chat-recall 0.7.3 → 0.7.5

package/dist/cli.js

@@ -6689,7 +6689,7 @@ async function archiveRawSession(store, sessionId) {
   return await store.putRawSession(sessionId, exp.tool, Math.floor(exp.mtime), gz, size);
 }
 function detectForkPredecessor(sessionPath) {
-  const { readFileSync: readFileSync50, readdirSync: readdirSync35 } = requireFs();
+  const { readFileSync: readFileSync50, readdirSync: readdirSync34 } = requireFs();
   const { dirname: dirname30, join: join62, basename: basename28 } = requirePath();
   let text;
   try {
@@ -6719,7 +6719,7 @@ function detectForkPredecessor(sessionPath) {
   const self = basename28(sessionPath);
   let entries;
   try {
-    entries = readdirSync35(dir);
+    entries = readdirSync34(dir);
   } catch {
     return null;
   }
@@ -8350,8 +8350,35 @@ var init_codex2 = __esm({
       configToml() {
         return join9(this.homeDir(), "config.toml");
       }
-      pluginsDir() {
-        return join9(this.homeDir(), ".tmp", "plugins", "plugins");
+      /**
+       * Plugins that are INSTALLED, one folder each:
+       * `plugins/cache/<marketplace>/<plugin>/<version>/`, newest version.
+       *
+       * `.tmp/plugins/plugins/` is Codex's copy of the plugin catalog (62 plugins
+       * and a README on one machine), not what is installed. Reading it reported
+       * every catalog plugin's skills and MCP servers as the user's own, and a
+       * pull then installed them into every tool: build-ios-apps' xcodebuildmcp
+       * reached a Linux PC that never installed the plugin.
+       */
+      installedPluginDirs() {
+        const cache4 = join9(this.homeDir(), "plugins", "cache");
+        const out = [];
+        const dirs = (p) => {
+          try {
+            return readdirSync6(p, { withFileTypes: true }).filter((e) => e.isDirectory() && !e.name.startsWith(".")).map((e) => e.name);
+          } catch {
+            return [];
+          }
+        };
+        for (const market of dirs(cache4)) {
+          for (const plugin of dirs(join9(cache4, market))) {
+            const versions = dirs(join9(cache4, market, plugin)).sort((a, b) => a.localeCompare(b, void 0, { numeric: true }));
+            const newest = versions[versions.length - 1];
+            if (newest)
+              out.push({ name: plugin, dir: join9(cache4, market, plugin, newest) });
+          }
+        }
+        return out;
       }
       /** OpenAI-bundled, read-only system skills (imagegen, skill-creator, …). */
       skillsSystemDir() {
@@ -17013,14 +17040,11 @@ var init_skills_source = __esm({
         }
         if (!isSourceEnabled("codex", "skills"))
           return;
-        const codexPluginsDir = codexBackend.pluginsDir();
-        if (existsSync33(codexPluginsDir)) {
-          for (const pluginName of readdirSync25(codexPluginsDir)) {
-            const skillsDir = join32(codexPluginsDir, pluginName, "skills");
-            if (!existsSync33(skillsDir))
-              continue;
-            yield* this.fromSkillRoot({ path: skillsDir, tool: "codex" }, pluginName);
-          }
+        for (const { name: pluginName, dir } of codexBackend.installedPluginDirs()) {
+          const skillsDir = join32(dir, "skills");
+          if (!existsSync33(skillsDir))
+            continue;
+          yield* this.fromSkillRoot({ path: skillsDir, tool: "codex" }, pluginName);
         }
       }
       async *fromSkillRoot(root, pluginName) {
@@ -17133,7 +17157,7 @@ var init_skills_source = __esm({
 });
 
 // ../engine/dist/parsers/mcps-source.js
-import { existsSync as existsSync34, readdirSync as readdirSync26, readFileSync as readFileSync24, statSync as statSync30 } from "fs";
+import { existsSync as existsSync34, readFileSync as readFileSync24, statSync as statSync30 } from "fs";
 import { homedir as homedir13 } from "os";
 import { join as join33 } from "path";
 function readJson(path) {
@@ -17245,16 +17269,13 @@ var init_mcps_source = __esm({
           scope: "user"
         });
         yield* this.fromCodexToml(codexBackend.configToml());
-        const pluginsDir = codexBackend.pluginsDir();
-        if (existsSync34(pluginsDir)) {
-          for (const plugin of readdirSync26(pluginsDir)) {
-            const mcpPath = join33(pluginsDir, plugin, ".mcp.json");
-            yield* this.fromObject(readJson(mcpPath)?.mcpServers, {
-              tool: "codex",
-              filePath: mcpPath,
-              scope: "plugin"
-            });
-          }
+        for (const { dir } of codexBackend.installedPluginDirs()) {
+          const mcpPath = join33(dir, ".mcp.json");
+          yield* this.fromObject(readJson(mcpPath)?.mcpServers, {
+            tool: "codex",
+            filePath: mcpPath,
+            scope: "plugin"
+          });
         }
       }
       async *fromObject(obj, ctx) {
@@ -17292,7 +17313,12 @@ var init_mcps_source = __esm({
               // MCP's url into a shell string, and `alwaysAllow` is truncated to
               // 8 for the preview — rebuilding from either produces a broken or
               // half-permissioned server, silently.
