flyspace-cli 0.1.13 → 0.1.15

package/dist/cli.js

@@ -13,6 +13,7 @@ import {
   HandleTakenError,
   InvalidTransferError,
   LastAdminError,
+  MEMORY_TYPES,
   MessageQueue,
   OutputStyleConflictError,
   SKIP_SUBTYPES,
@@ -39,12 +40,15 @@ import {
   createOutputStyle,
   createSkillFile,
   createWorkspace,
+  deleteChannelMemory,
   deleteMembership,
   deleteOutputStyle,
   deleteSkillFile,
   deleteWorkspace,
+  disableFeatureFlag,
   displayNameFor,
   docsAccessPromptNote,
+  enableFeatureFlag,
   ensureAgentDmChannel,
   ensureGeneralChannel,
   ensureLogicalCwdDir,
@@ -52,12 +56,15 @@ import {
   ensureUsersCached,
   expandPath,
   extractCategories,
+  featureFlagIds,
+  featureFlags,
   findChannel,
   findChannelByAgentName,
   findChannelById,
   findSkillDetail,
   getAgentPaused,
   getAllowGuestAccess,
+  getChannelMemory,
   getChannelRegistry,
   getMembershipByEmail,
   getMembershipByUserId,
@@ -68,17 +75,24 @@ import {
   getWorkspaceById,
   getWorkspaceBySlug,
   getWorkspaceByStripeCustomerId,
+  getWorkspaceGreetedAt,
   getWorkspacePlanStatus,
   installUsageRecording,
   isAllowedModel,
   isCodexModel,
   isCwdUsable,
   isEffort,
+  isFeatureFlagId,
+  isFeatureVisible,
   isLockedPlan,
   isLogicalCwd,
+  isMemoryType,
+  isUuid,
   isValidSkillName,
   lastRunsForWorkspace,
   listActiveUsers,
+  listChannelMemories,
+  listEnabledFeatureFlags,
   listMemberChannels,
   listMemberships,
   listMembershipsByEmail,
@@ -86,9 +100,11 @@ import {
   listPluginSkillDetails,
   listSkillFiles,
   listSkills,
+  listThreadMemoryEvents,
   listUsersWithAvatars,
   listWorkspaceSummaries,
   listWorkspaces,
+  loadAgentMemory,
   loadAutomations,
   loadAutomationsFile,
   loadBotIdentity,
@@ -103,6 +119,7 @@ import {
   lookupById,
   markInviteResent,
   markWorkspaceAgentConnected,
+  markWorkspaceGreeted,
   markWorkspaceProjectsSetup,
   markdownToBlocks,
   mcpStrictConfigEnabled,
@@ -120,6 +137,7 @@ import {
   resolveChannelId,
   resolveChannelPrompt,
   resolveCwd,
+  resolveFeatureFlags,
   resolveLogicalCwd,
   resolveSelectedOutputStyle,
   resolveUserId,
@@ -128,9 +146,11 @@ import {
   runnerForModel,
   saveAgentProfile,
   saveBotIdentity,
+  saveChannelMemory,
   saveDashboardSettings,
   saveWorkspaceBranding,
   saveWorkspacePrompt,
+  searchChannelMemories,
   setAgentPaused,
   setAllowGuestAccess,
   setMembershipHandle,
@@ -143,17 +163,20 @@ import {
   syncSlackAvatars,
   transferWorkspaceAdmin,
   tsToIso,
+  undoMemoryEvent,
   updateChannelById,
+  updateChannelMemory,
   updateChannelsMcpConnections,
   updateMembershipRole,
   updateOutputStyle,
   updateWorkspacePlanStatus,
   usageLimitedModels,
   usageLimitedUntil,
+  validateMemoryInput,
   warnOnBrokenChannelCwds,
   workspaceSkillsDir,
   writeSkillFile
-} from "./chunk-VKTJBYA3.js";
+} from "./chunk-KFT2YP5W.js";
 import {
   firstReplyBody,
   getThread,
@@ -220,8 +243,8 @@ import { dirname, join } from "path";
 var REQUIRED_ENV = ["SUPABASE_URL", "SUPABASE_SECRET_KEY"];
 var RENOTIFY_AFTER_MS = 30 * 60 * 1e3;
 var ts = () => (/* @__PURE__ */ new Date()).toISOString();
-function findMissingEnv(env = process.env) {
-  const required = slackConfigured(env) ? [...SLACK_ENV, ...REQUIRED_ENV] : REQUIRED_ENV;
+function findMissingEnv(env = process.env, supabaseViaHost = false) {
+  const required = [...slackConfigured(env) ? SLACK_ENV : [], ...supabaseViaHost ? [] : REQUIRED_ENV];
   return required.filter((name) => !env[name]?.trim());
 }
 function shouldNotify(missing, statePath, now) {
@@ -290,7 +313,7 @@ async function preflight(opts = {}) {
   const statePath = opts.statePath ?? join(paths.DATA_DIR, "preflight-alert.json");
   const notify = opts.notify ?? notifyOwnerOverSlack;
   const exit = opts.exit ?? ((code) => process.exit(code));
-  const missing = findMissingEnv(env);
+  const missing = findMissingEnv(env, opts.supabaseViaHost);
   if (missing.length === 0) {
     rmSync(statePath, { force: true });
     return;
@@ -307,15 +330,392 @@ async function preflight(opts = {}) {
   exit(1);
 }
 
+// src/auth/device-auth.ts
+import { createPrivateKey, createPublicKey, generateKeyPairSync, sign } from "crypto";
+import { existsSync, mkdirSync as mkdirSync2, readFileSync as readFileSync2, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "fs";
+import { dirname as dirname2, join as join2 } from "path";
+var DEFAULT_API_URL = "https://app.flyspace.ai";
+var EXPIRY_SKEW_MS = 6e4;
+var AuthApiError = class extends Error {
+  constructor(message, status) {
+    super(message);
+    this.status = status;
+    this.name = "AuthApiError";
+  }
+};
+function apiUrl() {
+  return (process.env["FLYSPACE_API_URL"] || DEFAULT_API_URL).replace(/\/+$/, "");
+}
+function deviceKeyPath() {
