flyspace-cli 0.1.1 → 0.1.4

package/dist/cli.js

@@ -7,6 +7,10 @@ import {
   BUILT_IN_OUTPUT_STYLES,
   DEFAULT_CODEX_MODEL,
   DEFAULT_TIMEZONE,
+  DEFAULT_TITLE_RULES,
+  DefaultChannelError,
+  HANDLE_PATTERN,
+  HandleTakenError,
   InvalidTransferError,
   LastAdminError,
   MessageQueue,
@@ -23,6 +27,7 @@ import {
   authorFor,
   blockToFallbackText,
   bodyTextFor,
+  buildAutoTitle,
   buildFilesPromptSection,
   buildSystemPrompt,
   canSeeChannel,
@@ -38,9 +43,14 @@ import {
   deleteSkillFile,
   deleteWorkspace,
   displayNameFor,
+  docsAccessPromptNote,
   ensureAgentDmChannel,
+  ensureGeneralChannel,
+  ensureLogicalCwdDir,
+  ensureMemberDmChannel,
   ensureUsersCached,
   expandPath,
+  extractCategories,
   findChannel,
   findChannelById,
   findSkillDetail,
@@ -63,6 +73,7 @@ import {
   isCwdUsable,
   isEffort,
   isLockedPlan,
+  isLogicalCwd,
   isValidSkillName,
   lastRunsForWorkspace,
   listActiveUsers,
@@ -90,6 +101,7 @@ import {
   lookupById,
   markInviteResent,
   markWorkspaceAgentConnected,
+  markWorkspaceProjectsSetup,
   markdownToBlocks,
   mcpStrictConfigEnabled,
   mimetypeSizeLimit,
@@ -105,6 +117,7 @@ import {
   resolveChannelId,
   resolveChannelPrompt,
   resolveCwd,
+  resolveLogicalCwd,
   resolveSelectedOutputStyle,
   resolveUserId,
   runAutomation,
@@ -117,6 +130,7 @@ import {
   saveWorkspacePrompt,
   setAgentPaused,
   setAllowGuestAccess,
+  setMembershipHandle,
   setOutputStyleDefault,
   setWorkspaceStripeSubscription,
   slackConfigured,
@@ -136,7 +150,7 @@ import {
   warnOnBrokenChannelCwds,
   workspaceSkillsDir,
   writeSkillFile
-} from "./chunk-6D2PIFEA.js";
+} from "./chunk-BZYTXXF7.js";
 import {
   firstReplyBody,
   getThread,
@@ -144,7 +158,7 @@ import {
   listThreads,
   moveThread,
   resolveChannel
-} from "./chunk-X7SJ653V.js";
+} from "./chunk-6PJ73XYW.js";
 import {
   AGENT_AUTHOR,
   DEFAULT_PROFILE,
@@ -154,15 +168,17 @@ import {
   getR2Bucket,
   getR2Client,
   getSupabaseClient,
+  hasSupabaseCredentials,
   isHumanAuthor,
   paths,
   postToDashboardChannel,
   resolveDashboardChannelId,
   runWithProfile,
+  setSupabaseClient,
   sumR2PrefixBytes,
   syncPostToDashboard,
   uploadLocalImages
-} from "./chunk-QZIN7MWV.js";
+} from "./chunk-ZBMYF5LX.js";
 
 // src/logger.ts
 var ALREADY_STAMPED = /^\[\d{4}-\d{2}-\d{2}T/;
@@ -852,7 +868,7 @@ Restarting ${installed.length} instance(s)...`);
   }
 }
 async function runUpgrade() {
-  const current = "0.1.1";
+  const current = "0.1.4";
   console.log(`Current version: ${current}`);
   console.log("Checking for updates...\n");
   try {
@@ -1491,10 +1507,10 @@ async function runLogs(args) {
 }
 
 // src/commands/slack.ts
-import { execFileSync as execFileSync3 } from "child_process";
-import { existsSync as existsSync28, readFileSync as readFileSync16, writeFileSync as writeFileSync9 } from "fs";
+import { execFileSync as execFileSync4 } from "child_process";
+import { existsSync as existsSync28, readFileSync as readFileSync17, writeFileSync as writeFileSync10 } from "fs";
 import { resolve as resolve7 } from "path";
-import { tmpdir as tmpdir3, homedir as homedir8 } from "os";
+import { tmpdir as tmpdir3, homedir as homedir9 } from "os";
 import { input, confirm, select, checkbox } from "@inquirer/prompts";
 import { WebClient as WebClient3 } from "@slack/web-api";
 
@@ -1547,6 +1563,10 @@ async function emailForToken(token, type) {
   }
 }
 
+// src/dashboard/profile-config.ts
+import { homedir as homedir4 } from "os";
+import { join as join7 } from "path";
+
 // src/dashboard/profile-config-cache.ts
 var cache = /* @__PURE__ */ new Map();
 function setProfileConfigCache(configs) {
@@ -1561,6 +1581,11 @@ function cachedProfileConfig(profile = getProfile()) {
 function profileEnv(key) {
   return cachedProfileConfig()?.env[key] || process.env[key] || void 0;
 }
+function profileClaudeConfigDir() {
+  const config = cachedProfileConfig();
+  if (!config) return process.env["CLAUDE_CONFIG_DIR"] || void 0;
+  return config.env["CLAUDE_CONFIG_DIR"]?.trim() || join7(homedir4(), ".claude");
+}
 function profileOauthToken() {
   const env = cachedProfileConfig()?.env ?? {};
   if (env["CLAUDE_CODE_OAUTH_TOKEN"]) return env["CLAUDE_CODE_OAUTH_TOKEN"];
@@ -1587,7 +1612,7 @@ function resolveChannelConfig(channelId) {
     mounts: channel?.mounts ?? [],
     prompt: channel?.prompt?.trim() || void 0,
     codexModel: profileEnv("CUSTIE_CODEX_MODEL")?.trim() || DEFAULT_CODEX_MODEL,
-    claudeConfigDir: profileEnv("CLAUDE_CONFIG_DIR"),
+    claudeConfigDir: profileClaudeConfigDir(),
     claudeCodeOauthToken: profileOauthToken(),
     agentName: channel?.agentName ?? null,
     profile: channel?.profile ?? getProfile(),
@@ -1758,7 +1783,10 @@ var THEME_ACCENTS = {
   sanctuary: "#a13c4a",
   light: "#3a66a3",
   "sanctuary-light": "#a13c4a",
-  folio: "#9c4a34"
+  folio: "#9c4a34",
+  // Cheer's yellow can't carry the white button text mail uses, so mail
+  // takes the theme's dark ink instead.
+  cheer: "#241c15"
 };
 function accentOf(id) {
   return THEME_ACCENTS[id ?? "default"] ?? THEME_ACCENTS["default"];
@@ -1786,6 +1814,10 @@ var FONTS = {
     stack: "system-ui,-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,'PingFang TC','Noto Sans TC',sans-serif"
   },
   serif: { stack: "Georgia,'Noto Serif TC','Times New Roman',serif" },
+  inter: {
+    stack: "Inter,'PingFang TC','Noto Sans TC',-apple-system,'Segoe UI',sans-serif",
+    google: "Inter:wght@400;600;700"
+  },
   exo2: {
     stack: "'Exo 2','PingFang TC','Noto Sans TC',-apple-system,BlinkMacSystemFont,'Segoe UI',sans-serif",
     google: "Exo+2:wght@400;500;600;700"
@@ -2032,6 +2064,13 @@ function trustedHost(c) {
   const trusted = expected && forwarded && c.req.header("x-share-proxy-key") === expected ? forwarded : void 0;
   return trusted ?? c.req.header("host");
 }
+function isDevHost(c) {
+  const expected = process.env["SHARE_PROXY_KEY"];
+  const forwarded = c.req.header("x-forwarded-host");
+  return Boolean(
+    expected && forwarded?.startsWith("dev-") && c.req.header("x-share-proxy-key") === expected
+  );
+}
 
 // src/dashboard/cors.ts
 function allowedOrigins() {
@@ -2174,8 +2213,8 @@ async function listSetupInvites() {
 
 // src/workspace-slug.ts
 var SLUG_PATTERN = /^[a-z](?:[a-z0-9]|-(?!-))*[a-z0-9]$/;
-var SLUG_MIN = 3;
-var SLUG_MAX = 30;
+var SLUG_MIN = 5;
+var SLUG_MAX = 15;
 var RESERVED = /* @__PURE__ */ new Set([
   // Platform hosts and routes (`app`, `www`, `admin` are also host-profile.ts's RESERVED_LABELS).
   "app",
@@ -2493,6 +2532,7 @@ async function provisionWorkspace(params) {
     );
     throw err;
   }
+  await runWithProfile(params.slug, ensureGeneralChannel).catch((err) => console.error(`[workspace-setup] general channel for ${params.slug} failed:`, err));
   clearKnownWorkspacesCache();
   return workspace;
 }
@@ -2559,7 +2599,6 @@ body { margin:0; }
 @media (min-width:800px) {
   .fs-split { grid-template-columns:minmax(0,5fr) minmax(0,6fr); gap:56px; }
   .fs-split > div + div { border-left:1px solid ${base.line}; padding-left:56px; }
-  .fs-pair { display:grid; grid-template-columns:1fr 1fr; gap:12px; }
 }
 </style>
 </head>
@@ -2603,9 +2642,9 @@ function hostDiagram(display, accent) {
   const agent = (x, title, path, fill) => {
     const unit = 16 + 8 + title.length * 7;
     const start = x + 67 - unit / 2;
-    return `<rect x="${x}" y="182" width="134" height="38" rx="8" fill="${DARK.bg}" stroke="${DARK.line}"/><svg x="${start}" y="193" width="16" height="16" viewBox="0 0 24 24"><path d="${path}" fill="${fill}" fill-rule="evenodd"/></svg><text x="${start + 24}" y="201" dominant-baseline="central" fill="${DARK.ink}" font-size="13" font-weight="600">${title}</text>`;
+    return `<rect x="${x}" y="116" width="134" height="38" rx="8" fill="${DARK.bg}" stroke="${DARK.line}"/><svg x="${start}" y="127" width="16" height="16" viewBox="0 0 24 24"><path d="${path}" fill="${fill}" fill-rule="evenodd"/></svg><text x="${start + 24}" y="135" dominant-baseline="central" fill="${DARK.ink}" font-size="13" font-weight="600">${title}</text>`;
   };
-  return `<svg viewBox="0 0 320 232" width="100%" role="img" aria-labelledby="fs-host-title" style="display:block;max-width:360px;margin:20px 0 0;font-family:${display};"><title id="fs-host-title">The Flyspace Host on your machine connects to your workspace over a WebSocket and runs Claude Code or Codex CLI.</title><defs><marker id="fs-arrow" viewBox="0 0 10 10" refX="8" refY="5" markerWidth="7" markerHeight="7" orient="auto-start-reverse"><path d="M0 0L10 5L0 10z" fill="${accent}"/></marker></defs>` + box(10, "Your Workspace") + arrow(88, 51) + `<text x="172" y="73" fill="${DARK.dim}" font-size="11">WebSocket</text><rect x="8" y="90" width="304" height="136" rx="10" fill="none" stroke="${DARK.dim}" stroke-dasharray="4 4"/><text x="20" y="108" fill="${DARK.dim}" font-size="10" font-weight="600" letter-spacing="0.06em">YOUR MACHINE</text>` + box(116, "Flyspace Host") + arrow(156, 180, 87) + arrow(156, 180, 233) + agent(20, "Claude Code", CLAUDE_PATH, "#D97757") + agent(166, "Codex CLI", CODEX_PATH, DARK.ink) + `</svg>`;
+  return `<svg viewBox="0 0 320 170" width="100%" role="img" aria-labelledby="fs-host-title" style="display:block;max-width:360px;margin:20px 0 0;font-family:${display};"><title id="fs-host-title">The Flyspace Host on your machine connects to your workspace over the Flyspace Socket and runs Claude Code or Codex CLI.</title><defs><marker id="fs-arrow" viewBox="0 0 10 10" refX="8" refY="5" markerWidth="7" markerHeight="7" orient="auto-start-reverse"><path d="M0 0L10 5L0 10z" fill="${accent}"/></marker></defs>` + box(10, "Your Workspace") + arrow(88, 51) + `<text x="172" y="73" fill="${DARK.dim}" font-size="11">Flyspace Socket</text><rect x="8" y="90" width="304" height="74" rx="10" fill="none" stroke="${DARK.dim}" stroke-dasharray="4 4"/><text x="20" y="108" fill="${DARK.dim}" font-size="10" font-weight="600" letter-spacing="0.06em">YOUR MACHINE</text>` + agent(20, "Claude Code", CLAUDE_PATH, "#D97757") + agent(166, "Codex CLI", CODEX_PATH, DARK.ink) + `</svg>`;
 }
 function setupPage(c, token, invite, form = {}) {
   const display = fontOf(void 0).stack;
@@ -2613,7 +2652,7 @@ function setupPage(c, token, invite, form = {}) {
   const host = trustedHost(c) ?? "";
   const suffix = `.${host.replace(/:\d+$/, "").split(".").slice(1).join(".")}`;
   return page(
-    `<div class="fs-split"><div>` + masthead2("Flyspace", FLYSPACE_MARK, display, true) + `<div class="fs-ink" style="font:600 20px/1.3 ${display};color:${DARK.ink};margin-bottom:10px;">Create your workspace</div><p class="fs-ink" style="margin:0 0 8px;font:500 15px/1.5 ${display};color:${DARK.ink};">Welcome to the early access cohort.</p><p class="fs-muted" style="margin:0;font:400 14px/1.6 ${display};color:${DARK.muted};">Your agents run on your own machine. The Flyspace Host connects out to this workspace, so Claude Code or Codex works in each channel's real folder, with your own tools and keys.</p>` + hostDiagram(display, accent) + `</div><div><form id="setup" method="post" action="/auth/new-workspace"><input type="hidden" name="token" value="${escapeHtml(token)}"><div class="fs-dim" style="margin:0 0 14px;font:600 11px/1.4 ${display};letter-spacing:0.06em;text-transform:uppercase;color:${DARK.dim};">Your account</div><label for="username" class="fs-muted" style="display:block;font:400 13px/1.4 ${display};color:${DARK.muted};margin-bottom:4px;">You'll be its Owner, signed in as</label><input id="username" name="username" type="email" autocomplete="username" readonly tabindex="-1" value="${escapeHtml(invite.email)}" style="display:block;width:100%;box-sizing:border-box;border:0;outline:0;background:transparent;padding:0;margin-bottom:20px;font:600 15px/1.4 ${display};color:${DARK.ink};text-overflow:ellipsis;"><div class="fs-pair"><div>` + passwordField("password", "Password", "new-password", display, !!form.passwordError) + `</div><div>` + passwordField("confirm", "Confirm password", "new-password", display, !!form.passwordError) + `</div></div>` + (form.passwordError ? `<p style="margin:-8px 0 16px;font:500 13px/1.5 ${display};color:#d33;">${escapeHtml(form.passwordError)}</p>` : `<p class="fs-dim" style="margin:-8px 0 20px;font:400 12px/1.6 ${display};color:${DARK.dim};">At least ${PASSWORD_MIN} characters. You'll use it to sign in to your workspace.</p>`) + `<div style="border-top:1px solid ${DARK.line};margin:4px 0 24px;"></div><div class="fs-dim" style="margin:0 0 14px;font:600 11px/1.4 ${display};letter-spacing:0.06em;text-transform:uppercase;color:${DARK.dim};">Your workspace</div><label for="name" class="fs-ink" style="display:block;font:600 13px/1.4 ${display};color:${DARK.ink};margin-bottom:6px;">Workspace name</label><input id="name" name="name" required autocomplete="organization" maxlength="${DISPLAY_NAME_MAX}" value="${escapeHtml(form.name ?? "")}" placeholder="My Team" class="fs-card" style="display:block;width:100%;box-sizing:border-box;border:1px solid ${DARK.line};border-radius:8px;padding:12px;outline:0;background:transparent;font:500 15px/1.2 ${display};color:inherit;"><p class="fs-dim" style="margin:8px 0 20px;font:400 12px/1.6 ${display};color:${DARK.dim};">Shown across your workspace. You can change it later.</p><label for="slug" class="fs-ink" style="display:block;font:600 13px/1.4 ${display};color:${DARK.ink};margin-bottom:6px;">Workspace URL</label><div class="fs-card" style="display:flex;align-items:center;border:1px solid ${form.error ? "#d33" : DARK.line};border-radius:8px;padding:0 12px;"><input id="slug" name="slug" required autocomplete="off" autocapitalize="none" spellcheck="false" minlength="${SLUG_MIN}" maxlength="${SLUG_MAX}" pattern="[a-z](?:[a-z0-9]|-(?!-))*[a-z0-9]" value="${escapeHtml(form.slug ?? "")}" placeholder="my-team" style="flex:1;min-width:0;border:0;outline:0;background:transparent;padding:12px 0;font:500 15px/1.2 ${display};color:inherit;"><span class="fs-dim" style="font:400 15px/1 ${display};color:${DARK.dim};white-space:nowrap;">${escapeHtml(suffix)}</span></div>` + (form.error ? `<p style="margin:8px 0 0;font:500 13px/1.5 ${display};color:#d33;">${escapeHtml(form.error)}</p>` : "") + `<p class="fs-dim" style="margin:8px 0 20px;font:400 12px/1.6 ${display};color:${DARK.dim};">Lowercase letters, digits and hyphens, ${SLUG_MIN} to ${SLUG_MAX} characters. <strong style="font-weight:600;color:${DARK.ink};">It can't be changed later.</strong></p><button id="setup-submit" class="fs-btn" type="submit" style="background:${accent};color:${DARK.onAccent};border-radius:8px;padding:13px 24px;width:100%;font:600 15px/1 ${display};">Create workspace</button></form><div style="margin-top:20px;border-left:2px solid ${accent};padding:2px 0 2px 12px;"><p class="fs-muted" style="margin:0;font:400 13px/1.6 ${display};color:${DARK.muted};"><strong class="fs-ink" style="font-weight:600;color:${DARK.ink};">Next:</strong> we'll help you connect Claude Code or Codex CLI.</p></div><p class="fs-dim" style="margin:16px 0 0;font:400 12px/1.6 ${display};color:${DARK.dim};">By creating a workspace, you agree to the <a href="https://flyspace.ai/terms/" target="_blank" rel="noreferrer" style="color:inherit;text-decoration:underline;text-underline-offset:2px;">Terms</a> and <a href="https://flyspace.ai/privacy/" target="_blank" rel="noreferrer" style="color:inherit;text-decoration:underline;text-underline-offset:2px;">Privacy Policy</a>.</p></div></div><script>(()=>{const n=document.getElementById('name'),s=document.getElementById('slug');let touched=!!s.value;s.addEventListener('input',()=>{touched=true});n.addEventListener('input',()=>{if(touched)return;s.value=n.value.normalize('NFKD').toLowerCase().replace(/[^a-z0-9]+/g,'-').replace(/^-+|-+$/g,'').replace(/^[^a-z]+/,'').slice(0,${SLUG_MAX}).replace(/-+$/,'')})})()</script><script>document.getElementById('setup').addEventListener('submit',()=>{const b=document.getElementById('setup-submit');b.disabled=true;b.style.opacity='0.7';b.style.cursor='progress';b.textContent='Creating workspace\u2026'})</script><script>document.querySelectorAll('[data-toggle-password]').forEach(b=>b.addEventListener('click',()=>{const i=document.getElementById(b.dataset.togglePassword),show=i.type==='password';i.type=show?'text':'password';b.setAttribute('aria-pressed',String(show));b.setAttribute('aria-label',show?'Hide password':'Show password');b.querySelector('[data-eye]').style.display=show?'none':'';b.querySelector('[data-eye-off]').style.display=show?'':'none'}))</script>`,
+    `<div class="fs-split"><div>` + masthead2("Flyspace", FLYSPACE_MARK, display, true) + `<div class="fs-ink" style="font:600 20px/1.3 ${display};color:${DARK.ink};margin-bottom:10px;">Create your workspace</div><p class="fs-ink" style="margin:0 0 8px;font:500 15px/1.5 ${display};color:${DARK.ink};">Welcome to the early access cohort.</p><p class="fs-muted" style="margin:0;font:400 14px/1.6 ${display};color:${DARK.muted};">Your agents run on your own machine. The Flyspace Host connects out to this workspace, so Claude Code or Codex works in each channel's real folder, with your own tools and keys.</p>` + hostDiagram(display, accent) + `</div><div><form id="setup" method="post" action="/auth/new-workspace"><input type="hidden" name="token" value="${escapeHtml(token)}"><div class="fs-dim" style="margin:0 0 14px;font:600 11px/1.4 ${display};letter-spacing:0.06em;text-transform:uppercase;color:${DARK.dim};">Your account</div><label for="username" class="fs-muted" style="display:block;font:400 13px/1.4 ${display};color:${DARK.muted};margin-bottom:4px;">You'll be its Owner, signed in as</label><input id="username" name="username" type="email" autocomplete="username" readonly tabindex="-1" value="${escapeHtml(invite.email)}" style="display:block;width:100%;box-sizing:border-box;border:0;outline:0;background:transparent;padding:0;margin-bottom:20px;font:600 15px/1.4 ${display};color:${DARK.ink};text-overflow:ellipsis;"><div style="margin-bottom:14px;">` + passwordField("password", "Password", "new-password", display, !!form.passwordError) + `</div><div>` + passwordField("confirm", "Confirm password", "new-password", display, !!form.passwordError) + `</div>` + (form.passwordError ? `<p style="margin:-8px 0 16px;font:500 13px/1.5 ${display};color:#d33;">${escapeHtml(form.passwordError)}</p>` : `<p class="fs-dim" style="margin:-8px 0 20px;font:400 12px/1.6 ${display};color:${DARK.dim};">At least ${PASSWORD_MIN} characters. You'll use it to sign in to your workspace.</p>`) + `<div style="border-top:1px solid ${DARK.line};margin:4px 0 24px;"></div><div class="fs-dim" style="margin:0 0 14px;font:600 11px/1.4 ${display};letter-spacing:0.06em;text-transform:uppercase;color:${DARK.dim};">Your workspace</div><label for="name" class="fs-ink" style="display:block;font:600 13px/1.4 ${display};color:${DARK.ink};margin-bottom:6px;">Workspace name</label><input id="name" name="name" required autocomplete="organization" maxlength="${DISPLAY_NAME_MAX}" value="${escapeHtml(form.name ?? "")}" placeholder="My Team" class="fs-card" style="display:block;width:100%;box-sizing:border-box;border:1px solid ${DARK.line};border-radius:8px;padding:12px;outline:0;background:transparent;font:500 15px/1.2 ${display};color:inherit;"><p class="fs-dim" style="margin:8px 0 20px;font:400 12px/1.6 ${display};color:${DARK.dim};">Shown across your workspace. You can change it later.</p><label for="slug" class="fs-ink" style="display:block;font:600 13px/1.4 ${display};color:${DARK.ink};margin-bottom:6px;">Workspace URL</label><div class="fs-card" style="display:flex;align-items:center;border:1px solid ${form.error ? "#d33" : DARK.line};border-radius:8px;padding:0 12px;"><input id="slug" name="slug" required autocomplete="off" autocapitalize="none" spellcheck="false" minlength="${SLUG_MIN}" maxlength="${SLUG_MAX}" pattern="[a-z](?:[a-z0-9]|-(?!-))*[a-z0-9]" value="${escapeHtml(form.slug ?? "")}" placeholder="my-team" style="flex:1;min-width:0;border:0;outline:0;background:transparent;padding:12px 0;font:500 15px/1.2 ${display};color:inherit;"><span class="fs-dim" style="font:400 15px/1 ${display};color:${DARK.dim};white-space:nowrap;">${escapeHtml(suffix)}</span></div>` + (form.error ? `<p style="margin:8px 0 0;font:500 13px/1.5 ${display};color:#d33;">${escapeHtml(form.error)}</p>` : "") + `<p class="fs-dim" style="margin:8px 0 20px;font:400 12px/1.6 ${display};color:${DARK.dim};">${SLUG_MIN} to ${SLUG_MAX} lowercase letters, digits or hyphens. <strong style="font-weight:600;color:${DARK.ink};">Can't be changed later.</strong></p><div style="border-top:1px solid ${DARK.line};margin:4px 0 20px;"></div><label class="fs-dim" style="display:flex;align-items:flex-start;gap:10px;margin:0 0 16px;font:400 13px/1.5 ${display};color:${DARK.dim};cursor:pointer;"><input type="checkbox" name="terms" required style="margin:3px 0 0;flex:none;accent-color:${accent};"><span>I agree to the <a href="https://flyspace.ai/terms/" target="_blank" rel="noreferrer" style="color:inherit;text-decoration:underline;text-underline-offset:2px;">Terms</a> and <a href="https://flyspace.ai/privacy/" target="_blank" rel="noreferrer" style="color:inherit;text-decoration:underline;text-underline-offset:2px;">Privacy Policy</a>.</span></label><button id="setup-submit" class="fs-btn" type="submit" style="background:${accent};color:${DARK.onAccent};border-radius:8px;padding:13px 24px;width:100%;font:600 15px/1 ${display};">Create workspace</button></form><div style="margin-top:20px;border-left:2px solid ${accent};padding:2px 0 2px 12px;"><p class="fs-muted" style="margin:0;font:400 13px/1.6 ${display};color:${DARK.muted};"><strong class="fs-ink" style="font-weight:600;color:${DARK.ink};">Next:</strong> we'll help you connect Claude Code or Codex CLI.</p></div></div></div><script>(()=>{const n=document.getElementById('name'),s=document.getElementById('slug');const K='fs-setup-draft';try{const d=JSON.parse(sessionStorage.getItem(K)||'{}');if(!n.value&&d.name)n.value=d.name;if(!s.value&&d.slug)s.value=d.slug}catch(e){}const save=()=>{try{sessionStorage.setItem(K,JSON.stringify({name:n.value,slug:s.value}))}catch(e){}};let touched=!!s.value;s.addEventListener('input',()=>{touched=true});n.addEventListener('input',()=>{if(touched)return;s.value=n.value.normalize('NFKD').toLowerCase().replace(/[^a-z0-9]+/g,'-').replace(/^-+|-+$/g,'').replace(/^[^a-z]+/,'').slice(0,${SLUG_MAX}).replace(/-+$/,'')});n.addEventListener('input',save);s.addEventListener('input',save)})()</script><script>document.getElementById('setup').addEventListener('submit',()=>{const b=document.getElementById('setup-submit');b.disabled=true;b.style.opacity='0.7';b.style.cursor='progress';b.textContent='Creating workspace\u2026'})</script><script>document.querySelectorAll('[data-toggle-password]').forEach(b=>b.addEventListener('click',()=>{const i=document.getElementById(b.dataset.togglePassword),show=i.type==='password';i.type=show?'text':'password';b.setAttribute('aria-pressed',String(show));b.setAttribute('aria-label',show?'Hide password':'Show password');b.querySelector('[data-eye]').style.display=show?'none':'';b.querySelector('[data-eye-off]').style.display=show?'':'none'}))</script>`,
     void 0,
     void 0,
     true,
@@ -2789,7 +2828,11 @@ function createAuthConfirmRouter() {
         invite.email,
         invite.ownerName ? { name: invite.ownerName } : {}
       );
-      const { error: error2 } = await getSupabaseClient().auth.admin.updateUserById(userId, { password });
+      const { error: error2 } = await getSupabaseClient().auth.admin.updateUserById(userId, {
+        password,
+        // The owner just chose one: don't ask again during onboarding.
+        user_metadata: { passwordSetAt: (/* @__PURE__ */ new Date()).toISOString() }
+      });
       if (error2) {
         const weak = error2.code === "weak_password";
         if (!weak) console.error(`[new-workspace] setting the password for ${invite.email} failed:`, error2);
@@ -2849,9 +2892,7 @@ function createAuthConfirmRouter() {
       const fragment = new URLSearchParams({
         access_token: session.accessToken,
         refresh_token: session.refreshToken,
-        type: "magiclink",
-        // AuthCallback lands a fresh owner on the connect-your-agent page.
-        next: "connect"
+        type: "magiclink"
       });
       return c.redirect(`${origin}/auth/callback#${fragment}`, 303);
     } catch (err) {
@@ -2957,8 +2998,8 @@ async function deliverSignInLink(email, redirectTo) {
 // src/dashboard/server.ts
 import { existsSync as existsSync27 } from "fs";
 import { createServer } from "net";
-import { join as join19 } from "path";
-import { Hono as Hono30 } from "hono";
+import { join as join21 } from "path";
+import { Hono as Hono32 } from "hono";
 import { serve } from "@hono/node-server";
 import { serveStatic } from "@hono/node-server/serve-static";
 