-              spec
+              spec,
+              // Where this registration runs. A server that starts through npx
+              // passes the command check on any machine, so this is what tells a
+              // pull that it came from another platform (see toolkit-pull.ts).
+              platform: process.platform,
+              arch: process.arch
             }
           };
         }
@@ -17471,7 +17497,7 @@ var init_toolkit_format = __esm({
 });
 
 // ../engine/dist/parsers/slash-commands-source.js
-import { existsSync as existsSync35, readdirSync as readdirSync27, readFileSync as readFileSync25, statSync as statSync31 } from "fs";
+import { existsSync as existsSync35, readdirSync as readdirSync26, readFileSync as readFileSync25, statSync as statSync31 } from "fs";
 import { join as join34, basename as basename18 } from "path";
 function rebuildBody2(content) {
   const { text, redacted } = redactInlineSecrets(content);
@@ -17526,7 +17552,7 @@ var init_slash_commands_source = __esm({
           const projectsRoot = claudeBackend.projectsDir();
           if (existsSync35(projectsRoot)) {
             try {
-              for (const entry of readdirSync27(projectsRoot, { withFileTypes: true })) {
+              for (const entry of readdirSync26(projectsRoot, { withFileTypes: true })) {
                 if (!entry.isDirectory() || entry.name.startsWith("."))
                   continue;
                 const projectPath = resolveProjectDirName(entry.name);
@@ -17558,7 +17584,7 @@ var init_slash_commands_source = __esm({
           const ext = root.format === "toml" ? ".toml" : ".md";
           let files;
           try {
-            files = readdirSync27(root.path).filter((f) => f.endsWith(ext));
+            files = readdirSync26(root.path).filter((f) => f.endsWith(ext));
           } catch {
             continue;
           }
@@ -17618,7 +17644,7 @@ var init_slash_commands_source = __esm({
 });
 
 // ../engine/dist/parsers/subagents-source.js
-import { existsSync as existsSync36, readdirSync as readdirSync28, readFileSync as readFileSync26, statSync as statSync32 } from "fs";
+import { existsSync as existsSync36, readdirSync as readdirSync27, readFileSync as readFileSync26, statSync as statSync32 } from "fs";
 import { join as join35, basename as basename19 } from "path";
 function rebuildBody3(content) {
   const { text, redacted } = redactInlineSecrets(content);
@@ -17675,7 +17701,7 @@ var init_subagents_source = __esm({
           const projectsRoot = claudeBackend.projectsDir();
           if (existsSync36(projectsRoot)) {
             try {
-              for (const entry of readdirSync28(projectsRoot, { withFileTypes: true })) {
+              for (const entry of readdirSync27(projectsRoot, { withFileTypes: true })) {
                 if (!entry.isDirectory() || entry.name.startsWith("."))
                   continue;
                 const projectPath = resolveProjectDirName(entry.name);
@@ -17707,7 +17733,7 @@ var init_subagents_source = __esm({
           const ext = root.format === "toml" ? ".toml" : ".md";
           let files;
           try {
-            files = readdirSync28(root.path).filter((f) => f.endsWith(ext));
+            files = readdirSync27(root.path).filter((f) => f.endsWith(ext));
           } catch {
             continue;
           }
@@ -17768,7 +17794,7 @@ var init_subagents_source = __esm({
 });
 
 // ../engine/dist/parsers/hooks-source.js
-import { existsSync as existsSync37, readFileSync as readFileSync27, readdirSync as readdirSync29, statSync as statSync33 } from "fs";
+import { existsSync as existsSync37, readFileSync as readFileSync27, readdirSync as readdirSync28, statSync as statSync33 } from "fs";
 import { join as join36 } from "path";
 function readJson2(path) {
   if (!existsSync37(path))
@@ -17795,7 +17821,7 @@ var init_hooks_source = __esm({
         const projectsRoot = claudeBackend.projectsDir();
         if (existsSync37(projectsRoot)) {
           try {
-            for (const entry of readdirSync29(projectsRoot, { withFileTypes: true })) {
+            for (const entry of readdirSync28(projectsRoot, { withFileTypes: true })) {
               if (!entry.isDirectory() || entry.name.startsWith("."))