+  return join2(paths.BASE_CONFIG_DIR, "device.key");
+}
+function credentialsPath() {
+  return join2(paths.BASE_CONFIG_DIR, "credentials.json");
+}
+function ensureDeviceKey(path = deviceKeyPath()) {
+  let created = false;
+  if (!existsSync(path)) {
+    const { privateKey: privateKey2 } = generateKeyPairSync("ed25519");
+    mkdirSync2(dirname2(path), { recursive: true });
+    writeFileSync2(path, privateKey2.export({ type: "pkcs8", format: "pem" }), { mode: 384 });
+    created = true;
+  }
+  const privateKey = createPrivateKey(readFileSync2(path, "utf8"));
+  const publicKeyBase64 = createPublicKey(privateKey).export({ type: "spki", format: "der" }).toString(
+    "base64"
+  );
+  return { privateKey, publicKeyBase64, created };
+}
+function loadCredentials(path = credentialsPath()) {
+  if (!existsSync(path)) return null;
+  try {
+    return JSON.parse(readFileSync2(path, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function saveCredentials(creds, path = credentialsPath()) {
+  mkdirSync2(dirname2(path), { recursive: true });
+  writeFileSync2(path, `${JSON.stringify(creds, null, 2)}
+`, { mode: 384 });
+}
+function clearLocalAuth() {
+  rmSync2(credentialsPath(), { force: true });
+  rmSync2(deviceKeyPath(), { force: true });
+}
+async function post(base, path, body, token) {
+  return fetch(`${base}${path}`, {
+    method: "POST",
+    headers: {
+      "content-type": "application/json",
+      ...token ? { authorization: `Bearer ${token}` } : {}
+    },
+    body: JSON.stringify(body)
+  });
+}
+async function readJson(res) {
+  try {
+    return await res.json();
+  } catch {
+    return {};
+  }
+}
+async function expectOk(res, what) {
+  const json = await readJson(res);
+  if (!res.ok) {
+    const reason = typeof json["error"] === "string" ? json["error"] : res.statusText;
+    throw new AuthApiError(`${what} failed (${res.status}): ${reason}`, res.status);
+  }
+  return json;
+}
+function toSlugs(value) {
+  return Array.isArray(value) ? value.filter((v) => typeof v === "string") : [];
+}
+function toGrant(json) {
+  const user = json["user"] ?? {};
+  return {
+    accessToken: String(json["access_token"]),
+    expiresIn: Number(json["expires_in"]),
+    deviceId: String(json["device_id"]),
+    userEmail: String(user["email"] ?? ""),
+    workspaces: toSlugs(json["workspaces"])
+  };
+}
+async function requestDeviceCode(base, input2) {
+  const res = await post(base, "/api/auth/device/code", {
+    public_key: input2.publicKey,
+    name: input2.name,
+    platform: input2.platform
+  });
+  const json = await expectOk(res, "Requesting a device code");
+  return {
+    deviceCode: String(json["device_code"]),
+    userCode: String(json["user_code"]),
+    verificationUri: String(json["verification_uri"]),
+    expiresIn: Number(json["expires_in"]),
+    interval: Number(json["interval"] ?? 5)
+  };
+}
+async function pollDeviceToken(base, deviceCode) {
+  const res = await post(base, "/api/auth/device/token", { device_code: deviceCode });
+  const json = await readJson(res);
+  if (res.ok) return { status: "approved", grant: toGrant(json) };
+  switch (json["error"]) {
+    case "authorization_pending":
+      return { status: "pending" };
+    case "slow_down":
+      return { status: "slow_down" };
+    case "access_denied":
+      return { status: "denied" };
+    case "expired_token":
+      return { status: "expired" };
+    default:
+      throw new AuthApiError(`Polling for approval failed (${res.status}): ${String(json["error"] ?? res.statusText)}`, res.status);
+  }
+}
+async function refreshAccessToken(creds, privateKey) {
+  const challenge = await expectOk(
+    await post(creds.apiUrl, "/api/auth/device/challenge", { device_id: creds.deviceId }),
+    "Requesting a refresh challenge"
+  );
+  const nonce = String(challenge["nonce"]);
+  const signature = sign(null, Buffer.from(nonce), privateKey).toString("base64");
+  const json = await expectOk(
+    await post(creds.apiUrl, "/api/auth/device/refresh", { device_id: creds.deviceId, nonce, signature }),
+    "Refreshing the access token"
+  );
+  return {
+    ...creds,
+    accessToken: String(json["access_token"]),
+    accessTokenExpiresAt: Date.now() + Number(json["expires_in"]) * 1e3
+  };
+}
+async function fetchWhoAmI(base, token) {
+  const res = await fetch(`${base}/api/auth/device/me`, { headers: { authorization: `Bearer ${token}` } });
+  const json = await expectOk(res, "Checking the session");
+  const user = json["user"] ?? {};
+  const device = json["device"] ?? {};
+  return {
+    userEmail: String(user["email"] ?? ""),
+    deviceId: String(device["id"] ?? ""),
+    deviceName: String(device["name"] ?? ""),
+    workspaces: toSlugs(json["workspaces"])
+  };
+}
+async function boundWorkspaces() {
+  const creds = loadCredentials();
