@teammy/cli 0.1.0 → 0.1.2

package/dist/main.js

@@ -150,7 +150,8 @@ var MemberUpdateSchema = z3.object({
 var ProjectCreateSchema = z3.object({
   operationId: z3.uuid(),
   projectName: z3.string().trim().min(1).max(120),
-  description: z3.string().max(2e3).default("")
+  description: z3.string().max(2e3).default(""),
+  workspacePath: z3.string().trim().min(1).optional()
 }).strict();
 var ProjectSummarySchema = z3.object({
   projectId: NameSchema,
@@ -285,7 +286,7 @@ var SessionSearchSchema = z5.object({
 });
 
 // packages/transport/hub-client.ts
-import { z as z8 } from "zod";
+import { z as z9 } from "zod";
 import { createHash } from "node:crypto";
 
 // packages/protocol/index.ts
@@ -330,6 +331,28 @@ function sharedPathAllowed(path, paths) {
   );
 }
 
+// packages/protocol/client-access.ts
+import { z as z8 } from "zod";
+var ConnectSecretSchema = z8.string().regex(/^[a-f0-9]{64}$/);
+var BrowserConnectRequestSchema = z8.object({
+  id: z8.uuid(),
+  projectId: NameSchema,
+  deviceId: DeviceIdSchema,
+  secret: ConnectSecretSchema,
+  label: z8.string().min(1).max(255)
+}).strict();
+var BrowserConnectStartSchema = z8.object({ id: z8.uuid(), expiresAt: z8.number() });
+var BrowserConnectPollSchema = z8.discriminatedUnion("state", [
+  z8.object({ state: z8.literal("pending") }),
+  z8.object({ state: z8.literal("approved"), memberId: NameSchema })
+]);
+var BrowserConnectInfoSchema = z8.object({
+  projectName: z8.string(),
+  label: z8.string(),
+  approvedBy: NameSchema.nullable(),
+  expiresAt: z8.number()
+});
+
 // packages/transport/hub-client.ts
 var HubRequestError = class extends Error {
   constructor(message2, status, code, requestId) {
@@ -370,6 +393,17 @@ var HubClient = class {
   get url() {
     return this.baseUrl.toString();
   }
+  startBrowserConnect(input) {
+    return this.request("POST", "api/v1/devices/connect", BrowserConnectStartSchema, input);
+  }
+  pollBrowserConnect(id, secret) {
+    return this.request(
+      "POST",
+      `api/v1/devices/connect/${encodeURIComponent(id)}/poll`,
+      BrowserConnectPollSchema,
+      { secret }
+    );
+  }
   bind(deviceId, projectId) {
     return this.request("POST", "api/v1/bind", BindingSchema, {
       deviceId,
@@ -400,7 +434,7 @@ var HubClient = class {
       void 0,
       BLOB_TRANSFER_TIMEOUT_MS
     );
-    if (!response.ok) return this.decode(response, signal, z8.never());
+    if (!response.ok) return this.decode(response, signal, z9.never());
     const reader = response.body?.getReader();
     if (!reader) throw new Error("Server returned no content body.");
     const parts = [];
@@ -445,7 +479,7 @@ var HubClient = class {
     return this.request(
       "PUT",
       "api/v1/devices/self/status",
-      z8.object({ ok: z8.literal(true) }),
+      z9.object({ ok: z9.literal(true) }),
       status
     );
   }
@@ -566,15 +600,15 @@ var HubClient = class {
 import { createHash as createHash8 } from "node:crypto";
 import { realpath as realpath6 } from "node:fs/promises";
 import { homedir as homedir4 } from "node:os";
-import { dirname as dirname9, join as join16, resolve as resolve8 } from "node:path";
+import { dirname as dirname9, join as join17, resolve as resolve8 } from "node:path";
 import { parseArgs as parseArgs2 } from "node:util";
 
 // packages/protocol/file-publication.ts
-import { z as z9 } from "zod";
+import { z as z10 } from "zod";
 var FilePublicationSchema = FileCommitSchema.safeExtend({
   configRevision: RevisionSchema.optional()
 }).strict();
-var PublishFilesSchema = z9.object({ manifest: BlobRefSchema }).strict();
+var PublishFilesSchema = z10.object({ manifest: BlobRefSchema }).strict();
 
 // packages/state/sqlite.ts
 import { chmodSync, mkdirSync } from "node:fs";
@@ -591,7 +625,7 @@ function transaction(db, action) {
     throw error;
   }
 }
-function openDatabase(path, migrations, busyTimeoutMs = 5e3) {
+function openDatabase(path, migrations, busyTimeoutMs = 5e3, journalMode = "WAL") {
   if (!Number.isSafeInteger(busyTimeoutMs) || busyTimeoutMs < 0)
     throw new Error("Invalid SQLite busy timeout.");
   mkdirSync(dirname(path), { recursive: true, mode: 448 });
@@ -599,7 +633,7 @@ function openDatabase(path, migrations, busyTimeoutMs = 5e3) {
   try {
     chmodSync(path, 384);
     db.exec(
-      `PRAGMA busy_timeout = ${busyTimeoutMs}; PRAGMA foreign_keys = ON; PRAGMA journal_mode = WAL; PRAGMA synchronous = FULL;`
+      `PRAGMA busy_timeout = ${busyTimeoutMs}; PRAGMA foreign_keys = ON; PRAGMA journal_mode = ${journalMode}; PRAGMA synchronous = FULL;`
     );
     transaction(db, () => {
       const version = Number(db.prepare("PRAGMA user_version").get().user_version);
@@ -950,8 +984,8 @@ var RuntimeState = class {
 
 // apps/client/state.ts
 import { randomUUID as randomUUID4 } from "node:crypto";
-import { join as join6, relative as relative2, isAbsolute, sep as sep2 } from "node:path";
-import { z as z11 } from "zod";
+import { join as join7, relative as relative2, isAbsolute, sep as sep2 } from "node:path";
+import { z as z13 } from "zod";
 import { DatabaseSync as DatabaseSync3 } from "node:sqlite";
 
 // apps/client/runtime/state-access.ts
@@ -1052,25 +1086,88 @@ function stateVersion(directory) {
 import { execFile } from "node:child_process";
 import { promisify } from "node:util";
 import { lstat as lstat2, mkdir as mkdir2, realpath as realpath2, rmdir as rmdir2 } from "node:fs/promises";
-import { basename, dirname as dirname4, join as join4, resolve } from "node:path";
+import { basename, dirname as dirname4, join as join5, resolve } from "node:path";
 
 // apps/client/files/local-fs.ts
 import { createHash as createHash2, randomUUID as randomUUID2 } from "node:crypto";
-import { constants } from "node:fs";
-import { lstat, mkdir, open, readdir, realpath, rename, rmdir, unlink } from "node:fs/promises";
-import { dirname as dirname3, join as join3, relative, sep } from "node:path";
+import { constants as constants2 } from "node:fs";
+import { lstat, mkdir, open as open2, readdir, realpath, rename, rmdir, unlink } from "node:fs/promises";
+import { dirname as dirname3, join as join4, relative, sep } from "node:path";
 import { setImmediate } from "node:timers/promises";
+
+// packages/workspace/local-config.ts
+import { constants } from "node:fs";
+import { open, writeFile } from "node:fs/promises";
+import { join as join3 } from "node:path";
+import { z as z11 } from "zod";
+import ignore from "ignore";
+function ignored(path) {
+  return path.split("/").some(
+    (part) => part === ".git" || part === ".DS_Store" || /^\.teammy(?:[-.]|$)/i.test(part) || /(?:~|\.(?:swp|swx|tmp|part))$/i.test(part)
+  );
+}
 function missing(error) {
   return error instanceof Error && "code" in error && ["ENOENT", "ENOTDIR"].includes(String(error.code));
 }
+var LOCAL_CONFIG_NAME = ".teammy-local.json";
+var LocalConfigSchema = z11.object({
+  files: z11.object({ ignore: z11.array(z11.string().max(1024)).max(256).default([]) }).strict().default({ ignore: [] })
+}).strict();
+async function ensureLocalConfig(root) {
+  try {
+    await writeFile(
+      join3(root, LOCAL_CONFIG_NAME),
+      JSON.stringify({ files: { ignore: [] } }, null, 2) + "\n",
+      { flag: "wx", mode: 384 }
+    );
+  } catch (error) {
+    if (!(error instanceof Error && "code" in error && error.code === "EEXIST")) throw error;
+  }
+}
+async function loadLocalRules(root) {
+  let rules = [];
+  try {
+    const file = await open(
+      join3(root, LOCAL_CONFIG_NAME),
+      constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK
+    );
+    try {
+      const before = await file.stat();
+      if (!before.isFile() || before.size > 65536)
+        throw new Error("Expected a regular configuration file no larger than 64 KiB.");
+      const buffer = Buffer.alloc(65537);
+      const { bytesRead } = await file.read(buffer, 0, buffer.length, 0);
+      if (bytesRead > 65536 || bytesRead !== before.size)
+        throw new Error("Configuration exceeds the read limit or changed while reading.");
+      const text = new TextDecoder("utf-8", { fatal: true }).decode(buffer.subarray(0, bytesRead));
+      const after = await file.stat();
+      if (before.size !== after.size || before.mtimeMs !== after.mtimeMs)
+        throw new Error("Configuration is being saved; retry on the next check.");
+      rules = LocalConfigSchema.parse(JSON.parse(text)).files.ignore;
+    } finally {
+      await file.close();
+    }
+  } catch (error) {
+    if (!missing(error))
+      throw new Error(
+        `${LOCAL_CONFIG_NAME}: invalid or unreadable configuration; uploads paused.`,
+        { cause: error }
+      );
+  }
+  const matcher = ignore().add(rules);
+  return {
+    fingerprint: JSON.stringify(rules),
+    excludes: (path, directory = false) => ignored(path) || matcher.ignores(path + (directory && !path.endsWith("/") ? "/" : ""))
+  };
+}
+
+// apps/client/files/local-fs.ts
+function missing2(error) {
+  return error instanceof Error && "code" in error && ["ENOENT", "ENOTDIR"].includes(String(error.code));
+}
 function signature(stat2) {
   return [stat2.dev, stat2.ino, stat2.size, stat2.mtimeNs, stat2.ctimeNs].join(":");
 }
-function ignored(path) {
-  return path.split("/").some(
-    (part) => part === ".git" || part === ".DS_Store" || /^\.teammy(?:[-.]|$)/i.test(part) || /(?:~|\.(?:swp|swx|tmp|part))$/i.test(part)
-  );
-}
 async function safePath(root, path, createParents = false) {
   FilePathSchema.parse(path);
   const rootStat = await lstat(root);
@@ -1079,7 +1176,7 @@ async function safePath(root, path, createParents = false) {
   const parts = path.split("/");
   let parent = root;
   for (const part of parts.slice(0, -1)) {
-    parent = join3(parent, part);
+    parent = join4(parent, part);
     if (createParents)
       await mkdir(parent).catch((error) => {
         if (error.code !== "EEXIST") throw error;
@@ -1089,7 +1186,7 @@ async function safePath(root, path, createParents = false) {
     if (!stat2.isDirectory())
       throw Object.assign(new Error(`Parent is not a directory: ${path}`), { code: "ENOTDIR" });
   }
-  return join3(root, ...parts);
+  return join4(root, ...parts);
 }
 async function metadata(root, path) {
   try {
@@ -1099,7 +1196,7 @@ async function metadata(root, path) {
       throw new Error(`Unsupported filesystem entry: ${path}`);
     return { signature: signature(stat2), directory: stat2.isDirectory() };
   } catch (error) {
-    if (missing(error)) return null;
+    if (missing2(error)) return null;
     throw error;
   }
 }
@@ -1149,7 +1246,7 @@ async function readStable(root, path) {
   const inside = relative(await realpath(root), resolvedBefore);
   if (inside.startsWith(`..${sep}`) || inside === "..")
     throw new Error(`File escapes sync root: ${path}`);
-  const file = await open(target, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
+  const file = await open2(target, constants2.O_RDONLY | (constants2.O_NOFOLLOW ?? 0));
   try {
     const before = await file.stat({ bigint: true });
     if (!before.isFile() || before.size > BigInt(MAX_FILE_BYTES))
@@ -1179,7 +1276,7 @@ async function readStable(root, path) {
 }
 async function syncDirectory(directory) {
   if (process.platform === "win32") return;
-  const handle = await open(directory, "r");
+  const handle = await open2(directory, "r");
   try {
     await handle.sync();
   } finally {
@@ -1188,8 +1285,8 @@ async function syncDirectory(directory) {
 }
 async function replaceFile(root, path, bytes, expected) {
   const target = await safePath(root, path, true);
-  const temporary = join3(dirname3(target), `.teammy-${randomUUID2()}.tmp`);
-  const file = await open(temporary, "wx", 384);
+  const temporary = join4(dirname3(target), `.teammy-${randomUUID2()}.tmp`);
+  const file = await open2(temporary, "wx", 384);
   try {
     try {
       await file.writeFile(bytes);
@@ -1213,7 +1310,7 @@ async function replaceFile(root, path, bytes, expected) {
     }
   } finally {
     await unlink(temporary).catch((error) => {
-      if (!missing(error)) throw error;
+      if (!missing2(error)) throw error;
     });
   }
 }
@@ -1241,7 +1338,7 @@ async function removeFile(root, path, expected) {
 var exec = promisify(execFile);
 async function workspacePath(input) {
   const path = resolve(input);
-  return join4(await realpath2(dirname4(path)), basename(path));
+  return join5(await realpath2(dirname4(path)), basename(path));
 }
 async function directoryIdentity(root) {
   const stat2 = await lstat2(root, { bigint: true });
@@ -1257,33 +1354,43 @@ async function verifyWorkspace(state, root) {
       "Workspace directory was replaced. Restore the original directory before syncing."
     );
 }
-async function ignorePlan(root) {
+async function workspaceGitInfo(root) {
   const parent = dirname4(root), name2 = basename(root);
-  if (/[\r\n]/.test(name2)) throw new Error("Workspace name cannot contain a newline.");
   let repo = false;
   for (let p = parent; ; p = dirname4(p)) {
     try {
-      await lstat2(join4(p, ".git"));
+      await lstat2(join5(p, ".git"));
       repo = true;
       break;
     } catch (e) {
-      if (!missing(e)) throw e;
+      if (!missing2(e)) throw e;
     }
     if (p === dirname4(p)) break;
   }
-  if (repo) {
-    let tracked;
-    try {
-      tracked = (await exec("git", ["-C", parent, "--literal-pathspecs", "ls-files", "-z", "--", name2], {
-        maxBuffer: 1024 * 1024
-      })).stdout;
-    } catch {
-      throw new Error("Cannot inspect the Git index. Check Git access before connecting.");
-    }
-    if (tracked)
-      throw new Error(
-        "Git already tracks this workspace path. Remove it from the Git index yourself before connecting."
-      );
+  if (!repo) return { repo: false, tracked: false, date: null };
+  try {
+    const tracked = (await exec("git", ["-C", parent, "--literal-pathspecs", "ls-files", "-z", "--", name2], {
+      maxBuffer: 16 * 1024 * 1024
+    })).stdout;
+    const date = tracked ? await exec("git", [
+      "-C",
+      parent,
+      "--literal-pathspecs",
+      "log",
+      "-1",
+      "--format=%cI",
+      "--",
+      name2
+    ]).then((result2) => result2.stdout.trim() || null).catch(() => null) : null;
+    return { repo: true, tracked: Boolean(tracked), date };
+  } catch {
+    throw new Error("Cannot inspect the Git index. Check Git access before connecting.");
+  }
+}
+async function ignorePlan(root) {
+  const parent = dirname4(root), name2 = basename(root);
+  if (/[\r\n]/.test(name2)) throw new Error("Workspace name cannot contain a newline.");
+  if ((await workspaceGitInfo(root)).repo) {
     try {
       await exec("git", ["-C", parent, "check-ignore", "--no-index", "-q", "--", name2 + "/"]);
       return;
@@ -1314,7 +1421,7 @@ async function prepareWorkspace(state, root, input, reconnect = false) {
     await lstat2(root);
     present = true;
   } catch (e) {
-    if (!missing(e)) throw e;
+    if (!missing2(e)) throw e;
   }
   if (present) {
     if (reconnect && state.binding(root)) {
@@ -1327,12 +1434,16 @@ async function prepareWorkspace(state, root, input, reconnect = false) {
       if (ignore3) await replaceFile(ignore3.parent, ".gitignore", ignore3.bytes, ignore3.signature);
       return;
     }
-    throw new Error(
-      'Workspace path already exists. Choose another directory; for a connected workspace use "teammy sync on".'
-    );
+    if (prior || state.binding(root))
+      throw new Error(
+        'Workspace is already prepared. Use the original connect command or "teammy sync on".'
+      );
+    await directoryIdentity(root);
+    return true;
   }
   if (state.binding(root) || prior)
     throw new Error("Connected workspace is missing. Restore its directory before syncing.");
+  if ((await workspaceGitInfo(root)).tracked) return true;
   const ignore2 = await ignorePlan(root);
   await mkdir2(root);
   try {
@@ -1352,7 +1463,7 @@ function completePreparation(state, root) {
 