                 continue;
               const projectPath = resolveProjectDirName(entry.name);
@@ -17891,7 +17917,7 @@ var init_hooks_source = __esm({
 });
 
 // ../engine/dist/parsers/plugins-source.js
-import { existsSync as existsSync38, readFileSync as readFileSync28, readdirSync as readdirSync30, statSync as statSync34 } from "fs";
+import { existsSync as existsSync38, readFileSync as readFileSync28, readdirSync as readdirSync29, statSync as statSync34 } from "fs";
 import { homedir as homedir14 } from "os";
 import { join as join37 } from "path";
 function readJson3(path) {
@@ -17953,7 +17979,7 @@ var init_plugins_source = __esm({
         if (isSourceEnabled("agy", "extensions") && existsSync38(gemRoot)) {
           let entries;
           try {
-            entries = readdirSync30(gemRoot);
+            entries = readdirSync29(gemRoot);
           } catch {
             entries = [];
           }
@@ -17997,16 +18023,8 @@ var init_plugins_source = __esm({
             };
           }
         }
-        const codexPluginsRoot = codexBackend.pluginsDir();
-        if (isSourceEnabled("codex", "plugins") && existsSync38(codexPluginsRoot)) {
-          let entries;
-          try {
-            entries = readdirSync30(codexPluginsRoot);
-          } catch {
-            entries = [];
-          }
-          for (const name of entries) {
-            const pluginDir = join37(codexPluginsRoot, name);
+        if (isSourceEnabled("codex", "plugins")) {
+          for (const { name, dir: pluginDir } of codexBackend.installedPluginDirs()) {
             let st;
             try {
               st = statSync34(pluginDir);
@@ -18120,7 +18138,8 @@ var init_all_sources = __esm({
 
 // ../engine/dist/core/extractor-version.js
 function extractorVersionForItem(id, sourceType) {
-  return extractorVersionForTool(toolOfId(id)) + (ITEM_SOURCE_BUMP[sourceType] ?? 0);
+  const tool = toolOfId(id);
+  return extractorVersionForTool(tool) + (ITEM_SOURCE_BUMP[sourceType] ?? 0) + (ITEM_TOOL_SOURCE_BUMP[`${tool}:${sourceType}`] ?? 0);
 }
 function toolOfId(id) {
   if (id.startsWith("agy_"))
@@ -18141,17 +18160,21 @@ function extractorVersionForTool(tool) {
 function extractorVersionForId(id) {
   return extractorVersionForTool(toolOfId(id));
 }
-var BASE_EXTRACTOR_VERSION, ITEM_SOURCE_BUMP, TOOL_EXTRACTOR_BUMP, EXTRACTOR_VERSION;
+var BASE_EXTRACTOR_VERSION, ITEM_SOURCE_BUMP, ITEM_TOOL_SOURCE_BUMP, TOOL_EXTRACTOR_BUMP, EXTRACTOR_VERSION;
 var init_extractor_version = __esm({
   "../engine/dist/core/extractor-version.js"() {
     "use strict";
     BASE_EXTRACTOR_VERSION = 2;
     ITEM_SOURCE_BUMP = {
-      mcp: 1,
+      mcp: 2,
       skill: 1,
       agent: 1,
       command: 1
     };
+    ITEM_TOOL_SOURCE_BUMP = {
+      "codex:skill": 1,
+      "codex:plugin": 1
+    };
     TOOL_EXTRACTOR_BUMP = {
       agy: 3,
       claude: 1,
@@ -18263,6 +18286,28 @@ function saveItemVersions(server, versions) {
   writeFileSync5(tmp, JSON.stringify(all));
   renameSync4(tmp, path);
 }
+function loadInventoryHashes(server) {
+  try {
+    const parsed = JSON.parse(readFileSync29(inventoryPath(), "utf-8"));
+    return { ...(parsed && typeof parsed === "object" ? parsed[server] : null) || {} };
+  } catch {
+    return {};
+  }
+}
+function saveInventoryHashes(server, hashes) {
+  let all = {};
+  try {
+    all = JSON.parse(readFileSync29(inventoryPath(), "utf-8"));
+  } catch {
+  }
+  if (!all || typeof all !== "object") all = {};
+  all[server] = { ...all[server] || {}, ...hashes };
+  const path = inventoryPath();
+  mkdirSync6(dirname15(path), { recursive: true });
+  const tmp = `${path}.tmp`;
+  writeFileSync5(tmp, JSON.stringify(all));
+  renameSync4(tmp, path);
+}
 function getSyncedRows(server) {
   const data = load();
   const out = /* @__PURE__ */ new Map();
@@ -18374,7 +18419,7 @@ function syncMode(row, mtime, fileSize, extractorVersion, isAppendOnly) {
   if (row.m >= Math.floor(mtime)) return "skip";
   return "full";
 }
-var ledgerPath, cache3, LEDGER_FLUSH_MS, pendingWrite, flushTimer, itemVersionsPath, itemVersionsCache, unackedCursorAttempts, reconcilePath, reconcileCache;
