flyspace-cli 0.1.10 → 0.1.13

package/dist/cli.js

@@ -32,6 +32,7 @@ import {
   buildSystemPrompt,
   canSeeChannel,
   channelSkillsDir,
+  claudeAuthFailed,
   codexAuthAvailable,
   createChannel,
   createMembership,
@@ -152,7 +153,7 @@ import {
   warnOnBrokenChannelCwds,
   workspaceSkillsDir,
   writeSkillFile
-} from "./chunk-UYLVSUD6.js";
+} from "./chunk-VKTJBYA3.js";
 import {
   firstReplyBody,
   getThread,
@@ -313,42 +314,10 @@ async function runStart() {
   await startServer();
 }
 
-// src/commands/prompt.ts
-import { existsSync, copyFileSync } from "fs";
+// src/commands/config.ts
+import { existsSync, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
 import { spawn } from "child_process";
 import { resolve } from "path";
-async function runPrompt() {
-  ensureDirs();
-  if (!existsSync(paths.PROMPT_FILE)) {
-    const defaultPrompt = resolve(paths.PACKAGE_ROOT, "system.default.md");
-    if (!existsSync(defaultPrompt)) {
-      console.error("[flyspace] system.default.md not found in package root.");
-      process.exit(1);
-    }
-    copyFileSync(defaultPrompt, paths.PROMPT_FILE);
-    console.log(`[flyspace] Copied default prompt to ${paths.PROMPT_FILE}`);
-  }
-  const editor = process.env["EDITOR"] || "vi";
-  console.log(`[flyspace] Opening ${paths.PROMPT_FILE} in ${editor}...`);
-  const child = spawn(editor, [paths.PROMPT_FILE], { stdio: "inherit" });
-  return new Promise((resolve8, reject) => {
-    child.on("close", (code) => {
-      if (code === 0) {
-        resolve8();
-      } else {
-        reject(new Error(`Editor exited with code ${code}`));
-      }
-    });
-    child.on("error", (err) => {
-      reject(new Error(`Failed to open editor: ${err.message}`));
-    });
-  });
-}
-
-// src/commands/config.ts
-import { existsSync as existsSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
-import { spawn as spawn2 } from "child_process";
-import { resolve as resolve2 } from "path";
 function maskToken(value) {
   if (!value || value.length < 12) return "****";
   return value.slice(0, 8) + "..." + value.slice(-4);
@@ -364,12 +333,12 @@ function printConfig() {
   console.log("\n  Paths:");
   console.log(`    Config dir:   ${paths.CONFIG_DIR}`);
   console.log(`    Data dir:     ${paths.DATA_DIR}`);
-  console.log(`    Config file:  ${paths.CONFIG_FILE} ${existsSync2(paths.CONFIG_FILE) ? "(exists)" : "(not found)"}`);
-  console.log(`    Prompt file:  ${paths.PROMPT_FILE} ${existsSync2(paths.PROMPT_FILE) ? "(exists)" : "(not found)"}`);
-  console.log(`    Database:     ${paths.DB_FILE} ${existsSync2(paths.DB_FILE) ? "(exists)" : "(not found)"}`);
+  console.log(`    Config file:  ${paths.CONFIG_FILE} ${existsSync(paths.CONFIG_FILE) ? "(exists)" : "(not found)"}`);
+  console.log(`    Prompt file:  ${paths.PROMPT_FILE} ${existsSync(paths.PROMPT_FILE) ? "(exists)" : "(not found)"}`);
+  console.log(`    Database:     ${paths.DB_FILE} ${existsSync(paths.DB_FILE) ? "(exists)" : "(not found)"}`);
   console.log(`    Log dir:      ${paths.LOG_DIR}`);
-  const repoEnv = resolve2(process.cwd(), ".env");
-  console.log(`    Repo .env:    ${repoEnv} ${existsSync2(repoEnv) ? "(exists)" : "(not found)"}`);
+  const repoEnv = resolve(process.cwd(), ".env");
+  console.log(`    Repo .env:    ${repoEnv} ${existsSync(repoEnv) ? "(exists)" : "(not found)"}`);
   const envKeys = [
     "SLACK_BOT_TOKEN",
     "SLACK_APP_TOKEN",
@@ -393,9 +362,9 @@ function printConfig() {
 }
 function editConfig() {
   ensureDirs();
-  if (!existsSync2(paths.CONFIG_FILE)) {
-    const defaultEnv = resolve2(paths.PACKAGE_ROOT, ".env.example");
-    if (existsSync2(defaultEnv)) {
+  if (!existsSync(paths.CONFIG_FILE)) {
+    const defaultEnv = resolve(paths.PACKAGE_ROOT, ".env.example");
+    if (existsSync(defaultEnv)) {
       const content = readFileSync2(defaultEnv, "utf-8");
       writeFileSync2(paths.CONFIG_FILE, content);
     } else {
@@ -405,11 +374,11 @@ function editConfig() {
   }
   const editor = process.env["EDITOR"] || "vi";
   console.log(`[flyspace] Opening ${paths.CONFIG_FILE} in ${editor}...`);
-  const child = spawn2(editor, [paths.CONFIG_FILE], { stdio: "inherit" });
-  return new Promise((resolve8, reject) => {
+  const child = spawn(editor, [paths.CONFIG_FILE], { stdio: "inherit" });
+  return new Promise((resolve7, reject) => {
     child.on("close", (code) => {
       if (code === 0) {
-        resolve8();
+        resolve7();
       } else {
         reject(new Error(`Editor exited with code ${code}`));
       }
@@ -439,7 +408,7 @@ import { confirm as confirm2 } from "@inquirer/prompts";
 
 // src/service.ts
 import { execSync } from "child_process";
-import { existsSync as existsSync3, readFileSync as readFileSync3, realpathSync } from "fs";
+import { existsSync as existsSync2, readFileSync as readFileSync3, realpathSync } from "fs";
 import { basename, dirname as dirname2, join as join2 } from "path";
 import { homedir, platform } from "os";
 function flyspaceHome(entry = process.argv[1]) {
@@ -454,7 +423,7 @@ function flyspaceHome(entry = process.argv[1]) {
   const npmPrefix = cliPath.slice(0, at);
   if (basename(npmPrefix) !== "cli") return void 0;
   const home = dirname2(npmPrefix);
-  return existsSync3(join2(home, "bin", "flyspace")) && existsSync3(join2(home, "node", "bin", "node")) ? home : void 0;
+  return existsSync2(join2(home, "bin", "flyspace")) && existsSync2(join2(home, "node", "bin", "node")) ? home : void 0;
 }
 function serviceLabel(profile) {
   return profile === DEFAULT_PROFILE ? "ai.flyspace" : `ai.flyspace.${profile}`;
@@ -478,8 +447,8 @@ function systemdUnitPath(profile) {
   return join2(homedir(), ".config", "systemd", "user", `${systemdUnitName(profile)}.service`);
 }
 function isServiceInstalled(profile) {
-  if (platform() === "darwin") return existsSync3(plistPath(profile));
-  if (platform() === "linux") return existsSync3(systemdUnitPath(profile));
+  if (platform() === "darwin") return existsSync2(plistPath(profile));
+  if (platform() === "linux") return existsSync2(systemdUnitPath(profile));
   return false;
 }
 function serviceBinaryMissing(file) {
@@ -490,7 +459,7 @@ function serviceBinaryMissing(file) {
     return false;
   }
   const bin = text.match(/<key>ProgramArguments<\/key>\s*<array>\s*<string>([^<]+)<\/string>/)?.[1] ?? text.match(/^ExecStart=(\S+)/m)?.[1];
-  return !!bin && !existsSync3(bin);
+  return !!bin && !existsSync2(bin);
 }
 function profileServiceFile(profile) {
   return platform() === "darwin" ? plistPath(profile) : systemdUnitPath(profile);
@@ -529,7 +498,7 @@ function hostPlistPath() {
   return join2(homedir(), "Library", "LaunchAgents", `${HOST_SERVICE_LABEL}.plist`);
 }
 function isHostServiceInstalled() {
-  if (platform() === "darwin" || platform() === "linux") return existsSync3(hostServiceFile());
+  if (platform() === "darwin" || platform() === "linux") return existsSync2(hostServiceFile());
   return false;
 }
 function restartHostService() {
@@ -569,9 +538,9 @@ function isHostServiceRunning() {
 }
 
 // src/commands/install.ts
-import { existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync4, writeFileSync as writeFileSync3, unlinkSync } from "fs";
+import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync4, writeFileSync as writeFileSync3, unlinkSync } from "fs";
 import { execSync as execSync2 } from "child_process";
-import { dirname as dirname3, join as join3, resolve as resolve3 } from "path";
+import { dirname as dirname3, join as join3, resolve as resolve2 } from "path";
 import { homedir as homedir2, platform as platform2 } from "os";
 function log(msg) {
   console.log(`
@@ -603,7 +572,7 @@ function detectNodeBinDir() {
 }
 function nodeShimDirs() {
   return [join3(homedir2(), ".local", "share", "mise", "shims"), join3(homedir2(), ".asdf", "shims")].filter(
-    (d) => existsSync4(d)
+    (d) => existsSync3(d)
   );
 }
 function detectCustieBin() {
@@ -611,7 +580,7 @@ function detectCustieBin() {
   if (home) return join3(home, "bin", "flyspace");
   const argv1 = process.argv[1];
   if (argv1) {
-    return resolve3(argv1);
+    return resolve2(argv1);
   }
   try {
     return run("which flyspace", { silent: true });
@@ -620,7 +589,7 @@ function detectCustieBin() {
   }
 }
 function readEnvFile() {
-  if (!existsSync4(paths.CONFIG_FILE)) return {};
+  if (!existsSync3(paths.CONFIG_FILE)) return {};
   const vars = {};
   for (const line of readFileSync4(paths.CONFIG_FILE, "utf-8").split("\n")) {
     const trimmed = line.trim();
@@ -668,7 +637,7 @@ async function installMacOS(spec) {
   const logDir = paths.LOG_DIR;
   mkdirSync2(logDir, { recursive: true });
   const envVars = spec.env;
-  const homebrewBin = existsSync4("/opt/homebrew/bin") ? "/opt/homebrew/bin" : void 0;
+  const homebrewBin = existsSync3("/opt/homebrew/bin") ? "/opt/homebrew/bin" : void 0;
   const pathParts = [
     detectNodeBinDir(),
     claudeBinDir,
@@ -736,7 +705,7 @@ async function installLinux(spec) {
   const logDir = paths.LOG_DIR;
   mkdirSync2(logDir, { recursive: true });
   const envLines = Object.entries(spec.env).map(([k, v]) => `Environment="${k}=${v}"`).join("\n");
-  const linuxbrewBin = existsSync4("/home/linuxbrew/.linuxbrew/bin") ? "/home/linuxbrew/.linuxbrew/bin" : void 0;
+  const linuxbrewBin = existsSync3("/home/linuxbrew/.linuxbrew/bin") ? "/home/linuxbrew/.linuxbrew/bin" : void 0;
   const pathParts = [
     detectNodeBinDir(),
     claudeBinDir,
@@ -796,13 +765,13 @@ async function installHostService() {
 }
 
 // src/commands/profiles.ts
-import { existsSync as existsSync5, readdirSync, statSync } from "fs";
+import { existsSync as existsSync4, readdirSync, statSync } from "fs";
 import { execSync as execSync3 } from "child_process";
 import { join as join4 } from "path";
 import { platform as platform3 } from "os";
 function listProfiles() {
   const profiles = [];
-  if (existsSync5(paths.PROFILES_DIR)) {
+  if (existsSync4(paths.PROFILES_DIR)) {
     for (const entry of readdirSync(paths.PROFILES_DIR)) {
       try {
         if (statSync(join4(paths.PROFILES_DIR, entry)).isDirectory()) {
@@ -831,7 +800,7 @@ function isServiceRunning2(profile) {
 
 // src/auth/device-auth.ts
 import { createPrivateKey, createPublicKey, generateKeyPairSync, sign } from "crypto";
-import { existsSync as existsSync6, mkdirSync as mkdirSync3, readFileSync as readFileSync5, rmSync as rmSync2, writeFileSync as writeFileSync4 } from "fs";
+import { existsSync as existsSync5, mkdirSync as mkdirSync3, readFileSync as readFileSync5, rmSync as rmSync2, writeFileSync as writeFileSync4 } from "fs";
 import { dirname as dirname4, join as join5 } from "path";
 var DEFAULT_API_URL = "https://app.flyspace.ai";
 var EXPIRY_SKEW_MS = 6e4;
@@ -853,7 +822,7 @@ function credentialsPath() {
 }
 function ensureDeviceKey(path = deviceKeyPath()) {
   let created = false;
-  if (!existsSync6(path)) {
+  if (!existsSync5(path)) {
     const { privateKey: privateKey2 } = generateKeyPairSync("ed25519");
     mkdirSync3(dirname4(path), { recursive: true });
     writeFileSync4(path, privateKey2.export({ type: "pkcs8", format: "pem" }), { mode: 384 });
@@ -866,7 +835,7 @@ function ensureDeviceKey(path = deviceKeyPath()) {
   return { privateKey, publicKeyBase64, created };
 }
 function loadCredentials(path = credentialsPath()) {
-  if (!existsSync6(path)) return null;
+  if (!existsSync5(path)) return null;
   try {
     return JSON.parse(readFileSync5(path, "utf8"));
   } catch {
@@ -1010,7 +979,7 @@ async function getAccessToken() {
 // src/dashboard/onboarding-scan.ts
 import { execFileSync } from "child_process";
 import {
-  existsSync as existsSync7,
+  existsSync as existsSync6,
   lstatSync,
   mkdirSync as mkdirSync4,
   readdirSync as readdirSync2,
@@ -1019,7 +988,7 @@ import {
   symlinkSync
 } from "fs";
 import { homedir as homedir3 } from "os";
-import { basename as basename2, join as join6, resolve as resolve4 } from "path";
+import { basename as basename2, join as join6, resolve as resolve3 } from "path";
 var MAX_JSONL_HEAD_BYTES = 64 * 1024;
 var GIT_SCAN_ROOTS = ["Workspaces", "Projects", "code"];
 function flyspaceRoot() {
@@ -1041,7 +1010,7 @@ function codexDir() {
 }
 function claudeLoggedIn() {
   if (process.env["ANTHROPIC_API_KEY"]) return true;
-  if (existsSync7(join6(claudeDir(), ".credentials.json"))) return true;
+  if (existsSync6(join6(claudeDir(), ".credentials.json"))) return true;
   try {
     const raw = JSON.parse(readFileSync6(join6(homedir3(), ".claude.json"), "utf-8"));
     if (raw.oauthAccount) return true;
@@ -1058,7 +1027,7 @@ function claudeLoggedIn() {
   }
 }
 function codexLoggedIn() {
-  return !!process.env["OPENAI_API_KEY"] || existsSync7(join6(codexDir(), "auth.json"));
+  return !!process.env["OPENAI_API_KEY"] || existsSync6(join6(codexDir(), "auth.json"));
 }
 function jsonlFiles(dir, depth) {
   const out = [];
@@ -1132,7 +1101,7 @@ function gitRepos() {
       continue;
     }
     for (const e of entries2) {
-      if (e.isDirectory() && existsSync7(join6(root, e.name, ".git"))) found.push(join6(root, e.name));
+      if (e.isDirectory() && existsSync6(join6(root, e.name, ".git"))) found.push(join6(root, e.name));
     }
   }
   return found;
@@ -1157,7 +1126,7 @@ function scanOnboarding() {
   const byPath = /* @__PURE__ */ new Map();
   const history = { claude: false, codex: false };
   const add = (rawPath, source, mtime, sessions, trusted = false) => {
-    const path = resolve4(rawPath);
+    const path = resolve3(rawPath);
     if (isExcluded(path)) return;
     const existing = byPath.get(path);
     if (existing) {
@@ -1249,7 +1218,7 @@ function linkProjectFolders(slug, items) {
     }
     if (!exists) {
       if (item.path) {
-        const target = resolve4(item.path);
+        const target = resolve3(item.path);
         if (!statSync2(target).isDirectory()) throw new Error(`not a directory: ${target}`);
         makeLink(target, dest);
       } else {
@@ -1262,7 +1231,7 @@ function linkProjectFolders(slug, items) {
 }
 
