached?.config.sync,
+        ...overrides
+      }),
+      overrides: Object.keys(overrides),
+      configError: null,
+      reportError: null,
+      lastSync: prior?.lastSync ?? null
+    };
+    apply(this.status.effectivePolicy);
+  }
+  state;
+  root;
+  overrides;
+  apply;
+  client;
+  local;
+  status;
+  enabled = true;
+  stop = new AbortController();
+  running;
+  pending;
+  persist() {
+    this.state.db.prepare(
+      "INSERT INTO client_control VALUES (?,?) ON CONFLICT(root) DO UPDATE SET status_json=excluded.status_json"
+    ).run(this.root, JSON.stringify(this.status));
+  }
+  updateSync(summary) {
+    this.status.lastSync = summary;
+    this.persist();
+  }
+  tick() {
+    this.pending ??= this.check().finally(() => {
+      this.pending = void 0;
+    });
+    return this.pending;
+  }
+  async check() {
+    if (this.stop.signal.aborted) return;
+    try {
+      await verifyWorkspace(this.state, this.root);
+      const config = await this.client.projectConfig();
+      this.status.receivedRevision = config.configRevision;
+      await verifyWorkspace(this.state, this.root);
+      await applyProjectFile(this.local, config);
+      const effective = EffectivePolicySchema.parse({ ...config.sync, ...this.overrides });
+      this.apply(effective);
+      this.status.effectivePolicy = effective;
+      this.status.appliedRevision = config.configRevision;
+      this.status.configError = null;
+    } catch (error) {
+      if (!this.local.cached() && error instanceof HubRequestError && ["SETUP_REQUIRED", "PROJECT_NOT_FOUND", "NOT_FOUND"].includes(error.code)) {
+        this.enabled = false;
+        return;
+      }
+      this.status.configError = diagnostic(error);
     }
     this.persist();
     this.status.reportError = null;
     try {
       await this.client.reportDeviceStatus(this.status);
     } catch (error) {
-      this.status.reportError = String(error).slice(0, 2e3);
+      this.status.reportError = diagnostic(error);
     }
     this.persist();
   }
@@ -824,7 +1173,7 @@ var ControlPlane = class {
           await this.tick();
         } catch (error) {
           if (!this.stop.signal.aborted) {
-            this.status.configError = String(error).slice(0, 2e3);
+            this.status.configError = diagnostic(error);
           }
         }
       }
@@ -833,6 +1182,7 @@ var ControlPlane = class {
   async close() {
     this.stop.abort();
     await this.running;
+    await this.pending;
   }
 };
 function readControlStatus(state, root) {
@@ -840,176 +1190,39 @@ function readControlStatus(state, root) {
   return row ? DeviceStatusSchema.parse(JSON.parse(String(row.status_json))) : null;
 }
 
-// apps/client/connection.ts
-import { readFile, mkdir as mkdir2 } from "node:fs/promises";
-import { createInterface } from "node:readline/promises";
-
-// apps/client/root-lock.ts
-import { createHash as createHash4 } from "node:crypto";
-import { join as join2 } from "node:path";
-
-// packages/state/sqlite.ts
-import { chmodSync, mkdirSync } from "node:fs";
-import { dirname as dirname2 } from "node:path";
-import { DatabaseSync } from "node:sqlite";
-function transaction(db, action) {
-  db.exec("BEGIN IMMEDIATE");
-  try {
-    const result = action();
-    db.exec("COMMIT");
-    return result;
-  } catch (error) {
-    db.exec("ROLLBACK");
-    throw error;
+// apps/client/sessions/state.ts
+var sessionClientMigration = String.raw`
+  CREATE TABLE session_sources (
+    root TEXT NOT NULL REFERENCES connections(root), path TEXT NOT NULL, agent TEXT NOT NULL, project_dir TEXT NOT NULL,
+    session_key TEXT, revision INTEGER NOT NULL DEFAULT 0, hash TEXT, signature TEXT,
+    checked_at INTEGER NOT NULL DEFAULT 0, verified_at INTEGER NOT NULL DEFAULT 0, last_error TEXT, adopt_existing INTEGER NOT NULL DEFAULT 0,
+    pending_json TEXT, pending_signature TEXT, attempts INTEGER NOT NULL DEFAULT 0, retry_at INTEGER NOT NULL DEFAULT 0,
+    PRIMARY KEY(root, path), UNIQUE(root, session_key)
+  );
+  CREATE INDEX session_source_scheduling ON session_sources(root, checked_at, path);
+  CREATE TABLE session_discovery (
+    root TEXT NOT NULL REFERENCES connections(root), directory TEXT NOT NULL, agent TEXT NOT NULL, project_dir TEXT NOT NULL,
+    PRIMARY KEY(root, directory)
+  );
+  CREATE TABLE session_discovery_cache (
+    root TEXT NOT NULL, path TEXT NOT NULL, signature TEXT NOT NULL, PRIMARY KEY(root, path)
+  );
+`;
+var SessionState = class {
+  constructor(state, root) {
+    this.state = state;
+    this.root = root;
   }
-}
-function openDatabase(path, migrations) {
-  mkdirSync(dirname2(path), { recursive: true, mode: 448 });
-  const db = new DatabaseSync(path);
-  try {
-    chmodSync(path, 384);
-    db.exec(
-      "PRAGMA busy_timeout = 5000; PRAGMA foreign_keys = ON; PRAGMA journal_mode = WAL; PRAGMA synchronous = FULL;"
-    );
-    transaction(db, () => {
-      const version = Number(db.prepare("PRAGMA user_version").get().user_version);
-      if (version > migrations.length)
-        throw new Error("Database was created by a newer Teammy version.");
-      for (let index = version; index < migrations.length; index++) {
-        db.exec(migrations[index]);
-        db.exec(`PRAGMA user_version = ${index + 1}`);
-      }
-    });
-    return db;
-  } catch (error) {
-    db.close();
-    throw error;
-  }
-}
-
-// apps/client/root-lock.ts
-function acquireRootLock(root, stateDirectory) {
-  let lock;
-  try {
-    lock = openDatabase(
-      join2(stateDirectory, "locks", `${createHash4("sha256").update(root).digest("hex")}.sqlite3`),
-      []
-    );
-    lock.exec("PRAGMA busy_timeout=0; BEGIN IMMEDIATE");
-    return lock;
-  } catch (error) {
-    lock?.close();
-    if (error instanceof Error && /locked|busy/.test(error.message))
-      throw new Error("Another sync or connect process is using this root.");
-    throw error;
-  }
-}
-
-// apps/client/connection.ts
-async function connectProject(state, root, directory, options) {
-  const lock = acquireRootLock(root, directory);
-  try {
-    const transport = new HubClient(options.url);
-    const existing = state.binding(root);
-    const project = new ClientProjectState(state, root);
-    if (existing && existing.serverUrl !== transport.url)
-      throw new Error("This root is connected to another server.");
-    let member = options.member;
-    if (existing && !options.reconnect && !options.tokenFile) {
-      if (member && member !== existing.memberId)
-        throw new Error("This root belongs to a different member.");
-      const client2 = new HubClient(existing.serverUrl, 1e4, existing);
-      await client2.members();
-    } else if (options.tokenFile) {
-      const token = CredentialSchema.parse((await readFile(options.tokenFile, "utf8")).trim());
-      const deviceId = state.deviceFor(root);
-      const client2 = new HubClient(options.url, 1e4, { token, deviceId });
-      const binding2 = await client2.bind(deviceId);
-      state.saveBinding(root, client2.url, token, binding2);
-    } else {
-      member ??= existing?.memberId;
-      if (!member && process.stdin.isTTY) {
-        const rl = createInterface({ input: process.stdin, output: process.stderr });
-        try {
-          member = (await rl.question("Member ID: ")).trim();
-        } finally {
-          rl.close();
-        }
-      }
-      if (!member) throw new Error("--member is required when input is not interactive.");
-      NameSchema.parse(member);
-      if (existing && existing.memberId !== member)
-        throw new Error("This root belongs to a different member.");
-      const request = project.enrollment(transport.url, member, Boolean(options.reconnect));
-      const binding2 = await transport.enroll(request);
-      state.saveBinding(root, transport.url, request.credential, binding2);
-      project.completeEnrollment();
-    }
-    const binding = state.binding(root);
-    const client = new HubClient(binding.serverUrl, 1e4, binding);
-    const info = await client.serverInfo();
-    if (info.capabilities.includes("project-config")) {
-      try {
-        await applyProjectFile(project, await client.projectConfig());
-      } catch (error) {
-        if (!(options.tokenFile && error instanceof Error && "code" in error && ["SETUP_REQUIRED", "PROJECT_NOT_FOUND"].includes(String(error.code))))
-          throw error;
-      }
-    }
-    const own = await metadata(root, binding.memberId);
-    if (own && !own.directory) throw new Error("Member path is not a directory.");
-    if (!own) await mkdir2(await safePath(root, binding.memberId));
-    const { token: _, ...visible } = binding;
-    return { ...visible, configRevision: project.cached()?.config.configRevision ?? null };
-  } finally {
-    lock.close();
-  }
-}
-
-// apps/client/main.ts
-import { parseArgs as parseArgs3 } from "node:util";
-import { mkdir as mkdir7, realpath as realpath6 } from "node:fs/promises";
-import { homedir as homedir3 } from "node:os";
-import { join as join11, resolve as resolve6 } from "node:path";
-
-// apps/client/state.ts
-import { randomUUID as randomUUID3 } from "node:crypto";
-import { join as join3 } from "node:path";
-import { z as z8 } from "zod";
-
-// apps/client/sessions/state.ts
-var sessionClientMigration = String.raw`
-  CREATE TABLE session_sources (
-    root TEXT NOT NULL REFERENCES connections(root), path TEXT NOT NULL, agent TEXT NOT NULL, project_dir TEXT NOT NULL,
-    session_key TEXT, revision INTEGER NOT NULL DEFAULT 0, hash TEXT, signature TEXT,
-    checked_at INTEGER NOT NULL DEFAULT 0, verified_at INTEGER NOT NULL DEFAULT 0, last_error TEXT, adopt_existing INTEGER NOT NULL DEFAULT 0,
-    pending_json TEXT, pending_signature TEXT, attempts INTEGER NOT NULL DEFAULT 0, retry_at INTEGER NOT NULL DEFAULT 0,
-    PRIMARY KEY(root, path), UNIQUE(root, session_key)
-  );
-  CREATE INDEX session_source_scheduling ON session_sources(root, checked_at, path);
-  CREATE TABLE session_discovery (
-    root TEXT NOT NULL REFERENCES connections(root), directory TEXT NOT NULL, agent TEXT NOT NULL, project_dir TEXT NOT NULL,
-    PRIMARY KEY(root, directory)
-  );
-  CREATE TABLE session_discovery_cache (
-    root TEXT NOT NULL, path TEXT NOT NULL, signature TEXT NOT NULL, PRIMARY KEY(root, path)
-  );
-`;
-var SessionState = class {
-  constructor(state, root) {
-    this.state = state;
-    this.root = root;
-  }
-  state;
-  root;
-  track(agent, path, projectDir, adoptExisting = false) {
-    const prior = this.get(path);
-    if (prior && (prior.agent !== agent || prior.projectDir !== projectDir))
-      throw new Error("Source is registered with different settings; untrack it first.");
-    this.state.db.prepare(
-      `INSERT INTO session_sources(root,path,agent,project_dir,adopt_existing) VALUES (?,?,?,?,?)
-      ON CONFLICT(root,path) DO UPDATE SET adopt_existing=MAX(adopt_existing,excluded.adopt_existing)`
-    ).run(this.root, path, agent, projectDir, Number(adoptExisting));
+  state;
+  root;
+  track(agent, path, projectDir, adoptExisting = false) {
+    const prior = this.get(path);
+    if (prior && (prior.agent !== agent || prior.projectDir !== projectDir))
+      throw new Error("Source is registered with different settings; untrack it first.");
+    this.state.db.prepare(
+      `INSERT INTO session_sources(root,path,agent,project_dir,adopt_existing) VALUES (?,?,?,?,?)
+      ON CONFLICT(root,path) DO UPDATE SET adopt_existing=MAX(adopt_existing,excluded.adopt_existing)`
+    ).run(this.root, path, agent, projectDir, Number(adoptExisting));
   }
   get(path) {
     return this.sources(path)[0];
@@ -1115,7 +1328,8 @@ var SyncState = class {
       generation: Number(row.generation),
       observedAt: Number(row.observed_at),
       hash: row.hash === null ? null : String(row.hash),
-      verifiedAt: Number(row.verified_at)
+      verifiedAt: Number(row.verified_at),
+      seenLocal: Boolean(row.seen_local)
     }));
   }
   audit(before, limit) {
@@ -1133,7 +1347,8 @@ var SyncState = class {
       generation: Number(row.generation),
       observedAt: Number(row.observed_at),
       hash: row.hash === null ? null : String(row.hash),
-      verifiedAt: Number(row.verified_at)
+      verifiedAt: Number(row.verified_at),
+      seenLocal: Boolean(row.seen_local)
     } : void 0;
   }
   restartWaiting(now) {
@@ -1152,11 +1367,13 @@ var SyncState = class {
     const prior = this.get(path);
     if (!prior) {
       if (signature2 !== null)
-        this.db.prepare("INSERT INTO file_index(root,path,signature,observed_at) VALUES (?,?,?,?)").run(this.root, path, signature2, now);
+        this.db.prepare(
+          "INSERT INTO file_index(root,path,signature,observed_at,seen_local) VALUES (?,?,?,?,1)"
+        ).run(this.root, path, signature2, now);
     } else if (signature2 !== prior.signature) {
       this.db.prepare(
-        "UPDATE file_index SET signature=?, dirty=1, generation=generation+1, observed_at=?, event_pending=0 WHERE root=? AND path=?"
-      ).run(signature2, prior.eventPending ? prior.observedAt : now, this.root, path);
+        "UPDATE file_index SET seen_local=MAX(seen_local, ? IS NOT NULL), signature=?, dirty=1, generation=generation+1, observed_at=?, event_pending=0 WHERE root=? AND path=?"
+      ).run(signature2, signature2, prior.eventPending ? prior.observedAt : now, this.root, path);
     } else if (prior.eventPending) {
       this.db.prepare("UPDATE file_index SET event_pending=0 WHERE root=? AND path=?").run(this.root, path);
     }
@@ -1230,7 +1447,7 @@ var LocalBindingSchema = BindingSchema.extend({
 var ClientState = class {
   db;
   constructor(directory) {
-    this.db = openDatabase(join3(directory, "client.sqlite3"), [
+    this.db = openDatabase(join4(directory, "client.sqlite3"), [
       String.raw`
       CREATE TABLE connections (root TEXT PRIMARY KEY, device_id TEXT NOT NULL, binding_json TEXT);
     `,
@@ -1242,13 +1459,27 @@ var ClientState = class {
       syncMigration,
       sessionClientMigration,
       projectClientMigration,
-      controlClientMigration
+      controlClientMigration,
+      runtimeMigration
     ]);
   }
   close() {
     this.db.close();
   }
+  assertRootAvailable(root) {
+    for (const row of this.db.prepare("SELECT root FROM connections").all()) {
+      const other = String(row.root);
+      if (root === other) continue;
+      const contains = (parent, child) => {
+        const path = relative2(parent, child);
+        return path === "" || !isAbsolute(path) && path !== ".." && !path.startsWith(`..${sep2}`);
+      };
+      if (contains(root, other) || contains(other, root))
+        throw new Error("Sync roots must not overlap. Use separate project directories.");
+    }
+  }
   deviceFor(root) {
+    this.assertRootAvailable(root);
     this.db.prepare("INSERT OR IGNORE INTO connections (root, device_id) VALUES (?, ?)").run(root, randomUUID3());
     return String(
       this.db.prepare("SELECT device_id FROM connections WHERE root=?").get(root).device_id
@@ -1259,6 +1490,7 @@ var ClientState = class {
     return row?.binding_json ? LocalBindingSchema.parse(JSON.parse(String(row.binding_json))) : void 0;
   }
   saveBinding(root, serverUrl, token, binding) {
+    this.assertRootAvailable(root);
     const prior = this.binding(root);
     if (prior && (prior.workspaceId !== binding.workspaceId || prior.memberId !== binding.memberId || prior.serverUrl !== serverUrl)) {
       throw new Error(
@@ -1312,10 +1544,10 @@ var ClientState = class {
       this.db.prepare("INSERT INTO outbox(root, request_json) VALUES (?, ?)").run(root, JSON.stringify(fixed));
     });
   }
-  acknowledge(root, result) {
+  acknowledge(root, result2) {
     transaction(this.db, () => {
       const pending = this.pending(root);
-      if (!pending || pending.batch.operationId !== result.operationId || result.revision < pending.batch.parentRevision || result.revision > pending.batch.parentRevision + 1)
+      if (!pending || pending.batch.operationId !== result2.operationId || result2.revision < pending.batch.parentRevision || result2.revision > pending.batch.parentRevision + 1)
         throw new Error("Unexpected publication acknowledgement.");
       for (const change of pending.batch.changes) {
         if (change.kind === "delete")
@@ -1325,7 +1557,7 @@ var ClientState = class {
             "INSERT INTO owner_files VALUES (?, ?, ?, ?) ON CONFLICT(root, path) DO UPDATE SET hash=excluded.hash, size=excluded.size"
           ).run(root, change.path, change.sha256, change.size);
       }
-      this.db.prepare("UPDATE publications SET revision=? WHERE root=?").run(result.revision, root);
+      this.db.prepare("UPDATE publications SET revision=? WHERE root=?").run(result2.revision, root);
       this.db.prepare("DELETE FROM outbox WHERE root=?").run(root);
     });
   }
@@ -1340,22 +1572,15 @@ var ClientState = class {
   }
 };
 