@@ -3003,24 +3044,157 @@ async function reconcileAll() {
   return results;
 }
 
+// src/store/channel-members-store.ts
+function rowToChannelMember(row) {
+  return {
+    id: row["id"],
+    channelId: row["channel_id"],
+    membershipId: row["membership_id"],
+    role: row["role"],
+    addedAt: row["added_at"]
+  };
+}
+async function listChannelMembers(channelId) {
+  const { data, error: error2 } = await getSupabaseClient().from("channel_members").select("*").eq("channel_id", channelId).order("added_at", { ascending: true });
+  if (error2) throw new Error(`listChannelMembers(${channelId}): ${error2.message}`);
+  return (data ?? []).map(rowToChannelMember);
+}
+async function upsertChannelMember(params) {
+  const { data, error: error2 } = await getSupabaseClient().from("channel_members").upsert(
+    { channel_id: params.channelId, membership_id: params.membershipId, role: params.role },
+    { onConflict: "channel_id,membership_id" }
+  ).select("*").single();
+  if (error2) {
+    throw new Error(
+      `upsertChannelMember(${params.channelId}, ${params.membershipId}): ${error2.message}`
+    );
+  }
+  return rowToChannelMember(data);
+}
+async function removeChannelMember(channelId, membershipId) {
+  const { data, error: error2 } = await getSupabaseClient().from("channel_members").delete().eq("channel_id", channelId).eq("membership_id", membershipId).select("id");
+  if (error2) throw new Error(`removeChannelMember(${channelId}, ${membershipId}): ${error2.message}`);
+  return data?.length ? true : false;
+}
+
+// src/store/channel-docs-access-store.ts
+var RANK = { none: 0, read: 1, write: 2 };
+function docsAccessAtLeast(have, need) {
+  return RANK[have] >= RANK[need];
+}
+function isDocsGrant(value) {
+  return value === "read" || value === "write";
+}
+function rowToGrant(row) {
+  return {
+    id: row["id"],
+    channelId: row["channel_id"],
+    membershipId: row["membership_id"],
+    access: row["access"],
+    grantedAt: row["granted_at"]
+  };
+}
+async function listChannelDocsAccess(channelId) {
+  const { data, error: error2 } = await getSupabaseClient().from("channel_docs_access").select("*").eq("channel_id", channelId).order("granted_at", { ascending: true });
+  if (error2) throw new Error(`listChannelDocsAccess(${channelId}): ${error2.message}`);
+  return (data ?? []).map(rowToGrant);
+}
+async function getChannelDocsGrant(channelId, membershipId) {
+  const { data, error: error2 } = await getSupabaseClient().from("channel_docs_access").select("*").eq("channel_id", channelId).eq("membership_id", membershipId).maybeSingle();
+  if (error2) throw new Error(`getChannelDocsGrant(${channelId}, ${membershipId}): ${error2.message}`);
+  return data ? rowToGrant(data) : null;
+}
+async function upsertChannelDocsAccess(params) {
+  const { data, error: error2 } = await getSupabaseClient().from("channel_docs_access").upsert(
+    { channel_id: params.channelId, membership_id: params.membershipId, access: params.access },
+    { onConflict: "channel_id,membership_id" }
+  ).select("*").single();
+  if (error2) {
+    throw new Error(
+      `upsertChannelDocsAccess(${params.channelId}, ${params.membershipId}): ${error2.message}`
+    );
+  }
+  return rowToGrant(data);
+}
+async function removeChannelDocsAccess(channelId, membershipId) {
+  const { data, error: error2 } = await getSupabaseClient().from("channel_docs_access").delete().eq("channel_id", channelId).eq("membership_id", membershipId).select("id");
+  if (error2) {
+    throw new Error(`removeChannelDocsAccess(${channelId}, ${membershipId}): ${error2.message}`);
+  }
+  return data?.length ? true : false;
+}
+async function resolveForMembership(membership, channelId) {
+  if (membership.role === "admin") return "write";
+  const members = await listChannelMembers(channelId);
+  if (members.some((m) => m.membershipId === membership.id && m.role === "channel_admin")) {
+    return "write";
+  }
+  const grant = await getChannelDocsGrant(channelId, membership.id);
+  return grant?.access ?? "none";
+}
+async function resolveDocsAccess(ctx, channelId) {
+  if (ctx.role === "admin") return "write";
+  const membership = await getMembershipByUserId(ctx.workspaceId, ctx.userId);
+  if (!membership) return "none";
+  return resolveForMembership(membership, channelId);
+}
+async function resolveDocsAccessByHandle(workspaceSlug, handle, channelId) {
+  const workspace = await getWorkspaceBySlug(workspaceSlug);
+  if (!workspace) return null;
+  const wanted = handle.toLowerCase();
+  const membership = (await listMemberships(workspace.id)).find(
+    (m) => m.handle.toLowerCase() === wanted
+  );
+  if (!membership) return "none";
+  return resolveForMembership(membership, channelId);
+}
+async function filterReadableDocsChannels(ctx, channelIds) {
+  if (ctx.role === "admin") return new Set(channelIds);
+  const membership = await getMembershipByUserId(ctx.workspaceId, ctx.userId);
+  if (!membership) return /* @__PURE__ */ new Set();
+  const db = getSupabaseClient();
+  const [grants, roles] = await Promise.all([
+    db.from("channel_docs_access").select("channel_id").eq("membership_id", membership.id),
+    db.from("channel_members").select("channel_id, role").eq("membership_id", membership.id)
+  ]);
+  if (grants.error) throw new Error(`filterReadableDocsChannels: ${grants.error.message}`);
+  if (roles.error) throw new Error(`filterReadableDocsChannels: ${roles.error.message}`);
+  const allowed = /* @__PURE__ */ new Set();
+  for (const r of grants.data ?? []) allowed.add(r.channel_id);
+  for (const r of roles.data ?? []) {
+    if (r.role === "channel_admin") allowed.add(r.channel_id);
+  }
+  return new Set(channelIds.filter((id) => allowed.has(id)));
+}
+
+// src/dashboard/docs-access-gate.ts
+var requireDocsAccess = async (c, next) => {
+  const auth = c.get("auth");
+  const need = c.req.method === "GET" ? "read" : "write";
+  const have = auth ? await resolveDocsAccess(auth, c.req.param("id") ?? "") : "none";
+  if (!docsAccessAtLeast(have, need)) return c.json({ error: "docs access required" }, 403);
+  await next();
+};
+
 // src/dashboard/api.ts
-import { Hono as Hono27 } from "hono";
+import { Hono as Hono29 } from "hono";
 
 // src/dashboard/public-share-routes.ts
 import { existsSync as existsSync11, readFileSync as readFileSync6, statSync as statSync2 } from "fs";
-import { join as join8 } from "path";
+import { join as join9 } from "path";
 import { Hono as Hono3 } from "hono";
 import { GetObjectCommand } from "@aws-sdk/client-s3";
 import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
 
 // src/store/doc-share-store.ts
 function rowToKind(value) {
-  return value === "html" ? "html" : "markdown";
+  return value === "html" || value === "excalidraw" ? value : "markdown";
 }
 function rowToShare(row) {
   return {
     id: row["id"],
     slug: row["slug"] ?? null,
+    tags: Array.isArray(row["tags"]) ? row["tags"] : [],
     workspaceId: row["workspace_id"],
     profile: row["profile"],
     channelId: row["channel_id"],
@@ -3087,11 +3261,12 @@ async function setDocShareSlug(id, slug) {
   if (error2) throw new Error(`setDocShareSlug(${id}): ${error2.message}`);
   return data ? rowToShare(data) : null;
 }
-var SUMMARY_COLUMNS = "id, slug, profile, channel_id, source_path, title, kind, created_by, created_at, updated_at, audio_enabled, ask_enabled, social_enabled, branding_enabled, translation_enabled, translation_langs, audio_status";
+var SUMMARY_COLUMNS = "id, slug, tags, profile, channel_id, source_path, title, kind, created_by, created_at, updated_at, audio_enabled, ask_enabled, social_enabled, branding_enabled, translation_enabled, translation_langs, audio_status";
 function rowToSummary(row) {
   return {
     id: row["id"],
     slug: row["slug"] ?? null,
+    tags: Array.isArray(row["tags"]) ? row["tags"] : [],
     profile: row["profile"],
     channelId: row["channel_id"],
     sourcePath: row["source_path"],
@@ -3166,6 +3341,11 @@ async function updateDocShareSnapshot(id, snapshot2, features) {
   if (error2) throw new Error(`updateDocShareSnapshot(${id}): ${error2.message}`);
   return rowToShare(data);
 }
+async function setDocShareTags(id, tags) {
+  const { data, error: error2 } = await getSupabaseClient().from("doc_shares").update({ tags }).eq("id", id).is("revoked_at", null).select("*").maybeSingle();
+  if (error2) throw new Error(`setDocShareTags(${id}): ${error2.message}`);
+  return data ? rowToShare(data) : null;
+}
 async function updateDocShareFeatures(id, features) {
   const { data, error: error2 } = await getSupabaseClient().from("doc_shares").update({
     ...features.audioEnabled !== void 0 ? { audio_enabled: features.audioEnabled } : {},
@@ -3467,11 +3647,11 @@ function injectShareHead(html, head) {
 // src/dashboard/app-icon.ts
 import { createHash as createHash2 } from "crypto";
 import { readFileSync as readFileSync5 } from "fs";
-import { join as join7 } from "path";
+import { join as join8 } from "path";
 import sharp from "sharp";
 var PLATE = "#0A0A0F";
-var MARK_FILE = join7(paths.PACKAGE_ROOT, "web", "public", "icons", "icon-512.png");
-var MARK_SVG_FILE = join7(paths.PACKAGE_ROOT, "web", "public", "favicon.svg");
+var MARK_FILE = join8(paths.PACKAGE_ROOT, "web", "public", "icons", "icon-512.png");
+var MARK_SVG_FILE = join8(paths.PACKAGE_ROOT, "web", "public", "favicon.svg");
 var LAYOUT = {
   standard: { logo: 0.7, logoCx: 0.5, logoCy: 0.48, badge: 0.27, badgeCx: 0.22, badgeCy: 0.76 },
   maskable: { logo: 0.56, logoCx: 0.5, logoCy: 0.48, badge: 0.23, badgeCx: 0.33, badgeCy: 0.66 }
@@ -4636,6 +4816,9 @@ function shareLangAudio(share, lang, audio) {
     truncated: isArticleTruncated(share.content)
   };
 }
+function shareDescription(share, shown) {
+  return share.kind === "excalidraw" ? "" : excerptFromMarkdown(shown.content, shown.title);
+}
 function createPublicShareApiRouter() {
   const app = new Hono3();
   app.get("/:id", async (c) => {
@@ -4784,7 +4967,7 @@ function serveBuildFile(c, webDist, dir, name) {
   if (!type || !/^[A-Za-z0-9._-]+$/.test(name) || name.includes("..")) {
     return c.text("not found", 404);
   }
-  const path = join8(webDist, dir, name);
+  const path = join9(webDist, dir, name);
   if (!existsSync11(path)) return c.text("not found", 404);
   c.header("Content-Type", type);
   c.header("Cache-Control", "public, max-age=31536000, immutable");
@@ -4812,7 +4995,7 @@ function createPublicShareAssetRouter(webDist) {
     const workspace = await workspaceOf(share);
     const png = await renderShareOgImage({
       title: shown.title,
-      description: excerptFromMarkdown(shown.content, shown.title),
+      description: shareDescription(share, shown),
       // Branding off drops the card's header row too. An unfurl in Slack or on
       // LinkedIn is the first thing a reader sees, so a page that doesn't sign
       // itself and a card that does would be the same contradiction the flag
@@ -4876,7 +5059,7 @@ function createPublicShareAssetRouter(webDist) {
     const id = c.req.param("file").replace(/\.md$/, "");
     const share = await getDocShare(id);
     if (!share) return c.json({ error: "not found" }, 404);
-    if (share.kind === "html") return c.json({ error: "not found" }, 404);
+    if (share.kind !== "markdown") return c.json({ error: "not found" }, 404);
     c.header("Content-Type", "text/markdown; charset=utf-8");
     c.header("Content-Disposition", "inline");
     c.header("Cache-Control", "no-store");
@@ -4890,7 +5073,7 @@ function createPublicShareAssetRouter(webDist) {
     const writtenIn = opts.noindex ? share.sourceLang : opts.lang ?? share.sourceLang;
     const head = buildShareHead({
       title: shown.title,
-      description: excerptFromMarkdown(shown.content, shown.title),
+      description: shareDescription(share, shown),
       workspaceName: publisher,
       pageUrl: opts.lang ? `${base}/${opts.lang}` : base,
       // The card follows the page's language where there is one to follow (see
@@ -4912,11 +5095,9 @@ function createPublicShareAssetRouter(webDist) {
       workspaceName: publisher,
       published: formatPublished(share.updatedAt) || void 0
     });
-    let html = injectShareBody(
-      injectShareHead(readShell(shell), analytics ? `${head}
-${analytics}` : head),
-      body
-    );
+    const headed = injectShareHead(readShell(shell), analytics ? `${head}
+${analytics}` : head);
+    let html = share.kind === "excalidraw" ? headed : injectShareBody(headed, body);
     if (writtenIn) html = setHtmlLang(html, writtenIn);
     c.header("Content-Type", "text/html; charset=utf-8");
     c.header("Cache-Control", "no-store");
@@ -4926,7 +5107,7 @@ ${analytics}` : head),
     const requested = c.req.param("lang");
     const lang = canonicalLanguage(requested);
     if (!isTranslatableLanguage(lang)) return next();
-    const shell = join8(webDist, "index.html");
+    const shell = join9(webDist, "index.html");
     if (!existsSync11(shell)) return next();
     const share = await getDocShare(c.req.param("id"));
     if (!share) return next();
@@ -4962,7 +5143,7 @@ ${analytics}` : head),
     const share = await getDocShare(c.req.param("id"));
     if (!share) return next();
     if (share.kind === "html") return servePublishedHtml(c, share);
-    const shell = join8(webDist, "index.html");
+    const shell = join9(webDist, "index.html");
     if (!existsSync11(shell)) return next();
     return readerPage(
       c,
@@ -5033,6 +5214,48 @@ import { Hono as Hono5 } from "hono";
 
 // src/dashboard/supabase-server-client.ts
 import { createServerClient, parseCookieHeader, serializeCookieHeader } from "@supabase/ssr";
+
+// src/dashboard/scoped-auth-cookies.ts
+import { stringFromBase64URL } from "@supabase/ssr";
+var SESSION_NAME = /^(sb-.+-auth-token)(?:\.\d+)?$/;
+var SCOPE_MARK = "fsw_";
+var SCOPE_END = "__";
+function hostLabel(host) {
+  return host.toLowerCase().replace(/:\d+$/, "").replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
+}
+var scopePrefix = (label2) => `${SCOPE_MARK}${label2}${SCOPE_END}`;
+function sessionUserId(cookies) {
+  const base = cookies.map((c) => SESSION_NAME.exec(c.name)?.[1]).find(Boolean);
+  if (!base) return null;
+  const whole = cookies.find((c) => c.name === base)?.value;
+  const raw = whole ?? cookies.filter((c) => c.name.startsWith(`${base}.`)).sort((a, b) => Number(a.name.split(".").pop()) - Number(b.name.split(".").pop())).map((c) => c.value).join("");
+  if (!raw) return null;
+  try {
+    const json = raw.startsWith("base64-") ? stringFromBase64URL(raw.slice(7)) : raw;
+    const id = JSON.parse(json).user?.id;
+    return typeof id === "string" ? id : null;
+  } catch {
+    return null;
+  }
+}
+var isScoped = (name) => name.startsWith(SCOPE_MARK);
+function readScopedCookies(all, label2) {
+  const prefix = scopePrefix(label2);
+  const own = all.filter((c) => c.name.startsWith(prefix)).map((c) => ({ name: c.name.slice(prefix.length), value: c.value }));
+  return own.length ? own : all.filter((c) => !isScoped(c.name));
+}
+function routeCookieWrites(all, label2, writes) {
+  const prefix = scopePrefix(label2);
+  const hasOwn = all.some((c) => c.name.startsWith(prefix));
+  const incoming = sessionUserId(writes.filter((c) => c.value !== ""));
+  const shared = sessionUserId(all.filter((c) => !isScoped(c.name)));
+  const toScoped = hasOwn || incoming !== null && shared !== null && incoming !== shared;
+  return writes.map(
+    (c) => toScoped ? { name: prefix + c.name, value: c.value, scoped: true } : { ...c, scoped: false }
+  );
+}
+
+// src/dashboard/supabase-server-client.ts
 var REQUEST_TIMEOUT_MS = 5e3;
 function fetchWithTimeout(input2, init) {
   return fetch(input2, { ...init, signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS) });
@@ -5043,26 +5266,34 @@ function createRequestSupabaseClient(c) {
   if (!url || !key) {
     throw new Error("SUPABASE_URL / VITE_SUPABASE_PUBLISHABLE_KEY not set \u2014 check .env");
   }
+  const origin = c.req.header("Origin");
+  const label2 = hostLabel(
+    (origin ? URL.parse(origin)?.host : void 0) ?? c.req.header("X-Forwarded-Host") ?? c.req.header("Host") ?? ""
+  );
+  const rawCookies = () => parseCookieHeader(c.req.header("Cookie") ?? "").map(({ name, value }) => ({
+    name,
+    value: value ?? ""
+  }));
   return createServerClient(url, key, {
     global: { fetch: fetchWithTimeout },
     cookies: {
       // `parseCookieHeader` types `value` as optional; the client requires a
       // string, and a valueless cookie is the same as an empty one here.
-      getAll: () => parseCookieHeader(c.req.header("Cookie") ?? "").map(({ name, value }) => ({
-        name,
-        value: value ?? ""
-      })),
+      getAll: () => readScopedCookies(rawCookies(), label2),
       setAll: (cookies) => {
         const domain = process.env["AUTH_COOKIE_DOMAIN"]?.trim();
         const overrides = {
           ...domain ? { domain } : {},
           ...crossOriginShell(c) ? { sameSite: "none", secure: true } : {}
         };
-        for (const { name, value, options } of cookies) {
-          c.header("Set-Cookie", serializeCookieHeader(name, value, { ...options, ...overrides }), {
+        const routed = routeCookieWrites(rawCookies(), label2, cookies);
+        cookies.forEach(({ options }, i) => {
+          const { name, value, scoped } = routed[i];
+          const { domain: _domain, ...rest } = overrides;
+          c.header("Set-Cookie", serializeCookieHeader(name, value, { ...options, ...scoped ? rest : overrides }), {
             append: true
           });
-        }
+        });
       }
     }
   });
@@ -5071,6 +5302,14 @@ function createRequestSupabaseClient(c) {
 // src/dashboard/auth-context.ts
 import { HTTPException } from "hono/http-exception";
 import { isAuthApiError, isAuthRetryableFetchError } from "@supabase/supabase-js";
+function onboardingPending(ctx) {
+  const pending3 = [];
+  if (!ctx.onboarded && !ctx.passwordSet) pending3.push("account");
+  if (!ctx.onboarded) pending3.push("profile");
+  if (ctx.role === "admin" && !ctx.agentConnectedAt) pending3.push("agent");
+  if (ctx.role === "admin" && !ctx.projectsSetupAt) pending3.push("projects");
+  return pending3;
+}
 var inFlight3 = /* @__PURE__ */ new Map();
 var CACHE_TTL_MS = 3e4;
 var resolved = /* @__PURE__ */ new Map();
@@ -5082,12 +5321,13 @@ function pruneExpired(now) {
     if (entry.expires <= now) resolved.delete(key);
   }
 }
-async function resolveAuthContext(c) {
+async function resolveAuthContext(c, opts = {}) {
   const cookie = c.req?.header("Cookie") ?? "";
   if (!cookie) return resolveAuthContextUncached(c);
   const key = `${getProfile()}\0${cookie}`;
   const now = Date.now();
   pruneExpired(now);
+  if (opts.fresh) resolved.delete(key);
   const cached = resolved.get(key);
   if (cached) return cached.value;
   const inflight = inFlight3.get(key);
@@ -5142,7 +5382,9 @@ async function resolveAuthContextUncached(c) {
     name: metadata.name,
     avatarKey: metadata.avatarKey,
     onboarded: Boolean(metadata.onboardedAt),
-    agentConnectedAt: workspace.agentConnectedAt ?? null
+    passwordSet: Boolean(metadata.passwordSetAt),
+    agentConnectedAt: workspace.agentConnectedAt ?? null,
+    projectsSetupAt: workspace.projectsSetupAt ?? null
   };
 }
 
@@ -5213,7 +5455,7 @@ function createAuthRouter() {
     const body = await c.req.json().catch(() => ({}));
     const email = body.email?.trim().toLowerCase();
     if (!email) return c.json({ error: "email is required" }, 400);
-    if (!await verifyTurnstileToken(body.captchaToken)) {
+    if (!isDevHost(c) && !await verifyTurnstileToken(body.captchaToken)) {
       return c.json({ error: "captcha check failed \u2014 please retry" }, 400);
     }
     const workspace = await getWorkspaceBySlug(getProfile());
@@ -5230,7 +5472,7 @@ function createAuthRouter() {
     return c.json({ sent: true });
   });
   auth.get("/session", async (c) => {
-    const ctx = await resolveAuthContext(c);
+    const ctx = await resolveAuthContext(c, { fresh: c.req.query("fresh") === "1" });
     if (!ctx) return c.json({ error: "not signed in" }, 401);
     return c.json({
       email: ctx.email,
@@ -5239,9 +5481,31 @@ function createAuthRouter() {
       name: ctx.name,
       avatarUrl: ctx.avatarKey ? await signAvatarUrl(ctx.avatarKey) : null,
       onboarded: ctx.onboarded,
-      agentConnectedAt: ctx.agentConnectedAt
+      passwordSet: ctx.passwordSet,
+      agentConnectedAt: ctx.agentConnectedAt,
+      onboarding: { pending: onboardingPending(ctx) }
     });
   });
+  auth.patch("/handle", async (c) => {
+    const ctx = await resolveAuthContext(c);
+    if (!ctx) return c.json({ error: "not signed in" }, 401);
+    if (ctx.onboarded) return c.json({ error: "handle can no longer be changed" }, 403);
+    const body = await c.req.json().catch(() => ({}));
+    const handle = body.handle?.trim().replace(/^@/, "").toLowerCase() ?? "";
+    if (!HANDLE_PATTERN.test(handle)) {
+      return c.json(
+        { error: "handle must be 1-32 characters: a-z, 0-9, _ or -, starting with a letter or digit" },
+        400
+      );
+    }
+    try {
+      await setMembershipHandle(ctx.workspaceId, ctx.userId, handle);
+    } catch (err) {
+      if (err instanceof HandleTakenError) return c.json({ error: err.message }, 409);
+      throw err;
+    }
+    return c.json({ handle });
+  });
   auth.post("/logout", async (c) => {
     const supabase = createRequestSupabaseClient(c);
     await supabase.auth.signOut();
@@ -5408,6 +5672,9 @@ function createAdminRouter() {
     const proto = c.req.header("x-forwarded-proto") ?? "http";
     const inviteUrl = new URL(`${proto}://${trustedHost(c)}/auth/new-workspace`);
     inviteUrl.searchParams.set("token", token);
+    if (body.sendEmail === false) {
+      return c.json({ email: ownerEmail, inviteLink: inviteUrl.toString() }, 201);
+    }
     try {
       await deliverWorkspaceSetupInvite({
         email: ownerEmail,
@@ -5425,7 +5692,7 @@ function createAdminRouter() {
         500
       );
     }
-    return c.json({ email: ownerEmail }, 201);
+    return c.json({ email: ownerEmail, inviteLink: inviteUrl.toString() }, 201);
   });
   admin.delete("/setup-invites/:id", async (c) => {
     await revokeSetupInvite(c.req.param("id"));
@@ -5443,6 +5710,9 @@ function createAdminRouter() {
     const proto = c.req.header("x-forwarded-proto") ?? "http";
     const inviteUrl = new URL(`${proto}://${trustedHost(c)}/auth/new-workspace`);
     inviteUrl.searchParams.set("token", token);
+    if (c.req.query("email") === "false") {
+      return c.json({ sent: false, inviteLink: inviteUrl.toString() });
+    }
     try {
       await deliverWorkspaceSetupInvite({
         email: invite.email,
@@ -5458,19 +5728,119 @@ function createAdminRouter() {
         500
       );
     }
-    return c.json({ sent: true });
+    return c.json({ sent: true, inviteLink: inviteUrl.toString() });
   });
   return admin;
 }
 
 // src/dashboard/host-api.ts
 import { existsSync as existsSync20, readFileSync as readFileSync10, statSync as statSync7 } from "fs";
-import { join as join15 } from "path";
+import { join as join16 } from "path";
 import sharp3 from "sharp";
 
 // src/dashboard/channels-routes.ts
 import { existsSync as existsSync12, mkdirSync as mkdirSync4 } from "fs";
+import { Hono as Hono9 } from "hono";
+
+// src/dashboard/feature-flags-routes.ts
 import { Hono as Hono8 } from "hono";
+
+// src/feature-flags.ts
+var featureFlags = {
+  "ai-cost": {
+    title: "AI cost",
+    description: "Shows admins what the agent has spent: a Cost section in a channel's AI overview and a per-thread cost in the thread menu. Estimated at API list rates, so on a Claude subscription it will not match your bill.",
+    stage: "beta"
+  },
+  "read-aloud": {
+    title: "Read aloud",
+    description: "Listen to messages, threads and docs as audio. Still rough in places, and each playback uses text-to-speech.",
+    stage: "beta"
+  },
+  excalidraw: {
+    title: "Excalidraw",
+    description: "Create and edit whiteboard drawings (.excalidraw files) in the Docs pane. Existing drawings stay viewable with this off.",
+    stage: "beta"
+  },
+  sandbox: {
+    title: "Sandbox runtime",
+    description: "Run a channel agent in an isolated sandbox without Docker. Channels already on Sandbox keep working with this off.",
+    stage: "beta"
+  },
+  dictation: {
+    title: "Dictation",
+    description: "A mic button in the message composer that turns speech into text as you talk. Each phrase uses speech-to-text.",
+    stage: "dev"
+  }
+};
+var featureFlagIds = Object.keys(featureFlags);
+function isFeatureFlagId(id) {
+  return Object.hasOwn(featureFlags, id);
+}
+function isFeatureVisible(stage, devHost) {
+  return stage === "beta" || stage === "dev" && devHost;
+}
+function resolveFeatureFlags(enabledIds, devHost) {
+  const enabled = new Set(enabledIds);
+  const out = {};
+  for (const id of featureFlagIds) {
+    const stage = featureFlags[id].stage;
+    out[id] = stage === "ga" || isFeatureVisible(stage, devHost) && enabled.has(id);
+  }
+  return out;
+}
+
+// src/store/feature-flag-store.ts
+async function listEnabledFeatureFlags(workspaceId) {
+  const { data, error: error2 } = await getSupabaseClient().from("feature_flags").select("flag_id").eq("workspace_id", workspaceId);
+  if (error2) throw new Error(`listEnabledFeatureFlags(${workspaceId}): ${error2.message}`);
+  return (data ?? []).map((r) => r.flag_id);
+}
+async function enableFeatureFlag(workspaceId, flagId, userId) {
+  const { error: error2 } = await getSupabaseClient().from("feature_flags").upsert(
+    { workspace_id: workspaceId, flag_id: flagId, enabled_by: userId },
+    { onConflict: "workspace_id,flag_id" }
+  );
+  if (error2) throw new Error(`enableFeatureFlag(${workspaceId}, ${flagId}): ${error2.message}`);
+}
+async function disableFeatureFlag(workspaceId, flagId) {
+  const { error: error2 } = await getSupabaseClient().from("feature_flags").delete().eq("workspace_id", workspaceId).eq("flag_id", flagId);
+  if (error2) throw new Error(`disableFeatureFlag(${workspaceId}, ${flagId}): ${error2.message}`);
+}
+
+// src/dashboard/feature-flags-routes.ts
+async function isFeatureEnabled(c, flagId) {
+  const auth = c.get("auth");
+  const enabled = await listEnabledFeatureFlags(auth.workspaceId);
+  return resolveFeatureFlags(enabled, isDevHost(c))[flagId];
+}
+function createFeatureFlagsRouter() {
+  const app = new Hono8();
+  app.get("/", async (c) => {
+    const auth = c.get("auth");
+    const devHost = isDevHost(c);
+    const flags = resolveFeatureFlags(await listEnabledFeatureFlags(auth.workspaceId), devHost);
+    const labs = featureFlagIds.filter((id) => isFeatureVisible(featureFlags[id].stage, devHost)).map((id) => ({ id, ...featureFlags[id], enabled: flags[id] }));
+    return c.json({ flags, labs });
+  });
+  const toggle = async (c, enabled) => {
+    const auth = c.get("auth");
+    if (auth.role !== "admin") return c.json({ error: "admin access required" }, 403);
+    const flagId = c.req.param("flagId") ?? "";
+    if (!isFeatureFlagId(flagId)) return c.json({ error: "unknown feature flag" }, 404);
+    if (!isFeatureVisible(featureFlags[flagId].stage, isDevHost(c))) {
+      return c.json({ error: "this feature flag cannot be changed here" }, 403);
+    }
+    if (enabled) await enableFeatureFlag(auth.workspaceId, flagId, auth.userId);
+    else await disableFeatureFlag(auth.workspaceId, flagId);
+    return c.json({ id: flagId, enabled });
+  };
+  app.put("/:flagId", (c) => toggle(c, true));
+  app.delete("/:flagId", (c) => toggle(c, false));
+  return app;
+}
+
+// src/dashboard/channels-routes.ts
 function coerceAccess(raw) {
   if (raw === "open" || raw === "*" || raw === "all") return raw;
   if (Array.isArray(raw) && raw.every((v) => typeof v === "string")) return raw;
@@ -5506,7 +5876,7 @@ function coerceMemberEmails(raw) {
   return raw.filter((v) => typeof v === "string").map((v) => v.trim().toLowerCase()).filter(Boolean);
 }
 function ensureCwdDir(cwd) {
-  const expanded = expandPath(cwd);
+  const expanded = isLogicalCwd(cwd) ? resolveLogicalCwd(cwd) : expandPath(cwd);
   if (!existsSync12(expanded)) mkdirSync4(expanded, { recursive: true });
 }
 function toResponse(channel) {
@@ -5526,11 +5896,13 @@ function toResponse(channel) {
     runtime: channel.runtime,
     mounts: channel.mounts,
     agentName: channel.agentName,
+    dmKey: channel.dmKey,
+    isDefault: channel.isDefault,
     archived: !!channel.archivedAt
   };
 }
 function createChannelWriteRouter() {
-  const app = new Hono8();
+  const app = new Hono9();
   app.post("/", async (c) => {
     const body = await c.req.json().catch(() => ({}));
     const name = typeof body["name"] === "string" ? body["name"].trim() : "";
@@ -5558,7 +5930,7 @@ function createChannelWriteRouter() {
       });
       return c.json(toResponse(channel), 201);
     } catch (err) {
-      return c.json({ error: err.message }, 500);
+      return c.json({ error: err.message }, err instanceof DefaultChannelError ? 400 : 500);
     }
   });
   app.put("/:id", async (c) => {
@@ -5569,6 +5941,8 @@ function createChannelWriteRouter() {
     const cwd = typeof body["cwd"] === "string" ? body["cwd"].trim() : "";
     if (!cwd) return c.json({ errors: ["cwd is required"] }, 400);
     const model = typeof body["model"] === "string" ? body["model"].trim() : "";
+    if (coerceRuntime(body["runtime"]) === "sandbox" && existing.runtime !== "sandbox" && !await isFeatureEnabled(c, "sandbox"))
+      return c.json({ error: "feature not enabled" }, 403);
     try {
       ensureCwdDir(cwd);
       const channel = await updateChannelById(id, {
@@ -5586,7 +5960,7 @@ function createChannelWriteRouter() {
       dropSessionsIfRuntimeChanged(id, existing.runtime, channel.runtime);
       return c.json(toResponse(channel), 200);
     } catch (err) {
-      return c.json({ error: err.message }, 500);
+      return c.json({ error: err.message }, err instanceof DefaultChannelError ? 400 : 500);
     }
   });
   app.patch("/reorder", async (c) => {
@@ -5629,6 +6003,8 @@ function createChannelWriteRouter() {
     if ("memberEmails" in body) patch.memberEmails = coerceMemberEmails(body["memberEmails"]);
     if ("runtime" in body) {
       const r = coerceRuntime(body["runtime"]);
+      if (r === "sandbox" && existing.runtime !== "sandbox" && !await isFeatureEnabled(c, "sandbox"))
+        return c.json({ error: "feature not enabled" }, 403);
       if (r) patch.runtime = r;
     }
     if ("mounts" in body) patch.mounts = coerceMounts(body["mounts"]);
@@ -5641,7 +6017,7 @@ function createChannelWriteRouter() {
       dropSessionsIfRuntimeChanged(id, existing.runtime, channel.runtime);
       return c.json(toResponse(channel), 200);
     } catch (err) {
-      return c.json({ error: err.message }, 500);
+      return c.json({ error: err.message }, err instanceof DefaultChannelError ? 400 : 500);
     }
   });
   return app;
@@ -5663,13 +6039,13 @@ import {
   statSync as statSync4,
   writeFileSync as writeFileSync6
 } from "fs";
-import { basename as basename4, dirname as dirname3, extname, join as join13, relative, resolve as resolve4, sep } from "path";
-import { Hono as Hono9 } from "hono";
+import { basename as basename4, dirname as dirname3, extname, join as join14, relative, resolve as resolve4, sep } from "path";
+import { Hono as Hono10 } from "hono";
 import { streamSSE } from "hono/streaming";
 