+var ledgerPath, cache3, LEDGER_FLUSH_MS, pendingWrite, flushTimer, itemVersionsPath, itemVersionsCache, inventoryPath, unackedCursorAttempts, reconcilePath, reconcileCache;
 var init_sync_ledger = __esm({
   "src/sync-ledger.ts"() {
     "use strict";
@@ -18387,6 +18432,7 @@ var init_sync_ledger = __esm({
     flushTimer = null;
     itemVersionsPath = () => join38(getDataDir(), "item-versions.json");
     itemVersionsCache = null;
+    inventoryPath = () => join38(getDataDir(), "toolkit-inventory.json");
     unackedCursorAttempts = 0;
     reconcilePath = () => join38(getDataDir(), "sync-field-reconcile.json");
     reconcileCache = null;
@@ -18541,7 +18587,7 @@ var init_http = __esm({
       CLI_VERSION = JSON.parse(readFileSync31(new URL("../package.json", import.meta.url), "utf-8")).version || CLI_VERSION;
     } catch {
       try {
-        if (true) CLI_VERSION = "0.7.3";
+        if (true) CLI_VERSION = "0.7.5";
       } catch {
       }
     }
@@ -19040,7 +19086,7 @@ var init_telemetry = __esm({
     init_sync_client();
     cliVersion2 = () => {
       try {
-        return true ? "0.7.3" : "dev";
+        return true ? "0.7.5" : "dev";
       } catch {
         return "dev";
       }
@@ -19405,7 +19451,7 @@ __export(auto_update_exports, {
 import { execSync as execSync2, execFileSync as execFileSync3 } from "node:child_process";
 import { readFileSync as readFileSync34, existsSync as existsSync41 } from "node:fs";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
-import { writeFileSync as writeFileSync8, mkdtempSync as mkdtempSync3, rmSync as rmSync5, readdirSync as readdirSync31, statSync as statSync36, mkdirSync as mkdirSync9 } from "node:fs";
+import { writeFileSync as writeFileSync8, mkdtempSync as mkdtempSync3, rmSync as rmSync5, readdirSync as readdirSync30, statSync as statSync36, mkdirSync as mkdirSync9 } from "node:fs";
 import { join as join41, dirname as dirname18, sep as sep2, posix as pathPosix, win32 as pathWin32 } from "node:path";
 import { tmpdir as tmpdir2, homedir as homedir15 } from "node:os";
 import { createHash as createHash8 } from "node:crypto";
@@ -19442,7 +19488,7 @@ function planAutoUpdate(base3, caps, ownVersion3, flag) {
   if (!rel || !rel.version || !rel.sha256) return { update: false, reason: "server advertises no CLI release" };
   if (!isAutoUpdateEnabled(caps.edition, flag)) return { update: false, reason: `auto-update disabled (edition ${caps.edition ?? "?"})` };
   if (compareVersions(rel.version, ownVersion3) <= 0) return { update: false, reason: `already current (own ${ownVersion3} >= server ${rel.version})` };
-  return { update: true, reason: `server ${rel.version} > own ${ownVersion3}`, url: tarballUrl(base3), sha256: rel.sha256, from: ownVersion3, to: rel.version };
+  return { update: true, reason: `server ${rel.version} > own ${ownVersion3}`, url: tarballUrl(base3, rel.version), fallbackUrl: tarballUrl(base3), sha256: rel.sha256, from: ownVersion3, to: rel.version };
 }
 function sweepStaleStaging(root = tmpdir2(), now = Date.now()) {
   const MKDTEMP_SUFFIX = /^cr-update-.{6}$/s;
@@ -19450,7 +19496,7 @@ function sweepStaleStaging(root = tmpdir2(), now = Date.now()) {
   let removed = 0;
   let entries;
   try {
-    entries = readdirSync31(root);
+    entries = readdirSync30(root);
   } catch {
     return 0;
   }
@@ -19460,7 +19506,7 @@ function sweepStaleStaging(root = tmpdir2(), now = Date.now()) {
     try {
       const st = statSync36(dir);
       if (!st.isDirectory() || now - st.mtimeMs < COLD_MS) continue;
-      const inside = readdirSync31(dir);
+      const inside = readdirSync30(dir);
       if (inside.length > 1 || inside.length === 1 && inside[0] !== "chat-recall.tgz") continue;
       rmSync5(dir, { recursive: true, force: true });
       removed++;
@@ -19475,7 +19521,13 @@ async function executeAutoUpdate(plan, deps) {
   try {
     buf = await deps.download(plan.url);
   } catch (e) {
-    return { updated: false, reason: `download failed: ${e instanceof Error ? e.message : e}` };
+    const notFound = e instanceof Error && e.message === "HTTP 404";
+    if (!notFound || !plan.fallbackUrl) return { updated: false, reason: `download failed: ${e instanceof Error ? e.message : e}` };
+    try {
