flyspace-cli 0.1.13 → 0.1.14

package/dist/cli.js

@@ -68,6 +68,7 @@ import {
   getWorkspaceById,
   getWorkspaceBySlug,
   getWorkspaceByStripeCustomerId,
+  getWorkspaceGreetedAt,
   getWorkspacePlanStatus,
   installUsageRecording,
   isAllowedModel,
@@ -103,6 +104,7 @@ import {
   lookupById,
   markInviteResent,
   markWorkspaceAgentConnected,
+  markWorkspaceGreeted,
   markWorkspaceProjectsSetup,
   markdownToBlocks,
   mcpStrictConfigEnabled,
@@ -153,7 +155,7 @@ import {
   warnOnBrokenChannelCwds,
   workspaceSkillsDir,
   writeSkillFile
-} from "./chunk-VKTJBYA3.js";
+} from "./chunk-DA7SYYKU.js";
 import {
   firstReplyBody,
   getThread,
@@ -220,8 +222,8 @@ import { dirname, join } from "path";
 var REQUIRED_ENV = ["SUPABASE_URL", "SUPABASE_SECRET_KEY"];
 var RENOTIFY_AFTER_MS = 30 * 60 * 1e3;
 var ts = () => (/* @__PURE__ */ new Date()).toISOString();
-function findMissingEnv(env = process.env) {
-  const required = slackConfigured(env) ? [...SLACK_ENV, ...REQUIRED_ENV] : REQUIRED_ENV;
+function findMissingEnv(env = process.env, supabaseViaHost = false) {
+  const required = [...slackConfigured(env) ? SLACK_ENV : [], ...supabaseViaHost ? [] : REQUIRED_ENV];
   return required.filter((name) => !env[name]?.trim());
 }
 function shouldNotify(missing, statePath, now) {
@@ -290,7 +292,7 @@ async function preflight(opts = {}) {
   const statePath = opts.statePath ?? join(paths.DATA_DIR, "preflight-alert.json");
   const notify = opts.notify ?? notifyOwnerOverSlack;
   const exit = opts.exit ?? ((code) => process.exit(code));
-  const missing = findMissingEnv(env);
+  const missing = findMissingEnv(env, opts.supabaseViaHost);
   if (missing.length === 0) {
     rmSync(statePath, { force: true });
     return;
@@ -307,15 +309,386 @@ async function preflight(opts = {}) {
   exit(1);
 }
 
+// src/auth/device-auth.ts
+import { createPrivateKey, createPublicKey, generateKeyPairSync, sign } from "crypto";
+import { existsSync, mkdirSync as mkdirSync2, readFileSync as readFileSync2, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "fs";
+import { dirname as dirname2, join as join2 } from "path";
+var DEFAULT_API_URL = "https://app.flyspace.ai";
+var EXPIRY_SKEW_MS = 6e4;
+var AuthApiError = class extends Error {
+  constructor(message, status) {
+    super(message);
+    this.status = status;
+    this.name = "AuthApiError";
+  }
+};
+function apiUrl() {
+  return (process.env["FLYSPACE_API_URL"] || DEFAULT_API_URL).replace(/\/+$/, "");
+}
+function deviceKeyPath() {
+  return join2(paths.BASE_CONFIG_DIR, "device.key");
+}
+function credentialsPath() {
+  return join2(paths.BASE_CONFIG_DIR, "credentials.json");
+}
+function ensureDeviceKey(path = deviceKeyPath()) {
+  let created = false;
+  if (!existsSync(path)) {
+    const { privateKey: privateKey2 } = generateKeyPairSync("ed25519");
+    mkdirSync2(dirname2(path), { recursive: true });
+    writeFileSync2(path, privateKey2.export({ type: "pkcs8", format: "pem" }), { mode: 384 });
+    created = true;
+  }
+  const privateKey = createPrivateKey(readFileSync2(path, "utf8"));
+  const publicKeyBase64 = createPublicKey(privateKey).export({ type: "spki", format: "der" }).toString(
+    "base64"
+  );
+  return { privateKey, publicKeyBase64, created };
+}
+function loadCredentials(path = credentialsPath()) {
+  if (!existsSync(path)) return null;
+  try {
+    return JSON.parse(readFileSync2(path, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function saveCredentials(creds, path = credentialsPath()) {
+  mkdirSync2(dirname2(path), { recursive: true });
+  writeFileSync2(path, `${JSON.stringify(creds, null, 2)}
+`, { mode: 384 });
+}
+function clearLocalAuth() {
+  rmSync2(credentialsPath(), { force: true });
+  rmSync2(deviceKeyPath(), { force: true });
+}
+async function post(base, path, body, token) {
+  return fetch(`${base}${path}`, {
+    method: "POST",
+    headers: {
+      "content-type": "application/json",
+      ...token ? { authorization: `Bearer ${token}` } : {}
+    },
+    body: JSON.stringify(body)
+  });
+}
+async function readJson(res) {
+  try {
+    return await res.json();
+  } catch {
+    return {};
+  }
+}
+async function expectOk(res, what) {
+  const json = await readJson(res);
+  if (!res.ok) {
+    const reason = typeof json["error"] === "string" ? json["error"] : res.statusText;
+    throw new AuthApiError(`${what} failed (${res.status}): ${reason}`, res.status);
+  }
+  return json;
+}
+function toSlugs(value) {
+  return Array.isArray(value) ? value.filter((v) => typeof v === "string") : [];
+}
+function toGrant(json) {
+  const user = json["user"] ?? {};
+  return {
+    accessToken: String(json["access_token"]),
+    expiresIn: Number(json["expires_in"]),
+    deviceId: String(json["device_id"]),
+    userEmail: String(user["email"] ?? ""),
+    workspaces: toSlugs(json["workspaces"])
+  };
+}
+async function requestDeviceCode(base, input2) {
+  const res = await post(base, "/api/auth/device/code", {
+    public_key: input2.publicKey,
+    name: input2.name,
+    platform: input2.platform
+  });
+  const json = await expectOk(res, "Requesting a device code");
+  return {
+    deviceCode: String(json["device_code"]),
+    userCode: String(json["user_code"]),
+    verificationUri: String(json["verification_uri"]),
+    expiresIn: Number(json["expires_in"]),
+    interval: Number(json["interval"] ?? 5)
+  };
+}
+async function pollDeviceToken(base, deviceCode) {
+  const res = await post(base, "/api/auth/device/token", { device_code: deviceCode });
+  const json = await readJson(res);
+  if (res.ok) return { status: "approved", grant: toGrant(json) };
+  switch (json["error"]) {
+    case "authorization_pending":
+      return { status: "pending" };
+    case "slow_down":
+      return { status: "slow_down" };
+    case "access_denied":
+      return { status: "denied" };
+    case "expired_token":
+      return { status: "expired" };
+    default:
+      throw new AuthApiError(`Polling for approval failed (${res.status}): ${String(json["error"] ?? res.statusText)}`, res.status);
+  }
+}
+async function refreshAccessToken(creds, privateKey) {
+  const challenge = await expectOk(
+    await post(creds.apiUrl, "/api/auth/device/challenge", { device_id: creds.deviceId }),
+    "Requesting a refresh challenge"
+  );
+  const nonce = String(challenge["nonce"]);
+  const signature = sign(null, Buffer.from(nonce), privateKey).toString("base64");
+  const json = await expectOk(
+    await post(creds.apiUrl, "/api/auth/device/refresh", { device_id: creds.deviceId, nonce, signature }),
+    "Refreshing the access token"
+  );
+  return {
+    ...creds,
+    accessToken: String(json["access_token"]),
+    accessTokenExpiresAt: Date.now() + Number(json["expires_in"]) * 1e3
+  };
+}
+async function fetchWhoAmI(base, token) {
+  const res = await fetch(`${base}/api/auth/device/me`, { headers: { authorization: `Bearer ${token}` } });
+  const json = await expectOk(res, "Checking the session");
+  const user = json["user"] ?? {};
+  const device = json["device"] ?? {};
+  return {
+    userEmail: String(user["email"] ?? ""),
+    deviceId: String(device["id"] ?? ""),
+    deviceName: String(device["name"] ?? ""),
+    workspaces: toSlugs(json["workspaces"])
+  };
+}
+async function boundWorkspaces() {
+  const creds = loadCredentials();
+  if (!creds) return null;
+  try {
+    const me = await fetchWhoAmI(creds.apiUrl, await getAccessToken());
+    saveCredentials({ ...loadCredentials() ?? creds, workspaces: me.workspaces });
+    return { workspaces: me.workspaces, fresh: true };
+  } catch {
+    return { workspaces: creds.workspaces ?? [], fresh: false };
+  }
+}
+async function revokeDevice(base, token) {
+  await expectOk(await post(base, "/api/auth/device/revoke", {}, token), "Revoking this device");
+}
+async function getAccessToken() {
+  const fromEnv = process.env["FLYSPACE_TOKEN"];
+  if (fromEnv) return fromEnv;
+  const creds = loadCredentials();
+  if (!creds) return null;
+  if (creds.accessTokenExpiresAt - EXPIRY_SKEW_MS > Date.now()) return creds.accessToken;
+  const { privateKey } = ensureDeviceKey();
+  const refreshed = await refreshAccessToken(creds, privateKey);
+  saveCredentials(refreshed);
+  return refreshed.accessToken;
+}
+
+// src/dashboard/host-db-client.ts
+import { createClient } from "@supabase/supabase-js";
+import { randomUUID } from "crypto";
+
+// src/dashboard/host-lock.ts
+import { execFileSync } from "child_process";
+import { randomBytes } from "crypto";
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync3, rmSync as rmSync3, writeFileSync as writeFileSync3 } from "fs";
+import { join as join3 } from "path";
+function hostLockPath() {
+  return join3(paths.BASE_DATA_DIR, "host.lock");
+}
+function isLiveFlyspace(pid) {
+  try {
+    process.kill(pid, 0);
+    const command = execFileSync("ps", ["-p", String(pid), "-o", "command="], {
+      encoding: "utf8"
+    });
+    return command.includes("flyspace") || command.includes("host-server");
+  } catch {
+    return false;
+  }
+}
+function readLockPid(path) {
+  try {
+    const pid = Number(JSON.parse(readFileSync3(path, "utf8")).pid);
+    return Number.isInteger(pid) && pid > 0 ? pid : null;
+  } catch {
+    return null;
+  }
+}
+function acquireHostLock() {
+  const path = hostLockPath();
+  mkdirSync3(paths.BASE_DATA_DIR, { recursive: true });
+  const body = JSON.stringify({
+    pid: process.pid,
+    startedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    execPath: process.argv[1] ?? ""
+  });
+  for (let attempt = 0; attempt < 2; attempt++) {
+    try {
+      writeFileSync3(path, body, { flag: "wx", mode: 384 });
+      const release2 = () => {
+        if (readLockPid(path) === process.pid) rmSync3(path, { force: true });
+      };
+      process.once("exit", release2);
+      return release2;
+    } catch (err) {
+      if (err.code !== "EEXIST") throw err;
+      const holder = readLockPid(path);
+      if (holder === process.pid) return () => {
+      };
+      if (holder && isLiveFlyspace(holder)) {
+        throw new Error(
+          `Another Flyspace Host is already running on this machine (pid ${holder}). Stop it first, or check for a second CLI install (\`which -a flyspace\`). Two Hosts overwrite each other's skill mirror.`
+        );
+      }
+      rmSync3(path, { force: true });
+    }
+  }
+  throw new Error(`Could not take the Host lock at ${path}`);
+}
+function publishHostEndpoint(port) {
+  const path = hostLockPath();
+  if (readLockPid(path) !== process.pid) return null;
+  const token = randomBytes(32).toString("hex");
+  const lock = JSON.parse(readFileSync3(path, "utf8"));
+  writeFileSync3(path, JSON.stringify({ ...lock, port, token }), { mode: 384 });
+  return token;
+}
+function readHostEndpoint() {
+  try {
+    const { pid, port, token } = JSON.parse(readFileSync3(hostLockPath(), "utf8"));
+    if (pid === process.pid || !Number.isInteger(port) || typeof token !== "string") return null;
+    return { port, token };
+  } catch {
+    return null;
+  }
+}
+
+// src/dashboard/host-db-client.ts
+var REQUEST_TIMEOUT_MS = 3e4;
+var pending = /* @__PURE__ */ new Map();
+var sender = null;
+var onSender = [];
+function setHostDbSender(fn) {
+  sender = fn;
+  if (!fn) return;
+  const waiting = onSender;
+  onSender = [];
+  for (const wake of waiting) wake();
+}
+function handleHostDbResult(id, res) {
+  const p = pending.get(id);
+  if (!p) return;
+  pending.delete(id);
+  clearTimeout(p.timer);
+  p.resolve(res);
+}
+function whenConnected() {
+  if (sender) return Promise.resolve(sender);
+  return new Promise((resolve7, reject) => {
+    const timer2 = setTimeout(() => {
+      onSender = onSender.filter((w) => w !== wake);
+      reject(new Error("Host is not connected to the Data API"));
+    }, REQUEST_TIMEOUT_MS);
+    const wake = () => {
+      clearTimeout(timer2);
+      resolve7(sender);
+    };
+    onSender.push(wake);
+  });
+}
+async function requestHostDb(req) {
+  const send2 = await whenConnected();
+  const id = randomUUID();
+  return new Promise((resolve7, reject) => {
+    const timer2 = setTimeout(() => {
+      pending.delete(id);
+      reject(new Error("Data API did not answer in time"));
+    }, REQUEST_TIMEOUT_MS);
+    pending.set(id, { resolve: resolve7, reject, timer: timer2 });
+    send2({ type: "db", id, req });
+  });
+}
+var BODYLESS_STATUS = /* @__PURE__ */ new Set([101, 204, 205, 304]);
+function dbFetch(send2) {
+  return async (input2, init) => {
+    const req = new Request(input2, init);
+    const url = new URL(req.url);
+    const method = req.method.toUpperCase();
+    const res = await send2({
+      method,
+      path: `${url.pathname}${url.search}`,
+      headers: Object.fromEntries(req.headers.entries()),
+      body: method === "GET" || method === "HEAD" ? void 0 : await req.text()
+    });
+    const noBody = method === "HEAD" || BODYLESS_STATUS.has(res.status);
+    return new Response(noBody ? null : res.body, { status: res.status, headers: res.headers });
+  };
+}
+var hostDbFetch = dbFetch(requestHostDb);
+var LOCAL_DB_PATH = "/internal/db";
+async function requestViaLocalHost(req) {
+  const deadline = Date.now() + REQUEST_TIMEOUT_MS;
+  let endpoint = readHostEndpoint();
+  while (!endpoint && Date.now() < deadline) {
+    await new Promise((r) => setTimeout(r, 1e3));
+    endpoint = readHostEndpoint();
+  }
+  if (!endpoint) throw new Error("No local Host to reach the Data API through");
+  const res = await fetch(`http://127.0.0.1:${endpoint.port}${LOCAL_DB_PATH}`, {
+    method: "POST",
+    headers: { authorization: `Bearer ${endpoint.token}`, "content-type": "application/json" },
+    body: JSON.stringify(req),
+    signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS + 5e3)
+  });
+  if (!res.ok) throw new Error(`Local Host DB relay answered ${res.status}`);
+  return await res.json();
+}
+function relayChannel(topic) {
+  const channel = {
+    on: () => channel,
+    subscribe: (callback) => {
+      queueMicrotask(() => callback?.("SUBSCRIBED"));
+      return channel;
+    },
+    send: async (msg) => {
+      if (msg.type !== "broadcast" || !sender) return "error";
+      sender({ type: "db-broadcast", topic, event: msg.event, payload: msg.payload ?? {} });
+      return "ok";
+    },
+    unsubscribe: async () => "ok"
+  };
+  return channel;
+}
+function createHostDbClient(via = "socket") {
+  const client2 = createClient("https://host-db.invalid", "host-device", {
+    auth: { persistSession: false, autoRefreshToken: false },
+    global: { fetch: via === "socket" ? hostDbFetch : dbFetch(requestViaLocalHost) }
+  });
+  return new Proxy(client2, {
+    get(target, prop) {
+      if (prop === "channel") return relayChannel;
+      if (prop === "removeChannel") return async () => "ok";
+      const value = Reflect.get(target, prop, target);
+      return typeof value === "function" ? value.bind(target) : value;
+    }
+  });
+}
+
 // src/commands/start.ts
 async function runStart() {
   loadEnvFiles();
-  await preflight();
+  const viaHost = !hasSupabaseCredentials() && !!loadCredentials();
+  if (viaHost) setSupabaseClient(createHostDbClient("local-host"));
+  await preflight({ supabaseViaHost: viaHost });
   await startServer();
 }
 