 // src/dashboard/docs-watcher.ts
 import { existsSync as existsSync13, watch } from "fs";
-import { basename as basename2, join as join9 } from "path";
+import { basename as basename2, join as join10 } from "path";
 var DEBOUNCE_MS = 200;
 var MAX_PENDING = 200;
 var IGNORED_SEGMENTS = /* @__PURE__ */ new Set([
@@ -5710,7 +6086,7 @@ function watchDocs(cwd, listener) {
       const current = entries.get(cwd);
       if (!current || filename === null) return;
       const rel = filename.split("\\").join("/");
-      if (rel === root && !existsSync13(join9(cwd, rel))) return;
+      if (rel === root && !existsSync13(join10(cwd, rel))) return;
       if (isIgnoredDocPath(rel)) return;
       if (current.pending.size < MAX_PENDING) current.pending.add(rel);
       if (current.timer === null) current.timer = setTimeout(() => flush(cwd), DEBOUNCE_MS);
@@ -5950,12 +6326,12 @@ async function readOrQueueDocAudio(input2) {
 import { readFileSync as readFileSync8 } from "fs";
 
 // src/dashboard/chat-agent.ts
-import { homedir as homedir5 } from "os";
+import { homedir as homedir6 } from "os";
 
 // src/mcp/config.ts
 import { mkdtempSync, rmSync as rmSync2, writeFileSync as writeFileSync5 } from "fs";
 import { tmpdir } from "os";
-import { join as join10 } from "path";
+import { join as join11 } from "path";
 
 // src/mcp/crypto.ts
 import { createCipheriv, createDecipheriv, randomBytes as randomBytes3, timingSafeEqual } from "crypto";
@@ -6641,8 +7017,8 @@ async function buildMcpConfig(profile, connectionIds) {
   return { config, skipped };
 }
 function writeMcpConfigFile(config) {
-  const dir = mkdtempSync(join10(tmpdir(), "flyspace-mcp-"));
-  const path = join10(dir, "mcp-config.json");
+  const dir = mkdtempSync(join11(tmpdir(), "flyspace-mcp-"));
+  const path = join11(dir, "mcp-config.json");
   writeFileSync5(path, JSON.stringify(config), { mode: 384 });
   return {
     path,
@@ -6664,15 +7040,15 @@ async function withMcpConfig(profile, connectionIds, fn) {
 
 // src/claude/agents.ts
 import { existsSync as existsSync14, readdirSync as readdirSync2, readFileSync as readFileSync7 } from "fs";
-import { homedir as homedir4 } from "os";
-import { basename as basename3, join as join11 } from "path";
+import { homedir as homedir5 } from "os";
+import { basename as basename3, join as join12 } from "path";
 import yaml from "js-yaml";
 function defaultConfigDir() {
-  return join11(homedir4(), ".claude");
+  return join12(homedir5(), ".claude");
 }
 function expandHome(p) {
-  if (p === "~") return homedir4();
-  if (p.startsWith("~/")) return join11(homedir4(), p.slice(2));
+  if (p === "~") return homedir5();
+  if (p.startsWith("~/")) return join12(homedir5(), p.slice(2));
   return p;
 }
 function parseFrontmatter(file) {
@@ -6702,7 +7078,7 @@ function collectFrom(root, source) {
     return [];
   }
   return entries2.map((file) => {
-    const path = join11(root, file);
+    const path = join12(root, file);
     const fm = parseFrontmatter(path);
     const name = fm.name?.trim() || basename3(file, ".md");
     return { name, description: (fm.description ?? "").trim(), source, path };
@@ -6711,8 +7087,8 @@ function collectFrom(root, source) {
 function listAgents(configDir2, cwd) {
   const base = configDir2 ? expandHome(configDir2) : defaultConfigDir();
   const collected = [
-    ...collectFrom(join11(cwd, ".claude", "agents"), "project"),
-    ...collectFrom(join11(base, "agents"), "user")
+    ...collectFrom(join12(cwd, ".claude", "agents"), "project"),
+    ...collectFrom(join12(base, "agents"), "user")
   ];
   const byName = /* @__PURE__ */ new Map();
   for (const agent of collected) {
@@ -6952,9 +7328,54 @@ ${incoming}`;
   }
 }
 
+// src/dashboard/should-resume.ts
+var GROQ_API_URL5 = "https://api.groq.com/openai/v1/chat/completions";
+var CLASSIFIER_MODEL3 = "openai/gpt-oss-20b";
+var SYSTEM_PROMPT3 = `An AI assistant was working in a chat thread when its process was restarted. Anything it was still doing, or had promised to do later, was lost. You are given the thread topic and its most recent messages; the last one is the assistant's own. Decide whether the assistant has to pick the work back up.
+
+Reply YES only if the assistant's last message clearly leaves work it owes unfinished and nothing after it delivers that work, e.g. it says something is running or in progress and that it will report back, it announces a next step it has not done yet, or it stops partway through a list of things it was asked to do.
+
+Reply NO for anything else: the assistant answered or finished the request, it is waiting on the human (asked a question, offered choices, needs a decision or approval), it reported a result or an error, or you are unsure. Staying quiet is the safe default: answering YES makes the assistant act without being asked.
+
+Answer with only the single word YES or NO, nothing else.`;
+async function shouldResume(topic, recent) {
+  const apiKey = process.env["GROQ_API_KEY"];
+  if (!apiKey) return false;
+  if (recent.length === 0) return false;
+  const user = `[thread topic]
+${topic}
+
+[most recent messages]
+${recent.map((m) => `${m.author}: ${m.body}`).join("\n")}`;
+  try {
+    const res = await fetch(GROQ_API_URL5, {
+      method: "POST",
+      headers: { "content-type": "application/json", authorization: `Bearer ${apiKey}` },
+      body: JSON.stringify({
+        model: CLASSIFIER_MODEL3,
+        temperature: 0,
+        reasoning_effort: "low",
+        // gpt-oss reasons before it answers, and those tokens count against
+        // this cap (see should-interrupt.ts).
+        max_tokens: 150,
+        messages: [
+          { role: "system", content: SYSTEM_PROMPT3 },
+          { role: "user", content: user }
+        ]
+      })
+    });
+    if (!res.ok) return false;
+    const data = await res.json();
+    const answer = data.choices?.[0]?.message?.content?.trim().toUpperCase() ?? "";
+    return answer.startsWith("YES");
+  } catch {
+    return false;
+  }
+}
+
 // src/dashboard/attachment-downloader.ts
 import { writeFile } from "fs/promises";
-import { join as join12 } from "path";
+import { join as join13 } from "path";
 import { GetObjectCommand as GetObjectCommand4 } from "@aws-sdk/client-s3";
 var debug = process.env["DEBUG"] === "true";
 var ATTACHMENT_LINK = /\]\(\/api\/attachments\/([^)?\s]+)(?:\?[^)\s]*)?\)/g;
@@ -7001,7 +7422,7 @@ async function downloadOne(key) {
     if (bytes.length > sizeLimit) {
       return { kind: "skip", skipped: { name, mimetype, reason: "too_large" } };
     }
-    const localPath = join12(paths.UPLOADS_DIR, lastSegment);
+    const localPath = join13(paths.UPLOADS_DIR, lastSegment);
     await writeFile(localPath, bytes);
     if (debug)
       console.log(`[attachment-downloader] saved ${key} -> ${localPath} (${bytes.length} bytes)`);
@@ -7090,8 +7511,10 @@ function loadChatAgentConfig() {
   };
 }
 var RETRY_DELAY_MS = 3e3;
+var MISSED_MESSAGE_WINDOW_MS = 24 * 60 * 60 * 1e3;
+var MISSED_MESSAGE_THREAD_LIMIT = 100;
 var delay = (ms) => new Promise((r) => setTimeout(r, ms));
-function stripPathPrefixes(label2, roots, home = homedir5()) {
+function stripPathPrefixes(label2, roots, home = homedir6()) {
   let out = label2;
   for (const root of roots) {
     if (root) out = out.replaceAll(`${root.replace(/\/+$/, "")}/`, "");
@@ -7109,6 +7532,7 @@ var ChatAgent = class {
     this.supabase = deps.supabase ?? getSupabaseClient;
     this.shouldAgentRespond = deps.shouldAgentRespond ?? shouldAgentRespond;
     this.shouldInterrupt = deps.shouldInterrupt ?? shouldInterrupt;
+    this.shouldResume = deps.shouldResume ?? shouldResume;
   }
   queue = new MessageQueue();
   ask;
@@ -7118,6 +7542,7 @@ var ChatAgent = class {
   supabase;
   shouldAgentRespond;
   shouldInterrupt;
+  shouldResume;
   /** Threads with a `run()` currently in flight, mapped to the tool-use
    * activities observed so far plus the run's abort controller. The realtime
    * "thinking"/"activity" broadcasts are ephemeral (no history for late
@@ -7139,6 +7564,10 @@ var ChatAgent = class {
    * it's accepted until `doRegenerate` settles — see `regenerate()`'s doc
    * comment for why this can't just be `activeRuns`. */
   pendingRegenerate = /* @__PURE__ */ new Set();
+  /** `replyId`s this process has already been handed, so a recovery pass
+   * never re-runs a message that is queued, in flight, or was deliberately
+   * left unanswered by the ambient classifier. */
+  seenReplies = /* @__PURE__ */ new Set();
   /** Workspace roots (workspaces.root_path) for path-prefix stripping in
    * activity labels. Fetched once per process — roots change ~never, and a
    * restart picks up edits. */
@@ -7146,6 +7575,7 @@ var ChatAgent = class {
   /** Fire-and-forget entry point, called by chat-routes after every write. */
   handleMessage(msg) {
     if (msg.author === AGENT_AUTHOR) return;
+    this.seenReplies.add(msg.replyId);
     this.queue.enqueue(msg.threadId, () => this.maybeRun(msg));
     void this.maybeSupersede(msg);
   }
@@ -7180,11 +7610,81 @@ var ChatAgent = class {
     this.supersedingReplies.add(msg.replyId);
     run3.abort.abort();
   }
+  /**
+   * Picks up messages nobody answered. `handleMessage` is fire-and-forget and
+   * every bit of run state lives in this process, so a message is silently
+   * lost when it is written while the Host is offline (the Data side's call
+   * has nowhere to land) or when the process dies mid-run. The stored thread
+   * is the only durable record of either, so this reads it back: any recently
+   * active thread whose latest message is a human's has nothing after it, and
+   * goes through the normal `handleMessage` path, which still decides
+   * whether it warrants a reply at all (mention, lone human, or the ambient
+   * classifier), and still honours the pause switch.
+   *
+   * A thread the agent had the last word in can be unfinished too: it said
+   * "running, I'll report back" and the restart took the promise with it.
+   * Nothing but the wording records that, so `shouldResume` reads the topic
+   * and the recent replies and, on a yes, the agent is handed its own last
+   * message to carry on from. At most once per human message: a thread whose
+   * last two messages are both the agent's is left alone, so a resume that
+   * itself ends on a promise can't re-trigger on every restart.
+   *
+   * Call after anything that could have opened such a gap: Host start, and
+   * every Host socket reconnect. Idempotent within a process (`seenReplies`).
+   * Returns how many messages were handed over.
+   */
+  async recoverMissed() {
+    const supabase = this.supabase();
+    const since2 = new Date(Date.now() - MISSED_MESSAGE_WINDOW_MS).toISOString();
+    const { data: threads, error: error2 } = await supabase.from("threads").select("id, channel_id, title").gte("updated_at", since2).is("archived_at", null).order("updated_at", { ascending: false }).limit(MISSED_MESSAGE_THREAD_LIMIT);
+    if (error2) {
+      console.error("[chat-agent] recoverMissed: failed to list threads:", error2.message);
+      return 0;
+    }
+    let recovered = 0;
+    for (const thread of threads ?? []) {
+      if (!findChannel(thread.channel_id)) continue;
+      const { data } = await supabase.from("thread_replies").select("id, author, body, model, effort, external_thread_replies_id").eq("thread_id", thread.id).is("archived_at", null).order("created_at", { ascending: false }).limit(CLASSIFIER_CONTEXT_SIZE);
+      const tail = data ?? [];
+      const last = tail[0];
+      if (!last || last.external_thread_replies_id) continue;
+      if (this.seenReplies.has(last.id)) continue;
+      if (!isHumanAuthor(last.author)) {
+        this.seenReplies.add(last.id);
+        const asker = tail[1];
+        if (!asker || !isHumanAuthor(asker.author)) continue;
+        const transcript = [...tail].reverse().map((r) => ({ author: r.author, body: r.body }));
+        if (!await this.shouldResume(thread.title ?? "", transcript)) continue;
+        console.log(`[chat-agent] resuming unfinished work. thread=${thread.id}`);
+        this.handleMessage({
+          threadId: thread.id,
+          replyId: last.id,
+          author: asker.author,
+          body: last.body,
+          resumed: true
+        });
+        recovered++;
+        continue;
+      }
+      console.log(`[chat-agent] recovering unanswered message. thread=${thread.id}`);
+      this.handleMessage({
+        threadId: thread.id,
+        replyId: last.id,
+        author: last.author,
+        body: last.body,
+        model: last.model ?? void 0,
+        effort: last.effort && isEffort(last.effort) ? last.effort : void 0,
+        recovered: true
+      });
+      recovered++;
+    }
+    return recovered;
+  }
   /** Decides whether this message should trigger a reply, then runs it. */
   async maybeRun(msg) {
     const superseding = this.supersedingReplies.delete(msg.replyId);
     if (await this.isPausedForThread(msg.threadId)) return;
-    if (superseding) {
+    if (superseding || msg.resumed) {
       await this.run(msg);
       return;
     }
@@ -7440,6 +7940,7 @@ var ChatAgent = class {
         activeRunner: runnerForModel(loadDashboardSettings().agent)
       })
     );
+    ensureLogicalCwdDir(baseConfig.cwd);
     const pickedModel = msg.model?.trim();
     let activeRunner = pickedModel ? runnerForModel(pickedModel) : defaultRunner;
     let channelConfig = pickedModel ? {
@@ -7461,18 +7962,34 @@ var ChatAgent = class {
         };
       }
     }
+    const docsAccess = await this.resolveSenderDocsAccess(
+      owningProfile,
+      msg.author,
+      thread.channel_id
+    );
+    if (docsAccess && docsAccess !== "write") channelConfig = { ...channelConfig, docsAccess };
     const store = this.openSessionStore();
     try {
       const channelKey = `chat:${thread.channel_id}`;
       const session = store.getSession(channelKey, msg.threadId);
-      const header = `[context: chat channel=${thread.channel_id}` + (thread.title ? `, thread="${thread.title}"` : "") + `, sender=${msg.author}. This is the Flyspace dashboard, not Slack \u2014 it renders full Markdown, so use normal paragraphs, line breaks, and real Markdown lists instead of Slack-style single-line replies. When you name a file that lives in this channel's folder, write it as @ + its cwd-relative path (@docs/spec.md, @web/src/App.tsx) as plain text, never inside backticks or a Markdown link \u2014 the dashboard turns that into a chip the reader clicks to open the file. A trailing line number (@src/app.ts:120) is fine. Paths outside the cwd stay in backticks.]
+      const docsNote = docsAccessPromptNote(channelConfig.docsAccess);
+      const header = (docsNote ? `[access: ${docsNote}]
+
+` : "") + `[context: chat channel=${thread.channel_id}` + (thread.title ? `, thread="${thread.title}"` : "") + `, sender=${msg.author}. This is the Flyspace dashboard, not Slack \u2014 it renders full Markdown, so use normal paragraphs, line breaks, and real Markdown lists instead of Slack-style single-line replies. When you name a file that lives in this channel's folder, write it as @ + its cwd-relative path (@docs/spec.md, @web/src/App.tsx) as plain text, never inside backticks or a Markdown link \u2014 the dashboard turns that into a chip the reader clicks to open the file. A trailing line number (@src/app.ts:120) is fine. Paths outside the cwd stay in backticks.]
 
 `;
       const attachments = await downloadChatAttachments(msg.body);
       const interruptionNote = carried ? `[note: you were still working on "${carried.interrupted.slice(0, 500)}" when ${msg.author} sent the message below. It was sent to correct or replace that request, so it wins. Whatever you already did is still in your context \u2014 keep what is still useful and adjust, rather than starting over or finishing the superseded request. Do not apologise for the interruption; just answer.]
 
 ` : "";
-      const barePrompt = header + interruptionNote + msg.body + buildFilesPromptSection(attachments);
+      const recoveryNote = msg.recovered ? `[note: the message below went unanswered: the agent was offline when it was sent, or a restart cut short the run answering it. If that run got as far as changing files or starting work, check what is already done before redoing it. Do not apologise for the delay; just answer.]
+
+` : "";
+      const body = msg.resumed ? `[note: nobody sent a new message. The agent process restarted after your last reply in this thread, quoted below, which left work unfinished. Anything you had running or meant to do next may have died with it. Check what actually got done (a background job may also still be running, or have finished), then complete what is left and report the result. If there turns out to be nothing left to do, say so in one line. Do not promise another follow-up, and do not apologise for the gap.]
+
+[your last reply]
+${msg.body}` : msg.body;
+      const barePrompt = header + interruptionNote + recoveryNote + body + buildFilesPromptSection(attachments);
       let resumableSessionId = session?.runner === activeRunner ? session.sessionId : void 0;
       let prompt = barePrompt;
       let rolledOver = false;
@@ -7748,9 +8265,9 @@ var ChatAgent = class {
       }, activity: () => {
       } };
     }
-    let pending2 = ready;
+    let pending3 = ready;
     const send2 = (event, payload, last = false) => {
-      pending2 = pending2.then(async (subscribed) => {
+      pending3 = pending3.then(async (subscribed) => {
         if (subscribed) {
           const res = await channel.send({ type: "broadcast", event, payload }).catch((err) => err.message);
           if (res !== "ok") {
@@ -7760,7 +8277,7 @@ var ChatAgent = class {
         return subscribed;
       }).catch(() => false);
       if (last) {
-        void pending2.finally(() => void this.supabase().removeChannel(channel));
+        void pending3.finally(() => void this.supabase().removeChannel(channel));
       }
     };
     return {
@@ -7807,9 +8324,9 @@ var ChatAgent = class {
       };
       return this.channelActivitySend;
     }
-    let pending2 = ready;
+    let pending3 = ready;
     this.channelActivitySend = (event, payload) => {
-      pending2 = pending2.then(async (subscribed) => {
+      pending3 = pending3.then(async (subscribed) => {
         if (subscribed) {
           const res = await channel.send({ type: "broadcast", event, payload }).catch((err) => err.message);
           if (res !== "ok") {
@@ -7821,6 +8338,20 @@ var ChatAgent = class {
     };
     return this.channelActivitySend;
   }
+  /**
+   * The sender's Docs level on `channelId`, or undefined when no restriction
+   * applies (non-human author, or a profile with no Supabase workspace). A
+   * lookup failure resolves to 'none': better to withhold files than leak them.
+   */
+  async resolveSenderDocsAccess(profile, author, channelId) {
+    if (!isHumanAuthor(author)) return void 0;
+    try {
+      return await resolveDocsAccessByHandle(profile, author, channelId) ?? void 0;
+    } catch (err) {
+      console.error("[chat-agent] docs access lookup failed:", err.message);
+      return "none";
+    }
+  }
   async tryAsk(channelConfig, prompt, sessionId, onActivity, signal, usageContext) {
     const name = subAgentName(channelConfig.agentName);
     const agentPersona = name ? readAgentPersona(channelConfig.claudeConfigDir, channelConfig.cwd, name) : void 0;
@@ -7843,7 +8374,8 @@ var ChatAgent = class {
             onActivity,
             signal,
             mcpConfigPath,
-            ...usageContext ? { usageContext } : {}
+            ...usageContext ? { usageContext } : {},
+            ...channelConfig.docsAccess ? { docsAccess: channelConfig.docsAccess } : {}
           },
           channelConfig.claudeConfigDir,
           sessionId,
@@ -7873,12 +8405,19 @@ var ChatAgent = class {
           // the channel's own instructions ride in with the prompt. Without
           // this a Codex turn answers as a generic coding agent: no house
           // language rules, no Slack/dashboard conventions, no channel prompt.
-          systemPrompt: buildSystemPrompt(
-            this.config.botName,
-            agentPersona,
-            channelConfig.prompt,
-            resolveSelectedOutputStyle(channelConfig.claudeConfigDir)?.body
-          ),
+          systemPrompt: [
+            buildSystemPrompt(
+              this.config.botName,
+              agentPersona,
+              channelConfig.prompt,
+              resolveSelectedOutputStyle(channelConfig.claudeConfigDir)?.body
+            ),
+            docsAccessPromptNote(channelConfig.docsAccess)
+          ].filter(Boolean).join("\n\n---\n\n"),
+          // Codex has no per-tool deny list, so any restricted requester gets
+          // its read-only sandbox (no file writes). It can still read: see the
+          // residual-gap note in docs/features/user-roles.md.
+          ...channelConfig.docsAccess === "read" || channelConfig.docsAccess === "none" ? { sandbox: "read-only" } : {},
           ...onActivity ? { onActivity } : {},
           ...signal ? { signal } : {},
           ...usageContext ? { usageContext } : {}
@@ -8198,7 +8737,9 @@ var DOC_EXTENSIONS = {
   ".htm": "html",
   // A file whose whole content is a URL — the Docs pane renders it as a
   // full-size iframe of that page instead of showing the link as text.
-  ".url": "url"
+  ".url": "url",
+  // An Excalidraw drawing: JSON on disk, drawn and edited in the Docs pane.
+  ".excalidraw": "excalidraw"
 };
 var MEDIA_EXTENSIONS = {
   ".png": "image/png",
@@ -8261,7 +8802,7 @@ var CODE_EXTENSIONS = {
 function highlightLanguageOf(path) {
   const ext = extname(path).toLowerCase();
   const doc = DOC_EXTENSIONS[ext];
-  if (doc) return doc === "md" ? "markdown" : "xml";
+  if (doc) return doc === "md" ? "markdown" : doc === "excalidraw" ? "json" : "xml";
   return CODE_EXTENSIONS[ext] ?? null;
 }
 var SKIP_FILES = /* @__PURE__ */ new Set([
@@ -8363,7 +8904,7 @@ function readHead(absPath) {
   }
 }
 function extractTitle(absPath, kind) {
-  if (kind === "url") return basename4(absPath);
+  if (kind === "url" || kind === "excalidraw") return basename4(absPath);
   const head = readHead(absPath);
   if (!head) return basename4(absPath);
   if (kind === "md") {
@@ -8405,7 +8946,7 @@ function probeDir(absDir, showHidden) {
         return false;
       }
       if (!showHidden && entry.name.startsWith(".")) continue;
-      const abs = join13(dir, entry.name);
+      const abs = join14(dir, entry.name);
       const kind = entryKind(entry, abs);
       if (kind === "dir") {
         if (SKIP_DIRS.has(entry.name)) hasOther = true;
@@ -8425,14 +8966,14 @@ function probeDir(absDir, showHidden) {
 }
 function readGitBranch(dir) {
   try {
-    let gitDir = join13(dir, ".git");
+    let gitDir = join14(dir, ".git");
     if (statSync4(gitDir).isFile()) {
       const pointer = readFileSync9(gitDir, "utf8").trim();
       const match = pointer.match(/^gitdir:\s*(.+)$/);
       if (!match) return void 0;
       gitDir = resolve4(dir, match[1]);
     }
-    const head = readFileSync9(join13(gitDir, "HEAD"), "utf8").trim();
+    const head = readFileSync9(join14(gitDir, "HEAD"), "utf8").trim();
     const branchMatch = head.match(/^ref:\s*refs\/heads\/(.+)$/);
     if (branchMatch) return branchMatch[1];
     return /^[0-9a-f]{7,40}$/i.test(head) ? head.slice(0, 7) : void 0;
@@ -8454,14 +8995,14 @@ function listDocLevel(root, relDir = "", sort = "newest", showHidden = false) {
   for (const entry of entries2) {
     if (dirs.length + docs.length >= MAX_ENTRIES) break;
     if (!showHidden && entry.name.startsWith(".")) continue;
-    const abs = join13(absDir, entry.name);
+    const abs = join14(absDir, entry.name);
     const path = relative(root, abs).split(sep).join("/");
     const kind = entryKind(entry, abs);
     if (kind === "dir") {
       if (SKIP_DIRS.has(entry.name)) continue;
       const probe2 = probeDir(abs, showHidden);
       if (!probe2.hasDocs && probe2.hasOther) continue;
-      const isRepo = existsSync16(join13(abs, ".git"));
+      const isRepo = existsSync16(join14(abs, ".git"));
       dirs.push({
         path,
         name: entry.name,
@@ -8497,7 +9038,7 @@ function flatDocs(root, {
     for (const entry of entries2) {
       if (hits.length >= MAX_FLAT_DOCS) return;
       if (!showHidden && entry.name.startsWith(".")) continue;
-      const abs = join13(dir, entry.name);
+      const abs = join14(dir, entry.name);
       const kind = entryKind(entry, abs);
       if (kind === "dir") {
         if (!SKIP_DIRS.has(entry.name)) walk(abs, depth + 1);
@@ -8577,7 +9118,7 @@ function uniqueName(absDir, name) {
   let candidate = name;
   for (let n = 1; n < 1e3; n++) {
     try {
-      statSync4(join13(absDir, candidate));
+      statSync4(join14(absDir, candidate));
     } catch {
       return candidate;
     }
@@ -8599,7 +9140,7 @@ function saveUploadedFile(root, relDir, name, data) {
   if (!(ext in DOC_EXTENSIONS) && !ASSET_LIST_EXTENSIONS.has(ext)) return { status: "bad-type" };
   if (data.byteLength > MAX_UPLOAD_BYTES) return { status: "too-large" };
   const final = uniqueName(absDir, safe);
-  const abs = join13(absDir, final);
+  const abs = join14(absDir, final);
   writeFileSync6(abs, data);
   return { status: "ok", path: relative(root, abs).split(sep).join("/"), name: final };
 }
@@ -8613,7 +9154,7 @@ function createDocFolder(root, relDir, name) {
   }
   const safe = sanitizeUploadName(name);
   if (!safe) return { status: "bad-name" };
-  const abs = join13(absDir, safe);
+  const abs = join14(absDir, safe);
   try {
     statSync4(abs);
     return { status: "exists" };
@@ -8636,7 +9177,7 @@ function createDocFile(root, relDir, name, content) {
   if (!(ext in DOC_EXTENSIONS) && !(ext in CODE_EXTENSIONS)) return { status: "bad-name" };
   if (SKIP_FILES.has(safe)) return { status: "bad-name" };
   if (Buffer.byteLength(content, "utf8") > MAX_CONTENT_BYTES) return { status: "too-large" };
-  const abs = join13(absDir, safe);
+  const abs = join14(absDir, safe);
   try {
     writeFileSync6(abs, content, { encoding: "utf8", flag: "wx" });
   } catch (err) {
@@ -8674,7 +9215,7 @@ function moveDocEntry(root, from, to) {
   } catch {
     return { status: "bad-target" };
   }
-  const finalAbs = join13(absToDir, name);
+  const finalAbs = join14(absToDir, name);
   if (isDir2 && (finalAbs === absFrom || finalAbs.startsWith(absFrom + sep))) {
     return { status: "into-self" };
   }
@@ -8705,7 +9246,9 @@ function deleteDocEntry(root, path) {
   };
 }
 function createDocsRouter() {
-  const app = new Hono9();
+  const app = new Hono10();
+  app.use("/:id/docs", requireDocsAccess);
+  app.use("/:id/docs/*", requireDocsAccess);
   app.get("/:id/docs", (c) => {
     const { cwd } = resolveChannelConfig(c.req.param("id"));
     const dir = c.req.query("path") ?? "";
@@ -8821,6 +9364,8 @@ function createDocsRouter() {
     if (!body || typeof body.name !== "string") return c.json({ error: "name is required" }, 400);
     const dir = typeof body.path === "string" ? body.path : "";
     const content = typeof body.content === "string" ? body.content : "";
+    if (body.name.toLowerCase().endsWith(".excalidraw") && !await isFeatureEnabled(c, "excalidraw"))
+      return c.json({ error: "feature not enabled" }, 403);
     const result = createDocFile(cwd, dir, body.name, content);
     switch (result.status) {
       case "no-dir":
@@ -9010,6 +9555,8 @@ function createDocsRouter() {
     if ("error" in resolved2) return resolved2.error;
     const lang = canonicalLanguage(c.req.param("lang"));
     if (!isTranslatableLanguage(lang)) return c.json({ error: "not found" }, 404);
+    if (!await isFeatureEnabled(c, "read-aloud"))
+      return c.json({ error: "feature not enabled" }, 403);
     try {
       const audio = await readOrQueueDocAudio({
         channelId: resolved2.channel.id,
@@ -9028,7 +9575,7 @@ function createDocsRouter() {
 }
 
