@wrongstack/core 0.310.1 → 0.313.1

package/dist/chunk-QVOVMXJR.js

@@ -0,0 +1,1351 @@
+import {
+  atomicWrite,
+  withFileLock
+} from "./chunk-7ZHZE5EO.js";
+import {
+  ERROR_CODES,
+  FsError,
+  WrongStackError
+} from "./chunk-WOEZV3Q4.js";
+import {
+  expectDefined
+} from "./chunk-PFZO3C6H.js";
+
+// src/storage/cloud-config-sync/sanitize.ts
+var SAGE_TREE = {
+  enabled: true,
+  storage: { projectLocal: true, directory: true },
+  inject: {
+    turnContext: true,
+    toolResults: true,
+    taskAware: true,
+    maxHintsPerTool: true,
+    maxCharsPerTool: true,
+    minScore: true,
+    repeatCooldownMs: true,
+    maxTurnMemories: true,
+    maxCharsPerTurn: true,
+    minImportance: true,
+    relationFloor: true
+  },
+  hygiene: {
+    autoAfterSession: true,
+    autoOnFileChange: true,
+    retentionDays: true,
+    archiveLowConfidenceAfterDays: true
+  },
+  embeddings: { enabled: true }
+};
+var CORE_RUNTIME_TREE = {
+  maxConcurrent: true,
+  context: {
+    mode: true,
+    autoCompact: true,
+    strategy: true,
+    warnThreshold: true,
+    softThreshold: true,
+    hardThreshold: true,
+    preserveK: true,
+    eliseThreshold: true,
+    targetLoad: true
+  },
+  tools: {
+    defaultExecutionStrategy: true,
+    maxIterations: true,
+    iterationTimeoutMs: true,
+    sessionTimeoutMs: true,
+    perIterationOutputCapBytes: true,
+    autoExtendLimit: true,
+    restrictToProjectRoot: true,
+    descriptionMode: true,
+    disabledTools: true,
+    maxToolTimeoutMs: true,
+    loopDetection: {
+      mode: true,
+      steerThreshold: true,
+      cutThreshold: true,
+      windowSize: true,
+      callRepeatThreshold: true
+    }
+  },
+  log: { level: true, format: true },
+  features: {
+    mcp: true,
+    plugins: true,
+    memory: true,
+    modelsRegistry: true,
+    skills: true,
+    prompts: true,
+    tokenSavingMode: true,
+    allowOutsideProjectRoot: true,
+    developerMode: true
+  },
+  session: { auditLevel: true, sampling: { toolProgress: { sampleRate: true } } },
+  indexing: { onSessionStart: true, onEdit: true, watchExternal: true, debounceMs: true },
+  circuitBreaker: { enabled: true, autoKillResetMs: true },
+  modelRuntime: {
+    reasoning: { mode: true, effort: true, preserve: true },
+    cache: { ttl: true }
+  },
+  systemPrompt: { variant: true },
+  skills: { readClaudeSkills: true },
+  Sage: SAGE_TREE,
+  fallbackAuto: true,
+  yolo: true,
+  nextPrediction: true,
+  hints: true,
+  debugStream: true
+};
+var UI_PREFERENCES_TREE = {
+  autonomy: {
+    defaultMode: true,
+    autoProceedDelayMs: true,
+    autoProceedMaxIterations: true,
+    autonomyNextPrompt: true,
+    terminalTitleAnimation: true,
+    yolo: true,
+    streamFleet: true,
+    chime: true,
+    confirmExit: true,
+    mouseMode: true,
+    enhance: true,
+    enhanceDelayMs: true,
+    enhanceCountdownMs: true,
+    enhanceLanguage: true,
+    statuslineMode: true,
+    thinkingWord: true,
+    midRunSendPicker: true,
+    animationStyle: true,
+    fleetChatVerbosity: true,
+    refinerFallbackProfile: true,
+    refinerProvider: true,
+    refinerModel: true,
+    showModelReasoning: true,
+    shellBangWarningDontShowAgain: true,
+    showAgentSwarmPanel: true,
+    showSageMemoryInject: true,
+    readAdvancedMode: true,
+    panelPositions: true
+  },
+  launch: { mode: true, autonomy: true },
+  uiLocale: true
+};
+var MODELS_ROUTING_TREE = {
+  provider: true,
+  model: true,
+  favoriteModels: true,
+  favoriteModelsOnly: true,
+  fallbackModels: true,
+  fallbackProfiles: true,
+  modelMatrix: { "*": { fallbackProfile: true } },
+  brain: {
+    mode: true,
+    maxAutoRisk: true,
+    models: true,
+    strategy: true,
+    decisionTimeoutMs: true,
+    humanTimeoutMs: true,
+    council: {
+      enabled: true,
+      minRisk: true,
+      voters: true
+    },
+    ledger: { enabled: true, autoDenyAfterFailures: true },
+    trace: { enabled: true }
+  }
+};
+var PROVIDERS_CATALOG_TREE = {
+  providers: {
+    "*": {
+      type: true,
+      family: true,
+      baseUrl: true,
+      envVars: true,
+      models: true,
+      activeKey: true
+    }
+  }
+};
+var MCP_SERVERS_TREE = {
+  mcpServers: {
+    "*": {
+      name: true,
+      transport: true,
+      command: true,
+      args: true,
+      url: true,
+      description: true,
+      permission: true,
+      enabled: true,
+      lazy: true,
+      envVars: true
+    }
+  }
+};
+var EXTENSIONS_PLUGINS_TREE = {
+  plugins: true,
+  extensions: true
+};
+var CLOUD_SYNC_CONTRACT = {
+  "core.runtime": CORE_RUNTIME_TREE,
+  "ui.preferences": UI_PREFERENCES_TREE,
+  "models.routing": MODELS_ROUTING_TREE,
+  "providers.catalog": PROVIDERS_CATALOG_TREE,
+  "mcp.servers": MCP_SERVERS_TREE,
+  "extensions.plugins": EXTENSIONS_PLUGINS_TREE
+};
+var CLOUD_SYNC_NAMESPACES = Object.keys(CLOUD_SYNC_CONTRACT);
+var INBOUND_DENIED_PATHS = [
+  // ── Code execution ──────────────────────────────────────────────────────
+  {
+    namespace: "mcp.servers",
+    path: "mcpServers.*.command",
+    reason: "Executable spawned for a stdio MCP server."
+  },
+  {
+    namespace: "mcp.servers",
+    path: "mcpServers.*.args",
+    reason: "Argv for that executable."
+  },
+  {
+    namespace: "mcp.servers",
+    path: "mcpServers.*.transport",
+    reason: "Switching transport to stdio selects the spawning code path."