+  if (!creds) return null;
+  try {
+    const me = await fetchWhoAmI(creds.apiUrl, await getAccessToken());
+    saveCredentials({ ...loadCredentials() ?? creds, workspaces: me.workspaces });
+    return { workspaces: me.workspaces, fresh: true };
+  } catch {
+    return { workspaces: creds.workspaces ?? [], fresh: false };
+  }
+}
+async function revokeDevice(base, token) {
+  await expectOk(await post(base, "/api/auth/device/revoke", {}, token), "Revoking this device");
+}
+async function getAccessToken() {
+  const fromEnv = process.env["FLYSPACE_TOKEN"];
+  if (fromEnv) return fromEnv;
+  const creds = loadCredentials();
+  if (!creds) return null;
+  if (creds.accessTokenExpiresAt - EXPIRY_SKEW_MS > Date.now()) return creds.accessToken;
+  const { privateKey } = ensureDeviceKey();
+  const refreshed = await refreshAccessToken(creds, privateKey);
+  saveCredentials(refreshed);
+  return refreshed.accessToken;
+}
+
+// src/dashboard/host-db-client.ts
+import { createClient } from "@supabase/supabase-js";
+import { randomUUID } from "crypto";
+
+// src/dashboard/host-lock.ts
+import { execFileSync } from "child_process";
+import { randomBytes } from "crypto";
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync3, rmSync as rmSync3, writeFileSync as writeFileSync3 } from "fs";
+import { join as join3 } from "path";
+function hostLockPath() {
+  return join3(paths.BASE_DATA_DIR, "host.lock");
+}
+function isLiveFlyspace(pid) {
+  try {
+    process.kill(pid, 0);
+    const command = execFileSync("ps", ["-p", String(pid), "-o", "command="], {
+      encoding: "utf8"
+    });
+    return command.includes("flyspace") || command.includes("host-server");
+  } catch {
+    return false;
+  }
+}
+function readLockPid(path) {
+  try {
+    const pid = Number(JSON.parse(readFileSync3(path, "utf8")).pid);
+    return Number.isInteger(pid) && pid > 0 ? pid : null;
+  } catch {
+    return null;
+  }
+}
+function acquireHostLock() {
+  const path = hostLockPath();
+  mkdirSync3(paths.BASE_DATA_DIR, { recursive: true });
+  const body = JSON.stringify({
+    pid: process.pid,
+    startedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    execPath: process.argv[1] ?? ""
+  });
+  for (let attempt = 0; attempt < 2; attempt++) {
+    try {
+      writeFileSync3(path, body, { flag: "wx", mode: 384 });
+      const release2 = () => {
+        if (readLockPid(path) === process.pid) rmSync3(path, { force: true });
+      };
+      process.once("exit", release2);
+      return release2;
+    } catch (err) {
+      if (err.code !== "EEXIST") throw err;
+      const holder = readLockPid(path);
+      if (holder === process.pid) return () => {
+      };
+      if (holder && isLiveFlyspace(holder)) {
+        throw new Error(
+          `Another Flyspace Host is already running on this machine (pid ${holder}). Stop it first, or check for a second CLI install (\`which -a flyspace\`). Two Hosts overwrite each other's skill mirror.`
+        );
+      }
+      rmSync3(path, { force: true });
+    }
+  }
+  throw new Error(`Could not take the Host lock at ${path}`);
+}
+function publishHostEndpoint(port) {
+  const path = hostLockPath();
+  if (readLockPid(path) !== process.pid) return null;
+  const token = randomBytes(32).toString("hex");
+  const lock = JSON.parse(readFileSync3(path, "utf8"));
+  writeFileSync3(path, JSON.stringify({ ...lock, port, token }), { mode: 384 });
+  return token;
+}
+function readHostEndpoint() {
+  try {
+    const { pid, port, token } = JSON.parse(readFileSync3(hostLockPath(), "utf8"));
+    if (pid === process.pid || !Number.isInteger(port) || typeof token !== "string") return null;
+    return { port, token };
+  } catch {
+    return null;
+  }
+}
+
+// src/dashboard/host-db-client.ts
+var REQUEST_TIMEOUT_MS = 3e4;
+var pending = /* @__PURE__ */ new Map();
+var sender = null;
+var onSender = [];
+function setHostDbSender(fn) {
+  sender = fn;
+  if (!fn) return;
+  const waiting = onSender;
+  onSender = [];
+  for (const wake of waiting) wake();
+}
+function handleHostDbResult(id, res) {
+  const p = pending.get(id);
+  if (!p) return;
+  pending.delete(id);
+  clearTimeout(p.timer);
+  p.resolve(res);
+}
+function whenConnected() {
+  if (sender) return Promise.resolve(sender);
+  return new Promise((resolve7, reject) => {
+    const timer2 = setTimeout(() => {
+      onSender = onSender.filter((w) => w !== wake);
+      reject(new Error("Host is not connected to the Data API"));
+    }, REQUEST_TIMEOUT_MS);
+    const wake = () => {
+      clearTimeout(timer2);
+      resolve7(sender);
+    };
+    onSender.push(wake);
+  });
+}
+async function requestHostDb(req) {
+  const send2 = await whenConnected();
+  const id = randomUUID();
+  return new Promise((resolve7, reject) => {