 // src/commands/config.ts
-import { existsSync, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
+import { existsSync as existsSync2, readFileSync as readFileSync4, writeFileSync as writeFileSync4 } from "fs";
 import { spawn } from "child_process";
 import { resolve } from "path";
 function maskToken(value) {
@@ -333,12 +706,12 @@ function printConfig() {
   console.log("\n  Paths:");
   console.log(`    Config dir:   ${paths.CONFIG_DIR}`);
   console.log(`    Data dir:     ${paths.DATA_DIR}`);
-  console.log(`    Config file:  ${paths.CONFIG_FILE} ${existsSync(paths.CONFIG_FILE) ? "(exists)" : "(not found)"}`);
-  console.log(`    Prompt file:  ${paths.PROMPT_FILE} ${existsSync(paths.PROMPT_FILE) ? "(exists)" : "(not found)"}`);
-  console.log(`    Database:     ${paths.DB_FILE} ${existsSync(paths.DB_FILE) ? "(exists)" : "(not found)"}`);
+  console.log(`    Config file:  ${paths.CONFIG_FILE} ${existsSync2(paths.CONFIG_FILE) ? "(exists)" : "(not found)"}`);
+  console.log(`    Prompt file:  ${paths.PROMPT_FILE} ${existsSync2(paths.PROMPT_FILE) ? "(exists)" : "(not found)"}`);
+  console.log(`    Database:     ${paths.DB_FILE} ${existsSync2(paths.DB_FILE) ? "(exists)" : "(not found)"}`);
   console.log(`    Log dir:      ${paths.LOG_DIR}`);
   const repoEnv = resolve(process.cwd(), ".env");
-  console.log(`    Repo .env:    ${repoEnv} ${existsSync(repoEnv) ? "(exists)" : "(not found)"}`);
+  console.log(`    Repo .env:    ${repoEnv} ${existsSync2(repoEnv) ? "(exists)" : "(not found)"}`);
   const envKeys = [
     "SLACK_BOT_TOKEN",
     "SLACK_APP_TOKEN",
@@ -362,13 +735,13 @@ function printConfig() {
 }
 function editConfig() {
   ensureDirs();
-  if (!existsSync(paths.CONFIG_FILE)) {
+  if (!existsSync2(paths.CONFIG_FILE)) {
     const defaultEnv = resolve(paths.PACKAGE_ROOT, ".env.example");
-    if (existsSync(defaultEnv)) {
-      const content = readFileSync2(defaultEnv, "utf-8");
-      writeFileSync2(paths.CONFIG_FILE, content);
+    if (existsSync2(defaultEnv)) {
+      const content = readFileSync4(defaultEnv, "utf-8");
+      writeFileSync4(paths.CONFIG_FILE, content);
     } else {
-      writeFileSync2(paths.CONFIG_FILE, "");
+      writeFileSync4(paths.CONFIG_FILE, "");
     }
     console.log(`[flyspace] Created ${paths.CONFIG_FILE}`);
   }
@@ -402,14 +775,14 @@ async function runConfig(args) {
 
 // src/commands/setup.ts
 import { execSync as execSync4 } from "child_process";
-import { mkdirSync as mkdirSync5 } from "fs";
-import { join as join7 } from "path";
+import { mkdirSync as mkdirSync6 } from "fs";
+import { join as join8 } from "path";
 import { confirm as confirm2 } from "@inquirer/prompts";
 
 // src/service.ts
 import { execSync } from "child_process";
-import { existsSync as existsSync2, readFileSync as readFileSync3, realpathSync } from "fs";
-import { basename, dirname as dirname2, join as join2 } from "path";
+import { existsSync as existsSync3, readFileSync as readFileSync5, realpathSync } from "fs";
+import { basename, dirname as dirname3, join as join4 } from "path";
 import { homedir, platform } from "os";
 function flyspaceHome(entry = process.argv[1]) {
   let cliPath;
@@ -422,8 +795,8 @@ function flyspaceHome(entry = process.argv[1]) {
   if (at <= 0) return void 0;
   const npmPrefix = cliPath.slice(0, at);
   if (basename(npmPrefix) !== "cli") return void 0;
-  const home = dirname2(npmPrefix);
-  return existsSync2(join2(home, "bin", "flyspace")) && existsSync2(join2(home, "node", "bin", "node")) ? home : void 0;
+  const home = dirname3(npmPrefix);
+  return existsSync3(join4(home, "bin", "flyspace")) && existsSync3(join4(home, "node", "bin", "node")) ? home : void 0;
 }
 function serviceLabel(profile) {
   return profile === DEFAULT_PROFILE ? "ai.flyspace" : `ai.flyspace.${profile}`;
@@ -432,40 +805,40 @@ function plistName(profile) {
   return `${serviceLabel(profile)}.plist`;
 }
 function plistPath(profile) {
-  return join2(homedir(), "Library", "LaunchAgents", plistName(profile));
+  return join4(homedir(), "Library", "LaunchAgents", plistName(profile));
 }
 function legacyServiceLabel(profile) {
   return profile === DEFAULT_PROFILE ? "io.flycoder.flyspace" : `io.flycoder.flyspace.${profile}`;
 }
 function legacyPlistPath(profile) {
-  return join2(homedir(), "Library", "LaunchAgents", `${legacyServiceLabel(profile)}.plist`);
+  return join4(homedir(), "Library", "LaunchAgents", `${legacyServiceLabel(profile)}.plist`);
 }
 function systemdUnitName(profile) {
   return profile === DEFAULT_PROFILE ? "flyspace" : `flyspace-${profile}`;
 }
 function systemdUnitPath(profile) {
-  return join2(homedir(), ".config", "systemd", "user", `${systemdUnitName(profile)}.service`);
+  return join4(homedir(), ".config", "systemd", "user", `${systemdUnitName(profile)}.service`);
 }
 function isServiceInstalled(profile) {
-  if (platform() === "darwin") return existsSync2(plistPath(profile));
-  if (platform() === "linux") return existsSync2(systemdUnitPath(profile));
+  if (platform() === "darwin") return existsSync3(plistPath(profile));
+  if (platform() === "linux") return existsSync3(systemdUnitPath(profile));
   return false;
 }
 function serviceBinaryMissing(file) {
   let text;
   try {
-    text = readFileSync3(file, "utf-8");
+    text = readFileSync5(file, "utf-8");
   } catch {
     return false;
   }
   const bin = text.match(/<key>ProgramArguments<\/key>\s*<array>\s*<string>([^<]+)<\/string>/)?.[1] ?? text.match(/^ExecStart=(\S+)/m)?.[1];
-  return !!bin && !existsSync2(bin);
+  return !!bin && !existsSync3(bin);
 }
 function profileServiceFile(profile) {
   return platform() === "darwin" ? plistPath(profile) : systemdUnitPath(profile);
 }
 function hostServiceFile() {
-  return platform() === "darwin" ? hostPlistPath() : join2(homedir(), ".config", "systemd", "user", `${HOST_SYSTEMD_UNIT}.service`);
+  return platform() === "darwin" ? hostPlistPath() : join4(homedir(), ".config", "systemd", "user", `${HOST_SYSTEMD_UNIT}.service`);
 }
 function restartService(profile) {
   const os = platform();
@@ -495,10 +868,10 @@ function restartService(profile) {
 var HOST_SERVICE_LABEL = "ai.flyspace.dashboard";
 var HOST_SYSTEMD_UNIT = "flyspace-host";
 function hostPlistPath() {
-  return join2(homedir(), "Library", "LaunchAgents", `${HOST_SERVICE_LABEL}.plist`);
+  return join4(homedir(), "Library", "LaunchAgents", `${HOST_SERVICE_LABEL}.plist`);
 }
 function isHostServiceInstalled() {
-  if (platform() === "darwin" || platform() === "linux") return existsSync2(hostServiceFile());
+  if (platform() === "darwin" || platform() === "linux") return existsSync3(hostServiceFile());
   return false;
 }
 function restartHostService() {
@@ -538,9 +911,9 @@ function isHostServiceRunning() {
 }
 
 // src/commands/install.ts
-import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync4, writeFileSync as writeFileSync3, unlinkSync } from "fs";
+import { existsSync as existsSync4, mkdirSync as mkdirSync4, readFileSync as readFileSync6, writeFileSync as writeFileSync5, unlinkSync } from "fs";
 import { execSync as execSync2 } from "child_process";
-import { dirname as dirname3, join as join3, resolve as resolve2 } from "path";
+import { dirname as dirname4, join as join5, resolve as resolve2 } from "path";
 import { homedir as homedir2, platform as platform2 } from "os";
 function log(msg) {
   console.log(`
@@ -561,23 +934,23 @@ function run(cmd, opts = {}) {
 function detectClaudeBinDir() {
   try {
     const claudePath = execSync2("which claude", { encoding: "utf-8", stdio: "pipe" }).trim();
-    return claudePath ? dirname3(claudePath) : void 0;
+    return claudePath ? dirname4(claudePath) : void 0;
   } catch {
     return void 0;
   }
 }
 function detectNodeBinDir() {
   const home = flyspaceHome();
-  return home ? join3(home, "node", "bin") : dirname3(process.execPath);
+  return home ? join5(home, "node", "bin") : dirname4(process.execPath);
 }
 function nodeShimDirs() {
-  return [join3(homedir2(), ".local", "share", "mise", "shims"), join3(homedir2(), ".asdf", "shims")].filter(
-    (d) => existsSync3(d)
+  return [join5(homedir2(), ".local", "share", "mise", "shims"), join5(homedir2(), ".asdf", "shims")].filter(
+    (d) => existsSync4(d)
   );
 }
 function detectCustieBin() {
   const home = flyspaceHome();
-  if (home) return join3(home, "bin", "flyspace");
+  if (home) return join5(home, "bin", "flyspace");
   const argv1 = process.argv[1];
   if (argv1) {
     return resolve2(argv1);
@@ -589,9 +962,9 @@ function detectCustieBin() {
   }
 }
 function readEnvFile() {
-  if (!existsSync3(paths.CONFIG_FILE)) return {};
+  if (!existsSync4(paths.CONFIG_FILE)) return {};
   const vars = {};
-  for (const line of readFileSync4(paths.CONFIG_FILE, "utf-8").split("\n")) {
+  for (const line of readFileSync6(paths.CONFIG_FILE, "utf-8").split("\n")) {
     const trimmed = line.trim();
     if (!trimmed || trimmed.startsWith("#")) continue;
     const eq = trimmed.indexOf("=");
@@ -635,9 +1008,9 @@ async function installMacOS(spec) {
   const custieBin = detectCustieBin();
   const claudeBinDir = detectClaudeBinDir();
   const logDir = paths.LOG_DIR;
-  mkdirSync2(logDir, { recursive: true });
+  mkdirSync4(logDir, { recursive: true });
   const envVars = spec.env;
-  const homebrewBin = existsSync3("/opt/homebrew/bin") ? "/opt/homebrew/bin" : void 0;
+  const homebrewBin = existsSync4("/opt/homebrew/bin") ? "/opt/homebrew/bin" : void 0;
   const pathParts = [
     detectNodeBinDir(),
     claudeBinDir,
@@ -676,14 +1049,14 @@ ${Object.entries(envVars).map(([k, v]) => `    <key>${k}</key>
   <true/>
 