+  },
+  {
+    namespace: "extensions.plugins",
+    path: "plugins",
+    reason: "Plugin list is resolved and `await import`ed."
+  },
+  // `extensions` is deliberately NOT denied: it is per-plugin settings read via
+  // `ConfigStore.getExtension(name)`, not a loader list, so it grants no import.
+  // Syncing it is the feature (`extensions.telegram.notifyChatId` and friends).
+  // Residual risk accepted: a plugin whose own settings include a URL can have
+  // that URL rewritten by the portal. Constrain that in the plugin's
+  // `configSchema`, which is where the loader validates it.
+  // ── Credential redirection / exfiltration ───────────────────────────────
+  {
+    namespace: "providers.catalog",
+    path: "providers.*.baseUrl",
+    reason: "Repoints the provider endpoint; reinjectLocalSecrets keeps the local apiKey, so the real key follows the redirect."
+  },
+  {
+    namespace: "providers.catalog",
+    path: "providers.*.envVars",
+    reason: "Chooses which environment variable is read for the key."
+  },
+  {
+    namespace: "providers.catalog",
+    path: "providers.*.activeKey",
+    reason: "Selects which stored key is sent."
+  },
+  {
+    namespace: "mcp.servers",
+    path: "mcpServers.*.url",
+    reason: "Remote MCP endpoint; receives whatever the transport carries."
+  },
+  {
+    namespace: "mcp.servers",
+    path: "mcpServers.*.envVars",
+    reason: "Names of environment variables forwarded to the server process."
+  },
+  // ── Operator-owned safety switches ──────────────────────────────────────
+  {
+    namespace: "mcp.servers",
+    path: "mcpServers.*.permission",
+    reason: "Approval requirement for that server\u2019s tools."
+  },
+  { namespace: "core.runtime", path: "yolo", reason: "Disables every permission prompt." },
+  {
+    namespace: "core.runtime",
+    path: "features.allowOutsideProjectRoot",
+    reason: "Short-circuits project-root containment and the symlink realpath check."
+  },
+  {
+    namespace: "core.runtime",
+    path: "tools.restrictToProjectRoot",
+    reason: "The other half of the filesystem confinement switch."
+  },
+  {
+    namespace: "core.runtime",
+    path: "features.developerMode",
+    reason: "Loosens guardrails; an operator opt-in, not a synced preference."
+  },
+  {
+    namespace: "core.runtime",
+    path: "tools.disabledTools",
+    reason: "Could re-enable a tool the operator deliberately switched off."
+  },
+  {
+    namespace: "ui.preferences",
+    path: "autonomy.defaultMode",
+    reason: "Autonomy is user-owned, never remote-owned."
+  },
+  {
+    namespace: "ui.preferences",
+    path: "autonomy.yolo",
+    reason: "Alias for the denied top-level `yolo`, and it wins over the user setting."
+  },
+  {
+    namespace: "ui.preferences",
+    path: "launch.autonomy",
+    reason: "Launch-time autonomy mode; same user-owned boundary."
+  },
+  {
+    namespace: "models.routing",
+    path: "brain.mode",
+    reason: "Selects the policy/LLM/human decision ladder."
+  },
+  {
+    namespace: "models.routing",
+    path: "brain.maxAutoRisk",
+    reason: "The risk ceiling below which actions proceed without asking."
+  }
+];
+function contractHasPath(tree, segments) {
+  if (segments.length === 0) return true;
+  if (tree === true) return false;
+  const [head, ...rest] = segments;
+  if (head === void 0 || !Object.hasOwn(tree, head)) return false;
+  const child = tree[head];
+  return child === void 0 ? false : contractHasPath(child, rest);
+}
+function pruneContractPath(tree, segments) {
+  if (tree === true || segments.length === 0) return tree;
+  const [head, ...rest] = segments;
+  if (head === void 0 || !Object.hasOwn(tree, head)) return tree;
+  const next = { ...tree };
+  if (rest.length === 0) {
+    delete next[head];
+    return next;
+  }
+  const child = next[head];
+  if (child === void 0) return tree;
+  next[head] = pruneContractPath(child, rest);
+  return next;
+}
+function assertInboundDenyListResolves() {
+  const unresolved = INBOUND_DENIED_PATHS.filter((entry) => {
+    const tree = CLOUD_SYNC_CONTRACT[entry.namespace];
+    return tree === void 0 || !contractHasPath(tree, entry.path.split("."));
+  });
+  if (unresolved.length > 0) {
+    throw new Error(
+      "INBOUND_DENIED_PATHS entr(ies) no longer resolve against CLOUD_SYNC_CONTRACT \u2014 a rename would silently re-open them: " + unresolved.map((entry) => `${entry.namespace}:${entry.path}`).join(", ")
+    );
+  }
+}
+var INBOUND_CONTRACT = (() => {
+  assertInboundDenyListResolves();
+  const out = { ...CLOUD_SYNC_CONTRACT };
+  for (const entry of INBOUND_DENIED_PATHS) {
+    const tree = out[entry.namespace];
+    if (tree === void 0) continue;
+    out[entry.namespace] = pruneContractPath(tree, entry.path.split("."));
+  }
+  return out;
+})();
+var NAMESPACE_SCHEMA_VERSIONS = {
+  "core.runtime": 1,
+  "ui.preferences": 1,
+  "models.routing": 1,
+  "providers.catalog": 1,
+  "mcp.servers": 2,
+  "extensions.plugins": 1
+};
+var LOCAL_ONLY_TOP_LEVEL = [
+  "version",
+  "configScope",
+  "hq",
+  "cloudSync",
+  "sync",
+  "models",
+  "apiKey",
+  "baseUrl"
+];
+var ENCRYPTED_VALUE = /enc:v\d+:/;
+var SECRET_KEY = /^(api[-_]?key|apikeys|.*token|secret.*|.*secret|password|passwd|credential.*|private[-_]?key|authorization)$/i;
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function stripSecretMaterial(value) {
+  if (typeof value === "string") {
+    return ENCRYPTED_VALUE.test(value) ? void 0 : value;
+  }
+  if (Array.isArray(value)) {
+    const cleaned = value.map((entry) => stripSecretMaterial(entry));
+    return cleaned.filter((entry) => entry !== void 0);
+  }
+  if (isPlainObject(value)) {
+    const out = {};
+    for (const [key, child] of Object.entries(value)) {
+      if (SECRET_KEY.test(key)) continue;
+      const cleaned = stripSecretMaterial(child);
+      if (cleaned !== void 0) out[key] = cleaned;
+    }
+    return out;
+  }
+  return value;