+      buf = await deps.download(plan.fallbackUrl);
+    } catch (e2) {
+      return { updated: false, reason: `download failed: ${e2 instanceof Error ? e2.message : e2}` };
+    }
   }
   const got = createHash8("sha256").update(buf).digest("hex");
   if (got !== plan.sha256) return { updated: false, reason: `checksum mismatch (expected ${plan.sha256.slice(0, 12)}\u2026, got ${got.slice(0, 12)}\u2026) \u2014 NOT installing` };
@@ -19651,7 +19703,7 @@ var init_auto_update = __esm({
   "src/auto-update.ts"() {
     "use strict";
     init_http();
-    tarballUrl = (base3) => `${base3.replace(/\/+$/, "")}/install/chat-recall.tgz`;
+    tarballUrl = (base3, version2) => `${base3.replace(/\/+$/, "")}/install/${version2 ? `chat-recall-${version2}.tgz` : "chat-recall.tgz"}`;
     GIVE_UP_AFTER = 3;
     reportedStandingSkip = /* @__PURE__ */ new Set();
   }
@@ -19664,6 +19716,7 @@ __export(sync_client_exports, {
   DERIVED_MAX_BYTES: () => DERIVED_MAX_BYTES,
   FULL_BUILD_MAX_BYTES: () => FULL_BUILD_MAX_BYTES,
   SYNC_CHUNK_BYTES: () => SYNC_CHUNK_BYTES,
+  TOOLKIT_INVENTORY_TYPES: () => TOOLKIT_INVENTORY_TYPES,
   _acceptedUploads: () => _acceptedUploads,
   _fetchTenantSyncConfigForTests: () => _fetchTenantSyncConfigForTests,
   _resetCapsCacheForTests: () => _resetCapsCacheForTests,
@@ -19692,7 +19745,7 @@ __export(sync_client_exports, {
   syncSessions: () => syncSessions
 });
 import { join as join42, dirname as dirname19, basename as basename20 } from "node:path";
-import { readFileSync as readFileSync35, writeFileSync as writeFileSync9, mkdirSync as mkdirSync10, mkdtempSync as mkdtempSync4, rmSync as rmSync6, chmodSync as chmodSync3, unlinkSync as unlinkSync2, readdirSync as readdirSync32, statSync as statSync37 } from "node:fs";
+import { readFileSync as readFileSync35, writeFileSync as writeFileSync9, mkdirSync as mkdirSync10, mkdtempSync as mkdtempSync4, rmSync as rmSync6, chmodSync as chmodSync3, unlinkSync as unlinkSync2, readdirSync as readdirSync31, statSync as statSync37 } from "node:fs";
 import { tmpdir as tmpdir3, hostname as hostname2 } from "node:os";
 import { createHash as createHash9 } from "node:crypto";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
@@ -20095,7 +20148,7 @@ function reapStaleScanDirs(dir = tmpdir3(), maxAgeMs = 6 * 36e5, now = Date.now(
   let reaped = 0;
   let names;
   try {
-    names = readdirSync32(dir);
+    names = readdirSync31(dir);
   } catch {
     return 0;
   }
@@ -20736,17 +20789,24 @@ async function syncToTargetInScope(cred, opts = {}) {
   const seenTools = /* @__PURE__ */ new Set();
   const seenItemKeys = /* @__PURE__ */ new Map();
   const registry = buildSourceRegistry();
+  const inventory = /* @__PURE__ */ new Map();
+  const inventoryFailed = /* @__PURE__ */ new Set();
   for (const sourceType of registry.getRegisteredTypes()) {
     if (sourceType === "session") continue;
+    if (TOOLKIT_INVENTORY_TYPES.has(sourceType)) inventory.set(sourceType, /* @__PURE__ */ new Set());
     for (const source of registry.getAll(sourceType)) {
       let discovered;
       try {
         discovered = source.discover();
       } catch {
+        inventoryFailed.add(sourceType);
         continue;
       }
       try {
         for await (const item of discovered) {
+          if (inventory.has(item.sourceType) && !excluded(item.projectPath || "") && includedProject(item.projectPath || "")) {
+            inventory.get(item.sourceType).add(item.id);
+          }
           const itemTool = toolOfId(item.id);
           seenTools.add(itemTool);
           const itemKey = `${itemTool}:${item.sourceType}`;
@@ -20804,6 +20864,7 @@ async function syncToTargetInScope(cred, opts = {}) {
           redactions += count.redactions;
         }
       } catch (err) {
+        inventoryFailed.add(sourceType);
         console.error(`[sync] source '${sourceType}' failed mid-walk (its items may be incomplete this run): ${err instanceof Error ? err.message : err}`);
       }
     }
@@ -20830,6 +20891,27 @@ async function syncToTargetInScope(cred, opts = {}) {
   await kgTripleBatch.drain();
   await findingsBatch.drain();
   await drainInflight();
+  {
+    const sentHashes = loadInventoryHashes(base3);
+    const entries = [];