   <key>StandardOutPath</key>
-  <string>${join3(logDir, `${spec.logName}.log`)}</string>
+  <string>${join5(logDir, `${spec.logName}.log`)}</string>
 
   <key>StandardErrorPath</key>
-  <string>${join3(logDir, `${spec.logName}-error.log`)}</string>
+  <string>${join5(logDir, `${spec.logName}-error.log`)}</string>
 </dict>
 </plist>`;
   const agentPlistPath = spec.plistPath;
-  mkdirSync2(dirname3(agentPlistPath), { recursive: true });
+  mkdirSync4(dirname4(agentPlistPath), { recursive: true });
   try {
     run(`launchctl unload "${agentPlistPath}"`, { silent: true });
   } catch {
@@ -692,7 +1065,7 @@ ${Object.entries(envVars).map(([k, v]) => `    <key>${k}</key>
     unlinkSync(agentPlistPath);
   } catch {
   }
-  writeFileSync3(agentPlistPath, plist);
+  writeFileSync5(agentPlistPath, plist);
   run(`launchctl load "${agentPlistPath}"`, { silent: true });
   success(`LaunchAgent installed and loaded (${spec.label}).`);
   console.log(`  Logs: ${logDir}`);
@@ -703,9 +1076,9 @@ async function installLinux(spec) {
   const custieBin = detectCustieBin();
   const claudeBinDir = detectClaudeBinDir();
   const logDir = paths.LOG_DIR;
-  mkdirSync2(logDir, { recursive: true });
+  mkdirSync4(logDir, { recursive: true });
   const envLines = Object.entries(spec.env).map(([k, v]) => `Environment="${k}=${v}"`).join("\n");
-  const linuxbrewBin = existsSync3("/home/linuxbrew/.linuxbrew/bin") ? "/home/linuxbrew/.linuxbrew/bin" : void 0;
+  const linuxbrewBin = existsSync4("/home/linuxbrew/.linuxbrew/bin") ? "/home/linuxbrew/.linuxbrew/bin" : void 0;
   const pathParts = [
     detectNodeBinDir(),
     claudeBinDir,
@@ -729,16 +1102,16 @@ RestartSec=5
 ${envLines}
 Environment="PATH=${pathParts.join(":")}"
 
-StandardOutput=append:${join3(logDir, `${spec.logName}.log`)}
-StandardError=append:${join3(logDir, `${spec.logName}-error.log`)}
+StandardOutput=append:${join5(logDir, `${spec.logName}.log`)}
+StandardError=append:${join5(logDir, `${spec.logName}-error.log`)}
 
 [Install]
 WantedBy=default.target
 `;
   const unitName = spec.unitName;
-  const unitDir = join3(homedir2(), ".config", "systemd", "user");
-  mkdirSync2(unitDir, { recursive: true });
-  writeFileSync3(join3(unitDir, `${unitName}.service`), unit);
+  const unitDir = join5(homedir2(), ".config", "systemd", "user");
+  mkdirSync4(unitDir, { recursive: true });
+  writeFileSync5(join5(unitDir, `${unitName}.service`), unit);
   run("systemctl --user daemon-reload", { silent: true });
   run(`systemctl --user enable --now ${unitName}`, { silent: true });
   success(`systemd user service installed and started (${unitName}).`);
@@ -748,277 +1121,100 @@ WantedBy=default.target
 async function installService(spec) {
   const os = platform2();
   if (os === "darwin") await installMacOS(spec);
-  else if (os === "linux") await installLinux(spec);
-  else {
-    warn(`Unsupported platform: ${os}. You'll need to configure autostart manually.`);
-    return false;
-  }
-  return true;
-}
-async function runInstall() {
-  ensureDirs();
-  await installService(profileSpec());
-}
-async function installHostService() {
-  ensureDirs();
-  return installService(hostSpec());
-}
-
-// src/commands/profiles.ts
-import { existsSync as existsSync4, readdirSync, statSync } from "fs";
-import { execSync as execSync3 } from "child_process";
-import { join as join4 } from "path";
-import { platform as platform3 } from "os";
-function listProfiles() {
-  const profiles = [];
-  if (existsSync4(paths.PROFILES_DIR)) {
-    for (const entry of readdirSync(paths.PROFILES_DIR)) {
-      try {
-        if (statSync(join4(paths.PROFILES_DIR, entry)).isDirectory()) {
-          profiles.push(entry);
-        }
-      } catch {
-      }
-    }
-  }
-  return profiles;
-}
-function isServiceRunning2(profile) {
-  try {
-    if (platform3() === "darwin") {
-      const out = execSync3("launchctl list", { encoding: "utf-8", stdio: "pipe" });
-      return out.split("\n").some((line) => line.endsWith(`	${serviceLabel(profile)}`));
-    }
-    if (platform3() === "linux") {
-      execSync3(`systemctl --user is-active ${systemdUnitName(profile)}`, { stdio: "pipe" });
-      return true;
-    }
-  } catch {
-  }
-  return false;
-}
-
-// src/auth/device-auth.ts
-import { createPrivateKey, createPublicKey, generateKeyPairSync, sign } from "crypto";
-import { existsSync as existsSync5, mkdirSync as mkdirSync3, readFileSync as readFileSync5, rmSync as rmSync2, writeFileSync as writeFileSync4 } from "fs";
-import { dirname as dirname4, join as join5 } from "path";
-var DEFAULT_API_URL = "https://app.flyspace.ai";
-var EXPIRY_SKEW_MS = 6e4;
-var AuthApiError = class extends Error {
-  constructor(message, status) {
-    super(message);
-    this.status = status;
-    this.name = "AuthApiError";
-  }
-};
-function apiUrl() {
-  return (process.env["FLYSPACE_API_URL"] || DEFAULT_API_URL).replace(/\/+$/, "");
-}
-function deviceKeyPath() {
-  return join5(paths.BASE_CONFIG_DIR, "device.key");
-}
-function credentialsPath() {
-  return join5(paths.BASE_CONFIG_DIR, "credentials.json");
-}
-function ensureDeviceKey(path = deviceKeyPath()) {
-  let created = false;
-  if (!existsSync5(path)) {
-    const { privateKey: privateKey2 } = generateKeyPairSync("ed25519");
-    mkdirSync3(dirname4(path), { recursive: true });
-    writeFileSync4(path, privateKey2.export({ type: "pkcs8", format: "pem" }), { mode: 384 });
-    created = true;
-  }
-  const privateKey = createPrivateKey(readFileSync5(path, "utf8"));
-  const publicKeyBase64 = createPublicKey(privateKey).export({ type: "spki", format: "der" }).toString(
-    "base64"
-  );
-  return { privateKey, publicKeyBase64, created };
-}
-function loadCredentials(path = credentialsPath()) {
-  if (!existsSync5(path)) return null;
-  try {
-    return JSON.parse(readFileSync5(path, "utf8"));
-  } catch {
-    return null;
-  }
-}
-function saveCredentials(creds, path = credentialsPath()) {
-  mkdirSync3(dirname4(path), { recursive: true });
-  writeFileSync4(path, `${JSON.stringify(creds, null, 2)}
-`, { mode: 384 });
-}
-function clearLocalAuth() {
-  rmSync2(credentialsPath(), { force: true });
-  rmSync2(deviceKeyPath(), { force: true });
-}
-async function post(base, path, body, token) {
-  return fetch(`${base}${path}`, {
-    method: "POST",
-    headers: {
-      "content-type": "application/json",
-      ...token ? { authorization: `Bearer ${token}` } : {}
-    },
-    body: JSON.stringify(body)
-  });
-}
-async function readJson(res) {
-  try {
-    return await res.json();
-  } catch {
-    return {};
-  }
-}
-async function expectOk(res, what) {
-  const json = await readJson(res);
-  if (!res.ok) {
-    const reason = typeof json["error"] === "string" ? json["error"] : res.statusText;
-    throw new AuthApiError(`${what} failed (${res.status}): ${reason}`, res.status);
-  }
-  return json;
-}
-function toSlugs(value) {
-  return Array.isArray(value) ? value.filter((v) => typeof v === "string") : [];
-}
-function toGrant(json) {
-  const user = json["user"] ?? {};
-  return {
-    accessToken: String(json["access_token"]),
-    expiresIn: Number(json["expires_in"]),
-    deviceId: String(json["device_id"]),
-    userEmail: String(user["email"] ?? ""),
-    workspaces: toSlugs(json["workspaces"])
-  };
-}
-async function requestDeviceCode(base, input2) {
-  const res = await post(base, "/api/auth/device/code", {
-    public_key: input2.publicKey,
-    name: input2.name,
-    platform: input2.platform
-  });
-  const json = await expectOk(res, "Requesting a device code");
-  return {
-    deviceCode: String(json["device_code"]),
-    userCode: String(json["user_code"]),
-    verificationUri: String(json["verification_uri"]),
-    expiresIn: Number(json["expires_in"]),
-    interval: Number(json["interval"] ?? 5)
-  };
-}
-async function pollDeviceToken(base, deviceCode) {
-  const res = await post(base, "/api/auth/device/token", { device_code: deviceCode });
-  const json = await readJson(res);
-  if (res.ok) return { status: "approved", grant: toGrant(json) };
-  switch (json["error"]) {
-    case "authorization_pending":
-      return { status: "pending" };
-    case "slow_down":
-      return { status: "slow_down" };
-    case "access_denied":
-      return { status: "denied" };
-    case "expired_token":
-      return { status: "expired" };
-    default:
-      throw new AuthApiError(`Polling for approval failed (${res.status}): ${String(json["error"] ?? res.statusText)}`, res.status);
+  else if (os === "linux") await installLinux(spec);
+  else {
+    warn(`Unsupported platform: ${os}. You'll need to configure autostart manually.`);
+    return false;
   }
+  return true;
 }
-async function refreshAccessToken(creds, privateKey) {
-  const challenge = await expectOk(
-    await post(creds.apiUrl, "/api/auth/device/challenge", { device_id: creds.deviceId }),
-    "Requesting a refresh challenge"
-  );
-  const nonce = String(challenge["nonce"]);
-  const signature = sign(null, Buffer.from(nonce), privateKey).toString("base64");
-  const json = await expectOk(
-    await post(creds.apiUrl, "/api/auth/device/refresh", { device_id: creds.deviceId, nonce, signature }),
-    "Refreshing the access token"
-  );
-  return {
-    ...creds,
-    accessToken: String(json["access_token"]),
-    accessTokenExpiresAt: Date.now() + Number(json["expires_in"]) * 1e3
-  };
+async function runInstall() {
+  ensureDirs();
+  await installService(profileSpec());
 }
-async function fetchWhoAmI(base, token) {
-  const res = await fetch(`${base}/api/auth/device/me`, { headers: { authorization: `Bearer ${token}` } });
-  const json = await expectOk(res, "Checking the session");
-  const user = json["user"] ?? {};
-  const device = json["device"] ?? {};
-  return {
-    userEmail: String(user["email"] ?? ""),
-    deviceId: String(device["id"] ?? ""),
-    deviceName: String(device["name"] ?? ""),
-    workspaces: toSlugs(json["workspaces"])
-  };
+async function installHostService() {
+  ensureDirs();
+  return installService(hostSpec());
 }
-async function boundWorkspaces() {
-  const creds = loadCredentials();
-  if (!creds) return null;
+
+// src/commands/profiles.ts
+import { existsSync as existsSync5, readdirSync, statSync } from "fs";
+import { execSync as execSync3 } from "child_process";
+import { join as join6 } from "path";
+import { platform as platform3 } from "os";
+function listProfiles() {
+  const profiles = [];
+  if (existsSync5(paths.PROFILES_DIR)) {
+    for (const entry of readdirSync(paths.PROFILES_DIR)) {
+      try {
+        if (statSync(join6(paths.PROFILES_DIR, entry)).isDirectory()) {
+          profiles.push(entry);
+        }
+      } catch {
+      }
+    }
+  }
+  return profiles;
+}
+function isServiceRunning2(profile) {
   try {
-    const me = await fetchWhoAmI(creds.apiUrl, await getAccessToken());
-    saveCredentials({ ...loadCredentials() ?? creds, workspaces: me.workspaces });
-    return { workspaces: me.workspaces, fresh: true };
+    if (platform3() === "darwin") {
+      const out = execSync3("launchctl list", { encoding: "utf-8", stdio: "pipe" });
+      return out.split("\n").some((line) => line.endsWith(`	${serviceLabel(profile)}`));
+    }
+    if (platform3() === "linux") {
+      execSync3(`systemctl --user is-active ${systemdUnitName(profile)}`, { stdio: "pipe" });
+      return true;
+    }
   } catch {
-    return { workspaces: creds.workspaces ?? [], fresh: false };
   }
-}
-async function revokeDevice(base, token) {
-  await expectOk(await post(base, "/api/auth/device/revoke", {}, token), "Revoking this device");
-}
-async function getAccessToken() {
-  const fromEnv = process.env["FLYSPACE_TOKEN"];
-  if (fromEnv) return fromEnv;
-  const creds = loadCredentials();
-  if (!creds) return null;
-  if (creds.accessTokenExpiresAt - EXPIRY_SKEW_MS > Date.now()) return creds.accessToken;
-  const { privateKey } = ensureDeviceKey();
-  const refreshed = await refreshAccessToken(creds, privateKey);
-  saveCredentials(refreshed);
-  return refreshed.accessToken;
+  return false;
 }
 