+    const timer2 = setTimeout(() => {
+      pending.delete(id);
+      reject(new Error("Data API did not answer in time"));
+    }, REQUEST_TIMEOUT_MS);
+    pending.set(id, { resolve: resolve7, reject, timer: timer2 });
+    send2({ type: "db", id, req });
+  });
+}
+var BODYLESS_STATUS = /* @__PURE__ */ new Set([101, 204, 205, 304]);
+function dbFetch(send2) {
+  return async (input2, init2) => {
+    const req = new Request(input2, init2);
+    const url = new URL(req.url);
+    const method = req.method.toUpperCase();
+    const res = await send2({
+      method,
+      path: `${url.pathname}${url.search}`,
+      headers: Object.fromEntries(req.headers.entries()),
+      body: method === "GET" || method === "HEAD" ? void 0 : await req.text()
+    });
+    const noBody = method === "HEAD" || BODYLESS_STATUS.has(res.status);
+    return new Response(noBody ? null : res.body, { status: res.status, headers: res.headers });
+  };
+}
+var hostDbFetch = dbFetch(requestHostDb);
+var LOCAL_DB_PATH = "/internal/db";
+async function requestViaLocalHost(req) {
+  const deadline = Date.now() + REQUEST_TIMEOUT_MS;
+  let endpoint = readHostEndpoint();
+  while (!endpoint && Date.now() < deadline) {
+    await new Promise((r) => setTimeout(r, 1e3));
+    endpoint = readHostEndpoint();
+  }
+  if (!endpoint) throw new Error("No local Host to reach the Data API through");
+  const res = await fetch(`http://127.0.0.1:${endpoint.port}${LOCAL_DB_PATH}`, {
+    method: "POST",
+    headers: { authorization: `Bearer ${endpoint.token}`, "content-type": "application/json" },
+    body: JSON.stringify(req),
+    signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS + 5e3)
+  });
+  if (!res.ok) throw new Error(`Local Host DB relay answered ${res.status}`);
+  return await res.json();
+}
+function relayChannel(topic) {
+  const channel = {
+    on: () => channel,
+    subscribe: (callback) => {
+      queueMicrotask(() => callback?.("SUBSCRIBED"));
+      return channel;
+    },
+    send: async (msg) => {
+      if (msg.type !== "broadcast" || !sender) return "error";
+      sender({ type: "db-broadcast", topic, event: msg.event, payload: msg.payload ?? {} });
+      return "ok";
+    },
+    unsubscribe: async () => "ok"
+  };
+  return channel;
+}
+function createHostDbClient(via = "socket") {
+  const client2 = createClient("https://host-db.invalid", "host-device", {
+    auth: { persistSession: false, autoRefreshToken: false },
+    global: { fetch: via === "socket" ? hostDbFetch : dbFetch(requestViaLocalHost) }
+  });
+  return new Proxy(client2, {
+    get(target, prop) {
+      if (prop === "channel") return relayChannel;
+      if (prop === "removeChannel") return async () => "ok";
+      const value = Reflect.get(target, prop, target);
+      return typeof value === "function" ? value.bind(target) : value;
+    }
+  });
+}
+
+// src/commands/supabase-via-host.ts
+function useHostDbWithoutCredentials() {
+  const viaHost = !hasSupabaseCredentials() && !!loadCredentials();
+  if (viaHost) setSupabaseClient(createHostDbClient("local-host"));
+  return viaHost;
+}
+
 // src/commands/start.ts
 async function runStart() {
   loadEnvFiles();
-  await preflight();
+  const viaHost = useHostDbWithoutCredentials();
+  await preflight({ supabaseViaHost: viaHost });
   await startServer();
 }
 
 // src/commands/config.ts
-import { existsSync, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
+import { existsSync as existsSync2, readFileSync as readFileSync4, writeFileSync as writeFileSync4 } from "fs";
 import { spawn } from "child_process";
 import { resolve } from "path";
 function maskToken(value) {
@@ -333,12 +733,12 @@ function printConfig() {
   console.log("\n  Paths:");
   console.log(`    Config dir:   ${paths.CONFIG_DIR}`);
   console.log(`    Data dir:     ${paths.DATA_DIR}`);
-  console.log(`    Config file:  ${paths.CONFIG_FILE} ${existsSync(paths.CONFIG_FILE) ? "(exists)" : "(not found)"}`);
-  console.log(`    Prompt file:  ${paths.PROMPT_FILE} ${existsSync(paths.PROMPT_FILE) ? "(exists)" : "(not found)"}`);
-  console.log(`    Database:     ${paths.DB_FILE} ${existsSync(paths.DB_FILE) ? "(exists)" : "(not found)"}`);
+  console.log(`    Config file:  ${paths.CONFIG_FILE} ${existsSync2(paths.CONFIG_FILE) ? "(exists)" : "(not found)"}`);
+  console.log(`    Prompt file:  ${paths.PROMPT_FILE} ${existsSync2(paths.PROMPT_FILE) ? "(exists)" : "(not found)"}`);
+  console.log(`    Database:     ${paths.DB_FILE} ${existsSync2(paths.DB_FILE) ? "(exists)" : "(not found)"}`);
   console.log(`    Log dir:      ${paths.LOG_DIR}`);
   const repoEnv = resolve(process.cwd(), ".env");
-  console.log(`    Repo .env:    ${repoEnv} ${existsSync(repoEnv) ? "(exists)" : "(not found)"}`);
+  console.log(`    Repo .env:    ${repoEnv} ${existsSync2(repoEnv) ? "(exists)" : "(not found)"}`);