+    const hashes = {};
+    for (const [sourceType, ids] of inventory) {
+      if (inventoryFailed.has(sourceType)) continue;
+      const sorted = [...ids].sort();
+      const hash = createHash9("sha256").update(sorted.join("\n")).digest("hex").slice(0, 32);
+      if (sentHashes[sourceType] === hash) continue;
+      entries.push({ source_type: sourceType, ids: sorted });
+      hashes[sourceType] = hash;
+    }
+    if (entries.length > 0) {
+      try {
+        await post({ inventory: entries });
+        saveInventoryHashes(base3, hashes);
+      } catch (err) {
+        console.error(`[sync] toolkit inventory not sent (it is retried next sync): ${err instanceof Error ? err.message : err}`);
+      }
+    }
+  }
   if (seenTools.size > 0) {
     try {
       const rec = {};
@@ -21275,7 +21357,7 @@ async function syncIncremental(opts = {}) {
     lock.release();
   }
 }
-var ownVersion, ERROR_CLASS, STANDING_FAILURE, walkProgressForUpload, lastServerPackSpec, credPath, _securityConfigCache, SECURITY_CONFIG_TTL_MS, _syncConfigCache, EMPTY_SYNC_CONFIG, _fetchTenantSyncConfigForTests, SYNC_RULES_REFUSAL, hashPath, acceptedUploads, MAX_DERIVED_ROW_BYTES, isLocalHost, CAPS_TTL_MS, capsOk, advertisedIngestConc, advertisedGzipBody, FULL_BUILD_MAX_BYTES, DERIVED_MAX_BYTES, SYNC_CHUNK_BYTES, BATCH_SCAN_MAX_BYTES;
+var ownVersion, ERROR_CLASS, STANDING_FAILURE, walkProgressForUpload, lastServerPackSpec, credPath, _securityConfigCache, SECURITY_CONFIG_TTL_MS, _syncConfigCache, EMPTY_SYNC_CONFIG, _fetchTenantSyncConfigForTests, SYNC_RULES_REFUSAL, hashPath, acceptedUploads, MAX_DERIVED_ROW_BYTES, isLocalHost, CAPS_TTL_MS, capsOk, advertisedIngestConc, advertisedGzipBody, FULL_BUILD_MAX_BYTES, DERIVED_MAX_BYTES, SYNC_CHUNK_BYTES, TOOLKIT_INVENTORY_TYPES, BATCH_SCAN_MAX_BYTES;
 var init_sync_client = __esm({
   "src/sync-client.ts"() {
     "use strict";
@@ -21320,7 +21402,7 @@ var init_sync_client = __esm({
       ownVersion = JSON.parse(readFileSync35(join42(dir, "../package.json"), "utf-8")).version || ownVersion;
     } catch {
       try {
-        if (true) ownVersion = "0.7.3";
+        if (true) ownVersion = "0.7.5";
       } catch {
       }
     }
@@ -21350,6 +21432,7 @@ var init_sync_client = __esm({
     FULL_BUILD_MAX_BYTES = Math.max(8, parseInt(process.env.CHAT_RECALL_FULL_BUILD_MAX_MB || "24", 10)) * 1024 * 1024;
     DERIVED_MAX_BYTES = Math.max(8, parseInt(process.env.CHAT_RECALL_DERIVED_MAX_MB || "64", 10)) * 1024 * 1024;
     SYNC_CHUNK_BYTES = 8 * 1024 * 1024;
+    TOOLKIT_INVENTORY_TYPES = /* @__PURE__ */ new Set(["skill", "mcp", "command", "agent", "plugin"]);
     BATCH_SCAN_MAX_BYTES = Math.max(1, parseInt(process.env.CHAT_RECALL_BATCHSCAN_MAX_MB || "64", 10)) * 1024 * 1024;
   }
 });
@@ -22004,7 +22087,7 @@ __export(install_skills_exports, {
   skillsSourceDir: () => skillsSourceDir,
   uninstallSkills: () => uninstallSkills
 });
-import { readdirSync as readdirSync33, existsSync as existsSync46, mkdirSync as mkdirSync14, rmSync as rmSync7, cpSync, writeFileSync as writeFileSync14, readFileSync as readFileSync39, statSync as statSync40, realpathSync as realpathSync4 } from "fs";
+import { readdirSync as readdirSync32, existsSync as existsSync46, mkdirSync as mkdirSync14, rmSync as rmSync7, cpSync, writeFileSync as writeFileSync14, readFileSync as readFileSync39, statSync as statSync40, realpathSync as realpathSync4 } from "fs";
 import { createHash as createHash11 } from "crypto";
 import { join as join48, basename as basename21 } from "path";
 function skillsSourceDir() {
@@ -22030,7 +22113,7 @@ function skillsFingerprint() {
 }
 function filesUnder(dir, prefix = "") {
   const out = [];
-  for (const e of readdirSync33(dir, { withFileTypes: true })) {
+  for (const e of readdirSync32(dir, { withFileTypes: true })) {
     if (e.name === MARKER) continue;
     const rel = prefix ? `${prefix}/${e.name}` : e.name;
     if (e.isDirectory()) out.push(...filesUnder(join48(dir, e.name), rel));
@@ -22044,7 +22127,7 @@ function skillStamp() {
 function bundledSkillNames() {
   const src = skillsSourceDir();
   if (!existsSync46(src)) return [];