+}
+function project(value, tree) {
+  if (tree === true) return value;
+  if (!isPlainObject(value)) return void 0;
+  const wildcard = tree["*"];
+  const out = {};
+  for (const [key, child] of Object.entries(value)) {
+    const node = Object.hasOwn(tree, key) && key !== "*" ? tree[key] : wildcard;
+    if (node === void 0) continue;
+    const projected = project(child, node);
+    if (projected !== void 0) out[key] = projected;
+  }
+  return out;
+}
+function buildNamespacePayloads(config) {
+  const payloads = {};
+  for (const [namespace, tree] of Object.entries(CLOUD_SYNC_CONTRACT)) {
+    if (tree === true) continue;
+    const payload = {};
+    for (const [key, node] of Object.entries(tree)) {
+      if (!(key in config) || config[key] === void 0) continue;
+      const projected = project(config[key], node);
+      if (projected === void 0) continue;
+      const cleaned = stripSecretMaterial(projected);
+      if (cleaned === void 0) continue;
+      if (isPlainObject(cleaned) && Object.keys(cleaned).length === 0 && node !== true) continue;
+      payload[key] = cleaned;
+    }
+    if (Object.keys(payload).length > 0) payloads[namespace] = payload;
+  }
+  return payloads;
+}
+function reinjectLocalSecrets(local, incoming) {
+  if (!isPlainObject(local) || !isPlainObject(incoming)) return incoming;
+  const out = { ...incoming };
+  for (const [key, value] of Object.entries(local)) {
+    const secretish = SECRET_KEY.test(key) || typeof value === "string" && ENCRYPTED_VALUE.test(value);
+    if (secretish && !(key in incoming)) {
+      out[key] = value;
+      continue;
+    }
+    if (isPlainObject(value) && isPlainObject(incoming[key])) {
+      out[key] = reinjectLocalSecrets(value, incoming[key]);
+    }
+  }
+  return out;
+}
+function mergeAtContract(local, incoming, tree) {
+  if (tree === true) return reinjectLocalSecrets(local, incoming);
+  if (!isPlainObject(incoming)) return local;
+  const base = isPlainObject(local) ? { ...local } : {};
+  const wildcard = tree["*"];
+  for (const [key, child] of Object.entries(incoming)) {
+    const node = Object.hasOwn(tree, key) && key !== "*" ? tree[key] : wildcard;
+    if (node === void 0) continue;
+    base[key] = mergeAtContract(base[key], child, node);
+  }
+  return base;
+}
+function applyNamespacePayload(config, namespace, payload) {
+  const tree = INBOUND_CONTRACT[namespace];
+  if (!tree || tree === true) return config;
+  const next = { ...config };
+  for (const [key, incoming] of Object.entries(payload)) {
+    const node = Object.hasOwn(tree, key) ? tree[key] : void 0;
+    if (node === void 0) continue;
+    next[key] = mergeAtContract(next[key], incoming, node);
+  }
+  return next;
+}
+
+// src/storage/cloud-config-sync.ts
+import { createHash, randomUUID as nodeRandomUUID } from "node:crypto";
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
+var EMPTY_STATE = {
+  version: 1,
+  cursor: 0,
+  namespaceRevisions: {},
+  syncedHashes: {},
+  syncedPayloads: {},
+  pendingMutations: {},
+  rejectedHashes: {}
+};
+function stableStringify(value) {
+  if (Array.isArray(value)) {
+    return `[${value.map((entry) => stableStringify(entry)).join(",")}]`;
+  }
+  if (typeof value === "object" && value !== null) {
+    const entries = Object.entries(value).filter(([, v]) => v !== void 0).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([k, v]) => `${JSON.stringify(k)}:${stableStringify(v)}`);
+    return `{${entries.join(",")}}`;
+  }
+  return JSON.stringify(value) ?? "null";
+}
+function hashPayload(payload) {
+  return createHash("sha256").update(stableStringify(payload)).digest("hex");
+}
+function deepEquals(a, b) {
+  return stableStringify(a) === stableStringify(b);
+}
+var CloudConfigSync = class {
+  constructor(deps) {
+    this.deps = deps;
+    this.fetchImpl = deps.fetchImpl ?? fetch;
+    this.uuid = deps.randomUUID ?? (() => nodeRandomUUID());
+    this.timeoutMs = deps.requestTimeoutMs ?? 15e3;
+  }
+  deps;
+  state = null;
+  fetchImpl;
+  uuid;
+  timeoutMs;
+  /** One full pull-then-push-then-heartbeat pass. Never throws; failures are summarized. */
+  async syncOnce() {
+    const settings = this.deps.getSettings();
+    if (!settings?.enabled || !settings.url || !settings.token) {
+      return summary({ skipped: true, message: "Cloud sync is not configured." });
+    }
+    const state = await this.loadState();
+    const pulled = [];
+    const pushed = [];
+    const conflicted = [];
+    const rejected = [];
+    try {
+      await this.pullChanges(settings, state, pulled);
+      await this.pushDirty(settings, state, { pushed, conflicted, rejected });
+      await this.heartbeat(settings, state);
+      state.lastSyncedAt = (/* @__PURE__ */ new Date()).toISOString();
+      await this.saveState(state);
+      return summary({
+        ok: true,
+        pulled,
+        pushed,
+        conflicted,
+        rejected,
+        message: pulled.length + pushed.length === 0 ? "Already in sync." : `Pulled ${pulled.length}, pushed ${pushed.length} namespace(s).`
+      });
+    } catch (error) {
+      await this.saveState(state).catch(() => {
+      });
+      const message = error instanceof Error ? error.message : String(error);
+      this.deps.logger?.warn(`cloud-config-sync: pass failed: ${message}`);
+      return summary({ pulled, pushed, conflicted, rejected, message });
+    }
+  }
+  /** Human-readable status for the slash command. */
+  async statusText() {
+    const settings = this.deps.getSettings();
+    if (!settings?.enabled) {
+      return "Cloud config sync: disabled. Run `/cloudsync on` after setting url + token.";
+    }
+    const state = await this.loadState();
+    const dirty = await this.dirtyNamespaces(state);
+    const rejectedList = Object.keys(state.rejectedHashes);
+    const lines = [
+      "Cloud config sync: enabled",
+      `  url:        ${settings.url}`,
+      `  cursor:     ${state.cursor}`,