 // src/dashboard/onboarding-scan.ts
-import { execFileSync } from "child_process";
+import { execFileSync as execFileSync2 } from "child_process";
 import {
+  cpSync,
   existsSync as existsSync6,
   lstatSync,
-  mkdirSync as mkdirSync4,
+  mkdirSync as mkdirSync5,
   readdirSync as readdirSync2,
-  readFileSync as readFileSync6,
+  readFileSync as readFileSync7,
   statSync as statSync2,
   symlinkSync
 } from "fs";
 import { homedir as homedir3 } from "os";
-import { basename as basename2, join as join6, resolve as resolve3 } from "path";
+import { basename as basename2, join as join7, resolve as resolve3 } from "path";
 var MAX_JSONL_HEAD_BYTES = 64 * 1024;
 var GIT_SCAN_ROOTS = ["Workspaces", "Projects", "code"];
 function flyspaceRoot() {
-  return process.env["FLYSPACE_ROOT"] || join6(homedir3(), "Flyspace");
+  return process.env["FLYSPACE_ROOT"] || join7(homedir3(), "Flyspace");
 }
 function onPath(cmd) {
   try {
-    execFileSync(process.platform === "win32" ? "where" : "which", [cmd], { stdio: "ignore" });
+    execFileSync2(process.platform === "win32" ? "where" : "which", [cmd], { stdio: "ignore" });
     return true;
   } catch {
     return false;
   }
 }
 function claudeDir() {
-  return process.env["CLAUDE_CONFIG_DIR"] || join6(homedir3(), ".claude");
+  return process.env["CLAUDE_CONFIG_DIR"] || join7(homedir3(), ".claude");
 }
 function codexDir() {
-  return process.env["CODEX_HOME"] || join6(homedir3(), ".codex");
+  return process.env["CODEX_HOME"] || join7(homedir3(), ".codex");
 }
 function claudeLoggedIn() {
   if (process.env["ANTHROPIC_API_KEY"]) return true;
-  if (existsSync6(join6(claudeDir(), ".credentials.json"))) return true;
+  if (existsSync6(join7(claudeDir(), ".credentials.json"))) return true;
   try {
-    const raw = JSON.parse(readFileSync6(join6(homedir3(), ".claude.json"), "utf-8"));
+    const raw = JSON.parse(readFileSync7(join7(homedir3(), ".claude.json"), "utf-8"));
     if (raw.oauthAccount) return true;
   } catch {
   }
   if (process.platform !== "darwin") return false;
   try {
-    execFileSync("security", ["find-generic-password", "-s", "Claude Code-credentials"], {
+    execFileSync2("security", ["find-generic-password", "-s", "Claude Code-credentials"], {
       stdio: "ignore"
     });
     return true;
@@ -1027,7 +1223,7 @@ function claudeLoggedIn() {
   }
 }
 function codexLoggedIn() {
-  return !!process.env["OPENAI_API_KEY"] || existsSync6(join6(codexDir(), "auth.json"));
+  return !!process.env["OPENAI_API_KEY"] || existsSync6(join7(codexDir(), "auth.json"));
 }
 function jsonlFiles(dir, depth) {
   const out = [];
@@ -1038,7 +1234,7 @@ function jsonlFiles(dir, depth) {
     return out;
   }
   for (const e of entries2) {
-    const full = join6(dir, e.name);
+    const full = join7(dir, e.name);
     if (e.isDirectory()) {
       if (depth > 0) out.push(...jsonlFiles(full, depth - 1));
     } else if (e.name.endsWith(".jsonl")) {
@@ -1053,7 +1249,7 @@ function jsonlFiles(dir, depth) {
 function cwdFromTranscript(file) {
   let head;
   try {
-    head = readFileSync6(file, { encoding: "utf-8", flag: "r" }).slice(0, MAX_JSONL_HEAD_BYTES);
+    head = readFileSync7(file, { encoding: "utf-8", flag: "r" }).slice(0, MAX_JSONL_HEAD_BYTES);
   } catch {
     return null;
   }
@@ -1070,7 +1266,7 @@ function cwdFromTranscript(file) {
 }
 function codexTrustedPaths() {
   try {
-    const toml = readFileSync6(join6(codexDir(), "config.toml"), "utf-8");
+    const toml = readFileSync7(join7(codexDir(), "config.toml"), "utf-8");
     return [...toml.matchAll(/^\[projects\.(?:"([^"]+)"|'([^']+)')\]/gm)].map((m) => m[1] ?? m[2]);
   } catch {
     return [];
@@ -1093,7 +1289,7 @@ function gitRepos() {
   const home = homedir3();
   const found = [];
   for (const rootName of GIT_SCAN_ROOTS) {
-    const root = join6(home, rootName);
+    const root = join7(home, rootName);
     let entries2;
     try {
       entries2 = readdirSync2(root, { withFileTypes: true });
@@ -1101,7 +1297,7 @@ function gitRepos() {
       continue;
     }
     for (const e of entries2) {
-      if (e.isDirectory() && existsSync6(join6(root, e.name, ".git"))) found.push(join6(root, e.name));
+      if (e.isDirectory() && existsSync6(join7(root, e.name, ".git"))) found.push(join7(root, e.name));
     }
   }
   return found;
@@ -1145,11 +1341,11 @@ function scanOnboarding() {
       });
     }
   };
-  const claudeProjects = join6(claudeDir(), "projects");
+  const claudeProjects = join7(claudeDir(), "projects");
   try {
     for (const e of readdirSync2(claudeProjects, { withFileTypes: true })) {
       if (!e.isDirectory()) continue;
-      const files = jsonlFiles(join6(claudeProjects, e.name), 0);
+      const files = jsonlFiles(join7(claudeProjects, e.name), 0);
       if (!files.length) continue;
       history.claude = true;
       files.sort((a, b) => b.mtime - a.mtime);
@@ -1162,7 +1358,7 @@ function scanOnboarding() {
     }
   } catch {
   }
-  const codexSessions = jsonlFiles(join6(codexDir(), "sessions"), 4);
+  const codexSessions = jsonlFiles(join7(codexDir(), "sessions"), 4);
   if (codexSessions.length) history.codex = true;
   const perCwd = /* @__PURE__ */ new Map();
   for (const f of codexSessions) {
@@ -1199,17 +1395,18 @@ function scanOnboarding() {
     fromGitScan
   };
 }
+var GENERAL_TEMPLATE_DIR = join7(paths.PACKAGE_ROOT, "templates", "general");
 function makeLink(target, linkPath) {
   symlinkSync(target, linkPath, process.platform === "win32" ? "junction" : "dir");
 }
 function linkProjectFolders(slug, items) {
   if (!/^[a-z0-9][a-z0-9-]*$/.test(slug)) throw new Error(`invalid workspace slug: ${slug}`);
-  const dir = join6(flyspaceRoot(), slug);
-  mkdirSync4(dir, { recursive: true });
+  const dir = join7(flyspaceRoot(), slug);
+  mkdirSync5(dir, { recursive: true });
   const results = [];
   for (const item of items) {
     if (!/^[a-z0-9][a-z0-9-]*$/.test(item.name)) throw new Error(`invalid channel name: ${item.name}`);
-    const dest = join6(dir, item.name);
+    const dest = join7(dir, item.name);
     let exists = true;
     try {
       lstatSync(dest);
@@ -1222,7 +1419,8 @@ function linkProjectFolders(slug, items) {
         if (!statSync2(target).isDirectory()) throw new Error(`not a directory: ${target}`);
         makeLink(target, dest);
       } else {
-        mkdirSync4(dest, { recursive: true });
+        mkdirSync5(dest, { recursive: true });
+        if (item.name === "general") cpSync(GENERAL_TEMPLATE_DIR, dest, { recursive: true });
       }
     }
     results.push({ name: item.name, cwd: `${slug}/${item.name}` });
@@ -1540,7 +1738,7 @@ async function runAuthCmd(args) {
 }
 
 // src/version.ts
-var CLI_VERSION = true ? "0.1.13" : null;
+var CLI_VERSION = true ? "0.1.14" : null;
 function isOlderVersion(a, b) {
   const parse2 = (v) => v.replace(/^v/, "").split("-")[0].split(".").map(Number);
   const [pa, pb] = [parse2(a), parse2(b)];
@@ -1654,8 +1852,8 @@ ${BOLD2}Flyspace Setup${RESET2}
   const anyReady = runners.some((r) => r.installed && r.loggedIn);
   for (const slug of workspaces) {
     if (!/^[a-z0-9][a-z0-9-]*$/.test(slug)) continue;
-    const dir = join7(flyspaceRoot(), slug);
-    mkdirSync5(dir, { recursive: true });
+    const dir = join8(flyspaceRoot(), slug);
+    mkdirSync6(dir, { recursive: true });
     ok(`Folder ${tilde2(dir)}`);
   }
   let hostRunning = false;
@@ -1818,10 +2016,10 @@ ${BOLD3}Flyspace Doctor${RESET3}
 }
 
 // src/commands/uninstall.ts
-import { existsSync as existsSync7, readFileSync as readFileSync7, rmSync as rmSync3, unlinkSync as unlinkSync2, writeFileSync as writeFileSync5 } from "fs";
+import { existsSync as existsSync7, readFileSync as readFileSync8, rmSync as rmSync4, unlinkSync as unlinkSync2, writeFileSync as writeFileSync6 } from "fs";
 import { confirm as confirm3 } from "@inquirer/prompts";
 import { execSync as execSync5 } from "child_process";
-import { basename as basename3, join as join8 } from "path";
+import { basename as basename3, join as join9 } from "path";
 import { homedir as homedir4, platform as platform5 } from "os";
 function log2(msg) {
   console.log(`
@@ -1864,7 +2062,7 @@ async function runServiceUninstall(profile = getProfile()) {
       run2(`systemctl --user disable --now ${unitName}`);
     } catch {
     }
-    const unitPath = join8(homedir4(), ".config", "systemd", "user", `${unitName}.service`);
+    const unitPath = join9(homedir4(), ".config", "systemd", "user", `${unitName}.service`);
     try {
       unlinkSync2(unitPath);
     } catch {
@@ -1879,7 +2077,7 @@ async function runServiceUninstall(profile = getProfile()) {
   }
 }
 async function runUninstall(args = []) {
-  const prefix = process.env["FLYSPACE_PREFIX"] || join8(homedir4(), ".flyspace");
+  const prefix = process.env["FLYSPACE_PREFIX"] || join9(homedir4(), ".flyspace");
   const targets = [paths.BASE_CONFIG_DIR, paths.BASE_DATA_DIR, prefix].filter(existsSync7);
   console.log("\n  This removes Flyspace from this machine:");
   console.log("    - revokes this device and removes every background service");
@@ -1905,15 +2103,15 @@ async function runUninstall(args = []) {
     await runServiceUninstall(profile);
   }
   for (const t of targets) {
-    rmSync3(t, { recursive: true, force: true });
+    rmSync4(t, { recursive: true, force: true });
     success2(`Deleted ${t}`);
   }
-  for (const rc of [".zshrc", ".bashrc", ".profile"].map((f) => join8(homedir4(), f))) {
+  for (const rc of [".zshrc", ".bashrc", ".profile"].map((f) => join9(homedir4(), f))) {
     if (!existsSync7(rc)) continue;
-    const before = readFileSync7(rc, "utf-8");
+    const before = readFileSync8(rc, "utf-8");
     const after = before.replace(/\n# Flyspace CLI\nexport PATH="[^"\n]*\.flyspace\/bin:\$PATH"\n?/g, "\n");
     if (after !== before) {
-      writeFileSync5(rc, after);
+      writeFileSync6(rc, after);
       success2(`Removed PATH entry from ${rc}`);
     }
   }
@@ -1921,7 +2119,7 @@ async function runUninstall(args = []) {
 }
 
 // src/commands/profiles-cmd.ts
-import { rmSync as rmSync4 } from "fs";
+import { rmSync as rmSync5 } from "fs";
 var USAGE = `
   Usage: flyspace profiles [list]
          flyspace profiles remove <name>
@@ -1978,7 +2176,7 @@ async function removeCmd(name) {
   }
   const { configDir: configDir2, dataDir } = runWithProfile(name, () => ({ configDir: paths.CONFIG_DIR, dataDir: paths.DATA_DIR }));
   if (isServiceInstalled(name)) await runWithProfile(name, runUninstall);
-  rmSync4(configDir2, { recursive: true, force: true });
+  rmSync5(configDir2, { recursive: true, force: true });
   console.log(`\x1B[32m+\x1B[0m Local config removed: ${configDir2}`);
   console.log(`
   Kept: ${dataDir} (sessions, logs) and any ~/Flyspace/${name}/ channel folders.`);
@@ -1996,7 +2194,7 @@ async function runProfiles(args = []) {
 // src/commands/upgrade.ts
 import { execSync as execSync6 } from "child_process";
 import { realpathSync as realpathSync2 } from "fs";
-import { join as join9 } from "path";
+import { join as join10 } from "path";
 function restartInstalledProfiles() {
   if (isHostServiceInstalled()) {
     console.log(restartHostService() ? "\nHost restarted." : "\nHost restart failed; run: flyspace setup --start-host --restart");
@@ -2029,10 +2227,10 @@ function npmInstallCommand() {
 }
 function npmEnv() {
   const home = flyspaceHome();
-  return home ? { ...process.env, PATH: `${join9(home, "node", "bin")}:${process.env.PATH ?? ""}` } : process.env;
+  return home ? { ...process.env, PATH: `${join10(home, "node", "bin")}:${process.env.PATH ?? ""}` } : process.env;
 }
 async function runUpgrade() {
-  const current = "0.1.13";
+  const current = "0.1.14";
   console.log(`Current version: ${current}`);
   console.log("Checking for updates...\n");
   try {
@@ -2646,11 +2844,11 @@ async function runRestart() {
 // src/commands/logs.ts
 import { spawn as spawn3 } from "child_process";
 import { existsSync as existsSync9 } from "fs";
-import { join as join10 } from "path";
+import { join as join11 } from "path";
 async function runLogs(args) {
   const showErrors = args.includes("--error") || args.includes("-e");
   const filename = showErrors ? "custie-error.log" : "custie.log";
-  const logFile = join10(paths.LOG_DIR, filename);
+  const logFile = join11(paths.LOG_DIR, filename);
   if (!existsSync9(logFile)) {
     console.error(`Log file not found: ${logFile}`);
     console.error("Is the service installed? Run `flyspace install` first.");
@@ -2679,7 +2877,7 @@ import { input, confirm as confirm4, select, checkbox } from "@inquirer/prompts"
 import { WebClient as WebClient3 } from "@slack/web-api";
 