 // src/commands/auth.ts
-import { spawn as spawn3 } from "child_process";
+import { spawn as spawn2 } from "child_process";
 import { confirm } from "@inquirer/prompts";
 import { hostname, platform as platform4, release } from "os";
 var BOLD = "\x1B[1m";
@@ -1309,7 +1278,7 @@ function openBrowser(url) {
   if (process.env["SSH_CONNECTION"] || process.env["SSH_TTY"]) return false;
   const cmd = platform4() === "darwin" ? "open" : platform4() === "win32" ? "explorer" : "xdg-open";
   try {
-    const child = spawn3(cmd, [url], { stdio: "ignore", detached: true });
+    const child = spawn2(cmd, [url], { stdio: "ignore", detached: true });
     child.on("error", () => {
     });
     child.unref();
@@ -1454,7 +1423,7 @@ async function runStatus() {
   const printLocal = (workspaces) => {
     console.log("");
     printIdentity({ ...creds, workspaces }, creds.deviceName);
-    console.log(`    ${DIM}API${RESET}         ${creds.apiUrl}`);
+    if (creds.apiUrl !== DEFAULT_API_URL) console.log(`    ${DIM}API${RESET}         ${creds.apiUrl}`);
     console.log(`    ${DIM}Key${RESET}         ${tilde(deviceKeyPath())}`);
     console.log(`    ${DIM}Credentials${RESET} ${tilde(credentialsPath())}`);
   };
@@ -1571,7 +1540,7 @@ async function runAuthCmd(args) {
 }
 
 // src/version.ts
-var CLI_VERSION = true ? "0.1.10" : null;
+var CLI_VERSION = true ? "0.1.13" : null;
 function isOlderVersion(a, b) {
   const parse2 = (v) => v.replace(/^v/, "").split("-")[0].split(".").map(Number);
   const [pa, pb] = [parse2(a), parse2(b)];
@@ -1849,7 +1818,8 @@ ${BOLD3}Flyspace Doctor${RESET3}
 }
 
 // src/commands/uninstall.ts
-import { existsSync as existsSync8, unlinkSync as unlinkSync2 } from "fs";
+import { existsSync as existsSync7, readFileSync as readFileSync7, rmSync as rmSync3, unlinkSync as unlinkSync2, writeFileSync as writeFileSync5 } from "fs";
+import { confirm as confirm3 } from "@inquirer/prompts";
 import { execSync as execSync5 } from "child_process";
 import { basename as basename3, join as join8 } from "path";
 import { homedir as homedir4, platform as platform5 } from "os";
@@ -1866,14 +1836,13 @@ function warn2(msg) {
 function run2(cmd) {
   execSync5(cmd, { encoding: "utf-8", stdio: "pipe" });
 }
-async function runUninstall() {
+async function runServiceUninstall(profile = getProfile()) {
   const os = platform5();
-  const profile = getProfile();
   log2("Uninstalling Flyspace service...");
   if (os === "darwin") {
     const removed = [];
     for (const plist of [plistPath(profile), legacyPlistPath(profile)]) {
-      if (!existsSync8(plist)) continue;
+      if (!existsSync7(plist)) continue;
       try {
         run2(`launchctl unload "${plist}"`);
       } catch {
@@ -1908,11 +1877,51 @@ async function runUninstall() {
   } else {
     warn2(`Unsupported platform: ${os}`);
   }
-  console.log("\n  Config and data directories were NOT removed.");
+}
+async function runUninstall(args = []) {
+  const prefix = process.env["FLYSPACE_PREFIX"] || join8(homedir4(), ".flyspace");
+  const targets = [paths.BASE_CONFIG_DIR, paths.BASE_DATA_DIR, prefix].filter(existsSync7);
+  console.log("\n  This removes Flyspace from this machine:");
+  console.log("    - revokes this device and removes every background service");
+  for (const t of targets) console.log(`    - deletes ${t}`);
+  console.log("  Your channel folders (~/Flyspace) are kept.\n");
+  if (!args.includes("--yes") && !args.includes("-y")) {
+    if (!await confirm3({ message: "Continue?", default: false })) {
+      console.log("  Cancelled.");
+      return;
+    }
+  }
+  const creds = loadCredentials();
+  if (creds) {
+    try {
+      const token = await getAccessToken();
+      if (token) await revokeDevice(creds.apiUrl, token);
+      success2("Device revoked.");
+    } catch {
+      warn2("Could not reach the server to revoke this device. Remove it from Settings later.");
+    }
+  }
+  for (const profile of ["default", ...listProfiles()]) {
+    await runServiceUninstall(profile);
+  }
+  for (const t of targets) {
+    rmSync3(t, { recursive: true, force: true });
+    success2(`Deleted ${t}`);
+  }
+  for (const rc of [".zshrc", ".bashrc", ".profile"].map((f) => join8(homedir4(), f))) {
+    if (!existsSync7(rc)) continue;
+    const before = readFileSync7(rc, "utf-8");
+    const after = before.replace(/\n# Flyspace CLI\nexport PATH="[^"\n]*\.flyspace\/bin:\$PATH"\n?/g, "\n");
+    if (after !== before) {
+      writeFileSync5(rc, after);
+      success2(`Removed PATH entry from ${rc}`);
+    }
+  }
+  console.log("\n  Flyspace is uninstalled. Open a new terminal to finish.\n");
 }
 
 // src/commands/profiles-cmd.ts
-import { rmSync as rmSync3 } from "fs";
+import { rmSync as rmSync4 } from "fs";
 var USAGE = `
   Usage: flyspace profiles [list]
          flyspace profiles remove <name>
@@ -1969,7 +1978,7 @@ async function removeCmd(name) {
   }
   const { configDir: configDir2, dataDir } = runWithProfile(name, () => ({ configDir: paths.CONFIG_DIR, dataDir: paths.DATA_DIR }));
   if (isServiceInstalled(name)) await runWithProfile(name, runUninstall);
-  rmSync3(configDir2, { recursive: true, force: true });
+  rmSync4(configDir2, { recursive: true, force: true });
   console.log(`\x1B[32m+\x1B[0m Local config removed: ${configDir2}`);
   console.log(`
   Kept: ${dataDir} (sessions, logs) and any ~/Flyspace/${name}/ channel folders.`);
@@ -2023,7 +2032,7 @@ function npmEnv() {
   return home ? { ...process.env, PATH: `${join9(home, "node", "bin")}:${process.env.PATH ?? ""}` } : process.env;
 }
 async function runUpgrade() {
-  const current = "0.1.10";
+  const current = "0.1.13";
   console.log(`Current version: ${current}`);
   console.log("Checking for updates...\n");
   try {
@@ -2394,7 +2403,7 @@ async function runAutomationCmd(args) {
 }
 
 // src/commands/usage.ts
-import { existsSync as existsSync9 } from "fs";
+import { existsSync as existsSync8 } from "fs";
 var HELP4 = `
   Usage: flyspace usage [options]
 
@@ -2521,7 +2530,7 @@ async function runUsage(args) {
     return;
   }
   const { days, by, explain, json } = parsed;
-  if (!existsSync9(paths.DB_FILE)) {
+  if (!existsSync8(paths.DB_FILE)) {
     console.log("No usage recorded yet (the database does not exist).");
     return;
   }
@@ -2635,21 +2644,21 @@ async function runRestart() {
 }
 
 // src/commands/logs.ts
-import { spawn as spawn4 } from "child_process";
-import { existsSync as existsSync10 } from "fs";
+import { spawn as spawn3 } from "child_process";
+import { existsSync as existsSync9 } from "fs";
 import { join as join10 } from "path";
 async function runLogs(args) {
   const showErrors = args.includes("--error") || args.includes("-e");
   const filename = showErrors ? "custie-error.log" : "custie.log";
   const logFile = join10(paths.LOG_DIR, filename);
-  if (!existsSync10(logFile)) {
+  if (!existsSync9(logFile)) {
     console.error(`Log file not found: ${logFile}`);
     console.error("Is the service installed? Run `flyspace install` first.");
     process.exit(1);
   }
   console.log(`Tailing ${logFile} (Ctrl+C to stop)
 `);
-  const tail = spawn4("tail", ["-f", "-n", "50", logFile], {
+  const tail = spawn3("tail", ["-f", "-n", "50", logFile], {
     stdio: "inherit"
   });
   tail.on("error", (err) => {
@@ -2663,10 +2672,10 @@ async function runLogs(args) {
 
 // src/commands/slack.ts
 import { execFileSync as execFileSync4 } from "child_process";
-import { existsSync as existsSync27, readFileSync as readFileSync17, writeFileSync as writeFileSync10 } from "fs";
-import { resolve as resolve7 } from "path";
+import { existsSync as existsSync26, readFileSync as readFileSync18, writeFileSync as writeFileSync11 } from "fs";
+import { resolve as resolve6 } from "path";
 import { tmpdir as tmpdir4, homedir as homedir9 } from "os";
-import { input, confirm as confirm3, select, checkbox } from "@inquirer/prompts";
+import { input, confirm as confirm4, select, checkbox } from "@inquirer/prompts";
 import { WebClient as WebClient3 } from "@slack/web-api";
 
 // src/store/auth-links.ts
@@ -3833,8 +3842,8 @@ function setupPage(c, token, invite, form = {}) {
   );
 }
 function createAuthConfirmRouter() {
-  const confirm4 = new Hono();
-  confirm4.get("/confirm", withResolvedProfile, async (c) => {
+  const confirm5 = new Hono();
+  confirm5.get("/confirm", withResolvedProfile, async (c) => {
     const settings = await loadWorkspaceBranding();
     const display = fontOf(settings.font).stack;
     const name = settings.displayName?.trim() || getProfile();
@@ -3871,7 +3880,7 @@ function createAuthConfirmRouter() {
       )
     );
   });
-  confirm4.post("/confirm", withResolvedProfile, async (c) => {
+  confirm5.post("/confirm", withResolvedProfile, async (c) => {
     const form = await c.req.parseBody();
     const params = readParams({
       token: typeof form["token"] === "string" ? form["token"] : void 0,
@@ -3882,7 +3891,7 @@ function createAuthConfirmRouter() {
     if (!target) return c.text("SUPABASE_URL is not configured", 500);
     return c.redirect(target, 303);
   });
-  confirm4.get("/invite", withResolvedProfile, async (c) => {
+  confirm5.get("/invite", withResolvedProfile, async (c) => {
     const token = c.req.query("token")?.trim() ?? "";
     const lookup = await findInvite(token);
     const brandingWorkspace = lookup.state === "valid" ? await getWorkspaceById(lookup.invite.workspaceId) : null;
@@ -3928,7 +3937,7 @@ function createAuthConfirmRouter() {
       )
     );
   });
-  confirm4.post("/invite", withResolvedProfile, async (c) => {
+  confirm5.post("/invite", withResolvedProfile, async (c) => {
     const form = await c.req.parseBody();
     const token = typeof form["token"] === "string" ? form["token"].trim() : "";
     const back = `/auth/invite?token=${encodeURIComponent(token)}`;
@@ -3945,7 +3954,7 @@ function createAuthConfirmRouter() {
     if (!await consumeInvite(lookup.invite.id)) return c.redirect(back, 303);
     return c.redirect(target, 303);
   });
-  confirm4.get("/new-workspace", async (c) => {
+  confirm5.get("/new-workspace", async (c) => {
     const token = c.req.query("token")?.trim() ?? "";
     const lookup = INVITE_TOKEN.test(token) ? await lookupSetupInvite(token) : { state: "unknown" };
     if (lookup.state === "valid") return c.html(setupPage(c, token, lookup.invite));
@@ -3973,7 +3982,7 @@ function createAuthConfirmRouter() {
       status
     );
   });
-  confirm4.post("/new-workspace", async (c) => {
+  confirm5.post("/new-workspace", async (c) => {
     const form = await c.req.parseBody();
     const token = typeof form["token"] === "string" ? form["token"].trim() : "";
     const slug = typeof form["slug"] === "string" ? form["slug"].trim().toLowerCase() : "";
@@ -4080,7 +4089,7 @@ function createAuthConfirmRouter() {
     }
     return c.redirect(`${origin}/login?email=${encodeURIComponent(invite.email)}`, 303);
   });
-  return confirm4;
+  return confirm5;
 }
 function confirmLinkFor(origin, actionLink, intent) {
   try {
@@ -4191,15 +4200,15 @@ async function deliverPasswordResetLink(email, redirectTo) {
 }
 
 // src/dashboard/server.ts
-import { existsSync as existsSync26 } from "fs";
+import { existsSync as existsSync25 } from "fs";
 import { createServer } from "net";
 import { join as join23 } from "path";
-import { Hono as Hono33 } from "hono";
+import { Hono as Hono34 } from "hono";
 import { serve } from "@hono/node-server";
 import { serveStatic } from "@hono/node-server/serve-static";
 