 // src/dashboard/output-styles-routes.ts
-import { Hono as Hono10 } from "hono";
+import { Hono as Hono11 } from "hono";
 function requireAdmin(auth) {
   return auth?.role === "admin" ? null : "admin access required";
 }
@@ -9042,13 +9589,13 @@ function toResponse3(style) {
     updatedAt: style.updatedAt
   };
 }
-var configDir = () => profileEnv("CLAUDE_CONFIG_DIR");
+var configDir = () => profileClaudeConfigDir();
 function failure(c, err) {
   const message = err.message;
   return c.json({ error: message }, err instanceof OutputStyleConflictError ? 409 : 500);
 }
 function createOutputStylesRouter() {
-  const app = new Hono10();
+  const app = new Hono11();
   app.get("/", (c) => {
     const auth = c.get("auth");
     const denied = requireAdmin(auth);
@@ -9139,11 +9686,44 @@ function createOutputStylesRouter() {
   });
   return app;
 }
+async function handleOutputStylesRequest(req) {
+  const app = new Hono11();
+  app.use("*", async (c, next) => {
+    c.set("auth", { role: "admin" });
+    await next();
+  });
+  app.route("/", createOutputStylesRouter());
+  const res = await app.request(req.path, {
+    method: req.method,
+    ...req.body !== void 0 && {
+      body: JSON.stringify(req.body),
+      headers: { "content-type": "application/json" }
+    }
+  });
+  return { status: res.status, body: await res.json().catch(() => null) };
+}
+function registerRelayedOutputStylesRoutes(api, agent) {
+  api.all("/output-styles/*", relay(agent, (p) => p.slice(p.indexOf("/output-styles") + "/output-styles".length) || "/"));
+  api.all("/output-styles", relay(agent, () => "/"));
+}
+function relay(agent, pathOf) {
+  return async (c) => {
+    const denied = requireAdmin(c.get("auth"));
+    if (denied) return c.json({ error: denied }, 403);
+    const method = c.req.method;
+    const body = method === "GET" || method === "DELETE" ? void 0 : await c.req.json().catch(() => null);
+    const result = await agent.outputStylesRequest?.({ method, path: pathOf(c.req.path), body });
+    if (!result) {
+      return c.json({ error: "Output styles need the Host machine, which is not connected right now." }, 503);
+    }
+    return c.json(result.body, result.status);
+  };
+}
 
 // src/dashboard/skills-routes.ts
 import { existsSync as existsSync18, statSync as statSync6 } from "fs";
 import { dirname as dirname4 } from "path";
-import { Hono as Hono11 } from "hono";
+import { Hono as Hono12 } from "hono";
 
 // src/dashboard/skill-mirror.ts
 import { createHash as createHash8 } from "crypto";
@@ -9170,7 +9750,7 @@ function ownSkills(scope, dir) {
 }
 function snapshot(scopes) {
   const wants = (scope) => !scopes || scopes.has(scope);
-  const configDir2 = profileEnv("CLAUDE_CONFIG_DIR");
+  const configDir2 = profileClaudeConfigDir();
   const rows = [];
   if (wants("workspace")) rows.push(...ownSkills("workspace", workspaceSkillsDir(configDir2)));
   if (wants("plugin")) {
@@ -9262,7 +9842,7 @@ async function readMirroredSkills(scopes, name) {
 
 // src/dashboard/skills-routes.ts
 function workspaceScope() {
-  const claudeConfigDir = profileEnv("CLAUDE_CONFIG_DIR");
+  const claudeConfigDir = profileClaudeConfigDir();
   const cwd = defaultClaudeCwd();
   return {
     dir: workspaceSkillsDir(claudeConfigDir),
@@ -9468,12 +10048,12 @@ function mountSkillRoutes(app, base, refOf, backend) {
 var workspaceRef = () => ({ kind: "workspace" });
 var channelRef = (c) => ({ kind: "channel", channelId: c.req.param("id") });
 function createWorkspaceSkillsRouter() {
-  const app = new Hono11();
+  const app = new Hono12();
   mountSkillRoutes(app, "/skills", workspaceRef, diskBackend);
   return app;
 }
 function createChannelSkillsRouter() {
-  const app = new Hono11();
+  const app = new Hono12();
   mountSkillRoutes(app, "/:id/skill-files", channelRef, diskBackend);
   return app;
 }
@@ -9491,7 +10071,7 @@ async function resolveAgentIdentities() {
   const main2 = [
     {
       name: BOT_DM_KEY,
-      label: "Workspace Bot",
+      label: "Workspace Agent",
       kind: "main",
       cwd: defaultCwd,
       model: settings.agentProfiles?.[BOT_DM_KEY]?.model,
@@ -9512,8 +10092,8 @@ async function resolveAgentIdentities() {
 // src/dashboard/providers.ts
 import { execFileSync } from "child_process";
 import { existsSync as existsSync19 } from "fs";
-import { homedir as homedir6 } from "os";
-import { join as join14, resolve as resolve5 } from "path";
+import { homedir as homedir7 } from "os";
+import { join as join15, resolve as resolve5 } from "path";
 var PROVIDER_LABELS = {
   claude: "Claude Code",
   codex: "Codex"
@@ -9530,8 +10110,8 @@ function binaryOnPath(bin) {
 }
 function claudeAuthAvailable() {
   if (profileEnv("CLAUDE_CODE_OAUTH_TOKEN")?.trim()) return true;
-  const configDir2 = profileEnv("CLAUDE_CONFIG_DIR")?.trim() || resolve5(homedir6(), ".claude");
-  if (existsSync19(join14(configDir2, ".credentials.json"))) return true;
+  const configDir2 = profileClaudeConfigDir() || resolve5(homedir7(), ".claude");
+  if (existsSync19(join15(configDir2, ".credentials.json"))) return true;
   if (process.platform !== "darwin") return false;
   try {
     execFileSync("security", ["find-generic-password", "-s", "Claude Code-credentials"], {
@@ -9594,6 +10174,8 @@ function registerHostRoutes(api) {
       agent,
       displayName: body["displayName"] === null || typeof body["displayName"] === "string" ? body["displayName"] : void 0,
       gaMeasurementId: body["gaMeasurementId"] === null || typeof body["gaMeasurementId"] === "string" ? body["gaMeasurementId"] : void 0,
+      autoTitleEnabled: typeof body["autoTitleEnabled"] === "boolean" ? body["autoTitleEnabled"] : void 0,
+      autoTitlePrompt: body["autoTitlePrompt"] === null || typeof body["autoTitlePrompt"] === "string" ? body["autoTitlePrompt"] : void 0,
       fallbackModel: body["fallbackModel"] === null || typeof body["fallbackModel"] === "string" ? body["fallbackModel"] : void 0,
       // Shape-checked only — which runners exist, whether a model belongs to
       // the runner it's listed under, and what a missing/duplicate entry
@@ -9632,7 +10214,7 @@ function registerHostRoutes(api) {
   api.delete("/settings/prompt", (c) => c.json(resetWorkspacePrompt()));
   api.get(
     "/settings/bot",
-    async (c) => c.json({ name: BOT_PROFILE_KEY, label: "Workspace Bot", ...await loadBotIdentity() })
+    async (c) => c.json({ name: BOT_PROFILE_KEY, label: "Workspace Agent", ...await loadBotIdentity() })
   );
   api.get("/settings/agents", async (c) => c.json({ agents: await resolveAgentIdentities() }));
   api.put("/settings/agents/:name", async (c) => {
@@ -9672,7 +10254,7 @@ function registerHostRoutes(api) {
     const errors = c.req.query("error") === "true" || c.req.query("error") === "1";
     const limit = Math.min(Number(c.req.query("limit")) || 200, 2e3);
     const filename = errors ? "custie-error.log" : "custie.log";
-    const file = join15(paths.LOG_DIR, filename);
+    const file = join16(paths.LOG_DIR, filename);
     const exists = existsSync20(file);
     return c.json({
       file,
@@ -9690,11 +10272,11 @@ function tailFile(file, limit) {
 }
 
 // src/dashboard/data-api.ts
-import { existsSync as existsSync23 } from "fs";
+import { existsSync as existsSync22 } from "fs";
 import sharp5 from "sharp";
 
 // src/dashboard/automations-routes.ts
-import { Hono as Hono12 } from "hono";
+import { Hono as Hono13 } from "hono";
 var TYPES2 = ["schedule", "trigger", "mention-trigger"];
 function isType(t) {
   return TYPES2.includes(t);
@@ -9711,7 +10293,7 @@ function statusFor(message) {
   return 400;
 }
 function createAutomationWriteRouter() {
-  const app = new Hono12();
+  const app = new Hono13();
   const manager = () => new AutomationManager();
   app.get("/:type/:name", (c) => {
     const item = manager().get(c.req.param("name"));
@@ -9767,9 +10349,9 @@ function createAutomationWriteRouter() {
 }
 
 // src/dashboard/categories-routes.ts
-import { Hono as Hono13 } from "hono";
+import { Hono as Hono14 } from "hono";
 function createCategoryWriteRouter() {
-  const app = new Hono13();
+  const app = new Hono14();
   app.get("/", async (c) => {
     const { data, error: error2 } = await getSupabaseClient().from("categories").select("*").eq("profile", getProfile()).order("position", { ascending: true });
     if (error2) return c.json({ error: error2.message }, 500);
@@ -9823,10 +10405,10 @@ function createCategoryWriteRouter() {
 }
 
 // src/dashboard/chat-routes.ts
-import { Hono as Hono14 } from "hono";
+import { Hono as Hono15 } from "hono";
 
 // src/dashboard/fork-summary.ts
-var GROQ_API_URL5 = "https://api.groq.com/openai/v1/chat/completions";
+var GROQ_API_URL6 = "https://api.groq.com/openai/v1/chat/completions";
 var SUMMARY_MODEL = "openai/gpt-oss-120b";
 var MAX_INPUT_CHARS2 = 24e3;
 var TITLE_MAX_CHARS = 80;
@@ -9890,7 +10472,7 @@ async function buildForkTopic(transcript, fallbackText, mode = "condense") {
   const apiKey = process.env["GROQ_API_KEY"];
   if (!apiKey) return fallbackTopic(fallback);
   try {
-    const res = await fetch(GROQ_API_URL5, {
+    const res = await fetch(GROQ_API_URL6, {
       method: "POST",
       headers: { "content-type": "application/json", authorization: `Bearer ${apiKey}` },
       body: JSON.stringify({
@@ -9990,7 +10572,7 @@ async function putThreadTranslations(lang, rows) {
 }
 
 // src/dashboard/thread-translate.ts
-var GROQ_API_URL6 = "https://api.groq.com/openai/v1/chat/completions";
+var GROQ_API_URL7 = "https://api.groq.com/openai/v1/chat/completions";
 var TRANSLATION_MODEL2 = "openai/gpt-oss-120b";
 var RECIPE_VERSION3 = 1;
 var BATCH_CHAR_BUDGET = 16e3;
@@ -10058,7 +10640,7 @@ async function translateBatch(batch, context, lang) {
     context: context.map((m) => ({ author: m.author, body: clip(m.body) })),
     translate: batch.map((m, i) => ({ n: i + 1, author: m.author, body: clip(m.body) }))
   };
-  const res = await fetch(GROQ_API_URL6, {
+  const res = await fetch(GROQ_API_URL7, {
     method: "POST",
     headers: { "content-type": "application/json", authorization: `Bearer ${apiKey}` },
     body: JSON.stringify({
@@ -10158,6 +10740,10 @@ function sanitizeModel(v) {
   const model = v.trim().toLowerCase();
   return isAllowedModel(model) ? model : null;
 }
+async function threadModel(threadId) {
+  const { data } = await getSupabaseClient().from("thread_replies").select("model").eq("thread_id", threadId).not("model", "is", null).order("created_at", { ascending: false }).limit(1).maybeSingle();
+  return sanitizeModel(data?.model);
+}
 function requestedModel(c, model) {
   return c.get("auth")?.role === "admin" ? sanitizeModel(model) : null;
 }
@@ -10266,8 +10852,38 @@ async function withPreviews(supabase, threads) {
     };
   });
 }
+async function labelThread(channelId, body, scope) {
+  const channel = getProfileChannelRegistry().find(
+    (ch) => ch.id === channelId || ch.externalChannelId === channelId
+  );
+  if (!channel) return null;
+  const supabase = getSupabaseClient();
+  const { data: recent } = await supabase.from("threads").select("auto_title, title").eq("channel_id", channelId).order("created_at", { ascending: false }).limit(50);
+  const existingCategories = extractCategories(
+    (recent ?? []).flatMap((t) => [
+      t.auto_title,
+      t.title
+    ])
+  );
+  return buildAutoTitle({
+    channelName: channel.name,
+    channelPrompt: channel.prompt,
+    workspacePrompt: loadWorkspacePrompt().prompt,
+    titlePrompt: (await loadWorkspaceBranding()).autoTitlePrompt,
+    existingCategories,
+    body,
+    scope
+  });
+}
+async function generateAutoTitle(threadId, channelId, body) {
+  if ((await loadWorkspaceBranding()).autoTitleEnabled === false) return;
+  const autoTitle = await labelThread(channelId, body);
+  if (!autoTitle) return;
+  const supabase = getSupabaseClient();
+  await supabase.from("threads").update({ auto_title: autoTitle }).eq("id", threadId).is("title", null);
+}
 function createChatRouter(agent = {}) {
-  const app = new Hono14();
+  const app = new Hono15();
   const {
     onChatMessage: onMessage,
     isAgentThinking,
@@ -10557,6 +11173,18 @@ function createChatRouter(agent = {}) {
     if (error2) return c.json({ error: error2.message }, 500);
     return c.json(thread);
   });
+  app.post("/threads/:id/suggest-title", async (c) => {
+    const id = c.req.param("id");
+    if (!await threadIsKnown(id, c)) return c.json({ error: "not found" }, 404);
+    const { data: thread } = await getSupabaseClient().from("threads").select("channel_id").eq("id", id).single();
+    if (!thread) return c.json({ error: "not found" }, 404);
+    const { data: rows, error: error2 } = await getSupabaseClient().from("thread_replies").select("author, body").eq("thread_id", id).is("archived_at", null).order("created_at", { ascending: true });
+    if (error2) return c.json({ error: error2.message }, 500);
+    const transcript = (rows ?? []).map((r) => `${r.author}: ${slackMrkdwnToMarkdown(r.body)}`).join("\n\n");
+    const title = await labelThread(thread.channel_id, transcript, "thread");
+    if (!title) return c.json({ error: "could not generate a topic" }, 502);
+    return c.json({ title });
+  });
   app.patch("/replies/:replyId", async (c) => {
     const replyId = c.req.param("replyId");
     const input2 = await c.req.json().catch(() => null);
@@ -10677,6 +11305,11 @@ function createChatRouter(agent = {}) {
         effort: effortFromRow(reply["effort"])
       });
     }
+    if (!replayed && thread["title"] == null) {
+      void generateAutoTitle(thread.id, channelId, input2.body).catch(
+        (err) => console.error("Auto title failed:", err)
+      );
+    }
     return c.json({ ...thread, replies: [reply] }, replayed ? 200 : 201);
   });
   app.post("/replies/:replyId/fork", async (c) => {
@@ -10725,9 +11358,9 @@ function createChatRouter(agent = {}) {
       return c.json({ errors: ["author and body are required"] }, 400);
     }
     const clientKey2 = isNonEmptyString(input2.clientKey) ? input2.clientKey : null;
-    const model = requestedModel(c, input2.model);
     const effort = requestedEffort(c, input2.effort);
     if (!await threadIsKnown(threadId, c)) return c.json({ error: "not found" }, 404);
+    const model = requestedModel(c, input2.model) ?? await threadModel(threadId);
     const { data, error: error2 } = await getSupabaseClient().from("thread_replies").insert({
       thread_id: threadId,
       author: input2.author,
@@ -10757,7 +11390,7 @@ function createChatRouter(agent = {}) {
 }
 
 // src/dashboard/doc-shares-routes.ts
-import { Hono as Hono15 } from "hono";
+import { Hono as Hono16 } from "hono";
 
 // src/dashboard/doc-share-features.ts
 import { DeleteObjectCommand as DeleteObjectCommand3 } from "@aws-sdk/client-s3";
@@ -10802,7 +11435,7 @@ async function deleteShareAssets(keys) {
   }
 }
 async function updateShareFeatures(share, requested) {
-  if (share.kind === "html") return share;
+  if (share.kind === "html" || share.kind === "excalidraw") return share;
   const features = resolveFeatures(requested, share);
   const updated = await updateDocShareFeatures(share.id, features);
   if (!updated) return null;
@@ -10811,6 +11444,25 @@ async function updateShareFeatures(share, requested) {
   return updated;
 }
 
+// src/dashboard/share-tags.ts
+var MAX_TAGS = 10;
+var MAX_TAG_LENGTH = 30;
+function normalizeTag(raw) {
+  const tag = raw.normalize("NFKC").trim().toLowerCase().replace(/^#+/, "").replace(/[\s_/\\,?#%]+/g, "-").replace(/-{2,}/g, "-").replace(/^-+|-+$/g, "").slice(0, MAX_TAG_LENGTH).replace(/-+$/, "");
+  return tag || null;
+}
+function normalizeTags(raw) {
+  if (!Array.isArray(raw)) return null;
+  const tags = /* @__PURE__ */ new Set();
+  for (const item of raw) {
+    if (typeof item !== "string") continue;
+    const tag = normalizeTag(item);
+    if (tag) tags.add(tag);
+    if (tags.size >= MAX_TAGS) break;
+  }
+  return [...tags];
+}
+
 // src/dashboard/share-slug.ts
 var MIN_SLUG = 2;
 var MAX_SLUG = 64;
@@ -10861,6 +11513,7 @@ function shareJson(c, share) {
   return {
     id: share.id,
     slug: share.slug,
+    tags: share.tags,
     url: shareUrl(c, share.slug ?? share.id),
     path: share.sourcePath,
     title: share.title,
@@ -10917,18 +11570,26 @@ function resolveChannel2(c) {
 }
 var LIST_LIMIT = 500;
 function createDocShareListRouter() {
-  const app = new Hono15();
+  const app = new Hono16();
   app.get("/shares", async (c) => {
     const viewer = c.get("auth");
+    const readable = await filterReadableDocsChannels(
+      viewer,
+      getProfileChannelRegistry().map((ch) => ch.id)
+    );
     const channels = new Map(
       getProfileChannelRegistry().filter((ch) => canSeeChannel(ch, viewer)).map((ch) => [ch.id, ch.name])
     );
+    for (const id of [...channels.keys()]) {
+      if (!readable.has(id)) channels.delete(id);
+    }
     const shares = await listLiveDocShares([...channels.keys()], LIST_LIMIT + 1);
     return c.json({
       truncated: shares.length > LIST_LIMIT,
       shares: shares.slice(0, LIST_LIMIT).map((s) => ({
         id: s.id,
         slug: s.slug,
+        tags: s.tags,
         url: shareUrl(c, s.slug ?? s.id),
         path: s.sourcePath,
         title: s.title,
@@ -10953,7 +11614,10 @@ function createDocShareListRouter() {
   return app;
 }
 function createDocShareWriteRouter(agent = {}) {
-  const app = new Hono15();
+  const app = new Hono16();
+  app.use("/:id/docs/share", requireDocsAccess);
+  app.use("/:id/docs/share/*", requireDocsAccess);
+  app.use("/:id/docs/shares", requireDocsAccess);
   app.get("/:id/docs/share", async (c) => {
     const resolved2 = resolveChannel2(c);
     if ("error" in resolved2) return resolved2.error;
@@ -11047,10 +11711,11 @@ function createDocShareWriteRouter(agent = {}) {
     if ("invalid" in slug)
       return c.json({ error: slugErrorMessage(slug.invalid), field: "slug" }, 400);
     const features = readFeatures(body);
-    if (!("slug" in slug) && features.audio === void 0 && features.ask === void 0 && features.social === void 0 && features.branding === void 0 && features.translation === void 0 && features.translationLangs === void 0) {
+    const tags = normalizeTags(body["tags"]);
+    if (!("slug" in slug) && tags === null && features.audio === void 0 && features.ask === void 0 && features.social === void 0 && features.branding === void 0 && features.translation === void 0 && features.translationLangs === void 0) {
       return c.json(
         {
-          error: "slug, audio, ask, social, branding, translation or translationLangs is required"
+          error: "slug, tags, audio, ask, social, branding, translation or translationLangs is required"
         },
         400
       );
@@ -11072,7 +11737,13 @@ function createDocShareWriteRouter(agent = {}) {
         throw err;
       }
     }
-    const updated = await updateShareFeatures(renamed, features);
+    let tagged = renamed;
+    if (tags !== null) {
+      const next = await setDocShareTags(renamed.id, tags);
+      if (!next) return c.json({ error: "not shared" }, 404);
+      tagged = next;
+    }
+    const updated = await updateShareFeatures(tagged, features);
     if (!updated) return c.json({ error: "not shared" }, 404);
     return c.json(shareJson(c, updated));
   });
@@ -11100,7 +11771,7 @@ function createDocShareWriteRouter(agent = {}) {
 }
 
 // src/dashboard/search-routes.ts
-import { Hono as Hono16 } from "hono";
+import { Hono as Hono17 } from "hono";
 function matchScore(q, fields) {
   const terms = q.toLowerCase().split(/\s+/).filter(Boolean);
   if (terms.length === 0) return 0;
@@ -11113,6 +11784,20 @@ function matchScore(q, fields) {
   }
   return score;
 }
+var SNIPPET_LENGTH = 180;
+function repeatsTitle(title, snippet) {
+  const norm = (s) => s.replace(/[*_`]/g, "").replace(/…$/, "").trim().toLowerCase();
+  const t = norm(title);
+  return t.length > 0 && norm(snippet).slice(0, t.length + 8).includes(t);
+}
+function snippetAround(text, q) {
+  const lower = text.toLowerCase();
+  const positions = q.toLowerCase().split(/\s+/).filter(Boolean).map((term) => lower.indexOf(term)).filter((i) => i >= 0);
+  const hit = positions.length ? Math.min(...positions) : 0;
+  const start = hit > 40 ? hit - 40 : 0;
+  const end = Math.min(text.length, start + SNIPPET_LENGTH);
+  return `${start > 0 ? "\u2026" : ""}${text.slice(start, end).trim()}${end < text.length ? "\u2026" : ""}`;
+}
 async function searchThreads(q) {
   const supabase = getSupabaseClient();
   const { data, error: error2 } = await supabase.rpc("search_threads", { q, match_limit: 20 });
@@ -11120,19 +11805,34 @@ async function searchThreads(q) {
     console.error("search_threads RPC failed:", error2.message);
     return [];
   }
-  const ownChannelIds2 = new Set(
+  const channelById = new Map(
     getProfileChannelRegistry().flatMap(
-      (ch) => ch.externalChannelId ? [ch.id, ch.externalChannelId] : [ch.id]
+      (ch) => ch.externalChannelId ? [
+        [ch.id, ch],
+        [ch.externalChannelId, ch]
+      ] : [[ch.id, ch]]
     )
   );
-  return (data ?? []).filter((t) => ownChannelIds2.has(t.channel_id)).map((t) => ({
-    type: "thread",
-    id: t.id,
-    title: t.title ?? t.snippet ?? "(untitled thread)",
-    snippet: t.title ? t.snippet ?? void 0 : void 0,
-    url: `/chat/${encodeURIComponent(t.channel_id)}/${encodeURIComponent(t.id)}`,
-    score: t.score
-  }));
+  return (data ?? []).flatMap((t) => {
+    const channel = channelById.get(t.channel_id);
+    if (!channel) return [];
+    return [
+      {
+        type: "thread",
+        id: t.id,
+        title: t.title ?? t.auto_title ?? "",
+        snippet: t.snippet && !repeatsTitle(t.title ?? t.auto_title ?? "", t.snippet) ? snippetAround(t.snippet, q) : void 0,
+        url: `/chat/${encodeURIComponent(t.channel_id)}/${encodeURIComponent(t.id)}`,
+        score: t.score,
+        author: t.author,
+        createdAt: t.created_at,
+        channelId: channel.id,
+        channelName: channel.name,
+        boardStatus: t.board_status,
+        replyCount: t.reply_count
+      }
+    ];
+  });
 }
 function searchChannels(q) {
   const channels = getProfileChannelRegistry();
@@ -11219,7 +11919,7 @@ function searchAutomations(q) {
 }
 var RESULT_LIMIT = 30;
 function createSearchRouter() {
-  const app = new Hono16();
+  const app = new Hono17();
   app.get("/", async (c) => {
     const q = c.req.query("q")?.trim();
     if (!q) return c.json({ results: [] });
@@ -11236,7 +11936,7 @@ function createSearchRouter() {
 
 // src/dashboard/uploads-routes.ts
 import { randomUUID } from "crypto";
-import { Hono as Hono17 } from "hono";
+import { Hono as Hono18 } from "hono";
 import { PutObjectCommand as PutObjectCommand3, GetObjectCommand as GetObjectCommand5 } from "@aws-sdk/client-s3";
 import { getSignedUrl as getSignedUrl4 } from "@aws-sdk/s3-request-presigner";
 var MAX_FILE_BYTES = 10 * 1024 * 1024;
@@ -11251,7 +11951,7 @@ function encodeKeyForUrl(key) {
   return key.split("/").map(encodeURIComponent).join("/");
 }
 function createUploadsRouter() {
-  const app = new Hono17();
+  const app = new Hono18();
   app.post("/uploads", async (c) => {
     const body = await c.req.parseBody().catch(() => null);
     const file = body?.["file"];
@@ -11295,9 +11995,55 @@ function createUploadsRouter() {
   return app;
 }
 