 // src/store/auth-links.ts
-import { createClient } from "@supabase/supabase-js";
+import { createClient as createClient2 } from "@supabase/supabase-js";
 function toAuthLink(data) {
   const userId = data.user?.id;
   const actionLink = data.properties?.action_link;
@@ -2703,7 +2901,7 @@ async function mintSession(email) {
   if (error2) throw new Error(error2.message);
   const tokenHash = data.properties?.hashed_token;
   if (!tokenHash) throw new Error("Supabase returned no token hash");
-  const scratch = createClient(process.env["SUPABASE_URL"], process.env["SUPABASE_SECRET_KEY"], {
+  const scratch = createClient2(process.env["SUPABASE_URL"], process.env["SUPABASE_SECRET_KEY"], {
     auth: { persistSession: false, autoRefreshToken: false }
   });
   const verified = await scratch.auth.verifyOtp({ token_hash: tokenHash, type: "magiclink" });
@@ -2729,7 +2927,7 @@ async function emailForToken(token, type) {
 
 // src/dashboard/profile-config.ts
 import { homedir as homedir5 } from "os";
-import { join as join11 } from "path";
+import { join as join12 } from "path";
 
 // src/dashboard/profile-config-cache.ts
 var cache = /* @__PURE__ */ new Map();
@@ -2748,7 +2946,7 @@ function profileEnv(key) {
 function profileClaudeConfigDir() {
   const config = cachedProfileConfig();
   if (!config) return process.env["CLAUDE_CONFIG_DIR"] || void 0;
-  return config.env["CLAUDE_CONFIG_DIR"]?.trim() || join11(homedir5(), ".claude");
+  return config.env["CLAUDE_CONFIG_DIR"]?.trim() || join12(homedir5(), ".claude");
 }
 function profileOauthToken() {
   const env = cachedProfileConfig()?.env ?? {};
@@ -2850,7 +3048,7 @@ async function sendEmail(email) {
 }
 
 // src/store/invite-store.ts
-import { createHash, randomBytes } from "crypto";
+import { createHash, randomBytes as randomBytes2 } from "crypto";
 var INVITE_TTL_DAYS = 7;
 var INVITE_MESSAGE_MAX = 500;
 function hashInviteToken(token) {
@@ -2860,7 +3058,7 @@ async function issueInvite(membershipId, message) {
   const db = getSupabaseClient();
   const { error: clearError } = await db.from("workspace_invites").delete().eq("membership_id", membershipId).is("accepted_at", null);
   if (clearError) throw new Error(`issueInvite(${membershipId}): ${clearError.message}`);
-  const token = randomBytes(32).toString("hex");
+  const token = randomBytes2(32).toString("hex");
   const expiresAt = new Date(Date.now() + INVITE_TTL_DAYS * 24 * 60 * 60 * 1e3);
   const { error: error2 } = await db.from("workspace_invites").insert({
     membership_id: membershipId,
@@ -3300,9 +3498,9 @@ function workspaceOrigin(c, slug) {
 }
 
 // src/store/setup-invite-store.ts
-import { randomBytes as randomBytes2 } from "crypto";
+import { randomBytes as randomBytes3 } from "crypto";
 async function issueSetupInvite(params) {
-  const token = randomBytes2(32).toString("hex");
+  const token = randomBytes3(32).toString("hex");
   const expiresAt = new Date(Date.now() + INVITE_TTL_DAYS * 24 * 60 * 60 * 1e3);
   const { error: error2 } = await getSupabaseClient().from("workspace_setup_invites").insert({
     email: params.email,
@@ -3329,7 +3527,7 @@ async function reissueSetupInvite(id) {
   const { data, error: error2 } = await db.from("workspace_setup_invites").select("email, owner_name, message").eq("id", id).is("accepted_at", null).maybeSingle();
   if (error2) throw new Error(`reissueSetupInvite(${id}): ${error2.message}`);
   if (!data) throw new Error("no pending invite with that id");
-  const token = randomBytes2(32).toString("hex");
+  const token = randomBytes3(32).toString("hex");
   const expiresAt = new Date(Date.now() + INVITE_TTL_DAYS * 24 * 60 * 60 * 1e3);
   const { error: updateError } = await db.from("workspace_setup_invites").update({ token_hash: hashInviteToken(token), expires_at: expiresAt.toISOString() }).eq("id", id);
   if (updateError) throw new Error(`reissueSetupInvite(${id}): ${updateError.message}`);
@@ -4208,7 +4406,7 @@ import { serve } from "@hono/node-server";
 import { serveStatic } from "@hono/node-server/serve-static";
 
 // src/reconcile.ts
-import { existsSync as existsSync10, mkdirSync as mkdirSync6, writeFileSync as writeFileSync6 } from "fs";
+import { existsSync as existsSync10, mkdirSync as mkdirSync7, writeFileSync as writeFileSync7 } from "fs";
 async function boundWorkspaces2() {
   return (await boundWorkspaces())?.workspaces ?? null;
 }
@@ -4225,7 +4423,7 @@ async function reconcileProfile(profile) {
     if (!hadConfigDir) log5.push(`config dir created (${paths.CONFIG_DIR})`);
     if (!hadDataDir) log5.push(`data dir created (${paths.DATA_DIR})`);
     if (!existsSync10(paths.CONFIG_FILE)) {
-      writeFileSync6(paths.CONFIG_FILE, `BOT_NAME=${profile}
+      writeFileSync7(paths.CONFIG_FILE, `BOT_NAME=${profile}
 `);
       log5.push(`config.env written (${paths.CONFIG_FILE})`);
     }
@@ -4234,7 +4432,7 @@ async function reconcileProfile(profile) {
       if (!channel.cwd) continue;
       const cwd = expandPath(channel.cwd);
       if (isCwdUsable(cwd)) continue;
-      mkdirSync6(cwd, { recursive: true });
+      mkdirSync7(cwd, { recursive: true });
       log5.push(`channel "${channel.name}" cwd created (${cwd})`);
     }
     return log5;
@@ -4396,8 +4594,10 @@ async function filterReadableDocsChannels(ctx, channelIds) {
 // src/dashboard/docs-access-gate.ts
 var requireDocsAccess = async (c, next) => {
   const auth = c.get("auth");
+  const channelId = c.req.param("id") ?? "";
+  if (findChannelById(channelId)?.profile !== getProfile()) return c.json({ error: "channel not found" }, 404);
   const need = c.req.method === "GET" ? "read" : "write";
-  const have = auth ? await resolveDocsAccess(auth, c.req.param("id") ?? "") : "none";
+  const have = auth ? await resolveDocsAccess(auth, channelId) : "none";
   if (!docsAccessAtLeast(have, need)) return c.json({ error: "docs access required" }, 403);
   await next();
 };
@@ -4406,8 +4606,8 @@ var requireDocsAccess = async (c, next) => {
 import { Hono as Hono31 } from "hono";
 
 // src/dashboard/public-share-routes.ts
-import { existsSync as existsSync11, readFileSync as readFileSync9, statSync as statSync3 } from "fs";
-import { join as join13 } from "path";
+import { existsSync as existsSync11, readFileSync as readFileSync10, statSync as statSync3 } from "fs";
+import { join as join14 } from "path";
 import { Hono as Hono3 } from "hono";
 import { GetObjectCommand } from "@aws-sdk/client-s3";
 import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
@@ -4872,12 +5072,12 @@ function injectShareHead(html, head) {
 
 // src/dashboard/app-icon.ts
 import { createHash as createHash2 } from "crypto";
-import { readFileSync as readFileSync8 } from "fs";
-import { join as join12 } from "path";
+import { readFileSync as readFileSync9 } from "fs";
+import { join as join13 } from "path";
 import sharp from "sharp";
 var PLATE = "#0A0A0F";
-var MARK_FILE = join12(paths.PACKAGE_ROOT, "web", "public", "icons", "icon-512.png");
-var MARK_SVG_FILE = join12(paths.PACKAGE_ROOT, "web", "public", "favicon.svg");
+var MARK_FILE = join13(paths.PACKAGE_ROOT, "web", "public", "icons", "icon-512.png");
+var MARK_SVG_FILE = join13(paths.PACKAGE_ROOT, "web", "public", "favicon.svg");
 var LAYOUT = {
   standard: { logo: 0.7, logoCx: 0.5, logoCy: 0.48, badge: 0.27, badgeCx: 0.22, badgeCy: 0.76 },
   maskable: { logo: 0.56, logoCx: 0.5, logoCy: 0.48, badge: 0.23, badgeCx: 0.33, badgeCy: 0.66 }
@@ -4900,7 +5100,7 @@ function roundedPlate(size, fill = PLATE) {
 }
 async function renderBadge(box) {
   const transparent = { r: 0, g: 0, b: 0, alpha: 0 };
-  const raster = await sharp(readFileSync8(MARK_SVG_FILE)).resize(512, 512, { fit: "contain", background: transparent }).png().toBuffer();
+  const raster = await sharp(readFileSync9(MARK_SVG_FILE)).resize(512, 512, { fit: "contain", background: transparent }).png().toBuffer();
   return sharp(raster).trim().resize(box, box, { fit: "contain", background: transparent }).png().toBuffer();
 }
 async function sampleBackground(logo) {
@@ -4955,7 +5155,7 @@ async function renderAppIcon({
   if (hit) return hit;
   const out = logo && await composeIcon(logo, size, maskable, plain).catch(() => null) || // No workspace logo to lead with — the stock mark is still the best icon,
   // either on its usual dark plate or, for a favicon, trimmed and bare.
-  (transparent ? await renderBadge(size) : await sharp(readFileSync8(MARK_FILE)).resize(size, size, { fit: "cover" }).png().toBuffer());
+  (transparent ? await renderBadge(size) : await sharp(readFileSync9(MARK_FILE)).resize(size, size, { fit: "cover" }).png().toBuffer());
   cache3.set(key, out);
   return out;
 }
@@ -6173,7 +6373,7 @@ var shellCache = null;
 function readShell(path) {
   const { mtimeMs } = statSync3(path);
   if (shellCache?.mtimeMs === mtimeMs) return shellCache.html;
-  const html = readFileSync9(path, "utf8").replaceAll('"/assets/', `"${BUILD_PREFIX}/`);
+  const html = readFileSync10(path, "utf8").replaceAll('"/assets/', `"${BUILD_PREFIX}/`);
   shellCache = { mtimeMs, html };
   return html;
 }
@@ -6193,17 +6393,17 @@ function serveBuildFile(c, webDist, dir, name) {
   if (!type || !/^[A-Za-z0-9._-]+$/.test(name) || name.includes("..")) {
     return c.text("not found", 404);
   }
-  const path = join13(webDist, dir, name);
+  const path = join14(webDist, dir, name);
   if (!existsSync11(path)) return c.text("not found", 404);
   c.header("Content-Type", type);
   c.header("Cache-Control", "public, max-age=31536000, immutable");
   if (ext === ".css") {
-    return c.body(readFileSync9(path, "utf8").replaceAll("url(/fonts/", `url(${BUILD_PREFIX}/fonts/`));
+    return c.body(readFileSync10(path, "utf8").replaceAll("url(/fonts/", `url(${BUILD_PREFIX}/fonts/`));
   }
   if (ext === ".js") {
-    return c.body(readFileSync9(path, "utf8").replaceAll('"/assets/', `"${BUILD_PREFIX}/`));
+    return c.body(readFileSync10(path, "utf8").replaceAll('"/assets/', `"${BUILD_PREFIX}/`));
   }
-  return c.body(new Uint8Array(readFileSync9(path)));
+  return c.body(new Uint8Array(readFileSync10(path)));
 }
 var HTML_SHARE_CSP = "sandbox allow-scripts allow-forms allow-modals allow-popups allow-popups-to-escape-sandbox";
 function servePublishedHtml(c, share) {
@@ -6339,7 +6539,7 @@ ${analytics}` : head);
     const requested = c.req.param("lang");
     const lang = canonicalLanguage(requested);
     if (!isTranslatableLanguage(lang)) return next();
-    const shell = join13(webDist, "index.html");
+    const shell = join14(webDist, "index.html");
     if (!existsSync11(shell)) return next();
     const share = await getDocShare(c.req.param("id"));
     if (!share) return next();
@@ -6375,7 +6575,7 @@ ${analytics}` : head);
     const share = await getDocShare(c.req.param("id"));
     if (!share) return next();
     if (share.kind === "html") return servePublishedHtml(c, share);
-    const shell = join13(webDist, "index.html");
+    const shell = join14(webDist, "index.html");
     if (!existsSync11(shell)) return next();
     return readerPage(
       c,
@@ -6488,9 +6688,9 @@ function routeCookieWrites(all, label2, writes) {
 }
 
 // src/dashboard/supabase-server-client.ts
-var REQUEST_TIMEOUT_MS = 5e3;
+var REQUEST_TIMEOUT_MS2 = 5e3;
 function fetchWithTimeout(input2, init) {
-  return fetch(input2, { ...init, signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS) });
+  return fetch(input2, { ...init, signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS2) });
 }
 function createRequestSupabaseClient(c) {
   const url = process.env["SUPABASE_URL"];
@@ -6642,13 +6842,13 @@ async function signAvatarUrl(key) {
 
 // src/dashboard/turnstile.ts
 var VERIFY_URL = "https://challenges.cloudflare.com/turnstile/v0/siteverify";
-var REQUEST_TIMEOUT_MS2 = 5e3;
+var REQUEST_TIMEOUT_MS3 = 5e3;
 function siteverify(secret, token) {
   return fetch(VERIFY_URL, {
     method: "POST",
     headers: { "content-type": "application/x-www-form-urlencoded" },
     body: new URLSearchParams({ secret, response: token }),
-    signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS2)
+    signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS3)
   });
 }
 async function verifyTurnstileToken(token) {
@@ -7001,12 +7201,12 @@ async function offlineAgentIdentities() {
 }
 