+      `  last sync:  ${state.lastSyncedAt ?? "never"}`,
+      `  dirty:      ${dirty.length > 0 ? dirty.join(", ") : "none"}`
+    ];
+    if (rejectedList.length > 0) {
+      lines.push(`  rejected:   ${rejectedList.join(", ")} (kept local; edit to retry)`);
+    }
+    return lines.join("\n");
+  }
+  // ── Pull ────────────────────────────────────────────────────────────────
+  async pullChanges(settings, state, pulled) {
+    const delta = (await this.request(settings, "GET", `/api/sync/v1/config?since=${state.cursor}`)).json;
+    const toRead = delta.full ? CLOUD_SYNC_NAMESPACES.map((namespace) => ({ namespace })) : delta.changed.filter(
+      (entry) => CLOUD_SYNC_NAMESPACES.includes(entry.namespace) && entry.revision > (state.namespaceRevisions[entry.namespace] ?? 0)
+    );
+    const dirtyBefore = new Set(await this.dirtyNamespaces(state));
+    for (const entry of toRead) {
+      const snapshot = (await this.request(
+        settings,
+        "GET",
+        `/api/sync/v1/config/${encodeURIComponent(entry.namespace)}`
+      )).json;
+      if ((state.namespaceRevisions[entry.namespace] ?? 0) >= snapshot.revision) continue;
+      if (snapshot.revision === 0) {
+        state.namespaceRevisions[entry.namespace] = 0;
+        continue;
+      }
+      if (dirtyBefore.has(entry.namespace)) {
+        const local = await this.deps.readLocalConfig();
+        const localPayload = buildNamespacePayloads(local)[entry.namespace] ?? {};
+        const base = state.syncedPayloads[entry.namespace] ?? {};
+        const merged = { ...snapshot.payload };
+        for (const [key, localValue] of Object.entries(localPayload)) {
+          if (!deepEquals(localValue, base[key])) merged[key] = localValue;
+        }
+        await this.deps.writeLocalConfig(
+          (config) => applyNamespacePayload(config, entry.namespace, merged)
+        );
+        state.namespaceRevisions[entry.namespace] = snapshot.revision;
+        state.syncedPayloads[entry.namespace] = snapshot.payload;
+      } else {
+        await this.applySnapshot(entry.namespace, snapshot, state);
+      }
+      pulled.push(entry.namespace);
+    }
+    state.cursor = Math.max(state.cursor, delta.cursor);
+  }
+  async applySnapshot(namespace, snapshot, state) {
+    await this.deps.writeLocalConfig(
+      (config) => applyNamespacePayload(config, namespace, snapshot.payload)
+    );
+    state.namespaceRevisions[namespace] = snapshot.revision;
+    state.syncedPayloads[namespace] = snapshot.payload;
+    const local = await this.deps.readLocalConfig();
+    const projected = buildNamespacePayloads(local)[namespace] ?? {};
+    state.syncedHashes[namespace] = hashPayload(projected);
+    delete state.pendingMutations[namespace];
+    delete state.rejectedHashes[namespace];
+  }
+  // ── Push ────────────────────────────────────────────────────────────────
+  async dirtyNamespaces(state) {
+    const local = await this.deps.readLocalConfig();
+    const payloads = buildNamespacePayloads(local);
+    return Object.entries(payloads).filter(([namespace, payload]) => hashPayload(payload) !== state.syncedHashes[namespace]).map(([namespace]) => namespace);
+  }
+  async pushDirty(settings, state, out) {
+    const local = await this.deps.readLocalConfig();
+    const payloads = buildNamespacePayloads(local);
+    for (const [namespace, payload] of Object.entries(payloads)) {
+      const hash = hashPayload(payload);
+      if (hash === state.syncedHashes[namespace]) continue;
+      if (state.rejectedHashes[namespace] === hash) continue;
+      const pending = state.pendingMutations[namespace];
+      const mutationId = pending?.hash === hash ? pending.mutationId : this.uuid();
+      state.pendingMutations[namespace] = { mutationId, hash };
+      await this.saveState(state);
+      const result = await this.putNamespace(settings, state, namespace, payload, mutationId);
+      if (result.kind === "applied") {
+        out.pushed.push(namespace);
+      } else if (result.kind === "conflict") {
+        out.conflicted.push(namespace);
+        await this.resolveConflict(settings, state, namespace, payload, result.server, out);
+      } else {
+        state.rejectedHashes[namespace] = hash;
+        delete state.pendingMutations[namespace];
+        out.rejected.push(namespace);
+        this.deps.logger?.warn(
+          `cloud-config-sync: server rejected ${namespace} (${result.code}); keeping it local until the config changes.`
+        );
+      }
+    }
+  }
+  async putNamespace(settings, state, namespace, payload, mutationId) {
+    const response = await this.request(
+      settings,
+      "PUT",
+      `/api/sync/v1/config/${encodeURIComponent(namespace)}`,
+      {
+        baseRevision: state.namespaceRevisions[namespace] ?? 0,
+        mutationId,
+        schemaVersion: NAMESPACE_SCHEMA_VERSIONS[namespace] ?? 1,
+        payload
+      },
+      // 409 (conflict) and 422 (contract mismatch) are protocol answers, not failures.
+      [409, 422]
+    );
+    if (response.status === 422) {
+      const code = response.json.error?.code;
+      return { kind: "rejected", code: code ?? "invalid_payload" };
+    }
+    const body = response.json;
+    if (response.status === 409) {
+      return { kind: "conflict", server: body };
+    }
+    state.namespaceRevisions[namespace] = body.revision;
+    state.syncedHashes[namespace] = hashPayload(payload);
+    state.syncedPayloads[namespace] = payload;
+    if (typeof body.cursor === "number") state.cursor = Math.max(state.cursor, body.cursor);
+    delete state.pendingMutations[namespace];
+    delete state.rejectedHashes[namespace];
+    return { kind: "applied" };
+  }
+  /**
+   * Three-way merge at owned-top-level-key granularity: keys unchanged locally since the
+   * last sync adopt the server value; locally-changed keys win and are re-pushed on top
+   * of the server revision with a fresh mutation id.