 // src/reconcile.ts
-import { existsSync as existsSync11, mkdirSync as mkdirSync6, writeFileSync as writeFileSync5 } from "fs";
+import { existsSync as existsSync10, mkdirSync as mkdirSync6, writeFileSync as writeFileSync6 } from "fs";
 async function boundWorkspaces2() {
   return (await boundWorkspaces())?.workspaces ?? null;
 }
@@ -4210,13 +4219,13 @@ async function servedWorkspaces2() {
 async function reconcileProfile(profile) {
   return runWithProfile(profile, async () => {
     const log5 = [];
-    const hadConfigDir = existsSync11(paths.CONFIG_DIR);
-    const hadDataDir = existsSync11(paths.DATA_DIR);
+    const hadConfigDir = existsSync10(paths.CONFIG_DIR);
+    const hadDataDir = existsSync10(paths.DATA_DIR);
     ensureDirs();
     if (!hadConfigDir) log5.push(`config dir created (${paths.CONFIG_DIR})`);
     if (!hadDataDir) log5.push(`data dir created (${paths.DATA_DIR})`);
-    if (!existsSync11(paths.CONFIG_FILE)) {
-      writeFileSync5(paths.CONFIG_FILE, `BOT_NAME=${profile}
+    if (!existsSync10(paths.CONFIG_FILE)) {
+      writeFileSync6(paths.CONFIG_FILE, `BOT_NAME=${profile}
 `);
       log5.push(`config.env written (${paths.CONFIG_FILE})`);
     }
@@ -4394,10 +4403,10 @@ var requireDocsAccess = async (c, next) => {
 };
 
 // src/dashboard/api.ts
-import { Hono as Hono30 } from "hono";
+import { Hono as Hono31 } from "hono";
 
 // src/dashboard/public-share-routes.ts
-import { existsSync as existsSync12, readFileSync as readFileSync8, statSync as statSync3 } from "fs";
+import { existsSync as existsSync11, readFileSync as readFileSync9, statSync as statSync3 } from "fs";
 import { join as join13 } from "path";
 import { Hono as Hono3 } from "hono";
 import { GetObjectCommand } from "@aws-sdk/client-s3";
@@ -4863,7 +4872,7 @@ function injectShareHead(html, head) {
 
 // src/dashboard/app-icon.ts
 import { createHash as createHash2 } from "crypto";
-import { readFileSync as readFileSync7 } from "fs";
+import { readFileSync as readFileSync8 } from "fs";
 import { join as join12 } from "path";
 import sharp from "sharp";
 var PLATE = "#0A0A0F";
@@ -4891,7 +4900,7 @@ function roundedPlate(size, fill = PLATE) {
 }
 async function renderBadge(box) {
   const transparent = { r: 0, g: 0, b: 0, alpha: 0 };
-  const raster = await sharp(readFileSync7(MARK_SVG_FILE)).resize(512, 512, { fit: "contain", background: transparent }).png().toBuffer();
+  const raster = await sharp(readFileSync8(MARK_SVG_FILE)).resize(512, 512, { fit: "contain", background: transparent }).png().toBuffer();
   return sharp(raster).trim().resize(box, box, { fit: "contain", background: transparent }).png().toBuffer();
 }
 async function sampleBackground(logo) {
@@ -4946,7 +4955,7 @@ async function renderAppIcon({
   if (hit) return hit;
   const out = logo && await composeIcon(logo, size, maskable, plain).catch(() => null) || // No workspace logo to lead with — the stock mark is still the best icon,
   // either on its usual dark plate or, for a favicon, trimmed and bare.
-  (transparent ? await renderBadge(size) : await sharp(readFileSync7(MARK_FILE)).resize(size, size, { fit: "cover" }).png().toBuffer());
+  (transparent ? await renderBadge(size) : await sharp(readFileSync8(MARK_FILE)).resize(size, size, { fit: "cover" }).png().toBuffer());
   cache3.set(key, out);
   return out;
 }
@@ -5458,7 +5467,7 @@ function truncationNotice(lang, voice) {
   if (lang === "en" || lang.startsWith("en-")) return TRUNCATION_NOTICE.en;
   return null;
 }
-var sleep2 = (ms) => new Promise((resolve8) => setTimeout(resolve8, ms));
+var sleep2 = (ms) => new Promise((resolve7) => setTimeout(resolve7, ms));
 async function synthesizeWithRetry(script, voice) {
   let lastError;
   for (let attempt = 1; attempt <= SYNTH_ATTEMPTS; attempt += 1) {
@@ -6164,7 +6173,7 @@ var shellCache = null;
 function readShell(path) {
   const { mtimeMs } = statSync3(path);
   if (shellCache?.mtimeMs === mtimeMs) return shellCache.html;
-  const html = readFileSync8(path, "utf8").replaceAll('"/assets/', `"${BUILD_PREFIX}/`);
+  const html = readFileSync9(path, "utf8").replaceAll('"/assets/', `"${BUILD_PREFIX}/`);
   shellCache = { mtimeMs, html };
   return html;
 }
@@ -6185,16 +6194,16 @@ function serveBuildFile(c, webDist, dir, name) {
     return c.text("not found", 404);
   }
   const path = join13(webDist, dir, name);
-  if (!existsSync12(path)) return c.text("not found", 404);
+  if (!existsSync11(path)) return c.text("not found", 404);
   c.header("Content-Type", type);
   c.header("Cache-Control", "public, max-age=31536000, immutable");
   if (ext === ".css") {
-    return c.body(readFileSync8(path, "utf8").replaceAll("url(/fonts/", `url(${BUILD_PREFIX}/fonts/`));
+    return c.body(readFileSync9(path, "utf8").replaceAll("url(/fonts/", `url(${BUILD_PREFIX}/fonts/`));
   }
   if (ext === ".js") {
-    return c.body(readFileSync8(path, "utf8").replaceAll('"/assets/', `"${BUILD_PREFIX}/`));
+    return c.body(readFileSync9(path, "utf8").replaceAll('"/assets/', `"${BUILD_PREFIX}/`));
   }
-  return c.body(new Uint8Array(readFileSync8(path)));
+  return c.body(new Uint8Array(readFileSync9(path)));
 }
 var HTML_SHARE_CSP = "sandbox allow-scripts allow-forms allow-modals allow-popups allow-popups-to-escape-sandbox";
 function servePublishedHtml(c, share) {
@@ -6331,7 +6340,7 @@ ${analytics}` : head);
     const lang = canonicalLanguage(requested);
     if (!isTranslatableLanguage(lang)) return next();
     const shell = join13(webDist, "index.html");
-    if (!existsSync12(shell)) return next();
+    if (!existsSync11(shell)) return next();
     const share = await getDocShare(c.req.param("id"));
     if (!share) return next();
     if (requested !== lang) return c.redirect(`/share/${share.id}/${lang}`, 302);
@@ -6367,7 +6376,7 @@ ${analytics}` : head);
     if (!share) return next();
     if (share.kind === "html") return servePublishedHtml(c, share);
     const shell = join13(webDist, "index.html");
-    if (!existsSync12(shell)) return next();
+    if (!existsSync11(shell)) return next();
     return readerPage(
       c,
       share,
@@ -6983,26 +6992,21 @@ async function resolveAgentIdentities() {
   );
 }
 async function offlineAgentIdentities() {
-  const dm = findChannelByAgentName(BOT_DM_KEY);
-  if (!dm) return [];
-  return [
-    {
-      name: BOT_DM_KEY,
-      label: BOT_LABEL,
-      kind: "main",
-      channelId: dm.id,
-      ...await loadBotIdentity()
-    }
-  ];
+  const identity = await loadBotIdentity();
+  const dm = findChannelByAgentName(BOT_DM_KEY) ?? await ensureAgentDmChannel(BOT_DM_KEY, {
+    name: identity.displayName ?? BOT_LABEL,
+    cwd: resolveChannelConfig("").cwd
+  });
+  return [{ name: BOT_DM_KEY, label: BOT_LABEL, kind: "main", channelId: dm.id, ...identity }];
 }
 
 // src/dashboard/host-api.ts
-import { existsSync as existsSync21, readFileSync as readFileSync12, statSync as statSync8 } from "fs";
+import { existsSync as existsSync20, readFileSync as readFileSync13, statSync as statSync8 } from "fs";
 import { join as join20 } from "path";
 import sharp3 from "sharp";
 
 // src/dashboard/channels-routes.ts
-import { existsSync as existsSync13, mkdirSync as mkdirSync7 } from "fs";
+import { existsSync as existsSync12, mkdirSync as mkdirSync7 } from "fs";
 import { Hono as Hono9 } from "hono";
 
 // src/dashboard/feature-flags-routes.ts
@@ -7150,7 +7154,7 @@ function coerceMemberEmails(raw) {
 }
 function ensureCwdDir(cwd) {
   const expanded = isLogicalCwd(cwd) ? resolveLogicalCwd(cwd) : expandPath(cwd);
-  if (!existsSync13(expanded)) mkdirSync7(expanded, { recursive: true });
+  if (!existsSync12(expanded)) mkdirSync7(expanded, { recursive: true });
 }
 function toResponse(channel) {
   return {
@@ -7299,25 +7303,25 @@ function createChannelWriteRouter() {
 // src/dashboard/docs-routes.ts
 import {
   closeSync,
-  existsSync as existsSync17,
+  existsSync as existsSync16,
   lstatSync as lstatSync2,
   mkdirSync as mkdirSync8,
   openSync,
   readSync,
   readdirSync as readdirSync4,
-  readFileSync as readFileSync11,
+  readFileSync as readFileSync12,
   realpathSync as realpathSync3,
   renameSync,
-  rmSync as rmSync5,
+  rmSync as rmSync6,
   statSync as statSync5,
-  writeFileSync as writeFileSync7
+  writeFileSync as writeFileSync8
 } from "fs";
-import { basename as basename6, dirname as dirname5, extname, join as join18, relative, resolve as resolve5, sep } from "path";
+import { basename as basename6, dirname as dirname5, extname, join as join18, relative, resolve as resolve4, sep } from "path";
 import { Hono as Hono10 } from "hono";
 import { streamSSE } from "hono/streaming";
 
 // src/dashboard/docs-watcher.ts
-import { existsSync as existsSync14, watch } from "fs";
+import { existsSync as existsSync13, watch } from "fs";
 import { basename as basename4, join as join14 } from "path";
 var DEBOUNCE_MS = 200;
 var MAX_PENDING = 200;
@@ -7359,7 +7363,7 @@ function watchDocs(cwd, listener) {
       const current = entries.get(cwd);
       if (!current || filename === null) return;
       const rel = filename.split("\\").join("/");
-      if (rel === root && !existsSync14(join14(cwd, rel))) return;
+      if (rel === root && !existsSync13(join14(cwd, rel))) return;
       if (isIgnoredDocPath(rel)) return;
       if (current.pending.size < MAX_PENDING) current.pending.add(rel);
       if (current.timer === null) current.timer = setTimeout(() => flush(cwd), DEBOUNCE_MS);
@@ -7596,13 +7600,13 @@ async function readOrQueueDocAudio(input2) {
 }
 
 // src/dashboard/artifact-export.ts
-import { readFileSync as readFileSync10 } from "fs";
+import { readFileSync as readFileSync11 } from "fs";
 
 // src/dashboard/chat-agent.ts
 import { homedir as homedir7 } from "os";
 
 // src/mcp/config.ts
-import { mkdtempSync, rmSync as rmSync4, writeFileSync as writeFileSync6 } from "fs";
+import { mkdtempSync, rmSync as rmSync5, writeFileSync as writeFileSync7 } from "fs";
 import { tmpdir as tmpdir2 } from "os";
 import { join as join15 } from "path";
 
@@ -8113,7 +8117,7 @@ function needsRefresh(expiresAt, now = Date.now()) {
   if (!expiresAt) return false;
   return new Date(expiresAt).getTime() - now < REFRESH_SKEW_MS;
 }
-var sleep3 = (ms) => new Promise((resolve8) => setTimeout(resolve8, ms));
+var sleep3 = (ms) => new Promise((resolve7) => setTimeout(resolve7, ms));
 async function refreshConnection(params) {
   const { workspaceId, connection, provider } = params;
   const deps = params.deps ?? {};
@@ -8292,10 +8296,10 @@ async function buildMcpConfig(profile, connectionIds) {
 function writeMcpConfigFile(config) {
   const dir = mkdtempSync(join15(tmpdir2(), "flyspace-mcp-"));
   const path = join15(dir, "mcp-config.json");
-  writeFileSync6(path, JSON.stringify(config), { mode: 384 });
+  writeFileSync7(path, JSON.stringify(config), { mode: 384 });
   return {
     path,
-    cleanup: () => rmSync4(dir, { recursive: true, force: true })
+    cleanup: () => rmSync5(dir, { recursive: true, force: true })
   };
 }
 async function withMcpConfig(profile, connectionIds, fn) {
@@ -8312,7 +8316,7 @@ async function withMcpConfig(profile, connectionIds, fn) {
 }
 
 // src/claude/agents.ts
-import { existsSync as existsSync15, readdirSync as readdirSync3, readFileSync as readFileSync9 } from "fs";
+import { existsSync as existsSync14, readdirSync as readdirSync3, readFileSync as readFileSync10 } from "fs";
 import { homedir as homedir6 } from "os";
 import { basename as basename5, join as join16 } from "path";
 import yaml from "js-yaml";
@@ -8327,7 +8331,7 @@ function expandHome(p) {
 function parseFrontmatter(file) {
   let content;
   try {
-    content = readFileSync9(file, "utf-8");
+    content = readFileSync10(file, "utf-8");
   } catch {
     return {};
   }
@@ -8343,7 +8347,7 @@ function parseFrontmatter(file) {
   }
 }
 function collectFrom(root, source) {
-  if (!existsSync15(root)) return [];
+  if (!existsSync14(root)) return [];
   let entries2;
   try {
     entries2 = readdirSync3(root).filter((f) => f.endsWith(".md"));
@@ -8373,7 +8377,7 @@ function readAgentPersona(configDir2, cwd, name) {
   const agent = listAgents(configDir2, cwd).find((a) => a.name === name);
   if (!agent) return void 0;
   try {
-    const content = readFileSync9(agent.path, "utf-8");
+    const content = readFileSync10(agent.path, "utf-8");
     return content.replace(/^---\r?\n[\s\S]*?\r?\n---\r?\n?/, "").trim();
   } catch {
     return void 0;
@@ -8606,7 +8610,7 @@ function formatMemoryPrompt(channelId, memories) {
 }
 