-  return readdirSync33(src, { withFileTypes: true }).filter((e) => e.isDirectory() && existsSync46(join48(src, e.name, "SKILL.md"))).map((e) => e.name).sort();
+  return readdirSync32(src, { withFileTypes: true }).filter((e) => e.isDirectory() && existsSync46(join48(src, e.name, "SKILL.md"))).map((e) => e.name).sort();
 }
 function realPathOrSelf(p) {
   try {
@@ -22134,7 +22217,7 @@ function uninstallSkills() {
       perTarget.push({ id: t.id, label: t.label, removed });
       continue;
     }
-    for (const entry of readdirSync33(t.dir, { withFileTypes: true })) {
+    for (const entry of readdirSync32(t.dir, { withFileTypes: true })) {
       if (!entry.isDirectory()) continue;
       const dir = join48(t.dir, entry.name);
       if (isManaged(dir) && (names.has(entry.name) || entry.name.startsWith("chat-recall"))) {
@@ -22808,6 +22891,7 @@ __export(toolkit_pull_exports, {
   entryFromSpec: () => entryFromSpec,
   executePull: () => executePull,
   planPull: () => planPull,
+  platformRefusal: () => platformRefusal,
   portableCommand: () => portableCommand
 });
 import { existsSync as existsSync48, mkdirSync as mkdirSync16, statSync as statSync41, writeFileSync as writeFileSync16 } from "node:fs";
@@ -22865,6 +22949,7 @@ function planPull(rows, opts = {}) {
   const wanted = opts.types;
   const seenUnsupported = /* @__PURE__ */ new Map();
   const byName = /* @__PURE__ */ new Map();
+  const platformsByName = /* @__PURE__ */ new Map();
   const skillsByName = /* @__PURE__ */ new Map();
   const agentsByName = /* @__PURE__ */ new Map();
   const commandsByName = /* @__PURE__ */ new Map();
@@ -22928,6 +23013,9 @@ function planPull(rows, opts = {}) {
     const name = extra.mcpName || row.title;
     if (!name)
       continue;
+    if (typeof extra.platform === "string" && extra.platform) {
+      (platformsByName.get(name) ?? platformsByName.set(name, /* @__PURE__ */ new Set()).get(name)).add(extra.platform);
+    }
     const spec = extra.spec || null;
     if (!spec)
       continue;
@@ -22937,7 +23025,12 @@ function planPull(rows, opts = {}) {
       byName.set(name, spec);
   }
   const targets = SUPPORTED_TARGETS.mcp;
-  const mcps = [...byName.entries()].map(([name, spec]) => ({ name, spec, tools: targets }));
+  const mcps = [...byName.entries()].map(([name, spec]) => ({
+    name,
+    spec,
+    tools: targets,
+    platforms: [...platformsByName.get(name) ?? []].sort()
+  }));
   const skills = [...skillsByName.entries()].map(([name, v]) => ({
     name,
     body: v.body,
@@ -22956,7 +23049,18 @@ function planPull(rows, opts = {}) {
   ];
   return { mcps, skills, codecs, unsupported };
 }
+function platformRefusal(name, platforms, here, explicit) {
+  if (explicit.has(name) || platforms.includes(here))
+    return null;
+  const hint = `install it by name if it works on ${here}: chat-recall toolkit pull --mcp ${name}`;
+  if (platforms.length === 0) {
+    return `no device recorded its platform \u2014 re-sync from the device that has it, or ${hint}`;
+  }
+  return `registered only on ${platforms.join(", ")} \u2014 ${hint}`;
+}
 function executePull(rows, opts = {}) {
+  const here = opts.platform ?? process.platform;
+  const explicit = new Set(opts.explicit ?? []);
   const { mcps, skills, codecs, unsupported } = planPull(rows, opts);
   const outcomes = [];
   for (const { name, body, truncated, redacted, tools } of skills) {
@@ -23025,8 +23129,9 @@ function executePull(rows, opts = {}) {
       }
     }
   }
-  for (const { name, spec, tools } of mcps) {
+  for (const { name, spec, tools, platforms } of mcps) {
     const built = entryFromSpec(spec);
+    const refusal = platformRefusal(name, platforms, here, explicit);
     for (const tool of tools) {
       if (!built) {
         outcomes.push({ type: "mcp", name, tool, status: "skipped", reason: "stored row has no rebuildable spec (re-index on the source device)" });
@@ -23036,6 +23141,10 @@ function executePull(rows, opts = {}) {
         outcomes.push({ type: "mcp", name, tool, status: "present" });
         continue;
       }
+      if (refusal) {
+        outcomes.push({ type: "mcp", name, tool, status: "skipped", reason: refusal });
+        continue;
+      }
       if (spec.secretsRedacted) {
         outcomes.push({