 // apps/client/runtime/log.ts
 import { appendFileSync, mkdirSync as mkdirSync4, renameSync as renameSync2, statSync, unlinkSync, readFileSync as readFileSync2 } from "node:fs";
-import { join as join5 } from "node:path";
+import { join as join6 } from "node:path";
 import { createHash as createHash3 } from "node:crypto";
 function rootKey(root) {
   return createHash3("sha256").update(root).digest("hex").slice(0, 16);
@@ -1368,9 +1479,9 @@ function diagnostic(error) {
 var ClientLog = class {
   constructor(directory, limit = 1024 * 1024) {
     this.limit = limit;
-    const logs = join5(directory, "logs");
+    const logs = join6(directory, "logs");
     mkdirSync4(logs, { recursive: true, mode: 448 });
-    this.path = join5(logs, "client.jsonl");
+    this.path = join6(logs, "client.jsonl");
   }
   limit;
   path;
@@ -1427,43 +1538,43 @@ var ClientLog = class {
 import { setTimeout as setTimeout2 } from "node:timers/promises";
 
 // packages/protocol/devices.ts
-import { z as z10 } from "zod";
-var CredentialSchema = z10.string().regex(/^tmy_[a-f0-9]{64}$/);
-var EnrollmentSchema = z10.object({
-  operationId: z10.uuid(),
+import { z as z12 } from "zod";
+var CredentialSchema = z12.string().regex(/^tmy_[a-f0-9]{64}$/);
+var EnrollmentSchema = z12.object({
+  operationId: z12.uuid(),
   projectId: NameSchema,
   memberId: NameSchema,
   deviceId: DeviceIdSchema,
   credential: CredentialSchema
 }).strict();
-var EffectivePolicySchema = z10.object({
-  checkIntervalSeconds: z10.number().min(1).max(86400),
-  fileSettleSeconds: z10.number().min(0).max(86400)
+var EffectivePolicySchema = z12.object({
+  checkIntervalSeconds: z12.number().min(1).max(86400),
+  fileSettleSeconds: z12.number().min(0).max(86400)
 }).strict();
-var SyncSummarySchema = z10.object({
-  checkedAt: z10.string(),
-  published: z10.boolean(),
-  appliedFiles: z10.number().int().nonnegative(),
-  pendingFiles: z10.number().int().nonnegative(),
-  sessionSources: z10.number().int().nonnegative(),
-  errors: z10.array(z10.string().max(1e3)).max(20)
+var SyncSummarySchema = z12.object({
+  checkedAt: z12.string(),
+  published: z12.boolean(),
+  appliedFiles: z12.number().int().nonnegative(),
+  pendingFiles: z12.number().int().nonnegative(),
+  sessionSources: z12.number().int().nonnegative(),
+  errors: z12.array(z12.string().max(1e3)).max(20)
 }).strict();
-var DeviceStatusSchema = z10.object({
-  clientVersion: z10.string().max(64),
+var DeviceStatusSchema = z12.object({
+  clientVersion: z12.string().max(64),
   receivedRevision: RevisionSchema.nullable(),
   appliedRevision: RevisionSchema.nullable(),
   effectivePolicy: EffectivePolicySchema,
-  overrides: z10.array(z10.enum(["checkIntervalSeconds", "fileSettleSeconds"])).max(2),
-  configError: z10.string().max(2e3).nullable(),
-  reportError: z10.string().max(2e3).nullable(),
+  overrides: z12.array(z12.enum(["checkIntervalSeconds", "fileSettleSeconds"])).max(2),
+  configError: z12.string().max(2e3).nullable(),
+  reportError: z12.string().max(2e3).nullable(),
   lastSync: SyncSummarySchema.nullable()
 }).strict();
-var WebDevicesSchema = z10.object({
-  devices: z10.array(
-    z10.object({
+var WebDevicesSchema = z12.object({
+  devices: z12.array(
+    z12.object({
       memberId: NameSchema,
-      bound: z10.boolean(),
-      lastSeenAt: z10.string().nullable(),
+      bound: z12.boolean(),
+      lastSeenAt: z12.string().nullable(),
       status: DeviceStatusSchema.nullable()
     })
   )
@@ -1864,9 +1975,9 @@ var SessionState = class {
 
 // apps/client/state.ts
 var LocalBindingSchema = BindingSchema.extend({
-  root: z11.string(),
-  serverUrl: z11.string(),
-  token: z11.string()
+  root: z13.string(),
+  serverUrl: z13.string(),
+  token: z13.string()
 });
 var clientMigrations = [
   String.raw`
@@ -1885,7 +1996,11 @@ var clientMigrations = [
   projectFilesClientMigration,
   sessionSourcesMigration,
   atomicFilesClientMigration,
-  sessionParserMigration
+  sessionParserMigration,
+  `CREATE TABLE client_workspace_replacements (
+    root TEXT PRIMARY KEY REFERENCES connections(root), directory TEXT NOT NULL,
+    original_identity TEXT, incoming_identity TEXT, committed INTEGER NOT NULL DEFAULT 0
+  );`
 ];
 var clientSchemaVersion = clientMigrations.length;
 var ClientState = class extends FilePublicationState {
@@ -1904,19 +2019,19 @@ var ClientState = class extends FilePublicationState {
         throw new Error("Client state needs an upgrade. Run teammy repair.");
       if (options.readOnly) {
         if (!version) throw new Error("No client state is available.");
-        db = new DatabaseSync3(join6(directory, "client.sqlite3"), { readOnly: true });
+        db = new DatabaseSync3(join7(directory, "client.sqlite3"), { readOnly: true });
       } else if (!version) {
         access2?.close();
         access2 = void 0;
         const exclusive = options.maintenance ? void 0 : stateAccess(directory, true);
         try {
-          db = openDatabase(join6(directory, "client.sqlite3"), clientMigrations);
+          db = openDatabase(join7(directory, "client.sqlite3"), clientMigrations);
         } finally {
           exclusive?.close();
         }
         if (!options.maintenance) access2 = stateAccess(directory);
       } else {
-        db = new DatabaseSync3(join6(directory, "client.sqlite3"));
+        db = new DatabaseSync3(join7(directory, "client.sqlite3"));
         db.exec("PRAGMA busy_timeout=5000; PRAGMA foreign_keys=ON; PRAGMA synchronous=FULL;");
       }
     } catch (error) {
@@ -1993,10 +2108,10 @@ async function stateLocation(root, directory) {
 // apps/client/sessions/setup.ts
 import { execFile as execFile2 } from "node:child_process";
 import { promisify as promisify2 } from "node:util";
-import { access, mkdir as mkdir5, readFile as readFile2, writeFile, realpath as realpath4 } from "node:fs/promises";
-import { constants as constants2 } from "node:fs";
+import { access, mkdir as mkdir5, readFile as readFile2, writeFile as writeFile2, realpath as realpath4 } from "node:fs/promises";
+import { constants as constants3 } from "node:fs";
 import { homedir } from "node:os";
-import { dirname as dirname6, join as join10, resolve as resolve4 } from "node:path";
+import { dirname as dirname6, join as join11, resolve as resolve4 } from "node:path";
 import { createHash as createHash6 } from "node:crypto";
 
 // apps/client/sessions/normalize.ts
@@ -2166,8 +2281,8 @@ var JsonlNormalizer = class {
 