-// apps/client/sessions/command.ts
-import { createHash as createHash6 } from "node:crypto";
-import { realpath as realpath3 } from "node:fs/promises";
-import { homedir } from "node:os";
-import { dirname as dirname3, join as join5, resolve as resolve2 } from "node:path";
-import { parseArgs } from "node:util";
-
 // apps/client/state-location.ts
-import { mkdir as mkdir3, realpath as realpath2 } from "node:fs/promises";
-import { isAbsolute, relative as relative2, resolve, sep as sep2 } from "node:path";
+import { mkdir as mkdir3, realpath as realpath3 } from "node:fs/promises";
+import { isAbsolute as isAbsolute2, relative as relative3, resolve as resolve2, sep as sep3 } from "node:path";
 async function stateLocation(root, directory) {
-  await mkdir3(resolve(directory), { recursive: true, mode: 448 });
-  const canonical = await realpath2(directory);
+  await mkdir3(resolve2(directory), { recursive: true, mode: 448 });
+  const canonical = await realpath3(directory);
   const contains = (parent, child) => {
-    const path = relative2(parent, child);
-    return path === "" || !isAbsolute(path) && path !== ".." && !path.startsWith(`..${sep2}`);
+    const path = relative3(parent, child);
+    return path === "" || !isAbsolute2(path) && path !== ".." && !path.startsWith(`..${sep3}`);
   };
   if (contains(root, canonical) || contains(canonical, root))
     throw new Error(
@@ -1367,7 +1592,7 @@ async function stateLocation(root, directory) {
 // apps/client/sessions/hooks.ts
 import { createHash as createHash5, randomUUID as randomUUID4 } from "node:crypto";
 import { mkdir as mkdir4, open as open2, opendir, rename as rename2, unlink as unlink2 } from "node:fs/promises";
-import { isAbsolute as isAbsolute2, join as join4 } from "node:path";
+import { isAbsolute as isAbsolute3, join as join5 } from "node:path";
 import { z as z9 } from "zod";
 
 // apps/client/sessions/normalize.ts
@@ -1488,17 +1713,17 @@ function normalizeJsonl(agent, text) {
 // apps/client/sessions/hooks.ts
 var HintSchema = z9.object({
   agent: AgentSchema,
-  path: z9.string().min(1).max(4096).refine(isAbsolute2),
-  projectDir: z9.string().min(1).max(4096).refine(isAbsolute2)
+  path: z9.string().min(1).max(4096).refine(isAbsolute3),
+  projectDir: z9.string().min(1).max(4096).refine(isAbsolute3)
 });
 function inbox(directory, root) {
-  return join4(directory, "session-hints", createHash5("sha256").update(root).digest("hex"));
+  return join5(directory, "session-hints", createHash5("sha256").update(root).digest("hex"));
 }
 async function recordHint(directory, root, input) {
   const hint = HintSchema.parse(input);
   const targetDir = inbox(directory, root);
   await mkdir4(targetDir, { recursive: true, mode: 448 });
-  const target = join4(
+  const target = join5(
     targetDir,
     `${createHash5("sha256").update(JSON.stringify(hint)).digest("hex")}.json`
   );
@@ -1524,7 +1749,7 @@ async function consumeHints(directory, root, sessions) {
   for await (const entry of dir) {
     if (!entry.isFile() || !entry.name.endsWith(".json")) continue;
     if (count++ >= 50) break;
-    const path = join4(inbox(directory, root), entry.name);
+    const path = join5(inbox(directory, root), entry.name);
     try {
       const handle = await open2(path, "r");
       let body;
@@ -1590,8 +1815,8 @@ async function runSessionCommand(args) {
   const { values } = parseArgs({
     args: args.slice(1),
     options: {
-      root: { type: "string", default: resolve2("workspaces") },
-      "state-dir": { type: "string", default: join5(homedir(), ".teammy", "client") },
+      root: { type: "string", default: resolve3("workspaces") },
+      "state-dir": { type: "string", default: join6(homedir(), ".teammy", "client") },
       agent: { type: "string" },
       file: { type: "string" },
       directory: { type: "string" },
@@ -1610,16 +1835,16 @@ async function runSessionCommand(args) {
     process.stdout.write(help);
     return 0;
   }
-  const root = await realpath3(resolve2(values.root));
+  const root = await realpath4(resolve3(values.root));
   const directory = await stateLocation(root, values["state-dir"]);
-  const projectDir = await realpath3(resolve2(values["project-dir"] ?? dirname3(root)));
+  const projectDir = await realpath4(resolve3(values["project-dir"] ?? dirname4(root)));
   if (command === "hook") {
     const payload = values.file ? {} : await hookPayload();
     const file = values.file ?? payload.transcript_path ?? payload.session_file ?? payload.sessionFile;
     if (typeof file === "string" && file)
       await recordHint(directory, root, {
         agent: AgentSchema.parse(values.agent),
-        path: resolve2(file),
+        path: resolve3(file),
         projectDir
       });
     return 0;
@@ -1633,7 +1858,7 @@ async function runSessionCommand(args) {
     let output;
     if (command === "track" || command === "untrack") {
       if (!values.file) throw new Error("--file is required.");
-      const path = resolve2(values.file);
+      const path = resolve3(values.file);
       if (command === "track")
         sessions.track(
           AgentSchema.parse(values.agent),
@@ -1646,23 +1871,23 @@ async function runSessionCommand(args) {
     } else if (command === "discover" || command === "undiscover") {
       if (command === "undiscover") {
         if (!values.directory) throw new Error("--directory is required.");
-        state.db.prepare("DELETE FROM session_discovery WHERE root=? AND directory=?").run(root, await realpath3(resolve2(values.directory)));
+        state.db.prepare("DELETE FROM session_discovery WHERE root=? AND directory=?").run(root, await realpath4(resolve3(values.directory)));
       } else {
         const agent = AgentSchema.parse(values.agent);
         const defaults = {
-          "claude-code": join5(homedir(), ".claude", "projects"),
-          codex: join5(process.env.CODEX_HOME ?? join5(homedir(), ".codex"), "sessions"),
-          cursor: join5(
-            process.env.CURSOR_CONFIG_DIR ?? join5(homedir(), ".cursor"),
+          "claude-code": join6(homedir(), ".claude", "projects"),
+          codex: join6(process.env.CODEX_HOME ?? join6(homedir(), ".codex"), "sessions"),
+          cursor: join6(
+            process.env.CURSOR_CONFIG_DIR ?? join6(homedir(), ".cursor"),
             "chats",
             createHash6("md5").update(projectDir).digest("hex")
           ),
-          pi: join5(process.env.PI_CODING_AGENT_DIR ?? join5(homedir(), ".pi", "agent"), "sessions"),
+          pi: join6(process.env.PI_CODING_AGENT_DIR ?? join6(homedir(), ".pi", "agent"), "sessions"),
           dsh: void 0
         };
         const path = values.directory ?? defaults[agent];
         if (!path) throw new Error("DSH requires its configured persistence --directory.");
-        sessions.discover(agent, await realpath3(resolve2(path)), projectDir);
+        sessions.discover(agent, await realpath4(resolve3(path)), projectDir);
       }
       output = sessions.directories();
     } else if (command === "sources")
@@ -1697,538 +1922,551 @@ async function runSessionCommand(args) {
 }
 
 // apps/client/sync-command.ts
-import { realpath as realpath5 } from "node:fs/promises";
-import { homedir as homedir2 } from "node:os";
-import { join as join10, resolve as resolve5 } from "node:path";
-import { setTimeout as setTimeout3 } from "node:timers/promises";
+import { parseArgs as parseArgs3 } from "node:util";
+import { setTimeout as setTimeout4 } from "node:timers/promises";
+
+// apps/client/client-command.ts
 import { parseArgs as parseArgs2 } from "node:util";
+import { join as join10, resolve as resolve5 } from "node:path";
+import { homedir as homedir3 } from "node:os";
+import { createInterface as createInterface2 } from "node:readline/promises";
 
-// apps/client/sessions/synchronizer.ts
-import { randomUUID as randomUUID6 } from "node:crypto";
-import { join as join8 } from "node:path";
+// apps/client/connection.ts
+import { readFile, mkdir as mkdir5 } from "node:fs/promises";
+import { createInterface } from "node:readline/promises";
 
-// packages/protocol/session-key.ts
+// apps/client/root-lock.ts
 import { createHash as createHash7 } from "node:crypto";
-function sessionKey(agent, nativeId) {
-  return createHash7("sha256").update(JSON.stringify([agent, nativeId])).digest("hex");
+import { join as join7 } from "node:path";
+function acquireRootLock(root, stateDirectory) {
+  let lock;
+  try {
+    lock = openDatabase(
+      join7(stateDirectory, "locks", `${createHash7("sha256").update(root).digest("hex")}.sqlite3`),
+      [],
+      0
+    );
+    lock.exec("PRAGMA busy_timeout=0; BEGIN IMMEDIATE");
+    return lock;
+  } catch (error) {
+    lock?.close();
+    if (error instanceof Error && /locked|busy/.test(error.message))
+      throw new Error("Another sync or connect process is using this root.");
+    throw error;
+  }
 }
 
-// packages/storage/local-blob-store.ts
-import { createHash as createHash8, randomUUID as randomUUID5 } from "node:crypto";
-import { link, mkdir as mkdir5, open as open3, readFile as readFile2, unlink as unlink3 } from "node:fs/promises";
-import { dirname as dirname4, join as join6, resolve as resolve3 } from "node:path";
-function hash(content) {
-  return createHash8("sha256").update(content).digest("hex");
-}
-function hasCode(error, code) {
-  return error instanceof Error && "code" in error && error.code === code;
-}
-var BlobIntegrityError = class extends Error {
-  constructor(sha256) {
-    super(`Stored content failed integrity verification: ${sha256}`);
-    this.sha256 = sha256;
-    this.name = "BlobIntegrityError";
-  }
-  sha256;
-};
-var LocalBlobStore = class {
-  root;
-  constructor(root) {
-    this.root = resolve3(root);
-  }
-  async put(content) {
-    const bytes = Buffer.from(content);
-    const sha256 = hash(bytes);
-    const target = this.pathFor(sha256);
-    await mkdir5(dirname4(target), { recursive: true, mode: 448 });
-    const temporary = `${target}.${randomUUID5()}.tmp`;
-    const file = await open3(temporary, "wx", 384);
-    try {
-      try {
-        await file.writeFile(bytes);
-        await file.sync();
-      } finally {
-        await file.close();
+// apps/client/connection.ts
+async function connectProject(state, root, directory, options) {
+  const lock = acquireRootLock(root, directory);
+  try {
+    state.assertRootAvailable(root);
+    const transport = new HubClient(options.url);
+    const existing = state.binding(root);
+    const project = new ClientProjectState(state, root);
+    if (existing && existing.serverUrl !== transport.url)
+      throw new Error("This root is connected to another server.");
+    if (existing && options.project && options.project !== existing.workspaceId)
+      throw new Error("This root belongs to a different project. Use a different local root.");
+    const info = await transport.serverInfo();
+    if (!info.capabilities.includes("multi-project"))
+      throw new Error(
+        "This client requires a multi-project server. Update the server before connecting."
+      );
+    let member = options.member;
+    if (existing && !options.reconnect && !options.tokenFile) {
+      if (member && member !== existing.memberId)
+        throw new Error("This root belongs to a different member.");
+      const client2 = new HubClient(existing.serverUrl, 1e4, existing);
+      await client2.members();
+    } else if (options.tokenFile) {
+      const token = CredentialSchema.parse((await readFile(options.tokenFile, "utf8")).trim());
+      const deviceId = state.deviceFor(root);
+      const client2 = new HubClient(options.url, 1e4, { token, deviceId });
+      const binding2 = await client2.bind(deviceId, options.project ?? existing?.workspaceId);
+      if (options.project && binding2.workspaceId !== options.project)
+        throw new Error("Token belongs to a different project.");
+      state.saveBinding(root, client2.url, token, binding2);
+    } else {
+      member ??= existing?.memberId;
+      if (!member && process.stdin.isTTY) {
+        const rl = createInterface({ input: process.stdin, output: process.stderr });
+        try {
+          member = (await rl.question("Member ID: ")).trim();
+        } finally {
+          rl.close();
+        }
       }
+      if (!member) throw new Error("--member is required when input is not interactive.");
+      NameSchema.parse(member);
+      if (existing && existing.memberId !== member)
+        throw new Error("This root belongs to a different member.");
+      const projectId = options.project ?? existing?.workspaceId;
+      if (!projectId)
+        throw new Error(
+          "--project is required for a new connection; copy the command from the project settings."
+        );
+      NameSchema.parse(projectId);
+      const request = project.enrollment(
+        transport.url,
+        member,
+        projectId,
+        Boolean(options.reconnect)
+      );
+      const binding2 = await transport.enroll(request);
+      state.saveBinding(root, transport.url, request.credential, binding2);
+      project.completeEnrollment();
+    }
+    const binding = state.binding(root);
+    const client = new HubClient(binding.serverUrl, 1e4, binding);
+    if (info.capabilities.includes("project-config")) {
       try {
-        await link(temporary, target);
+        await applyProjectFile(project, await client.projectConfig());
       } catch (error) {
-        if (!hasCode(error, "EEXIST")) throw error;
-        await this.get(sha256);
-      }
-      if (process.platform !== "win32") {
-        let directory = dirname4(target);
-        for (; ; ) {
-          const handle = await open3(directory, "r");
-          try {
-            await handle.sync();
-          } finally {
-            await handle.close();
-          }
-          if (directory === dirname4(this.root)) break;
-          directory = dirname4(directory);
-        }
+        if (!(options.tokenFile && error instanceof Error && "code" in error && ["SETUP_REQUIRED", "PROJECT_NOT_FOUND"].includes(String(error.code))))
+          throw error;
       }
-    } finally {
-      await unlink3(temporary);
     }
-    return { sha256, size: bytes.byteLength };
-  }
-  async get(sha256) {
-    const target = this.pathFor(sha256);
-    let content;
-    try {
-      content = await readFile2(target);
-    } catch (error) {
-      if (hasCode(error, "ENOENT")) return void 0;
-      throw error;
-    }
-    if (hash(content) !== sha256) throw new BlobIntegrityError(sha256);
-    return content;
-  }
-  pathFor(sha256) {
-    if (!/^[a-f0-9]{64}$/.test(sha256)) throw new Error("Invalid SHA-256 content identifier.");
-    return join6(this.root, "sha256", sha256.slice(0, 2), sha256);
+    const own = await metadata(root, binding.memberId);
+    if (own && !own.directory) throw new Error("Member path is not a directory.");
+    if (!own) await mkdir5(await safePath(root, binding.memberId));
+    const { token: _, ...visible } = binding;
+    return { ...visible, configRevision: project.cached()?.config.configRevision ?? null };
+  } finally {
+    lock.close();
   }
-};
-
-// apps/client/sessions/source.ts
-import { open as open4, stat, realpath as realpath4 } from "node:fs/promises";
-import { relative as relative3, isAbsolute as isAbsolute3, sep as sep3 } from "node:path";
-import * as zlib from "node:zlib";
+}
 