   const envKeys = [
     "SLACK_BOT_TOKEN",
     "SLACK_APP_TOKEN",
@@ -362,13 +762,13 @@ function printConfig() {
 }
 function editConfig() {
   ensureDirs();
-  if (!existsSync(paths.CONFIG_FILE)) {
+  if (!existsSync2(paths.CONFIG_FILE)) {
     const defaultEnv = resolve(paths.PACKAGE_ROOT, ".env.example");
-    if (existsSync(defaultEnv)) {
-      const content = readFileSync2(defaultEnv, "utf-8");
-      writeFileSync2(paths.CONFIG_FILE, content);
+    if (existsSync2(defaultEnv)) {
+      const content = readFileSync4(defaultEnv, "utf-8");
+      writeFileSync4(paths.CONFIG_FILE, content);
     } else {
-      writeFileSync2(paths.CONFIG_FILE, "");
+      writeFileSync4(paths.CONFIG_FILE, "");
     }
     console.log(`[flyspace] Created ${paths.CONFIG_FILE}`);
   }
@@ -402,14 +802,14 @@ async function runConfig(args) {
 
 // src/commands/setup.ts
 import { execSync as execSync4 } from "child_process";
-import { mkdirSync as mkdirSync5 } from "fs";
-import { join as join7 } from "path";
+import { mkdirSync as mkdirSync6 } from "fs";
+import { join as join8 } from "path";
 import { confirm as confirm2 } from "@inquirer/prompts";
 
 // src/service.ts
 import { execSync } from "child_process";
-import { existsSync as existsSync2, readFileSync as readFileSync3, realpathSync } from "fs";
-import { basename, dirname as dirname2, join as join2 } from "path";
+import { existsSync as existsSync3, readFileSync as readFileSync5, realpathSync } from "fs";
+import { basename, dirname as dirname3, join as join4 } from "path";
 import { homedir, platform } from "os";
 function flyspaceHome(entry = process.argv[1]) {
   let cliPath;
@@ -422,8 +822,8 @@ function flyspaceHome(entry = process.argv[1]) {
   if (at <= 0) return void 0;
   const npmPrefix = cliPath.slice(0, at);
   if (basename(npmPrefix) !== "cli") return void 0;
-  const home = dirname2(npmPrefix);
-  return existsSync2(join2(home, "bin", "flyspace")) && existsSync2(join2(home, "node", "bin", "node")) ? home : void 0;
+  const home = dirname3(npmPrefix);
+  return existsSync3(join4(home, "bin", "flyspace")) && existsSync3(join4(home, "node", "bin", "node")) ? home : void 0;
 }
 function serviceLabel(profile) {
   return profile === DEFAULT_PROFILE ? "ai.flyspace" : `ai.flyspace.${profile}`;
@@ -432,40 +832,40 @@ function plistName(profile) {
   return `${serviceLabel(profile)}.plist`;
 }
 function plistPath(profile) {
-  return join2(homedir(), "Library", "LaunchAgents", plistName(profile));
+  return join4(homedir(), "Library", "LaunchAgents", plistName(profile));
 }
 function legacyServiceLabel(profile) {
   return profile === DEFAULT_PROFILE ? "io.flycoder.flyspace" : `io.flycoder.flyspace.${profile}`;
 }
 function legacyPlistPath(profile) {
-  return join2(homedir(), "Library", "LaunchAgents", `${legacyServiceLabel(profile)}.plist`);
+  return join4(homedir(), "Library", "LaunchAgents", `${legacyServiceLabel(profile)}.plist`);
 }
 function systemdUnitName(profile) {
   return profile === DEFAULT_PROFILE ? "flyspace" : `flyspace-${profile}`;
 }
 function systemdUnitPath(profile) {
-  return join2(homedir(), ".config", "systemd", "user", `${systemdUnitName(profile)}.service`);
+  return join4(homedir(), ".config", "systemd", "user", `${systemdUnitName(profile)}.service`);
 }
 function isServiceInstalled(profile) {
-  if (platform() === "darwin") return existsSync2(plistPath(profile));
-  if (platform() === "linux") return existsSync2(systemdUnitPath(profile));
+  if (platform() === "darwin") return existsSync3(plistPath(profile));
+  if (platform() === "linux") return existsSync3(systemdUnitPath(profile));
   return false;
 }
 function serviceBinaryMissing(file) {
   let text;
   try {
-    text = readFileSync3(file, "utf-8");
+    text = readFileSync5(file, "utf-8");
   } catch {
     return false;
   }
   const bin = text.match(/<key>ProgramArguments<\/key>\s*<array>\s*<string>([^<]+)<\/string>/)?.[1] ?? text.match(/^ExecStart=(\S+)/m)?.[1];
-  return !!bin && !existsSync2(bin);
+  return !!bin && !existsSync3(bin);
 }
 function profileServiceFile(profile) {
   return platform() === "darwin" ? plistPath(profile) : systemdUnitPath(profile);
 }
 function hostServiceFile() {
-  return platform() === "darwin" ? hostPlistPath() : join2(homedir(), ".config", "systemd", "user", `${HOST_SYSTEMD_UNIT}.service`);
+  return platform() === "darwin" ? hostPlistPath() : join4(homedir(), ".config", "systemd", "user", `${HOST_SYSTEMD_UNIT}.service`);
 }
 function restartService(profile) {
   const os = platform();
@@ -495,10 +895,10 @@ function restartService(profile) {
 var HOST_SERVICE_LABEL = "ai.flyspace.dashboard";
 var HOST_SYSTEMD_UNIT = "flyspace-host";
 function hostPlistPath() {