 // src/dashboard/host-api.ts
-import { existsSync as existsSync20, readFileSync as readFileSync13, statSync as statSync8 } from "fs";
-import { join as join20 } from "path";
+import { existsSync as existsSync20, readFileSync as readFileSync14, statSync as statSync8 } from "fs";
+import { join as join21 } from "path";
 import sharp3 from "sharp";
 
 // src/dashboard/channels-routes.ts
-import { existsSync as existsSync12, mkdirSync as mkdirSync7 } from "fs";
+import { existsSync as existsSync12, mkdirSync as mkdirSync8 } from "fs";
 import { Hono as Hono9 } from "hono";
 
 // src/dashboard/feature-flags-routes.ts
@@ -7154,7 +7354,7 @@ function coerceMemberEmails(raw) {
 }
 function ensureCwdDir(cwd) {
   const expanded = isLogicalCwd(cwd) ? resolveLogicalCwd(cwd) : expandPath(cwd);
-  if (!existsSync12(expanded)) mkdirSync7(expanded, { recursive: true });
+  if (!existsSync12(expanded)) mkdirSync8(expanded, { recursive: true });
 }
 function toResponse(channel) {
   return {
@@ -7305,24 +7505,24 @@ import {
   closeSync,
   existsSync as existsSync16,
   lstatSync as lstatSync2,
-  mkdirSync as mkdirSync8,
+  mkdirSync as mkdirSync9,
   openSync,
   readSync,
   readdirSync as readdirSync4,
-  readFileSync as readFileSync12,
+  readFileSync as readFileSync13,
   realpathSync as realpathSync3,
   renameSync,
-  rmSync as rmSync6,
+  rmSync as rmSync7,
   statSync as statSync5,
-  writeFileSync as writeFileSync8
+  writeFileSync as writeFileSync9
 } from "fs";
-import { basename as basename6, dirname as dirname5, extname, join as join18, relative, resolve as resolve4, sep } from "path";
+import { basename as basename6, dirname as dirname5, extname, join as join19, relative, resolve as resolve4, sep } from "path";
 import { Hono as Hono10 } from "hono";
 import { streamSSE } from "hono/streaming";
 
 // src/dashboard/docs-watcher.ts
 import { existsSync as existsSync13, watch } from "fs";
-import { basename as basename4, join as join14 } from "path";
+import { basename as basename4, join as join15 } from "path";
 var DEBOUNCE_MS = 200;
 var MAX_PENDING = 200;
 var IGNORED_SEGMENTS = /* @__PURE__ */ new Set([
@@ -7363,7 +7563,7 @@ function watchDocs(cwd, listener) {
       const current = entries.get(cwd);
       if (!current || filename === null) return;
       const rel = filename.split("\\").join("/");
-      if (rel === root && !existsSync13(join14(cwd, rel))) return;
+      if (rel === root && !existsSync13(join15(cwd, rel))) return;
       if (isIgnoredDocPath(rel)) return;
       if (current.pending.size < MAX_PENDING) current.pending.add(rel);
       if (current.timer === null) current.timer = setTimeout(() => flush(cwd), DEBOUNCE_MS);
@@ -7600,18 +7800,18 @@ async function readOrQueueDocAudio(input2) {
 }
 
 // src/dashboard/artifact-export.ts
-import { readFileSync as readFileSync11 } from "fs";
+import { readFileSync as readFileSync12 } from "fs";
 
 // src/dashboard/chat-agent.ts
 import { homedir as homedir7 } from "os";
 
 // src/mcp/config.ts
-import { mkdtempSync, rmSync as rmSync5, writeFileSync as writeFileSync7 } from "fs";
+import { mkdtempSync, rmSync as rmSync6, writeFileSync as writeFileSync8 } from "fs";
 import { tmpdir as tmpdir2 } from "os";
-import { join as join15 } from "path";
+import { join as join16 } from "path";
 
 // src/mcp/crypto.ts
-import { createCipheriv, createDecipheriv, randomBytes as randomBytes3, timingSafeEqual } from "crypto";
+import { createCipheriv, createDecipheriv, randomBytes as randomBytes4, timingSafeEqual } from "crypto";
 var ALGORITHM = "aes-256-gcm";
 var KEY_BYTES = 32;
 var IV_BYTES = 12;
@@ -7644,7 +7844,7 @@ function currentKeyVersion() {
   );
 }
 function encrypt(key, purpose, plaintext) {
-  const iv = randomBytes3(IV_BYTES);
+  const iv = randomBytes4(IV_BYTES);
   const cipher = createCipheriv(ALGORITHM, key, iv);
   cipher.setAAD(Buffer.from(purpose, "utf8"));
   const ciphertext = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
@@ -7664,7 +7864,7 @@ function decrypt(key, purpose, blob) {
 }
 function createEnvelope() {
   const keyVersion = currentKeyVersion();
-  const key = randomBytes3(KEY_BYTES);
+  const key = randomBytes4(KEY_BYTES);
   const wrappedDek = encrypt(
     readMasterKey(keyVersion),
     purposeForDek(keyVersion),
@@ -7730,7 +7930,7 @@ function secretsMatch(a, b) {
 }
 
 // src/mcp/oauth.ts
-import { createHash as createHash7, randomBytes as randomBytes4 } from "crypto";
+import { createHash as createHash7, randomBytes as randomBytes5 } from "crypto";
 var RESERVED_AUTHORIZE_PARAMS = /* @__PURE__ */ new Set([
   "client_id",
   "redirect_uri",
@@ -7744,10 +7944,10 @@ function base64url(buffer) {
   return buffer.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
 function createStateToken() {
-  return base64url(randomBytes4(32));
+  return base64url(randomBytes5(32));
 }
 function createPkcePair() {
-  const verifier = base64url(randomBytes4(32));
+  const verifier = base64url(randomBytes5(32));
   const challenge = base64url(createHash7("sha256").update(verifier).digest());
   return { verifier, challenge };
 }
@@ -8294,12 +8494,12 @@ async function buildMcpConfig(profile, connectionIds) {
   return { config, skipped };
 }
 function writeMcpConfigFile(config) {
-  const dir = mkdtempSync(join15(tmpdir2(), "flyspace-mcp-"));
-  const path = join15(dir, "mcp-config.json");
-  writeFileSync7(path, JSON.stringify(config), { mode: 384 });
+  const dir = mkdtempSync(join16(tmpdir2(), "flyspace-mcp-"));
+  const path = join16(dir, "mcp-config.json");
+  writeFileSync8(path, JSON.stringify(config), { mode: 384 });
   return {
     path,
-    cleanup: () => rmSync5(dir, { recursive: true, force: true })
+    cleanup: () => rmSync6(dir, { recursive: true, force: true })
   };
 }
 async function withMcpConfig(profile, connectionIds, fn) {
@@ -8316,22 +8516,22 @@ async function withMcpConfig(profile, connectionIds, fn) {
 }
 
 // src/claude/agents.ts
-import { existsSync as existsSync14, readdirSync as readdirSync3, readFileSync as readFileSync10 } from "fs";
+import { existsSync as existsSync14, readdirSync as readdirSync3, readFileSync as readFileSync11 } from "fs";
 import { homedir as homedir6 } from "os";
-import { basename as basename5, join as join16 } from "path";
+import { basename as basename5, join as join17 } from "path";
 import yaml from "js-yaml";
 function defaultConfigDir() {
-  return join16(homedir6(), ".claude");
+  return join17(homedir6(), ".claude");
 }
 function expandHome(p) {
   if (p === "~") return homedir6();
-  if (p.startsWith("~/")) return join16(homedir6(), p.slice(2));
+  if (p.startsWith("~/")) return join17(homedir6(), p.slice(2));
   return p;
 }
 function parseFrontmatter(file) {
   let content;
   try {
-    content = readFileSync10(file, "utf-8");
+    content = readFileSync11(file, "utf-8");
   } catch {
     return {};
   }
@@ -8355,7 +8555,7 @@ function collectFrom(root, source) {
     return [];
   }
   return entries2.map((file) => {
-    const path = join16(root, file);
+    const path = join17(root, file);
     const fm = parseFrontmatter(path);
     const name = fm.name?.trim() || basename5(file, ".md");
     return { name, description: (fm.description ?? "").trim(), source, path };
@@ -8364,8 +8564,8 @@ function collectFrom(root, source) {
 function listAgents(configDir2, cwd) {
   const base = configDir2 ? expandHome(configDir2) : defaultConfigDir();
   const collected = [
-    ...collectFrom(join16(cwd, ".claude", "agents"), "project"),
-    ...collectFrom(join16(base, "agents"), "user")
+    ...collectFrom(join17(cwd, ".claude", "agents"), "project"),
+    ...collectFrom(join17(base, "agents"), "user")
   ];
   const byName = /* @__PURE__ */ new Map();
   for (const agent of collected) {
@@ -8377,7 +8577,7 @@ function readAgentPersona(configDir2, cwd, name) {
   const agent = listAgents(configDir2, cwd).find((a) => a.name === name);
   if (!agent) return void 0;
   try {
-    const content = readFileSync10(agent.path, "utf-8");
+    const content = readFileSync11(agent.path, "utf-8");
     return content.replace(/^---\r?\n[\s\S]*?\r?\n---\r?\n?/, "").trim();
   } catch {
     return void 0;
@@ -8477,11 +8677,11 @@ async function updateChannelMemory(channelId, memoryId, patch, actor) {
 async function searchChannelMemories(channelId, query) {
   const words = query.replaceAll(/[,()*%\\]/g, " ").split(/\s+/).filter(Boolean);
   if (!words.length) return [];
-  let request2 = getSupabaseClient().from("memories").select("*").eq("scope", "channel").eq("channel_id", channelId);
+  let request = getSupabaseClient().from("memories").select("*").eq("scope", "channel").eq("channel_id", channelId);
   for (const word of words) {
-    request2 = request2.or(`name.ilike.*${word}*,description.ilike.*${word}*,body.ilike.*${word}*`);
+    request = request.or(`name.ilike.*${word}*,description.ilike.*${word}*,body.ilike.*${word}*`);
   }
-  const { data, error: error2 } = await request2.order("updated_at", { ascending: false }).limit(20);
+  const { data, error: error2 } = await request.order("updated_at", { ascending: false }).limit(20);
   if (error2) throw new Error(`searchChannelMemories(${channelId}): ${error2.message}`);
   return (data ?? []).map(rowToMemory);
 }
@@ -8877,7 +9077,7 @@ ${recent.map((m) => `${m.author}: ${m.body}`).join("\n")}`;
 