 // apps/client/sessions/registration.ts
 import { existsSync as existsSync3, readFileSync as readFileSync3, readdirSync as readdirSync2 } from "node:fs";
-import { join as join7 } from "node:path";
-var registrationPath = (directory, root) => join7(directory, "hook-registrations", rootKey(root) + ".json");
+import { join as join8 } from "node:path";
+var registrationPath = (directory, root) => join8(directory, "hook-registrations", rootKey(root) + ".json");
 function readRegistration(directory, root) {
   const path = registrationPath(directory, root);
   if (!existsSync3(path)) return null;
@@ -2180,16 +2295,16 @@ function saveRegistration(directory, value) {
   writePrivateJson(registrationPath(directory, value.root), value);
 }
 function registrations(directory, onError) {
-  const path = join7(directory, "hook-registrations");
+  const path = join8(directory, "hook-registrations");
   if (!existsSync3(path)) return [];
   return readdirSync2(path).filter((name2) => /^[a-f0-9]{16}\.json$/.test(name2)).flatMap((name2) => {
     try {
-      const value = JSON.parse(readFileSync3(join7(path, name2), "utf8"));
+      const value = JSON.parse(readFileSync3(join8(path, name2), "utf8"));
       const registration = readRegistration(directory, value.root);
       if (!registration) throw new Error("Missing Hook registration.");
       return [registration];
     } catch (error) {
-      onError(join7(path, name2), error);
+      onError(join8(path, name2), error);
       return [];
     }
   });
@@ -2197,12 +2312,12 @@ function registrations(directory, onError) {
 
 // apps/client/root-lock.ts
 import { createHash as createHash5 } from "node:crypto";
-import { join as join8 } from "node:path";
+import { join as join9 } from "node:path";
 function acquireRootLock(root, stateDirectory) {
   let lock;
   try {
     lock = openDatabase(
-      join8(stateDirectory, "locks", `${createHash5("sha256").update(root).digest("hex")}.sqlite3`),
+      join9(stateDirectory, "locks", `${createHash5("sha256").update(root).digest("hex")}.sqlite3`),
       [],
       0
     );
@@ -2221,29 +2336,29 @@ import { DatabaseSync as DatabaseSync4 } from "node:sqlite";
 
 // apps/client/sessions/pi-extension.ts
 import { mkdir as mkdir4, readFile } from "node:fs/promises";
-import { dirname as dirname5, basename as basename2, join as join9, resolve as resolve3 } from "node:path";
+import { dirname as dirname5, basename as basename2, join as join10, resolve as resolve3 } from "node:path";
 var marker = (directory) => `// Teammy Pi collection ${rootKey(directory)}`;
 function piPath(path, home, cwd) {
   return resolve3(
     cwd,
-    path === "~" ? home : path.startsWith("~/") ? join9(home, path.slice(2)) : path
+    path === "~" ? home : path.startsWith("~/") ? join10(home, path.slice(2)) : path
   );
 }
 async function piDiscoveryDirectories(agentDirectory, project, home, env) {
   let configured;
-  for (const path of [join9(agentDirectory, "settings.json"), join9(project, ".pi/settings.json")]) {
+  for (const path of [join10(agentDirectory, "settings.json"), join10(project, ".pi/settings.json")]) {
     try {
       const settings = JSON.parse(await readFile(path, "utf8"));
       if (typeof settings?.sessionDir === "string" && settings.sessionDir)
         configured = settings.sessionDir;
     } catch (error) {
-      if (!missing(error)) throw new Error(`Unable to read Pi session directory setting: ${path}`);
+      if (!missing2(error)) throw new Error(`Unable to read Pi session directory setting: ${path}`);
     }
   }
   configured = env.PI_CODING_AGENT_SESSION_DIR || configured;
   return [
     .../* @__PURE__ */ new Set([
-      join9(agentDirectory, "sessions"),
+      join10(agentDirectory, "sessions"),
       ...configured ? [piPath(configured, home, project)] : []
     ])
   ];
@@ -2264,7 +2379,7 @@ export default function teammyCollection(pi) {
         transcript_path: file,
       });
       const child = spawn(${JSON.stringify(process.execPath)}, [
-        ${JSON.stringify(join9(dirname5(entry), "session-hook.js"))},
+        ${JSON.stringify(join10(dirname5(entry), "session-hook.js"))},
         '--agent', 'pi', '--state-dir', ${JSON.stringify(directory)},
         '--integration-file', ${JSON.stringify(path)},
       ], { stdio: ['pipe', 'ignore', 'ignore'], windowsHide: true, shell: false });
@@ -2287,13 +2402,13 @@ export default function teammyCollection(pi) {
 `;
 }
 async function installPiExtension(directory, registry, agentDirectory, entry) {
-  const path = join9(agentDirectory, "extensions", `teammy-${rootKey(directory)}.js`);
+  const path = join10(agentDirectory, "extensions", `teammy-${rootKey(directory)}.js`);
   await mkdir4(dirname5(path), { recursive: true });
   let original = null;
   try {
     original = await readStable(dirname5(path), basename2(path));
   } catch (error) {
-    if (!missing(error)) throw error;
+    if (!missing2(error)) throw error;
   }
   if (original && !original.bytes.toString("utf8").startsWith(marker(directory) + "\n"))
     throw new Error(`Pi extension is not owned by Teammy: ${path}`);
@@ -2316,7 +2431,7 @@ async function removePiExtension(directory, path) {
     await removeFile(dirname5(path), basename2(path), original.signature);
     return true;
   } catch (error) {
-    if (missing(error)) return false;
+    if (missing2(error)) return false;
     throw error;
   }
 }
@@ -2324,7 +2439,7 @@ async function removePiExtension(directory, path) {
 // apps/client/sessions/setup.ts
 var exec2 = promisify2(execFile2);
 var quote = (value) => "'" + value.replace(/'/g, "'\\''") + "'";
-async function exists(path, mode = constants2.F_OK) {
+async function exists(path, mode = constants3.F_OK) {
   try {
     await access(path, mode);
     return true;
@@ -2335,7 +2450,7 @@ async function exists(path, mode = constants2.F_OK) {
 async function setupSessions(state, root, directory, options = {}) {
   await realpath4(root);
   if (!state.binding(root)) throw new Error("Connect this root before installing hooks.");
-  const lock = acquireRootLock("hooks", join10(directory, "runtime"));
+  const lock = acquireRootLock("hooks", join11(directory, "runtime"));
   try {
     const prior = readRegistration(directory, root);
     if (prior && !prior.enabled && !options.enable)
@@ -2355,7 +2470,7 @@ async function setupSessions(state, root, directory, options = {}) {
       {
         agent: "claude-code",
         executables: ["claude"],
-        storage: env.CLAUDE_CONFIG_DIR ?? join10(home, ".claude"),
+        storage: env.CLAUDE_CONFIG_DIR ?? join11(home, ".claude"),
         directories: ["projects"],
         config: ".claude/settings.local.json",
         events: ["Stop", "SessionEnd"]
@@ -2363,7 +2478,7 @@ async function setupSessions(state, root, directory, options = {}) {
       {
         agent: "codex",
         executables: ["codex"],
-        storage: env.CODEX_HOME ?? join10(home, ".codex"),
+        storage: env.CODEX_HOME ?? join11(home, ".codex"),
         directories: ["sessions"],
         config: ".codex/hooks.json",
         events: ["Stop", "SessionEnd"]
@@ -2372,7 +2487,7 @@ async function setupSessions(state, root, directory, options = {}) {
         agent: "claude-code",
         instance: "tclaude",
         executables: ["tclaude"],
-        storage: join10(home, ".tclaude"),
+        storage: join11(home, ".tclaude"),
         directories: ["projects"],
         config: ".claude/settings.local.json",
         events: ["Stop", "SessionEnd"]
@@ -2381,7 +2496,7 @@ async function setupSessions(state, root, directory, options = {}) {
         agent: "codex",
         instance: "tcodex",
         executables: ["tcodex"],
-        storage: join10(home, ".tcodex"),
+        storage: join11(home, ".tcodex"),
         directories: ["sessions"],
         config: ".codex/hooks.json",
         events: ["Stop", "SessionEnd"]
@@ -2389,7 +2504,7 @@ async function setupSessions(state, root, directory, options = {}) {
       {
         agent: "cursor",
         executables: ["agent", "cursor-agent"],
-        storage: env.CURSOR_CONFIG_DIR ?? join10(home, ".cursor"),
+        storage: env.CURSOR_CONFIG_DIR ?? join11(home, ".cursor"),
         directories: ["chats", "projects"],
         config: ".cursor/hooks.json",
         events: ["sessionStart", "postToolUse", "stop", "sessionEnd"]
@@ -2397,7 +2512,7 @@ async function setupSessions(state, root, directory, options = {}) {
       {
         agent: "pi",
         executables: ["pi"],
-        storage: piPath(env.PI_CODING_AGENT_DIR ?? join10(home, ".pi", "agent"), home, project),
+        storage: piPath(env.PI_CODING_AGENT_DIR ?? join11(home, ".pi", "agent"), home, project),
         directories: []
       }
     ];
@@ -2411,7 +2526,7 @@ async function setupSessions(state, root, directory, options = {}) {
     for (const adapter of defaults) {
       const installed = options.agents ? options.agents.includes(adapter.instance ?? adapter.agent) : await exists(adapter.storage) || (await Promise.all(
         (env.PATH ?? "").split(":").flatMap(
-          (dir) => adapter.executables.map((name2) => exists(join10(dir, name2), constants2.X_OK))
+          (dir) => adapter.executables.map((name2) => exists(join11(dir, name2), constants3.X_OK))
         )
       )).some(Boolean);
       const piProfiles = adapter.agent === "pi" ? registry.configs.filter((config) => config.kind === "pi-extension").map((config) => dirname6(dirname6(config.path))) : [];
@@ -2421,8 +2536,8 @@ async function setupSessions(state, root, directory, options = {}) {
         if (!registry.excludedDiscovery?.includes(source))
           sessions.discover(adapter.agent, source, project);
       }
-      if (adapter.agent === "cursor" && !registry.excludedDiscovery?.includes(join10(home, ".cursor", "projects")))
-        sessions.discover("cursor", join10(home, ".cursor", "projects"), project);
+      if (adapter.agent === "cursor" && !registry.excludedDiscovery?.includes(join11(home, ".cursor", "projects")))
+        sessions.discover("cursor", join11(home, ".cursor", "projects"), project);
       if (!configured.includes(adapter.agent)) configured.push(adapter.agent);
       if (adapter.agent === "pi") {
         for (const profile of /* @__PURE__ */ new Set([...piProfiles, ...installed ? [adapter.storage] : []])) {
@@ -2448,7 +2563,7 @@ async function setupSessions(state, root, directory, options = {}) {
       }
       if (!adapter.config) continue;
       const configRoot = adapter.agent === "cursor" ? gitRoot : project;
-      const path = join10(configRoot, adapter.config);
+      const path = join11(configRoot, adapter.config);
       if (written.has(path)) continue;
       written.add(path);
       try {
@@ -2457,7 +2572,7 @@ async function setupSessions(state, root, directory, options = {}) {
         try {
           original = await readStable(configRoot, adapter.config);
         } catch (error) {
-          if (!missing(error)) throw error;
+          if (!missing2(error)) throw error;
         }
         const config = original ? JSON.parse(original.bytes.toString("utf8")) : {};
         if (!config || typeof config !== "object" || Array.isArray(config))
@@ -2467,7 +2582,7 @@ async function setupSessions(state, root, directory, options = {}) {
         const hooks = object(config.hooks);
         const marker2 = hookMarker(directory, root);
         const cliEntry = options.entry ?? resolve4(process.argv[1]);
-        const hookEntry = join10(dirname6(cliEntry), "session-hook.js");
+        const hookEntry = join11(dirname6(cliEntry), "session-hook.js");
         const invocation = [
           process.execPath,
           hookEntry,
@@ -2501,10 +2616,10 @@ async function setupSessions(state, root, directory, options = {}) {
         const bytes = Buffer.from(JSON.stringify(config, null, 2) + "\n");
         if (original?.bytes.equals(bytes)) continue;
         if (original) {
-          const backupDir = join10(directory, "hook-backups", rootKey(root));
+          const backupDir = join11(directory, "hook-backups", rootKey(root));
           await mkdir5(backupDir, { recursive: true, mode: 448 });
           const hash2 = createHash6("sha256").update(original.bytes).digest("hex");
-          await writeFile(join10(backupDir, `${adapter.agent}-${hash2}.json`), original.bytes, {
+          await writeFile2(join11(backupDir, `${adapter.agent}-${hash2}.json`), original.bytes, {
             mode: 384
           });
         }
@@ -2522,7 +2637,7 @@ async function setupSessions(state, root, directory, options = {}) {
               "info/exclude"
             ])).stdout.trim();
             const old = await readFile2(exclude, "utf8").catch((e) => {
-              if (missing(e)) return "";
+              if (missing2(e)) return "";
               throw e;
             });
             const rule = "/" + relativePath.replace(/[\\*?[\]#! ]/g, "\\$&");
@@ -2533,7 +2648,7 @@ async function setupSessions(state, root, directory, options = {}) {
                 line: "# teammy-hook-" + rootKey(directory) + "-" + rootKey(root) + "\n" + rule
               };
               saveRegistration(directory, registry);
-              await writeFile(
+              await writeFile2(
                 exclude,
                 old + (old && !old.endsWith("\n") ? "\n" : "") + owned.exclude.line + "\n"
               );
@@ -2554,7 +2669,7 @@ function hookMarker(directory, root) {
   return `teammy-session-${rootKey(directory)}-${rootKey(root)}`;
 }
 function setDiscoveryPreference(directory, root, source, enabled) {
-  const lock = acquireRootLock("hooks", join10(directory, "runtime"));
+  const lock = acquireRootLock("hooks", join11(directory, "runtime"));
   try {
     const registry = readRegistration(directory, root);
     if (!registry) return;
@@ -2595,7 +2710,7 @@ async function legacyRegistrations(directory, explicitRoot) {
   const roots = new Set(explicitRoot ? [explicitRoot] : []);
   let db;
   try {
-    db = new DatabaseSync4(join10(directory, "client.sqlite3"), { readOnly: true });
+    db = new DatabaseSync4(join11(directory, "client.sqlite3"), { readOnly: true });
     for (const row of db.prepare("SELECT root FROM connections WHERE binding_json IS NOT NULL").all())
       if (!explicitRoot || row.root === explicitRoot) roots.add(String(row.root));
   } catch {
@@ -2615,15 +2730,15 @@ async function legacyRegistrations(directory, explicitRoot) {
     } catch {
     }
     const configs = [
-      { path: join10(project, ".claude/settings.local.json"), agent: "claude-code", created: false },
-      { path: join10(project, ".codex/hooks.json"), agent: "codex", created: false },
-      { path: join10(gitRoot, ".cursor/hooks.json"), agent: "cursor", created: false }
+      { path: join11(project, ".claude/settings.local.json"), agent: "claude-code", created: false },
+      { path: join11(project, ".codex/hooks.json"), agent: "codex", created: false },
+      { path: join11(gitRoot, ".cursor/hooks.json"), agent: "cursor", created: false }
     ];
     saveRegistration(directory, { format: 1, root, projectDir: project, enabled: true, configs });
   }
 }
 async function teardownSessions(directory, root) {
-  const lock = acquireRootLock("hooks", join10(directory, "runtime"));
+  const lock = acquireRootLock("hooks", join11(directory, "runtime"));
   const issues = [];
   let removed = 0;
   try {
@@ -2678,11 +2793,11 @@ async function teardownSessions(directory, root) {
             );
           if (config.exclude && !await exists(config.path)) {
             const text = await readFile2(config.exclude.path, "utf8");
-            await writeFile(config.exclude.path, text.replace(config.exclude.line + "\n", ""));
+            await writeFile2(config.exclude.path, text.replace(config.exclude.line + "\n", ""));
           }
           removed++;
         } catch (error) {
-          if (!missing(error))
+          if (!missing2(error))
             issues.push(
               `${config.path}: ${error instanceof Error ? error.message : "Hook removal failed."}`
             );
@@ -2700,32 +2815,32 @@ import { parseArgs } from "node:util";
 import { realpath as realpath5 } from "node:fs/promises";
 import { dirname as dirname7, isAbsolute as isAbsolute4, relative as relative4, resolve as resolve5, sep as sep4 } from "node:path";
 import { homedir as homedir2 } from "node:os";
-import { join as join12 } from "node:path";
+import { join as join13 } from "node:path";
 