 // src/dashboard/rollover-summary.ts
-import { spawn as spawn5 } from "child_process";
+import { spawn as spawn4 } from "child_process";
 import { tmpdir as tmpdir3 } from "os";
 var HAIKU_MODEL = "haiku";
 var CJK_PATTERN = /[　-〿぀-ヿ㐀-䶿一-鿿豈-﫿＀-￯]/;
@@ -8647,7 +8651,7 @@ Rules:
 - No preamble like "Summary:" \u2014 start directly with the summary text.`;
 var HAIKU_TIMEOUT_MS = 6e4;
 function runHaikuPrint(input2, claudeConfigDir, claudeCodeOauthToken) {
-  return new Promise((resolve8, reject) => {
+  return new Promise((resolve7, reject) => {
     const args = [
       "--print",
       "--model",
@@ -8666,7 +8670,7 @@ function runHaikuPrint(input2, claudeConfigDir, claudeCodeOauthToken) {
     if (claudeConfigDir) env["CLAUDE_CONFIG_DIR"] = claudeConfigDir;
     if (claudeCodeOauthToken) env["CLAUDE_CODE_OAUTH_TOKEN"] = claudeCodeOauthToken;
     else delete env["CLAUDE_CODE_OAUTH_TOKEN"];
-    const child = spawn5("claude", args, {
+    const child = spawn4("claude", args, {
       // A stateless rewrite touches no files — tmpdir keeps it that way and
       // avoids picking up an unrelated project's own CLAUDE.md/AGENTS.md,
       // unlike the channel's own cwd the main turn runs in.
@@ -8698,7 +8702,7 @@ function runHaikuPrint(input2, claudeConfigDir, claudeCodeOauthToken) {
         reject(new Error("claude -p --model haiku returned empty output"));
         return;
       }
-      resolve8(text);
+      resolve7(text);
     });
   });
 }
@@ -8945,11 +8949,11 @@ async function downloadChatAttachments(body) {
 }
 
 // src/dashboard/doc-mention-guard.ts
-import { existsSync as existsSync16, statSync as statSync4 } from "fs";
+import { existsSync as existsSync15, statSync as statSync4 } from "fs";
 var DOC_MENTION_RE = /(?<![\w@/`])@((?:[\w.-]+\/)+[\w.-]+\.[A-Za-z0-9]{1,6})(?::(\d+))?(?![\w-])/g;
 function isRealDoc(root, rel) {
   const abs = resolveDocPath(root, rel);
-  if (!abs || !existsSync16(abs)) return false;
+  if (!abs || !existsSync15(abs)) return false;
   try {
     return statSync4(abs).isFile();
   } catch {
@@ -9460,12 +9464,14 @@ var ChatAgent = class {
         };
       }
     }
-    const docsAccess = await this.resolveSenderDocsAccess(
-      owningProfile,
-      msg.author,
-      thread.channel_id
-    );
-    if (docsAccess && docsAccess !== "write") channelConfig = { ...channelConfig, docsAccess };
+    const { access: docsAccess, unverified: docsAccessUnverified } = await this.resolveSenderDocsAccess(owningProfile, msg.author, thread.channel_id);
+    if (docsAccess && docsAccess !== "write") {
+      channelConfig = {
+        ...channelConfig,
+        docsAccess,
+        ...docsAccessUnverified ? { docsAccessUnverified } : {}
+      };
+    }
     const agentMemory = await listEnabledFeatureFlagsBySlug(owningProfile).then((ids) => resolveFeatureFlags(ids, false)["agent-memory"]).catch((err) => {
       console.error("[chat-agent] feature flag lookup failed:", err.message);
       return false;
@@ -9482,7 +9488,7 @@ var ChatAgent = class {
     try {
       const channelKey = `chat:${thread.channel_id}`;
       const session = store.getSession(channelKey, msg.threadId);
-      const docsNote = docsAccessPromptNote(channelConfig.docsAccess);
+      const docsNote = docsAccessPromptNote(channelConfig.docsAccess, channelConfig.docsAccessUnverified);
       const header = (docsNote ? `[access: ${docsNote}]
 
 ` : "") + `[context: chat channel=${thread.channel_id}` + (thread.title ? `, thread="${thread.title}"` : "") + `, sender=${msg.author}. This is the Flyspace dashboard, not Slack \u2014 it renders full Markdown, so use normal paragraphs, line breaks, and real Markdown lists instead of Slack-style single-line replies. When you name a file that lives in this channel's folder, write it as @ + its cwd-relative path (@docs/spec.md, @web/src/App.tsx) as plain text, never inside backticks or a Markdown link \u2014 the dashboard turns that into a chip the reader clicks to open the file. A trailing line number (@src/app.ts:120) is fine. Paths outside the cwd stay in backticks.]
@@ -9750,22 +9756,22 @@ ${msg.body}` : msg.body;
     let ready;
     try {
       channel = this.supabase().channel(`agent-thinking:${threadId}`);
-      ready = new Promise((resolve8) => {
+      ready = new Promise((resolve7) => {
         const timeout = setTimeout(() => {
           console.error(`[chat-agent] thinking-channel ${threadId}: subscribe timed out after 10s`);
-          resolve8(false);
+          resolve7(false);
         }, 1e4);
         channel.subscribe((status, err) => {
           if (status === "SUBSCRIBED") {
             clearTimeout(timeout);
-            resolve8(true);
+            resolve7(true);
           } else if (status === "CHANNEL_ERROR" || status === "TIMED_OUT" || status === "CLOSED") {
             console.error(
               `[chat-agent] thinking-channel ${threadId}: ${status}`,
               err?.message ?? ""
             );
             clearTimeout(timeout);
-            resolve8(false);
+            resolve7(false);
           }
         });
       });
@@ -9812,19 +9818,19 @@ ${msg.body}` : msg.body;
     let ready;
     try {
       channel = this.supabase().channel("channel-activity");
-      ready = new Promise((resolve8) => {
+      ready = new Promise((resolve7) => {
         const timeout = setTimeout(() => {
           console.error("[chat-agent] channel-activity: subscribe timed out after 10s");
-          resolve8(false);
+          resolve7(false);
         }, 1e4);
         channel.subscribe((status, err) => {
           if (status === "SUBSCRIBED") {
             clearTimeout(timeout);
-            resolve8(true);
+            resolve7(true);
           } else if (status === "CHANNEL_ERROR" || status === "TIMED_OUT" || status === "CLOSED") {
             console.error(`[chat-agent] channel-activity: ${status}`, err?.message ?? "");
             clearTimeout(timeout);
-            resolve8(false);
+            resolve7(false);
           }
         });
       });
@@ -9851,15 +9857,17 @@ ${msg.body}` : msg.body;
   /**
    * The sender's Docs level on `channelId`, or undefined when no restriction
    * applies (non-human author, or a profile with no Supabase workspace). A
-   * lookup failure resolves to 'none': better to withhold files than leak them.
+   * lookup failure resolves to 'none' (better to withhold files than leak
+   * them), flagged `unverified` so the agent reports a system error instead of
+   * telling the sender they lack access.
    */
   async resolveSenderDocsAccess(profile, author, channelId) {
-    if (!isHumanAuthor(author)) return void 0;
+    if (!isHumanAuthor(author)) return {};
     try {
-      return await resolveDocsAccessByHandle(profile, author, channelId) ?? void 0;
+      return { access: await resolveDocsAccessByHandle(profile, author, channelId) ?? void 0 };
     } catch (err) {
       console.error("[chat-agent] docs access lookup failed:", err.message);
-      return "none";
+      return { access: "none", unverified: true };
     }
   }
   async tryAsk(channelConfig, prompt, sessionId, onActivity, signal, usageContext) {
@@ -9886,6 +9894,7 @@ ${msg.body}` : msg.body;
             mcpConfigPath,
             ...usageContext ? { usageContext } : {},
             ...channelConfig.docsAccess ? { docsAccess: channelConfig.docsAccess } : {},
+            ...channelConfig.docsAccessUnverified ? { docsAccessUnverified: true } : {},
             ...channelConfig.memoryPrompt ? { memoryPrompt: channelConfig.memoryPrompt } : {},
             ...channelConfig.disableAutoMemory ? { disableAutoMemory: true } : {}
           },
@@ -9925,7 +9934,7 @@ ${msg.body}` : msg.body;
               resolveSelectedOutputStyle(channelConfig.claudeConfigDir)?.body
             ),
             channelConfig.memoryPrompt,
-            docsAccessPromptNote(channelConfig.docsAccess)
+            docsAccessPromptNote(channelConfig.docsAccess, channelConfig.docsAccessUnverified)
           ].filter(Boolean).join("\n\n---\n\n"),
           // Codex has no per-tool deny list, so any restricted requester gets
           // its read-only sandbox (no file writes). It can still read: see the
@@ -10202,7 +10211,7 @@ async function exportDocAsArtifact(channelId, docPath) {
   );
   const abs = resolveDocPath(channelConfig.cwd, docPath);
   if (!abs) throw new Error(`doc not found: ${docPath}`);
-  const content = readFileSync10(abs, "utf8");
+  const content = readFileSync11(abs, "utf8");
   const title = extractTitle(abs, "md");
   const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
   const prompt = `Publish the document at \`${docPath}\` (already read below) as a Claude Artifact, then record the result as a stub file under this channel's \`docs/artifacts/\` folder (create the folder if it doesn't exist).
@@ -10431,7 +10440,7 @@ function extractTitle(absPath, kind) {
 }
 function resolveDirPath(root, rel) {
   if (rel.includes("\0")) return null;
-  const abs = resolve5(root, rel);
+  const abs = resolve4(root, rel);
   if (abs !== root && !abs.startsWith(root + sep)) return null;
   return abs;
 }
@@ -10481,12 +10490,12 @@ function readGitBranch(dir) {
   try {
     let gitDir = join18(dir, ".git");
     if (statSync5(gitDir).isFile()) {
-      const pointer = readFileSync11(gitDir, "utf8").trim();
+      const pointer = readFileSync12(gitDir, "utf8").trim();
       const match = pointer.match(/^gitdir:\s*(.+)$/);
       if (!match) return void 0;
-      gitDir = resolve5(dir, match[1]);
+      gitDir = resolve4(dir, match[1]);
     }
-    const head = readFileSync11(join18(gitDir, "HEAD"), "utf8").trim();
+    const head = readFileSync12(join18(gitDir, "HEAD"), "utf8").trim();
     const branchMatch = head.match(/^ref:\s*refs\/heads\/(.+)$/);
     if (branchMatch) return branchMatch[1];
     return /^[0-9a-f]{7,40}$/i.test(head) ? head.slice(0, 7) : void 0;
@@ -10515,7 +10524,7 @@ function listDocLevel(root, relDir = "", sort = "newest", showHidden = false) {
       if (SKIP_DIRS.has(entry.name)) continue;
       const probe3 = probeDir(abs, showHidden);
       if (!probe3.hasDocs && probe3.hasOther) continue;
-      const isRepo = existsSync17(join18(abs, ".git"));
+      const isRepo = existsSync16(join18(abs, ".git"));
       dirs.push({
         path,
         name: entry.name,
@@ -10571,7 +10580,7 @@ function flatDocs(root, {
 }
 function resolveDocPath(root, rel) {
   if (!rel || rel.includes("\0")) return null;
-  const abs = resolve5(root, rel);
+  const abs = resolve4(root, rel);
   if (abs !== root && !abs.startsWith(root + sep)) return null;
   const ext = extname(abs).toLowerCase();
   if (!(ext in DOC_EXTENSIONS) && !(ext in CODE_EXTENSIONS)) return null;
@@ -10593,12 +10602,12 @@ function writeDocContent(root, rel, content, baseMtime) {
   if (Buffer.byteLength(content, "utf8") > MAX_CONTENT_BYTES) {
     return { status: "too-large" };
   }
-  writeFileSync7(abs, content, "utf8");
+  writeFileSync8(abs, content, "utf8");
   return { status: "ok", mtime: statSync5(abs).mtime.toISOString() };
 }
 function resolveRawPath(root, rel) {
   if (!rel || rel.includes("\0")) return null;
-  const abs = resolve5(root, rel);
+  const abs = resolve4(root, rel);
   if (abs !== root && !abs.startsWith(root + sep)) return null;
   const contentType = MEDIA_EXTENSIONS[extname(abs).toLowerCase()];
   if (!contentType) return null;
@@ -10606,14 +10615,14 @@ function resolveRawPath(root, rel) {
 }
 function resolveHtmlPath(root, rel) {
   if (!rel || rel.includes("\0")) return null;
-  const abs = resolve5(root, rel);
+  const abs = resolve4(root, rel);
   if (abs !== root && !abs.startsWith(root + sep)) return null;
   if (DOC_EXTENSIONS[extname(abs).toLowerCase()] !== "html") return null;
   return abs;
 }
 function resolveDownloadPath(root, rel) {
   if (!rel || rel.includes("\0")) return null;
-  const abs = resolve5(root, rel);
+  const abs = resolve4(root, rel);
   if (abs !== root && !abs.startsWith(root + sep)) return null;
   if (!isListableFile(basename6(abs))) return null;
   const contentType = MEDIA_EXTENSIONS[extname(abs).toLowerCase()] ?? "application/octet-stream";
@@ -10654,7 +10663,7 @@ function saveUploadedFile(root, relDir, name, data) {
   if (data.byteLength > MAX_UPLOAD_BYTES) return { status: "too-large" };
   const final = uniqueName(absDir, safe);
   const abs = join18(absDir, final);
-  writeFileSync7(abs, data);
+  writeFileSync8(abs, data);
   return { status: "ok", path: relative(root, abs).split(sep).join("/"), name: final };
 }
 function createDocFolder(root, relDir, name) {
@@ -10692,7 +10701,7 @@ function createDocFile(root, relDir, name, content) {
   if (Buffer.byteLength(content, "utf8") > MAX_CONTENT_BYTES) return { status: "too-large" };
   const abs = join18(absDir, safe);
   try {
-    writeFileSync7(abs, content, { encoding: "utf8", flag: "wx" });
+    writeFileSync8(abs, content, { encoding: "utf8", flag: "wx" });
   } catch (err) {
     if (err.code === "EEXIST") return { status: "exists" };
     throw err;
@@ -10701,7 +10710,7 @@ function createDocFile(root, relDir, name, content) {
 }
 function moveDocEntry(root, from, to) {
   if (!from || !to || from.includes("\0") || to.includes("\0")) return { status: "not-found" };
-  const absFrom = resolve5(root, from);
+  const absFrom = resolve4(root, from);
   if (!absFrom.startsWith(root + sep)) return { status: "not-found" };
   let stat;
   try {
@@ -10711,7 +10720,7 @@ function moveDocEntry(root, from, to) {
   }
   const isDir2 = stat.isDirectory();
   if (!isDir2 && !stat.isFile()) return { status: "not-found" };
-  const absTo = resolve5(root, to);
+  const absTo = resolve4(root, to);
   if (!absTo.startsWith(root + sep)) return { status: "bad-target" };
   const name = sanitizeUploadName(basename6(absTo));
   if (!name) return { status: "bad-target" };
@@ -10741,7 +10750,7 @@ function moveDocEntry(root, from, to) {
 }
 function deleteDocEntry(root, path) {
   if (!path || path.includes("\0")) return { status: "not-found" };
-  const abs = resolve5(root, path);
+  const abs = resolve4(root, path);
   if (!abs.startsWith(root + sep)) return { status: "not-found" };
   let stat;
   try {
@@ -10751,17 +10760,17 @@ function deleteDocEntry(root, path) {
   }
   const isDir2 = stat.isDirectory();
   if (!isDir2 && !stat.isFile() && !stat.isSymbolicLink()) return { status: "not-found" };
-  rmSync5(abs, { recursive: isDir2 });
+  rmSync6(abs, { recursive: isDir2 });
   return {
     status: "ok",
     path: relative(root, abs).split(sep).join("/"),
     type: isDir2 ? "dir" : "file"
   };
 }
-function createDocsRouter() {
+function createDocsRouter({ gate = requireDocsAccess } = {}) {
   const app = new Hono10();
-  app.use("/:id/docs", requireDocsAccess);
-  app.use("/:id/docs/*", requireDocsAccess);
+  app.use("/:id/docs", gate);
+  app.use("/:id/docs/*", gate);
   app.get("/:id/docs", (c) => {
     const { cwd } = resolveChannelConfig(c.req.param("id"));
     const dir = c.req.query("path") ?? "";
@@ -10790,7 +10799,7 @@ function createDocsRouter() {
     }
     if (!stat.isFile()) return c.json({ error: "not found" }, 404);
     if (stat.size > MAX_RAW_BYTES) return c.json({ error: "file too large" }, 413);
-    const data = readFileSync11(resolved2.abs);
+    const data = readFileSync12(resolved2.abs);
     const headers = { "Content-Type": resolved2.contentType };
     if (download) {
       const filename = basename6(resolved2.abs).replace(/"/g, "");
@@ -10810,7 +10819,7 @@ function createDocsRouter() {
     }
     if (!stat.isFile()) return c.json({ error: "not found" }, 404);
     if (stat.size > MAX_RAW_BYTES) return c.json({ error: "file too large" }, 413);
-    return c.body(new Uint8Array(readFileSync11(abs)), 200, {
+    return c.body(new Uint8Array(readFileSync12(abs)), 200, {
       "Content-Type": "text/html; charset=utf-8",
       "Content-Security-Policy": HTML_SHARE_CSP,
       "X-Content-Type-Options": "nosniff",
@@ -10995,7 +11004,7 @@ function createDocsRouter() {
       title: kind ? extractTitle(abs, kind) : basename6(abs),
       mtime: stat.mtime.toISOString(),
       tooLarge: tooLarge || void 0,
-      content: tooLarge ? "" : readFileSync11(abs, "utf8")
+      content: tooLarge ? "" : readFileSync12(abs, "utf8")
     });
   });
   app.put("/:id/docs/content", async (c) => {
@@ -11038,7 +11047,7 @@ function createDocsRouter() {
       channel,
       rel,
       title: extractTitle(abs, "md"),
-      content: readFileSync11(abs, "utf8")
+      content: readFileSync12(abs, "utf8")
     };
   };
   app.get("/:id/docs/translation/:lang", async (c) => {
@@ -11234,13 +11243,13 @@ function relay(agent, pathOf) {
 }
 