           type: "mcp",
@@ -25320,7 +25429,7 @@ async function runPull(base3, opts) {
       return r.title === opts.name;
     }
   }) : rows;
-  const report = executePull2(filtered, { thisDeviceId: hostname3(), types: wanted });
+  const report = executePull2(filtered, { thisDeviceId: hostname3(), types: wanted, explicit: opts.name ? [opts.name] : void 0 });
   const written = report.outcomes.filter((o) => o.status === "written");
   const failed = report.outcomes.filter((o) => o.status === "failed");
   return {
@@ -25454,7 +25563,7 @@ var init_intent_drain = __esm({
       ownVersion2 = JSON.parse(readFileSync45(join56(dir, "../package.json"), "utf-8")).version || ownVersion2;
     } catch {
       try {
-        if (true) ownVersion2 = "0.7.3";
+        if (true) ownVersion2 = "0.7.5";
       } catch {
       }
     }
@@ -25876,7 +25985,7 @@ var init_vault_crypto = __esm({
 });
 
 // ../engine/dist/core/vault-source.js
-import { existsSync as existsSync54, readdirSync as readdirSync34, statSync as statSync44 } from "fs";
+import { existsSync as existsSync54, readdirSync as readdirSync33, statSync as statSync44 } from "fs";
 import { extname, join as join58 } from "path";
 function* walkVaultSources() {
   const t = loadSettings().team.vault;
@@ -25906,7 +26015,7 @@ function* walkClaude() {
     return;
   let projectDirs = [];
   try {
-    projectDirs = readdirSync34(root);
+    projectDirs = readdirSync33(root);
   } catch {
     return;
   }
@@ -25917,7 +26026,7 @@ function* walkClaude() {
     const projDir = join58(root, proj);
     let entries = [];
     try {
-      entries = readdirSync34(projDir);
+      entries = readdirSync33(projDir);
     } catch {
       continue;
     }
@@ -25962,7 +26071,7 @@ function* walkCodex() {
     const dir = stack.pop();
     let entries = [];
     try {
-      entries = readdirSync34(dir, { withFileTypes: true });
+      entries = readdirSync33(dir, { withFileTypes: true });
     } catch {
       continue;
     }
@@ -25988,7 +26097,7 @@ function* walkAgy() {
     return;
   let sessionDirs = [];
   try {
-    sessionDirs = readdirSync34(brainDir);
+    sessionDirs = readdirSync33(brainDir);
   } catch {
     return;
   }
@@ -29328,7 +29437,7 @@ toolkit.command("sync").description("Fan every artifact out to every tool that i
   console.log(chalk2.bold(`Synced: ${r.copied.length} copied, ${r.skipped.length} already present, ${r.failed.length} failed.`));
   if (r.copied.length > 0) await pushToolkitToServer();
 });
-toolkit.command("pull").description("Install artifacts this device is missing, from the server (cross-device setup)").option("--types <list>", "comma-separated subset: mcp").option("--dry-run", "report what would change, write nothing").action(async (options) => {
+toolkit.command("pull").description("Install artifacts this device is missing, from the server (cross-device setup)").option("--types <list>", "comma-separated subset: mcp").option("--dry-run", "report what would change, write nothing").option("--mcp <names>", "comma-separated MCP servers to install even if only another platform registered them").action(async (options) => {
   const { loadAllCredentials: loadAllCredentials2 } = await Promise.resolve().then(() => (init_sync_client(), sync_client_exports));
   const { executePull: executePull2 } = await Promise.resolve().then(() => (init_toolkit_pull(), toolkit_pull_exports));
   const { hostname: hostname3 } = await import("node:os");
@@ -29357,7 +29466,8 @@ toolkit.command("pull").description("Install artifacts this device is missing, f
     return;
   }
   const types = options.types ? options.types.split(",").map((x) => x.trim()).filter(Boolean) : void 0;
-  const report = executePull2(rows, { thisDeviceId: hostname3(), types, dryRun: options.dryRun });
+  const explicit = options.mcp ? options.mcp.split(",").map((x) => x.trim()).filter(Boolean) : void 0;
+  const report = executePull2(rows, { thisDeviceId: hostname3(), types, dryRun: options.dryRun, explicit });
   const written = report.outcomes.filter((o) => o.status === "written");
   const present = report.outcomes.filter((o) => o.status === "present");
   const failed = report.outcomes.filter((o) => o.status === "failed");