 // apps/client/sessions/hooks.ts
 import { createHash as createHash7, randomUUID as randomUUID5 } from "node:crypto";
-import { mkdir as mkdir6, open as open2, opendir, rename as rename2, unlink as unlink2 } from "node:fs/promises";
-import { isAbsolute as isAbsolute3, join as join11 } from "node:path";
-import { z as z12 } from "zod";
-var HintSchema = z12.object({
+import { mkdir as mkdir6, open as open3, opendir, rename as rename2, unlink as unlink2 } from "node:fs/promises";
+import { isAbsolute as isAbsolute3, join as join12 } from "node:path";
+import { z as z14 } from "zod";
+var HintSchema = z14.object({
   agent: AgentSchema,
-  path: z12.string().min(1).max(4096).refine(isAbsolute3).optional(),
-  nativeId: z12.string().min(1).max(512).optional(),
-  projectDir: z12.string().min(1).max(4096).refine(isAbsolute3)
+  path: z14.string().min(1).max(4096).refine(isAbsolute3).optional(),
+  nativeId: z14.string().min(1).max(512).optional(),
+  projectDir: z14.string().min(1).max(4096).refine(isAbsolute3)
 });
 function inbox(directory, root) {
-  return join11(directory, "session-hints", createHash7("sha256").update(root).digest("hex"));
+  return join12(directory, "session-hints", createHash7("sha256").update(root).digest("hex"));
 }
 async function recordHint(directory, root, input) {
   const hint = HintSchema.parse(input);
   const targetDir = inbox(directory, root);
   await mkdir6(targetDir, { recursive: true, mode: 448 });
-  const target = join11(
+  const target = join12(
     targetDir,
     `${createHash7("sha256").update(JSON.stringify(hint)).digest("hex")}.json`
   );
   const temporary = `${target}.${randomUUID5()}.tmp`;
-  const handle = await open2(temporary, "wx", 384);
+  const handle = await open3(temporary, "wx", 384);
   try {
     await handle.writeFile(JSON.stringify(hint));
   } finally {
@@ -2746,9 +2861,9 @@ async function consumeHints(directory, root, sessions, refresh) {
   for await (const entry of dir) {
     if (!entry.isFile() || !entry.name.endsWith(".json")) continue;
     if (count++ >= 50) break;
-    const path = join11(inbox(directory, root), entry.name);
+    const path = join12(inbox(directory, root), entry.name);
     try {
-      const handle = await open2(path, "r");
+      const handle = await open3(path, "r");
       let body;
       try {
         if ((await handle.stat()).size > 16384) throw new Error("Oversized hook hint.");
@@ -2801,7 +2916,7 @@ async function runHook(args) {
       }
     });
     const directory = await realpath5(
-      resolve5(values["state-dir"] ?? join12(homedir2(), ".teammy", "client"))
+      resolve5(values["state-dir"] ?? join13(homedir2(), ".teammy", "client"))
     );
     const payload = values.file ? {} : await hookPayload();
     let selectedRoot = values.root;
@@ -2852,28 +2967,28 @@ async function runHook(args) {
 // apps/client/runtime/maintenance.ts
 import { mkdir as mkdir9, rename as rename4, rm as rm2, readFile as readFile4 } from "node:fs/promises";
 import { existsSync as existsSync4 } from "node:fs";
-import { join as join15, resolve as resolve7 } from "node:path";
+import { join as join16, resolve as resolve7 } from "node:path";
 import { DatabaseSync as DatabaseSync5 } from "node:sqlite";
 import { setTimeout as delay } from "node:timers/promises";
 