-// apps/client/sessions/cursor.ts
-import { createHash as createHash9 } from "node:crypto";
-import { basename, dirname as dirname5, resolve as resolve4 } from "node:path";
-import { DatabaseSync as DatabaseSync2 } from "node:sqlite";
-import { fileURLToPath } from "node:url";
-function fields(bytes) {
-  const data = Buffer.from(bytes);
-  let offset = 0;
-  const varint = () => {
-    let value = 0n;
-    for (let i = 0; i < 10; i++) {
-      if (offset >= data.length) throw new Error("Truncated Cursor protobuf.");
-      const byte = data[offset++];
-      value |= BigInt(byte & 127) << BigInt(i * 7);
-      if (byte < 128) return value;
-    }
-    throw new Error("Invalid Cursor protobuf integer.");
-  };
-  const result = /* @__PURE__ */ new Map();
-  while (offset < data.length) {
-    const tag = varint();
-    const field = Number(tag >> 3n);
-    if (field < 1 || field > 536870911) throw new Error("Invalid Cursor protobuf field.");
-    const wire = Number(tag & 7n);
-    if (wire === 0) varint();
-    else if (wire === 1) offset += 8;
-    else if (wire === 5) offset += 4;
-    else if (wire === 2) {
-      const length = Number(varint());
-      if (!Number.isSafeInteger(length) || length > data.length - offset)
-        throw new Error("Truncated Cursor protobuf value.");
-      const values = result.get(field) ?? [];
-      values.push(data.subarray(offset, offset + length));
-      result.set(field, values);
-      offset += length;
-    } else throw new Error("Unsupported Cursor protobuf wire type.");
-    if (offset > data.length) throw new Error("Truncated Cursor protobuf value.");
-  }
-  return result;
+// apps/client/runtime/ipc.ts
+import { createConnection } from "node:net";
+import { mkdir as mkdir6, lstat as lstat3, chmod } from "node:fs/promises";
+import { join as join8 } from "node:path";
+import { z as z10 } from "zod";
+var RequestSchema = z10.object({
+  method: z10.enum(["ping", "wake", "status", "once"]),
+  root: z10.string().max(4096).optional()
+}).strict();
+function socketPath(directory) {
+  return join8(
+    "/tmp",
+    `teammy-${process.getuid?.() ?? "user"}-${rootKey(directory)}`,
+    "control.sock"
+  );
 }
-function readCursor(path, projectDir) {
-  const db = new DatabaseSync2(path, { readOnly: true });
-  try {
-    db.exec("PRAGMA query_only=ON; PRAGMA busy_timeout=100; BEGIN");
-    if (db.prepare("PRAGMA user_version").get()?.user_version !== 1)
-      throw new Error("Unsupported Cursor CLI store version (expected 1).");
-    const row = db.prepare("SELECT value FROM meta WHERE key='0' AND length(value)<=2097152").get();
-    const hex = row?.value;
-    if (typeof hex !== "string" || !/^(?:[a-fA-F0-9]{2})+$/.test(hex))
-      throw new Error("Invalid Cursor metadata.");
-    const meta = object(JSON.parse(Buffer.from(hex, "hex").toString("utf8")));
-    if (typeof meta.agentId !== "string" || meta.agentId !== basename(dirname5(path)) || meta.subagentInfo != null)
-      throw new Error("Invalid or delegated Cursor session identity.");
-    let budget = 64 * 1024 * 1024;
-    const blob = (id) => {
-      if (!/^[a-f0-9]{64}$/.test(id)) throw new Error("Invalid Cursor blob reference.");
-      const value = db.prepare("SELECT data FROM blobs WHERE id=? AND length(data)<=?").get(id, budget)?.data;
-      if (!(value instanceof Uint8Array))
-        throw new Error("Cursor history missing or exceeds 64 MiB.");
-      const bytes = Buffer.from(value);
-      budget -= bytes.length;
-      if (createHash9("sha256").update(bytes).digest("hex") !== id)
-        throw new Error("Cursor blob failed integrity verification.");
-      return bytes;
+async function prepareSocketDirectory(directory) {
+  const path = join8(socketPath(directory), "..");
+  await mkdir6(path, { recursive: true, mode: 448 });
+  const stat2 = await lstat3(path);
+  if (!stat2.isDirectory() || stat2.isSymbolicLink() || stat2.uid !== process.getuid?.())
+    throw new Error("Unsafe daemon socket directory.");
+  await chmod(path, 448);
+}
+async function daemonRequest(directory, input, timeout = 15e3) {
+  RequestSchema.parse(input);
+  return new Promise((resolve9, reject) => {
+    const socket = createConnection(socketPath(directory));
+    socket.setEncoding("utf8");
+    let body = "";
+    let done = false;
+    const finish = (error, result2) => {
+      if (done) return;
+      done = true;
+      socket.destroy();
+      if (error) reject(error);
+      else resolve9(result2);
     };
-    const root = fields(blob(String(meta.latestRootBlobId)));
-    const bucket = basename(dirname5(dirname5(path)));
-    const md5 = (cwd2) => createHash9("md5").update(resolve4(cwd2)).digest("hex");
-    let cwd = md5(projectDir) === bucket ? projectDir : void 0;
-    for (const uri of root.get(9) ?? []) {
+    socket.setTimeout(
+      timeout,
+      () => finish(new Error("Background service did not respond. Run teammy status."))
+    );
+    socket.on("error", (e) => finish(e));
+    socket.on("end", () => {
+      if (!done)
+        finish(
+          Object.assign(new Error("Background service disconnected."), { code: "ECONNRESET" })
+        );
+    });
+    socket.on("connect", () => socket.write(JSON.stringify(input) + "\n"));
+    socket.on("data", (chunk) => {
+      body += chunk.toString();
+      if (body.length > 256 * 1024) return finish(new Error("Oversized daemon response."));
+      if (!body.includes("\n")) return;
       try {
-        const native = fileURLToPath(uri.toString("utf8"));
-        if (md5(native) === bucket) {
-          cwd = native;
-          break;
-        }
-      } catch {
-      }
-    }
-    if (!cwd) throw new Error("Cursor workspace cannot be verified against its storage bucket.");
-    const refs = [];
-    for (const archive of root.get(13) ?? root.get(11) ?? [])
-      refs.push(...fields(blob(archive.toString("hex"))).get(1) ?? []);
-    refs.push(...root.get(1) ?? []);
-    if (refs.length > 5e4) throw new Error("Cursor history exceeds 50000 messages.");
-    const messages = [];
-    const counts = /* @__PURE__ */ new Map();
-    for (const ref of refs) {
-      const key = ref.toString("hex");
-      const message2 = object(
-        JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(blob(key)))
-      );
-      const cursor = object(object(message2.providerOptions).cursor);
-      if (cursor.isSummary || !["user", "assistant"].includes(String(message2.role))) continue;
-      let text = textContent(message2.content);
-      if (message2.role === "user") {
-        if (!cursor.requestId) continue;
-        const start = text.indexOf("<user_query>");
-        const end = text.lastIndexOf("</user_query>");
-        if (start >= 0 && end > start) text = text.slice(start + 12, end).trim();
+        const response = JSON.parse(body.split("\n")[0]);
+        if (response.ok) finish(void 0, response.result);
+        else finish(new Error(response.error ?? "Background operation failed."));
+      } catch (e) {
+        finish(e);
       }
-      if (!text.trim()) continue;
-      const id = createHash9("sha256").update(JSON.stringify([message2.role, cursor.requestId ?? "", text])).digest("hex");
-      const count = (counts.get(id) ?? 0) + 1;
-      counts.set(id, count);
-      messages.push({
-        id: `${id}#${count}`,
-        role: message2.role,
-        text,
-        source: `blob:${key}`
-      });
-    }
-    return SessionSnapshotSchema.parse({
-      formatVersion: 1,
-      adapterVersion: 1,
-      agent: "cursor",
-      nativeId: meta.agentId,
-      cwd,
-      messages
     });
-  } finally {
-    db.close();
+  });
+}
+async function runningDaemon(directory) {
+  try {
+    return await daemonRequest(directory, { method: "ping" }, 1e3);
+  } catch (error) {
+    if (["ENOENT", "ECONNREFUSED", "ECONNRESET", "EPIPE"].includes(
+      String(error.code)
+    ))
+      return null;
+    throw error;
   }
 }
 
-// apps/client/sessions/source.ts
-var MAX_SOURCE_BYTES = 64 * 1024 * 1024;
-async function sourceSignature(path, agent) {
-  const paths = agent === "cursor" ? [path, `${path}-wal`] : [path];
-  const signatures = [];
-  for (const file of paths) {
+// apps/client/runtime/service.ts
+import { execFile as execFile2 } from "node:child_process";
+import { promisify as promisify2 } from "node:util";
+import { homedir as homedir2 } from "node:os";
+import { dirname as dirname5, join as join9, resolve as resolve4 } from "node:path";
+import { mkdir as mkdir7, readFile as readFile2, writeFile, rename as rename3 } from "node:fs/promises";
+import { setTimeout as setTimeout3 } from "node:timers/promises";
+var execute = promisify2(execFile2);
+var exec2 = (file, args, options = {}) => execute(file, args, { timeout: 45e3, ...options });
+var xml = (s) => s.replace(
+  /[<>&"']/g,
+  (c) => ({ "<": "&lt;", ">": "&gt;", "&": "&amp;", '"': "&quot;", "'": "&apos;" })[c]
+);
+var unit = (s) => '"' + s.replace(/%/g, "%%").replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\$/g, () => "$$") + '"';
+function serviceDefinition(directory, executable, entry, platform = process.platform, userHome = homedir2()) {
+  for (const value of [directory, executable, entry])
+    if (/[\r\n\0]/.test(value)) throw new Error("Invalid service path.");
+  const id = `com.teammy.client.${rootKey(directory)}`;
+  const args = [executable, entry, "_daemon", "--state-dir", directory];
+  if (platform === "darwin")
+    return {
+      id,
+      path: join9(userHome, "Library", "LaunchAgents", id + ".plist"),
+      content: `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0"><dict><key>Label</key><string>${id}</string><key>ProgramArguments</key><array>${args.map((a) => `<string>${xml(a)}</string>`).join("")}</array><key>RunAtLoad</key><true/><key>KeepAlive</key><true/><key>ThrottleInterval</key><integer>30</integer><key>WorkingDirectory</key><string>${xml(userHome)}</string></dict></plist>
+`
+    };
+  if (platform === "linux")
+    return {
+      id: id + ".service",
+      path: join9(userHome, ".config", "systemd", "user", id + ".service"),
+      content: `[Unit]
+Description=Teammy background synchronization
+[Service]
+Type=simple
+ExecStart=${args.map(unit).join(" ")}
+Restart=always
+RestartSec=30
+UMask=0077
+StandardOutput=null
+StandardError=journal
+[Install]
+WantedBy=default.target
+`
+    };
+  throw new Error(
+    "Automatic background sync currently supports macOS and Linux. Use --no-start with sync --foreground on other systems."
+  );
+}
+async function checkServiceSupport() {
+  try {
+    if (process.platform === "darwin")
+      await exec2("launchctl", ["print", `gui/${process.getuid()}`], {
+        maxBuffer: 4 * 1024 * 1024
+      });
+    else if (process.platform === "linux") await exec2("systemctl", ["--user", "show-environment"]);
+    else throw new Error("unsupported");
+  } catch {
+    throw new Error(
+      "A login-session service manager is required (macOS launchd or Linux systemd --user). Use --no-start and sync --foreground where unavailable."
+    );
+  }
+}
+async function bootstrapLaunchAgent(path) {
+  const deadline = Date.now() + 1e4;
+  for (; ; ) {
     try {
-      const s = await stat(file, { bigint: true });
-      if (!s.isFile()) throw new Error("Session source must be a regular file.");
-      signatures.push([
-        String(s.dev),
-        String(s.ino),
-        String(s.size),
-        String(s.mtimeNs),
-        String(s.ctimeNs)
-      ]);
+      await exec2("launchctl", ["bootstrap", `gui/${process.getuid()}`, path]);
+      return;
     } catch (error) {
-      if (file !== path && error.code === "ENOENT")
-        signatures.push(null);
-      else throw error;
+      if (error.code !== 5 || Date.now() >= deadline) throw error;
+      await setTimeout3(250);
     }
   }
-  return JSON.stringify(signatures);
 }
-async function readSource(agent, path, projectDir) {
-  const signature2 = await sourceSignature(path, agent);
-  let result;
-  if (agent === "cursor") result = { snapshot: readCursor(path, projectDir), incomplete: false };
-  else {
-    const handle = await open4(path, "r");
-    let bytes;
+async function ensureDaemon(directory, version) {
+  const definition = serviceDefinition(directory, process.execPath, resolve4(process.argv[1]));
+  let old = "";
+  try {
+    old = await readFile2(definition.path, "utf8");
+  } catch (e) {
+    if (e.code !== "ENOENT") throw e;
+  }
+  const alive = await runningDaemon(directory);
+  if (alive && old === definition.content && alive.version === version) return;
+  await checkServiceSupport();
+  await mkdir7(dirname5(definition.path), { recursive: true });
+  if (old !== definition.content) {
+    const temp = definition.path + `.${process.pid}.tmp`;
+    await writeFile(temp, definition.content, { mode: 384 });
+    await rename3(temp, definition.path);
+  }
+  if (process.platform === "darwin") {
+    const domain = `gui/${process.getuid()}`, target = `${domain}/${definition.id}`;
+    let loaded = false;
     try {
-      const size = (await handle.stat()).size;
-      if (size > MAX_SOURCE_BYTES) throw new Error("Session source exceeds 64 MiB.");
-      bytes = Buffer.alloc(size + 1);
-      let offset = 0;
-      while (offset < bytes.length) {
-        const read = await handle.read(bytes, offset, bytes.length - offset, offset);
-        if (!read.bytesRead) break;
-        offset += read.bytesRead;
-      }
-      bytes = bytes.subarray(0, offset);
-      if (offset > size) throw new Error("Session source changed while reading; retry next cycle.");
-    } finally {
-      await handle.close();
+      await exec2("launchctl", ["print", target]);
+      loaded = true;
+    } catch {
     }
-    if (agent === "dsh" && path.endsWith(".zstd")) {
-      const decompress = zlib.zstdDecompressSync;
-      if (!decompress)
-        throw new Error(
-          "Compressed DSH sessions require Node.js with zstd support (22.15+ or 24+)."
-        );
-      bytes = decompress(bytes, { maxOutputLength: MAX_SOURCE_BYTES });
+    if (loaded && (old !== definition.content || alive?.version !== version)) {
+      await exec2("launchctl", ["bootout", target]);
+      loaded = false;
     }
-    result = normalizeJsonl(agent, new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+    if (!loaded) await bootstrapLaunchAgent(definition.path);
+    await exec2("launchctl", ["kickstart", target]);
+  } else {
+    await exec2("systemctl", ["--user", "daemon-reload"]);
+    await exec2("systemctl", ["--user", "enable", definition.id]);
+    await exec2("systemctl", [
+      "--user",
+      old !== definition.content || alive?.version !== version ? "restart" : "start",
+      definition.id
+    ]);
   }
-  if (signature2 !== await sourceSignature(path, agent))
-    throw new Error("Session source changed while reading; retry next cycle.");
-  const cwd = await realpath4(result.snapshot.cwd);
-  const project = await realpath4(projectDir);
-  const rel = relative3(project, cwd);
-  if (rel === ".." || rel.startsWith(`..${sep3}`) || isAbsolute3(rel))
-    throw new Error("Session cwd is outside the registered project.");
-  return { ...result, signature: signature2 };
+  const deadline = Date.now() + 15e3;
+  while (Date.now() < deadline) {
+    if ((await runningDaemon(directory))?.version === version) return;
+    await setTimeout3(150);
+  }
+  throw new Error(
+    "Background service did not start. Run teammy logs and check the user service manager."
+  );
+}
+async function wakeDaemon(directory, version) {
+  await ensureDaemon(directory, version);
+  await daemonRequest(directory, { method: "wake" });
 }
 