 // src/dashboard/skills-routes.ts
-import { existsSync as existsSync19, statSync as statSync7 } from "fs";
+import { existsSync as existsSync18, statSync as statSync7 } from "fs";
 import { dirname as dirname6 } from "path";
 import { Hono as Hono12 } from "hono";
 
 // src/dashboard/skill-mirror.ts
 import { createHash as createHash8 } from "crypto";
-import { existsSync as existsSync18, statSync as statSync6 } from "fs";
+import { existsSync as existsSync17, statSync as statSync6 } from "fs";
 var SYNC_INTERVAL_MS = 6e4;
 var UPSERT_BATCH = 50;
 function mirrorScopeOf(ref) {
@@ -11248,7 +11257,7 @@ function mirrorScopeOf(ref) {
 }
 function isDir(path) {
   try {
-    return existsSync18(path) && statSync6(path).isDirectory();
+    return existsSync17(path) && statSync6(path).isDirectory();
   } catch {
     return false;
   }
@@ -11389,7 +11398,7 @@ function requireAdmin2(auth) {
 }
 function rootExists(dir) {
   try {
-    return existsSync19(dir) && statSync7(dir).isDirectory();
+    return existsSync18(dir) && statSync7(dir).isDirectory();
   } catch {
     return false;
   }
@@ -11578,9 +11587,9 @@ function registerMirroredSkillRoutes(api, agent) {
 
 // src/dashboard/providers.ts
 import { execFileSync as execFileSync2 } from "child_process";
-import { existsSync as existsSync20 } from "fs";
+import { existsSync as existsSync19 } from "fs";
 import { homedir as homedir8 } from "os";
-import { join as join19, resolve as resolve6 } from "path";
+import { join as join19, resolve as resolve5 } from "path";
 var PROVIDER_LABELS = {
   claude: "Claude Code",
   codex: "Codex"
@@ -11597,8 +11606,8 @@ function binaryOnPath(bin) {
 }
 function claudeAuthAvailable() {
   if (profileEnv("CLAUDE_CODE_OAUTH_TOKEN")?.trim()) return true;
-  const configDir2 = profileClaudeConfigDir() || resolve6(homedir8(), ".claude");
-  if (existsSync20(join19(configDir2, ".credentials.json"))) return true;
+  const configDir2 = profileClaudeConfigDir() || resolve5(homedir8(), ".claude");
+  if (existsSync19(join19(configDir2, ".credentials.json"))) return true;
   if (process.platform !== "darwin") return false;
   try {
     execFileSync2("security", ["find-generic-password", "-s", "Claude Code-credentials"], {
@@ -11626,13 +11635,23 @@ function probe2(runner) {
   }
   return { runner, label: label2, connected: true };
 }
+function withAuthFailure(status) {
+  if (!claudeAuthFailed()) return status;
+  return {
+    ...status,
+    connected: false,
+    reason: `Sign-in expired and could not be refreshed. On the Host, run claude setup-token, add the token to ~/.config/flyspace/profiles/${getProfile()}/config.env as CLAUDE_CODE_OAUTH_TOKEN, then restart the Host.`
+  };
+}
 function providerStatuses() {
   const key = getProfile();
   const hit = cache6.get(key);
-  if (hit && Date.now() - hit.at < TTL_MS2) return hit.statuses;
-  const statuses = ["claude", "codex"].map(probe2);
-  cache6.set(key, { at: Date.now(), statuses });
-  return statuses;
+  let statuses = hit && Date.now() - hit.at < TTL_MS2 ? hit.statuses : void 0;
+  if (!statuses) {
+    statuses = ["claude", "codex"].map(probe2);
+    cache6.set(key, { at: Date.now(), statuses });
+  }
+  return statuses.map((st) => st.runner === "claude" && st.connected ? withAuthFailure(st) : st);
 }
 
 // src/dashboard/host-api.ts
@@ -11742,7 +11761,7 @@ function registerHostRoutes(api) {
     const limit = Math.min(Number(c.req.query("limit")) || 200, 2e3);
     const filename = errors ? "custie-error.log" : "custie.log";
     const file = join20(paths.LOG_DIR, filename);
-    const exists = existsSync21(file);
+    const exists = existsSync20(file);
     return c.json({
       file,
       exists,
@@ -11752,14 +11771,14 @@ function registerHostRoutes(api) {
   });
 }
 function tailFile(file, limit) {
-  if (!existsSync21(file)) return [];
-  const lines = readFileSync12(file, "utf-8").split("\n");
+  if (!existsSync20(file)) return [];
+  const lines = readFileSync13(file, "utf-8").split("\n");
   if (lines.at(-1) === "") lines.pop();
   return lines.slice(-limit);
 }
 
 // src/dashboard/data-api.ts
-import { existsSync as existsSync23 } from "fs";
+import { existsSync as existsSync22 } from "fs";
 import sharp5 from "sharp";
 
 // src/dashboard/automations-routes.ts
@@ -13533,7 +13552,7 @@ function createTranscribeRouter() {
 }
 
 // src/dashboard/avatars-routes.ts
-import { randomUUID as randomUUID2 } from "crypto";
+import { createHash as createHash10, randomUUID as randomUUID2 } from "crypto";
 import { Hono as Hono20 } from "hono";
 import sharp4 from "sharp";
 import { PutObjectCommand as PutObjectCommand4, DeleteObjectCommand as DeleteObjectCommand4 } from "@aws-sdk/client-s3";
@@ -13541,6 +13560,16 @@ var AVATAR_SIZE = 192;
 var MAX_AVATAR_BYTES = 2 * 1024 * 1024;
 var AVATAR_MIME_TYPES = ["image/png", "image/jpeg"];
 var KEY_PREFIX3 = "avatar";
+var GRAVATAR_TIMEOUT_MS = 5e3;
+async function fetchGravatar(email) {
+  const hash = createHash10("sha256").update(email.trim().toLowerCase()).digest("hex");
+  const res = await fetch(`https://gravatar.com/avatar/${hash}?s=${AVATAR_SIZE}&d=404`, {
+    signal: AbortSignal.timeout(GRAVATAR_TIMEOUT_MS)
+  }).catch(() => null);
+  if (!res?.ok) return null;
+  const type = res.headers.get("content-type")?.split(";")[0] ?? "";
+  return new File([await res.arrayBuffer()], "gravatar", { type });
+}
 async function saveAvatarKey(userId, avatarKey) {
   const { data, error: getError } = await getSupabaseClient().auth.admin.getUserById(userId);
   if (getError || !data.user) {
@@ -13602,6 +13631,17 @@ function createAvatarsRouter() {
     }
     return c.json({ avatarUrl: await signAvatarUrl(key) }, 201);
   });
+  app.post("/avatars/gravatar", async (c) => {
+    const ctx = await resolveAuthContext(c);
+    if (!ctx) return c.json({ error: "not signed in" }, 401);
+    if (ctx.avatarKey) return c.json({ avatarUrl: await signAvatarUrl(ctx.avatarKey) });
+    const file = await fetchGravatar(ctx.email);
+    if (!file) return c.json({ avatarUrl: null });
+    const stored = await storeAvatar(file, ctx.userId);
+    if ("error" in stored) return c.json({ avatarUrl: null });
+    await saveAvatarKey(ctx.userId, stored.key);
+    return c.json({ avatarUrl: await signAvatarUrl(stored.key) }, 201);
+  });
   app.delete("/avatars", async (c) => {
     const ctx = await resolveAuthContext(c);
     if (!ctx) return c.json({ error: "not signed in" }, 401);
@@ -14606,7 +14646,7 @@ async function sessionUsageForThreads(workspace, threadTsList) {
 }
 
 // src/dashboard/usage-report.ts
-import { existsSync as existsSync22 } from "fs";
+import { existsSync as existsSync21 } from "fs";
 function mergeByLabel(buckets) {
   const merged = /* @__PURE__ */ new Map();
   for (const bucket of buckets) {
@@ -14652,7 +14692,7 @@ function toReport(days, rows, labelChannel) {
   };
 }
 function fromLocalStore(days, labelChannel) {
-  if (!existsSync22(paths.DB_FILE)) return { ...EMPTY, days };
+  if (!existsSync21(paths.DB_FILE)) return { ...EMPTY, days };
   const window = days === 0 ? void 0 : days;
   const store = new UsageStore(paths.DB_FILE);
   try {
@@ -14694,7 +14734,7 @@ async function buildChannelUsageReport(channelId, days, labelChannel) {
     const { totals, byDay } = await channelUsageForWorkspace(workspace, aliasIds, window);
     return { days, totals: totals.runs > 0 ? totals : null, byDay };
   } catch {
-    if (!existsSync22(paths.DB_FILE)) return { days, totals: null, byDay: [] };
+    if (!existsSync21(paths.DB_FILE)) return { days, totals: null, byDay: [] };
     const store = new UsageStore(paths.DB_FILE);
     try {
       const targetLabel = labelChannel(channelId);
@@ -14716,7 +14756,7 @@ async function buildThreadUsage(threadTs) {
     if (totals.runs === 0) return { threadTs, totals: null, byModel: [] };
     return { threadTs, totals, byModel };
   } catch {
-    if (!existsSync22(paths.DB_FILE)) return { threadTs, totals: null, byModel: [] };
+    if (!existsSync21(paths.DB_FILE)) return { threadTs, totals: null, byModel: [] };
     const store = new UsageStore(paths.DB_FILE);
     try {
       const totals = store.threadTotals(threadTs);
@@ -15076,10 +15116,10 @@ function createOnboardingRouter(agent) {
 var HOST_STATUS_CHANNEL = "host-status";
 var channelReady = null;
 function getHostStatusChannel() {
-  channelReady ??= new Promise((resolve8) => {
+  channelReady ??= new Promise((resolve7) => {
     const channel = getSupabaseClient().channel(HOST_STATUS_CHANNEL);
     channel.subscribe((state) => {
-      if (state === "SUBSCRIBED") resolve8(channel);
+      if (state === "SUBSCRIBED") resolve7(channel);
     });
   });
   return channelReady;
@@ -15245,7 +15285,7 @@ function registerDataRoutes(api, agent = {}) {
         runs.set(name, { lastRun: run3.lastRunAt.toISOString(), lastStatus: run3.lastStatus });
       }
     } catch {
-      if (existsSync23(paths.DB_FILE)) {
+      if (existsSync22(paths.DB_FILE)) {
         const runStore = new AutomationRunStore(paths.DB_FILE);
         try {
           for (const run3 of runStore.listLastRuns()) {
@@ -15307,7 +15347,7 @@ function registerDataRoutes(api, agent = {}) {
       const runs = (await recentRunsForWorkspace(getProfile(), 200)).map(toResponse5);
       return c.json({ runs });
     } catch {
-      if (!existsSync23(paths.DB_FILE)) return c.json({ runs: [] });
+      if (!existsSync22(paths.DB_FILE)) return c.json({ runs: [] });
       const runStore = new AutomationRunStore(paths.DB_FILE);
       try {
         const runs = runStore.listRuns(200).map(toResponse5);
@@ -15429,7 +15469,7 @@ function registerDataRoutes(api, agent = {}) {
     } catch {
       latest = /* @__PURE__ */ new Map();
       totals = /* @__PURE__ */ new Map();
-      if (existsSync23(paths.DB_FILE)) {
+      if (existsSync22(paths.DB_FILE)) {
         const usageStore = new UsageStore(paths.DB_FILE);
         try {
           latest = usageStore.latestByThread(threadTsList);
@@ -15484,28 +15524,94 @@ function registerDataRoutes(api, agent = {}) {
 // src/dashboard/device-auth-routes.ts
 import { verify } from "crypto";
 import { getConnInfo } from "@hono/node-server/conninfo";
-import { Hono as Hono29 } from "hono";
+import { Hono as Hono30 } from "hono";
 