 // src/dashboard/attachment-downloader.ts
 import { writeFile } from "fs/promises";
-import { join as join17 } from "path";
+import { join as join18 } from "path";
 import { GetObjectCommand as GetObjectCommand4 } from "@aws-sdk/client-s3";
 var debug = process.env["DEBUG"] === "true";
 var ATTACHMENT_LINK = /\]\(\/api\/attachments\/([^)?\s]+)(?:\?[^)\s]*)?\)/g;
@@ -8924,7 +9124,7 @@ async function downloadOne(key) {
     if (bytes.length > sizeLimit) {
       return { kind: "skip", skipped: { name, mimetype, reason: "too_large" } };
     }
-    const localPath = join17(paths.UPLOADS_DIR, lastSegment);
+    const localPath = join18(paths.UPLOADS_DIR, lastSegment);
     await writeFile(localPath, bytes);
     if (debug)
       console.log(`[attachment-downloader] saved ${key} -> ${localPath} (${bytes.length} bytes)`);
@@ -10211,7 +10411,7 @@ async function exportDocAsArtifact(channelId, docPath) {
   );
   const abs = resolveDocPath(channelConfig.cwd, docPath);
   if (!abs) throw new Error(`doc not found: ${docPath}`);
-  const content = readFileSync11(abs, "utf8");
+  const content = readFileSync12(abs, "utf8");
   const title = extractTitle(abs, "md");
   const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
   const prompt = `Publish the document at \`${docPath}\` (already read below) as a Claude Artifact, then record the result as a stub file under this channel's \`docs/artifacts/\` folder (create the folder if it doesn't exist).
@@ -10468,7 +10668,7 @@ function probeDir(absDir, showHidden) {
         return false;
       }
       if (!showHidden && entry.name.startsWith(".")) continue;
-      const abs = join18(dir, entry.name);
+      const abs = join19(dir, entry.name);
       const kind = entryKind(entry, abs);
       if (kind === "dir") {
         if (SKIP_DIRS.has(entry.name)) hasOther = true;
@@ -10488,14 +10688,14 @@ function probeDir(absDir, showHidden) {
 }
 function readGitBranch(dir) {
   try {
-    let gitDir = join18(dir, ".git");
+    let gitDir = join19(dir, ".git");
     if (statSync5(gitDir).isFile()) {
-      const pointer = readFileSync12(gitDir, "utf8").trim();
+      const pointer = readFileSync13(gitDir, "utf8").trim();
       const match = pointer.match(/^gitdir:\s*(.+)$/);
       if (!match) return void 0;
       gitDir = resolve4(dir, match[1]);
     }
-    const head = readFileSync12(join18(gitDir, "HEAD"), "utf8").trim();
+    const head = readFileSync13(join19(gitDir, "HEAD"), "utf8").trim();
     const branchMatch = head.match(/^ref:\s*refs\/heads\/(.+)$/);
     if (branchMatch) return branchMatch[1];
     return /^[0-9a-f]{7,40}$/i.test(head) ? head.slice(0, 7) : void 0;
@@ -10517,14 +10717,14 @@ function listDocLevel(root, relDir = "", sort = "newest", showHidden = false) {
   for (const entry of entries2) {
     if (dirs.length + docs.length >= MAX_ENTRIES) break;
     if (!showHidden && entry.name.startsWith(".")) continue;
-    const abs = join18(absDir, entry.name);
+    const abs = join19(absDir, entry.name);
     const path = relative(root, abs).split(sep).join("/");
     const kind = entryKind(entry, abs);
     if (kind === "dir") {
       if (SKIP_DIRS.has(entry.name)) continue;
       const probe3 = probeDir(abs, showHidden);
       if (!probe3.hasDocs && probe3.hasOther) continue;
-      const isRepo = existsSync16(join18(abs, ".git"));
+      const isRepo = existsSync16(join19(abs, ".git"));
       dirs.push({
         path,
         name: entry.name,
@@ -10560,7 +10760,7 @@ function flatDocs(root, {
     for (const entry of entries2) {
       if (hits.length >= MAX_FLAT_DOCS) return;
       if (!showHidden && entry.name.startsWith(".")) continue;
-      const abs = join18(dir, entry.name);
+      const abs = join19(dir, entry.name);
       const kind = entryKind(entry, abs);
       if (kind === "dir") {
         if (!SKIP_DIRS.has(entry.name)) walk(abs, depth + 1);
@@ -10602,7 +10802,7 @@ function writeDocContent(root, rel, content, baseMtime) {
   if (Buffer.byteLength(content, "utf8") > MAX_CONTENT_BYTES) {
     return { status: "too-large" };
   }
-  writeFileSync8(abs, content, "utf8");
+  writeFileSync9(abs, content, "utf8");
   return { status: "ok", mtime: statSync5(abs).mtime.toISOString() };
 }
 function resolveRawPath(root, rel) {
@@ -10640,7 +10840,7 @@ function uniqueName(absDir, name) {
   let candidate = name;
   for (let n = 1; n < 1e3; n++) {
     try {
-      statSync5(join18(absDir, candidate));
+      statSync5(join19(absDir, candidate));
     } catch {
       return candidate;
     }
@@ -10662,8 +10862,8 @@ function saveUploadedFile(root, relDir, name, data) {
   if (!(ext in DOC_EXTENSIONS) && !ASSET_LIST_EXTENSIONS.has(ext)) return { status: "bad-type" };
   if (data.byteLength > MAX_UPLOAD_BYTES) return { status: "too-large" };
   const final = uniqueName(absDir, safe);
-  const abs = join18(absDir, final);
-  writeFileSync8(abs, data);
+  const abs = join19(absDir, final);
+  writeFileSync9(abs, data);
   return { status: "ok", path: relative(root, abs).split(sep).join("/"), name: final };
 }
 function createDocFolder(root, relDir, name) {
@@ -10676,13 +10876,13 @@ function createDocFolder(root, relDir, name) {
   }
   const safe = sanitizeUploadName(name);
   if (!safe) return { status: "bad-name" };
-  const abs = join18(absDir, safe);
+  const abs = join19(absDir, safe);
   try {
     statSync5(abs);
     return { status: "exists" };
   } catch {
   }
-  mkdirSync8(abs);
+  mkdirSync9(abs);
   return { status: "ok", path: relative(root, abs).split(sep).join("/"), name: safe };
 }
 function createDocFile(root, relDir, name, content) {
@@ -10699,9 +10899,9 @@ function createDocFile(root, relDir, name, content) {
   if (!(ext in DOC_EXTENSIONS) && !(ext in CODE_EXTENSIONS)) return { status: "bad-name" };
   if (SKIP_FILES.has(safe)) return { status: "bad-name" };
   if (Buffer.byteLength(content, "utf8") > MAX_CONTENT_BYTES) return { status: "too-large" };
-  const abs = join18(absDir, safe);
+  const abs = join19(absDir, safe);
   try {
-    writeFileSync8(abs, content, { encoding: "utf8", flag: "wx" });
+    writeFileSync9(abs, content, { encoding: "utf8", flag: "wx" });
   } catch (err) {
     if (err.code === "EEXIST") return { status: "exists" };
     throw err;
@@ -10737,7 +10937,7 @@ function moveDocEntry(root, from, to) {
   } catch {
     return { status: "bad-target" };
   }
-  const finalAbs = join18(absToDir, name);
+  const finalAbs = join19(absToDir, name);
   if (isDir2 && (finalAbs === absFrom || finalAbs.startsWith(absFrom + sep))) {
     return { status: "into-self" };
   }
@@ -10760,7 +10960,7 @@ function deleteDocEntry(root, path) {
   }
   const isDir2 = stat.isDirectory();
   if (!isDir2 && !stat.isFile() && !stat.isSymbolicLink()) return { status: "not-found" };
-  rmSync6(abs, { recursive: isDir2 });
+  rmSync7(abs, { recursive: isDir2 });
   return {
     status: "ok",
     path: relative(root, abs).split(sep).join("/"),
@@ -10799,7 +10999,7 @@ function createDocsRouter({ gate = requireDocsAccess } = {}) {
     }
     if (!stat.isFile()) return c.json({ error: "not found" }, 404);
     if (stat.size > MAX_RAW_BYTES) return c.json({ error: "file too large" }, 413);
-    const data = readFileSync12(resolved2.abs);
+    const data = readFileSync13(resolved2.abs);
     const headers = { "Content-Type": resolved2.contentType };
     if (download) {
       const filename = basename6(resolved2.abs).replace(/"/g, "");
@@ -10819,7 +11019,7 @@ function createDocsRouter({ gate = requireDocsAccess } = {}) {
     }
     if (!stat.isFile()) return c.json({ error: "not found" }, 404);
     if (stat.size > MAX_RAW_BYTES) return c.json({ error: "file too large" }, 413);
-    return c.body(new Uint8Array(readFileSync12(abs)), 200, {
+    return c.body(new Uint8Array(readFileSync13(abs)), 200, {
       "Content-Type": "text/html; charset=utf-8",
       "Content-Security-Policy": HTML_SHARE_CSP,
       "X-Content-Type-Options": "nosniff",
@@ -11004,7 +11204,7 @@ function createDocsRouter({ gate = requireDocsAccess } = {}) {
       title: kind ? extractTitle(abs, kind) : basename6(abs),
       mtime: stat.mtime.toISOString(),
       tooLarge: tooLarge || void 0,
-      content: tooLarge ? "" : readFileSync12(abs, "utf8")
+      content: tooLarge ? "" : readFileSync13(abs, "utf8")
     });
   });
   app.put("/:id/docs/content", async (c) => {
@@ -11047,7 +11247,7 @@ function createDocsRouter({ gate = requireDocsAccess } = {}) {
       channel,
       rel,
       title: extractTitle(abs, "md"),
-      content: readFileSync12(abs, "utf8")
+      content: readFileSync13(abs, "utf8")
     };
   };
   app.get("/:id/docs/translation/:lang", async (c) => {
@@ -11586,10 +11786,10 @@ function registerMirroredSkillRoutes(api, agent) {
 }
 
 // src/dashboard/providers.ts
-import { execFileSync as execFileSync2 } from "child_process";
+import { execFileSync as execFileSync3 } from "child_process";
 import { existsSync as existsSync19 } from "fs";
 import { homedir as homedir8 } from "os";
-import { join as join19, resolve as resolve5 } from "path";
+import { join as join20, resolve as resolve5 } from "path";
 var PROVIDER_LABELS = {
   claude: "Claude Code",
   codex: "Codex"
@@ -11598,7 +11798,7 @@ var TTL_MS2 = 6e4;
 var cache6 = /* @__PURE__ */ new Map();
 function binaryOnPath(bin) {
   try {
-    execFileSync2(bin, ["--version"], { stdio: "ignore" });
+    execFileSync3(bin, ["--version"], { stdio: "ignore" });
     return true;
   } catch {
     return false;
@@ -11607,10 +11807,10 @@ function binaryOnPath(bin) {
 function claudeAuthAvailable() {
   if (profileEnv("CLAUDE_CODE_OAUTH_TOKEN")?.trim()) return true;
   const configDir2 = profileClaudeConfigDir() || resolve5(homedir8(), ".claude");
-  if (existsSync19(join19(configDir2, ".credentials.json"))) return true;
+  if (existsSync19(join20(configDir2, ".credentials.json"))) return true;
   if (process.platform !== "darwin") return false;
   try {
-    execFileSync2("security", ["find-generic-password", "-s", "Claude Code-credentials"], {
+    execFileSync3("security", ["find-generic-password", "-s", "Claude Code-credentials"], {
       stdio: "ignore"
     });
     return true;
@@ -11760,7 +11960,7 @@ function registerHostRoutes(api) {
     const errors = c.req.query("error") === "true" || c.req.query("error") === "1";
     const limit = Math.min(Number(c.req.query("limit")) || 200, 2e3);
     const filename = errors ? "custie-error.log" : "custie.log";
-    const file = join20(paths.LOG_DIR, filename);
+    const file = join21(paths.LOG_DIR, filename);
     const exists = existsSync20(file);
     return c.json({
       file,
@@ -11772,7 +11972,7 @@ function registerHostRoutes(api) {
 }
 function tailFile(file, limit) {
   if (!existsSync20(file)) return [];
-  const lines = readFileSync13(file, "utf-8").split("\n");
+  const lines = readFileSync14(file, "utf-8").split("\n");
   if (lines.at(-1) === "") lines.pop();
   return lines.slice(-limit);
 }
@@ -13445,7 +13645,7 @@ function createSearchRouter() {
 }
 
 // src/dashboard/uploads-routes.ts
-import { randomUUID } from "crypto";
+import { randomUUID as randomUUID2 } from "crypto";
 import { Hono as Hono18 } from "hono";
 import { PutObjectCommand as PutObjectCommand3, GetObjectCommand as GetObjectCommand5 } from "@aws-sdk/client-s3";
 import { getSignedUrl as getSignedUrl4 } from "@aws-sdk/s3-request-presigner";
@@ -13469,7 +13669,7 @@ function createUploadsRouter() {
     if (file.size > MAX_FILE_BYTES) {
       return c.json({ error: `file must be ${MAX_FILE_BYTES / (1024 * 1024)}MB or smaller` }, 400);
     }
-    const key = `${KEY_PREFIX2}/${getProfile()}/${randomUUID()}-${sanitizeFilename(file.name)}`;
+    const key = `${KEY_PREFIX2}/${getProfile()}/${randomUUID2()}-${sanitizeFilename(file.name)}`;
     const buffer = Buffer.from(await file.arrayBuffer());
     await getR2Client().send(
       new PutObjectCommand3({
@@ -13552,7 +13752,7 @@ function createTranscribeRouter() {
 }
 
 // src/dashboard/avatars-routes.ts
-import { createHash as createHash10, randomUUID as randomUUID2 } from "crypto";
+import { createHash as createHash10, randomUUID as randomUUID3 } from "crypto";
 import { Hono as Hono20 } from "hono";
 import sharp4 from "sharp";
 import { PutObjectCommand as PutObjectCommand4, DeleteObjectCommand as DeleteObjectCommand4 } from "@aws-sdk/client-s3";
@@ -13591,7 +13791,7 @@ async function storeAvatar(file, owner) {
   if (file.size > MAX_AVATAR_BYTES) return { error: "avatar must be 2MB or smaller" };
   const original = Buffer.from(await file.arrayBuffer());
   const resized = await sharp4(original).resize({ width: AVATAR_SIZE, height: AVATAR_SIZE, fit: "cover" }).png().toBuffer();
-  const key = `${avatarKeyPrefix()}${owner}-${randomUUID2()}.png`;
+  const key = `${avatarKeyPrefix()}${owner}-${randomUUID3()}.png`;
   await getR2Client().send(
     new PutObjectCommand4({
       Bucket: getR2Bucket(),
@@ -14955,6 +15155,14 @@ var GROQ_API_URL8 = "https://api.groq.com/openai/v1/chat/completions";
 var GREETING_MODEL = "openai/gpt-oss-20b";
 var TIMEOUT_MS = 6e3;
 var MAX_LISTED_CHANNELS = 8;
+var GUIDES = [
+  "Welcome to Flyspace",
+  "Working with the agent",
+  "Channels and folders",
+  "Docs",
+  "Inviting your team",
+  "Automations"
+];
 var SYSTEM_PROMPT4 = `You write the first message a new Flyspace workspace owner sees, posted in their #general channel. Flyspace is a team chat where an AI agent works inside every channel.
 