-  return join2(homedir(), "Library", "LaunchAgents", `${HOST_SERVICE_LABEL}.plist`);
+  return join4(homedir(), "Library", "LaunchAgents", `${HOST_SERVICE_LABEL}.plist`);
 }
 function isHostServiceInstalled() {
-  if (platform() === "darwin" || platform() === "linux") return existsSync2(hostServiceFile());
+  if (platform() === "darwin" || platform() === "linux") return existsSync3(hostServiceFile());
   return false;
 }
 function restartHostService() {
@@ -538,9 +938,9 @@ function isHostServiceRunning() {
 }
 
 // src/commands/install.ts
-import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync4, writeFileSync as writeFileSync3, unlinkSync } from "fs";
+import { existsSync as existsSync4, mkdirSync as mkdirSync4, readFileSync as readFileSync6, writeFileSync as writeFileSync5, unlinkSync } from "fs";
 import { execSync as execSync2 } from "child_process";
-import { dirname as dirname3, join as join3, resolve as resolve2 } from "path";
+import { dirname as dirname4, join as join5, resolve as resolve2 } from "path";
 import { homedir as homedir2, platform as platform2 } from "os";
 function log(msg) {
   console.log(`
@@ -561,23 +961,23 @@ function run(cmd, opts = {}) {
 function detectClaudeBinDir() {
   try {
     const claudePath = execSync2("which claude", { encoding: "utf-8", stdio: "pipe" }).trim();
-    return claudePath ? dirname3(claudePath) : void 0;
+    return claudePath ? dirname4(claudePath) : void 0;
   } catch {
     return void 0;
   }
 }
 function detectNodeBinDir() {
   const home = flyspaceHome();
-  return home ? join3(home, "node", "bin") : dirname3(process.execPath);
+  return home ? join5(home, "node", "bin") : dirname4(process.execPath);
 }
 function nodeShimDirs() {
-  return [join3(homedir2(), ".local", "share", "mise", "shims"), join3(homedir2(), ".asdf", "shims")].filter(
-    (d) => existsSync3(d)
+  return [join5(homedir2(), ".local", "share", "mise", "shims"), join5(homedir2(), ".asdf", "shims")].filter(
+    (d) => existsSync4(d)
   );
 }
 function detectCustieBin() {
   const home = flyspaceHome();
-  if (home) return join3(home, "bin", "flyspace");
+  if (home) return join5(home, "bin", "flyspace");
   const argv1 = process.argv[1];
   if (argv1) {
     return resolve2(argv1);
@@ -589,9 +989,9 @@ function detectCustieBin() {
   }
 }
 function readEnvFile() {
-  if (!existsSync3(paths.CONFIG_FILE)) return {};
+  if (!existsSync4(paths.CONFIG_FILE)) return {};
   const vars = {};
-  for (const line of readFileSync4(paths.CONFIG_FILE, "utf-8").split("\n")) {
+  for (const line of readFileSync6(paths.CONFIG_FILE, "utf-8").split("\n")) {
     const trimmed = line.trim();
     if (!trimmed || trimmed.startsWith("#")) continue;
     const eq = trimmed.indexOf("=");
@@ -635,9 +1035,9 @@ async function installMacOS(spec) {
   const custieBin = detectCustieBin();
   const claudeBinDir = detectClaudeBinDir();
   const logDir = paths.LOG_DIR;
-  mkdirSync2(logDir, { recursive: true });
+  mkdirSync4(logDir, { recursive: true });
   const envVars = spec.env;
-  const homebrewBin = existsSync3("/opt/homebrew/bin") ? "/opt/homebrew/bin" : void 0;
+  const homebrewBin = existsSync4("/opt/homebrew/bin") ? "/opt/homebrew/bin" : void 0;
   const pathParts = [
     detectNodeBinDir(),
     claudeBinDir,
@@ -676,14 +1076,14 @@ ${Object.entries(envVars).map(([k, v]) => `    <key>${k}</key>
   <true/>
 
   <key>StandardOutPath</key>
-  <string>${join3(logDir, `${spec.logName}.log`)}</string>
+  <string>${join5(logDir, `${spec.logName}.log`)}</string>
 
   <key>StandardErrorPath</key>
-  <string>${join3(logDir, `${spec.logName}-error.log`)}</string>
+  <string>${join5(logDir, `${spec.logName}-error.log`)}</string>
 </dict>
 </plist>`;
   const agentPlistPath = spec.plistPath;
-  mkdirSync2(dirname3(agentPlistPath), { recursive: true });
+  mkdirSync4(dirname4(agentPlistPath), { recursive: true });
   try {
     run(`launchctl unload "${agentPlistPath}"`, { silent: true });
   } catch {
@@ -692,7 +1092,7 @@ ${Object.entries(envVars).map(([k, v]) => `    <key>${k}</key>
     unlinkSync(agentPlistPath);
   } catch {
   }
-  writeFileSync3(agentPlistPath, plist);
+  writeFileSync5(agentPlistPath, plist);
   run(`launchctl load "${agentPlistPath}"`, { silent: true });
   success(`LaunchAgent installed and loaded (${spec.label}).`);
   console.log(`  Logs: ${logDir}`);
@@ -703,9 +1103,9 @@ async function installLinux(spec) {
   const custieBin = detectCustieBin();
   const claudeBinDir = detectClaudeBinDir();
   const logDir = paths.LOG_DIR;
-  mkdirSync2(logDir, { recursive: true });
+  mkdirSync4(logDir, { recursive: true });
   const envLines = Object.entries(spec.env).map(([k, v]) => `Environment="${k}=${v}"`).join("\n");
-  const linuxbrewBin = existsSync3("/home/linuxbrew/.linuxbrew/bin") ? "/home/linuxbrew/.linuxbrew/bin" : void 0;