+   */
+  async resolveConflict(settings, state, namespace, localPayload, server, out) {
+    const base = state.syncedPayloads[namespace] ?? {};
+    const merged = { ...server.payload };
+    for (const [key, localValue] of Object.entries(localPayload)) {
+      if (!deepEquals(localValue, base[key])) merged[key] = localValue;
+    }
+    await this.deps.writeLocalConfig((config) => applyNamespacePayload(config, namespace, merged));
+    state.namespaceRevisions[namespace] = server.revision;
+    const mutationId = this.uuid();
+    const hash = hashPayload(merged);
+    state.pendingMutations[namespace] = { mutationId, hash };
+    await this.saveState(state);
+    const result = await this.putNamespace(settings, state, namespace, merged, mutationId);
+    if (result.kind === "applied") {
+      out.pushed.push(namespace);
+    } else {
+      this.deps.logger?.warn(
+        `cloud-config-sync: conflict resolution for ${namespace} did not converge (${result.kind}); will retry next pass.`
+      );
+    }
+  }
+  // ── Heartbeat ───────────────────────────────────────────────────────────
+  async heartbeat(settings, state) {
+    await this.request(settings, "POST", "/api/sync/v1/heartbeat", {
+      transport: "poll",
+      syncCursor: state.cursor,
+      namespaceRevisions: state.namespaceRevisions
+    }).catch((error) => {
+      const message = error instanceof Error ? error.message : String(error);
+      this.deps.logger?.warn(`cloud-config-sync: heartbeat failed: ${message}`);
+    });
+  }
+  // ── HTTP + state plumbing ───────────────────────────────────────────────
+  async request(settings, method, pathname, body, acceptStatuses = []) {
+    const url = `${settings.url.replace(/\/+$/, "")}${pathname}`;
+    const headers = {
+      Authorization: `Bearer ${settings.token}`,
+      "X-WrongStack-Version": this.deps.appVersion ?? "unknown"
+    };
+    if (body !== void 0) headers["Content-Type"] = "application/json";
+    const init = {
+      method,
+      headers,
+      signal: AbortSignal.timeout(this.timeoutMs)
+    };
+    if (body !== void 0) init.body = JSON.stringify(body);
+    const response = await this.fetchImpl(url, init);
+    const ok = response.ok || acceptStatuses.includes(response.status);
+    if (!ok) {
+      if (response.status === 401) {
+        throw new Error("unauthorized: the machine token is invalid, expired, or revoked.");
+      }
+      if (response.status === 429) {
+        throw new Error("rate limited by the portal; backing off until the next pass.");
+      }
+      throw new Error(`${method} ${pathname} failed with HTTP ${response.status}.`);
+    }
+    const json = response.status === 204 ? null : await response.json().catch(() => null);
+    return { status: response.status, json };
+  }
+  async loadState() {
+    if (this.state) return this.state;
+    try {
+      const raw = await fs.readFile(this.deps.statePath, "utf8");
+      const parsed = JSON.parse(raw);
+      this.state = {
+        ...structuredClone(EMPTY_STATE),
+        ...parsed,
+        version: 1
+      };
+    } catch {
+      this.state = structuredClone(EMPTY_STATE);
+    }
+    return this.state;
+  }
+  async saveState(state) {
+    this.state = state;
+    await fs.mkdir(path.dirname(this.deps.statePath), { recursive: true });
+    await atomicWrite(this.deps.statePath, `${JSON.stringify(state, null, 2)}
+`, {
+      mode: 384
+    });
+  }
+};
+function summary(partial) {
+  return {
+    ok: partial.ok ?? false,
+    skipped: partial.skipped ?? false,
+    pulled: partial.pulled ?? [],
+    pushed: partial.pushed ?? [],
+    conflicted: partial.conflicted ?? [],
+    rejected: partial.rejected ?? [],
+    message: partial.message
+  };
+}
+
+// src/storage/prompt-usage-store.ts
+import * as fs2 from "node:fs/promises";
+var PromptUsageStore = class {
+  constructor(file) {
+    this.file = file;
+  }
+  file;
+  cachedUsage = null;
+  cachedSignature = null;
+  pendingRecords = [];
+  drainScheduled = false;
+  draining = false;
+  async load() {
+    return cloneUsage(await this.loadInternal());
+  }
+  async loadInternal() {
+    const signature = await this.fileSignature();
+    if (this.cachedUsage && sameSignature(signature, this.cachedSignature)) {
+      return this.cachedUsage;
+    }
+    try {
+      const raw = JSON.parse(await fs2.readFile(this.file, "utf8"));
+      if (raw && typeof raw === "object" && raw.usage && typeof raw.usage === "object") {
+        this.cachedUsage = raw.usage;
+        this.cachedSignature = signature;
+        return this.cachedUsage;
+      }
+    } catch {
+    }
+    this.cachedUsage = {};
+    this.cachedSignature = signature;
+    return this.cachedUsage;
+  }
+  async record(slug, at = (/* @__PURE__ */ new Date()).toISOString()) {
+    return await new Promise((resolve2, reject) => {
+      this.pendingRecords.push({ slug, at, resolve: resolve2, reject });
+      this.scheduleDrain();
+    });
+  }
+  async get(slug) {
+    return (await this.load())[slug];
+  }
+  /** Slugs ordered by most-recently-used (then by count), capped at `limit`. */
+  async recent(limit = 15) {
+    const usage = await this.load();
+    return Object.entries(usage).map(([slug, u]) => ({ slug, usage: u })).sort(
+      (a, b) => new Date(b.usage.lastUsedAt).getTime() - new Date(a.usage.lastUsedAt).getTime() || b.usage.count - a.usage.count
+    ).slice(0, limit);
+  }
+  /** Slugs ordered by usage count (then recency), capped at `limit`. */
+  async top(limit = 15) {
+    const usage = await this.load();
+    return Object.entries(usage).map(([slug, u]) => ({ slug, usage: u })).sort(
+      (a, b) => b.usage.count - a.usage.count || new Date(b.usage.lastUsedAt).getTime() - new Date(a.usage.lastUsedAt).getTime()
+    ).slice(0, limit);
+  }
+  scheduleDrain() {
+    if (this.drainScheduled || this.draining) return;
+    this.drainScheduled = true;
+    queueMicrotask(() => {
+      this.drainScheduled = false;
+      void this.drainPending();
+    });
+  }
+  async drainPending() {
+    if (this.draining || this.pendingRecords.length === 0) return;
+    this.draining = true;
+    const batch = this.pendingRecords.splice(0);
+    try {
+      const results = await withFileLock(this.file, async () => {
+        const usage = { ...await this.loadInternal() };
+        const nextValues = [];
+        for (const item of batch) {
+          const previous = usage[item.slug];
+          const next = {