-// apps/client/sessions/discovery.ts
-import { opendir as opendir2 } from "node:fs/promises";
-import { join as join7 } from "node:path";
-async function* candidates(directory, agent) {
-  const queue = [directory];
-  while (queue.length) {
-    const current = queue.shift();
-    const dir = await opendir2(current);
-    for await (const entry of dir) {
-      const path = join7(current, entry.name);
-      if (entry.isDirectory()) queue.push(path);
-      if (entry.isFile() && (agent === "cursor" ? entry.name === "store.db" : entry.name.endsWith(".jsonl") || agent === "dsh" && entry.name.endsWith(".jsonl.zstd")))
-        yield path;
-      else yield null;
-    }
-  }
+// apps/client/output.ts
+var styled = () => Boolean(
+  process.stdout.isTTY && process.env.NO_COLOR === void 0 && process.env.TERM !== "dumb"
+);
+function bold(value) {
+  const clean = redact(value);
+  return styled() ? `\x1B[1m${clean}\x1B[22m` : clean;
 }
-var SessionDiscovery = class {
-  constructor(state) {
-    this.state = state;
-  }
-  state;
-  scans = /* @__PURE__ */ new Map();
-  async cycle() {
-    const issues = [];
-    let entries = 500;
-    let reads = 5;
-    const configs = this.state.directories();
-    for (const [directory, scan] of this.scans) {
-      if (!configs.some((config) => config.directory === directory)) {
-        await scan.iterator.return(void 0);
-        this.scans.delete(directory);
-      }
+function result(title, detail) {
+  process.stdout.write(`${bold(title)}${detail ? `
+  ${redact(detail)}` : ""}
+`);
+}
+function json(value) {
+  process.stdout.write(JSON.stringify(value, null, 2) + "\n");
+}
+
+// apps/client/client-command.ts
+var locationOptions = {
+  root: { type: "string", default: resolve5("workspaces") },
+  "state-dir": { type: "string", default: join10(homedir3(), ".teammy", "client") },
+  json: { type: "boolean" },
+  help: { type: "boolean", short: "h" }
+};
+async function runClientCommand(command, args, version) {
+  const { values } = parseArgs2({
+    args,
+    options: {
+      ...locationOptions,
+      url: { type: "string" },
+      project: { type: "string" },
+      member: { type: "string" },
+      "token-file": { type: "string" },
+      reconnect: { type: "boolean" },
+      "no-start": { type: "boolean" },
+      all: { type: "boolean" }
     }
-    for (const config of configs) {
-      let scan = this.scans.get(config.directory);
-      if (!scan) {
-        scan = { iterator: candidates(config.directory, config.agent), nextAt: 0 };
-        this.scans.set(config.directory, scan);
+  });
+  if (values.help) {
+    process.stdout.write(
+      command === "connect" ? "Usage: teammy connect --url URL --project ID --member ID [--root DIR]\n\nCreates ./workspaces, adds Git ignore rules and starts login-session background sync.\nAdvanced: --no-start, --reconnect (stop sync first), --token-file FILE, --state-dir DIR, --json\n" : `Usage: teammy ${command} [--root DIR] [--state-dir DIR] [--json]${command === "logs" ? " [--all]" : ""}
+`
+    );
+    return 0;
+  }
+  const root = await workspacePath(values.root), directory = await stateLocation(root, values["state-dir"]);
+  const state = new ClientState(directory), log = new ClientLog(directory), runtime = new RuntimeState(state);
+  try {
+    if (command === "logs") {
+      const entries = log.tail(values.all ? void 0 : root);
+      if (values.json) json(entries);
+      else if (!entries.length) result("\u6CA1\u6709\u8BCA\u65AD\u8BB0\u5F55");
+      else
+        for (const item of entries)
+          process.stdout.write(
+            `${item.at}  ${item.event}${item.detail ? "  " + item.detail : ""}
+`
+          );
+      return 0;
+    }
+    if (command === "status") {
+      const binding = state.binding(root);
+      if (!binding) throw new Error("This workspace is not connected. Run teammy connect first.");
+      const daemon = await runningDaemon(directory);
+      const current = daemon ? await daemonRequest(directory, { method: "status", root }) : { enabled: runtime.enabled(root), running: false, status: runtime.status(root) };
+      const { token: _, ...publicBinding } = binding;
+      if (values.json)
+        json({
+          ...current,
+          binding: publicBinding,
+          control: readControlStatus(state, root),
+          daemon,
+          logPath: log.path
+        });
+      else {
+        const status = current.status;
+        const title = !current.enabled ? "\u540C\u6B65\u5DF2\u505C\u6B62" : !current.running ? "\u540E\u53F0\u540C\u6B65\u672A\u8FD0\u884C" : status?.issue ? "\u540C\u6B65\u7B49\u5F85\u5904\u7406" : status?.pendingDownloads || !status?.lastSuccessAt ? "\u9996\u6B21\u540C\u6B65\u4E2D" : "\u540C\u6B65\u5DF2\u5F00\u542F";
+        result(
+          title,
+          new ClientProjectState(state, root).cached()?.config.projectName ?? binding.workspaceId
+        );
+        if (status?.issue) result("\u5F85\u5904\u7406", status.issue);
+        else if (status?.lastSuccessAt)
+          process.stdout.write(`  \u6700\u8FD1\u6210\u529F\uFF1A${status.lastSuccessAt}
+`);
+        if (status?.pendingFiles || status?.pendingDownloads)
+          process.stdout.write(
+            `  \u5F85\u4E0A\u4F20 ${status.pendingFiles} \xB7 \u5F85\u4E0B\u8F7D ${status.pendingDownloads}
+`
+          );
       }
-      if (scan.nextAt > Date.now()) continue;
+      return 0;
+    }
+    const existing = state.binding(root);
+    const url = values.url ?? (values.reconnect ? existing?.serverUrl : void 0);
+    if (!url) throw new Error("--url is required.");
+    const transport = new HubClient(url);
+    const selectedProject = values.project ?? (values.reconnect ? existing?.workspaceId : void 0);
+    const project = selectedProject === void 0 && values["token-file"] ? void 0 : NameSchema.parse(selectedProject);
+    let member = values.member ?? (values.reconnect ? existing?.memberId : void 0);
+    if (!member && !values["token-file"] && process.stdin.isTTY) {
+      const rl = createInterface2({ input: process.stdin, output: process.stderr });
       try {
-        while (entries > 0 && reads > 0) {
-          entries--;
-          const entry = await scan.iterator.next();
-          if (entry.done) {
-            scan.iterator = candidates(config.directory, config.agent);
-            scan.nextAt = Date.now() + 3e5;
-            break;
-          }
-          const path = entry.value;
-          if (!path || this.state.get(path)) continue;
-          const signature2 = await sourceSignature(path, config.agent);
-          const db = this.state.state.db;
-          if (db.prepare(
-            "SELECT 1 FROM session_discovery_cache WHERE root=? AND path=? AND signature=?"
-          ).get(this.state.root, path, signature2))
-            continue;
-          reads--;
-          try {
-            const result = await readSource(config.agent, path, config.projectDir);
-            if (result.incomplete) continue;
-            this.state.track(config.agent, path, config.projectDir);
-          } catch (error) {
-            const message2 = error instanceof Error ? error.message : "Discovery failed.";
-            if (!message2.includes("outside the registered project"))
-              issues.push(`${path}: ${message2}`);
-            if (!message2.includes("outside the registered project")) continue;
-          }
-          db.prepare(
-            "INSERT INTO session_discovery_cache VALUES (?,?,?) ON CONFLICT(root,path) DO UPDATE SET signature=excluded.signature"
-          ).run(this.state.root, path, signature2);
-        }
-      } catch (error) {
-        issues.push(
-          `${config.directory}: ${error instanceof Error ? error.message : "Discovery failed."}`
-        );
-        await scan.iterator.return(void 0);
-        scan.iterator = candidates(config.directory, config.agent);
-        scan.nextAt = Date.now() + 3e5;
+        member = (await rl.question("Member ID: ")).trim();
+      } finally {
+        rl.close();
       }
     }
-    return issues;
-  }
-  async close() {
-    for (const scan of this.scans.values()) await scan.iterator.return(void 0);
+    if (!values["token-file"]) member = NameSchema.parse(member);
+    await prepareWorkspace(
+      state,
+      root,
+      { url: transport.url, project: project ?? "", member: member ?? "" },
+      Boolean(values.reconnect)
+    );
+    if (!values["no-start"]) await checkServiceSupport();
+    const connected = await connectProject(state, root, directory, {
+      url: transport.url,
+      project,
+      member,
+      tokenFile: values["token-file"],
+      reconnect: values.reconnect
+    });
+    completePreparation(state, root);
+    runtime.enable(root, !values["no-start"]);
+    log.write("workspace.connected", root);
+    if (!values["no-start"]) await wakeDaemon(directory, version);
+    if (values.json) json({ ...connected, syncEnabled: !values["no-start"] });
+    else result(values["no-start"] ? "\u9879\u76EE\u5DF2\u8FDE\u63A5" : "\u5DF2\u8FDE\u63A5\uFF0C\u540E\u53F0\u540C\u6B65\u5DF2\u542F\u52A8", root);
+    return 0;
+  } catch (e) {
+    log.write(`${command}.failed`, root, diagnostic(e));
+    throw e;
+  } finally {
+    state.close();
   }
-};
+}
 
-// apps/client/sessions/synchronizer.ts
-var SessionSynchronizer = class {
-  constructor(state, root, directory, signal) {
-    this.root = root;
-    this.directory = directory;
-    const binding = state.binding(root);
-    if (!binding) throw new Error("Connect this root before collecting sessions.");
-    this.client = new HubClient(binding.serverUrl, 1e4, binding, signal);
-    this.blobs = new LocalBlobStore(join8(directory, "blobs"));
-    this.index = new SessionState(state, root);
-    this.discovery = new SessionDiscovery(this.index);
+// apps/client/files/synchronizer.ts
+import { randomUUID as randomUUID6 } from "node:crypto";
+import { watch } from "node:fs";
+import { lstat as lstat4, mkdir as mkdir9 } from "node:fs/promises";
+import { join as join12, sep as sep4 } from "node:path";
+import { performance } from "node:perf_hooks";
+
+// packages/storage/local-blob-store.ts
+import { createHash as createHash8, randomUUID as randomUUID5 } from "node:crypto";
+import { link, mkdir as mkdir8, open as open3, readFile as readFile3, unlink as unlink3 } from "node:fs/promises";
+import { dirname as dirname6, join as join11, resolve as resolve6 } from "node:path";
+function hash(content) {
+  return createHash8("sha256").update(content).digest("hex");
+}
+function hasCode(error, code) {
+  return error instanceof Error && "code" in error && error.code === code;
+}
+var BlobIntegrityError = class extends Error {
+  constructor(sha256) {
+    super(`Stored content failed integrity verification: ${sha256}`);
+    this.sha256 = sha256;
+    this.name = "BlobIntegrityError";
   }
+  sha256;
+};
+var LocalBlobStore = class {
   root;
-  directory;
-  index;
-  client;
-  blobs;
-  discovery;
-  capable = false;
-  async cycle() {
-    const report = { published: 0, checked: 0, issues: [] };
-    report.issues.push(...await consumeHints(this.directory, this.root, this.index));
-    report.issues.push(...await this.discovery.cycle());
-    const sources = this.index.sources(void 0, 200);
-    if (sources.length && !this.capable) {
-      const info = await this.client.serverInfo();
-      if (!["blobs", "session-revisions"].every(
-        (capability) => info.capabilities.includes(capability)
-      ))
-        throw new Error("Server does not support session publication. Upgrade the server first.");
-      this.capable = true;
-    }
-    let reads = 5;
-    let uploads = 5;
-    for (const source of sources) {
-      if (reads <= 0 || uploads <= 0 || report.checked >= 200) break;
-      report.checked++;
-      this.index.checked(source.path, source.lastError);
+  constructor(root) {
+    this.root = resolve6(root);
+  }
+  async put(content) {
+    const bytes = Buffer.from(content);
+    const sha256 = hash(bytes);
+    const target = this.pathFor(sha256);
+    await mkdir8(dirname6(target), { recursive: true, mode: 448 });
+    const temporary = `${target}.${randomUUID5()}.tmp`;
+    const file = await open3(temporary, "wx", 384);
+    try {
       try {
-        if (source.pending) {
-          if (source.retryAt > Date.now()) {
-            if (source.lastError)
-              report.issues.push(`${source.path}: ${source.lastError} (retry deferred)`);
-            continue;
-          }
-          uploads--;
-          await this.flush(source);
-          report.published++;
-          continue;
-        }
-        const signature2 = await sourceSignature(source.path, source.agent);
-        if (signature2 === source.signature && Date.now() - source.verifiedAt < 864e5) {
-          this.index.checked(source.path);
-          continue;
-        }
-        reads--;
-        const observed = await readSource(source.agent, source.path, source.projectDir);
-        if (observed.incomplete)
-          throw new Error("Final session record is incomplete; waiting for the next save.");
-        if (!observed.snapshot.messages.length) {
-          this.index.checked(source.path);
-          continue;
-        }
-        const key = sessionKey(source.agent, observed.snapshot.nativeId);
-        if (source.key && source.key !== key)
-          throw new Error(
-            "Native session identity changed at this path; register the new source explicitly."
-          );
-        const bytes = Buffer.from(JSON.stringify(observed.snapshot));
-        if (bytes.length > MAX_BLOB_BYTES)
-          throw new Error("Normalized session exceeds the 10 MiB snapshot limit.");
-        const blob = await this.blobs.put(bytes);
-        let revision = source.revision;
-        if (!source.key) {
+        await file.writeFile(bytes);
+        await file.sync();
+      } finally {
+        await file.close();
+      }
+      try {
+        await link(temporary, target);
+      } catch (error) {
+        if (!hasCode(error, "EEXIST")) throw error;
+        await this.get(sha256);
+      }
+      if (process.platform !== "win32") {
+        let directory = dirname6(target);
+        for (; ; ) {
+          const handle = await open3(directory, "r");
           try {
-            const owner = this.index.state.binding(this.root).memberId;
-            const current = await this.client.session(owner, key);
-            if (current.blob.sha256 !== blob.sha256 && !source.adoptExisting)
-              throw new Error(
-                "Server session already exists with different content; inspect it, then track with --adopt-existing to continue."
-              );
-            revision = current.revision;
-          } catch (error) {
-            if (!(error instanceof HubRequestError && error.code === "SESSION_NOT_FOUND"))
-              throw error;
+            await handle.sync();
+          } finally {
+            await handle.close();
           }
-          this.index.baseline(source.path, key, revision);
-        }
-        if (blob.sha256 === source.hash) {
-          this.index.acknowledge(source.path, revision, blob.sha256, observed.signature);
-          continue;
+          if (directory === dirname6(this.root)) break;
+          directory = dirname6(directory);
         }
-        this.index.stage(
-          source.path,
-          { operationId: randomUUID6(), sessionKey: key, parentRevision: revision, blob },
-          observed.signature
-        );
-        uploads--;
-        await this.flush(this.index.get(source.path));
-        report.published++;
-      } catch (error) {
-        const message2 = error instanceof Error ? error.message : "Session synchronization failed.";
-        this.index.checked(source.path, message2);
-        report.issues.push(`${source.path}: ${message2}`);
       }
+    } finally {
+      await unlink3(temporary);
     }
-    return report;
+    return { sha256, size: bytes.byteLength };
   }
-  async flush(source) {
-    const request = source.pending;
+  async get(sha256) {
+    const target = this.pathFor(sha256);
+    let content;
     try {
-      const { missing: missing2 } = await this.client.missingBlobs([request.blob.sha256]);
-      if (missing2.some((hash2) => hash2 !== request.blob.sha256))
-        throw new Error("Server requested unrelated session content.");
-      if (missing2.length) {
-        const bytes = await this.blobs.get(request.blob.sha256);
-        if (!bytes) throw new Error("Queued session snapshot is missing.");
-        const ref = await this.client.uploadBlob(request.blob.sha256, bytes);
-        if (ref.sha256 !== request.blob.sha256 || ref.size !== request.blob.size)
-          throw new Error("Server acknowledged different session content.");
-      }
-      const result = await this.client.commitSession(request);
-      if (result.operationId !== request.operationId || result.revision < request.parentRevision || result.revision > request.parentRevision + 1)
-        throw new Error("Invalid session acknowledgement.");
-      this.index.acknowledge(
-        source.path,
-        result.revision,
-        request.blob.sha256,
-        source.pendingSignature
-      );
+      content = await readFile3(target);
     } catch (error) {
-      const blocked = error instanceof HubRequestError && error.status >= 400 && error.status < 500 && ![408, 429].includes(error.status);
-      this.index.postpone(
-        source,
-        error instanceof Error ? error.message : "Upload failed.",
-        blocked
-      );
+      if (hasCode(error, "ENOENT")) return void 0;
       throw error;
     }
+    if (hash(content) !== sha256) throw new BlobIntegrityError(sha256);
+    return content;
   }
-  async close() {
-    await this.discovery.close();
+  pathFor(sha256) {
+    if (!/^[a-f0-9]{64}$/.test(sha256)) throw new Error("Invalid SHA-256 content identifier.");
+    return join11(this.root, "sha256", sha256.slice(0, 2), sha256);
   }
 };
 