+  const linuxbrewBin = existsSync4("/home/linuxbrew/.linuxbrew/bin") ? "/home/linuxbrew/.linuxbrew/bin" : void 0;
   const pathParts = [
     detectNodeBinDir(),
     claudeBinDir,
@@ -729,16 +1129,16 @@ RestartSec=5
 ${envLines}
 Environment="PATH=${pathParts.join(":")}"
 
-StandardOutput=append:${join3(logDir, `${spec.logName}.log`)}
-StandardError=append:${join3(logDir, `${spec.logName}-error.log`)}
+StandardOutput=append:${join5(logDir, `${spec.logName}.log`)}
+StandardError=append:${join5(logDir, `${spec.logName}-error.log`)}
 
 [Install]
 WantedBy=default.target
 `;
   const unitName = spec.unitName;
-  const unitDir = join3(homedir2(), ".config", "systemd", "user");
-  mkdirSync2(unitDir, { recursive: true });
-  writeFileSync3(join3(unitDir, `${unitName}.service`), unit);
+  const unitDir = join5(homedir2(), ".config", "systemd", "user");
+  mkdirSync4(unitDir, { recursive: true });
+  writeFileSync5(join5(unitDir, `${unitName}.service`), unit);
   run("systemctl --user daemon-reload", { silent: true });
   run(`systemctl --user enable --now ${unitName}`, { silent: true });
   success(`systemd user service installed and started (${unitName}).`);
@@ -765,16 +1165,16 @@ async function installHostService() {
 }
 
 // src/commands/profiles.ts
-import { existsSync as existsSync4, readdirSync, statSync } from "fs";
+import { existsSync as existsSync5, readdirSync, statSync } from "fs";
 import { execSync as execSync3 } from "child_process";
-import { join as join4 } from "path";
+import { join as join6 } from "path";
 import { platform as platform3 } from "os";
 function listProfiles() {
   const profiles = [];
-  if (existsSync4(paths.PROFILES_DIR)) {
+  if (existsSync5(paths.PROFILES_DIR)) {
     for (const entry of readdirSync(paths.PROFILES_DIR)) {
       try {
-        if (statSync(join4(paths.PROFILES_DIR, entry)).isDirectory()) {
+        if (statSync(join6(paths.PROFILES_DIR, entry)).isDirectory()) {
           profiles.push(entry);
         }
       } catch {
@@ -798,227 +1198,50 @@ function isServiceRunning2(profile) {
   return false;
 }
 
-// src/auth/device-auth.ts
-import { createPrivateKey, createPublicKey, generateKeyPairSync, sign } from "crypto";
-import { existsSync as existsSync5, mkdirSync as mkdirSync3, readFileSync as readFileSync5, rmSync as rmSync2, writeFileSync as writeFileSync4 } from "fs";
-import { dirname as dirname4, join as join5 } from "path";
-var DEFAULT_API_URL = "https://app.flyspace.ai";
-var EXPIRY_SKEW_MS = 6e4;
-var AuthApiError = class extends Error {
-  constructor(message, status) {
-    super(message);
-    this.status = status;
-    this.name = "AuthApiError";
-  }
-};
-function apiUrl() {
-  return (process.env["FLYSPACE_API_URL"] || DEFAULT_API_URL).replace(/\/+$/, "");
-}
-function deviceKeyPath() {
-  return join5(paths.BASE_CONFIG_DIR, "device.key");
-}
-function credentialsPath() {
-  return join5(paths.BASE_CONFIG_DIR, "credentials.json");
-}
-function ensureDeviceKey(path = deviceKeyPath()) {
-  let created = false;
-  if (!existsSync5(path)) {
-    const { privateKey: privateKey2 } = generateKeyPairSync("ed25519");
-    mkdirSync3(dirname4(path), { recursive: true });
-    writeFileSync4(path, privateKey2.export({ type: "pkcs8", format: "pem" }), { mode: 384 });
-    created = true;
-  }
-  const privateKey = createPrivateKey(readFileSync5(path, "utf8"));
-  const publicKeyBase64 = createPublicKey(privateKey).export({ type: "spki", format: "der" }).toString(
-    "base64"
-  );
-  return { privateKey, publicKeyBase64, created };
-}
-function loadCredentials(path = credentialsPath()) {
-  if (!existsSync5(path)) return null;
-  try {
-    return JSON.parse(readFileSync5(path, "utf8"));
-  } catch {
-    return null;
-  }
-}
-function saveCredentials(creds, path = credentialsPath()) {
-  mkdirSync3(dirname4(path), { recursive: true });
-  writeFileSync4(path, `${JSON.stringify(creds, null, 2)}
-`, { mode: 384 });
-}
-function clearLocalAuth() {
-  rmSync2(credentialsPath(), { force: true });
-  rmSync2(deviceKeyPath(), { force: true });
-}
-async function post(base, path, body, token) {
-  return fetch(`${base}${path}`, {
-    method: "POST",
-    headers: {
-      "content-type": "application/json",
-      ...token ? { authorization: `Bearer ${token}` } : {}
-    },
-    body: JSON.stringify(body)
-  });
-}
-async function readJson(res) {
-  try {
-    return await res.json();
-  } catch {
-    return {};
-  }
-}
-async function expectOk(res, what) {
-  const json = await readJson(res);
-  if (!res.ok) {
-    const reason = typeof json["error"] === "string" ? json["error"] : res.statusText;
-    throw new AuthApiError(`${what} failed (${res.status}): ${reason}`, res.status);
-  }
-  return json;
-}
-function toSlugs(value) {