+            count: (previous?.count ?? 0) + 1,
+            lastUsedAt: item.at
+          };
+          usage[item.slug] = next;
+          nextValues.push(next);
+        }
+        await atomicWrite(
+          this.file,
+          JSON.stringify({ version: 1, usage }, null, 2)
+        );
+        this.cachedUsage = usage;
+        this.cachedSignature = await this.fileSignature();
+        return nextValues;
+      });
+      for (let index = 0; index < batch.length; index++) {
+        batch[index].resolve(results[index]);
+      }
+    } catch (error) {
+      for (const item of batch) item.reject(error);
+    } finally {
+      this.draining = false;
+      if (this.pendingRecords.length > 0) this.scheduleDrain();
+    }
+  }
+  async fileSignature() {
+    try {
+      const stat2 = await fs2.stat(this.file);
+      return { size: stat2.size, mtimeMs: stat2.mtimeMs, ctimeMs: stat2.ctimeMs };
+    } catch {
+      return null;
+    }
+  }
+};
+function sameSignature(a, b) {
+  if (a === null || b === null) return a === b;
+  return a.size === b.size && a.mtimeMs === b.mtimeMs && a.ctimeMs === b.ctimeMs;
+}
+function cloneUsage(usage) {
+  return Object.fromEntries(Object.entries(usage).map(([slug, value]) => [slug, { ...value }]));
+}
+
+// src/storage/cloud-sync.ts
+import * as fs3 from "node:fs/promises";
+import * as path2 from "node:path";
+import { createHash as createHash2 } from "node:crypto";
+var ALL_SYNC_CATEGORIES = ["settings", "skills", "prompts", "memory", "history"];
+var CloudSync = class {
+  constructor(paths, getConfig, setConfig, getSettingsConfigPath) {
+    this.paths = paths;
+    this.getConfig = getConfig;
+    this.setConfig = setConfig;
+    this.statePath = path2.join(paths.configDir, "sync-state.json");
+    this.getSettingsConfigPath = getSettingsConfigPath ?? (() => path2.join(this.paths.configDir, "config.json"));
+  }
+  paths;
+  getConfig;
+  setConfig;
+  statePath;
+  state = null;
+  getSettingsConfigPath;
+  // ── Public API ─────────────────────────────────────────────────────
+  async status() {
+    const cfg = this.getConfig();
+    if (!cfg?.enabled) {
+      return "CloudSync: disabled. Run `/sync enable` to activate.";
+    }
+    const last = this.state?.lastSyncedAt;
+    const since = last ? timeAgo(last) : "never";
+    return [
+      `CloudSync: enabled`,
+      `  repo:       ${cfg.repo}`,
+      `  categories: ${cfg.categories.join(", ")}`,
+      `  last sync:  ${since}`
+    ].join("\n");
+  }
+  async enable(_repo, _categories) {
+    return "Enable via /sync enable.";
+  }
+  async disable() {
+    const cfg = this.getConfig();
+    if (!cfg) return "CloudSync is not configured.";
+    const next = { ...cfg, enabled: false };
+    await this.setConfig(next);
+    return "CloudSync disabled. Local data kept.";
+  }
+  async push(token) {
+    const cfg = this.getConfig();
+    if (!cfg?.enabled) return { ok: false, action: "push", categories: [], message: "Not enabled." };
+    const parts = cfg.repo.split("/");
+    const owner = expectDefined(parts[0]);
+    const repoName = expectDefined(parts[1]);
+    const branch = "main";
+    const remoteHead = await this.getOptionalRef(token, owner, repoName, branch);
+    let parentCommitSha = remoteHead?.object?.sha;
+    let baseTreeSha;
+    let remoteEntries = [];
+    if (parentCommitSha) {
+      baseTreeSha = parentCommitSha === this.state?.sha && this.state.treeSha ? this.state.treeSha : (await this.getCommit(token, owner, repoName, parentCommitSha)).tree.sha;
+      remoteEntries = await this.getTreeEntries(token, owner, repoName, baseTreeSha);
+    }
+    const { treeEntries: localEntries, rev } = await this.buildLocalTree(cfg.categories);
+    let treeEntries = this.buildPushTree(localEntries, remoteEntries, cfg.categories);
+    let newTreeSha = await this.createGitTree(token, owner, repoName, treeEntries, baseTreeSha);
+    let commitSha = await this.createCommit(
+      token,
+      owner,
+      repoName,
+      newTreeSha,
+      parentCommitSha,
+      `Sync ${cfg.categories.join(", ")} \u2014 ${(/* @__PURE__ */ new Date()).toISOString()}`
+    );
+    try {
+      if (parentCommitSha) {
+        await this.updateRef(token, owner, repoName, branch, commitSha);
+      } else {
+        await this.createRef(token, owner, repoName, branch, commitSha);
+      }
+    } catch (err) {
+      if (err instanceof Error && err.message.includes("422")) {
+        const remote = await this.getRef(token, owner, repoName, branch);
+        parentCommitSha = remote.object.sha;
+        baseTreeSha = (await this.getCommit(token, owner, repoName, parentCommitSha)).tree.sha;
+        remoteEntries = await this.getTreeEntries(token, owner, repoName, baseTreeSha);
+        treeEntries = this.buildPushTree(localEntries, remoteEntries, cfg.categories);
+        newTreeSha = await this.createGitTree(token, owner, repoName, treeEntries, baseTreeSha);
+        commitSha = await this.createCommit(
+          token,
+          owner,
+          repoName,
+          newTreeSha,
+          parentCommitSha,
+          `Sync ${cfg.categories.join(", ")} \u2014 ${(/* @__PURE__ */ new Date()).toISOString()}`
+        );
+        await this.updateRef(token, owner, repoName, branch, commitSha);
+      } else {
+        throw err;
+      }
+    }
+    const syncState = {
+      version: 1,
+      sha: commitSha,
+      treeSha: newTreeSha,
+      lastSyncedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      localRev: rev
+    };
+    await atomicWrite(this.statePath, JSON.stringify(syncState, null, 2));
+    this.state = syncState;
+    return {
+      ok: true,
+      action: "push",
+      categories: cfg.categories,
+      committedAt: commitSha,
+      message: `Pushed ${cfg.categories.join(", ")} to ${cfg.repo}. Commit: ${commitSha.slice(0, 7)}`
+    };
+  }
+  async pull(token) {
+    const cfg = this.getConfig();
+    if (!cfg?.enabled) return { ok: false, action: "pull", categories: [], message: "Not enabled." };
+    const pullParts = cfg.repo.split("/");
+    const owner = expectDefined(pullParts[0]);
+    const repoName = expectDefined(pullParts[1]);
+    const branchData = await this.getRef(token, owner, repoName, "main");
+    const currentSha = branchData.object.sha;
+    const commitData = await this.getCommit(token, owner, repoName, currentSha);
+    const treeSha = commitData.tree.sha;
+    const treeEntries = await this.getTreeEntries(token, owner, repoName, treeSha);