 // src/dashboard/agent-bridge.ts
 import { randomBytes as randomBytes8, randomUUID as randomUUID4, sign as signRaw, timingSafeEqual as timingSafeEqual2, verify as verifyRaw } from "crypto";
-import { existsSync as existsSync25, readFileSync as readFileSync16 } from "fs";
+
+// src/dashboard/docs-relay.ts
+import { Hono as Hono29 } from "hono";
+import { streamSSE as streamSSE2 } from "hono/streaming";
+var FORWARDED_HEADERS = ["content-type", "host", "accept-language"];
+var RETURNED_HEADERS = ["content-type", "content-disposition", "content-security-policy", "cache-control"];
+async function handleDocsRequest(req) {
+  const app = new Hono29();
+  app.use("*", async (c, next) => {
+    c.set("auth", req.auth);
+    await next();
+  });
+  app.route("/channels", createDocsRouter({ gate: async (_c, next) => next() }));
+  const res = await app.request(req.path, {
+    method: req.method,
+    headers: req.headers,
+    ...req.body !== void 0 && { body: Buffer.from(req.body, "base64") }
+  });
+  const headers = {};
+  for (const name of RETURNED_HEADERS) {
+    const value = res.headers.get(name);
+    if (value) headers[name] = value;
+  }
+  return { status: res.status, headers, body: Buffer.from(await res.arrayBuffer()).toString("base64") };
+}
+function registerRelayedDocsRoutes(api, agent) {
+  api.get(
+    "/channels/:id/docs/watch",
+    requireDocsAccess,
+    (c) => streamSSE2(c, async (stream) => {
+      await stream.writeSSE({ event: "unavailable", data: "{}" });
+    })
+  );
+  api.all("/channels/:id/docs", requireDocsAccess, relay2(agent));
+  api.all("/channels/:id/docs/*", requireDocsAccess, relay2(agent));
+}
+function relay2(agent) {
+  return async (c) => {
+    const url = new URL(c.req.url);
+    const path = url.pathname.slice(url.pathname.indexOf("/channels/")) + url.search;
+    const headers = {};
+    for (const name of FORWARDED_HEADERS) {
+      const value = c.req.header(name);
+      if (value) headers[name] = value;
+    }
+    const hasBody = c.req.method !== "GET" && c.req.method !== "HEAD";
+    const body = hasBody ? Buffer.from(await c.req.arrayBuffer()).toString("base64") : void 0;
+    const result = await agent.docsRequest?.({
+      method: c.req.method,
+      path,
+      headers,
+      body,
+      auth: c.get("auth")
+    });
+    if (!result) {
+      return c.json({ error: "Docs need the Host machine, which is not connected right now." }, 503);
+    }
+    const empty = c.req.method === "HEAD" || result.status === 204 || result.status === 304;
+    return new Response(empty ? null : Buffer.from(result.body, "base64"), {
+      status: result.status,
+      headers: result.headers
+    });
+  };
+}
+
+// src/dashboard/agent-bridge.ts
+import { existsSync as existsSync24, readFileSync as readFileSync17 } from "fs";
 import dotenv from "dotenv";
 import { WebSocket, WebSocketServer } from "ws";
 
 // src/dashboard/host-identity.ts
 import { createPrivateKey as createPrivateKey2, createPublicKey as createPublicKey2, generateKeyPairSync as generateKeyPairSync2 } from "crypto";
-import { existsSync as existsSync24, mkdirSync as mkdirSync9, readFileSync as readFileSync13, writeFileSync as writeFileSync8 } from "fs";
+import { existsSync as existsSync23, mkdirSync as mkdirSync9, readFileSync as readFileSync14, writeFileSync as writeFileSync9 } from "fs";
 import { dirname as dirname7, join as join21 } from "path";
 function hostPrivateKeyPath() {
   return process.env["FLYSPACE_HOST_KEY_PATH"] || join21(paths.BASE_CONFIG_DIR, "host.key");
 }
 function loadHostPrivateKey(path = hostPrivateKeyPath()) {
-  if (!existsSync24(path)) {
+  if (!existsSync23(path)) {
     throw new Error(
       `No Host identity at ${path}. Run \`pnpm run generate-host-key\` on this machine, then set FLYSPACE_HOST_PUBLIC_KEY on the Data process to the printed public key.`
     );
   }
-  return createPrivateKey2(readFileSync13(path, "utf8"));
+  return createPrivateKey2(readFileSync14(path, "utf8"));
 }
 function loadHostPublicKey() {
   const b64 = process.env["FLYSPACE_HOST_PUBLIC_KEY"];
@@ -15521,7 +15627,7 @@ function loadHostPublicKey() {
 // src/dashboard/host-lock.ts
 import { execFileSync as execFileSync3 } from "child_process";
 import { randomBytes as randomBytes5 } from "crypto";
-import { mkdirSync as mkdirSync10, readFileSync as readFileSync14, rmSync as rmSync6, writeFileSync as writeFileSync9 } from "fs";
+import { mkdirSync as mkdirSync10, readFileSync as readFileSync15, rmSync as rmSync7, writeFileSync as writeFileSync10 } from "fs";
 import { join as join22 } from "path";
 function hostLockPath() {
   return join22(paths.BASE_DATA_DIR, "host.lock");
@@ -15539,7 +15645,7 @@ function isLiveFlyspace(pid) {
 }
 function readLockPid(path) {
   try {
-    const pid = Number(JSON.parse(readFileSync14(path, "utf8")).pid);
+    const pid = Number(JSON.parse(readFileSync15(path, "utf8")).pid);
     return Number.isInteger(pid) && pid > 0 ? pid : null;
   } catch {
     return null;
@@ -15555,9 +15661,9 @@ function acquireHostLock() {
   });
   for (let attempt = 0; attempt < 2; attempt++) {
     try {
-      writeFileSync9(path, body, { flag: "wx", mode: 384 });
+      writeFileSync10(path, body, { flag: "wx", mode: 384 });
       const release2 = () => {
-        if (readLockPid(path) === process.pid) rmSync6(path, { force: true });
+        if (readLockPid(path) === process.pid) rmSync7(path, { force: true });
       };
       process.once("exit", release2);
       return release2;
@@ -15571,7 +15677,7 @@ function acquireHostLock() {
           `Another Flyspace Host is already running on this machine (pid ${holder}). Stop it first, or check for a second CLI install (\`which -a flyspace\`). Two Hosts overwrite each other's skill mirror.`
         );
       }
-      rmSync6(path, { force: true });
+      rmSync7(path, { force: true });
     }
   }
   throw new Error(`Could not take the Host lock at ${path}`);
@@ -15580,13 +15686,13 @@ function publishHostEndpoint(port) {
   const path = hostLockPath();
   if (readLockPid(path) !== process.pid) return null;
   const token = randomBytes5(32).toString("hex");
-  const lock = JSON.parse(readFileSync14(path, "utf8"));
-  writeFileSync9(path, JSON.stringify({ ...lock, port, token }), { mode: 384 });
+  const lock = JSON.parse(readFileSync15(path, "utf8"));
+  writeFileSync10(path, JSON.stringify({ ...lock, port, token }), { mode: 384 });
   return token;
 }
 function readHostEndpoint() {
   try {
-    const { pid, port, token } = JSON.parse(readFileSync14(hostLockPath(), "utf8"));
+    const { pid, port, token } = JSON.parse(readFileSync15(hostLockPath(), "utf8"));
     if (pid === process.pid || !Number.isInteger(port) || typeof token !== "string") return null;
     return { port, token };
   } catch {
@@ -15595,12 +15701,12 @@ function readHostEndpoint() {
 }
 
 // src/store/device-store.ts
-import { createHash as createHash10, createPublicKey as createPublicKey3, randomBytes as randomBytes6, randomInt } from "crypto";
+import { createHash as createHash11, createPublicKey as createPublicKey3, randomBytes as randomBytes6, randomInt } from "crypto";
 var DEVICE_CODE_TTL_MS = 10 * 6e4;
 var ACCESS_TOKEN_TTL_MS = 15 * 6e4;
 var CHALLENGE_TTL_MS = 2 * 6e4;
 var POLL_INTERVAL_S = 5;
-var sha256 = (s) => createHash10("sha256").update(s).digest("hex");
+var sha256 = (s) => createHash11("sha256").update(s).digest("hex");
 function parseEd25519PublicKey(b64) {
   if (typeof b64 !== "string" || b64.length > 200) return null;
   try {
@@ -15826,7 +15932,7 @@ async function userEmail(userId) {
 
 // src/dashboard/doc-share-publisher.ts
 import { randomBytes as randomBytes7 } from "crypto";
-import { readFileSync as readFileSync15, statSync as statSync9 } from "fs";
+import { readFileSync as readFileSync16, statSync as statSync9 } from "fs";
 import { extname as extname2, posix } from "path";
 import { CopyObjectCommand, PutObjectCommand as PutObjectCommand5 } from "@aws-sdk/client-s3";
 