 // apps/client/runtime/ipc.ts
 import { createConnection } from "node:net";
 import { mkdir as mkdir7, lstat as lstat3, chmod } from "node:fs/promises";
-import { join as join13 } from "node:path";
-import { z as z13 } from "zod";
-var RequestSchema = z13.object({
-  method: z13.enum(["ping", "wake", "status", "once"]),
-  root: z13.string().max(4096).optional()
+import { join as join14 } from "node:path";
+import { z as z15 } from "zod";
+var RequestSchema = z15.object({
+  method: z15.enum(["ping", "wake", "status", "once"]),
+  root: z15.string().max(4096).optional()
 }).strict();
 function socketPath(directory) {
-  return join13(
+  return join14(
     "/tmp",
     `teammy-${process.getuid?.() ?? "user"}-${rootKey(directory)}`,
     "control.sock"
   );
 }
 async function prepareSocketDirectory(directory) {
-  const path = join13(socketPath(directory), "..");
+  const path = join14(socketPath(directory), "..");
   await mkdir7(path, { recursive: true, mode: 448 });
   const stat2 = await lstat3(path);
   if (!stat2.isDirectory() || stat2.isSymbolicLink() || stat2.uid !== process.getuid?.())
@@ -2959,8 +3074,8 @@ async function runningDaemon(directory) {
 import { execFile as execFile3 } from "node:child_process";
 import { promisify as promisify3 } from "node:util";
 import { homedir as homedir3 } from "node:os";
-import { dirname as dirname8, join as join14, resolve as resolve6 } from "node:path";
-import { mkdir as mkdir8, readFile as readFile3, writeFile as writeFile2, rename as rename3, rm } from "node:fs/promises";
+import { dirname as dirname8, join as join15, resolve as resolve6 } from "node:path";
+import { mkdir as mkdir8, readFile as readFile3, writeFile as writeFile3, rename as rename3, rm } from "node:fs/promises";
 import { setTimeout as setTimeout3 } from "node:timers/promises";
 var execute = promisify3(execFile3);
 var exec3 = (file, args, options = {}) => execute(file, args, { timeout: 45e3, ...options });
@@ -2977,7 +3092,7 @@ function serviceDefinition(directory, executable, entry, platform = process.plat
   if (platform === "darwin")
     return {
       id,
-      path: join14(userHome, "Library", "LaunchAgents", id + ".plist"),
+      path: join15(userHome, "Library", "LaunchAgents", id + ".plist"),
       content: `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0"><dict><key>Label</key><string>${id}</string><key>ProgramArguments</key><array>${args.map((a) => `<string>${xml(a)}</string>`).join("")}</array><key>RunAtLoad</key><true/><key>KeepAlive</key><true/><key>ThrottleInterval</key><integer>30</integer><key>WorkingDirectory</key><string>${xml(userHome)}</string></dict></plist>
@@ -2986,7 +3101,7 @@ function serviceDefinition(directory, executable, entry, platform = process.plat
   if (platform === "linux")
     return {
       id: id + ".service",
-      path: join14(userHome, ".config", "systemd", "user", id + ".service"),
+      path: join15(userHome, ".config", "systemd", "user", id + ".service"),
       content: `[Unit]
 Description=Teammy background synchronization
 [Service]
@@ -3047,7 +3162,7 @@ async function ensureDaemon(directory, version) {
   await mkdir8(dirname8(definition.path), { recursive: true });
   if (old !== definition.content) {
     const temp = definition.path + `.${process.pid}.tmp`;
-    await writeFile2(temp, definition.content, { mode: 384 });
+    await writeFile3(temp, definition.content, { mode: 384 });
     await rename3(temp, definition.path);
   }
   if (process.platform === "darwin") {
@@ -3093,7 +3208,7 @@ async function stopDaemon(directory, remove = false) {
   let loaded = false;
   let pid;
   try {
-    const saved = JSON.parse(await readFile3(join14(directory, "runtime", "daemon.json"), "utf8"));
+    const saved = JSON.parse(await readFile3(join15(directory, "runtime", "daemon.json"), "utf8"));
     if (saved.directory === directory && Number.isSafeInteger(saved.pid) && saved.pid > 0)
       pid = saved.pid;
   } catch {
@@ -3203,14 +3318,14 @@ async function prepareClient(directory, version, options = {}, control = service
   };
   let installed;
   try {
-    installed = JSON.parse(await readFile4(join15(directory, "runtime/installation.json"), "utf8"));
+    installed = JSON.parse(await readFile4(join16(directory, "runtime/installation.json"), "utf8"));
   } catch {
   }
   const probe = options.daemonStartup ? { state: "absent" } : await probeDaemon(directory);
   const changed = probe.state === "ready" && (probe.info.version !== version || probe.info.protocol !== CONTROL_PROTOCOL || probe.info.executable !== process.execPath || probe.info.entry !== resolve7(process.argv[1]));
   const required = options.force || options.stop || options.uninstall || schema !== clientSchemaVersion || JSON.stringify(installed) !== JSON.stringify(installation) || changed || probe.state === "unresponsive" || probe.state === "incompatible" || Boolean(record && (options.resume || ["repair", "upgrade"].includes(record.reason)));
   if (!required) return { maintained: false, enabled: 0, stopped: 0, issues: [] };
-  const mutex = acquireRootLock("maintenance", join15(directory, "runtime"));
+  const mutex = acquireRootLock("maintenance", join16(directory, "runtime"));
   const log = new ClientLog(directory);
   let access2;
   let legacy;
@@ -3252,13 +3367,13 @@ async function prepareClient(directory, version, options = {}, control = service
         );
       let backup;
       if (before > 0 && before < clientSchemaVersion) {
-        const backups = join15(directory, "backups");
+        const backups = join16(directory, "backups");
         await mkdir9(backups, { recursive: true, mode: 448 });
-        backup = join15(backups, `before-schema-${before}.sqlite3`);
+        backup = join16(backups, `before-schema-${before}.sqlite3`);
         if (!existsSync4(backup)) {
           const temp = backup + ".tmp";
           await rm2(temp, { force: true });
-          const db = new DatabaseSync5(join15(directory, "client.sqlite3"));
+          const db = new DatabaseSync5(join16(directory, "client.sqlite3"));
           try {
             db.prepare("VACUUM INTO ?").run(temp);
           } finally {
@@ -3277,7 +3392,7 @@ async function prepareClient(directory, version, options = {}, control = service
         ...pauseReason ? { pauseReason } : {},
         ...backup ? { backup } : {}
       });
-      openDatabase(join15(directory, "client.sqlite3"), clientMigrations).close();
+      openDatabase(join16(directory, "client.sqlite3"), clientMigrations).close();
       state = new ClientState(directory, { maintenance: true });
       const runtime = new RuntimeState(state);
       if (options.intent) {
@@ -3300,16 +3415,16 @@ async function prepareClient(directory, version, options = {}, control = service
           issues.push(`${root}: ${diagnostic(error)}`);
         }
       }
-      writePrivateJson(join15(directory, "runtime/installation.json"), installation);
+      writePrivateJson(join16(directory, "runtime/installation.json"), installation);
       if (pauseReason)
         writeMaintenance(directory, { reason: pauseReason, phase: "paused", version });
       else await rm2(maintenancePath(directory), { force: true });
       restart = !options.daemonStartup && !pauseReason && enabled > 0;
       if (backup) {
-        const { readdir: readdir3 } = await import("node:fs/promises");
-        for (const file of await readdir3(join15(directory, "backups"))) {
-          if (/^before-schema-\d+\.sqlite3$/.test(file) && join15(directory, "backups", file) !== backup)
-            await rm2(join15(directory, "backups", file));
+        const { readdir: readdir4 } = await import("node:fs/promises");
+        for (const file of await readdir4(join16(directory, "backups"))) {
+          if (/^before-schema-\d+\.sqlite3$/.test(file) && join16(directory, "backups", file) !== backup)
+            await rm2(join16(directory, "backups", file));
         }
       }
       log.write(
@@ -3369,7 +3484,7 @@ async function runSessionCommand(args, version) {
     args: args.slice(1),
     options: {
       root: { type: "string", default: resolve8("workspaces") },
-      "state-dir": { type: "string", default: join16(homedir4(), ".teammy", "client") },
+      "state-dir": { type: "string", default: join17(homedir4(), ".teammy", "client") },
       agent: { type: "string" },
       file: { type: "string" },
       directory: { type: "string" },
@@ -3429,17 +3544,17 @@ async function runSessionCommand(args, version) {
       } else {
         const agent = AgentSchema.parse(values.agent);
         const defaults = {
-          "claude-code": join16(
-            process.env.CLAUDE_CONFIG_DIR ?? join16(homedir4(), ".claude"),
+          "claude-code": join17(
+            process.env.CLAUDE_CONFIG_DIR ?? join17(homedir4(), ".claude"),
             "projects"
           ),
-          codex: join16(process.env.CODEX_HOME ?? join16(homedir4(), ".codex"), "sessions"),
-          cursor: join16(
-            process.env.CURSOR_CONFIG_DIR ?? join16(homedir4(), ".cursor"),
+          codex: join17(process.env.CODEX_HOME ?? join17(homedir4(), ".codex"), "sessions"),
+          cursor: join17(
+            process.env.CURSOR_CONFIG_DIR ?? join17(homedir4(), ".cursor"),
             "chats",
             createHash8("md5").update(projectDir).digest("hex")
           ),
-          pi: join16(process.env.PI_CODING_AGENT_DIR ?? join16(homedir4(), ".pi", "agent"), "sessions"),
+          pi: join17(process.env.PI_CODING_AGENT_DIR ?? join17(homedir4(), ".pi", "agent"), "sessions"),
           dsh: void 0
         };
         const path = values.directory ?? defaults[agent];
@@ -3486,74 +3601,185 @@ async function runSessionCommand(args, version) {
 
 // apps/client/sync-command.ts
 import { parseArgs as parseArgs4 } from "node:util";
-import { setTimeout as setTimeout4 } from "node:timers/promises";
+import { setTimeout as setTimeout5 } from "node:timers/promises";
 
 // apps/client/client-command.ts
 import { parseArgs as parseArgs3 } from "node:util";
-import { join as join18, resolve as resolve10 } from "node:path";
+import { join as join19, resolve as resolve10 } from "node:path";
 import { homedir as homedir5 } from "node:os";
 import { createInterface as createInterface2 } from "node:readline/promises";
 
 // apps/client/connection.ts
-import { readFile as readFile5, mkdir as mkdir10 } from "node:fs/promises";
+import { readFile as readFile5, mkdir as mkdir11 } from "node:fs/promises";
 import { createInterface } from "node:readline/promises";
 
-// apps/client/local-config.ts
-import { constants as constants3 } from "node:fs";
-import { open as open3, writeFile as writeFile3 } from "node:fs/promises";
-import { join as join17 } from "node:path";
-import { z as z14 } from "zod";
-import ignore from "ignore";
-var LOCAL_CONFIG_NAME = ".teammy-local.json";
-var LocalConfigSchema = z14.object({
-  files: z14.object({ ignore: z14.array(z14.string().max(1024)).max(256).default([]) }).strict().default({ ignore: [] })
-}).strict();
-async function ensureLocalConfig(root) {
+// apps/client/workspace-replacement.ts
+import { lstat as lstat4, mkdir as mkdir10, mkdtemp, readdir as readdir2, rename as rename5, rm as rm3 } from "node:fs/promises";
+import { dirname as dirname10, join as join18 } from "node:path";
+var ConnectionCancelled = class extends Error {
+  constructor() {
+    super("\u5DF2\u53D6\u6D88\u63A5\u5165\uFF0C\u539F\u5DE5\u4F5C\u533A\u672A\u6539\u52A8\u3002");
+  }
+};
+async function localSnapshot(root) {
+  const entries = [];
+  let date = 0;
   try {
-    await writeFile3(
-      join17(root, LOCAL_CONFIG_NAME),
-      JSON.stringify({ files: { ignore: [] } }, null, 2) + "\n",
-      { flag: "wx", mode: 384 }
-    );
+    const identity = await directoryIdentity(root);
+    const pending = [""];
+    while (pending.length) {
+      const path = pending.pop();
+      const stat2 = await lstat4(join18(root, path), { bigint: true });
+      entries.push([path, signature(stat2)]);
+      if (stat2.isFile()) date = Math.max(date, Number(stat2.mtimeMs));
+      if (stat2.isDirectory() && !stat2.isSymbolicLink())
+        for (const name2 of await readdir2(join18(root, path))) pending.push(join18(path, name2));
+    }
+    entries.sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+    return {
+      identity,
+      fingerprint: JSON.stringify(entries),
+      date: date ? new Date(date).toISOString() : null
+    };
   } catch (error) {
-    if (!(error instanceof Error && "code" in error && error.code === "EEXIST")) throw error;
+    if (entries.length === 0 && missing2(error))
+      return { identity: null, fingerprint: "", date: null };
+    throw error;
   }
 }
-async function loadLocalRules(root) {
-  let rules = [];
+async function identityIfPresent(path) {
   try {
-    const file = await open3(
-      join17(root, LOCAL_CONFIG_NAME),
-      constants3.O_RDONLY | constants3.O_NOFOLLOW | constants3.O_NONBLOCK
-    );
-    try {
-      const before = await file.stat();
-      if (!before.isFile() || before.size > 65536)
-        throw new Error("Expected a regular configuration file no larger than 64 KiB.");
-      const buffer = Buffer.alloc(65537);
-      const { bytesRead } = await file.read(buffer, 0, buffer.length, 0);
-      if (bytesRead > 65536 || bytesRead !== before.size)
-        throw new Error("Configuration exceeds the read limit or changed while reading.");
-      const text = new TextDecoder("utf-8", { fatal: true }).decode(buffer.subarray(0, bytesRead));
-      const after = await file.stat();
-      if (before.size !== after.size || before.mtimeMs !== after.mtimeMs)
-        throw new Error("Configuration is being saved; retry on the next check.");
-      rules = LocalConfigSchema.parse(JSON.parse(text)).files.ignore;
-    } finally {
-      await file.close();
-    }
+    return await directoryIdentity(path);
   } catch (error) {
-    if (!missing(error))
+    if (missing2(error)) return null;
+    throw error;
+  }
+}
+async function recoverWorkspaceReplacement(state, root) {
+  const row = state.db.prepare("SELECT * FROM client_workspace_replacements WHERE root=?").get(root);
+  if (!row) return;
+  const directory = String(row.directory);
+  const previous = join18(directory, "previous");
+  const currentIdentity = await identityIfPresent(root);
+  if (row.committed) {
+    if (currentIdentity !== row.incoming_identity)
       throw new Error(
-        `${LOCAL_CONFIG_NAME}: invalid or unreadable configuration; uploads paused.`,
-        { cause: error }
+        "Connected workspace was replaced. Preserve the recovery directory before retrying."
       );
+  } else {
+    const previousIdentity = await identityIfPresent(previous);
+    if (previousIdentity) {
+      if (previousIdentity !== row.original_identity || currentIdentity && currentIdentity !== row.incoming_identity)
+        throw new Error(
+          "Workspace changed during recovery. Preserve both directories before retrying."
+        );
+      if (currentIdentity) await rm3(root, { recursive: true });
+      await rename5(previous, root);
+    } else if (currentIdentity !== row.original_identity) {
+      if (row.original_identity === null && currentIdentity === row.incoming_identity)
+        await rm3(root, { recursive: true });
+      else
+        throw new Error(
+          "Original workspace is unavailable. Preserve the recovery directory before retrying."
+        );
+    }
   }
-  const matcher = ignore().add(rules);
-  return {
-    fingerprint: JSON.stringify(rules),
-    excludes: (path, directory = false) => ignored(path) || matcher.ignores(path + (directory && !path.endsWith("/") ? "/" : ""))
-  };
+  await rm3(directory, { recursive: true, force: true });
+  state.db.prepare("DELETE FROM client_workspace_replacements WHERE root=?").run(root);
+}
+async function replaceExistingWorkspace(state, root, input, client, binding, confirm) {
+  const original = await localSnapshot(root);
+  const git = await workspaceGitInfo(root);
+  const shared = await client.sharedFilesConfig();
+  const members = (await client.members()).members;
+  const snapshots = [];
+  let remoteDate = null;
+  for (const owner of [.../* @__PURE__ */ new Set([...members, binding.memberId, PROJECT_FILE_OWNER])]) {
+    let revision;
+    let after = "";
+    const files = [];
+    for (; ; ) {
+      const page = await client.fileManifest(owner, revision, after);
+      if (revision !== void 0 && page.revision !== revision)
+        throw new Error("Manifest changed version during pagination.");
+      revision = page.revision;
+      files.push(...page.files);
+      if (page.nextCursor === null) {
+        snapshots.push({ owner, revision, complete: page.complete, files });
+        break;
+      }
+      if (page.nextCursor <= after) throw new Error("Manifest pagination did not advance.");
+      after = page.nextCursor;
+    }
+    if (revision > 0) {
+      const latest = (await client.fileChanges(owner, revision - 1)).revisions[0];
+      if (latest?.revision === revision && (!remoteDate || latest.createdAt > remoteDate))
+        remoteDate = latest.createdAt;
+    }
+  }
+  if (!await confirm({
+    localDate: git.date ?? original.date,
+    localDateSource: git.date ? "git" : "files",
+    remoteDate,
+    fileCount: snapshots.reduce((count, item) => count + item.files.length, 0),
+    tracked: git.tracked
+  }))
+    throw new ConnectionCancelled();
+  const ignore2 = await ignorePlan(root);
+  const directory = await mkdtemp(join18(dirname10(root), ".teammy-connect-"));
+  const incoming = join18(directory, "incoming");
+  try {
+    state.db.prepare(
+      "INSERT INTO client_workspace_replacements(root,directory,original_identity) VALUES (?,?,?)"
+    ).run(root, directory, original.identity);
+  } catch (error) {
+    await rm3(directory, { recursive: true, force: true });
+    throw error;
+  }
+  try {
+    await mkdir10(incoming);
+    for (const snapshot of snapshots) {
+      const target = snapshot.owner === PROJECT_FILE_OWNER ? incoming : join18(incoming, snapshot.owner);
+      if (target !== incoming) await mkdir10(target);
+      for (const file of snapshot.files) {
+        const bytes = await client.downloadBlob(file.sha256);
+        if (bytes.byteLength !== file.size) throw new Error(`Content size mismatch: ${file.path}`);
+        await replaceFile(target, file.path, bytes, null);
+      }
+    }
+    const identity = await directoryIdentity(incoming);
+    state.db.prepare("UPDATE client_workspace_replacements SET incoming_identity=? WHERE root=?").run(identity, root);
+    const current = await localSnapshot(root);
+    if (current.identity !== original.identity || current.fingerprint !== original.fingerprint)
+      throw new Error("\u4E0B\u8F7D\u671F\u95F4\u672C\u5730 workspaces \u5DF2\u53D8\u5316\uFF0C\u672A\u6267\u884C\u66FF\u6362\uFF1B\u8BF7\u786E\u8BA4\u6587\u4EF6\u540E\u91CD\u65B0 connect\u3002");
+    if (original.identity) await rename5(root, join18(directory, "previous"));
+    await rename5(incoming, root);
+    transaction(state.db, () => {
+      for (const snapshot of snapshots) {
+        const prefix = snapshot.owner === PROJECT_FILE_OWNER ? "project_" : "";
+        if (snapshot.owner === binding.memberId || prefix) {
+          state.db.prepare(
+            `INSERT OR REPLACE INTO ${prefix}publications(root,revision,initialized,complete) VALUES (?,?,1,?)`
+          ).run(root, snapshot.revision, Number(snapshot.complete));
+          state.db.prepare(`DELETE FROM ${prefix}owner_files WHERE root=?`).run(root);
+          for (const file of snapshot.files)
+            state.db.prepare(`INSERT INTO ${prefix}owner_files VALUES (?,?,?,?)`).run(root, file.path, file.sha256, file.size);
+        }
+        state.db.prepare(`INSERT OR REPLACE INTO ${prefix}received_progress VALUES (?,?,?)`).run(root, snapshot.owner, snapshot.revision);
+        state.db.prepare(`DELETE FROM ${prefix}received_files WHERE root=? AND owner=?`).run(root, snapshot.owner);
+        for (const file of snapshot.files)
+          state.db.prepare(`INSERT INTO ${prefix}received_files VALUES (?,?,?,?,?)`).run(root, snapshot.owner, file.path, file.sha256, file.size);
+      }
+      state.db.prepare("INSERT OR REPLACE INTO project_file_settings VALUES (?,?)").run(root, JSON.stringify(shared));
+      state.db.prepare("INSERT INTO client_preparations(root,identity,input_json) VALUES (?,?,?)").run(root, identity, JSON.stringify(input));
+      state.db.prepare("UPDATE client_workspace_replacements SET committed=1 WHERE root=?").run(root);
+    });
+  } catch (error) {
+    await recoverWorkspaceReplacement(state, root);
+    throw error;
+  }
+  await recoverWorkspaceReplacement(state, root);
+  if (ignore2) await replaceFile(ignore2.parent, ".gitignore", ignore2.bytes, ignore2.signature);
 }
 