-// apps/client/files/synchronizer.ts
-import { randomUUID as randomUUID7 } from "node:crypto";
-import { watch } from "node:fs";
-import { lstat as lstat2, mkdir as mkdir6 } from "node:fs/promises";
-import { join as join9, sep as sep4 } from "node:path";
-import { performance } from "node:perf_hooks";
-
 // apps/client/publication.ts
 var PublicationQueue = class {
   constructor(state, blobs, transport) {
@@ -2255,8 +2493,8 @@ var PublicationQueue = class {
         if (!hashes.includes(hash2)) throw new Error("Server requested unrelated content.");
         const content = await this.blobs.get(hash2);
         if (!content) throw new Error("A queued content snapshot is missing from local storage.");
-        const result = await this.transport.uploadBlob(hash2, content);
-        if (result.sha256 !== hash2 || result.size !== content.byteLength)
+        const result2 = await this.transport.uploadBlob(hash2, content);
+        if (result2.sha256 !== hash2 || result2.size !== content.byteLength)
           throw new Error("Server acknowledged different content.");
       }
       this.state.acknowledge(root, await this.transport.commitFiles(pending.batch));
@@ -2285,10 +2523,10 @@ var FileSynchronizer = class {
     if (!binding) throw new Error("Connect this root before synchronizing.");
     this.binding = binding;
     this.client = new HubClient(binding.serverUrl, 3e4, binding, this.abort.signal);
-    this.blobs = new LocalBlobStore(join9(stateDirectory, "blobs"));
+    this.blobs = new LocalBlobStore(join12(stateDirectory, "blobs"));
     this.queue = new PublicationQueue(state, this.blobs, this.client);
     this.index = new SyncState(state, root);
-    this.ownRoot = join9(root, binding.memberId);
+    this.ownRoot = join12(root, binding.memberId);
     const started = performance.now();
     const epoch = Date.now();
     this.clock = options.clock ?? (() => epoch + performance.now() - started);
@@ -2344,7 +2582,7 @@ var FileSynchronizer = class {
     try {
       try {
         await this.initializeAuthor();
-        const ownStat = await lstat2(await safePath(this.root, this.binding.memberId));
+        const ownStat = await lstat4(await safePath(this.root, this.binding.memberId));
         if (!ownStat.isDirectory() || ownStat.isSymbolicLink())
           throw new Error("Author directory is unavailable or is a symlink.");
         this.listen();
@@ -2403,11 +2641,7 @@ var FileSynchronizer = class {
   async initializeAuthor() {
     if (this.state.publication(this.root).initialized) return;
     const manifest = await this.manifest(this.binding.memberId);
-    if (manifest.revision > 0) {
-      if (!this.options.adoptBaseline)
-        throw new Error(
-          "Published history exists but the local baseline is missing. Verify local files, then use --adopt-baseline."
-        );
+    if (manifest.revision > 0 && this.options.adoptBaseline) {
       for (const file of manifest.files) {
         const local = await readStable(this.ownRoot, file.path);
         if (local.sha256 !== file.sha256)
@@ -2415,12 +2649,11 @@ var FileSynchronizer = class {
             `Cannot adopt baseline: local ${file.path} differs from the published file.`
           );
       }
-    } else {
-      const ownerPath = await safePath(this.root, this.binding.memberId);
-      await mkdir6(ownerPath).catch((error) => {
-        if (error.code !== "EEXIST") throw error;
-      });
     }
+    const ownerPath = await safePath(this.root, this.binding.memberId);
+    await mkdir9(ownerPath).catch((error) => {
+      if (error.code !== "EEXIST") throw error;
+    });
     this.state.initializePublication(this.root, manifest.revision, manifest.files);
   }
   listen() {
@@ -2512,7 +2745,7 @@ var FileSynchronizer = class {
             this.index.event(row.path, this.clock());
             continue;
           }
-          if (baseline.has(row.path)) {
+          if (baseline.has(row.path) && row.seenLocal) {
             changes.push({ kind: "delete", path: row.path });
             planned.delete(row.path);
           } else {
@@ -2526,7 +2759,12 @@ var FileSynchronizer = class {
         const collision = [...planned.keys()].some(
           (path) => path !== row.path && (path.toLowerCase() === key || path.toLowerCase().startsWith(`${key}/`) || key.startsWith(`${path.toLowerCase()}/`))
         );
-        if (collision) continue;
+        if (collision) {
+          issues.push(
+            `${row.path}: conflicts with a preserved server path; rename the local file to publish it.`
+          );
+          continue;
+        }
         const local = await readStable(this.ownRoot, row.path);
         bytes += local.bytes.length;
         if (local.signature !== row.signature || this.index.get(row.path)?.generation !== row.generation) {
@@ -2537,245 +2775,1027 @@ var FileSynchronizer = class {
           this.index.clean(row.path, row.generation, local.sha256, this.clock());
           continue;
         }
-        const ref = await this.blobs.put(local.bytes);
-        changes.push({ kind: "upsert", path: row.path, ...ref });
-        planned.set(row.path, ref);
-        snapshots.push({ path: row.path, generation: row.generation, hash: local.sha256 });
+        const ref = await this.blobs.put(local.bytes);
+        changes.push({ kind: "upsert", path: row.path, ...ref });
+        planned.set(row.path, ref);
+        snapshots.push({ path: row.path, generation: row.generation, hash: local.sha256 });
+      } catch (error) {
+        this.index.event(row.path, this.clock());
+        issues.push(`${row.path}: ${message(error)}`);
+      }
+    }
+    if (!changes.length) return;
+    const rootStat = await lstat4(this.ownRoot);
+    if (!rootStat.isDirectory() || rootStat.isSymbolicLink())
+      throw new Error("Author directory disappeared before publication.");
+    this.state.enqueue(this.root, {
+      operationId: randomUUID6(),
+      parentRevision: this.state.publication(this.root).revision,
+      changes
+    });
+    for (const snapshot of snapshots)
+      this.index.clean(snapshot.path, snapshot.generation, snapshot.hash, this.clock());
+  }
+  async receive(owner) {
+    if (!this.index.job(owner)) {
+      const revision = this.index.revision(owner);
+      if (revision === void 0) {
+        const manifest = await this.manifest(owner);
+        this.index.queue(
+          owner,
+          manifest.revision,
+          manifest.files.map((file) => ({
+            kind: "upsert",
+            path: file.path,
+            sha256: file.sha256,
+            size: file.size
+          }))
+        );
+      } else {
+        const delta = await this.client.fileChanges(owner, revision);
+        if (!delta.revisions.length) return 0;
+        const changes = /* @__PURE__ */ new Map();
+        let expected = revision + 1;
+        for (const entry of delta.revisions) {
+          if (entry.revision !== expected++) throw new Error("Server change history has a gap.");
+          for (const change of entry.changes) changes.set(change.path, change);
+        }
+        const finalNames = new Set(
+          [...changes.values()].filter((change) => change.kind === "upsert").map((change) => change.path.toLowerCase())
+        );
+        for (const change of changes.values()) {
+          if (change.kind === "delete" && !this.index.received(owner, change.path) && finalNames.has(change.path.toLowerCase()))
+            changes.delete(change.path);
+        }
+        const ordered = [...changes.values()].sort(
+          (a, b) => a.kind !== b.kind ? a.kind === "delete" ? -1 : 1 : a.kind === "delete" ? b.path.length - a.path.length : a.path.length - b.path.length
+        );
+        this.index.queue(owner, delta.revisions.at(-1).revision, ordered);
+      }
+    }
+    const job = this.index.job(owner);
+    const ownerRoot = await safePath(this.root, owner);
+    await mkdir9(ownerRoot).catch((error) => {
+      if (error.code !== "EEXIST") throw error;
+    });
+    const ownerStat = await lstat4(ownerRoot);
+    if (!ownerStat.isDirectory() || ownerStat.isSymbolicLink())
+      throw new Error("Mirror root is not an ordinary directory.");
+    let count = 0;
+    let bytes = 0;
+    for (let offset = job.nextIndex; offset < job.changes.length; offset++) {
+      if (this.stopped || count >= (this.options.applyBudget ?? 200) || bytes > 20 * 1024 * 1024)
+        break;
+      const change = job.changes[offset];
+      await this.apply(owner, ownerRoot, change);
+      this.index.applied(owner, change, offset + 1);
+      count++;
+      if (change.kind === "upsert") bytes += change.size;
+    }
+    if (this.index.job(owner).nextIndex === job.changes.length) this.index.finish(owner);
+    return count;
+  }
+  async apply(owner, root, change) {
+    const prior = this.index.received(owner, change.path);
+    const current = await metadata(root, change.path);
+    let local;
+    if (current && !current.directory) local = await readStable(root, change.path);
+    if (change.kind === "delete") {
+      if (!current) return;
+      if (current.directory && !prior) return;
+      if (!local || !prior || local.sha256 !== prior.sha256)
+        throw new Error(`Local mirror differs; preserving ${change.path}.`);
+      await removeFile(root, change.path, local.signature);
+    } else {
+      if (local?.sha256 === change.sha256) return;
+      if (local && (!prior || local.sha256 !== prior.sha256))
+        throw new Error(`Local mirror differs; preserving ${change.path}.`);
+      if (!current && prior && !this.options.restoreMissing)
+        throw new Error(
+          `Local mirror was removed; use --restore-missing to restore ${change.path}.`
+        );
+      let content = await this.blobs.get(change.sha256);
+      if (!content) {
+        content = await this.client.downloadBlob(change.sha256);
+        await this.blobs.put(content);
+      }
+      if (content.byteLength !== change.size)
+        throw new Error(`Content size mismatch: ${change.path}`);
+      await replaceFile(root, change.path, content, local?.signature ?? null);
+    }
+  }
+};
+function message(error) {
+  return diagnostic(error);
+}
+
+// apps/client/sessions/synchronizer.ts
+import { randomUUID as randomUUID7 } from "node:crypto";
+import { join as join14 } from "node:path";
+
+// packages/protocol/session-key.ts
+import { createHash as createHash9 } from "node:crypto";
+function sessionKey(agent, nativeId) {
+  return createHash9("sha256").update(JSON.stringify([agent, nativeId])).digest("hex");
+}
+
+// apps/client/sessions/source.ts
+import { open as open4, stat, realpath as realpath5 } from "node:fs/promises";
+import { relative as relative4, isAbsolute as isAbsolute4, sep as sep5 } from "node:path";
+import * as zlib from "node:zlib";
+
+// apps/client/sessions/cursor.ts
+import { createHash as createHash10 } from "node:crypto";
+import { basename as basename2, dirname as dirname7, resolve as resolve7 } from "node:path";
+import { DatabaseSync as DatabaseSync2 } from "node:sqlite";
+import { fileURLToPath } from "node:url";
+function fields(bytes) {
+  const data = Buffer.from(bytes);
+  let offset = 0;
+  const varint = () => {
+    let value = 0n;
+    for (let i = 0; i < 10; i++) {
+      if (offset >= data.length) throw new Error("Truncated Cursor protobuf.");
+      const byte = data[offset++];
+      value |= BigInt(byte & 127) << BigInt(i * 7);
+      if (byte < 128) return value;
+    }
+    throw new Error("Invalid Cursor protobuf integer.");
+  };
+  const result2 = /* @__PURE__ */ new Map();
+  while (offset < data.length) {
+    const tag = varint();
+    const field = Number(tag >> 3n);
+    if (field < 1 || field > 536870911) throw new Error("Invalid Cursor protobuf field.");
+    const wire = Number(tag & 7n);
+    if (wire === 0) varint();
+    else if (wire === 1) offset += 8;
+    else if (wire === 5) offset += 4;
+    else if (wire === 2) {
+      const length = Number(varint());
+      if (!Number.isSafeInteger(length) || length > data.length - offset)
+        throw new Error("Truncated Cursor protobuf value.");
+      const values = result2.get(field) ?? [];
+      values.push(data.subarray(offset, offset + length));
+      result2.set(field, values);
+      offset += length;
+    } else throw new Error("Unsupported Cursor protobuf wire type.");
+    if (offset > data.length) throw new Error("Truncated Cursor protobuf value.");
+  }
+  return result2;
+}
+function readCursor(path, projectDir) {
+  const db = new DatabaseSync2(path, { readOnly: true });
+  try {
+    db.exec("PRAGMA query_only=ON; PRAGMA busy_timeout=100; BEGIN");
+    if (db.prepare("PRAGMA user_version").get()?.user_version !== 1)
+      throw new Error("Unsupported Cursor CLI store version (expected 1).");
+    const row = db.prepare("SELECT value FROM meta WHERE key='0' AND length(value)<=2097152").get();
+    const hex = row?.value;
+    if (typeof hex !== "string" || !/^(?:[a-fA-F0-9]{2})+$/.test(hex))
+      throw new Error("Invalid Cursor metadata.");
+    const meta = object(JSON.parse(Buffer.from(hex, "hex").toString("utf8")));
+    if (typeof meta.agentId !== "string" || meta.agentId !== basename2(dirname7(path)) || meta.subagentInfo != null)