 - Plain Markdown, 60 to 110 words, in English. No headings, no emoji, no em or en dashes, no sign-off.
@@ -14962,11 +15170,13 @@ var SYSTEM_PROMPT4 = `You write the first message a new Flyspace workspace owner
 - Say that #general is public: everyone invited to the workspace can see it.
 - If project channels are listed, mention them as #name and say each one is linked to that project folder. Never invent a channel.
 - Mention the trial or the missing Host only if the facts say so.
+- If guides are listed, say they are in the Docs pane of #general and suggest starting with the first one.
 - Use only the facts given. Do not add buttons or a list of next steps: those are appended for you.`;
 function greetingButtons(input2) {
   const buttons = [];
   if (!input2.hostConnected) buttons.push("Connect a machine");
   if (input2.channels[0]) buttons.push(`Summarise #${input2.channels[0]} for me`);
+  if (input2.hostConnected) buttons.push("Give me a quick tour of the guides");
   if (input2.memberCount <= 1) buttons.push("Invite my team");
   buttons.push("Set up a daily digest");
   return buttons.slice(0, 3).map((b) => b.replace(/[|\]]/g, ""));
@@ -14977,6 +15187,7 @@ function fallbackGreeting(input2) {
     `Welcome to ${input2.workspaceName}, ${input2.ownerName}.`,
     "This is #general. It is public, so everyone you invite to the workspace can see it.",
     channels.length ? `Your project channels are ready: ${channels.join(", ")}. Each one is linked to its project folder, so the agent there works on the real files.` : "",
+    input2.hostConnected ? "A few short guides are waiting in the Docs pane of #general. Start with Welcome to Flyspace." : "",
     "Mention the agent in any channel to get started."
   ].filter(Boolean).join("\n\n");
 }
@@ -14987,7 +15198,8 @@ async function groqGreeting(input2, apiKey) {
     `Plan: ${input2.trialing ? "14-day free trial, just started" : "not on a trial"}`,
     `Host: ${input2.hostConnected ? "a machine is connected, agents can run" : "no machine connected yet, agents cannot run until one is"}`,
     `Project channels: ${input2.channels.slice(0, MAX_LISTED_CHANNELS).join(", ") || "(none yet)"}`,
-    `Members: ${input2.memberCount}`
+    `Members: ${input2.memberCount}`,
+    `Guides in #general: ${input2.hostConnected ? GUIDES.join(", ") : "(none, no machine connected)"}`
   ].join("\n");
   const res = await fetch(GROQ_API_URL8, {
     method: "POST",
@@ -15069,6 +15281,14 @@ function createOnboardingRouter(agent) {
     await markWorkspaceProjectsSetup(ctx.workspaceId);
     return c.json({ channels: created.map((ch) => ({ id: ch.id, name: ch.name })) }, 201);
   });
+  app.get("/greeting", async (c) => {
+    const ctx = await resolveAuthContext(c);
+    if (ctx?.role !== "admin") return c.json({ pending: false });
+    const greetedAt = await getWorkspaceGreetedAt(ctx.workspaceId);
+    const pending3 = !!ctx.projectsSetupAt && !greetedAt;
+    const general = pending3 ? await ensureGeneralChannel() : null;
+    return c.json({ pending: pending3, channelId: general?.id ?? null });
+  });
   app.post("/greeting", async (c) => {
     const ctx = await resolveAuthContext(c);
     if (ctx?.role !== "admin") return c.json({ error: "admin access required" }, 403);
@@ -15077,6 +15297,8 @@ function createOnboardingRouter(agent) {
     const existing = () => supabase.from("threads").select("id").eq("client_key", ctx.workspaceId).maybeSingle();
     const found = await existing();
     if (found.data) return c.json({ channelId: general.id, threadId: found.data.id });
+    if (await getWorkspaceGreetedAt(ctx.workspaceId))
+      return c.json({ error: "already greeted" }, 409);
     const [branding, billing, members] = await Promise.all([
       getWorkspaceBranding(getProfile()).catch(() => null),
       getWorkspaceBilling(ctx.workspaceId).catch(() => null),
@@ -15107,6 +15329,7 @@ function createOnboardingRouter(agent) {
       await supabase.from("threads").delete().eq("id", thread.id);
       return c.json({ error: reply.error.message }, 500);
     }
+    await markWorkspaceGreeted(ctx.workspaceId);
     return c.json({ channelId: general.id, threadId: thread.id }, 201);
   });
   return app;
@@ -15600,10 +15823,10 @@ import { WebSocket, WebSocketServer } from "ws";
 
 // src/dashboard/host-identity.ts
 import { createPrivateKey as createPrivateKey2, createPublicKey as createPublicKey2, generateKeyPairSync as generateKeyPairSync2 } from "crypto";
-import { existsSync as existsSync23, mkdirSync as mkdirSync9, readFileSync as readFileSync14, writeFileSync as writeFileSync9 } from "fs";
-import { dirname as dirname7, join as join21 } from "path";
+import { existsSync as existsSync23, mkdirSync as mkdirSync10, readFileSync as readFileSync15, writeFileSync as writeFileSync10 } from "fs";
+import { dirname as dirname7, join as join22 } from "path";
 function hostPrivateKeyPath() {
-  return process.env["FLYSPACE_HOST_KEY_PATH"] || join21(paths.BASE_CONFIG_DIR, "host.key");
+  return process.env["FLYSPACE_HOST_KEY_PATH"] || join22(paths.BASE_CONFIG_DIR, "host.key");
 }
 function loadHostPrivateKey(path = hostPrivateKeyPath()) {
   if (!existsSync23(path)) {
@@ -15611,7 +15834,7 @@ function loadHostPrivateKey(path = hostPrivateKeyPath()) {
       `No Host identity at ${path}. Run \`pnpm run generate-host-key\` on this machine, then set FLYSPACE_HOST_PUBLIC_KEY on the Data process to the printed public key.`
     );
   }
-  return createPrivateKey2(readFileSync14(path, "utf8"));
+  return createPrivateKey2(readFileSync15(path, "utf8"));
 }
 function loadHostPublicKey() {
   const b64 = process.env["FLYSPACE_HOST_PUBLIC_KEY"];
@@ -15624,82 +15847,6 @@ function loadHostPublicKey() {
   }
 }
 
-// src/dashboard/host-lock.ts
-import { execFileSync as execFileSync3 } from "child_process";
-import { randomBytes as randomBytes5 } from "crypto";
-import { mkdirSync as mkdirSync10, readFileSync as readFileSync15, rmSync as rmSync7, writeFileSync as writeFileSync10 } from "fs";
-import { join as join22 } from "path";
-function hostLockPath() {
-  return join22(paths.BASE_DATA_DIR, "host.lock");
-}
-function isLiveFlyspace(pid) {
-  try {
-    process.kill(pid, 0);
-    const command = execFileSync3("ps", ["-p", String(pid), "-o", "command="], {
-      encoding: "utf8"
-    });
-    return command.includes("flyspace") || command.includes("host-server");
-  } catch {
-    return false;
-  }
-}
-function readLockPid(path) {
-  try {
-    const pid = Number(JSON.parse(readFileSync15(path, "utf8")).pid);
-    return Number.isInteger(pid) && pid > 0 ? pid : null;
-  } catch {
-    return null;
-  }
-}
-function acquireHostLock() {
-  const path = hostLockPath();
-  mkdirSync10(paths.BASE_DATA_DIR, { recursive: true });
-  const body = JSON.stringify({
-    pid: process.pid,
-    startedAt: (/* @__PURE__ */ new Date()).toISOString(),
-    execPath: process.argv[1] ?? ""
-  });
-  for (let attempt = 0; attempt < 2; attempt++) {
-    try {
-      writeFileSync10(path, body, { flag: "wx", mode: 384 });
-      const release2 = () => {
-        if (readLockPid(path) === process.pid) rmSync7(path, { force: true });
-      };
-      process.once("exit", release2);
-      return release2;
-    } catch (err) {
-      if (err.code !== "EEXIST") throw err;
-      const holder = readLockPid(path);
-      if (holder === process.pid) return () => {
-      };
-      if (holder && isLiveFlyspace(holder)) {
-        throw new Error(
-          `Another Flyspace Host is already running on this machine (pid ${holder}). Stop it first, or check for a second CLI install (\`which -a flyspace\`). Two Hosts overwrite each other's skill mirror.`
-        );
-      }
-      rmSync7(path, { force: true });
-    }
-  }
-  throw new Error(`Could not take the Host lock at ${path}`);
-}
-function publishHostEndpoint(port) {
-  const path = hostLockPath();
-  if (readLockPid(path) !== process.pid) return null;
-  const token = randomBytes5(32).toString("hex");
-  const lock = JSON.parse(readFileSync15(path, "utf8"));
-  writeFileSync10(path, JSON.stringify({ ...lock, port, token }), { mode: 384 });
-  return token;
-}
-function readHostEndpoint() {
-  try {
-    const { pid, port, token } = JSON.parse(readFileSync15(hostLockPath(), "utf8"));
-    if (pid === process.pid || !Number.isInteger(port) || typeof token !== "string") return null;
-    return { port, token };
-  } catch {
-    return null;
-  }
-}
-
 // src/store/device-store.ts
 import { createHash as createHash11, createPublicKey as createPublicKey3, randomBytes as randomBytes6, randomInt } from "crypto";
 var DEVICE_CODE_TTL_MS = 10 * 6e4;
@@ -16490,98 +16637,6 @@ var forwardToSupabase = async (req) => {
   };
 };
 
-// src/dashboard/host-db-client.ts
-import { createClient as createClient2 } from "@supabase/supabase-js";
-import { randomUUID as randomUUID3 } from "crypto";
-var REQUEST_TIMEOUT_MS3 = 3e4;
-var pending = /* @__PURE__ */ new Map();
-var sender = null;
-var onSender = [];
-function setHostDbSender(fn) {
-  sender = fn;
-  if (!fn) return;
-  const waiting = onSender;
-  onSender = [];
-  for (const wake of waiting) wake();
-}
-function handleHostDbResult(id, res) {
-  const p = pending.get(id);
-  if (!p) return;
-  pending.delete(id);
-  clearTimeout(p.timer);
-  p.resolve(res);
-}
-function whenConnected() {
-  if (sender) return Promise.resolve(sender);
-  return new Promise((resolve7, reject) => {
-    const timer2 = setTimeout(() => {
-      onSender = onSender.filter((w) => w !== wake);
-      reject(new Error("Host is not connected to the Data API"));
-    }, REQUEST_TIMEOUT_MS3);
-    const wake = () => {
-      clearTimeout(timer2);
-      resolve7(sender);
-    };
-    onSender.push(wake);
-  });
-}
-async function request(req) {
-  const send2 = await whenConnected();
-  const id = randomUUID3();
-  return new Promise((resolve7, reject) => {
-    const timer2 = setTimeout(() => {
-      pending.delete(id);
-      reject(new Error("Data API did not answer in time"));
-    }, REQUEST_TIMEOUT_MS3);
-    pending.set(id, { resolve: resolve7, reject, timer: timer2 });
-    send2({ type: "db", id, req });
-  });
-}
-var BODYLESS_STATUS = /* @__PURE__ */ new Set([101, 204, 205, 304]);
-var hostDbFetch = async (input2, init) => {
-  const req = new Request(input2, init);
-  const url = new URL(req.url);
-  const method = req.method.toUpperCase();
-  const res = await request({
-    method,
-    path: `${url.pathname}${url.search}`,
-    headers: Object.fromEntries(req.headers.entries()),
-    body: method === "GET" || method === "HEAD" ? void 0 : await req.text()
-  });
-  const noBody = method === "HEAD" || BODYLESS_STATUS.has(res.status);
-  return new Response(noBody ? null : res.body, { status: res.status, headers: res.headers });
-};
-function relayChannel(topic) {
-  const channel = {
-    on: () => channel,
-    subscribe: (callback) => {
-      queueMicrotask(() => callback?.("SUBSCRIBED"));
-      return channel;
-    },
-    send: async (msg) => {
-      if (msg.type !== "broadcast" || !sender) return "error";
-      sender({ type: "db-broadcast", topic, event: msg.event, payload: msg.payload ?? {} });
-      return "ok";
-    },
-    unsubscribe: async () => "ok"
-  };
-  return channel;
-}
-function createHostDbClient() {
-  const client2 = createClient2("https://host-db.invalid", "host-device", {
-    auth: { persistSession: false, autoRefreshToken: false },
-    global: { fetch: hostDbFetch }
-  });
-  return new Proxy(client2, {
-    get(target, prop) {
-      if (prop === "channel") return relayChannel;
-      if (prop === "removeChannel") return async () => "ok";
-      const value = Reflect.get(target, prop, target);
-      return typeof value === "function" ? value.bind(target) : value;
-    }
-  });
-}
-
 // src/dashboard/agent-bridge.ts
 var HOST_SOCKET_PATH = "/internal/host-socket";
 var DEFAULT_DATA_API_PORT = 4757;
@@ -16842,6 +16897,7 @@ function callHost(method, args, timeoutMs = CALL_TIMEOUT_MS) {
     );
     return Promise.resolve(null);
   }
+  if (method === "docsRequest") console.log(`[host-socket] docsRequest for "${profile}" -> device ${hosts.get(ws)?.deviceId ?? "legacy"}`);
   const id = randomUUID4();
   return new Promise((resolve7) => {
     const timer2 = setTimeout(() => {
@@ -17066,12 +17122,13 @@ function relayedAgentCallbacks(local) {
     ...Object.fromEntries(RELAYED_METHODS.map((method) => [method, relay3(method)]))
   };
 }
-async function handleLocalRelay(req, callbacks, token) {
+function relayAuthorized(req, token) {
   const given = Buffer.from(req.headers.get("authorization") ?? "");
   const expected = Buffer.from(`Bearer ${token}`);
-  if (!token || given.length !== expected.length || !timingSafeEqual2(given, expected)) {
-    return Response.json({ error: "unauthorized" }, { status: 401 });
-  }
+  return !!token && given.length === expected.length && timingSafeEqual2(given, expected);
+}
+async function handleLocalRelay(req, callbacks, token) {
+  if (!relayAuthorized(req, token)) return Response.json({ error: "unauthorized" }, { status: 401 });
   const body = await req.json().catch(() => null);
   const method = RELAYED_METHODS.find((m) => m === body?.method);
   if (!body || !method || typeof body.profile !== "string" || !Array.isArray(body.args)) {
@@ -17738,6 +17795,20 @@ async function startDashboardServer(preferredPort = DEFAULT_DASHBOARD_PORT, host
   let relayToken = null;
   if (mode === "host") {
     app.post(LOCAL_RELAY_PATH, (c) => handleLocalRelay(c.req.raw, agent, relayToken));
+    if (earlyHostSocket) {
+      app.post(LOCAL_DB_PATH, async (c) => {
+        if (!relayAuthorized(c.req.raw, relayToken)) return c.json({ error: "unauthorized" }, 401);
+        const req = await c.req.json().catch(() => null);
+        if (!req || typeof req.method !== "string" || typeof req.path !== "string") {
+          return c.json({ error: "bad request" }, 400);
+        }
+        try {
+          return c.json(await requestHostDb(req));
+        } catch (err) {
+          return c.json({ error: err.message }, 503);
+        }
+      });
+    }
   }
   app.route("/stripe", createStripeWebhookRouter());
   if (!servesHost) {
@@ -19731,7 +19802,7 @@ async function main() {
       break;
     case "-v":
     case "--version":
-      printRaw("0.1.13");
+      printRaw("0.1.14");
       break;
     case "-h":
     case "--help":