 // apps/client/connection.ts
@@ -3561,6 +3787,7 @@ async function connectProject(state, root, directory, options) {
   const lock = acquireRootLock(root, directory);
   try {
     state.assertRootAvailable(root);
+    if (options.prepare) await recoverWorkspaceReplacement(state, root);
     const transport = new HubClient(options.url);
     const existing = state.binding(root);
     const project = new ClientProjectState(state, root);
@@ -3578,19 +3805,23 @@ async function connectProject(state, root, directory, options) {
         "This client requires a multi-project server. Update the server before connecting."
       );
     let member = options.member;
+    const input = { url: transport.url, project: options.project ?? "", member: member ?? "" };
+    const replace = options.prepare ? await prepareWorkspace(state, root, input, Boolean(options.reconnect)) : false;
+    let binding = existing;
+    let token = existing?.token;
+    let enrolled = false;
     if (existing && !options.reconnect && !options.tokenFile) {
       if (member && member !== existing.memberId)
         throw new Error("This root belongs to a different member.");
       const client2 = new HubClient(existing.serverUrl, 1e4, existing);
       await client2.members();
     } else if (options.tokenFile) {
-      const token = CredentialSchema.parse((await readFile5(options.tokenFile, "utf8")).trim());
+      token = CredentialSchema.parse((await readFile5(options.tokenFile, "utf8")).trim());
       const deviceId = state.deviceFor(root);
       const client2 = new HubClient(options.url, 1e4, { token, deviceId });
-      const binding2 = await client2.bind(deviceId, options.project ?? existing?.workspaceId);
-      if (options.project && binding2.workspaceId !== options.project)
+      binding = await client2.bind(deviceId, options.project ?? existing?.workspaceId);
+      if (options.project && binding.workspaceId !== options.project)
         throw new Error("Token belongs to a different project.");
-      state.saveBinding(root, client2.url, token, binding2);
     } else {
       member ??= existing?.memberId;
       if (!member && process.stdin.isTTY) {
@@ -3617,12 +3848,26 @@ async function connectProject(state, root, directory, options) {
         projectId,
         Boolean(options.reconnect)
       );
-      const binding2 = await transport.enroll(request);
-      state.saveBinding(root, transport.url, request.credential, binding2);
-      project.completeEnrollment();
+      binding = await transport.enroll(request);
+      token = request.credential;
+      enrolled = true;
     }
-    const binding = state.binding(root);
-    const client = new HubClient(binding.serverUrl, 1e4, binding);
+    if (!binding || !token) throw new Error("Connection credentials are unavailable.");
+    const client = new HubClient(transport.url, 1e4, { ...binding, token });
+    if (replace) {
+      if (!options.confirmReplacement)
+        throw new Error("Existing workspaces requires confirmation before connecting.");
+      await replaceExistingWorkspace(
+        state,
+        root,
+        input,
+        client,
+        binding,
+        options.confirmReplacement
+      );
+    }
+    const localBinding = state.saveBinding(root, transport.url, token, binding);
+    if (enrolled) project.completeEnrollment();
     if (info.capabilities.includes("project-config")) {
       try {
         await applyProjectFile(project, await client.projectConfig());
@@ -3633,9 +3878,9 @@ async function connectProject(state, root, directory, options) {
     }
     const own = await metadata(root, binding.memberId);
     if (own && !own.directory) throw new Error("Member path is not a directory.");
-    if (!own) await mkdir10(await safePath(root, binding.memberId));
+    if (!own) await mkdir11(await safePath(root, binding.memberId));
     await ensureLocalConfig(root);
-    const { token: _, ...visible } = binding;
+    const { token: _, ...visible } = localBinding;
     return { ...visible, configRevision: project.cached()?.config.configRevision ?? null };
   } finally {
     lock.close();
@@ -3658,6 +3903,16 @@ function result(title, detail) {
 function json(value) {
   process.stdout.write(JSON.stringify(value, null, 2) + "\n");
 }
+function browserPrompt(url) {
+  const ansi = process.stderr.isTTY && process.env.NO_COLOR === void 0 && process.env.TERM !== "dumb";
+  const title = "\u5728\u7F51\u9875\u786E\u8BA4\u8EAB\u4EFD";
+  const link2 = redact(url);
+  return ansi ? `\x1B[1m${title}\x1B[22m
+  \x1B[1;4m${link2}\x1B[0m
+` : `${title}
+  ${link2}
+`;
+}
 
 // apps/client/runtime/diagnostics.ts
 import { resolve as resolve9 } from "node:path";
@@ -3738,10 +3993,53 @@ async function runDiagnostics(command, options, version) {
   return issue ? 1 : 0;
 }
 