+      throw new Error("Invalid or delegated Cursor session identity.");
+    let budget = 64 * 1024 * 1024;
+    const blob = (id) => {
+      if (!/^[a-f0-9]{64}$/.test(id)) throw new Error("Invalid Cursor blob reference.");
+      const value = db.prepare("SELECT data FROM blobs WHERE id=? AND length(data)<=?").get(id, budget)?.data;
+      if (!(value instanceof Uint8Array))
+        throw new Error("Cursor history missing or exceeds 64 MiB.");
+      const bytes = Buffer.from(value);
+      budget -= bytes.length;
+      if (createHash10("sha256").update(bytes).digest("hex") !== id)
+        throw new Error("Cursor blob failed integrity verification.");
+      return bytes;
+    };
+    const root = fields(blob(String(meta.latestRootBlobId)));
+    const bucket = basename2(dirname7(dirname7(path)));
+    const md5 = (cwd2) => createHash10("md5").update(resolve7(cwd2)).digest("hex");
+    let cwd = md5(projectDir) === bucket ? projectDir : void 0;
+    for (const uri of root.get(9) ?? []) {
+      try {
+        const native = fileURLToPath(uri.toString("utf8"));
+        if (md5(native) === bucket) {
+          cwd = native;
+          break;
+        }
+      } catch {
+      }
+    }
+    if (!cwd) throw new Error("Cursor workspace cannot be verified against its storage bucket.");
+    const refs = [];
+    for (const archive of root.get(13) ?? root.get(11) ?? [])
+      refs.push(...fields(blob(archive.toString("hex"))).get(1) ?? []);
+    refs.push(...root.get(1) ?? []);
+    if (refs.length > 5e4) throw new Error("Cursor history exceeds 50000 messages.");
+    const messages = [];
+    const counts = /* @__PURE__ */ new Map();
+    for (const ref of refs) {
+      const key = ref.toString("hex");
+      const message2 = object(
+        JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(blob(key)))
+      );
+      const cursor = object(object(message2.providerOptions).cursor);
+      if (cursor.isSummary || !["user", "assistant"].includes(String(message2.role))) continue;
+      let text = textContent(message2.content);
+      if (message2.role === "user") {
+        if (!cursor.requestId) continue;
+        const start = text.indexOf("<user_query>");
+        const end = text.lastIndexOf("</user_query>");
+        if (start >= 0 && end > start) text = text.slice(start + 12, end).trim();
+      }
+      if (!text.trim()) continue;
+      const id = createHash10("sha256").update(JSON.stringify([message2.role, cursor.requestId ?? "", text])).digest("hex");
+      const count = (counts.get(id) ?? 0) + 1;
+      counts.set(id, count);
+      messages.push({
+        id: `${id}#${count}`,
+        role: message2.role,
+        text,
+        source: `blob:${key}`
+      });
+    }
+    return SessionSnapshotSchema.parse({
+      formatVersion: 1,
+      adapterVersion: 1,
+      agent: "cursor",
+      nativeId: meta.agentId,
+      cwd,
+      messages
+    });
+  } finally {
+    db.close();
+  }
+}
+
+// apps/client/sessions/source.ts
+var MAX_SOURCE_BYTES = 64 * 1024 * 1024;
+async function sourceSignature(path, agent) {
+  const paths = agent === "cursor" ? [path, `${path}-wal`] : [path];
+  const signatures = [];
+  for (const file of paths) {
+    try {
+      const s = await stat(file, { bigint: true });
+      if (!s.isFile()) throw new Error("Session source must be a regular file.");
+      signatures.push([
+        String(s.dev),
+        String(s.ino),
+        String(s.size),
+        String(s.mtimeNs),
+        String(s.ctimeNs)
+      ]);
+    } catch (error) {
+      if (file !== path && error.code === "ENOENT")
+        signatures.push(null);
+      else throw error;
+    }
+  }
+  return JSON.stringify(signatures);
+}
+async function readSource(agent, path, projectDir) {
+  const signature2 = await sourceSignature(path, agent);
+  let result2;
+  if (agent === "cursor") result2 = { snapshot: readCursor(path, projectDir), incomplete: false };
+  else {
+    const handle = await open4(path, "r");
+    let bytes;
+    try {
+      const size = (await handle.stat()).size;
+      if (size > MAX_SOURCE_BYTES) throw new Error("Session source exceeds 64 MiB.");
+      bytes = Buffer.alloc(size + 1);
+      let offset = 0;
+      while (offset < bytes.length) {
+        const read = await handle.read(bytes, offset, bytes.length - offset, offset);
+        if (!read.bytesRead) break;
+        offset += read.bytesRead;
+      }
+      bytes = bytes.subarray(0, offset);
+      if (offset > size) throw new Error("Session source changed while reading; retry next cycle.");
+    } finally {
+      await handle.close();
+    }
+    if (agent === "dsh" && path.endsWith(".zstd")) {
+      const decompress = zlib.zstdDecompressSync;
+      if (!decompress)
+        throw new Error(
+          "Compressed DSH sessions require Node.js with zstd support (22.15+ or 24+)."
+        );
+      bytes = decompress(bytes, { maxOutputLength: MAX_SOURCE_BYTES });
+    }
+    result2 = normalizeJsonl(agent, new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+  }
+  if (signature2 !== await sourceSignature(path, agent))
+    throw new Error("Session source changed while reading; retry next cycle.");
+  const cwd = await realpath5(result2.snapshot.cwd);
+  const project = await realpath5(projectDir);
+  const rel = relative4(project, cwd);
+  if (rel === ".." || rel.startsWith(`..${sep5}`) || isAbsolute4(rel))
+    throw new Error("Session cwd is outside the registered project.");
+  return { ...result2, signature: signature2 };
+}
+
+// apps/client/sessions/discovery.ts
+import { opendir as opendir2 } from "node:fs/promises";
+import { join as join13 } from "node:path";
+async function* candidates(directory, agent) {
+  const queue = [directory];
+  while (queue.length) {
+    const current = queue.shift();
+    const dir = await opendir2(current);
+    for await (const entry of dir) {
+      const path = join13(current, entry.name);
+      if (entry.isDirectory()) queue.push(path);
+      if (entry.isFile() && (agent === "cursor" ? entry.name === "store.db" : entry.name.endsWith(".jsonl") || agent === "dsh" && entry.name.endsWith(".jsonl.zstd")))
+        yield path;
+      else yield null;
+    }
+  }
+}
+var SessionDiscovery = class {
+  constructor(state) {
+    this.state = state;
+  }
+  state;
+  scans = /* @__PURE__ */ new Map();
+  async cycle() {
+    const issues = [];
+    let entries = 500;
+    let reads = 5;
+    const configs = this.state.directories();
+    for (const [directory, scan] of this.scans) {
+      if (!configs.some((config) => config.directory === directory)) {
+        await scan.iterator.return(void 0);
+        this.scans.delete(directory);
+      }
+    }
+    for (const config of configs) {
+      let scan = this.scans.get(config.directory);
+      if (!scan) {
+        scan = { iterator: candidates(config.directory, config.agent), nextAt: 0 };
+        this.scans.set(config.directory, scan);
+      }
+      if (scan.nextAt > Date.now()) continue;
+      try {
+        while (entries > 0 && reads > 0) {
+          entries--;
+          const entry = await scan.iterator.next();
+          if (entry.done) {
+            scan.iterator = candidates(config.directory, config.agent);
+            scan.nextAt = Date.now() + 3e5;
+            break;
+          }
+          const path = entry.value;
+          if (!path || this.state.get(path)) continue;
+          const signature2 = await sourceSignature(path, config.agent);
+          const db = this.state.state.db;
+          if (db.prepare(
+            "SELECT 1 FROM session_discovery_cache WHERE root=? AND path=? AND signature=?"
+          ).get(this.state.root, path, signature2))
+            continue;
+          reads--;
+          try {
+            const result2 = await readSource(config.agent, path, config.projectDir);
+            if (result2.incomplete) continue;
+            this.state.track(config.agent, path, config.projectDir);
+          } catch (error) {
+            const message2 = error instanceof Error ? error.message : "Discovery failed.";
+            if (!message2.includes("outside the registered project"))
+              issues.push(`${path}: ${message2}`);
+            if (!message2.includes("outside the registered project")) continue;
+          }
+          db.prepare(
+            "INSERT INTO session_discovery_cache VALUES (?,?,?) ON CONFLICT(root,path) DO UPDATE SET signature=excluded.signature"
+          ).run(this.state.root, path, signature2);
+        }
+      } catch (error) {
+        issues.push(
+          `${config.directory}: ${error instanceof Error ? error.message : "Discovery failed."}`
+        );
+        await scan.iterator.return(void 0);
+        scan.iterator = candidates(config.directory, config.agent);
+        scan.nextAt = Date.now() + 3e5;
+      }
+    }
+    return issues;
+  }
+  async close() {
+    for (const scan of this.scans.values()) await scan.iterator.return(void 0);
+  }
+};
+
+// apps/client/sessions/synchronizer.ts
+var SessionSynchronizer = class {
+  constructor(state, root, directory, signal) {
+    this.root = root;
+    this.directory = directory;
+    const binding = state.binding(root);
+    if (!binding) throw new Error("Connect this root before collecting sessions.");
+    this.client = new HubClient(binding.serverUrl, 1e4, binding, signal);
+    this.blobs = new LocalBlobStore(join14(directory, "blobs"));
+    this.index = new SessionState(state, root);
+    this.discovery = new SessionDiscovery(this.index);
+  }
+  root;
+  directory;
+  index;
+  client;
+  blobs;
+  discovery;
+  capable = false;
+  async cycle() {
+    const report = { published: 0, checked: 0, issues: [] };
+    report.issues.push(...await consumeHints(this.directory, this.root, this.index));
+    report.issues.push(...await this.discovery.cycle());
+    const sources = this.index.sources(void 0, 200);
+    if (sources.length && !this.capable) {
+      const info = await this.client.serverInfo();
+      if (!["blobs", "session-revisions"].every(
+        (capability) => info.capabilities.includes(capability)
+      ))
+        throw new Error("Server does not support session publication. Upgrade the server first.");
+      this.capable = true;
+    }
+    let reads = 5;
+    let uploads = 5;
+    for (const source of sources) {
+      if (reads <= 0 || uploads <= 0 || report.checked >= 200) break;
+      report.checked++;
+      this.index.checked(source.path, source.lastError);
+      try {
+        if (source.pending) {
+          if (source.retryAt > Date.now()) {
+            if (source.lastError)
+              report.issues.push(`${source.path}: ${source.lastError} (retry deferred)`);
+            continue;
+          }
+          uploads--;
+          await this.flush(source);
+          report.published++;
+          continue;
+        }
+        const signature2 = await sourceSignature(source.path, source.agent);
+        if (signature2 === source.signature && Date.now() - source.verifiedAt < 864e5) {
+          this.index.checked(source.path);
+          continue;
+        }
+        reads--;
+        const observed = await readSource(source.agent, source.path, source.projectDir);
+        if (observed.incomplete)
+          throw new Error("Final session record is incomplete; waiting for the next save.");
+        if (!observed.snapshot.messages.length) {
+          this.index.checked(source.path);
+          continue;
+        }
+        const key = sessionKey(source.agent, observed.snapshot.nativeId);
+        if (source.key && source.key !== key)
+          throw new Error(
+            "Native session identity changed at this path; register the new source explicitly."
+          );
+        const bytes = Buffer.from(JSON.stringify(observed.snapshot));
+        if (bytes.length > MAX_BLOB_BYTES)
+          throw new Error("Normalized session exceeds the 10 MiB snapshot limit.");
+        const blob = await this.blobs.put(bytes);
+        let revision = source.revision;
+        if (!source.key) {
+          try {
+            const owner = this.index.state.binding(this.root).memberId;
+            const current = await this.client.session(owner, key);
+            if (current.blob.sha256 !== blob.sha256 && !source.adoptExisting)
+              throw new Error(
+                "Server session already exists with different content; inspect it, then track with --adopt-existing to continue."
+              );
+            revision = current.revision;
+          } catch (error) {
+            if (!(error instanceof HubRequestError && error.code === "SESSION_NOT_FOUND"))
+              throw error;
+          }
+          this.index.baseline(source.path, key, revision);
+        }
+        if (blob.sha256 === source.hash) {
+          this.index.acknowledge(source.path, revision, blob.sha256, observed.signature);
+          continue;
+        }
+        this.index.stage(
+          source.path,
+          { operationId: randomUUID7(), sessionKey: key, parentRevision: revision, blob },
+          observed.signature
+        );
+        uploads--;
+        await this.flush(this.index.get(source.path));
+        report.published++;