+    for (const entry of treeEntries) {
+      if (entry.type !== "blob") continue;
+      const segments = entry.path.split("/");
+      if (segments[0] !== "data" || !segments[1]) continue;
+      const cat = segments[1];
+      if (!ALL_SYNC_CATEGORIES.includes(cat) || !cfg.categories.includes(cat)) continue;
+      const localPath = this.categoryToPath(cat);
+      if (!localPath) continue;
+      const rel = segments.slice(2).join("/");
+      const destPath = resolvePulledCategoryPath(cat, localPath, rel, entry.path);
+      await preparePulledDestination(cat, localPath, destPath, entry.path);
+      const blobData = await this.getBlob(token, owner, repoName, entry.sha);
+      await atomicWrite(destPath, Buffer.from(blobData, "base64"));
+    }
+    const localRev = await this.hashLocalCategories(cfg.categories);
+    const syncState = {
+      version: 1,
+      sha: currentSha,
+      treeSha,
+      lastSyncedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      localRev
+    };
+    await atomicWrite(this.statePath, JSON.stringify(syncState, null, 2));
+    this.state = syncState;
+    return {
+      ok: true,
+      action: "pull",
+      categories: cfg.categories,
+      committedAt: currentSha,
+      message: `Pulled ${cfg.categories.join(", ")} from ${cfg.repo}. Commit: ${currentSha.slice(0, 7)}`
+    };
+  }
+  async hasLocalChanges() {
+    if (!this.state) return true;
+    const cfg = this.getConfig();
+    if (!cfg) return true;
+    const current = await this.hashLocalCategories(cfg.categories);
+    return current !== this.state.localRev;
+  }
+  async loadState() {
+    try {
+      const raw = await fs3.readFile(this.statePath, "utf8");
+      this.state = JSON.parse(raw);
+    } catch {
+      this.state = null;
+    }
+  }
+  // ── GitHub API helpers ──────────────────────────────────────────────
+  async githubFetch(token, owner, repo, method, pathSegment, body) {
+    const url = `https://api.github.com/repos/${owner}/${repo}${pathSegment}`;
+    const init = {
+      signal: AbortSignal.timeout(15e3),
+      method,
+      headers: {
+        Authorization: `Bearer ${token}`,
+        Accept: "application/vnd.github+json",
+        "X-GitHub-Api-Version": "2022-11-28",
+        "Content-Type": "application/json"
+      }
+    };
+    if (body !== void 0) init.body = JSON.stringify(body);
+    const res = await fetch(url, init);
+    if (!res.ok) {
+      const errText = await res.text();
+      throw new WrongStackError({
+        message: `GitHub API ${method} ${pathSegment} failed (${res.status}): ${errText}`,
+        code: ERROR_CODES.UNKNOWN,
+        subsystem: "general",
+        context: { method, pathSegment, status: res.status, repo: `${owner}/${repo}` }
+      });
+    }
+    const text = await res.text();
+    return text ? JSON.parse(text) : {};
+  }
+  async getRef(token, owner, repo, ref) {
+    return await this.githubFetch(token, owner, repo, "GET", `/git/refs/heads/${ref}`);
+  }
+  async getOptionalRef(token, owner, repo, ref) {
+    try {
+      return await this.getRef(token, owner, repo, ref);
+    } catch (err) {
+      if (err instanceof Error && err.message.includes("failed (404)")) return null;
+      if (err instanceof Error && err.message.includes("failed (409)")) {
+        throw new WrongStackError({
+          message: "GitHub repository is empty. Initialize it with a README or first commit, then retry `/sync push`.",
+          code: ERROR_CODES.UNKNOWN,
+          subsystem: "general",
+          context: { repo: `${owner}/${repo}`, ref },
+          cause: err
+        });
+      }
+      throw err;
+    }
+  }
+  async createRef(token, owner, repo, ref, sha) {
+    await this.githubFetch(token, owner, repo, "POST", "/git/refs", {
+      ref: `refs/heads/${ref}`,
+      sha
+    });
+  }
+  async updateRef(token, owner, repo, ref, sha) {
+    await this.githubFetch(token, owner, repo, "PATCH", `/git/refs/heads/${ref}`, {
+      sha,
+      force: false
+    });
+  }
+  async getCommit(token, owner, repo, sha) {
+    return await this.githubFetch(token, owner, repo, "GET", `/git/commits/${sha}`);
+  }
+  async getTreeEntries(token, owner, repo, treeSha) {
+    const res = await this.githubFetch(
+      token,
+      owner,
+      repo,
+      "GET",
+      `/git/trees/${treeSha}?recursive=1`
+    );
+    if (res.truncated) {
+      throw new WrongStackError({
+        message: "Sync tree is too large \u2014 GitHub truncated the result; refusing a partial pull.",
+        code: ERROR_CODES.UNKNOWN,
+        subsystem: "general"
+      });
+    }
+    return res.tree ?? [];
+  }
+  async createCommit(token, owner, repo, treeSha, parentSha, message = "sync") {
+    const body = { message, tree: treeSha };
+    if (parentSha) body.parents = [parentSha];
+    const result = await this.githubFetch(token, owner, repo, "POST", "/git/commits", body);
+    return result.sha;
+  }
+  async createGitTree(token, owner, repo, entries, baseTreeSha) {
+    const tree = entries.map(
+      (entry) => "sha" in entry ? { path: entry.path, mode: entry.mode, type: "blob", sha: entry.sha } : { path: entry.path, mode: entry.mode, type: "blob", content: entry.content }
+    );
+    const body = { tree };
+    if (baseTreeSha) body.base_tree = baseTreeSha;
+    const result = await this.githubFetch(token, owner, repo, "POST", "/git/trees", body);
+    return result.sha;
+  }
+  async getBlob(token, owner, repo, sha) {
+    const result = await this.githubFetch(token, owner, repo, "GET", `/git/blobs/${sha}`);
+    return result.content;
+  }
+  // ── Local file helpers ──────────────────────────────────────────────
+  buildPushTree(localEntries, remoteEntries, categories) {
+    const selected = new Set(categories.map((category) => `data/${category}`));
+    const localPaths = new Set(localEntries.map((entry) => entry.path));
+    const deletions = [];
+    for (const entry of remoteEntries) {
+      if (entry.type !== "blob" || localPaths.has(entry.path)) continue;
+      const selectedCategory = [...selected].some(
+        (prefix) => entry.path === prefix || entry.path.startsWith(`${prefix}/`)
+      );
+      if (selectedCategory) deletions.push({ path: entry.path, sha: null, mode: "100644" });
+    }
+    return [...localEntries, ...deletions];
+  }
+  async buildLocalTree(categories) {
+    const entries = [];
+    const hashes = [];
+    for (const cat of categories) {
+      const localPath = this.categoryToPath(cat);