+// src/dashboard/transcribe-routes.ts
+import { Hono as Hono19 } from "hono";
+var GROQ_TRANSCRIBE_URL = "https://api.groq.com/openai/v1/audio/transcriptions";
+var MODEL = "whisper-large-v3-turbo";
+var MAX_AUDIO_BYTES = 5 * 1024 * 1024;
+var MAX_PROMPT_CHARS = 400;
+var NO_SPEECH_THRESHOLD = 0.6;
+function createTranscribeRouter() {
+  const app = new Hono19();
+  app.post("/transcribe", async (c) => {
+    if (!await isFeatureEnabled(c, "dictation"))
+      return c.json({ error: "feature not enabled" }, 403);
+    const apiKey = process.env["GROQ_API_KEY"];
+    if (!apiKey) return c.json({ error: "transcription is not configured" }, 503);
+    const body = await c.req.parseBody().catch(() => null);
+    const file = body?.["file"];
+    if (!(file instanceof File)) return c.json({ error: "missing file" }, 400);
+    if (file.size > MAX_AUDIO_BYTES) return c.json({ error: "audio segment too large" }, 400);
+    const form = new FormData();
+    form.append("file", file, file.name || "segment.wav");
+    form.append("model", MODEL);
+    form.append("temperature", "0");
+    form.append("response_format", "verbose_json");
+    const prompt = body?.["prompt"];
+    if (typeof prompt === "string" && prompt)
+      form.append("prompt", prompt.slice(-MAX_PROMPT_CHARS));
+    const language = body?.["language"];
+    if (typeof language === "string" && /^[a-z]{2}$/.test(language)) {
+      form.append("language", language);
+    }
+    const res = await fetch(GROQ_TRANSCRIBE_URL, {
+      method: "POST",
+      headers: { authorization: `Bearer ${apiKey}` },
+      body: form
+    });
+    if (!res.ok) return c.json({ error: `transcription failed (${res.status})` }, 502);
+    const data = await res.json();
+    const segments = data.segments ?? [];
+    if (segments.length > 0 && segments.every((s) => (s.no_speech_prob ?? 0) > NO_SPEECH_THRESHOLD)) {
+      return c.json({ text: "" });
+    }
+    return c.json({ text: (data.text ?? "").trim() });
+  });
+  return app;
+}
+
 // src/dashboard/avatars-routes.ts
 import { randomUUID as randomUUID2 } from "crypto";
-import { Hono as Hono18 } from "hono";
+import { Hono as Hono20 } from "hono";
 import sharp4 from "sharp";
 import { PutObjectCommand as PutObjectCommand4, DeleteObjectCommand as DeleteObjectCommand4 } from "@aws-sdk/client-s3";
 var AVATAR_SIZE = 192;
@@ -11340,7 +12086,7 @@ function avatarKeyPrefix() {
   return `${KEY_PREFIX3}/${getProfile()}/`;
 }
 function createAvatarsRouter() {
-  const app = new Hono18();
+  const app = new Hono20();
   app.get("/avatars/slack", async (c) => {
     const ctx = await resolveAuthContext(c);
     if (!ctx) return c.json({ error: "not signed in" }, 401);
@@ -11378,7 +12124,7 @@ function createAvatarsRouter() {
 }
 
 // src/dashboard/members-routes.ts
-import { Hono as Hono19 } from "hono";
+import { Hono as Hono21 } from "hono";
 function inviteLinkFor(c, token) {
   const url = new URL("/auth/invite", callbackUrl(c));
   url.searchParams.set("token", token);
@@ -11386,7 +12132,7 @@ function inviteLinkFor(c, token) {
 }
 var EMAIL_RE2 = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
 function createMembersRouter() {
-  const members = new Hono19();
+  const members = new Hono21();
   members.get("/", async (c) => {
     const ctx = await resolveAuthContext(c);
     if (ctx?.role !== "admin") return c.json({ error: "admin access required" }, 403);
@@ -11415,6 +12161,33 @@ function createMembersRouter() {
     );
     return c.json({ members: members2 });
   });
+  members.get("/directory", async (c) => {
+    const ctx = await resolveAuthContext(c);
+    if (!ctx) return c.json({ error: "unauthorized" }, 401);
+    const list = (await listMemberships(ctx.workspaceId)).filter((m) => m.status === "active");
+    const directory = await Promise.all(
+      list.map(async (m) => {
+        const { data } = await getSupabaseClient().auth.admin.getUserById(m.userId);
+        const metadata = data?.user?.user_metadata;
+        const avatarUrl = metadata?.avatarKey ? await signAvatarUrl(metadata.avatarKey) : null;
+        return { userId: m.userId, handle: m.handle, role: m.role, avatarUrl };
+      })
+    );
+    return c.json({ members: directory });
+  });
+  members.post("/:userId/dm", async (c) => {
+    const ctx = await resolveAuthContext(c);
+    if (!ctx) return c.json({ error: "unauthorized" }, 401);
+    const peerId = c.req.param("userId");
+    if (peerId === ctx.userId) return c.json({ error: "cannot message yourself" }, 400);
+    const peer = await getMembershipByUserId(ctx.workspaceId, peerId);
+    if (!peer || peer.status !== "active") return c.json({ error: "member not found" }, 404);
+    const channel = await ensureMemberDmChannel(
+      { userId: ctx.userId, email: ctx.email, handle: ctx.handle },
+      { userId: peer.userId, email: peer.email, handle: peer.handle }
+    );
+    return c.json({ channelId: channel.id });
+  });
   members.get("/check", async (c) => {
     const ctx = await resolveAuthContext(c);
     if (ctx?.role !== "admin") return c.json({ error: "admin access required" }, 403);
@@ -11570,7 +12343,7 @@ function createMembersRouter() {
 }
 
 // src/dashboard/notifications-routes.ts
-import { Hono as Hono20 } from "hono";
+import { Hono as Hono22 } from "hono";
 
 // src/store/notification-store.ts
 function rowToNotification(row) {
@@ -11638,7 +12411,7 @@ async function markAllRead(channelIds, userId) {
 
 // src/dashboard/notifications-routes.ts
 function createNotificationsRouter() {
-  const notifications = new Hono20();
+  const notifications = new Hono22();
   notifications.get("/", async (c) => {
     const auth = c.get("auth");
     const channelIds = getProfileChannelRegistry().filter((ch) => canSeeChannel(ch, auth)).map((ch) => ch.id);
@@ -11665,7 +12438,7 @@ function createNotificationsRouter() {
   return notifications;
 }
 function createThreadReadRouter() {
-  const threads = new Hono20();
+  const threads = new Hono22();
   threads.post("/threads/:threadId/read", async (c) => {
     const { userId } = c.get("auth");
     const threadId = c.req.param("threadId");
@@ -11677,7 +12450,7 @@ function createThreadReadRouter() {
 }
 
 // src/dashboard/push-routes.ts
-import { Hono as Hono21 } from "hono";
+import { Hono as Hono23 } from "hono";
 
 // src/push/send.ts
 import webpush from "web-push";
@@ -11780,7 +12553,7 @@ async function pushToUser(userId, payload) {
 
 // src/dashboard/push-routes.ts
 function createPushRouter() {
-  const push = new Hono21();
+  const push = new Hono23();
   push.get("/key", (c) => c.json({ publicKey: getVapidPublicKey() }));
   push.post("/subscribe", async (c) => {
     const { userId } = c.get("auth");
@@ -11811,7 +12584,7 @@ function createPushRouter() {
 }
 
 // src/dashboard/mcp-oauth-routes.ts
-import { Hono as Hono22 } from "hono";
+import { Hono as Hono24 } from "hono";
 var CONNECTIONS_PAGE = "/settings/connections";
 function callbackUri(c) {
   const proto = c.req.header("x-forwarded-proto") ?? "http";
@@ -11826,7 +12599,7 @@ function backToDashboard(c, to, params) {
   return c.redirect(`${target.pathname}${target.search}`);
 }
 function createMcpOAuthRouter() {
-  const app = new Hono22();
+  const app = new Hono24();
   app.get("/oauth/:provider/start", async (c) => {
     const auth = c.get("auth");
     if (auth.role !== "admin") return c.json({ error: "admin access required" }, 403);
@@ -11953,7 +12726,7 @@ function createMcpOAuthRouter() {
 }
 
 // src/dashboard/mcp-routes.ts
-import { Hono as Hono23 } from "hono";
+import { Hono as Hono25 } from "hono";
 
 // src/mcp/transport.ts
 var KINDS = ["inherit", "npx", "local", "http", "sse"];
@@ -12083,7 +12856,7 @@ function bindingsByConnection() {
   return map;
 }
 function createMcpRouter() {
-  const app = new Hono23();
+  const app = new Hono25();
   app.get("/providers", async (c) => {
     const denied = requireAdmin3(c.get("auth"));
     if (denied) return c.json({ error: denied }, 403);
@@ -12465,42 +13238,7 @@ async function buildThreadUsage(threadTs) {
 }
 
 // src/dashboard/channel-members-routes.ts
-import { Hono as Hono24 } from "hono";
-
-// src/store/channel-members-store.ts
-function rowToChannelMember(row) {
-  return {
-    id: row["id"],
-    channelId: row["channel_id"],
-    membershipId: row["membership_id"],
-    role: row["role"],
-    addedAt: row["added_at"]
-  };
-}
-async function listChannelMembers(channelId) {
-  const { data, error: error2 } = await getSupabaseClient().from("channel_members").select("*").eq("channel_id", channelId).order("added_at", { ascending: true });
-  if (error2) throw new Error(`listChannelMembers(${channelId}): ${error2.message}`);
-  return (data ?? []).map(rowToChannelMember);
-}
-async function upsertChannelMember(params) {
-  const { data, error: error2 } = await getSupabaseClient().from("channel_members").upsert(
-    { channel_id: params.channelId, membership_id: params.membershipId, role: params.role },
-    { onConflict: "channel_id,membership_id" }
-  ).select("*").single();
-  if (error2) {
-    throw new Error(
-      `upsertChannelMember(${params.channelId}, ${params.membershipId}): ${error2.message}`
-    );
-  }
-  return rowToChannelMember(data);
-}
-async function removeChannelMember(channelId, membershipId) {
-  const { data, error: error2 } = await getSupabaseClient().from("channel_members").delete().eq("channel_id", channelId).eq("membership_id", membershipId).select("id");
-  if (error2) throw new Error(`removeChannelMember(${channelId}, ${membershipId}): ${error2.message}`);
-  return data?.length ? true : false;
-}
-
-// src/dashboard/channel-members-routes.ts
+import { Hono as Hono26 } from "hono";
 async function isChannelAdmin(ctx, channelId) {
   if (ctx.role === "admin") return true;
   const membership = await getMembershipByUserId(ctx.workspaceId, ctx.userId);
@@ -12509,7 +13247,7 @@ async function isChannelAdmin(ctx, channelId) {
   return members.some((m) => m.membershipId === membership.id && m.role === "channel_admin");
 }
 function createChannelMembersRouter() {
-  const router = new Hono24();
+  const router = new Hono26();
   router.get("/:id/members", async (c) => {
     const ctx = await resolveAuthContext(c);
     if (!ctx) return c.json({ error: "workspace access required" }, 403);
@@ -12545,277 +13283,143 @@ function createChannelMembersRouter() {
     if (!removed) return c.json({ error: "no such channel member" }, 404);
     return c.body(null, 204);
   });
+  router.get("/:id/docs-access/me", async (c) => {
+    const ctx = await resolveAuthContext(c);
+    if (!ctx) return c.json({ error: "workspace access required" }, 403);
+    return c.json({ access: await resolveDocsAccess(ctx, c.req.param("id")) });
+  });
+  router.get("/:id/docs-access", async (c) => {
+    const ctx = await resolveAuthContext(c);
+    if (!ctx) return c.json({ error: "workspace access required" }, 403);
+    const channelId = c.req.param("id");
+    if (!await isChannelAdmin(ctx, channelId)) {
+      return c.json({ error: "channel admin access required" }, 403);
+    }
+    return c.json({ grants: await listChannelDocsAccess(channelId) });
+  });
+  router.put("/:id/docs-access/:membershipId", async (c) => {
+    const ctx = await resolveAuthContext(c);
+    if (!ctx) return c.json({ error: "workspace access required" }, 403);
+    const channelId = c.req.param("id");
+    if (!await isChannelAdmin(ctx, channelId)) {
+      return c.json({ error: "channel admin access required" }, 403);
+    }
+    const body = await c.req.json().catch(() => ({}));
+    if (!isDocsGrant(body.access)) {
+      return c.json({ error: "access must be 'read' or 'write'" }, 400);
+    }
+    const grant = await upsertChannelDocsAccess({
+      channelId,
+      membershipId: c.req.param("membershipId"),
+      access: body.access
+    });
+    return c.json({ grant });
+  });
+  router.delete("/:id/docs-access/:membershipId", async (c) => {
+    const ctx = await resolveAuthContext(c);
+    if (!ctx) return c.json({ error: "workspace access required" }, 403);
+    const channelId = c.req.param("id");
+    if (!await isChannelAdmin(ctx, channelId)) {
+      return c.json({ error: "channel admin access required" }, 403);
+    }
+    const removed = await removeChannelDocsAccess(channelId, c.req.param("membershipId"));
+    if (!removed) return c.json({ error: "no such docs grant" }, 404);
+    return c.body(null, 204);
+  });
   return router;
 }
 
 // src/dashboard/onboarding-routes.ts
-import { Hono as Hono25 } from "hono";
+import { Hono as Hono27 } from "hono";
 
-// src/dashboard/onboarding-scan.ts
-import { execFileSync as execFileSync2 } from "child_process";
-import {
-  existsSync as existsSync22,
-  lstatSync as lstatSync2,
-  mkdirSync as mkdirSync6,
-  readdirSync as readdirSync4,
-  readFileSync as readFileSync11,
-  statSync as statSync8,
-  symlinkSync
-} from "fs";
-import { homedir as homedir7 } from "os";
-import { basename as basename5, join as join16, resolve as resolve6 } from "path";
-var MAX_JSONL_HEAD_BYTES = 64 * 1024;
-var GIT_SCAN_ROOTS = ["Workspaces", "Projects", "code"];
-function flyspaceRoot() {
-  return process.env["FLYSPACE_ROOT"] || join16(homedir7(), "Flyspace");
-}
-function onPath(cmd) {
-  try {
-    execFileSync2(process.platform === "win32" ? "where" : "which", [cmd], { stdio: "ignore" });
-    return true;
-  } catch {
-    return false;
-  }
-}
-function claudeDir() {
-  return process.env["CLAUDE_CONFIG_DIR"] || join16(homedir7(), ".claude");
-}
-function codexDir() {
-  return process.env["CODEX_HOME"] || join16(homedir7(), ".codex");
-}
-function claudeLoggedIn() {
-  if (process.env["ANTHROPIC_API_KEY"]) return true;
-  if (existsSync22(join16(claudeDir(), ".credentials.json"))) return true;
-  try {
-    const raw = JSON.parse(readFileSync11(join16(homedir7(), ".claude.json"), "utf-8"));
-    if (raw.oauthAccount) return true;
-  } catch {
-  }
-  if (process.platform !== "darwin") return false;
-  try {
-    execFileSync2("security", ["find-generic-password", "-s", "Claude Code-credentials"], {
-      stdio: "ignore"
-    });
-    return true;
-  } catch {
-    return false;
-  }
+// src/dashboard/unique-channel-name.ts
+function uniqueChannelName(raw, taken) {
+  const base = raw.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "project";
+  let name = base;
+  for (let i = 2; taken.has(name); i += 1) name = `${base}-${i}`;
+  taken.add(name);
+  return name;
 }
-function codexLoggedIn() {
-  return !!process.env["OPENAI_API_KEY"] || existsSync22(join16(codexDir(), "auth.json"));
+
+// src/dashboard/workspace-greeting.ts
+var GROQ_API_URL8 = "https://api.groq.com/openai/v1/chat/completions";
+var GREETING_MODEL = "openai/gpt-oss-20b";
+var TIMEOUT_MS = 6e3;
+var MAX_LISTED_CHANNELS = 8;
+var SYSTEM_PROMPT4 = `You write the first message a new Flyspace workspace owner sees, posted in their #general channel. Flyspace is a team chat where an AI agent works inside every channel.
+
+- Plain Markdown, 60 to 110 words, in English. No headings, no emoji, no em or en dashes, no sign-off.
+- Greet the owner by name and name the workspace.
+- Say that #general is public: everyone invited to the workspace can see it.
+- If project channels are listed, mention them as #name and say each one is linked to that project folder. Never invent a channel.
+- Mention the trial or the missing Host only if the facts say so.
+- Use only the facts given. Do not add buttons or a list of next steps: those are appended for you.`;
+function greetingButtons(input2) {
+  const buttons = [];
+  if (!input2.hostConnected) buttons.push("Connect a machine");
+  if (input2.channels[0]) buttons.push(`Summarise #${input2.channels[0]} for me`);
+  if (input2.memberCount <= 1) buttons.push("Invite my team");
+  buttons.push("Set up a daily digest");
+  return buttons.slice(0, 3).map((b) => b.replace(/[|\]]/g, ""));
+}
+function fallbackGreeting(input2) {
+  const channels = input2.channels.slice(0, MAX_LISTED_CHANNELS).map((c) => `#${c}`);
+  return [
+    `Welcome to ${input2.workspaceName}, ${input2.ownerName}.`,
+    "This is #general. It is public, so everyone you invite to the workspace can see it.",
+    channels.length ? `Your project channels are ready: ${channels.join(", ")}. Each one is linked to its project folder, so the agent there works on the real files.` : "",
+    "Mention the agent in any channel to get started."
+  ].filter(Boolean).join("\n\n");
+}
+async function groqGreeting(input2, apiKey) {
+  const facts = [
+    `Owner: ${input2.ownerName}`,
+    `Workspace: ${input2.workspaceName}`,
+    `Plan: ${input2.trialing ? "14-day free trial, just started" : "not on a trial"}`,
+    `Host: ${input2.hostConnected ? "a machine is connected, agents can run" : "no machine connected yet, agents cannot run until one is"}`,
+    `Project channels: ${input2.channels.slice(0, MAX_LISTED_CHANNELS).join(", ") || "(none yet)"}`,
+    `Members: ${input2.memberCount}`
+  ].join("\n");
+  const res = await fetch(GROQ_API_URL8, {
+    method: "POST",
+    signal: AbortSignal.timeout(TIMEOUT_MS),
+    headers: { "content-type": "application/json", authorization: `Bearer ${apiKey}` },
+    body: JSON.stringify({
+      model: GREETING_MODEL,
+      temperature: 0.6,
+      // Reasoning model: the cap covers reasoning tokens too, so keep it roomy.
+      reasoning_effort: "low",
+      max_tokens: 900,
+      messages: [
+        { role: "system", content: SYSTEM_PROMPT4 },
+        { role: "user", content: facts }
+      ]
+    })
+  });
+  if (!res.ok) throw new Error(`Groq request failed (${res.status})`);
+  const data = await res.json();
+  const text = data.choices?.[0]?.message?.content?.replace(/\[BUTTONS:[^\]]*\]/g, "").replace(/\s*[–—]\s*/g, ", ").trim();
+  return text || null;
 }
-function jsonlFiles(dir, depth) {
-  const out = [];
-  let entries2;
-  try {
-    entries2 = readdirSync4(dir, { withFileTypes: true });
-  } catch {
-    return out;
-  }
-  for (const e of entries2) {
-    const full = join16(dir, e.name);
-    if (e.isDirectory()) {
-      if (depth > 0) out.push(...jsonlFiles(full, depth - 1));
-    } else if (e.name.endsWith(".jsonl")) {
-      try {
-        out.push({ file: full, mtime: statSync8(full).mtimeMs });
-      } catch {
-      }
+async function buildGreeting(input2) {
+  let text = null;
+  const apiKey = process.env["GROQ_API_KEY"];
+  if (apiKey) {
+    try {
+      text = await groqGreeting(input2, apiKey);
+    } catch (err) {
+      console.error("Workspace greeting failed, using the fixed template:", err);
     }
   }
-  return out;
-}
-function cwdFromTranscript(file) {
-  let head;
-  try {
-    head = readFileSync11(file, { encoding: "utf-8", flag: "r" }).slice(0, MAX_JSONL_HEAD_BYTES);
-  } catch {
-    return null;
-  }
-  for (const line of head.split("\n")) {
-    if (!line.includes('"cwd"')) continue;
-    try {
-      const obj = JSON.parse(line);
-      const cwd = obj.cwd ?? obj.payload?.cwd;
-      if (typeof cwd === "string" && cwd) return cwd;
-    } catch {
-    }
-  }
-  return null;
-}
-function codexTrustedPaths() {
-  try {
-    const toml = readFileSync11(join16(codexDir(), "config.toml"), "utf-8");
-    return [...toml.matchAll(/^\[projects\.(?:"([^"]+)"|'([^']+)')\]/gm)].map((m) => m[1] ?? m[2]);
-  } catch {
-    return [];
-  }
-}
-function isExcluded(path) {
-  const home = homedir7();
-  if (path === home || path === "/") return true;
-  if (path === "/tmp" || path.startsWith("/tmp/")) return true;
-  if (path === "/private/tmp" || path.startsWith("/private/tmp/")) return true;
-  const root = flyspaceRoot();
-  if (path === root || path.startsWith(`${root}/`)) return true;
-  try {
-    return !statSync8(path).isDirectory();
-  } catch {
-    return true;
-  }
-}
-function gitRepos() {
-  const home = homedir7();
-  const found = [];
-  for (const rootName of GIT_SCAN_ROOTS) {
-    const root = join16(home, rootName);
-    let entries2;
-    try {
-      entries2 = readdirSync4(root, { withFileTypes: true });
-    } catch {
-      continue;
-    }
-    for (const e of entries2) {
-      if (e.isDirectory() && existsSync22(join16(root, e.name, ".git"))) found.push(join16(root, e.name));
-    }
-  }
-  return found;
-}
-function detectRunners(history = { claude: false, codex: false }) {
-  return [
-    {
-      id: "claude",
-      installed: onPath("claude"),
-      loggedIn: claudeLoggedIn(),
-      hasHistory: history.claude
-    },
-    {
-      id: "codex",
-      installed: onPath("codex"),
-      loggedIn: codexLoggedIn(),
-      hasHistory: history.codex
-    }
-  ];
-}
-function scanOnboarding() {
-  const byPath = /* @__PURE__ */ new Map();
-  const history = { claude: false, codex: false };
-  const add = (rawPath, source, mtime, sessions, trusted = false) => {
-    const path = resolve6(rawPath);
-    if (isExcluded(path)) return;
-    const existing = byPath.get(path);
-    if (existing) {
-      if (!existing.sources.includes(source)) existing.sources.push(source);
-      existing.lastUsed = Math.max(existing.lastUsed, mtime);
-      existing.sessions += sessions;
-      existing.trusted ||= trusted;
-    } else {
-      byPath.set(path, {
-        path,
-        name: basename5(path),
-        sources: [source],
-        lastUsed: mtime,
-        sessions,
-        trusted
-      });
-    }
-  };
-  const claudeProjects = join16(claudeDir(), "projects");
-  try {
-    for (const e of readdirSync4(claudeProjects, { withFileTypes: true })) {
-      if (!e.isDirectory()) continue;
-      const files = jsonlFiles(join16(claudeProjects, e.name), 0);
-      if (!files.length) continue;
-      history.claude = true;
-      files.sort((a, b) => b.mtime - a.mtime);
-      let cwd = null;
-      for (const f of files.slice(0, 3)) {
-        cwd = cwdFromTranscript(f.file);
-        if (cwd) break;
-      }
-      if (cwd) add(cwd, "claude", files[0].mtime, files.length);
-    }
-  } catch {
-  }
-  const codexSessions = jsonlFiles(join16(codexDir(), "sessions"), 4);
-  if (codexSessions.length) history.codex = true;
-  const perCwd = /* @__PURE__ */ new Map();
-  for (const f of codexSessions) {
-    const cwd = cwdFromTranscript(f.file);
-    if (!cwd) continue;
-    const cur = perCwd.get(cwd) ?? { mtime: 0, count: 0 };
-    cur.mtime = Math.max(cur.mtime, f.mtime);
-    cur.count += 1;
-    perCwd.set(cwd, cur);
-  }
-  for (const [cwd, v] of perCwd) add(cwd, "codex", v.mtime, v.count);
-  for (const p of codexTrustedPaths()) add(p, "codex", 0, 0, true);
-  let projects = [...byPath.values()];
-  let fromGitScan = false;
-  if (!projects.length) {
-    fromGitScan = true;
-    for (const repo of gitRepos()) {
-      let mtime = 0;
-      try {
-        mtime = statSync8(repo).mtimeMs;
-      } catch {
-      }
-      add(repo, "git", mtime, 0);
-    }
-    projects = [...byPath.values()];
-  }
-  projects.sort(
-    (a, b) => Number(b.sources.length > 1) - Number(a.sources.length > 1) || Number(b.trusted) - Number(a.trusted) || b.lastUsed - a.lastUsed || b.sessions - a.sessions
-  );
-  return {
-    root: flyspaceRoot(),
-    runners: detectRunners(history),
-    projects,
-    fromGitScan
-  };
-}
-function uniqueChannelName(raw, taken) {
-  const base = raw.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "project";
-  let name = base;
-  for (let i = 2; taken.has(name); i += 1) name = `${base}-${i}`;
-  taken.add(name);
-  return name;
-}
-function makeLink(target, linkPath) {
-  symlinkSync(target, linkPath, process.platform === "win32" ? "junction" : "dir");
-}
-function linkProjectFolders(slug, items) {
-  if (!/^[a-z0-9][a-z0-9-]*$/.test(slug)) throw new Error(`invalid workspace slug: ${slug}`);
-  const dir = join16(flyspaceRoot(), slug);
-  mkdirSync6(dir, { recursive: true });
-  const results = [];
-  for (const item of items) {
-    if (!/^[a-z0-9][a-z0-9-]*$/.test(item.name)) throw new Error(`invalid channel name: ${item.name}`);
-    const dest = join16(dir, item.name);
-    let exists = true;
-    try {
-      lstatSync2(dest);
-    } catch {
-      exists = false;
-    }
-    if (!exists) {
-      if (item.path) {
-        const target = resolve6(item.path);
-        if (!statSync8(target).isDirectory()) throw new Error(`not a directory: ${target}`);
-        makeLink(target, dest);
-      } else {
-        mkdirSync6(dest, { recursive: true });
-      }
-    }
-    results.push({ name: item.name, cwd: `${slug}/${item.name}` });
-  }
-  return results;
+  return `${text ?? fallbackGreeting(input2)}
+
+[BUTTONS: ${greetingButtons(input2).join(" | ")}]`;
 }
 
 // src/dashboard/onboarding-routes.ts
 var MAX_FOLDERS = 20;
 function createOnboardingRouter(agent) {
-  const app = new Hono25();
+  const app = new Hono27();
   app.get("/scan", async (c) => {
     const ctx = await resolveAuthContext(c);
     if (ctx?.role !== "admin") return c.json({ error: "admin access required" }, 403);
@@ -12848,9 +13452,54 @@ function createOnboardingRouter(agent) {
       await agent.saveLocalDashboardSettings?.({ providers: [{ runner }] });
     }
     const created = [];
-    for (const l of linked) created.push(await createChannel({ name: l.name, cwd: l.cwd }));
+    for (const l of linked) {
+      created.push(
+        l.name === "general" ? await ensureGeneralChannel() : await createChannel({ name: l.name, cwd: l.cwd })
+      );
+    }
+    await markWorkspaceProjectsSetup(ctx.workspaceId);
     return c.json({ channels: created.map((ch) => ({ id: ch.id, name: ch.name })) }, 201);
   });
+  app.post("/greeting", async (c) => {
+    const ctx = await resolveAuthContext(c);
+    if (ctx?.role !== "admin") return c.json({ error: "admin access required" }, 403);
+    const supabase = getSupabaseClient();
+    const general = await ensureGeneralChannel();
+    const existing = () => supabase.from("threads").select("id").eq("client_key", ctx.workspaceId).maybeSingle();
+    const found = await existing();
+    if (found.data) return c.json({ channelId: general.id, threadId: found.data.id });
+    const [branding, billing, members] = await Promise.all([
+      getWorkspaceBranding(getProfile()).catch(() => null),
+      getWorkspaceBilling(ctx.workspaceId).catch(() => null),
+      listMemberships(ctx.workspaceId).catch(() => [])
+    ]);
+    const workspaceName2 = branding?.displayName || getProfile();
+    const body = await buildGreeting({
+      ownerName: ctx.name?.trim() || ctx.handle,
+      workspaceName: workspaceName2,
+      trialing: billing?.planStatus === "trialing",
+      hostConnected: !!ctx.agentConnectedAt,
+      channels: getProfileChannelRegistry().filter((ch) => !ch.isDefault && !ch.dmKey && !ch.agentName && !ch.archivedAt).map((ch) => ch.name),
+      memberCount: members.length
+    });
+    const { data: thread, error: error2 } = await supabase.from("threads").insert({
+      channel_id: general.id,
+      title: `Welcome to ${workspaceName2}`,
+      author: AGENT_AUTHOR,
+      client_key: ctx.workspaceId
+    }).select("id").single();
+    if (error2) {
+      const raced = error2.code === "23505" ? (await existing()).data : null;
+      if (!raced) return c.json({ error: error2.message }, 500);
+      return c.json({ channelId: general.id, threadId: raced.id });
+    }
+    const reply = await supabase.from("thread_replies").insert({ thread_id: thread.id, author: AGENT_AUTHOR, body });
+    if (reply.error) {
+      await supabase.from("threads").delete().eq("id", thread.id);
+      return c.json({ error: reply.error.message }, 500);
+    }
+    return c.json({ channelId: general.id, threadId: thread.id }, 201);
+  });
   return app;
 }
 