@@ -16013,7 +16119,7 @@ async function buildSnapshot(cwd, sourcePath, shareId) {
   }
   if (!stat.isFile()) return { status: "not-found" };
   if (stat.size > MAX_CONTENT_BYTES2) return { status: "too-large" };
-  const source = readFileSync15(abs, "utf8");
+  const source = readFileSync16(abs, "utf8");
   const title = extractTitle(abs, kind === "markdown" ? "md" : kind);
   if (kind === "excalidraw") {
     try {
@@ -16093,7 +16199,7 @@ async function buildSnapshot(cwd, sourcePath, shareId) {
       let text = null;
       try {
         const size = statSync9(docAbs).size;
-        if (size <= budget) text = readFileSync15(docAbs, "utf8");
+        if (size <= budget) text = readFileSync16(docAbs, "utf8");
       } catch {
         continue;
       }
@@ -16110,7 +16216,7 @@ async function buildSnapshot(cwd, sourcePath, shareId) {
     let body;
     try {
       if (statSync9(resolved2.abs).size > MAX_ASSET_BYTES) continue;
-      body = readFileSync15(resolved2.abs);
+      body = readFileSync16(resolved2.abs);
     } catch {
       continue;
     }
@@ -16201,9 +16307,13 @@ var METHODS = {
   agent_usage: ["GET", "HEAD", "POST"],
   skill_files: ALL,
   threads: ["GET", "HEAD", "POST", "PATCH"],
-  thread_replies: ["GET", "HEAD", "POST", "PATCH"]
+  thread_replies: ["GET", "HEAD", "POST", "PATCH"],
+  memberships: ["GET", "HEAD"],
+  channel_members: ["GET", "HEAD"],
+  channel_docs_access: ["GET", "HEAD"]
 };
-var FORWARDED_HEADERS = ["accept", "content-type", "prefer", "range"];
+var CHANNEL_SCOPED = /* @__PURE__ */ new Set(["channel_members", "channel_docs_access"]);
+var FORWARDED_HEADERS2 = ["accept", "content-type", "prefer", "range"];
 var deny = (message, status = 403) => ({
   status,
   headers: { "content-type": "application/json" },
@@ -16245,6 +16355,13 @@ async function ownedChannelIds(forward, slugs) {
   if (!rows) return null;
   return rows.flatMap((r) => [r.id, r.external_channel_id].filter((v) => !!v));
 }
+async function ownedWorkspaceIds(forward, slugs) {
+  const rows = await getJson(
+    forward,
+    `/rest/v1/workspaces?select=id&slug=${encodeURIComponent(inList(slugs))}`
+  );
+  return rows ? rows.map((r) => r.id) : null;
+}
 async function threadsOwned(forward, threadIds, channelIds) {
   const wanted = [...new Set(threadIds)];
   if (wanted.length === 0 || channelIds.length === 0) return false;
@@ -16302,10 +16419,16 @@ async function proxyHostDb(workspaces, req, forward, assigned = workspaces ?? []
       }
     }
     params.append(slugColumn, inList(scope));
+  } else if (table === "memberships") {
+    const workspaceIds = await ownedWorkspaceIds(forward, workspaces);
+    if (!workspaceIds) return deny("Could not resolve the device workspaces.", 502);
+    params.append("workspace_id", inList(workspaceIds));
   } else {
     const channelIds = await ownedChannelIds(forward, workspaces);
     if (!channelIds) return deny("Could not resolve the device workspaces.", 502);
-    if (table === "threads") {
+    if (CHANNEL_SCOPED.has(table)) {
+      params.append("channel_id", inList(channelIds));
+    } else if (table === "threads") {
       if (method === "POST") {
         const ok3 = rows.length > 0 && rows.every((r) => typeof r["channel_id"] === "string" && channelIds.includes(r["channel_id"]));
         if (!ok3) return deny("A thread must belong to a channel of the device workspaces.");
@@ -16326,7 +16449,7 @@ async function proxyHostDb(workspaces, req, forward, assigned = workspaces ?? []
     }
   }
   const headers = {};
-  for (const name of FORWARDED_HEADERS) {
+  for (const name of FORWARDED_HEADERS2) {
     const value = req.headers[name];
     if (value !== void 0) headers[name] = value;
   }
@@ -16390,14 +16513,14 @@ function handleHostDbResult(id, res) {
 }
 function whenConnected() {
   if (sender) return Promise.resolve(sender);
-  return new Promise((resolve8, reject) => {
+  return new Promise((resolve7, reject) => {
     const timer2 = setTimeout(() => {
       onSender = onSender.filter((w) => w !== wake);
       reject(new Error("Host is not connected to the Data API"));
     }, REQUEST_TIMEOUT_MS3);
     const wake = () => {
       clearTimeout(timer2);
-      resolve8(sender);
+      resolve7(sender);
     };
     onSender.push(wake);
   });
@@ -16405,12 +16528,12 @@ function whenConnected() {
 async function request(req) {
   const send2 = await whenConnected();
   const id = randomUUID3();
-  return new Promise((resolve8, reject) => {
+  return new Promise((resolve7, reject) => {
     const timer2 = setTimeout(() => {
       pending.delete(id);
       reject(new Error("Data API did not answer in time"));
     }, REQUEST_TIMEOUT_MS3);
-    pending.set(id, { resolve: resolve8, reject, timer: timer2 });
+    pending.set(id, { resolve: resolve7, reject, timer: timer2 });
     send2({ type: "db", id, req });
   });
 }
@@ -16470,7 +16593,7 @@ function dataSocketUrl() {
   return `ws://127.0.0.1:${process.env["FLYSPACE_DATA_API_PORT"] ?? DEFAULT_DATA_API_PORT}${HOST_SOCKET_PATH}`;
 }
 function listLocalSessions() {
-  if (!existsSync25(paths.DB_FILE)) return [];
+  if (!existsSync24(paths.DB_FILE)) return [];
   const store = new SessionStore(paths.DB_FILE);
   try {
     return store.listSessions();
@@ -16496,6 +16619,7 @@ function localAgentCallbacks(chatAgent) {
     saveLocalDashboardSettings: (patch) => saveDashboardSettings(patch),
     writeSkill: (ref, write) => writeSkillAndSync(ref, write),
     outputStylesRequest: (req) => handleOutputStylesRequest(req),
+    docsRequest: (req) => handleDocsRequest(req),
     listSessions: () => listLocalSessions(),
     scanOnboarding: () => scanOnboarding(),
     linkProjectFolders: (slug, items) => linkProjectFolders(slug, items),
@@ -16507,7 +16631,7 @@ function buildHostConfigSnapshot() {
   const snapshot3 = {};
   for (const profile of listProfiles()) {
     snapshot3[profile] = runWithProfile(profile, () => ({
-      env: existsSync25(paths.CONFIG_FILE) ? dotenv.parse(readFileSync16(paths.CONFIG_FILE, "utf-8")) : {},
+      env: existsSync24(paths.CONFIG_FILE) ? dotenv.parse(readFileSync17(paths.CONFIG_FILE, "utf-8")) : {},
       agentModel: loadDashboardSettings().agent
     }));
   }
@@ -16519,6 +16643,7 @@ function startLocalProfileConfigHydration() {
   return () => clearInterval(timer2);
 }
 var CALL_TIMEOUT_MS = 15e3;
+var DOCS_CALL_TIMEOUT_MS = 12e4;
 var AUTH_TIMEOUT_MS = 5e3;
 var HEARTBEAT_INTERVAL_MS = 15e3;
 var HEARTBEAT_TIMEOUT_MS = HEARTBEAT_INTERVAL_MS * 2.5;
@@ -16708,7 +16833,7 @@ function attachHostSocket(server) {
   });
   return wss;
 }
-function callHost(method, args) {
+function callHost(method, args, timeoutMs = CALL_TIMEOUT_MS) {
   const profile = getProfile();
   const ws = hostFor(profile);
   if (!ws) {
@@ -16718,16 +16843,16 @@ function callHost(method, args) {
     return Promise.resolve(null);
   }
   const id = randomUUID4();
-  return new Promise((resolve8) => {
+  return new Promise((resolve7) => {
     const timer2 = setTimeout(() => {
       pending2.delete(id);
       console.error(`[host-socket] ${method} -> timed out`);
-      resolve8(null);
-    }, CALL_TIMEOUT_MS);
+      resolve7(null);
+    }, timeoutMs);
     pending2.set(id, {
       resolve: (value) => {
         clearTimeout(timer2);
-        resolve8(value);
+        resolve7(value);
       }
     });
     send(ws, { type: "call", id, method, profile, args });
@@ -16778,6 +16903,9 @@ function remoteAgentCallbacks() {
     writeSkill: (ref, write) => callHost("writeSkill", [ref, write]),
     // Same posture as writeSkill: `null` becomes a 503.
     outputStylesRequest: (req) => callHost("outputStylesRequest", [req]),
+    // Same posture again. Longer timeout: a first translation of a doc runs a
+    // model call on the Host before it answers.
+    docsRequest: (req) => callHost("docsRequest", [req], DOCS_CALL_TIMEOUT_MS),
     // `null` (no Host connected) is passed through rather than defaulting to
     // `[]` — see listSessions's doc comment on AgentCallbacks.
     listSessions: () => callHost("listSessions", []),
@@ -16915,7 +17043,7 @@ var RELAYED_METHODS = [
   "listAgentRuns"
 ];
 function relayedAgentCallbacks(local) {
-  const relay2 = (method) => async (...args) => {
+  const relay3 = (method) => async (...args) => {
     const endpoint = readHostEndpoint();
     if (endpoint) {
       try {
@@ -16935,7 +17063,7 @@ function relayedAgentCallbacks(local) {
   };
   return {
     ...local,
-    ...Object.fromEntries(RELAYED_METHODS.map((method) => [method, relay2(method)]))
+    ...Object.fromEntries(RELAYED_METHODS.map((method) => [method, relay3(method)]))
   };
 }
 async function handleLocalRelay(req, callbacks, token) {
@@ -17038,7 +17166,7 @@ async function boundWorkspaceIds(publicKey, userId) {
   return new Set(existing ? (await listDeviceWorkspaces(existing)).map((w) => w.id) : []);
 }
 function createDeviceAuthRouter() {
-  const app = new Hono29();
+  const app = new Hono30();
   app.post("/code", async (c) => {
     const body = await readBody(c);
     const publicKey = typeof body["public_key"] === "string" ? body["public_key"] : "";
@@ -17202,7 +17330,7 @@ function createDeviceAuthRouter() {
 
 // src/dashboard/api.ts
 function createApiRouter(agent = {}, mode = "all") {
-  const api = new Hono30();
+  const api = new Hono31();
   api.use("*", async (c, next) => {
     const known = await listKnownWorkspaces();
     const fromHost = profileFromHost(trustedHost(c), known);
@@ -17265,6 +17393,7 @@ function createApiRouter(agent = {}, mode = "all") {
       const entries2 = await agent.listFlatDocs?.({ cwd, query, sort, showHidden }) ?? [];
       return c.json({ root: cwd, query, entries: entries2 });
     });
+    registerRelayedDocsRoutes(api, agent);
     api.get("/settings", async (c) => {
       const [branding, local] = await Promise.all([
         loadWorkspaceBranding(),
@@ -17313,7 +17442,7 @@ function createApiRouter(agent = {}, mode = "all") {
 }
 
 // src/dashboard/app-icon-routes.ts
-import { Hono as Hono31 } from "hono";
+import { Hono as Hono32 } from "hono";
 var NEUTRAL_MANIFEST = {
   id: "/",
   name: "Flyspace",
@@ -17351,7 +17480,7 @@ async function withResolvedProfile2(c, next) {
   return profile ? runWithProfile(profile, () => next()) : next();
 }
 function createAppIconRouter() {
-  const app = new Hono31();
+  const app = new Hono32();
   app.get("/manifest.json", withResolvedProfile2, async (c) => {
     if (!await resolvedProfileHost(c)) return c.json(NEUTRAL_MANIFEST);
     const profile = getProfile();
@@ -17391,7 +17520,7 @@ function pngResponse(c, png) {
 }
 
 // src/dashboard/stripe-routes.ts
-import { Hono as Hono32 } from "hono";
+import { Hono as Hono33 } from "hono";
 function planStatusFor(status) {
   const known = ["trialing", "active", "paused", "canceled"];
   return known.includes(status) ? status : null;
@@ -17434,7 +17563,7 @@ async function handleCardAdded(session) {
   }
 }
 function createStripeWebhookRouter() {
-  const stripeRouter = new Hono32();
+  const stripeRouter = new Hono33();
   stripeRouter.post("/webhook", async (c) => {
     const secret = process.env["STRIPE_WEBHOOK_SECRET"];
     const signature = c.req.header("stripe-signature");
@@ -17549,10 +17678,10 @@ var WEB_DIST = join23(paths.PACKAGE_ROOT, "web", "dist");
 var DEFAULT_DASHBOARD_HOST = "127.0.0.1";
 async function findFreePort(start, host = DEFAULT_DASHBOARD_HOST, attempts = 50) {
   for (let port = start; port < start + attempts; port++) {
-    const free = await new Promise((resolve8) => {
+    const free = await new Promise((resolve7) => {
       const probe3 = createServer();
-      probe3.once("error", () => resolve8(false));
-      probe3.once("listening", () => probe3.close(() => resolve8(true)));
+      probe3.once("error", () => resolve7(false));
+      probe3.once("listening", () => probe3.close(() => resolve7(true)));
       probe3.listen(port, host);
     });
     if (free) return port;
@@ -17594,7 +17723,7 @@ async function startDashboardServer(preferredPort = DEFAULT_DASHBOARD_PORT, host
   const mirrorsSkills = mode === "host" || process.env["FLYSPACE_SKILL_SYNC"] === "1";
   const stopSkillSync = mirrorsSkills ? installSkillSync(listProfiles()) : () => {
   };
-  const app = new Hono33();
+  const app = new Hono34();
   app.use("*", async (c, next) => {
     await next();
     if (c.req.path.startsWith("/assets/")) {
@@ -17619,14 +17748,14 @@ async function startDashboardServer(preferredPort = DEFAULT_DASHBOARD_PORT, host
   } else {
     app.route("/share", createPublicShareAssetRouter(WEB_DIST));
     app.route("/", createAppIconRouter());
-    if (existsSync26(WEB_DIST) || existsSync26(join23(paths.PACKAGE_ROOT, "web", "package.json"))) {
+    if (existsSync25(WEB_DIST) || existsSync25(join23(paths.PACKAGE_ROOT, "web", "package.json"))) {
       app.use("/*", serveStatic({ root: WEB_DIST }));
     }
     app.get("/assets/*", (c) => c.text("stale asset \u2014 reload for the current build", 404));
     const spaFallback = serveStatic({ path: join23(WEB_DIST, "index.html") });
     app.get("*", async (c, next) => {
-      if (!existsSync26(join23(WEB_DIST, "index.html"))) {
-        const isCheckout = existsSync26(join23(paths.PACKAGE_ROOT, "web", "package.json"));
+      if (!existsSync25(join23(WEB_DIST, "index.html"))) {
+        const isCheckout = existsSync25(join23(paths.PACKAGE_ROOT, "web", "package.json"));
         return c.text(
           isCheckout ? `Workspace UI build missing (${WEB_DIST}).
 Run \`pnpm --dir web build\` (or \`pnpm --dir web dev\`).
@@ -18064,7 +18193,7 @@ async function threadReplies(client2, nameOrId, ts2) {
 async function postMessage(client2, args) {
   const channelArg = getArg2(args, "--channel");
   const textFilePath = getArg2(args, "--text-file");
-  const text = textFilePath ? readFileSync17(textFilePath, "utf8") : getArg2(args, "--text");
+  const text = textFilePath ? readFileSync18(textFilePath, "utf8") : getArg2(args, "--text");
   const threadTs = getArg2(args, "--thread");
   const markdown = args.includes("--markdown");
   const broadcast = args.includes("--broadcast") && Boolean(threadTs);
@@ -18159,10 +18288,10 @@ function hasClaudeBinary() {
   }
 }
 function defaultClaudeConfigDir() {
-  return process.env.CLAUDE_CONFIG_DIR || resolve7(homedir9(), ".claude");
+  return process.env.CLAUDE_CONFIG_DIR || resolve6(homedir9(), ".claude");
 }
 function hasClaudeCredentials(configDir2) {
-  if (existsSync27(resolve7(configDir2, ".credentials.json"))) {
+  if (existsSync26(resolve6(configDir2, ".credentials.json"))) {
     return true;
   }
   if (process.platform === "darwin") {
@@ -18199,7 +18328,7 @@ async function ensureClaudeCodeReady() {
     console.log("  Flyspace spawns Claude Code as a subprocess. Without credentials, the bot");
     console.log("  will prompt /login inside Slack at runtime and you cannot complete the");
     console.log("  browser sign-in from there.\n");
-    if (claudeConfigDir !== resolve7(homedir9(), ".claude")) {
+    if (claudeConfigDir !== resolve6(homedir9(), ".claude")) {
       console.log("  Tip: run with the same CLAUDE_CONFIG_DIR you use for this Claude Code install:");
       console.log(`    \x1B[1mCLAUDE_CONFIG_DIR=${claudeConfigDir} claude\x1B[0m
 `);
@@ -18207,7 +18336,7 @@ async function ensureClaudeCodeReady() {
       console.log("  Open a new terminal and run \x1B[1mclaude\x1B[0m to complete the sign-in flow,");
       console.log("  then come back here.\n");
     }
-    const proceed = await confirm3({
+    const proceed = await confirm4({
       message: "Continue setup anyway?",
       default: false
     });
@@ -18218,8 +18347,8 @@ async function ensureClaudeCodeReady() {
   return { claudeConfigDir };
 }
 function getManifestYaml(botName) {
-  const manifestPath = resolve7(paths.PACKAGE_ROOT, "slack-app-manifest.yml");
-  const raw = readFileSync17(manifestPath, "utf-8");
+  const manifestPath = resolve6(paths.PACKAGE_ROOT, "slack-app-manifest.yml");
+  const raw = readFileSync18(manifestPath, "utf-8");
   return raw.replace(/name: Custie/g, `name: ${botName}`);
 }
 async function stepPersonalise() {
@@ -18432,7 +18561,7 @@ async function stepBrowserTokens(botName) {
     })
   ));
   const DEBUG = process.argv.includes("--debug");
-  const USER_DATA_DIR = resolve7(tmpdir4(), "custie-playwright-profile");
+  const USER_DATA_DIR = resolve6(tmpdir4(), "custie-playwright-profile");
   let context;
   try {
     log4("Opening browser \u2014 a Slack login page will appear.\n");
@@ -18464,14 +18593,14 @@ async function stepBrowserTokens(botName) {
     const appLink = page2.locator('a[href*="/apps/A"]').first();
     const hasExistingApp = await appLink.isVisible({ timeout: 3e3 }).catch(() => false);
     if (hasExistingApp) {
-      const tokenPromise = new Promise((resolve8) => {
+      const tokenPromise = new Promise((resolve7) => {
         page2.on("request", (req) => {
           if (token) return;
           const postData = req.postData() || "";
           const match = postData.match(/xoxc-[a-f0-9-]+/);
           if (match) {
             token = match[0];
-            resolve8(token);
+            resolve7(token);
           }
         });
       });
@@ -18522,7 +18651,7 @@ async function stepBrowserTokens(botName) {
     log4("Almost done! The browser will now open an install page.\n");
     console.log('  \x1B[1mPlease click "Install to Workspace", then click "Allow".\x1B[0m\n');
     await page2.goto(installUrl);
-    const installPage = await new Promise((resolve8, reject) => {
+    const installPage = await new Promise((resolve7, reject) => {
       let settled = false;
       let interval;
       let timeout;
@@ -18535,7 +18664,7 @@ async function stepBrowserTokens(botName) {
       };
       const checkUrl = (p) => {
         if (p.url().includes("install-on-team?success=1")) {
-          finish(() => resolve8(p));
+          finish(() => resolve7(p));
         }
       };
       context.on("page", (newPage) => {
@@ -18594,7 +18723,7 @@ async function stepBrowserTokens(botName) {
     try {
       const pages = context?.pages();
       if (pages?.[0]) {
-        const screenshotPath = resolve7(paths.PACKAGE_ROOT, "setup-error.png");
+        const screenshotPath = resolve6(paths.PACKAGE_ROOT, "setup-error.png");
         await pages[0].screenshot({ path: screenshotPath, fullPage: true });
         warn4(`Screenshot saved to: ${screenshotPath}`);
       }
@@ -18636,25 +18765,23 @@ function writeConfigFile(config) {
     `OWNER_USER_ID=${config.ownerUserId}`,
     ``
   ].join("\n");
-  writeFileSync10(paths.CONFIG_FILE, envContent);
+  writeFileSync11(paths.CONFIG_FILE, envContent);
   success4(`Config written to ${paths.CONFIG_FILE}`);
 }
 function printNextSteps() {
   log4("Setup complete! Next steps:\n");
-  console.log("  1. Customise the system prompt (optional):");
-  console.log(`     Run \x1B[1mflyspace prompt\x1B[0m to edit ${paths.PROMPT_FILE}
-`);
+  console.log("  1. Customise the system prompt (optional) in Settings \u2192 Prompt.\n");
   console.log("  2. Start the bot:");
   console.log("     Run \x1B[1mflyspace start\x1B[0m\n");
   console.log("  3. Install as a background service (optional):");
-  console.log("     Run \x1B[1mflyspace install\x1B[0m\n");
+  console.log("     Run \x1B[1mflyspace service install\x1B[0m\n");
 }
 function copyDefaultPrompt(botName) {
-  if (!existsSync27(paths.PROMPT_FILE)) {
-    const defaultPrompt = resolve7(paths.PACKAGE_ROOT, "system.default.md");
-    if (existsSync27(defaultPrompt)) {
-      const content = readFileSync17(defaultPrompt, "utf-8").replace(/\{\{botName\}\}/g, botName);
-      writeFileSync10(paths.PROMPT_FILE, content);
+  if (!existsSync26(paths.PROMPT_FILE)) {
+    const defaultPrompt = resolve6(paths.PACKAGE_ROOT, "system.default.md");
+    if (existsSync26(defaultPrompt)) {
+      const content = readFileSync18(defaultPrompt, "utf-8").replace(/\{\{botName\}\}/g, botName);
+      writeFileSync11(paths.PROMPT_FILE, content);
       success4(`Default prompt copied to ${paths.PROMPT_FILE}`);
     }
   }
@@ -18666,8 +18793,8 @@ async function runSlackSetup(args) {
     const prereq = await ensureClaudeCodeReady();
     if (!prereq) return;
     const { claudeConfigDir } = prereq;
-    if (existsSync27(paths.CONFIG_FILE)) {
-      const reconfigure = await confirm3({
+    if (existsSync26(paths.CONFIG_FILE)) {
+      const reconfigure = await confirm4({
         message: `Config already exists at ${paths.CONFIG_FILE}. Reconfigure?`,
         default: false
       });
@@ -18976,7 +19103,85 @@ async function runChatCmd(args) {
 }
 