       } catch (error) {
-        this.index.event(row.path, this.clock());
-        issues.push(`${row.path}: ${message(error)}`);
+        const message2 = error instanceof Error ? error.message : "Session synchronization failed.";
+        this.index.checked(source.path, message2);
+        report.issues.push(`${source.path}: ${message2}`);
       }
     }
-    if (!changes.length) return;
-    const rootStat = await lstat2(this.ownRoot);
-    if (!rootStat.isDirectory() || rootStat.isSymbolicLink())
-      throw new Error("Author directory disappeared before publication.");
-    this.state.enqueue(this.root, {
-      operationId: randomUUID7(),
-      parentRevision: this.state.publication(this.root).revision,
-      changes
-    });
-    for (const snapshot of snapshots)
-      this.index.clean(snapshot.path, snapshot.generation, snapshot.hash, this.clock());
+    return report;
   }
-  async receive(owner) {
-    if (!this.index.job(owner)) {
-      const revision = this.index.revision(owner);
-      if (revision === void 0) {
-        const manifest = await this.manifest(owner);
-        this.index.queue(
-          owner,
-          manifest.revision,
-          manifest.files.map((file) => ({
-            kind: "upsert",
-            path: file.path,
-            sha256: file.sha256,
-            size: file.size
-          }))
-        );
-      } else {
-        const delta = await this.client.fileChanges(owner, revision);
-        if (!delta.revisions.length) return 0;
-        const changes = /* @__PURE__ */ new Map();
-        let expected = revision + 1;
-        for (const entry of delta.revisions) {
-          if (entry.revision !== expected++) throw new Error("Server change history has a gap.");
-          for (const change of entry.changes) changes.set(change.path, change);
-        }
-        const finalNames = new Set(
-          [...changes.values()].filter((change) => change.kind === "upsert").map((change) => change.path.toLowerCase())
-        );
-        for (const change of changes.values()) {
-          if (change.kind === "delete" && !this.index.received(owner, change.path) && finalNames.has(change.path.toLowerCase()))
-            changes.delete(change.path);
-        }
-        const ordered = [...changes.values()].sort(
-          (a, b) => a.kind !== b.kind ? a.kind === "delete" ? -1 : 1 : a.kind === "delete" ? b.path.length - a.path.length : a.path.length - b.path.length
-        );
-        this.index.queue(owner, delta.revisions.at(-1).revision, ordered);
+  async flush(source) {
+    const request = source.pending;
+    try {
+      const { missing: missing2 } = await this.client.missingBlobs([request.blob.sha256]);
+      if (missing2.some((hash2) => hash2 !== request.blob.sha256))
+        throw new Error("Server requested unrelated session content.");
+      if (missing2.length) {
+        const bytes = await this.blobs.get(request.blob.sha256);
+        if (!bytes) throw new Error("Queued session snapshot is missing.");
+        const ref = await this.client.uploadBlob(request.blob.sha256, bytes);
+        if (ref.sha256 !== request.blob.sha256 || ref.size !== request.blob.size)
+          throw new Error("Server acknowledged different session content.");
       }
+      const result2 = await this.client.commitSession(request);
+      if (result2.operationId !== request.operationId || result2.revision < request.parentRevision || result2.revision > request.parentRevision + 1)
+        throw new Error("Invalid session acknowledgement.");
+      this.index.acknowledge(
+        source.path,
+        result2.revision,
+        request.blob.sha256,
+        source.pendingSignature
+      );
+    } catch (error) {
+      const blocked = error instanceof HubRequestError && error.status >= 400 && error.status < 500 && ![408, 429].includes(error.status);
+      this.index.postpone(
+        source,
+        error instanceof Error ? error.message : "Upload failed.",
+        blocked
+      );
+      throw error;
     }
-    const job = this.index.job(owner);
-    const ownerRoot = await safePath(this.root, owner);
-    await mkdir6(ownerRoot).catch((error) => {
-      if (error.code !== "EEXIST") throw error;
+  }
+  async close() {
+    await this.discovery.close();
+  }
+};
+
+// apps/client/runtime/job.ts
+var SyncJob = class {
+  constructor(root, directory, version, log, options = {}) {
+    this.root = root;
+    this.log = log;
+    this.lock = acquireRootLock(root, directory);
+    let state;
+    try {
+      state = new ClientState(directory);
+      this.state = state;
+      this.runtime = new RuntimeState(state);
+      this.files = options.sessionsOnly ? void 0 : new FileSynchronizer(state, root, directory, {
+        ...options.settleMs === void 0 ? {} : { settleMs: options.settleMs },
+        adoptBaseline: Boolean(options.adoptBaseline),
+        restoreMissing: Boolean(options.restoreMissing)
+      });
+      this.sessions = new SessionSynchronizer(state, root, directory, this.abort.signal);
+      if (options.retry) {
+        state.retryPublication(root);
+        this.sessions.index.retry();
+      }
+      const overrides = {};
+      if (options.intervalMs !== void 0)
+        overrides.checkIntervalSeconds = options.intervalMs / 1e3;
+      if (options.settleMs !== void 0) overrides.fileSettleSeconds = options.settleMs / 1e3;
+      this.control = new ControlPlane(state, root, version, overrides, (policy) => {
+        this.intervalMs = Math.round(policy.checkIntervalSeconds * 1e3);
+        this.files?.setSettleMs(Math.round(policy.fileSettleSeconds * 1e3));
+      });
+    } catch (e) {
+      state?.close();
+      this.lock.close();
+      throw e;
+    }
+  }
+  root;
+  log;
+  state;
+  runtime;
+  control;
+  files;
+  sessions;
+  lock;
+  abort = new AbortController();
+  pending;
+  stopped = false;
+  closing;
+  controlStarted = false;
+  lastIssue = "";
+  issueCount = 0;
+  lastLogAt = 0;
+  nextAt = 0;
+  intervalMs = 6e4;
+  tick() {
+    if (this.stopped) return Promise.reject(new Error("Synchronization stopped."));
+    this.pending ??= this.cycle().finally(() => {
+      this.pending = void 0;
     });
-    const ownerStat = await lstat2(ownerRoot);
-    if (!ownerStat.isDirectory() || ownerStat.isSymbolicLink())
-      throw new Error("Mirror root is not an ordinary directory.");
-    let count = 0;
-    let bytes = 0;
-    for (let offset = job.nextIndex; offset < job.changes.length; offset++) {
-      if (this.stopped || count >= (this.options.applyBudget ?? 200) || bytes > 20 * 1024 * 1024)
-        break;
-      const change = job.changes[offset];
-      await this.apply(owner, ownerRoot, change);
-      this.index.applied(owner, change, offset + 1);
-      count++;
-      if (change.kind === "upsert") bytes += change.size;
+    return this.pending;
+  }
+  async once() {
+    const prior = this.runtime.status(this.root);
+    const report = await this.tick();
+    if (this.control.enabled) await this.control.tick();
+    const errors = [
+      ...report.issues,
+      ...report.sessions.issues,
+      ...this.control.enabled ? [this.control.status.configError, this.control.status.reportError].filter(
+        (e) => Boolean(e)
+      ) : []
+    ].map(redact);
+    if (errors[0] && !this.stopped) {
+      const status = this.runtime.status(this.root);
+      this.runtime.save(this.root, {
+        ...status,
+        state: "waiting",
+        lastSuccessAt: prior?.lastSuccessAt ?? null,
+        issue: errors[0]
+      });
+      if (errors[0] !== report.errors[0]) this.log.write("sync.waiting", this.root, errors[0]);
     }
-    if (this.index.job(owner).nextIndex === job.changes.length) this.index.finish(owner);
-    return count;
+    return { ...report, errors, control: this.control.enabled ? this.control.status : null };
   }
-  async apply(owner, root, change) {
-    const prior = this.index.received(owner, change.path);
-    const current = await metadata(root, change.path);
-    let local;
-    if (current && !current.directory) local = await readStable(root, change.path);
-    if (change.kind === "delete") {
-      if (!current) return;
-      if (current.directory && !prior) return;
-      if (!local || !prior || local.sha256 !== prior.sha256)
-        throw new Error(`Local mirror differs; preserving ${change.path}.`);
-      await removeFile(root, change.path, local.signature);
+  async cycle() {
+    const prior = this.runtime.status(this.root);
+    this.runtime.save(this.root, {
+      state: "syncing",
+      checkedAt: prior?.checkedAt ?? null,
+      lastSuccessAt: prior?.lastSuccessAt ?? null,
+      pendingFiles: prior?.pendingFiles ?? 0,
+      pendingDownloads: prior?.pendingDownloads ?? 0,
+      issue: null
+    });
+    let report = {
+      published: false,
+      appliedFiles: 0,
+      waitingFiles: 0,
+      pendingPublication: false,
+      issues: []
+    };
+    let sessions = { published: 0, checked: 0, issues: [] };
+    try {
+      await verifyWorkspace(this.state, this.root);
+      if (!this.controlStarted) {
+        await this.control.tick();
+        this.control.start();
+        this.controlStarted = true;
+      }
+      if (this.files) report = await this.files.cycle();
+      sessions = await this.sessions.cycle();
+    } catch (e) {
+      report.issues.push(diagnostic(e));
+    }
+    const errors = [
+      ...report.issues,
+      ...sessions.issues,
+      ...this.control.enabled ? [this.control.status.configError, this.control.status.reportError].filter(
+        (e) => Boolean(e)
+      ) : []
+    ].map(redact);
+    const pendingDownloads = Number(
+      this.state.db.prepare(
+        "SELECT COALESCE(SUM(json_array_length(changes_json)-next_index),0) n FROM receive_jobs WHERE root=?"
+      ).get(this.root).n
+    );
+    const pendingFiles = report.waitingFiles + (this.state.pending(this.root)?.batch.changes.length ?? 0);
+    const now = Date.now(), checkedAt = new Date(now).toISOString();
+    this.control.updateSync({
+      checkedAt,
+      published: report.published,
+      appliedFiles: report.appliedFiles,
+      pendingFiles,
+      sessionSources: Number(
+        this.state.db.prepare("SELECT COUNT(*) n FROM session_sources WHERE root=?").get(this.root).n
+      ),
+      errors: errors.slice(0, 20).map((e) => e.slice(0, 1e3))
+    });
+    const issue = errors[0] ?? "";
+    const issueKey = issue.replace(/[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}/gi, "[request]");
+    if (issue) {
+      this.issueCount++;
+      if (issueKey !== this.lastIssue || now - this.lastLogAt >= 9e5) {
+        this.log.write("sync.waiting", this.root, issue);
+        this.lastLogAt = now;
+      }
     } else {
-      if (local?.sha256 === change.sha256) return;
-      if (local && (!prior || local.sha256 !== prior.sha256))
-        throw new Error(`Local mirror differs; preserving ${change.path}.`);
-      if (!current && prior && !this.options.restoreMissing)
-        throw new Error(
-          `Local mirror was removed; use --restore-missing to restore ${change.path}.`
+      if (this.lastIssue)
+        this.log.write("sync.recovered", this.root, `${this.issueCount} failed checks`);
+      this.issueCount = 0;
+      if (report.published || report.appliedFiles || sessions.published)
+        this.log.write(
+          "sync.changed",
+          this.root,
+          `files received=${report.appliedFiles}, files published=${Number(report.published)}, sessions published=${sessions.published}`
         );
-      let content = await this.blobs.get(change.sha256);
-      if (!content) {
-        content = await this.client.downloadBlob(change.sha256);
-        await this.blobs.put(content);
-      }
-      if (content.byteLength !== change.size)
-        throw new Error(`Content size mismatch: ${change.path}`);
-      await replaceFile(root, change.path, content, local?.signature ?? null);
     }
+    this.lastIssue = issueKey;
+    this.nextAt = now + (issue ? Math.min(9e5, Math.max(this.intervalMs, 1e4) * 2 ** Math.min(this.issueCount - 1, 5)) : pendingDownloads ? 250 : this.intervalMs);
+    this.runtime.save(this.root, {
+      state: this.stopped ? "stopped" : issue ? "waiting" : "idle",
+      checkedAt,
+      lastSuccessAt: !issue && !pendingDownloads ? checkedAt : prior?.lastSuccessAt ?? null,
+      pendingFiles,
+      pendingDownloads,
+      issue: issue || null
+    });
+    return {
+      ...report,
+      sessions,
+      pendingDownloads,
+      control: this.control.enabled ? this.control.status : null,
+      errors
+    };
+  }
+  close() {
+    if (this.closing) return this.closing;
+    this.stopped = true;
+    this.abort.abort();
+    this.files?.close();
+    return this.closing = (async () => {
+      await this.control.close();
+      await this.pending?.catch(() => {
+      });
+      await this.sessions.close();
+      const prior = this.runtime.status(this.root);
+      if (prior) this.runtime.save(this.root, { ...prior, state: "stopped" });
+      this.state.close();
+      this.lock.close();
+    })();
   }
 };
-function message(error) {
-  return error instanceof Error ? error.message : String(error);
-}
 