@@ -12980,7 +13629,8 @@ function registerDataRoutes(api, agent = {}) {
       externalChannelId: ch.externalChannelId,
       categoryId: ch.categoryId,
       position: ch.position,
-      name: ch.name,
+      // A DM is stored as "<a>, <b>"; each side sees the other's handle.
+      name: ch.dmKey ? ch.name.split(", ").filter((h) => h !== auth.handle).join(", ") || ch.name : ch.name,
       configured: true,
       cwd: ch.cwd,
       // Surfaces a rotted working directory in the sidebar instead of
@@ -12993,18 +13643,20 @@ function registerDataRoutes(api, agent = {}) {
       visibility: ch.visibility,
       memberEmails: ch.memberEmails,
       agentName: ch.agentName,
+      dmKey: ch.dmKey,
       archived: !!ch.archivedAt
     }));
     return c.json({
       channels: list,
       defaultModel: defaultModel(),
       defaultEffort: defaultEffort() ?? null,
-      defaultCwd: defaultClaudeCwd()
+      defaultCwd: getProfile()
     });
   });
   api.get("/channels/:id/usage", async (c) => {
     const ctx = await resolveAuthContext(c);
     if (ctx?.role !== "admin") return c.json({ error: "admin access required" }, 403);
+    if (!await isFeatureEnabled(c, "ai-cost")) return c.json({ error: "feature not enabled" }, 403);
     const raw = Number.parseInt(c.req.query("days") ?? "7", 10);
     const days = Number.isFinite(raw) && raw >= 0 ? raw : 7;
     return c.json(await buildChannelUsageReport(c.req.param("id"), days, channelLabel));
@@ -13023,7 +13675,7 @@ function registerDataRoutes(api, agent = {}) {
         runs.set(name, { lastRun: run3.lastRunAt.toISOString(), lastStatus: run3.lastStatus });
       }
     } catch {
-      if (existsSync23(paths.DB_FILE)) {
+      if (existsSync22(paths.DB_FILE)) {
         const runStore = new AutomationRunStore(paths.DB_FILE);
         try {
           for (const run3 of runStore.listLastRuns()) {
@@ -13085,7 +13737,7 @@ function registerDataRoutes(api, agent = {}) {
       const runs = (await recentRunsForWorkspace(getProfile(), 200)).map(toResponse5);
       return c.json({ runs });
     } catch {
-      if (!existsSync23(paths.DB_FILE)) return c.json({ runs: [] });
+      if (!existsSync22(paths.DB_FILE)) return c.json({ runs: [] });
       const runStore = new AutomationRunStore(paths.DB_FILE);
       try {
         const runs = runStore.listRuns(200).map(toResponse5);
@@ -13105,13 +13757,19 @@ function registerDataRoutes(api, agent = {}) {
   api.get("/usage/threads/:threadTs", async (c) => {
     const ctx = await resolveAuthContext(c);
     if (ctx?.role !== "admin") return c.json({ error: "admin access required" }, 403);
+    if (!await isFeatureEnabled(c, "ai-cost")) return c.json({ error: "feature not enabled" }, 403);
     return c.json(await buildThreadUsage(c.req.param("threadTs")));
   });
   api.route("/automations", createAutomationWriteRouter());
   api.route("/billing", createBillingRouter());
   api.route("/chat", createChatRouter(agent));
   api.route("/search", createSearchRouter());
+  api.use("/tts/*", async (c, next) => {
+    if (!await isFeatureEnabled(c, "read-aloud")) return c.json({ error: "feature not enabled" }, 403);
+    await next();
+  });
   api.route("/tts", createTtsRouter());
+  api.route("/feature-flags", createFeatureFlagsRouter());
   api.route("/members", createMembersRouter());
   api.route("/notifications", createNotificationsRouter());
   api.route("/push", createPushRouter());
@@ -13158,6 +13816,7 @@ function registerDataRoutes(api, agent = {}) {
     return c.json({ paused: body.paused, cancelled });
   });
   api.route("/", createUploadsRouter());
+  api.route("/", createTranscribeRouter());
   api.route("/", createAvatarsRouter());
   api.get("/profiles", async (c) => {
     const active = getProfile();
@@ -13200,7 +13859,7 @@ function registerDataRoutes(api, agent = {}) {
     } catch {
       latest = /* @__PURE__ */ new Map();
       totals = /* @__PURE__ */ new Map();
-      if (existsSync23(paths.DB_FILE)) {
+      if (existsSync22(paths.DB_FILE)) {
         const usageStore = new UsageStore(paths.DB_FILE);
         try {
           latest = usageStore.latestByThread(threadTsList);
@@ -13210,65 +13869,321 @@ function registerDataRoutes(api, agent = {}) {
         }
       }
     }
-    const threadLinks = await resolveThreadLinks(raw);
-    const sessions = raw.map((s) => {
-      const run3 = latest.get(s.threadTs);
-      const turns = run3?.numTurns ?? 1;
-      const total = run3 ? run3.inputTokens + run3.cacheReadTokens + run3.cacheCreationTokens : void 0;
-      const link = s.channelId.startsWith("chat:") ? threadLinks.chat.get(s.threadTs) : threadLinks.external.get(`${s.channelId}:${s.threadTs}`);
-      return {
-        ...s,
-        channelLabel: channelLabel(s.channelId),
-        model: run3?.model,
-        numTurns: run3?.numTurns,
-        contextTokens: total !== void 0 ? Math.round(total / (turns > 0 ? turns : 1)) : void 0,
-        rolledOver: run3?.label === "rollover",
-        threadTitle: link?.title ?? void 0,
-        chatChannelId: link?.chatChannelId,
-        chatThreadId: link?.chatThreadId,
-        costUsd: totals.get(s.threadTs)?.costUsd
-      };
-    });
-    return c.json({ sessions });
-  });
-  const LOGO_SIZE = 256;
-  const MAX_LOGO_BYTES = 2 * 1024 * 1024;
-  const LOGO_MIME_TYPES = ["image/png", "image/jpeg"];
-  api.post("/settings/logo", async (c) => {
-    const body = await c.req.parseBody().catch(() => null);
-    const file = body?.["file"];
-    if (!(file instanceof File)) return c.json({ error: "missing file" }, 400);
-    if (!LOGO_MIME_TYPES.includes(file.type)) {
-      return c.json({ error: "logo must be a PNG or JPEG image" }, 400);
+    const threadLinks = await resolveThreadLinks(raw);
+    const sessions = raw.map((s) => {
+      const run3 = latest.get(s.threadTs);
+      const turns = run3?.numTurns ?? 1;
+      const total = run3 ? run3.inputTokens + run3.cacheReadTokens + run3.cacheCreationTokens : void 0;
+      const link = s.channelId.startsWith("chat:") ? threadLinks.chat.get(s.threadTs) : threadLinks.external.get(`${s.channelId}:${s.threadTs}`);
+      return {
+        ...s,
+        channelLabel: channelLabel(s.channelId),
+        model: run3?.model,
+        numTurns: run3?.numTurns,
+        contextTokens: total !== void 0 ? Math.round(total / (turns > 0 ? turns : 1)) : void 0,
+        rolledOver: run3?.label === "rollover",
+        threadTitle: link?.title ?? void 0,
+        chatChannelId: link?.chatChannelId,
+        chatThreadId: link?.chatThreadId,
+        costUsd: totals.get(s.threadTs)?.costUsd
+      };
+    });
+    return c.json({ sessions });
+  });
+  const LOGO_SIZE = 256;
+  const MAX_LOGO_BYTES = 2 * 1024 * 1024;
+  const LOGO_MIME_TYPES = ["image/png", "image/jpeg"];
+  api.post("/settings/logo", async (c) => {
+    const body = await c.req.parseBody().catch(() => null);
+    const file = body?.["file"];
+    if (!(file instanceof File)) return c.json({ error: "missing file" }, 400);
+    if (!LOGO_MIME_TYPES.includes(file.type)) {
+      return c.json({ error: "logo must be a PNG or JPEG image" }, 400);
+    }
+    if (file.size > MAX_LOGO_BYTES) {
+      return c.json({ error: "logo must be 2MB or smaller" }, 400);
+    }
+    const original = Buffer.from(await file.arrayBuffer());
+    const resized = await sharp5(original).resize({ width: LOGO_SIZE, height: LOGO_SIZE, fit: "cover" }).png().toBuffer();
+    const logo = `data:image/png;base64,${resized.toString("base64")}`;
+    return c.json(await saveWorkspaceBranding({ logo }));
+  });
+  api.delete("/settings/logo", async (c) => c.json(await saveWorkspaceBranding({ logo: null })));
+}
+
+// src/dashboard/device-auth-routes.ts
+import { verify } from "crypto";
+import { getConnInfo } from "@hono/node-server/conninfo";
+import { Hono as Hono28 } from "hono";
+
+// src/dashboard/agent-bridge.ts
+import { randomBytes as randomBytes8, randomUUID as randomUUID4, sign as signRaw, timingSafeEqual as timingSafeEqual2, verify as verifyRaw } from "crypto";
+
+// src/dashboard/onboarding-scan.ts
+import { execFileSync as execFileSync2 } from "child_process";
+import {
+  existsSync as existsSync23,
+  lstatSync as lstatSync2,
+  mkdirSync as mkdirSync6,
+  readdirSync as readdirSync4,
+  readFileSync as readFileSync11,
+  statSync as statSync8,
+  symlinkSync
+} from "fs";
+import { homedir as homedir8 } from "os";
+import { basename as basename5, join as join17, resolve as resolve6 } from "path";
+var MAX_JSONL_HEAD_BYTES = 64 * 1024;
+var GIT_SCAN_ROOTS = ["Workspaces", "Projects", "code"];
+function flyspaceRoot() {
+  return process.env["FLYSPACE_ROOT"] || join17(homedir8(), "Flyspace");
+}
+function onPath(cmd) {
+  try {
+    execFileSync2(process.platform === "win32" ? "where" : "which", [cmd], { stdio: "ignore" });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function claudeDir() {
+  return process.env["CLAUDE_CONFIG_DIR"] || join17(homedir8(), ".claude");
+}
+function codexDir() {
+  return process.env["CODEX_HOME"] || join17(homedir8(), ".codex");
+}
+function claudeLoggedIn() {
+  if (process.env["ANTHROPIC_API_KEY"]) return true;
+  if (existsSync23(join17(claudeDir(), ".credentials.json"))) return true;
+  try {
+    const raw = JSON.parse(readFileSync11(join17(homedir8(), ".claude.json"), "utf-8"));
+    if (raw.oauthAccount) return true;
+  } catch {
+  }
+  if (process.platform !== "darwin") return false;
+  try {
+    execFileSync2("security", ["find-generic-password", "-s", "Claude Code-credentials"], {
+      stdio: "ignore"
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function codexLoggedIn() {
+  return !!process.env["OPENAI_API_KEY"] || existsSync23(join17(codexDir(), "auth.json"));
+}
+function jsonlFiles(dir, depth) {
+  const out = [];
+  let entries2;
+  try {
+    entries2 = readdirSync4(dir, { withFileTypes: true });
+  } catch {
+    return out;
+  }
+  for (const e of entries2) {
+    const full = join17(dir, e.name);
+    if (e.isDirectory()) {
+      if (depth > 0) out.push(...jsonlFiles(full, depth - 1));
+    } else if (e.name.endsWith(".jsonl")) {
+      try {
+        out.push({ file: full, mtime: statSync8(full).mtimeMs });
+      } catch {
+      }
+    }
+  }
+  return out;
+}
+function cwdFromTranscript(file) {
+  let head;
+  try {
+    head = readFileSync11(file, { encoding: "utf-8", flag: "r" }).slice(0, MAX_JSONL_HEAD_BYTES);
+  } catch {
+    return null;
+  }
+  for (const line of head.split("\n")) {
+    if (!line.includes('"cwd"')) continue;
+    try {
+      const obj = JSON.parse(line);
+      const cwd = obj.cwd ?? obj.payload?.cwd;
+      if (typeof cwd === "string" && cwd) return cwd;
+    } catch {
+    }
+  }
+  return null;
+}
+function codexTrustedPaths() {
+  try {
+    const toml = readFileSync11(join17(codexDir(), "config.toml"), "utf-8");
+    return [...toml.matchAll(/^\[projects\.(?:"([^"]+)"|'([^']+)')\]/gm)].map((m) => m[1] ?? m[2]);
+  } catch {
+    return [];
+  }
+}
+function isExcluded(path) {
+  const home = homedir8();
+  if (path === home || path === "/") return true;
+  if (path === "/tmp" || path.startsWith("/tmp/")) return true;
+  if (path === "/private/tmp" || path.startsWith("/private/tmp/")) return true;
+  const root = flyspaceRoot();
+  if (path === root || path.startsWith(`${root}/`)) return true;
+  try {
+    return !statSync8(path).isDirectory();
+  } catch {
+    return true;
+  }
+}
+function gitRepos() {
+  const home = homedir8();
+  const found = [];
+  for (const rootName of GIT_SCAN_ROOTS) {
+    const root = join17(home, rootName);
+    let entries2;
+    try {
+      entries2 = readdirSync4(root, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const e of entries2) {
+      if (e.isDirectory() && existsSync23(join17(root, e.name, ".git"))) found.push(join17(root, e.name));
+    }
+  }
+  return found;
+}
+function detectRunners(history = { claude: false, codex: false }) {
+  return [
+    {
+      id: "claude",
+      installed: onPath("claude"),
+      loggedIn: claudeLoggedIn(),
+      hasHistory: history.claude
+    },
+    {
+      id: "codex",
+      installed: onPath("codex"),
+      loggedIn: codexLoggedIn(),
+      hasHistory: history.codex
+    }
+  ];
+}
+function scanOnboarding() {
+  const byPath = /* @__PURE__ */ new Map();
+  const history = { claude: false, codex: false };
+  const add = (rawPath, source, mtime, sessions, trusted = false) => {
+    const path = resolve6(rawPath);
+    if (isExcluded(path)) return;
+    const existing = byPath.get(path);
+    if (existing) {
+      if (!existing.sources.includes(source)) existing.sources.push(source);
+      existing.lastUsed = Math.max(existing.lastUsed, mtime);
+      existing.sessions += sessions;
+      existing.trusted ||= trusted;
+    } else {
+      byPath.set(path, {
+        path,
+        name: basename5(path),
+        sources: [source],
+        lastUsed: mtime,
+        sessions,
+        trusted
+      });
+    }
+  };
+  const claudeProjects = join17(claudeDir(), "projects");
+  try {
+    for (const e of readdirSync4(claudeProjects, { withFileTypes: true })) {
+      if (!e.isDirectory()) continue;
+      const files = jsonlFiles(join17(claudeProjects, e.name), 0);
+      if (!files.length) continue;
+      history.claude = true;
+      files.sort((a, b) => b.mtime - a.mtime);
+      let cwd = null;
+      for (const f of files.slice(0, 3)) {
+        cwd = cwdFromTranscript(f.file);
+        if (cwd) break;
+      }
+      if (cwd) add(cwd, "claude", files[0].mtime, files.length);
+    }
+  } catch {
+  }
+  const codexSessions = jsonlFiles(join17(codexDir(), "sessions"), 4);
+  if (codexSessions.length) history.codex = true;
+  const perCwd = /* @__PURE__ */ new Map();
+  for (const f of codexSessions) {
+    const cwd = cwdFromTranscript(f.file);
+    if (!cwd) continue;
+    const cur = perCwd.get(cwd) ?? { mtime: 0, count: 0 };
+    cur.mtime = Math.max(cur.mtime, f.mtime);
+    cur.count += 1;
+    perCwd.set(cwd, cur);
+  }
+  for (const [cwd, v] of perCwd) add(cwd, "codex", v.mtime, v.count);
+  for (const p of codexTrustedPaths()) add(p, "codex", 0, 0, true);
+  let projects = [...byPath.values()];
+  let fromGitScan = false;
+  if (!projects.length) {
+    fromGitScan = true;
+    for (const repo of gitRepos()) {
+      let mtime = 0;
+      try {
+        mtime = statSync8(repo).mtimeMs;
+      } catch {
+      }
+      add(repo, "git", mtime, 0);
+    }
+    projects = [...byPath.values()];
+  }
+  projects.sort(
+    (a, b) => Number(b.sources.length > 1) - Number(a.sources.length > 1) || Number(b.trusted) - Number(a.trusted) || b.lastUsed - a.lastUsed || b.sessions - a.sessions
+  );
+  return {
+    root: flyspaceRoot(),
+    runners: detectRunners(history),
+    projects,
+    fromGitScan
+  };
+}
+function makeLink(target, linkPath) {
+  symlinkSync(target, linkPath, process.platform === "win32" ? "junction" : "dir");
+}
+function linkProjectFolders(slug, items) {
+  if (!/^[a-z0-9][a-z0-9-]*$/.test(slug)) throw new Error(`invalid workspace slug: ${slug}`);
+  const dir = join17(flyspaceRoot(), slug);
+  mkdirSync6(dir, { recursive: true });
+  const results = [];
+  for (const item of items) {
+    if (!/^[a-z0-9][a-z0-9-]*$/.test(item.name)) throw new Error(`invalid channel name: ${item.name}`);
+    const dest = join17(dir, item.name);
+    let exists = true;
+    try {
+      lstatSync2(dest);
+    } catch {
+      exists = false;
     }
-    if (file.size > MAX_LOGO_BYTES) {
-      return c.json({ error: "logo must be 2MB or smaller" }, 400);
+    if (!exists) {
+      if (item.path) {
+        const target = resolve6(item.path);
+        if (!statSync8(target).isDirectory()) throw new Error(`not a directory: ${target}`);
+        makeLink(target, dest);
+      } else {
+        mkdirSync6(dest, { recursive: true });
+      }
     }
-    const original = Buffer.from(await file.arrayBuffer());
-    const resized = await sharp5(original).resize({ width: LOGO_SIZE, height: LOGO_SIZE, fit: "cover" }).png().toBuffer();
-    const logo = `data:image/png;base64,${resized.toString("base64")}`;
-    return c.json(await saveWorkspaceBranding({ logo }));
-  });
-  api.delete("/settings/logo", async (c) => c.json(await saveWorkspaceBranding({ logo: null })));
+    results.push({ name: item.name, cwd: `${slug}/${item.name}` });
+  }
+  return results;
 }
 
-// src/dashboard/device-auth-routes.ts
-import { verify } from "crypto";
-import { getConnInfo } from "@hono/node-server/conninfo";
-import { Hono as Hono26 } from "hono";
-
 // src/dashboard/agent-bridge.ts
-import { randomBytes as randomBytes7, randomUUID as randomUUID3, sign as signRaw, verify as verifyRaw } from "crypto";
-import { existsSync as existsSync26, readFileSync as readFileSync15 } from "fs";
+import { existsSync as existsSync26, readFileSync as readFileSync16 } from "fs";
 import dotenv from "dotenv";
 import { WebSocket, WebSocketServer } from "ws";
 
 // src/dashboard/host-identity.ts
 import { createPrivateKey, createPublicKey, generateKeyPairSync } from "crypto";
 import { existsSync as existsSync24, mkdirSync as mkdirSync7, readFileSync as readFileSync12, writeFileSync as writeFileSync7 } from "fs";
-import { dirname as dirname5, join as join17 } from "path";
+import { dirname as dirname5, join as join18 } from "path";
 function hostPrivateKeyPath() {
-  return process.env["FLYSPACE_HOST_KEY_PATH"] || join17(paths.BASE_CONFIG_DIR, "host.key");
+  return process.env["FLYSPACE_HOST_KEY_PATH"] || join18(paths.BASE_CONFIG_DIR, "host.key");
 }
 function loadHostPrivateKey(path = hostPrivateKeyPath()) {
   if (!existsSync24(path)) {
@@ -13289,8 +14204,84 @@ function loadHostPublicKey() {
   }
 }
 
+// src/dashboard/host-lock.ts
+import { execFileSync as execFileSync3 } from "child_process";
+import { randomBytes as randomBytes5 } from "crypto";
+import { mkdirSync as mkdirSync8, readFileSync as readFileSync13, rmSync as rmSync4, writeFileSync as writeFileSync8 } from "fs";
+import { join as join19 } from "path";
+function hostLockPath() {
+  return join19(paths.BASE_DATA_DIR, "host.lock");
+}
+function isLiveFlyspace(pid) {
+  try {
+    process.kill(pid, 0);
+    const command = execFileSync3("ps", ["-p", String(pid), "-o", "command="], {
+      encoding: "utf8"
+    });
+    return command.includes("flyspace") || command.includes("host-server");
+  } catch {
+    return false;
+  }
+}
+function readLockPid(path) {
+  try {
+    const pid = Number(JSON.parse(readFileSync13(path, "utf8")).pid);
+    return Number.isInteger(pid) && pid > 0 ? pid : null;
+  } catch {
+    return null;
+  }
+}
+function acquireHostLock() {
+  const path = hostLockPath();
+  mkdirSync8(paths.BASE_DATA_DIR, { recursive: true });
+  const body = JSON.stringify({
+    pid: process.pid,
+    startedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    execPath: process.argv[1] ?? ""
+  });
+  for (let attempt = 0; attempt < 2; attempt++) {
+    try {
+      writeFileSync8(path, body, { flag: "wx", mode: 384 });
+      const release2 = () => {
+        if (readLockPid(path) === process.pid) rmSync4(path, { force: true });
+      };
+      process.once("exit", release2);
+      return release2;
+    } catch (err) {
+      if (err.code !== "EEXIST") throw err;
+      const holder = readLockPid(path);
+      if (holder === process.pid) return () => {
+      };
+      if (holder && isLiveFlyspace(holder)) {
+        throw new Error(
+          `Another Flyspace Host is already running on this machine (pid ${holder}). Stop it first, or check for a second CLI install (\`which -a flyspace\`). Two Hosts overwrite each other's skill mirror.`
+        );
+      }
+      rmSync4(path, { force: true });
+    }
+  }
+  throw new Error(`Could not take the Host lock at ${path}`);
+}
+function publishHostEndpoint(port) {
+  const path = hostLockPath();
+  if (readLockPid(path) !== process.pid) return null;
+  const token = randomBytes5(32).toString("hex");
+  const lock = JSON.parse(readFileSync13(path, "utf8"));
+  writeFileSync8(path, JSON.stringify({ ...lock, port, token }), { mode: 384 });
+  return token;
+}
+function readHostEndpoint() {
+  try {
+    const { pid, port, token } = JSON.parse(readFileSync13(hostLockPath(), "utf8"));
+    if (pid === process.pid || !Number.isInteger(port) || typeof token !== "string") return null;
+    return { port, token };
+  } catch {
+    return null;
+  }
+}
+
 // src/store/device-store.ts
-import { createHash as createHash10, createPublicKey as createPublicKey2, randomBytes as randomBytes5, randomInt } from "crypto";
+import { createHash as createHash10, createPublicKey as createPublicKey2, randomBytes as randomBytes6, randomInt } from "crypto";
 var DEVICE_CODE_TTL_MS = 10 * 6e4;
 var ACCESS_TOKEN_TTL_MS = 15 * 6e4;
 var CHALLENGE_TTL_MS = 2 * 6e4;
@@ -13349,7 +14340,7 @@ function fail(what, error2) {
 async function createDeviceCode(input2) {
   const db = getSupabaseClient();
   await db.from("device_codes").delete().lt("expires_at", (/* @__PURE__ */ new Date()).toISOString());
-  const deviceCode = randomBytes5(32).toString("hex");
+  const deviceCode = randomBytes6(32).toString("hex");
   for (let attempt = 0; attempt < 3; attempt++) {
     const userCode = generateUserCode();
     const { error: error2 } = await db.from("device_codes").insert({
@@ -13387,26 +14378,28 @@ async function decideDeviceCode(id, userId, decision) {
   if (error2) fail("decideDeviceCode", error2);
   return (data ?? []).length > 0;
 }
-async function redeemDeviceCode(pending2) {
+async function redeemDeviceCode(pending3) {
   const db = getSupabaseClient();
-  const { data: claimed, error: claimError } = await db.from("device_codes").delete().eq("id", pending2.id).select("id");
+  const { data: claimed, error: claimError } = await db.from("device_codes").delete().eq("id", pending3.id).select("id");
   if (claimError) fail("redeemDeviceCode", claimError);
   if (!claimed?.length) return null;
-  const { data, error: error2 } = await db.from("devices").insert({
-    user_id: pending2.approvedBy,
-    name: pending2.name,
-    platform: pending2.platform,
-    public_key: pending2.publicKey
+  const existing = pending3.approvedBy ? await findDeviceByKey(pending3.publicKey, pending3.approvedBy) : null;
+  const { data, error: error2 } = existing ? await db.from("devices").update({ name: pending3.name, platform: pending3.platform }).eq("id", existing.id).select("*").single() : await db.from("devices").insert({
+    user_id: pending3.approvedBy,
+    name: pending3.name,
+    platform: pending3.platform,
+    public_key: pending3.publicKey
   }).select("*").single();
   if (error2) fail("redeemDeviceCode", error2);
   const device = toDevice(data);
-  if (pending2.workspaceIds.length) {
-    const { error: bindError } = await db.from("device_workspaces").insert(
-      pending2.workspaceIds.map((workspaceId) => ({
+  if (pending3.workspaceIds.length) {
+    const { error: bindError } = await db.from("device_workspaces").upsert(
+      pending3.workspaceIds.map((workspaceId) => ({
         device_id: device.id,
         workspace_id: workspaceId,
-        bound_by: pending2.approvedBy
-      }))
+        bound_by: pending3.approvedBy
+      })),
+      { onConflict: "device_id,workspace_id", ignoreDuplicates: true }
     );
     if (bindError) fail("redeemDeviceCode", bindError);
   }
@@ -13417,8 +14410,13 @@ async function getDevice(id) {
   if (error2) fail("getDevice", error2);
   return data ? toDevice(data) : null;
 }
+async function findDeviceByKey(publicKey, userId) {
+  const { data, error: error2 } = await getSupabaseClient().from("devices").select("*").eq("public_key", publicKey).eq("user_id", userId).is("revoked_at", null).order("created_at", { ascending: false }).limit(1).maybeSingle();
+  if (error2) fail("findDeviceByKey", error2);
+  return data ? toDevice(data) : null;
+}
 async function issueAccessToken(deviceId) {
-  const token = `fsd_${randomBytes5(32).toString("hex")}`;
+  const token = `fsd_${randomBytes6(32).toString("hex")}`;
   const { error: error2 } = await getSupabaseClient().from("devices").update({
     access_token_hash: sha256(token),
     access_token_expires_at: new Date(Date.now() + ACCESS_TOKEN_TTL_MS).toISOString(),
@@ -13440,7 +14438,7 @@ async function revokeDevice(id) {
 async function createChallenge(deviceId) {
   const db = getSupabaseClient();
   await db.from("device_challenges").delete().lt("expires_at", (/* @__PURE__ */ new Date()).toISOString());
-  const nonce = randomBytes5(32).toString("base64url");
+  const nonce = randomBytes6(32).toString("base64url");
   const { error: error2 } = await db.from("device_challenges").insert({
     nonce,
     device_id: deviceId,
@@ -13465,11 +14463,28 @@ async function listDeviceWorkspaces(device) {
   const bound = new Set((data ?? []).map((r) => r.workspace_id));
   return (await listAdminWorkspaces(device.userId)).filter((w) => bound.has(w.id));
 }
+async function bindDeviceWorkspace(deviceId, workspaceId, boundBy) {
+  const { error: error2 } = await getSupabaseClient().from("device_workspaces").upsert(
+    { device_id: deviceId, workspace_id: workspaceId, bound_by: boundBy },
+    { onConflict: "device_id,workspace_id", ignoreDuplicates: true }
+  );
+  if (error2) fail("bindDeviceWorkspace", error2);
+}
 async function listWorkspaceDevices(workspaceId) {
   const { data, error: error2 } = await getSupabaseClient().from("device_workspaces").select("devices!inner(*)").eq("workspace_id", workspaceId).is("devices.revoked_at", null);
   if (error2) fail("listWorkspaceDevices", error2);
   return (data ?? []).map((r) => toDevice(r.devices)).sort((a, b) => b.createdAt.localeCompare(a.createdAt));
 }
+async function listWorkspaceHosts(workspaceIds, exceptPublicKey) {
+  const hosts2 = /* @__PURE__ */ new Map();
+  if (!workspaceIds.length) return hosts2;
+  const { data, error: error2 } = await getSupabaseClient().from("device_workspaces").select("workspace_id, devices!inner(name, public_key, revoked_at)").in("workspace_id", workspaceIds).is("devices.revoked_at", null);
+  if (error2) fail("listWorkspaceHosts", error2);
+  for (const r of data ?? []) {
+    if (r.devices.public_key !== exceptPublicKey) hosts2.set(r.workspace_id, r.devices.name);
+  }
+  return hosts2;
+}
 async function userEmail(userId) {
   const { data, error: error2 } = await getSupabaseClient().auth.admin.getUserById(userId);
   if (error2) return null;
@@ -13478,8 +14493,8 @@ async function userEmail(userId) {
 