+// apps/client/browser-connect.ts
+import { randomBytes as randomBytes2, randomUUID as randomUUID6 } from "node:crypto";
+import { hostname } from "node:os";
+import { basename as basename3, dirname as dirname11 } from "node:path";
+import { spawn } from "node:child_process";
+import { setTimeout as setTimeout4 } from "node:timers/promises";
+function openBrowser(url) {
+  if (process.env.SSH_CONNECTION || process.env.SSH_TTY) return;
+  const command = process.platform === "darwin" ? "open" : process.platform === "linux" ? "xdg-open" : void 0;
+  if (!command) return;
+  const child = spawn(command, [url], { detached: true, stdio: "ignore" });
+  child.on("error", () => {
+  });
+  child.unref();
+}
+async function browserConnectMember(state, root, client, projectId, options = {}) {
+  const info = await client.serverInfo();
+  if (!info.capabilities.includes("browser-connect"))
+    throw new Error("\u670D\u52A1\u7AEF\u5C1A\u672A\u652F\u6301\u7F51\u9875\u786E\u8BA4\u8EAB\u4EFD\u3002\u8BF7\u5148\u4F7F\u7528 --member \u7528\u6237ID\uFF0C\u6216\u5347\u7EA7\u670D\u52A1\u7AEF\u3002");
+  const secret = randomBytes2(32).toString("hex");
+  const started = await client.startBrowserConnect({
+    id: randomUUID6(),
+    projectId,
+    deviceId: state.deviceFor(root),
+    secret,
+    label: `${hostname()} \xB7 ${basename3(dirname11(root))}`.slice(0, 255)
+  });
+  const url = new URL(`connect?request=${encodeURIComponent(started.id)}`, client.url).href;
+  (options.write ?? ((text) => process.stderr.write(text)))(browserPrompt(url));
+  (options.open ?? openBrowser)(url);
+  while (Date.now() < started.expiresAt) {
+    options.signal?.throwIfAborted();
+    try {
+      const status = await client.pollBrowserConnect(started.id, secret);
+      if (status.state === "approved") return status.memberId;
+    } catch (error) {
+      if (error instanceof HubRequestError && error.status < 500) throw error;
+    }
+    await setTimeout4(options.intervalMs ?? 2e3, void 0, { signal: options.signal });
+  }
+  throw new Error("\u7F51\u9875\u786E\u8BA4\u5DF2\u8D85\u65F6\uFF0C\u8BF7\u91CD\u65B0\u8FD0\u884C teammy connect\u3002");
+}
+
 // apps/client/client-command.ts
 var locationOptions = {
   root: { type: "string", default: resolve10("workspaces") },
-  "state-dir": { type: "string", default: join18(homedir5(), ".teammy", "client") },
+  "state-dir": { type: "string", default: join19(homedir5(), ".teammy", "client") },
   json: { type: "boolean" },
   help: { type: "boolean", short: "h" }
 };
@@ -3756,12 +4054,13 @@ async function runClientCommand(command, args, version) {
       "token-file": { type: "string" },
       reconnect: { type: "boolean" },
       "no-start": { type: "boolean" },
+      yes: { type: "boolean", short: "y" },
       all: { type: "boolean" }
     }
   });
   if (values.help) {
     process.stdout.write(
-      command === "connect" ? "Usage: teammy connect --url URL --project ID --member ID [--root DIR]\n\nCreates ./workspaces, adds Git ignore rules and starts login-session background sync.\nAdvanced: --no-start, --reconnect (stop sync first), --token-file FILE, --state-dir DIR, --json\n" : `Usage: teammy ${command} [--root DIR] [--state-dir DIR] [--json]${command === "logs" ? " [--all]" : ""}
+      command === "connect" ? "Usage: teammy connect --url URL --project ID [--root DIR]\n\nOpens a browser to confirm your user ID; --member ID remains available for scripts.\nCreates ./workspaces or confirms replacing an existing checkout with the server version.\nAdds Git ignore rules without changing tracked files in the index, then starts background sync.\nAdvanced: --yes (confirm replacement), --no-start, --reconnect (stop sync first), --token-file FILE, --state-dir DIR, --json\n" : `Usage: teammy ${command} [--root DIR] [--state-dir DIR] [--json]${command === "logs" ? " [--all]" : ""}
 `
     );
     return 0;
@@ -3782,29 +4081,42 @@ async function runClientCommand(command, args, version) {
     const transport = new HubClient(url);
     const selectedProject = values.project ?? (values.reconnect ? existing?.workspaceId : void 0);
     const project = selectedProject === void 0 && values["token-file"] ? void 0 : NameSchema.parse(selectedProject);
-    let member = values.member ?? (values.reconnect ? existing?.memberId : void 0);
-    if (!member && !values["token-file"] && process.stdin.isTTY) {
-      const rl = createInterface2({ input: process.stdin, output: process.stderr });
-      try {
-        member = (await rl.question("Member ID: ")).trim();
-      } finally {
-        rl.close();
-      }
-    }
-    if (!values["token-file"]) member = NameSchema.parse(member);
-    await prepareWorkspace(
-      state,
-      root,
-      { url: transport.url, project: project ?? "", member: member ?? "" },
-      Boolean(values.reconnect)
-    );
+    let member = values.member ?? existing?.memberId;
     if (!values["no-start"]) await checkServiceSupport();
+    if (!member && !values["token-file"])
+      member = await browserConnectMember(state, root, transport, project);
+    if (!values["token-file"]) member = NameSchema.parse(member);
     const connected = await connectProject(state, root, directory, {
       url: transport.url,
       project,
       member,
       tokenFile: values["token-file"],
-      reconnect: values.reconnect
+      reconnect: values.reconnect,
+      prepare: true,
+      confirmReplacement: async (preview) => {
+        const date = (value) => value ? new Date(value).toLocaleString("zh-CN", { hour12: false }) : "\u6682\u65E0\u8BB0\u5F55";
+        const prompt = [
+          "\u5C06\u4F7F\u7528\u670D\u52A1\u5668\u7684\u5DE5\u4F5C\u533A workspaces/ \u66FF\u6362\u672C\u5730\u5185\u5BB9\uFF0C\u662F\u5426\u7EE7\u7EED\uFF1F",
+          `  \u670D\u52A1\u5668 workspaces/ \u6700\u540E\u66F4\u65B0\u65F6\u95F4\uFF1A${date(preview.remoteDate)}`,
+          `  \u672C\u5730 workspaces/ \u6700\u540E\u66F4\u65B0\u65F6\u95F4\uFF1A${date(preview.localDate)}`,
+          "[Y/n] "
+        ].join("\n");
+        if (!values.yes) {
+          if (!process.stdin.isTTY || values.json)
+            throw new Error(
+              "\u5DF2\u6709 workspaces \u9700\u8981\u786E\u8BA4\u66FF\u6362\u3002\u8BF7\u5728\u4EA4\u4E92\u7EC8\u7AEF\u91CD\u65B0\u8FD0\u884C\uFF0C\u6216\u660E\u786E\u4F20\u5165 --yes\u3002"
+            );
+          const rl = createInterface2({ input: process.stdin, output: process.stderr });
+          try {
+            const answer = (await rl.question(prompt)).trim().toLowerCase();
+            if (!["", "y", "yes", "\u662F"].includes(answer)) return false;
+          } finally {
+            rl.close();
+          }
+        }
+        if (!values.json) result("\u6B63\u5728\u4E0B\u8F7D\u5DE5\u4F5C\u533A\u2026");
+        return true;
+      }
     });
     const collection = await setupSessions(state, root, directory, { enable: true });
     for (const issue of collection.issues) log.write("sessions.setup.failed", root, issue);
@@ -3818,6 +4130,11 @@ async function runClientCommand(command, args, version) {
       result("\u90E8\u5206\u5BF9\u8BDD\u91C7\u96C6 Hook \u672A\u914D\u7F6E", "\u540E\u53F0\u53D1\u73B0\u4ECD\u53EF\u7528\uFF0C\u8BE6\u60C5\u89C1 teammy logs");
     return 0;
   } catch (e) {
+    if (e instanceof ConnectionCancelled) {
+      if (values.json) json({ cancelled: true });
+      else result(e.message);
+      return 0;
+    }
     log.write(`${command}.failed`, root, diagnostic(e));
     throw e;
   } finally {
@@ -3826,16 +4143,16 @@ async function runClientCommand(command, args, version) {
 }
 
 // apps/client/files/synchronizer.ts
-import { randomUUID as randomUUID7 } from "node:crypto";
+import { randomUUID as randomUUID8 } from "node:crypto";
 import { watch } from "node:fs";
-import { lstat as lstat4, mkdir as mkdir12 } from "node:fs/promises";
-import { join as join20, sep as sep5 } from "node:path";
+import { lstat as lstat5, mkdir as mkdir13 } from "node:fs/promises";
+import { join as join21, sep as sep5 } from "node:path";
 import { performance } from "node:perf_hooks";
 
 // packages/storage/local-blob-store.ts
-import { createHash as createHash9, randomUUID as randomUUID6 } from "node:crypto";
-import { link, mkdir as mkdir11, open as open4, readFile as readFile6, unlink as unlink3 } from "node:fs/promises";
-import { dirname as dirname10, join as join19, resolve as resolve11 } from "node:path";
+import { createHash as createHash9, randomUUID as randomUUID7 } from "node:crypto";
+import { link, mkdir as mkdir12, open as open4, readFile as readFile6, unlink as unlink3 } from "node:fs/promises";
+import { dirname as dirname12, join as join20, resolve as resolve11 } from "node:path";
 function hash(content) {
   return createHash9("sha256").update(content).digest("hex");
 }
@@ -3859,8 +4176,8 @@ var LocalBlobStore = class {
     const bytes = Buffer.from(content);
     const sha256 = hash(bytes);
     const target = this.pathFor(sha256);
-    await mkdir11(dirname10(target), { recursive: true, mode: 448 });
-    const temporary = `${target}.${randomUUID6()}.tmp`;
+    await mkdir12(dirname12(target), { recursive: true, mode: 448 });
+    const temporary = `${target}.${randomUUID7()}.tmp`;
     const file = await open4(temporary, "wx", 384);
     try {
       try {
@@ -3876,7 +4193,7 @@ var LocalBlobStore = class {
         await this.get(sha256);
       }
       if (process.platform !== "win32") {
-        let directory = dirname10(target);
+        let directory = dirname12(target);
         for (; ; ) {
           const handle = await open4(directory, "r");
           try {
@@ -3884,8 +4201,8 @@ var LocalBlobStore = class {
           } finally {
             await handle.close();
           }
-          if (directory === dirname10(this.root)) break;
-          directory = dirname10(directory);
+          if (directory === dirname12(this.root)) break;
+          directory = dirname12(directory);
         }
       }
     } finally {
@@ -3907,7 +4224,7 @@ var LocalBlobStore = class {
   }
   pathFor(sha256) {
     if (!/^[a-f0-9]{64}$/.test(sha256)) throw new Error("Invalid SHA-256 content identifier.");
-    return join19(this.root, "sha256", sha256.slice(0, 2), sha256);
+    return join20(this.root, "sha256", sha256.slice(0, 2), sha256);
   }
 };
 
@@ -3935,8 +4252,8 @@ var PublicationQueue = class {
           pending.batch.changes.slice(pending.nextIndex, end).flatMap((change) => change.kind === "upsert" ? [change.sha256] : [])
         )
       ];
-      const { missing: missing2 } = hashes.length ? await this.transport.missingBlobs(hashes) : { missing: [] };
-      for (const hash2 of missing2) {
+      const { missing: missing3 } = hashes.length ? await this.transport.missingBlobs(hashes) : { missing: [] };
+      for (const hash2 of missing3) {
         if (!hashes.includes(hash2)) throw new Error("Server requested unrelated content.");
         const content = await this.blobs.get(hash2);
         if (!content) throw new Error("A queued content snapshot is missing from local storage.");
@@ -3973,7 +4290,7 @@ var FileSynchronizer = class _FileSynchronizer {
     if (!binding) throw new Error("Connect this root before synchronizing.");
     this.binding = binding;
     this.client = new HubClient(binding.serverUrl, 3e4, binding, this.abort.signal);
-    this.blobs = new LocalBlobStore(join20(stateDirectory, "blobs"));
+    this.blobs = new LocalBlobStore(join21(stateDirectory, "blobs"));
     this.projectScope = options.scope === "project";
     this.owner = this.projectScope ? PROJECT_FILE_OWNER : binding.memberId;
     this.publication = new FilePublicationState(state.db, options.scope);
@@ -3983,7 +4300,7 @@ var FileSynchronizer = class _FileSynchronizer {
       commitFiles: (batch) => this.projectScope ? this.client.commitSharedFiles(batch, batch.configRevision) : this.client.commitFiles(batch)
     });
     this.index = new SyncState(state, root, options.scope);
-    this.ownRoot = this.projectScope ? root : join20(root, binding.memberId);
+    this.ownRoot = this.projectScope ? root : join21(root, binding.memberId);
     this.common = this.projectScope ? void 0 : new _FileSynchronizer(state, root, stateDirectory, { ...options, scope: "project" });
     const started = performance.now();
     const epoch = Date.now();
@@ -4100,7 +4417,7 @@ var FileSynchronizer = class _FileSynchronizer {
         if (pending?.batch.changes.some((change) => this.excludes(change.path)))
           await this.resetPublication();
         await this.initializeAuthor();
-        const ownStat = await lstat4(this.ownRoot);
+        const ownStat = await lstat5(this.ownRoot);
         if (!ownStat.isDirectory() || ownStat.isSymbolicLink())
           throw new Error("Author directory is unavailable or is a symlink.");
         this.listen();
@@ -4184,7 +4501,7 @@ var FileSynchronizer = class _FileSynchronizer {
       }
     }
     const ownerPath = this.projectScope ? this.root : await safePath(this.root, this.owner);
-    await mkdir12(ownerPath).catch((error) => {
+    await mkdir13(ownerPath).catch((error) => {
       if (error.code !== "EEXIST") throw error;
     });
     this.publication.initializePublication(this.root, manifest.revision, manifest.files, {
@@ -4332,7 +4649,7 @@ var FileSynchronizer = class _FileSynchronizer {
       return;
     if (changes.length || !publication.complete) {
       this.publication.enqueue(this.root, {
-        operationId: randomUUID7(),
+        operationId: randomUUID8(),
         parentRevision: publication.revision,
         changes,
         ...this.projectScope ? { configRevision: this.sharedConfig.revision } : {}
@@ -4380,10 +4697,10 @@ var FileSynchronizer = class _FileSynchronizer {
     }
     const job = this.index.job(owner);
     const ownerRoot = this.projectScope ? this.root : await safePath(this.root, owner);
-    await mkdir12(ownerRoot).catch((error) => {
+    await mkdir13(ownerRoot).catch((error) => {
       if (error.code !== "EEXIST") throw error;
     });
-    const ownerStat = await lstat4(ownerRoot);
+    const ownerStat = await lstat5(ownerRoot);
     if (!ownerStat.isDirectory() || ownerStat.isSymbolicLink())
       throw new Error("Mirror root is not an ordinary directory.");
     let count = 0;
@@ -4435,8 +4752,8 @@ function message(error) {
 }
 
 // apps/client/sessions/synchronizer.ts
-import { randomUUID as randomUUID8 } from "node:crypto";
-import { join as join23 } from "node:path";
+import { randomUUID as randomUUID9 } from "node:crypto";
+import { join as join24 } from "node:path";
 import { performance as performance3 } from "node:perf_hooks";
 