+      if (!localPath) continue;
+      try {
+        const stat2 = await fs3.lstat(localPath);
+        if (stat2.isSymbolicLink()) continue;
+        if (stat2.isDirectory()) {
+          const files = await this.walkDir(localPath, localPath);
+          for (const file of files) {
+            const content = await fs3.readFile(file, "utf8");
+            const rel = path2.relative(localPath, file).replace(/\\/g, "/");
+            entries.push({ path: `data/${cat}/${rel}`, content, mode: "100644" });
+            hashes.push(`${cat}/${rel}\0${content}`);
+          }
+        } else {
+          const content = await fs3.readFile(localPath, "utf8");
+          entries.push({ path: `data/${cat}`, content, mode: "100644" });
+          hashes.push(`${cat}\0${content}`);
+        }
+      } catch {
+      }
+    }
+    const rev = createHash2("sha256").update(hashes.join("")).digest("hex").slice(0, 12);
+    return { treeEntries: entries, rev };
+  }
+  async hashLocalCategories(categories) {
+    const hashes = [];
+    for (const cat of categories) {
+      const localPath = this.categoryToPath(cat);
+      if (!localPath) continue;
+      try {
+        const stat2 = await fs3.lstat(localPath);
+        if (stat2.isSymbolicLink()) continue;
+        if (stat2.isDirectory()) {
+          const files = await this.walkDir(localPath, localPath);
+          for (const file of files) {
+            const content = await fs3.readFile(file, "utf8");
+            const rel = path2.relative(localPath, file).replace(/\\/g, "/");
+            hashes.push(`${cat}/${rel}\0${content}`);
+          }
+        } else {
+          const content = await fs3.readFile(localPath, "utf8");
+          hashes.push(`${cat}\0${content}`);
+        }
+      } catch {
+      }
+    }
+    return createHash2("sha256").update(hashes.join("")).digest("hex").slice(0, 12);
+  }
+  categoryToPath(cat) {
+    switch (cat) {
+      case "settings":
+        return this.getSettingsConfigPath();
+      case "skills":
+        return this.paths.globalSkills;
+      case "prompts":
+        return this.paths.globalPrompts;
+      case "memory":
+        return this.paths.globalMemory;
+      case "history":
+        return this.paths.historyFile;
+      /* v8 ignore next -- unreachable: SyncCategory is exhaustively matched above */
+      default:
+        return null;
+    }
+  }
+  async walkDir(dir, base) {
+    const results = [];
+    const entries = await fs3.readdir(dir, { withFileTypes: true });
+    entries.sort((a, b) => a.name.localeCompare(b.name));
+    for (const entry of entries) {
+      const full = path2.join(dir, entry.name);
+      if (entry.isSymbolicLink()) continue;
+      if (entry.isDirectory()) {
+        results.push(...await this.walkDir(full, base));
+      } else if (entry.isFile()) {
+        results.push(full);
+      }
+    }
+    return results;
+  }
+};
+async function preparePulledDestination(cat, localPath, destPath, remotePath) {
+  const directoryBacked = cat === "skills" || cat === "prompts";
+  const rootPath = directoryBacked ? localPath : path2.dirname(localPath);
+  const rootStat = await lstatIfExists(rootPath);
+  if (rootStat?.isSymbolicLink()) {
+    throw unsafePulledSymlinkError(remotePath, rootPath);
+  }
+  if (directoryBacked) {
+    const relativeParent = path2.relative(rootPath, path2.dirname(destPath));
+    let cursor = rootPath;
+    if (relativeParent) {
+      for (const segment of relativeParent.split(path2.sep)) {
+        cursor = path2.join(cursor, segment);
+        const stat2 = await lstatIfExists(cursor);
+        if (stat2?.isSymbolicLink()) throw unsafePulledSymlinkError(remotePath, cursor);
+      }
+    }
+  }
+  const destStat = await lstatIfExists(destPath);
+  if (destStat?.isSymbolicLink()) throw unsafePulledSymlinkError(remotePath, destPath);
+  await fs3.mkdir(path2.dirname(destPath), { recursive: true });
+}
+async function lstatIfExists(filePath) {
+  try {
+    return await fs3.lstat(filePath);
+  } catch (err) {
+    if (err.code === "ENOENT") return null;
+    throw err;
+  }
+}
+function unsafePulledSymlinkError(remotePath, symlinkPath) {
+  return new FsError({
+    message: `Refusing CloudSync write through symlink: ${remotePath}`,
+    code: ERROR_CODES.FS_DELETE_FAILED,
+    path: remotePath,
+    context: { reason: "symlink_destination", symlinkPath }
+  });
+}
+function resolvePulledCategoryPath(cat, localPath, rel, remotePath) {
+  const directoryBacked = cat === "skills" || cat === "prompts";
+  if (!directoryBacked) {
+    if (rel) throw new FsError({
+      message: `Refusing nested CloudSync path for file category: ${remotePath}`,
+      code: ERROR_CODES.FS_DELETE_FAILED,
+      path: remotePath,
+      context: { reason: "nested_file_category", category: cat }
+    });
+    return localPath;
+  }
+  if (!rel) return localPath;
+  const normalizedRel = path2.normalize(rel);
+  const traversesUp = normalizedRel === ".." || normalizedRel.startsWith(`..${path2.sep}`);
+  if (path2.isAbsolute(normalizedRel) || traversesUp) {
+    throw new FsError({
+      message: `Refusing CloudSync path traversal: ${remotePath}`,
+      code: ERROR_CODES.FS_DELETE_FAILED,
+      path: remotePath,
+      context: { reason: "path_traversal", normalizedRel }
+    });
+  }
+  const dest = path2.resolve(localPath, normalizedRel);
+  const root = path2.resolve(localPath);
+  const relative2 = path2.relative(root, dest);
+  if (relative2.startsWith("..") || path2.isAbsolute(relative2)) {
+    throw new FsError({
+      message: `Refusing CloudSync path outside category root: ${remotePath}`,
+      code: ERROR_CODES.FS_DELETE_FAILED,
+      path: remotePath,
+      context: { reason: "outside_category_root", category: cat }
+    });
+  }
+  return dest;
+}
+function timeAgo(iso) {
+  const diff = Date.now() - new Date(iso).getTime();
+  const mins = Math.floor(diff / 6e4);
+  if (mins < 1) return "just now";
+  if (mins < 60) return `${mins}m ago`;
+  const hrs = Math.floor(mins / 60);
+  if (hrs < 24) return `${hrs}h ago`;
+  const days = Math.floor(hrs / 24);
+  return `${days}d ago`;
+}
+
+export {
+  CLOUD_SYNC_CONTRACT,
+  CLOUD_SYNC_NAMESPACES,
+  NAMESPACE_SCHEMA_VERSIONS,
+  LOCAL_ONLY_TOP_LEVEL,
+  stripSecretMaterial,
+  buildNamespacePayloads,
+  applyNamespacePayload,
+  CloudConfigSync,
+  PromptUsageStore,
+  ALL_SYNC_CATEGORIES,
+  CloudSync
+};
+//# sourceMappingURL=chunk-QVOVMXJR.js.map