 // src/commands/memory.ts
-import { readFileSync as readFileSync18 } from "fs";
+import { readFileSync as readFileSync20 } from "fs";
+
+// src/store/claude-memory-import.ts
+import { existsSync as existsSync27, readdirSync as readdirSync5, readFileSync as readFileSync19 } from "fs";
+import { homedir as homedir10 } from "os";
+import { basename as basename8, join as join24 } from "path";
+import dotenv2 from "dotenv";
+function claudeMemoryDir(cwd, configDir2) {
+  return join24(configDir2, "projects", cwd.replaceAll(/[^a-zA-Z0-9]/g, "-"), "memory");
+}
+function profileClaudeConfigDirFor(profile) {
+  const dir = profile === "default" ? paths.BASE_CONFIG_DIR : join24(paths.PROFILES_DIR, profile);
+  const file = join24(dir, "config.env");
+  const env = existsSync27(file) ? dotenv2.parse(readFileSync19(file)) : {};
+  return env["CLAUDE_CONFIG_DIR"]?.trim() || join24(homedir10(), ".claude");
+}
+var TYPE_MAP = {
+  user: "preference",
+  feedback: "preference",
+  project: "fact",
+  reference: "reference"
+};
+var DESCRIPTION_MAX2 = 200;
+function unquote2(value) {
+  const v = value.trim();
+  return /^(["']).*\1$/.test(v) ? v.slice(1, -1) : v;
+}
+function slugify(value) {
+  return value.toLowerCase().replaceAll(/[^a-z0-9]+/g, "-").replaceAll(/^-+|-+$/g, "");
+}
+function parseClaudeMemory(fileName, text, channelId) {
+  const match = /^---\n([\s\S]*?)\n---\n?([\s\S]*)$/.exec(text.replaceAll("\r\n", "\n"));
+  if (!match) return { skip: "no frontmatter" };
+  const fields = {};
+  for (const line of match[1].split("\n")) {
+    const kv = /^\s*([A-Za-z_]+):\s*(.*)$/.exec(line);
+    if (kv && kv[2] && !(kv[1] in fields)) fields[kv[1]] = unquote2(kv[2]);
+  }
+  const name = slugify(fields["name"] || basename8(fileName, ".md"));
+  let description = (fields["description"] ?? "").replaceAll(/\s+/g, " ").trim();
+  if (description.length > DESCRIPTION_MAX2) {
+    description = `${description.slice(0, DESCRIPTION_MAX2 - 3).trimEnd()}...`;
+  }
+  const input2 = {
+    channelId,
+    name,
+    description,
+    type: TYPE_MAP[fields["type"] ?? ""] ?? "fact",
+    body: match[2].trim(),
+    createdBy: "agent"
+  };
+  try {
+    validateMemoryInput(input2);
+  } catch (err) {
+    return { skip: err.message };
+  }
+  return input2;
+}
+async function importClaudeMemories(dir, channelId, opts = {}) {
+  if (!existsSync27(dir)) throw new Error(`No Claude memory directory at ${dir}`);
+  const files = readdirSync5(dir).filter((f) => f.endsWith(".md") && f !== "MEMORY.md").sort();
+  const results = [];
+  for (const file of files) {
+    const parsed = parseClaudeMemory(file, readFileSync19(join24(dir, file), "utf-8"), channelId);
+    if ("skip" in parsed) {
+      results.push({ file, outcome: "skipped", reason: parsed.skip });
+      continue;
+    }
+    if (await getChannelMemory(channelId, parsed.name)) {
+      results.push({ file, name: parsed.name, outcome: "exists" });
+      continue;
+    }
+    if (!opts.dryRun) await saveChannelMemory(parsed, "agent");
+    results.push({ file, name: parsed.name, outcome: "imported" });
+  }
+  return results;
+}
+
+// src/commands/memory.ts
 var USAGE5 = `
   Usage: flyspace memory <subcommand> --channel <name-or-id> [options]
 
@@ -18991,6 +19196,10 @@ var USAGE5 = `
       --body <text | ->                  "-" reads the body from stdin
       [--thread <id>]                    The thread the memory came from
     delete <name-or-id> [--thread <id>]  Delete one memory
+    import [--dir <path>] [--dry-run]    Copy Claude Code's native auto memory for the
+                                         channel's folder in; names already present are kept.
+                                         Defaults to the channel profile's CLAUDE_CONFIG_DIR
+                                         (or ~/.claude)/projects/<cwd slug>/memory
 
   Types: ${MEMORY_TYPES.join(", ")}
 `;
@@ -19056,7 +19265,7 @@ ${memory.body}`);
         );
       }
       if (!isMemoryType(type)) throw new Error(`--type must be one of ${MEMORY_TYPES.join(", ")}`);
-      const body = bodyArg === "-" ? readFileSync18(0, "utf-8") : bodyArg;
+      const body = bodyArg === "-" ? readFileSync20(0, "utf-8") : bodyArg;
       const thread = getArg4(rest, "--thread");
       const { created, changed } = await saveChannelMemory(
         {
@@ -19082,6 +19291,20 @@ ${memory.body}`);
       console.log(`Deleted memory ${ref}.`);
       break;
     }
+    case "import": {
+      const dir = getArg4(rest, "--dir") ?? claudeMemoryDir(channel.cwd, profileClaudeConfigDirFor(channel.profile));
+      const dryRun = rest.includes("--dry-run");
+      const results = await importClaudeMemories(dir, channel.id, { dryRun });
+      for (const r of results) {
+        const detail = r.outcome === "skipped" ? r.reason : r.name;
+        console.log(`${r.outcome.padEnd(8)}  ${r.file}  ${detail}`);
+      }
+      const count = (o) => results.filter((r) => r.outcome === o).length;
+      console.log(
+        `${dryRun ? "Would import" : "Imported"} ${count("imported")}, ${count("exists")} already present, ${count("skipped")} skipped, from ${dir}.`
+      );
+      break;
+    }
     default:
       console.error(`Unknown subcommand: ${subcommand}`);
       console.log(USAGE5);
@@ -19126,10 +19349,10 @@ async function runMcpCmd(args) {
 }
 
 // src/commands/dashboard.ts
-import { spawn as spawn6, spawnSync } from "child_process";
+import { spawn as spawn5, spawnSync } from "child_process";
 import { existsSync as existsSync28 } from "fs";
 import { platform as platform7 } from "os";
-import { join as join24 } from "path";
+import { join as join25 } from "path";
 function flagValue(args, name) {
   const eq = args.find((a) => a.startsWith(`--${name}=`));
   if (eq) return eq.slice(`--${name}=`.length);
@@ -19139,13 +19362,13 @@ function flagValue(args, name) {
 function openBrowser2(url) {
   const cmd = platform7() === "darwin" ? "open" : platform7() === "win32" ? "start" : "xdg-open";
   try {
-    spawn6(cmd, [url], { stdio: "ignore", detached: true }).unref();
+    spawn5(cmd, [url], { stdio: "ignore", detached: true }).unref();
   } catch {
   }
 }
 function ensureWebBuild() {
-  if (existsSync28(join24(paths.PACKAGE_ROOT, "web", "dist", "index.html"))) return;
-  if (!existsSync28(join24(paths.PACKAGE_ROOT, "web", "package.json"))) return;
+  if (existsSync28(join25(paths.PACKAGE_ROOT, "web", "dist", "index.html"))) return;
+  if (!existsSync28(join25(paths.PACKAGE_ROOT, "web", "package.json"))) return;
   console.log("  web/dist missing \u2014 building the dashboard UI (pnpm --dir web build)...");
   const result = spawnSync("pnpm", ["--dir", "web", "build"], {
     cwd: paths.PACKAGE_ROOT,
@@ -19195,7 +19418,7 @@ async function runDashboard(args) {
 }
 
 // src/commands/workspace.ts
-import { existsSync as existsSync29, mkdirSync as mkdirSync11, writeFileSync as writeFileSync11 } from "fs";
+import { existsSync as existsSync29, mkdirSync as mkdirSync11, writeFileSync as writeFileSync12 } from "fs";
 var USAGE7 = `
   Usage: flyspace workspace <subcommand> [options]
 
@@ -19284,7 +19507,7 @@ function provisionLocal(botName) {
   if (existsSync29(paths.CONFIG_FILE)) {
     console.log("  config.env exists");
   } else {
-    writeFileSync11(paths.CONFIG_FILE, `BOT_NAME=${botName}
+    writeFileSync12(paths.CONFIG_FILE, `BOT_NAME=${botName}
 `);
     console.log(`  config.env written (${paths.CONFIG_FILE})`);
   }
@@ -19384,18 +19607,16 @@ var USAGE9 = `
     setup        Set up this machine as a Host (login, agent CLIs, ~/Flyspace)
     auth         Log in, check status, or log out this device
     doctor       Check this Host end to end (login, agent CLIs, services)
-    start        Start the agent host (Slack only if configured)
-    install      Install as a system service (launchd / systemd)
-    uninstall    Remove the system service
+    start        Start the agent host in the foreground
+    service      Run the host in the background (install / uninstall)
     stop         Stop the service (without uninstalling)
     restart      Restart the service
     logs         Tail the service log (-e for error log)
     upgrade      Upgrade Flyspace to the latest version
-    prompt       Edit the system prompt in $EDITOR
+    uninstall    Remove Flyspace from this machine (CLI, services, config)
     config       Show resolved config (--edit to edit, --path for file path)
     automation   Manage scheduled tasks and triggers
     usage        Show agent token usage and cost for this workspace
-    slack        Query Slack (channels, users, post messages)
     chat         Inspect dashboard chat channels and move threads between them
     memory       Read and write a channel's persistent agent memory
     profiles     List local profiles (bound here? scheduler?) or remove one
@@ -19453,11 +19674,20 @@ async function main() {
     case "reconcile":
       await runReconcileCmd(args.slice(1));
       break;
+    case "service":
+      if (args[1] === "install") await runInstall();
+      else if (args[1] === "uninstall") await runServiceUninstall();
+      else {
+        printRaw("Usage: flyspace service <install|uninstall>");
+        process.exit(1);
+      }
+      break;
+    // Pre-rename spelling, kept so existing docs and scripts keep working.
     case "install":
       await runInstall();
       break;
     case "uninstall":
-      await runUninstall();
+      await runUninstall(args.slice(1));
       break;
     case "stop":
       await runStop();
@@ -19471,9 +19701,6 @@ async function main() {
     case "upgrade":
       await runUpgrade();
       break;
-    case "prompt":
-      await runPrompt();
-      break;
     case "config":
       await runConfig(args.slice(1));
       break;
@@ -19504,7 +19731,7 @@ async function main() {
       break;
     case "-v":
     case "--version":
-      printRaw("0.1.10");
+      printRaw("0.1.13");
       break;
     case "-h":
     case "--help":