 // src/auth/device-auth.ts
 import { createPrivateKey as createPrivateKey2, createPublicKey as createPublicKey3, generateKeyPairSync as generateKeyPairSync2, sign } from "crypto";
-import { existsSync as existsSync25, mkdirSync as mkdirSync8, readFileSync as readFileSync13, rmSync as rmSync4, writeFileSync as writeFileSync8 } from "fs";
-import { dirname as dirname6, join as join18 } from "path";
+import { existsSync as existsSync25, mkdirSync as mkdirSync9, readFileSync as readFileSync14, rmSync as rmSync5, writeFileSync as writeFileSync9 } from "fs";
+import { dirname as dirname6, join as join20 } from "path";
 var DEFAULT_API_URL = "https://app.flyspace.ai";
 var EXPIRY_SKEW_MS = 6e4;
 var AuthApiError = class extends Error {
@@ -13493,20 +14508,20 @@ function apiUrl() {
   return (process.env["FLYSPACE_API_URL"] || DEFAULT_API_URL).replace(/\/+$/, "");
 }
 function deviceKeyPath() {
-  return join18(paths.BASE_CONFIG_DIR, "device.key");
+  return join20(paths.BASE_CONFIG_DIR, "device.key");
 }
 function credentialsPath() {
-  return join18(paths.BASE_CONFIG_DIR, "credentials.json");
+  return join20(paths.BASE_CONFIG_DIR, "credentials.json");
 }
 function ensureDeviceKey(path = deviceKeyPath()) {
   let created = false;
   if (!existsSync25(path)) {
     const { privateKey: privateKey2 } = generateKeyPairSync2("ed25519");
-    mkdirSync8(dirname6(path), { recursive: true });
-    writeFileSync8(path, privateKey2.export({ type: "pkcs8", format: "pem" }), { mode: 384 });
+    mkdirSync9(dirname6(path), { recursive: true });
+    writeFileSync9(path, privateKey2.export({ type: "pkcs8", format: "pem" }), { mode: 384 });
     created = true;
   }
-  const privateKey = createPrivateKey2(readFileSync13(path, "utf8"));
+  const privateKey = createPrivateKey2(readFileSync14(path, "utf8"));
   const publicKeyBase64 = createPublicKey3(privateKey).export({ type: "spki", format: "der" }).toString(
     "base64"
   );
@@ -13515,19 +14530,19 @@ function ensureDeviceKey(path = deviceKeyPath()) {
 function loadCredentials(path = credentialsPath()) {
   if (!existsSync25(path)) return null;
   try {
-    return JSON.parse(readFileSync13(path, "utf8"));
+    return JSON.parse(readFileSync14(path, "utf8"));
   } catch {
     return null;
   }
 }
 function saveCredentials(creds, path = credentialsPath()) {
-  mkdirSync8(dirname6(path), { recursive: true });
-  writeFileSync8(path, `${JSON.stringify(creds, null, 2)}
+  mkdirSync9(dirname6(path), { recursive: true });
+  writeFileSync9(path, `${JSON.stringify(creds, null, 2)}
 `, { mode: 384 });
 }
 function clearLocalAuth() {
-  rmSync4(credentialsPath(), { force: true });
-  rmSync4(deviceKeyPath(), { force: true });
+  rmSync5(credentialsPath(), { force: true });
+  rmSync5(deviceKeyPath(), { force: true });
 }
 async function post(base, path, body, token) {
   return fetch(`${base}${path}`, {
@@ -13644,14 +14659,14 @@ async function getAccessToken() {
 }
 
 // src/dashboard/doc-share-publisher.ts
-import { randomBytes as randomBytes6 } from "crypto";
-import { readFileSync as readFileSync14, statSync as statSync9 } from "fs";
+import { randomBytes as randomBytes7 } from "crypto";
+import { readFileSync as readFileSync15, statSync as statSync9 } from "fs";
 import { extname as extname2, posix } from "path";
 import { CopyObjectCommand, PutObjectCommand as PutObjectCommand5 } from "@aws-sdk/client-s3";
 
 // src/dashboard/share-language.ts
-var GROQ_API_URL7 = "https://api.groq.com/openai/v1/chat/completions";
-var CLASSIFIER_MODEL3 = "openai/gpt-oss-20b";
+var GROQ_API_URL9 = "https://api.groq.com/openai/v1/chat/completions";
+var CLASSIFIER_MODEL4 = "openai/gpt-oss-20b";
 var SAMPLE_CHARS = 4e3;
 var NOISE = [
   /```[\s\S]*?```/g,
@@ -13689,11 +14704,11 @@ async function detectSourceLanguage(title, content) {
   const sample = languageSample(title, content);
   if (sample.length < MIN_SAMPLE_CHARS) return null;
   try {
-    const res = await fetch(GROQ_API_URL7, {
+    const res = await fetch(GROQ_API_URL9, {
       method: "POST",
       headers: { "content-type": "application/json", authorization: `Bearer ${apiKey}` },
       body: JSON.stringify({
-        model: CLASSIFIER_MODEL3,
+        model: CLASSIFIER_MODEL4,
         temperature: 0,
         reasoning_effort: "low",
         // gpt-oss reasons before it answers, and those tokens count against
@@ -13765,10 +14780,11 @@ function shareKindOf(absPath) {
   const ext = extname2(absPath).toLowerCase();
   if (ext === ".md" || ext === ".markdown") return "markdown";
   if (ext === ".html" || ext === ".htm") return "html";
+  if (ext === ".excalidraw") return "excalidraw";
   return null;
 }
 function generateShareId() {
-  return randomBytes6(9).toString("base64url");
+  return randomBytes7(9).toString("base64url");
 }
 function isExternalHref(href) {
   return /^[a-z][a-z0-9+.-]*:/i.test(href) || href.startsWith("//") || href.startsWith("#");
@@ -13831,8 +14847,17 @@ async function buildSnapshot(cwd, sourcePath, shareId) {
   }
   if (!stat.isFile()) return { status: "not-found" };
   if (stat.size > MAX_CONTENT_BYTES2) return { status: "too-large" };
-  const source = readFileSync14(abs, "utf8");
-  const title = extractTitle(abs, kind === "html" ? "html" : "md");
+  const source = readFileSync15(abs, "utf8");
+  const title = extractTitle(abs, kind === "markdown" ? "md" : kind);
+  if (kind === "excalidraw") {
+    try {
+      const parsed = JSON.parse(source);
+      if (!parsed || typeof parsed !== "object") return { status: "unsupported" };
+    } catch {
+      return { status: "unsupported" };
+    }
+    return { kind, title, content: source, assetKeys: [] };
+  }
   const docDir = sourcePath.includes("/") ? sourcePath.slice(0, sourcePath.lastIndexOf("/")) : "";
   const client2 = getR2Client();
   const bucket = getR2Bucket();
@@ -13902,7 +14927,7 @@ async function buildSnapshot(cwd, sourcePath, shareId) {
       let text = null;
       try {
         const size = statSync9(docAbs).size;
-        if (size <= budget) text = readFileSync14(docAbs, "utf8");
+        if (size <= budget) text = readFileSync15(docAbs, "utf8");
       } catch {
         continue;
       }
@@ -13919,7 +14944,7 @@ async function buildSnapshot(cwd, sourcePath, shareId) {
     let body;
     try {
       if (statSync9(resolved2.abs).size > MAX_ASSET_BYTES) continue;
-      body = readFileSync14(resolved2.abs);
+      body = readFileSync15(resolved2.abs);
     } catch {
       continue;
     }
@@ -13956,7 +14981,7 @@ async function publishDocShare(input2) {
   const shareId = existing?.id ?? generateShareId();
   const built = await buildSnapshot(input2.cwd, input2.sourcePath, shareId);
   if ("status" in built) return built;
-  const html = built.kind === "html";
+  const html = built.kind !== "markdown";
   const features = html ? HTML_FEATURES : resolveFeatures(input2.features, existing);
   const snapshot2 = {
     ...built,
@@ -13990,6 +15015,281 @@ async function publishDocShare(input2) {
   return { status: "ok", share };
 }
 
+// src/dashboard/host-db-proxy.ts
+var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var SLUG_COLUMN = {
+  workspaces: "slug",
+  channels: "profile",
+  automations: "profile",
+  agent_usage: "workspace",
+  skill_files: "workspace"
+};
+var ALL = ["GET", "HEAD", "POST", "PATCH", "DELETE"];
+var METHODS = {
+  workspaces: ["GET", "HEAD"],
+  channels: ALL,
+  automations: ALL,
+  agent_usage: ["GET", "HEAD", "POST"],
+  skill_files: ALL,
+  threads: ["GET", "HEAD", "POST", "PATCH"],
+  thread_replies: ["GET", "HEAD", "POST", "PATCH"]
+};
+var FORWARDED_HEADERS = ["accept", "content-type", "prefer", "range"];
+var deny = (message, status = 403) => ({
+  status,
+  headers: { "content-type": "application/json" },
+  body: JSON.stringify({ code: "FLYSPACE_DENIED", message, details: null, hint: null })
+});
+var inList = (values) => `in.(${values.map((v) => `"${v.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`).join(",")})`;
+function filterValues(raw) {
+  if (raw.startsWith("eq.")) return [raw.slice(3)];
+  if (raw.startsWith("in.(") && raw.endsWith(")")) {
+    const inner = raw.slice(4, -1);
+    return inner === "" ? [] : inner.split(",").map((v) => v.replace(/^"|"$/g, ""));
+  }
+  return null;
+}
+function bodyRows(body) {
+  if (!body) return [];
+  try {
+    const parsed = JSON.parse(body);
+    const rows = Array.isArray(parsed) ? parsed : [parsed];
+    return rows.every((r) => r && typeof r === "object") ? rows : null;
+  } catch {
+    return null;
+  }
+}
+async function getJson(forward, path) {
+  const res = await forward({ method: "GET", path, headers: { accept: "application/json" } });
+  if (res.status !== 200) return null;
+  try {
+    return JSON.parse(res.body);
+  } catch {
+    return null;
+  }
+}
+async function ownedChannelIds(forward, slugs) {
+  const rows = await getJson(
+    forward,
+    `/rest/v1/channels?select=id,external_channel_id&profile=${encodeURIComponent(inList(slugs))}`
+  );
+  if (!rows) return null;
+  return rows.flatMap((r) => [r.id, r.external_channel_id].filter((v) => !!v));
+}
+async function threadsOwned(forward, threadIds, channelIds) {
+  const wanted = [...new Set(threadIds)];
+  if (wanted.length === 0 || channelIds.length === 0) return false;
+  const rows = await getJson(
+    forward,
+    `/rest/v1/threads?select=id&id=${encodeURIComponent(inList(wanted))}&channel_id=${encodeURIComponent(inList(channelIds))}`
+  );
+  return !!rows && new Set(rows.map((r) => r.id)).size === wanted.length;
+}
+async function replyThreadIds(forward, method, params, rows) {
+  if (method === "POST") {
+    const ids = rows.map((r) => r["thread_id"]);
+    return ids.length > 0 && ids.every((v) => typeof v === "string" && UUID.test(v)) ? ids : null;
+  }
+  const threadFilters = params.getAll("thread_id").map(filterValues);
+  if (threadFilters.length > 0) {
+    const ids = threadFilters.flatMap((v) => v ?? [""]);
+    return ids.length > 0 && ids.every((v) => UUID.test(v)) ? ids : null;
+  }
+  const idFilters = params.getAll("id").map(filterValues);
+  const replyIds = idFilters.flatMap((v) => v ?? [""]);
+  if (replyIds.length === 0 || !replyIds.every((v) => UUID.test(v))) return null;
+  const found = await getJson(
+    forward,
+    `/rest/v1/thread_replies?select=id,thread_id&id=${encodeURIComponent(inList(replyIds))}`
+  );
+  if (!found || found.length !== new Set(replyIds).size) return null;
+  return found.map((r) => r.thread_id);
+}
+async function proxyHostDb(workspaces, req, forward, assigned = workspaces ?? []) {
+  if (!workspaces) return deny("This Host is not bound to a workspace.");
+  if (workspaces.length === 0) return deny("This device has no workspace.");
+  const url = new URL(req.path, "http://proxy.invalid");
+  const match = /^\/rest\/v1\/([a-z_]+)$/.exec(url.pathname);
+  const table = match?.[1];
+  if (!table || !(table in METHODS)) return deny(`Table is not available to a Host: ${url.pathname}`);
+  const method = req.method.toUpperCase();
+  if (!METHODS[table].includes(method)) return deny(`${method} ${table} is not available to a Host.`);
+  const params = url.searchParams;
+  const isWrite = method === "POST" || method === "PATCH" || method === "DELETE";
+  const rows = method === "POST" ? bodyRows(req.body) : [];
+  if (rows === null) return deny("Body must be a JSON object or array.", 400);
+  const slugColumn = SLUG_COLUMN[table];
+  if (slugColumn) {
+    const scope = table === "skill_files" && isWrite ? assigned : workspaces;
+    if (scope.length === 0) return deny(`This Host is not the assigned Host for any workspace it may write ${table} to.`);
+    if (method === "POST") {
+      const ok = rows.length > 0 && rows.every((r) => typeof r[slugColumn] === "string" && scope.includes(r[slugColumn]));
+      if (!ok) return deny(`Every ${table} row must belong to a workspace this Host is assigned.`);
+    }
+    if (method === "PATCH") {
+      const patch = bodyRows(req.body);
+      if (!patch || patch.some((r) => slugColumn in r && !scope.includes(r[slugColumn]))) {
+        return deny(`A ${table} row cannot be moved to another workspace.`);
+      }
+    }
+    params.append(slugColumn, inList(scope));
+  } else {
+    const channelIds = await ownedChannelIds(forward, workspaces);
+    if (!channelIds) return deny("Could not resolve the device workspaces.", 502);
+    if (table === "threads") {
+      if (method === "POST") {
+        const ok = rows.length > 0 && rows.every((r) => typeof r["channel_id"] === "string" && channelIds.includes(r["channel_id"]));
+        if (!ok) return deny("A thread must belong to a channel of the device workspaces.");
+      }
+      if (method === "PATCH") {
+        const patch = bodyRows(req.body);
+        if (!patch || patch.some((r) => "channel_id" in r)) return deny("A thread cannot move channels.");
+      }
+      params.append("channel_id", inList(channelIds));
+    } else {
+      const threadIds = await replyThreadIds(forward, method, params, rows);
+      if (!threadIds) return deny("thread_replies requests must name the thread or replies they touch.");
+      if (!await threadsOwned(forward, threadIds, channelIds)) return deny("Thread is outside the device workspaces.");
+      if (method === "PATCH") {
+        const patch = bodyRows(req.body);
+        if (!patch || patch.some((r) => "thread_id" in r)) return deny("A reply cannot move threads.");
+      }
+    }
+  }
+  const headers = {};
+  for (const name of FORWARDED_HEADERS) {
+    const value = req.headers[name];
+    if (value !== void 0) headers[name] = value;
+  }
+  return forward({
+    method,
+    path: `${url.pathname}?${params.toString()}`,
+    headers,
+    body: isWrite ? req.body : void 0
+  });
+}
+var THREAD_TOPIC = /^agent-thinking:([0-9a-f-]{36})$/i;
+async function hostMayBroadcast(workspaces, topic, forward) {
+  if (!workspaces || workspaces.length === 0) return false;
+  if (topic === "channel-activity" || topic === "host-status") return true;
+  const thread = THREAD_TOPIC.exec(topic)?.[1];
+  if (!thread || !UUID.test(thread)) return false;
+  const channelIds = await ownedChannelIds(forward, workspaces);
+  return !!channelIds && await threadsOwned(forward, [thread], channelIds);
+}
+var forwardToSupabase = async (req) => {
+  const base = process.env["SUPABASE_URL"];
+  const key = process.env["SUPABASE_SECRET_KEY"];
+  if (!base || !key) return deny("Data API has no Supabase credentials.", 500);
+  const res = await fetch(`${base}${req.path}`, {
+    method: req.method,
+    headers: { ...req.headers, apikey: key, authorization: `Bearer ${key}` },
+    body: req.body
+  });
+  return {
+    status: res.status,
+    headers: Object.fromEntries(
+      ["content-type", "content-range", "content-profile"].flatMap((h) => {
+        const v = res.headers.get(h);
+        return v ? [[h, v]] : [];
+      })
+    ),
+    body: await res.text()
+  };
+};
+
+// src/dashboard/host-db-client.ts
+import { createClient as createClient2 } from "@supabase/supabase-js";
+import { randomUUID as randomUUID3 } from "crypto";
+var REQUEST_TIMEOUT_MS3 = 3e4;
+var pending = /* @__PURE__ */ new Map();
+var sender = null;
+var onSender = [];
+function setHostDbSender(fn) {
+  sender = fn;
+  if (!fn) return;
+  const waiting = onSender;
+  onSender = [];
+  for (const wake of waiting) wake();
+}
+function handleHostDbResult(id, res) {
+  const p = pending.get(id);
+  if (!p) return;
+  pending.delete(id);
+  clearTimeout(p.timer);
+  p.resolve(res);
+}
+function whenConnected() {
+  if (sender) return Promise.resolve(sender);
+  return new Promise((resolve8, reject) => {
+    const timer2 = setTimeout(() => {
+      onSender = onSender.filter((w) => w !== wake);
+      reject(new Error("Host is not connected to the Data API"));
+    }, REQUEST_TIMEOUT_MS3);
+    const wake = () => {
+      clearTimeout(timer2);
+      resolve8(sender);
+    };
+    onSender.push(wake);
+  });
+}
+async function request(req) {
+  const send2 = await whenConnected();
+  const id = randomUUID3();
+  return new Promise((resolve8, reject) => {
+    const timer2 = setTimeout(() => {
+      pending.delete(id);
+      reject(new Error("Data API did not answer in time"));
+    }, REQUEST_TIMEOUT_MS3);
+    pending.set(id, { resolve: resolve8, reject, timer: timer2 });
+    send2({ type: "db", id, req });
+  });
+}
+var BODYLESS_STATUS = /* @__PURE__ */ new Set([101, 204, 205, 304]);
+var hostDbFetch = async (input2, init) => {
+  const req = new Request(input2, init);
+  const url = new URL(req.url);
+  const method = req.method.toUpperCase();
+  const res = await request({
+    method,
+    path: `${url.pathname}${url.search}`,
+    headers: Object.fromEntries(req.headers.entries()),
+    body: method === "GET" || method === "HEAD" ? void 0 : await req.text()
+  });
+  const noBody = method === "HEAD" || BODYLESS_STATUS.has(res.status);
+  return new Response(noBody ? null : res.body, { status: res.status, headers: res.headers });
+};
+function relayChannel(topic) {
+  const channel = {
+    on: () => channel,
+    subscribe: (callback) => {
+      queueMicrotask(() => callback?.("SUBSCRIBED"));
+      return channel;
+    },
+    send: async (msg) => {
+      if (msg.type !== "broadcast" || !sender) return "error";
+      sender({ type: "db-broadcast", topic, event: msg.event, payload: msg.payload ?? {} });
+      return "ok";
+    },
+    unsubscribe: async () => "ok"
+  };
+  return channel;
+}
+function createHostDbClient() {
+  const client2 = createClient2("https://host-db.invalid", "host-device", {
+    auth: { persistSession: false, autoRefreshToken: false },
+    global: { fetch: hostDbFetch }
+  });
+  return new Proxy(client2, {
+    get(target, prop) {
+      if (prop === "channel") return relayChannel;
+      if (prop === "removeChannel") return async () => "ok";
+      const value = Reflect.get(target, prop, target);
+      return typeof value === "function" ? value.bind(target) : value;
+    }
+  });
+}
+
 // src/dashboard/agent-bridge.ts
 var HOST_SOCKET_PATH = "/internal/host-socket";
 var DEFAULT_DATA_API_PORT = 4757;
@@ -14026,6 +15326,7 @@ function localAgentCallbacks(chatAgent) {
     getLocalDashboardSettings: () => loadDashboardSettings(),
     saveLocalDashboardSettings: (patch) => saveDashboardSettings(patch),
     writeSkill: (ref, write) => writeSkillAndSync(ref, write),
+    outputStylesRequest: (req) => handleOutputStylesRequest(req),
     listSessions: () => listLocalSessions(),
     scanOnboarding: () => scanOnboarding(),
     linkProjectFolders: (slug, items) => linkProjectFolders(slug, items),
@@ -14037,7 +15338,7 @@ function buildHostConfigSnapshot() {
   const snapshot2 = {};
   for (const profile of listProfiles()) {
     snapshot2[profile] = runWithProfile(profile, () => ({
-      env: existsSync26(paths.CONFIG_FILE) ? dotenv.parse(readFileSync15(paths.CONFIG_FILE, "utf-8")) : {},
+      env: existsSync26(paths.CONFIG_FILE) ? dotenv.parse(readFileSync16(paths.CONFIG_FILE, "utf-8")) : {},
       agentModel: loadDashboardSettings().agent
     }));
   }
@@ -14052,9 +15353,9 @@ var CALL_TIMEOUT_MS = 15e3;
 var AUTH_TIMEOUT_MS = 5e3;
 var HEARTBEAT_INTERVAL_MS = 15e3;
 var HEARTBEAT_TIMEOUT_MS = HEARTBEAT_INTERVAL_MS * 2.5;
-var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var UUID2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 var hosts = /* @__PURE__ */ new Map();
-var pending = /* @__PURE__ */ new Map();
+var pending2 = /* @__PURE__ */ new Map();
 var hostStatusListeners = /* @__PURE__ */ new Set();
 var lastAuthFailure = null;
 function hostFor(profile) {
@@ -14153,7 +15454,7 @@ function attachHostSocket(server) {
   wss.on("connection", (ws) => {
     alive.add(ws);
     ws.on("pong", () => alive.add(ws));
-    const nonce = randomBytes7(32).toString("base64");
+    const nonce = randomBytes8(32).toString("base64");
     const authTimer = setTimeout(() => {
       console.error("[host-socket] auth timed out");
       ws.close(1008, "auth timeout");
@@ -14165,32 +15466,48 @@ function attachHostSocket(server) {
       if (msg.type === "auth") {
         clearTimeout(authTimer);
         void (async () => {
-          const scope = await verifyHostAuth(nonce, msg, legacyPublicKey);
-          if (!scope) {
+          const scope2 = await verifyHostAuth(nonce, msg, legacyPublicKey);
+          if (!scope2) {
             console.error("[host-socket] rejecting connection: bad signature or unknown/revoked device");
             lastAuthFailure = { reason: "bad signature", since: Date.now() };
             send(ws, { type: "auth-failed", reason: "bad signature" });
             ws.close(1008, "bad signature");
             return;
           }
-          supersedeSameIdentity(scope, ws);
+          supersedeSameIdentity(scope2, ws);
           lastAuthFailure = null;
-          addHost(ws, scope);
+          addHost(ws, scope2);
           send(ws, { type: "auth-ok" });
-          console.log(`[host-socket] Host authenticated (authPath: ${scope.authPath})`);
-          if (scope.workspaces) void markAgentConnected(scope.workspaces);
+          console.log(`[host-socket] Host authenticated (authPath: ${scope2.authPath})`);
+          if (scope2.workspaces) void markAgentConnected(scope2.workspaces);
         })();
         return;
       }
       if (msg.type === "result" || msg.type === "call-error") {
-        const waiter = pending.get(msg.id);
+        const waiter = pending2.get(msg.id);
         if (!waiter) return;
-        pending.delete(msg.id);
+        pending2.delete(msg.id);
         waiter.resolve(msg.type === "result" ? msg.value : null);
         return;
       }
       if (msg.type === "host-config") {
         setProfileConfigCache(msg.configs);
+        return;
+      }
+      const scope = hosts.get(ws);
+      if (!scope) return;
+      if (msg.type === "db") {
+        const assigned = (scope.workspaces ?? []).filter((p) => hostFor(p) === ws);
+        void proxyHostDb(scope.workspaces, msg.req, forwardToSupabase, assigned).then(
+          (res) => send(ws, { type: "db-result", id: msg.id, res })
+        );
+        return;
+      }
+      if (msg.type === "db-broadcast") {
+        void (async () => {
+          if (!await hostMayBroadcast(scope.workspaces, msg.topic, forwardToSupabase)) return;
+          await getSupabaseClient().channel(msg.topic).httpSend(msg.event, msg.payload).catch((err) => console.error(`[host-socket] broadcast ${msg.topic} failed:`, err.message));
+        })();
       }
     });
     ws.on("close", () => {
@@ -14210,14 +15527,14 @@ function callHost(method, args) {
     );
     return Promise.resolve(null);
   }
-  const id = randomUUID3();
+  const id = randomUUID4();
   return new Promise((resolve8) => {
     const timer2 = setTimeout(() => {
-      pending.delete(id);
+      pending2.delete(id);
       console.error(`[host-socket] ${method} -> timed out`);
       resolve8(null);
     }, CALL_TIMEOUT_MS);
-    pending.set(id, {
+    pending2.set(id, {
       resolve: (value) => {
         clearTimeout(timer2);
         resolve8(value);
@@ -14268,6 +15585,8 @@ function remoteAgentCallbacks() {
     saveLocalDashboardSettings: (patch) => callHost("saveLocalDashboardSettings", [patch]),
     // Same posture as saveLocalDashboardSettings: `null` becomes a 503.
     writeSkill: (ref, write) => callHost("writeSkill", [ref, write]),
+    // Same posture as writeSkill: `null` becomes a 503.
+    outputStylesRequest: (req) => callHost("outputStylesRequest", [req]),
     // `null` (no Host connected) is passed through rather than defaulting to
     // `[]` — see listSessions's doc comment on AgentCallbacks.
     listSessions: () => callHost("listSessions", []),
@@ -14281,7 +15600,7 @@ function remoteAgentCallbacks() {
 }
 var RECONNECT_BASE_MS = 1e3;
 var RECONNECT_MAX_MS = 3e4;
-function connectHostSocket(url, callbacks) {
+function connectHostSocket(url, callbacks, onAuthenticated) {
   const credentials = loadCredentials();
   const deviceId = credentials?.deviceId;
   const privateKey = deviceId ? ensureDeviceKey().privateKey : loadHostPrivateKey();
@@ -14322,11 +15641,17 @@ function connectHostSocket(url, callbacks) {
       }
       if (msg.type === "auth-ok") {
         console.log("[host-socket] authenticated");
+        setHostDbSender((out) => send(ws, out));
         send(ws, { type: "host-config", configs: buildHostConfigSnapshot() });
         if (configPushTimer) clearInterval(configPushTimer);
         configPushTimer = setInterval(() => {
           send(ws, { type: "host-config", configs: buildHostConfigSnapshot() });
         }, HOST_CONFIG_PUSH_INTERVAL_MS);
+        onAuthenticated?.();
+        return;
+      }
+      if (msg.type === "db-result") {
+        handleHostDbResult(msg.id, msg.res);
         return;
       }
       if (msg.type === "call") {
@@ -14334,6 +15659,7 @@ function connectHostSocket(url, callbacks) {
       }
     });
     ws.on("close", () => {
+      setHostDbSender(null);
       if (configPushTimer) {
         clearInterval(configPushTimer);
         configPushTimer = null;
@@ -14375,6 +15701,56 @@ async function handleCall(msg, callbacks, ws) {
     }
   });
 }
+var LOCAL_RELAY_PATH = "/internal/agent-call";
+var RELAYED_METHODS = [
+  "onChatMessage",
+  "isAgentThinking",
+  "getAgentActivities",
+  "cancelAgentRun",
+  "regenerateAgentRun",
+  "listAgentRuns"
+];
+function relayedAgentCallbacks(local) {
+  const relay2 = (method) => async (...args) => {
+    const endpoint = readHostEndpoint();
+    if (endpoint) {
+      try {
+        const res = await fetch(`http://127.0.0.1:${endpoint.port}${LOCAL_RELAY_PATH}`, {
+          method: "POST",
+          headers: { authorization: `Bearer ${endpoint.token}`, "content-type": "application/json" },
+          body: JSON.stringify({ method, profile: getProfile(), args }),
+          signal: AbortSignal.timeout(CALL_TIMEOUT_MS)
+        });
+        if (res.ok) return (await res.json()).value;
+        console.error(`[agent-relay] ${method} -> Host answered ${res.status}, running locally`);
+      } catch (err) {
+        console.error(`[agent-relay] ${method} -> ${err.message}, running locally`);
+      }
+    }
+    return local[method]?.(...args);
+  };
+  return {
+    ...local,
+    ...Object.fromEntries(RELAYED_METHODS.map((method) => [method, relay2(method)]))
+  };
+}
+async function handleLocalRelay(req, callbacks, token) {
+  const given = Buffer.from(req.headers.get("authorization") ?? "");
+  const expected = Buffer.from(`Bearer ${token}`);
+  if (!token || given.length !== expected.length || !timingSafeEqual2(given, expected)) {
+    return Response.json({ error: "unauthorized" }, { status: 401 });
+  }
+  const body = await req.json().catch(() => null);
+  const method = RELAYED_METHODS.find((m) => m === body?.method);
+  if (!body || !method || typeof body.profile !== "string" || !Array.isArray(body.args)) {
+    return Response.json({ error: "bad request" }, { status: 400 });
+  }
+  const value = await runWithProfile(
+    body.profile,
+    async () => callbacks[method]?.(...body.args)
+  );
+  return Response.json({ value: value ?? null });
+}
 function send(ws, msg) {
   if (ws.readyState === WebSocket.OPEN) ws.send(JSON.stringify(msg));
 }
@@ -14387,7 +15763,7 @@ function parse(raw) {
 }
 async function verifyHostAuth(nonce, msg, legacyPublicKey) {
   if (msg.deviceId) {
-    if (!UUID.test(msg.deviceId)) return null;
+    if (!UUID2.test(msg.deviceId)) return null;
     const device = await getDevice(msg.deviceId);
     if (!device || device.revokedAt) return null;
     const key = parseEd25519PublicKey(device.publicKey);
@@ -14411,7 +15787,7 @@ function verifySignature(nonce, signatureBase64, publicKey) {
 }
 