 // packages/protocol/session-key.ts
@@ -4447,14 +4764,14 @@ function sessionKey(agent, nativeId) {
 
 // apps/client/sessions/source.ts
 import { createReadStream, realpathSync } from "node:fs";
-import { stat, realpath as realpath8, readdir as readdir2 } from "node:fs/promises";
-import { basename as basename4, dirname as dirname12, relative as relative5, isAbsolute as isAbsolute5, sep as sep6, join as join21 } from "node:path";
+import { stat, realpath as realpath8, readdir as readdir3 } from "node:fs/promises";
+import { basename as basename5, dirname as dirname14, relative as relative5, isAbsolute as isAbsolute5, sep as sep6, join as join22 } from "node:path";
 import { createInterface as createInterface3 } from "node:readline";
 import * as zlib from "node:zlib";
 
 // apps/client/sessions/cursor.ts
 import { createHash as createHash11 } from "node:crypto";
-import { basename as basename3, dirname as dirname11, resolve as resolve12 } from "node:path";
+import { basename as basename4, dirname as dirname13, resolve as resolve12 } from "node:path";
 import { DatabaseSync as DatabaseSync6 } from "node:sqlite";
 import { fileURLToPath } from "node:url";
 function fields(bytes) {
@@ -4503,7 +4820,7 @@ function readCursor(path, projectDir, checkCwd) {
     if (typeof hex !== "string" || !/^(?:[a-fA-F0-9]{2})+$/.test(hex))
       throw new Error("Invalid Cursor metadata.");
     const meta = object(JSON.parse(Buffer.from(hex, "hex").toString("utf8")));
-    if (typeof meta.agentId !== "string" || meta.agentId !== basename3(dirname11(path)) || meta.subagentInfo != null)
+    if (typeof meta.agentId !== "string" || meta.agentId !== basename4(dirname13(path)) || meta.subagentInfo != null)
       throw new Error("Invalid or delegated Cursor session identity.");
     const blob = (id) => {
       if (!/^[a-f0-9]{64}$/.test(id)) throw new Error("Invalid Cursor blob reference.");
@@ -4515,7 +4832,7 @@ function readCursor(path, projectDir, checkCwd) {
       return bytes;
     };
     const root = fields(blob(String(meta.latestRootBlobId)));
-    const bucket = basename3(dirname11(dirname11(path)));
+    const bucket = basename4(dirname13(dirname13(path)));
     const md5 = (cwd2) => createHash11("md5").update(resolve12(cwd2)).digest("hex");
     let cwd = md5(projectDir) === bucket ? projectDir : void 0;
     for (const uri of root.get(9) ?? []) {
@@ -4580,7 +4897,7 @@ function within(project, cwd) {
   return rel !== ".." && !rel.startsWith(`..${sep6}`) && !isAbsolute5(rel);
 }
 var cursorEncoded = (cwd) => cwd.replace(/^[/\\]+/, "").replace(/[/\\]/g, "-");
-var cursorDatabase = (path) => basename4(path) === "store.db";
+var cursorDatabase = (path) => basename5(path) === "store.db";
 async function sourceSignature(path, agent) {
   const paths = agent === "cursor" && cursorDatabase(path) ? [path, `${path}-wal`] : [path];
   const signatures = [];
@@ -4604,12 +4921,12 @@ async function sourceSignature(path, agent) {
   return JSON.stringify(signatures);
 }
 async function cursorScope(path, project) {
-  let container = dirname12(path);
-  while (basename4(container) !== "agent-transcripts" && dirname12(container) !== container)
-    container = dirname12(container);
-  if (basename4(container) !== "agent-transcripts")
+  let container = dirname14(path);
+  while (basename5(container) !== "agent-transcripts" && dirname14(container) !== container)
+    container = dirname14(container);
+  if (basename5(container) !== "agent-transcripts")
     throw new Error("Cursor transcript workspace cannot be verified.");
-  const encoded = basename4(dirname12(container));
+  const encoded = basename5(dirname14(container));
   const matches = [];
   const visit = async (directory) => {
     const prefix = cursorEncoded(directory);
@@ -4618,8 +4935,8 @@ async function cursorScope(path, project) {
       return;
     }
     if (!encoded.startsWith(prefix + "-")) return;
-    for (const entry of await readdir2(directory, { withFileTypes: true })) {
-      if (entry.isDirectory() && !entry.isSymbolicLink()) await visit(join21(directory, entry.name));
+    for (const entry of await readdir3(directory, { withFileTypes: true })) {
+      if (entry.isDirectory() && !entry.isSymbolicLink()) await visit(join22(directory, entry.name));
     }
   };
   await visit(project);
@@ -4637,7 +4954,7 @@ async function readSource(agent, path, projectDir) {
     });
     return { snapshot: snapshot2, incomplete: false, skipped: 0, signature: signature2 };
   }
-  const cursor = agent === "cursor" ? { nativeId: basename4(path, ".jsonl"), cwd: await cursorScope(path, projectDir) } : void 0;
+  const cursor = agent === "cursor" ? { nativeId: basename5(path, ".jsonl"), cwd: await cursorScope(path, projectDir) } : void 0;
   const normalizer = new JsonlNormalizer(agent, cursor);
   const stream = createReadStream(path, {
     end: Math.max(0, Number(JSON.parse(signature2)[0][2]) - 1)
@@ -4697,7 +5014,7 @@ async function readSource(agent, path, projectDir) {
 // apps/client/sessions/discovery.ts
 import { opendir as opendir2 } from "node:fs/promises";
 import { performance as performance2 } from "node:perf_hooks";
-import { join as join22 } from "node:path";
+import { join as join23 } from "node:path";
 
 // apps/client/sessions/work-queue.ts
 var SessionWorkQueue = class {
@@ -4736,7 +5053,7 @@ async function* candidates(directory, agent) {
     const current = queue.shift();
     const dir = await opendir2(current);
     for await (const entry of dir) {
-      const path = join22(current, entry.name);
+      const path = join23(current, entry.name);
       if (entry.isDirectory()) queue.push(path);
       if (entry.isFile() && (agent === "cursor" ? entry.name === "store.db" || entry.name.endsWith(".jsonl") : entry.name.endsWith(".jsonl") || agent === "dsh" && entry.name.endsWith(".jsonl.zstd")))
         yield path;
@@ -4834,7 +5151,7 @@ var SessionSynchronizer = class {
     const binding = state.binding(root);
     if (!binding) throw new Error("Connect this root before collecting sessions.");
     this.client = new HubClient(binding.serverUrl, 1e4, binding, signal);
-    this.blobs = new LocalBlobStore(join23(directory, "blobs"));
+    this.blobs = new LocalBlobStore(join24(directory, "blobs"));
     this.index = new SessionState(state, root);
     this.discovery = new SessionDiscovery(this.index);
   }
@@ -4985,7 +5302,7 @@ var SessionSynchronizer = class {
         }
         this.index.stage(
           source.path,
-          { operationId: randomUUID8(), sessionKey: key, parentRevision: revision, blob },
+          { operationId: randomUUID9(), sessionKey: key, parentRevision: revision, blob },
           observed.signature
         );
         await this.flush(this.index.get(source.path));
@@ -5001,10 +5318,10 @@ var SessionSynchronizer = class {
   async flush(source) {
     const request = source.pending;
     try {
-      const { missing: missing2 } = await this.client.missingBlobs([request.blob.sha256]);
-      if (missing2.some((hash2) => hash2 !== request.blob.sha256))
+      const { missing: missing3 } = await this.client.missingBlobs([request.blob.sha256]);
+      if (missing3.some((hash2) => hash2 !== request.blob.sha256))
         throw new Error("Server requested unrelated session content.");
-      if (missing2.length) {
+      if (missing3.length) {
         const bytes = await this.blobs.get(request.blob.sha256);
         if (!bytes) throw new Error("Queued session snapshot is missing.");
         const ref = await this.client.uploadBlob(request.blob.sha256, bytes);
@@ -5368,7 +5685,7 @@ async function runSyncCommand(args, version) {
           prior = report.errors[0] ?? "";
         }
         if (values.once) return report.errors.length ? 1 : 0;
-        await setTimeout4(Math.max(100, job.nextAt - Date.now()), void 0, {
+        await setTimeout5(Math.max(100, job.nextAt - Date.now()), void 0, {
           signal: abort.signal
         }).catch((e) => {
           if (!abort.signal.aborted) throw e;
@@ -5391,13 +5708,13 @@ async function runSyncCommand(args, version) {
 // apps/client/maintenance-command.ts
 import { parseArgs as parseArgs5 } from "node:util";
 import { homedir as homedir6 } from "node:os";
-import { join as join24, resolve as resolve13 } from "node:path";
-import { mkdir as mkdir13, realpath as realpath9 } from "node:fs/promises";
+import { join as join25, resolve as resolve13 } from "node:path";
+import { mkdir as mkdir14, realpath as realpath9 } from "node:fs/promises";
 async function runMaintenanceCommand(command, args, version) {
   const { values } = parseArgs5({
     args,
     options: {
-      "state-dir": { type: "string", default: join24(homedir6(), ".teammy", "client") },
+      "state-dir": { type: "string", default: join25(homedir6(), ".teammy", "client") },
       stop: { type: "boolean" },
       json: { type: "boolean" },
       help: { type: "boolean", short: "h" }
@@ -5413,7 +5730,7 @@ ${command === "repair" ? "Repair this local client and preserve project on/off s
     return 0;
   }
   if (command === "uninstall" && values.stop) throw new Error("--stop is a repair option.");
-  await mkdir13(resolve13(values["state-dir"]), { recursive: true, mode: 448 });
+  await mkdir14(resolve13(values["state-dir"]), { recursive: true, mode: 448 });
   const directory = await realpath9(values["state-dir"]);
   const report = await prepareClient(directory, version, {
     force: true,
@@ -5438,7 +5755,7 @@ ${command === "repair" ? "Repair this local client and preserve project on/off s
 // apps/client/runtime/daemon.ts
 import { createServer } from "node:net";
 import { chmod as chmod2, unlink as unlink4 } from "node:fs/promises";
-import { join as join25 } from "node:path";
+import { join as join26 } from "node:path";
 import { resolve as resolve14 } from "node:path";
 async function runDaemon(directory, version) {
   await prepareClient(directory, version, { daemonStartup: true });
@@ -5572,7 +5889,7 @@ async function runDaemon(directory, version) {
       });
     });
     await chmod2(socketPath(directory), 384);
-    writePrivateJson(join25(directory, "runtime", "daemon.json"), { pid: process.pid, directory });
+    writePrivateJson(join26(directory, "runtime", "daemon.json"), { pid: process.pid, directory });
     process.once("SIGINT", stop);
     process.once("SIGTERM", stop);
     log.write("daemon.started", void 0, `version=${version}`);
@@ -5595,7 +5912,7 @@ async function runDaemon(directory, version) {
     await new Promise((resolve16) => server.close(() => resolve16()));
     await unlink4(socketPath(directory)).catch(() => {
     });
-    await unlink4(join25(directory, "runtime", "daemon.json")).catch(() => {
+    await unlink4(join26(directory, "runtime", "daemon.json")).catch(() => {
     });
     log.write("daemon.stopped");
     state.close();
@@ -5612,7 +5929,7 @@ Usage:
   teammy --version                  Show the installed client version
   teammy server-info --url URL      Check server connection and protocol capabilities
   teammy server-info --help         Show connection options
-  teammy connect --url URL --project ID [--member ID | --token-file FILE] [--reconnect] [--root DIR] [--state-dir DIR]
+  teammy connect --url URL --project ID [--member ID | --token-file FILE] [--yes] [--reconnect] [--root DIR] [--state-dir DIR]
   teammy repair [--stop]            Repair or pause this local background client
   teammy uninstall                  Remove local service and hooks; keep user data
   teammy status [--root DIR] [--state-dir DIR]
@@ -5622,6 +5939,7 @@ Usage:
 
 Root defaults to ./workspaces; local state defaults to ~/.teammy/client.
 connect starts background sync; enabled projects resume after login.
+Without --member, connect opens a browser to confirm your user ID.
 Use --json for scripts; manage sync timing in the server dashboard.
 The hub server is installed separately as @teammy/server (command: teammy-server).
 `;