 // apps/client/sync-command.ts
-var help2 = `Usage: teammy sync [options]
+var help2 = `Usage: teammy sync on | off [--root DIR]
 
-  --root DIR           Shared root (default: ./workspaces)
-  --state-dir DIR      Local state (default: ~/.teammy/client)
-  --once               Run one check and exit; pending changes remain saved
-  --interval-ms N      Check interval (default: 60000, minimum: 1000)
-  --settle-ms N        Per-file quiet period (default: 60000)
-  --adopt-baseline     Accept existing server history only if every published file matches locally
-  --restore-missing   Restore missing mirror files; existing local edits are still preserved
-  --retry              Retry file/session publications paused by a previous failure
-  --sessions-only      Collect sessions without applying shared files
-  -h, --help           Show this help
+  on                   Start background sync and resume after login
+  off                  Stop this project's sync, including after login
+  --once               Run one check without changing the enabled state
+  --foreground         Run in this terminal for diagnostics (turn background sync off first)
+  --json               Machine-readable output
 
-Runs in the foreground until SIGINT/SIGTERM. Each run restarts the quiet period
-for pending files; --once does not wait for edits to settle. --settle-ms 0 can be
-used for an explicit immediate check. Only this member's directory is uploaded.
+Advanced: --state-dir DIR, --interval-ms N, --settle-ms N,
+          --restore-missing, --adopt-baseline, --retry, --sessions-only
+Use teammy status or teammy logs for diagnostics.
 `;
 async function runSyncCommand(args, version) {
-  const { values } = parseArgs2({
-    args,
+  const action = ["on", "off"].includes(args[0] ?? "") ? args[0] : void 0;
+  const { values } = parseArgs3({
+    args: action ? args.slice(1) : args,
     options: {
-      root: { type: "string", default: resolve5("workspaces") },
-      "state-dir": { type: "string", default: join10(homedir2(), ".teammy", "client") },
+      ...locationOptions,
       once: { type: "boolean" },
+      foreground: { type: "boolean" },
       "interval-ms": { type: "string" },
       "settle-ms": { type: "string" },
       "adopt-baseline": { type: "boolean" },
       "restore-missing": { type: "boolean" },
       retry: { type: "boolean" },
-      "sessions-only": { type: "boolean" },
-      help: { type: "boolean", short: "h" }
+      "sessions-only": { type: "boolean" }
     }
   });
-  if (values.help) {
+  if (values.help || !action && !values.once && !values.foreground) {
     process.stdout.write(help2);
     return 0;
   }
-  let intervalMs = Number(values["interval-ms"] ?? 6e4);
-  const settleMs = Number(values["settle-ms"] ?? 6e4);
-  if (!Number.isSafeInteger(intervalMs) || intervalMs < 1e3 || intervalMs > 864e5 || !Number.isSafeInteger(settleMs) || settleMs < 0 || settleMs > 864e5)
-    throw new Error("Invalid sync timing options.");
-  const root = await realpath5(resolve5(values.root));
-  const stateDirectory = await stateLocation(root, values["state-dir"]);
-  const lock = acquireRootLock(root, stateDirectory);
-  let state;
-  let synchronizer;
-  let sessions;
-  let control;
-  const stopped = new AbortController();
+  if (action && (values.once || values.foreground) || values.once && values.foreground)
+    throw new Error("Choose sync on, sync off, --once or --foreground.");
+  const options = {};
+  for (const [key, target, min] of [
+    ["interval-ms", "intervalMs", 1e3],
+    ["settle-ms", "settleMs", 0]
+  ]) {
+    if (values[key] === void 0) continue;
+    const n = Number(values[key]);
+    if (!Number.isSafeInteger(n) || n < min || n > 864e5)
+      throw new Error("Invalid sync timing options.");
+    options[target] = n;
+  }
+  if (values["adopt-baseline"]) options.adoptBaseline = true;
+  if (values["restore-missing"]) options.restoreMissing = true;
+  if (values.retry) options.retry = true;
+  if (values["sessions-only"]) options.sessionsOnly = true;
+  if (action && Object.keys(options).length)
+    throw new Error(
+      "Timing and recovery overrides require --once or --foreground. Manage normal sync timing in the dashboard."
+    );
+  const root = await workspacePath(values.root), directory = await stateLocation(root, values["state-dir"]);
+  const state = new ClientState(directory), runtime = new RuntimeState(state), log = new ClientLog(directory);
+  try {
+    if (!state.binding(root)) throw new Error("Connect this workspace first.");
+    if (action) {
+      if (action === "on") await verifyWorkspace(state, root);
+      runtime.enable(root, action === "on");
+      if (action === "on") await wakeDaemon(directory, version);
+      else {
+        if (await runningDaemon(directory))
+          await daemonRequest(directory, { method: "wake" }, 45e3);
+        const status = runtime.status(root);
+        if (status) runtime.save(root, { ...status, state: "stopped" });
+        log.write("sync.off_requested", root);
+      }
+      if (values.json) json({ enabled: action === "on", root });
+      else result(action === "on" ? "\u540E\u53F0\u540C\u6B65\u5DF2\u5F00\u542F" : "\u540C\u6B65\u5DF2\u505C\u6B62", root);
+      return 0;
+    }
+    const daemon = await runningDaemon(directory);
+    if (daemon && values.once && !Object.keys(options).length) {
+      const report = await daemonRequest(directory, { method: "once", root }, 6e5);
+      if (values.json) json(report);
+      else result(report.errors.length ? "\u540C\u6B65\u9700\u8981\u5904\u7406" : "\u540C\u6B65\u68C0\u67E5\u5B8C\u6210", report.errors[0]);
+      return report.errors.length ? 1 : 0;
+    }
+    if (runtime.enabled(root))
+      throw new Error(
+        'Run "teammy sync off" before using foreground synchronization or recovery overrides.'
+      );
+    const job = new SyncJob(root, directory, version, log, options);
+    const abort = new AbortController();
+    const stop = () => {
+      abort.abort();
+      void job.close();
+    };
+    process.once("SIGINT", stop);
+    process.once("SIGTERM", stop);
+    let prior = "";
+    try {
+      if (values.foreground && !values.json) result("\u540C\u6B65\u8FD0\u884C\u4E2D", "\u6309 Ctrl+C \u505C\u6B62");
+      do {
+        const report = await (values.once ? job.once() : job.tick());
+        if (values.json) json(report);
+        else if (values.once)
+          result(report.errors.length ? "\u540C\u6B65\u9700\u8981\u5904\u7406" : "\u540C\u6B65\u68C0\u67E5\u5B8C\u6210", report.errors[0]);
+        else if ((report.errors[0] ?? "") !== prior) {
+          result(report.errors.length ? "\u540C\u6B65\u7B49\u5F85\u5904\u7406" : "\u540C\u6B65\u5DF2\u6062\u590D", report.errors[0]);
+          prior = report.errors[0] ?? "";
+        }
+        if (values.once) return report.errors.length ? 1 : 0;
+        await setTimeout4(Math.max(100, job.nextAt - Date.now()), void 0, {
+          signal: abort.signal
+        }).catch((e) => {
+          if (!abort.signal.aborted) throw e;
+        });
+      } while (!abort.signal.aborted);
+    } finally {
+      process.off("SIGINT", stop);
+      process.off("SIGTERM", stop);
+      await job.close();
+    }
+    return 0;
+  } catch (e) {
+    log.write("sync.command_failed", root, diagnostic(e));
+    throw e;
+  } finally {
+    state.close();
+  }
+}
+
+// apps/client/runtime/daemon.ts
+import { createServer } from "node:net";
+import { chmod as chmod2, unlink as unlink4 } from "node:fs/promises";
+async function runDaemon(directory, version) {
+  const lock = acquireRootLock("daemon:" + directory, directory), state = new ClientState(directory), runtime = new RuntimeState(state), log = new ClientLog(directory);
+  const jobs = /* @__PURE__ */ new Map(), retry = /* @__PURE__ */ new Map();
+  let closing = false, serial = Promise.resolve();
+  const reconcile = () => {
+    serial = serial.catch(() => {
+    }).then(async () => {
+      if (closing) return;
+      const enabled = new Set(runtime.roots());
+      for (const [root, job] of jobs)
+        if (!enabled.has(root)) {
+          await job.close();
+          jobs.delete(root);
+          log.write("sync.off", root);
+        }
+      for (const root of enabled) {
+        if (jobs.has(root) || oneShots.has(root) || (retry.get(root) ?? 0) > Date.now()) continue;
+        try {
+          jobs.set(root, new SyncJob(root, directory, version, log));
+          retry.delete(root);
+          log.write("sync.on", root);
+        } catch (e) {
+          retry.set(root, Date.now() + 6e4);
+          log.write("sync.start_failed", root, diagnostic(e));
+          runtime.save(root, {
+            state: "waiting",
+            checkedAt: null,
+            lastSuccessAt: runtime.status(root)?.lastSuccessAt ?? null,
+            pendingFiles: 0,
+            pendingDownloads: 0,
+            issue: diagnostic(e)
+          });
+        }
+      }
+      for (const job of jobs.values())
+        if (job.nextAt <= Date.now())
+          void job.tick().catch((e) => {
+            job.nextAt = Date.now() + 6e4;
+            log.write("sync.failed", job.root, diagnostic(e));
+          });
+    });
+    return serial;
+  };
+  const sockets = /* @__PURE__ */ new Set(), temporaryJobs = /* @__PURE__ */ new Set();
+  const oneShots = /* @__PURE__ */ new Map();
+  const server = createServer((socket) => {
+    sockets.add(socket);
+    socket.once("close", () => sockets.delete(socket));
+    let body = "", used = false;
+    socket.setEncoding("utf8");
+    socket.setTimeout(6e5, () => socket.destroy());
+    socket.on("error", () => {
+    });
+    socket.on("data", (chunk) => {
+      if (used) return;
+      body += chunk.toString();
+      if (body.length > 8192) {
+        socket.destroy();
+        return;
+      }
+      if (!body.includes("\n")) return;
+      used = true;
+      void (async () => {
+        const input = RequestSchema.parse(JSON.parse(body.split("\n")[0]));
+        if (closing) throw new Error("Background service is stopping.");
+        if (input.method === "ping") return { pid: process.pid, version };
+        if (input.method === "wake") {
+          retry.clear();
+          await reconcile();
+          return { ok: true };
+        }
+        const root = input.root;
+        if (!root || !state.binding(root)) throw new Error("Workspace is not connected.");
+        if (input.method === "status")
+          return {
+            enabled: runtime.enabled(root),
+            running: jobs.has(root),
+            status: runtime.status(root)
+          };
+        const active = jobs.get(root);
+        if (active) return active.once();
+        if (runtime.enabled(root)) throw new Error("Workspace could not start. Run teammy status.");
+        let work = oneShots.get(root);
+        if (!work) {
+          const job = new SyncJob(root, directory, version, log);
+          temporaryJobs.add(job);
+          work = job.once().finally(async () => {
+            await job.close();
+            temporaryJobs.delete(job);
+            oneShots.delete(root);
+          });
+          oneShots.set(root, work);
+        }
+        return work;
+      })().then(
+        (result2) => socket.end(JSON.stringify({ ok: true, result: result2 }) + "\n"),
+        (e) => socket.end(JSON.stringify({ ok: false, error: diagnostic(e) }) + "\n")
+      );
+    });
+  });
+  let timer;
+  let resolveStop = () => {
+  };
+  const stopped = new Promise((resolve9) => {
+    resolveStop = resolve9;
+  });
   const stop = () => {
-    stopped.abort();
-    synchronizer?.close();
+    closing = true;
+    resolveStop();
   };
   try {
-    state = new ClientState(stateDirectory);
-    if (values.retry) state.retryPublication(root);
-    sessions = new SessionSynchronizer(state, root, stateDirectory, stopped.signal);
-    if (values.retry) sessions.index.retry();
-    if (!values["sessions-only"])
-      synchronizer = new FileSynchronizer(state, root, stateDirectory, {
-        settleMs,
-        adoptBaseline: Boolean(values["adopt-baseline"]),
-        restoreMissing: Boolean(values["restore-missing"])
+    await prepareSocketDirectory(directory);
+    await unlink4(socketPath(directory)).catch((e) => {
+      if (e.code !== "ENOENT") throw e;
+    });
+    await new Promise((resolve9, reject) => {
+      server.once("error", reject);
+      server.listen(socketPath(directory), () => {
+        server.off("error", reject);
+        resolve9();
       });
-    const overrides = {};
-    if (values["interval-ms"] !== void 0) overrides.checkIntervalSeconds = intervalMs / 1e3;
-    if (values["settle-ms"] !== void 0) overrides.fileSettleSeconds = settleMs / 1e3;
-    control = new ControlPlane(state, root, version, overrides, (policy) => {
-      intervalMs = Math.round(policy.checkIntervalSeconds * 1e3);
-      synchronizer?.setSettleMs(Math.round(policy.fileSettleSeconds * 1e3));
     });
-    await control.tick();
-    await synchronizer?.checkCapabilities();
-    if (!values.once) control.start();
+    await chmod2(socketPath(directory), 384);
     process.once("SIGINT", stop);
     process.once("SIGTERM", stop);
-    do {
-      const report = synchronizer ? await synchronizer.cycle() : { issues: [], published: false, appliedFiles: 0, waitingFiles: 0 };
-      let sessionReport;
-      try {
-        sessionReport = await sessions.cycle();
-      } catch (error) {
-        sessionReport = {
-          published: 0,
-          checked: 0,
-          issues: [error instanceof Error ? error.message : "Session synchronization failed."]
-        };
-      }
-      control.updateSync({
-        checkedAt: (/* @__PURE__ */ new Date()).toISOString(),
-        published: report.published,
-        appliedFiles: report.appliedFiles,
-        pendingFiles: report.waitingFiles + (state.pending(root)?.batch.changes.length ?? 0),
-        sessionSources: Number(
-          state.db.prepare("SELECT COUNT(*) n FROM session_sources WHERE root=?").get(root).n
-        ),
-        errors: [...report.issues, ...sessionReport.issues].slice(0, 20).map((message2) => message2.slice(0, 1e3))
-      });
-      if (values.once && control.enabled) await control.tick();
-      const combined = {
-        ...report,
-        sessions: sessionReport,
-        control: control.enabled ? control.status : null
-      };
-      process.stdout.write(`${JSON.stringify(combined)}
-`);
-      if (values.once)
-        return report.issues.length || sessionReport.issues.length || control.enabled && (control.status.configError || control.status.reportError) ? 1 : 0;
-      const finishedAt = Date.now();
-      while (!stopped.signal.aborted && Date.now() - finishedAt < intervalMs)
-        await setTimeout3(Math.min(1e3, intervalMs - (Date.now() - finishedAt)), void 0, {
-          signal: stopped.signal
-        }).catch((error) => {
-          if (!stopped.signal.aborted) throw error;
-        });
-    } while (!stopped.signal.aborted);
-    return 0;
+    log.write("daemon.started", void 0, `version=${version}`);
+    await reconcile();
+    timer = setInterval(
+      () => void reconcile().catch((e) => log.write("daemon.error", void 0, diagnostic(e))),
+      1e3
+    );
+    await stopped;
   } finally {
+    closing = true;
+    clearInterval(timer);
     process.off("SIGINT", stop);
     process.off("SIGTERM", stop);
-    synchronizer?.close();
-    await control?.close();
-    await sessions?.close();
-    state?.close();
+    await serial.catch(() => {
+    });
+    await Promise.all([...jobs.values(), ...temporaryJobs].map((job) => job.close()));
+    await Promise.allSettled(oneShots.values());
+    for (const socket of sockets) socket.destroy();
+    await new Promise((resolve9) => server.close(() => resolve9()));
+    await unlink4(socketPath(directory)).catch(() => {
+    });
+    log.write("daemon.stopped");
+    state.close();
     lock.close();
   }
 }
@@ -2789,13 +3809,15 @@ Usage:
   teammy --version                  Show the installed client version
   teammy server-info --url URL      Check server connection and protocol capabilities
   teammy server-info --help         Show connection options
-  teammy connect --url URL [--member ID | --token-file FILE] [--reconnect] [--root DIR] [--state-dir DIR]
+  teammy connect --url URL --project ID [--member ID | --token-file FILE] [--reconnect] [--root DIR] [--state-dir DIR]
   teammy status [--root DIR] [--state-dir DIR]
-  teammy sync [--root DIR] [--once]
+  teammy sync on | off [--root DIR]
+  teammy logs [--root DIR]          Show recent diagnostic events
   teammy session --help              Collect, read and search Agent sessions
 
 Root defaults to ./workspaces; local state defaults to ~/.teammy/client.
-sync runs foreground synchronization; manage project settings in the server dashboard.
+connect starts background sync; enabled projects resume after login.
+Use --json for scripts; manage sync timing in the server dashboard.
 The hub server is installed separately as @teammy/server (command: teammy-server).
 `;
 var serverInfoHelp = `Usage: teammy server-info --url URL
@@ -2822,6 +3844,21 @@ async function runCli(args, version) {
     process.stderr.write('Install @teammy/server and run "teammy-server" to start the hub.\n');
     return 1;
   }
+  if (command === "_daemon") {
+    const { values } = parseArgs4({
+      args: args.slice(1),
+      options: { "state-dir": { type: "string" } }
+    });
+    if (!values["state-dir"]) throw new Error("Missing daemon state directory.");
+    const directory = resolve8(values["state-dir"]);
+    try {
+      await runDaemon(directory, version);
+      return 0;
+    } catch (e) {
+      new ClientLog(directory).write("daemon.failed", void 0, diagnostic(e));
+      return 1;
+    }
+  }
   if (command === "session") {
     try {
       return await runSessionCommand(args.slice(1));
@@ -2838,64 +3875,17 @@ async function runCli(args, version) {
     try {
       return await runSyncCommand(args.slice(1), version);
     } catch (error) {
-      process.stderr.write(
-        `${error instanceof Error ? error.message : "Synchronization failed."}
-`
-      );
+      process.stderr.write(`${diagnostic(error)}
+`);
       return 1;
     }
   }
-  if (command === "connect" || command === "status") {
+  if (command === "connect" || command === "status" || command === "logs") {
     try {
-      const { values } = parseArgs3({
-        args: args.slice(1),
-        options: {
-          url: { type: "string" },
-          "token-file": { type: "string" },
-          member: { type: "string" },
-          reconnect: { type: "boolean" },
-          root: { type: "string", default: resolve6("workspaces") },
-          "state-dir": { type: "string", default: join11(homedir3(), ".teammy", "client") }
-        }
-      });
-      const rootPath = resolve6(values.root);
-      if (command === "connect") await mkdir7(rootPath, { recursive: true });
-      const root = await realpath6(rootPath);
-      const state = new ClientState(await stateLocation(root, values["state-dir"]));
-      try {
-        if (command === "status") {
-          const binding = state.binding(root);
-          if (!binding) throw new Error("This root is not connected. Run teammy connect first.");
-          const { token: _token, ...publicBinding } = binding;
-          process.stdout.write(
-            `${JSON.stringify({ ...publicBinding, control: readControlStatus(state, root), sessions: new SessionState(state, root).status(), publication: state.publication(root), pending: state.pending(root) ? { operationId: state.pending(root).batch.operationId, retryAt: state.pending(root).retryAt, lastError: state.pending(root).lastError } : null, sync: new SyncState(state, root).status() }, null, 2)}
-`
-          );
-        } else {
-          if (!values.url) throw new Error("--url is required.");
-          const connected = await connectProject(
-            state,
-            root,
-            await stateLocation(root, values["state-dir"]),
-            {
-              url: values.url,
-              member: values.member,
-              tokenFile: values["token-file"],
-              reconnect: values.reconnect
-            }
-          );
-          process.stdout.write(`${JSON.stringify(connected, null, 2)}
+      return await runClientCommand(command, args.slice(1), version);
+    } catch (e) {
+      process.stderr.write(`${diagnostic(e)}
 `);
-        }
-      } finally {
-        state.close();
-      }
-      return 0;
-    } catch (error) {
-      process.stderr.write(
-        `${error instanceof Error ? error.message : "Unable to open connection."}
-`
-      );
       return 1;
     }
   }
@@ -2904,7 +3894,7 @@ async function runCli(args, version) {
     return 1;
   }
   try {
-    const { values } = parseArgs3({
+    const { values } = parseArgs4({
       args: args.slice(1),
       options: {
         help: { type: "boolean", short: "h" },