 // src/dashboard/device-auth-routes.ts
-var UUID2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var UUID3 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 function cleanText(value, max) {
   if (typeof value !== "string") return null;
   const trimmed = value.trim();
@@ -14440,7 +15816,7 @@ async function readBody(c) {
     return {};
   }
 }
-async function sessionUserId(c) {
+async function sessionUserId2(c) {
   try {
     const { data } = await createRequestSupabaseClient(c).auth.getUser();
     return data.user?.id ?? null;
@@ -14453,8 +15829,12 @@ async function bearerDevice(c) {
   const token = header.startsWith("Bearer ") ? header.slice("Bearer ".length).trim() : "";
   return token ? deviceForAccessToken(token) : null;
 }
+async function boundWorkspaceIds(publicKey, userId) {
+  const existing = await findDeviceByKey(publicKey, userId);
+  return new Set(existing ? (await listDeviceWorkspaces(existing)).map((w) => w.id) : []);
+}
 function createDeviceAuthRouter() {
-  const app = new Hono26();
+  const app = new Hono28();
   app.post("/code", async (c) => {
     const body = await readBody(c);
     const publicKey = typeof body["public_key"] === "string" ? body["public_key"] : "";
@@ -14478,18 +15858,18 @@ function createDeviceAuthRouter() {
   app.post("/token", async (c) => {
     const body = await readBody(c);
     const code = typeof body["device_code"] === "string" ? body["device_code"] : "";
-    const pending2 = code ? await getDeviceCodeBySecret(code) : null;
-    if (!pending2 || Date.parse(pending2.expiresAt) <= Date.now()) {
+    const pending3 = code ? await getDeviceCodeBySecret(code) : null;
+    if (!pending3 || Date.parse(pending3.expiresAt) <= Date.now()) {
       return c.json({ error: "expired_token" }, 400);
     }
-    if (pending2.deniedAt) return c.json({ error: "access_denied" }, 400);
-    if (!pending2.approvedBy) {
-      const last = pending2.lastPolledAt ? Date.parse(pending2.lastPolledAt) : 0;
-      await markPolled(pending2.id);
+    if (pending3.deniedAt) return c.json({ error: "access_denied" }, 400);
+    if (!pending3.approvedBy) {
+      const last = pending3.lastPolledAt ? Date.parse(pending3.lastPolledAt) : 0;
+      await markPolled(pending3.id);
       const tooSoon = Date.now() - last < (POLL_INTERVAL_S - 1) * 1e3;
       return c.json({ error: tooSoon ? "slow_down" : "authorization_pending" }, 400);
     }
-    const device = await redeemDeviceCode(pending2);
+    const device = await redeemDeviceCode(pending3);
     if (!device) return c.json({ error: "expired_token" }, 400);
     const { token, expiresInS } = await issueAccessToken(device.id);
     return c.json({
@@ -14503,14 +15883,14 @@ function createDeviceAuthRouter() {
   });
   app.post("/challenge", async (c) => {
     const body = await readBody(c);
-    const deviceId = typeof body["device_id"] === "string" && UUID2.test(body["device_id"]) ? body["device_id"] : "";
+    const deviceId = typeof body["device_id"] === "string" && UUID3.test(body["device_id"]) ? body["device_id"] : "";
     const device = deviceId ? await getDevice(deviceId) : null;
     if (!device || device.revokedAt) return c.json({ error: "unknown_device" }, 401);
     return c.json({ nonce: await createChallenge(device.id) });
   });
   app.post("/refresh", async (c) => {
     const body = await readBody(c);
-    const deviceId = typeof body["device_id"] === "string" && UUID2.test(body["device_id"]) ? body["device_id"] : "";
+    const deviceId = typeof body["device_id"] === "string" && UUID3.test(body["device_id"]) ? body["device_id"] : "";
     const nonce = typeof body["nonce"] === "string" ? body["nonce"] : "";
     const signature = typeof body["signature"] === "string" ? body["signature"] : "";
     const device = deviceId ? await getDevice(deviceId) : null;
@@ -14539,24 +15919,32 @@ function createDeviceAuthRouter() {
     return c.json({ ok: true });
   });
   app.get("/lookup", async (c) => {
-    const userId = await sessionUserId(c);
+    const userId = await sessionUserId2(c);
     if (!userId) return c.json({ error: "not signed in" }, 401);
     const userCode = normalizeUserCode(c.req.query("user_code") ?? "");
-    const pending2 = userCode ? await getDeviceCodeByUserCode(userCode) : null;
-    if (!pending2 || Date.parse(pending2.expiresAt) <= Date.now() || pending2.approvedBy || pending2.deniedAt) {
+    const pending3 = userCode ? await getDeviceCodeByUserCode(userCode) : null;
+    if (!pending3 || Date.parse(pending3.expiresAt) <= Date.now() || pending3.approvedBy || pending3.deniedAt) {
       return c.json({ error: "That code is invalid, expired, or already used." }, 404);
     }
+    const workspaces = await listAdminWorkspaces(userId);
+    const hosts2 = await listWorkspaceHosts(
+      workspaces.map((w) => w.id),
+      pending3.publicKey
+    );
+    const bound = await boundWorkspaceIds(pending3.publicKey, userId);
     return c.json({
-      user_code: pending2.userCode,
-      name: pending2.name,
-      platform: pending2.platform,
-      ip: pending2.requesterIp,
-      created_at: pending2.createdAt,
-      workspaces: await listAdminWorkspaces(userId)
+      user_code: pending3.userCode,
+      name: pending3.name,
+      platform: pending3.platform,
+      ip: pending3.requesterIp,
+      created_at: pending3.createdAt,
+      // `host`: another machine this workspace already runs on, so it can't be
+      // picked. `bound`: this machine already serves it, so there's nothing to pick.
+      workspaces: workspaces.map((w) => ({ ...w, host: hosts2.get(w.id) ?? null, bound: bound.has(w.id) }))
     });
   });
   app.get("/workspace", async (c) => {
-    const userId = await sessionUserId(c);
+    const userId = await sessionUserId2(c);
     if (!userId) return c.json({ error: "not signed in" }, 401);
     const slug = getProfile();
     const workspace = (await listAdminWorkspaces(userId)).find((w) => w.slug === slug);
@@ -14569,28 +15957,33 @@ function createDeviceAuthRouter() {
     });
   });
   app.post("/approve", async (c) => {
-    const userId = await sessionUserId(c);
+    const userId = await sessionUserId2(c);
     if (!userId) return c.json({ error: "not signed in" }, 401);
     const body = await readBody(c);
     const userCode = normalizeUserCode(typeof body["user_code"] === "string" ? body["user_code"] : "");
     const decision = body["decision"];
     if (!userCode || decision !== "approve" && decision !== "deny") return c.json({ error: "invalid request" }, 400);
+    const pending3 = await getDeviceCodeByUserCode(userCode);
+    if (!pending3 || Date.parse(pending3.expiresAt) <= Date.now()) {
+      return c.json({ error: "That code is invalid or expired." }, 404);
+    }
     let workspaceIds = [];
     if (decision === "approve") {
       const requested = Array.isArray(body["workspace_ids"]) ? body["workspace_ids"] : [];
       const allowed = new Set((await listAdminWorkspaces(userId)).map((w) => w.id));
       workspaceIds = [...new Set(requested.filter((id) => typeof id === "string"))];
-      if (!workspaceIds.length) return c.json({ error: "Pick at least one workspace." }, 400);
       if (workspaceIds.some((id) => !allowed.has(id))) {
         return c.json({ error: "You can only add a device to workspaces you are an admin of." }, 403);
       }
+      if (!workspaceIds.length && !(await boundWorkspaceIds(pending3.publicKey, userId)).size) {
+        return c.json({ error: "Pick at least one workspace." }, 400);
+      }
     }
-    const pending2 = await getDeviceCodeByUserCode(userCode);
-    if (!pending2 || Date.parse(pending2.expiresAt) <= Date.now()) {
-      return c.json({ error: "That code is invalid or expired." }, 404);
+    if ((await listWorkspaceHosts(workspaceIds, pending3.publicKey)).size) {
+      return c.json({ error: "That workspace already has a Host. Its Host cannot be replaced." }, 409);
     }
     const decided = await decideDeviceCode(
-      pending2.id,
+      pending3.id,
       userId,
       decision === "approve" ? { approve: true, workspaceIds } : { approve: false }
     );
@@ -14604,7 +15997,7 @@ function createDeviceAuthRouter() {
 
 // src/dashboard/api.ts
 function createApiRouter(agent = {}, mode = "all") {
-  const api = new Hono27();
+  const api = new Hono29();
   api.use("*", async (c, next) => {
     const known = await listKnownWorkspaces();
     const fromHost = profileFromHost(trustedHost(c), known);
@@ -14649,13 +16042,17 @@ function createApiRouter(agent = {}, mode = "all") {
   if (mode !== "host") registerDataRoutes(api, agent);
   if (mode !== "data") registerHostRoutes(api);
   if (mode === "data") {
-    api.get("/settings/agents", async (c) => c.json({ agents: await agent.getAgentIdentities?.() ?? [] }));
+    api.get(
+      "/settings/agents",
+      async (c) => c.json({ agents: await agent.getAgentIdentities?.() ?? [] })
+    );
     api.get("/channels/:id/skills", async (c) => {
       const { cwd, claudeConfigDir } = resolveChannelConfig(c.req.param("id"));
       return c.json({ skills: await agent.listChannelSkills?.({ cwd, claudeConfigDir }) ?? [] });
     });
     registerMirroredSkillRoutes(api, agent);
-    api.get("/channels/:id/docs/flat", async (c) => {
+    registerRelayedOutputStylesRoutes(api, agent);
+    api.get("/channels/:id/docs/flat", requireDocsAccess, async (c) => {
       const { cwd } = resolveChannelConfig(c.req.param("id"));
       const query = c.req.query("q") ?? "";
       const sort = c.req.query("sort") === "oldest" ? "oldest" : "newest";
@@ -14668,7 +16065,7 @@ function createApiRouter(agent = {}, mode = "all") {
         loadWorkspaceBranding(),
         Promise.resolve(agent.getLocalDashboardSettings?.()).then((v) => v ?? localDefaults())
       ]);
-      return c.json({ ...branding, ...local });
+      return c.json({ ...branding, ...local, autoTitleDefaultPrompt: DEFAULT_TITLE_RULES });
     });
     api.put("/settings", async (c) => {
       const body = await c.req.json().catch(() => ({}));
@@ -14711,7 +16108,7 @@ function createApiRouter(agent = {}, mode = "all") {
 }
 
 // src/dashboard/app-icon-routes.ts
-import { Hono as Hono28 } from "hono";
+import { Hono as Hono30 } from "hono";
 var NEUTRAL_MANIFEST = {
   id: "/",
   name: "Flyspace",
@@ -14749,7 +16146,7 @@ async function withResolvedProfile2(c, next) {
   return profile ? runWithProfile(profile, () => next()) : next();
 }
 function createAppIconRouter() {
-  const app = new Hono28();
+  const app = new Hono30();
   app.get("/manifest.json", withResolvedProfile2, async (c) => {
     if (!await resolvedProfileHost(c)) return c.json(NEUTRAL_MANIFEST);
     const profile = getProfile();
@@ -14789,7 +16186,7 @@ function pngResponse(c, png) {
 }
 
 // src/dashboard/stripe-routes.ts
-import { Hono as Hono29 } from "hono";
+import { Hono as Hono31 } from "hono";
 function planStatusFor(status) {
   const known = ["trialing", "active", "paused", "canceled"];
   return known.includes(status) ? status : null;
@@ -14832,7 +16229,7 @@ async function handleCardAdded(session) {
   }
 }
 function createStripeWebhookRouter() {
-  const stripeRouter = new Hono29();
+  const stripeRouter = new Hono31();
   stripeRouter.post("/webhook", async (c) => {
     const secret = process.env["STRIPE_WEBHOOK_SECRET"];
     const signature = c.req.header("stripe-signature");
@@ -14943,7 +16340,7 @@ function startHostStatusBroadcast() {
 
 // src/dashboard/server.ts
 var DEFAULT_DASHBOARD_PORT = 4747;
-var WEB_DIST = join19(paths.PACKAGE_ROOT, "web", "dist");
+var WEB_DIST = join21(paths.PACKAGE_ROOT, "web", "dist");
 var DEFAULT_DASHBOARD_HOST = "127.0.0.1";
 async function findFreePort(start, host = DEFAULT_DASHBOARD_HOST, attempts = 50) {
   for (let port = start; port < start + attempts; port++) {
@@ -14960,6 +16357,12 @@ async function findFreePort(start, host = DEFAULT_DASHBOARD_HOST, attempts = 50)
 async function startDashboardServer(preferredPort = DEFAULT_DASHBOARD_PORT, host = DEFAULT_DASHBOARD_HOST, mode = "all") {
   const servesHost = mode !== "data";
   loadEnvFiles();
+  let lateCallbacks;
+  let onHostConnected;
+  const bootCallbacks = new Proxy({}, {
+    get: (_t, prop) => lateCallbacks?.[prop]
+  });
+  const earlyHostSocket = mode === "host" && !hasSupabaseCredentials() && loadCredentials() ? (setSupabaseClient(createHostDbClient()), connectHostSocket(dataSocketUrl(), bootCallbacks, () => onHostConnected?.())) : void 0;
   if (servesHost) {
     await reconcileAll().catch(
       (err) => console.error("[dashboard] reconcileAll failed:", err.message)
@@ -14973,11 +16376,18 @@ async function startDashboardServer(preferredPort = DEFAULT_DASHBOARD_PORT, host
   await refreshAutomationRegistry();
   const stopAutomationPolling = startAutomationRegistryPolling();
   const chatAgent = servesHost ? new ChatAgent(loadChatAgentConfig()) : void 0;
-  const agent = chatAgent ? localAgentCallbacks(chatAgent) : remoteAgentCallbacks();
+  const local = chatAgent ? localAgentCallbacks(chatAgent) : void 0;
+  const agent = !local ? remoteAgentCallbacks() : mode === "all" ? relayedAgentCallbacks(local) : local;
+  if (chatAgent) lateCallbacks = agent;
+  if (chatAgent && mode === "host") {
+    onHostConnected = () => void chatAgent.recoverMissed().catch((err) => console.error("[chat-agent] recoverMissed failed:", err.message));
+    if (earlyHostSocket) onHostConnected();
+  }
   if (servesHost) installUsageRecording();
-  const stopSkillSync = servesHost ? installSkillSync(listProfiles()) : () => {
+  const mirrorsSkills = mode === "host" || process.env["FLYSPACE_SKILL_SYNC"] === "1";
+  const stopSkillSync = mirrorsSkills ? installSkillSync(listProfiles()) : () => {
   };
-  const app = new Hono30();
+  const app = new Hono32();
   app.use("*", async (c, next) => {
     await next();
     if (c.req.path.startsWith("/assets/")) {
@@ -14989,6 +16399,10 @@ async function startDashboardServer(preferredPort = DEFAULT_DASHBOARD_PORT, host
   app.use("*", corsForShell);
   app.route("/api", createApiRouter(agent, mode));
   app.route("/auth", createAuthConfirmRouter());
+  let relayToken = null;
+  if (mode === "host") {
+    app.post(LOCAL_RELAY_PATH, (c) => handleLocalRelay(c.req.raw, agent, relayToken));
+  }
   app.route("/stripe", createStripeWebhookRouter());
   if (!servesHost) {
     app.all(
@@ -15000,13 +16414,14 @@ async function startDashboardServer(preferredPort = DEFAULT_DASHBOARD_PORT, host
     app.route("/", createAppIconRouter());
     app.use("/*", serveStatic({ root: WEB_DIST }));
     app.get("/assets/*", (c) => c.text("stale asset \u2014 reload for the current build", 404));
-    const spaFallback = serveStatic({ path: join19(WEB_DIST, "index.html") });
+    const spaFallback = serveStatic({ path: join21(WEB_DIST, "index.html") });
     app.get("*", (c, next) => {
-      if (!existsSync27(join19(WEB_DIST, "index.html"))) {
+      if (!existsSync27(join21(WEB_DIST, "index.html"))) {
+        const isCheckout = existsSync27(join21(paths.PACKAGE_ROOT, "web", "package.json"));
         return c.text(
-          `Dashboard UI build missing (${WEB_DIST}).
+          isCheckout ? `Workspace UI build missing (${WEB_DIST}).
 Run \`pnpm --dir web build\` (or \`pnpm --dir web dev\`).
-The JSON API is live under /api.`,
+The JSON API is live under /api.` : "This install has no bundled Workspace UI.\nOpen the hosted Workspace at https://flyspace.ai instead.\nThe JSON API is live under /api.",
           503
         );
       }
@@ -15015,10 +16430,12 @@ The JSON API is live under /api.`,
   }
   const port = await findFreePort(preferredPort, host);
   const server = serve({ fetch: app.fetch, port, hostname: host });
+  if (mode === "host") relayToken = publishHostEndpoint(port);
   if (mode === "data") attachHostSocket(server);
   const stopHostStatusBroadcast = mode === "data" ? startHostStatusBroadcast() : void 0;
-  const hostSocketClient = mode === "host" && chatAgent ? connectHostSocket(dataSocketUrl(), localAgentCallbacks(chatAgent)) : void 0;
-  const stopPushWatcher = startPushWatcher();
+  const hostSocketClient = earlyHostSocket ?? (mode === "host" && chatAgent ? connectHostSocket(dataSocketUrl(), localAgentCallbacks(chatAgent), () => onHostConnected?.()) : void 0);
+  const stopPushWatcher = earlyHostSocket ? () => {
+  } : startPushWatcher();
   const displayHost = host === "0.0.0.0" || host === "::" ? "127.0.0.1" : host;
   return {
     port,
@@ -15058,7 +16475,7 @@ async function uploadImage(client2, { channel, filePath, threadTs, text }) {
 
 // src/commands/slack-sync.ts
 import { WebClient as WebClient2 } from "@slack/web-api";
-function createClient2() {
+function createClient3() {
   loadEnvFiles();
   const config = loadConfig();
   return new WebClient2(requireSlackBotToken(config));
@@ -15188,7 +16605,7 @@ function parseSince(args) {
 }
 async function runSlackSync(args) {
   const oldest = parseSince(args);
-  const client2 = createClient2();
+  const client2 = createClient3();
   const auth = await client2.auth.test();
   const own = { userId: auth.user_id, botId: auth.bot_id };
   try {
@@ -15264,7 +16681,7 @@ function getArg2(args, flag) {
   const idx = args.indexOf(flag);
   return idx !== -1 && idx + 1 < args.length ? args[idx + 1] : void 0;
 }
-function createClient3() {
+function createClient4() {
   loadEnvFiles();
   const config = loadConfig();
   return new WebClient3(requireSlackBotToken(config));
@@ -15420,7 +16837,7 @@ async function threadReplies(client2, nameOrId, ts2) {
 async function postMessage(client2, args) {
   const channelArg = getArg2(args, "--channel");
   const textFilePath = getArg2(args, "--text-file");
-  const text = textFilePath ? readFileSync16(textFilePath, "utf8") : getArg2(args, "--text");
+  const text = textFilePath ? readFileSync17(textFilePath, "utf8") : getArg2(args, "--text");
   const threadTs = getArg2(args, "--thread");
   const markdown = args.includes("--markdown");
   const broadcast = args.includes("--broadcast") && Boolean(threadTs);
@@ -15510,14 +16927,14 @@ function mask(token) {
 }
 function hasClaudeBinary() {
   try {
-    execFileSync3("claude", ["--version"], { stdio: "ignore" });
+    execFileSync4("claude", ["--version"], { stdio: "ignore" });
     return true;
   } catch {
     return false;
   }
 }
 function defaultClaudeConfigDir() {
-  return process.env.CLAUDE_CONFIG_DIR || resolve7(homedir8(), ".claude");
+  return process.env.CLAUDE_CONFIG_DIR || resolve7(homedir9(), ".claude");
 }
 function hasClaudeCredentials(configDir2) {
   if (existsSync28(resolve7(configDir2, ".credentials.json"))) {
@@ -15525,7 +16942,7 @@ function hasClaudeCredentials(configDir2) {
   }
   if (process.platform === "darwin") {
     try {
-      execFileSync3(
+      execFileSync4(
         "security",
         ["find-generic-password", "-s", "Claude Code-credentials"],
         { stdio: "ignore" }
@@ -15557,7 +16974,7 @@ async function ensureClaudeCodeReady() {
     console.log("  Flyspace spawns Claude Code as a subprocess. Without credentials, the bot");
     console.log("  will prompt /login inside Slack at runtime and you cannot complete the");
     console.log("  browser sign-in from there.\n");
-    if (claudeConfigDir !== resolve7(homedir8(), ".claude")) {
+    if (claudeConfigDir !== resolve7(homedir9(), ".claude")) {
       console.log("  Tip: run with the same CLAUDE_CONFIG_DIR you use for this Claude Code install:");
       console.log(`    \x1B[1mCLAUDE_CONFIG_DIR=${claudeConfigDir} claude\x1B[0m
 `);
@@ -15577,7 +16994,7 @@ async function ensureClaudeCodeReady() {
 }
 function getManifestYaml(botName) {
   const manifestPath = resolve7(paths.PACKAGE_ROOT, "slack-app-manifest.yml");
-  const raw = readFileSync16(manifestPath, "utf-8");
+  const raw = readFileSync17(manifestPath, "utf-8");
   return raw.replace(/name: Custie/g, `name: ${botName}`);
 }
 async function stepPersonalise() {
@@ -15994,7 +17411,7 @@ function writeConfigFile(config) {
     `OWNER_USER_ID=${config.ownerUserId}`,
     ``
   ].join("\n");
-  writeFileSync9(paths.CONFIG_FILE, envContent);
+  writeFileSync10(paths.CONFIG_FILE, envContent);
   success4(`Config written to ${paths.CONFIG_FILE}`);
 }
 function printNextSteps() {
@@ -16011,8 +17428,8 @@ function copyDefaultPrompt(botName) {
   if (!existsSync28(paths.PROMPT_FILE)) {
     const defaultPrompt = resolve7(paths.PACKAGE_ROOT, "system.default.md");
     if (existsSync28(defaultPrompt)) {
-      const content = readFileSync16(defaultPrompt, "utf-8").replace(/\{\{botName\}\}/g, botName);
-      writeFileSync9(paths.PROMPT_FILE, content);
+      const content = readFileSync17(defaultPrompt, "utf-8").replace(/\{\{botName\}\}/g, botName);
+      writeFileSync10(paths.PROMPT_FILE, content);
       success4(`Default prompt copied to ${paths.PROMPT_FILE}`);
     }
   }
@@ -16099,12 +17516,12 @@ async function runSlackCmd(args) {
       break;
     }
     case "channels": {
-      const client2 = createClient3();
+      const client2 = createClient4();
       await listChannels2(client2, args.includes("--refresh"));
       break;
     }
     case "users": {
-      const client2 = createClient3();
+      const client2 = createClient4();
       await listUsers(client2, args.includes("--refresh"));
       break;
     }
@@ -16113,7 +17530,7 @@ async function runSlackCmd(args) {
         console.error("Usage: flyspace slack channel-info <name-or-id>");
         process.exit(1);
       }
-      const client2 = createClient3();
+      const client2 = createClient4();
       await channelInfo(client2, args[1]);
       break;
     }
@@ -16122,7 +17539,7 @@ async function runSlackCmd(args) {
         console.error("Usage: flyspace slack user-info <name-or-id>");
         process.exit(1);
       }
-      const client2 = createClient3();
+      const client2 = createClient4();
       await userInfo(client2, args[1]);
       break;
     }
@@ -16131,7 +17548,7 @@ async function runSlackCmd(args) {
         console.error("Usage: flyspace slack history <name-or-id> [--today] [--limit n]");
         process.exit(1);
       }
-      const client2 = createClient3();
+      const client2 = createClient4();
       await channelHistory(client2, args[1], args.slice(2));
       break;
     }
@@ -16140,12 +17557,12 @@ async function runSlackCmd(args) {
         console.error("Usage: flyspace slack thread <name-or-id> <ts>");
         process.exit(1);
       }
-      const client2 = createClient3();
+      const client2 = createClient4();
       await threadReplies(client2, args[1], args[2]);
       break;
     }
     case "post": {
-      const client2 = createClient3();
+      const client2 = createClient4();
       await postMessage(client2, args.slice(1));
       break;
     }
@@ -16156,14 +17573,14 @@ async function runSlackCmd(args) {
         console.error("Usage: flyspace slack delete --channel <channel-id> --ts <timestamp>");
         process.exit(1);
       }
-      const client2 = createClient3();
+      const client2 = createClient4();
       const channelId = await resolveChannelId2(client2, channel);
       await client2.chat.delete({ channel: channelId, ts: ts2 });
       console.log(`Message deleted (channel: ${channelId}, ts: ${ts2}).`);
       break;
     }
     case "upload": {
-      const client2 = createClient3();
+      const client2 = createClient4();
       await uploadImageCmd(client2, args.slice(1));
       break;
     }
@@ -16358,7 +17775,7 @@ async function runMcpCmd(args) {
   loadEnvFiles();
   switch (server) {
     case "threads": {
-      const { startThreadsServer } = await import("./threads-EQGJZF44.js");
+      const { startThreadsServer } = await import("./threads-PAG4PKHR.js");
       await startThreadsServer();
       return;
     }
@@ -16373,7 +17790,7 @@ async function runMcpCmd(args) {
 import { spawn as spawn5, spawnSync } from "child_process";
 import { existsSync as existsSync29 } from "fs";
 import { platform as platform6 } from "os";
-import { join as join20 } from "path";
+import { join as join22 } from "path";
 function flagValue(args, name) {
   const eq = args.find((a) => a.startsWith(`--${name}=`));
   if (eq) return eq.slice(`--${name}=`.length);
@@ -16388,7 +17805,8 @@ function openBrowser(url) {
   }
 }
 function ensureWebBuild() {
-  if (existsSync29(join20(paths.PACKAGE_ROOT, "web", "dist", "index.html"))) return;
+  if (existsSync29(join22(paths.PACKAGE_ROOT, "web", "dist", "index.html"))) return;
+  if (!existsSync29(join22(paths.PACKAGE_ROOT, "web", "package.json"))) return;
   console.log("  web/dist missing \u2014 building the dashboard UI (pnpm --dir web build)...");
   const result = spawnSync("pnpm", ["--dir", "web", "build"], {
     cwd: paths.PACKAGE_ROOT,
@@ -16411,6 +17829,7 @@ async function runDashboard(args) {
   if (mode !== "all" && mode !== "host") {
     throw new Error(`--mode must be "all" or "host" (got "${mode}")`);
   }
+  if (mode === "host") acquireHostLock();
   ensureWebBuild();
   const server = await startDashboardServer(preferredPort, host, mode);
   const profile = getProfile();
@@ -16436,7 +17855,7 @@ async function runDashboard(args) {
 }
 
 // src/commands/workspace.ts
-import { existsSync as existsSync30, mkdirSync as mkdirSync9, writeFileSync as writeFileSync10 } from "fs";
+import { existsSync as existsSync30, mkdirSync as mkdirSync10, writeFileSync as writeFileSync11 } from "fs";
 var USAGE5 = `
   Usage: flyspace workspace <subcommand> [options]
 
@@ -16483,6 +17902,7 @@ async function provisionSupabase(slug, adminEmail, baseDomain, allowInvite) {
   console.log(
     existing ? `  workspace row exists (${workspace.id})` : `  workspace row created (${workspace.id})`
   );
+  await bindThisHost(workspace.id);
   if (await getMembershipByEmail(workspace.id, adminEmail)) {
     console.log(`  membership exists for ${adminEmail}`);
     return;
@@ -16507,6 +17927,16 @@ async function provisionSupabase(slug, adminEmail, baseDomain, allowInvite) {
     console.log(`  sign-in link sent to ${adminEmail}`);
   }
 }
+async function bindThisHost(workspaceId) {
+  const deviceId = loadCredentials()?.deviceId;
+  const device = deviceId ? await getDevice(deviceId) : null;
+  if (!device || device.revokedAt) {
+    console.log("  no paired Host on this machine, skipping device binding");
+    return;
+  }
+  await bindDeviceWorkspace(device.id, workspaceId, device.userId);
+  console.log(`  bound to Host "${device.name}" (restart it to pick up the new workspace)`);
+}
 function provisionLocal(botName) {
   ensureDirs();
   console.log(`  config dir ready (${paths.CONFIG_DIR})`);
@@ -16514,7 +17944,7 @@ function provisionLocal(botName) {
   if (existsSync30(paths.CONFIG_FILE)) {
     console.log("  config.env exists");
   } else {
-    writeFileSync10(paths.CONFIG_FILE, `BOT_NAME=${botName}
+    writeFileSync11(paths.CONFIG_FILE, `BOT_NAME=${botName}
 `);
     console.log(`  config.env written (${paths.CONFIG_FILE})`);
   }
@@ -16523,13 +17953,13 @@ async function provisionChannels(specs) {
   if (specs.length === 0) return;
   await refreshChannelRegistry();
   for (const [index, spec] of specs.entries()) {
-    if (findChannel(spec.name)) {
+    if (getProfileChannelRegistry().some((c) => c.name === spec.name)) {
       console.log(`  channel "${spec.name}" exists`);
       continue;
     }
     const cwd = expandPath(spec.cwd);
     if (!existsSync30(cwd)) {
-      mkdirSync9(cwd, { recursive: true });
+      mkdirSync10(cwd, { recursive: true });
       console.log(`  created cwd ${cwd}`);
     }
     await createChannel({ name: spec.name, cwd, position: index });
@@ -17034,7 +18464,7 @@ async function main() {
       break;
     case "-v":
     case "--version":
-      printRaw("0.1.1");
+      printRaw("0.1.4");
       break;
     case "-h":
     case "--help":