-  return Array.isArray(value) ? value.filter((v) => typeof v === "string") : [];
-}
-function toGrant(json) {
-  const user = json["user"] ?? {};
-  return {
-    accessToken: String(json["access_token"]),
-    expiresIn: Number(json["expires_in"]),
-    deviceId: String(json["device_id"]),
-    userEmail: String(user["email"] ?? ""),
-    workspaces: toSlugs(json["workspaces"])
-  };
-}
-async function requestDeviceCode(base, input2) {
-  const res = await post(base, "/api/auth/device/code", {
-    public_key: input2.publicKey,
-    name: input2.name,
-    platform: input2.platform
-  });
-  const json = await expectOk(res, "Requesting a device code");
-  return {
-    deviceCode: String(json["device_code"]),
-    userCode: String(json["user_code"]),
-    verificationUri: String(json["verification_uri"]),
-    expiresIn: Number(json["expires_in"]),
-    interval: Number(json["interval"] ?? 5)
-  };
-}
-async function pollDeviceToken(base, deviceCode) {
-  const res = await post(base, "/api/auth/device/token", { device_code: deviceCode });
-  const json = await readJson(res);
-  if (res.ok) return { status: "approved", grant: toGrant(json) };
-  switch (json["error"]) {
-    case "authorization_pending":
-      return { status: "pending" };
-    case "slow_down":
-      return { status: "slow_down" };
-    case "access_denied":
-      return { status: "denied" };
-    case "expired_token":
-      return { status: "expired" };
-    default:
-      throw new AuthApiError(`Polling for approval failed (${res.status}): ${String(json["error"] ?? res.statusText)}`, res.status);
-  }
-}
-async function refreshAccessToken(creds, privateKey) {
-  const challenge = await expectOk(
-    await post(creds.apiUrl, "/api/auth/device/challenge", { device_id: creds.deviceId }),
-    "Requesting a refresh challenge"
-  );
-  const nonce = String(challenge["nonce"]);
-  const signature = sign(null, Buffer.from(nonce), privateKey).toString("base64");
-  const json = await expectOk(
-    await post(creds.apiUrl, "/api/auth/device/refresh", { device_id: creds.deviceId, nonce, signature }),
-    "Refreshing the access token"
-  );
-  return {
-    ...creds,
-    accessToken: String(json["access_token"]),
-    accessTokenExpiresAt: Date.now() + Number(json["expires_in"]) * 1e3
-  };
-}
-async function fetchWhoAmI(base, token) {
-  const res = await fetch(`${base}/api/auth/device/me`, { headers: { authorization: `Bearer ${token}` } });
-  const json = await expectOk(res, "Checking the session");
-  const user = json["user"] ?? {};
-  const device = json["device"] ?? {};
-  return {
-    userEmail: String(user["email"] ?? ""),
-    deviceId: String(device["id"] ?? ""),
-    deviceName: String(device["name"] ?? ""),
-    workspaces: toSlugs(json["workspaces"])
-  };
-}
-async function boundWorkspaces() {
-  const creds = loadCredentials();
-  if (!creds) return null;
-  try {
-    const me = await fetchWhoAmI(creds.apiUrl, await getAccessToken());
-    saveCredentials({ ...loadCredentials() ?? creds, workspaces: me.workspaces });
-    return { workspaces: me.workspaces, fresh: true };
-  } catch {
-    return { workspaces: creds.workspaces ?? [], fresh: false };
-  }
-}
-async function revokeDevice(base, token) {
-  await expectOk(await post(base, "/api/auth/device/revoke", {}, token), "Revoking this device");
-}
-async function getAccessToken() {
-  const fromEnv = process.env["FLYSPACE_TOKEN"];
-  if (fromEnv) return fromEnv;
-  const creds = loadCredentials();
-  if (!creds) return null;
-  if (creds.accessTokenExpiresAt - EXPIRY_SKEW_MS > Date.now()) return creds.accessToken;
-  const { privateKey } = ensureDeviceKey();
-  const refreshed = await refreshAccessToken(creds, privateKey);
-  saveCredentials(refreshed);
-  return refreshed.accessToken;
-}
-
 // src/dashboard/onboarding-scan.ts
-import { execFileSync } from "child_process";
+import { execFileSync as execFileSync2 } from "child_process";
 import {
+  cpSync,
   existsSync as existsSync6,
   lstatSync,
-  mkdirSync as mkdirSync4,
+  mkdirSync as mkdirSync5,
   readdirSync as readdirSync2,
-  readFileSync as readFileSync6,
+  readFileSync as readFileSync7,
   statSync as statSync2,
   symlinkSync
 } from "fs";
 import { homedir as homedir3 } from "os";
-import { basename as basename2, join as join6, resolve as resolve3 } from "path";
+import { basename as basename2, join as join7, resolve as resolve3 } from "path";
 var MAX_JSONL_HEAD_BYTES = 64 * 1024;
 var GIT_SCAN_ROOTS = ["Workspaces", "Projects", "code"];
 function flyspaceRoot() {
-  return process.env["FLYSPACE_ROOT"] || join6(homedir3(), "Flyspace");
+  return process.env["FLYSPACE_ROOT"] || join7(homedir3(), "Flyspace");
 }
 function onPath(cmd) {
   try {
-    execFileSync(process.platform === "win32" ? "where" : "which", [cmd], { stdio: "ignore" });
+    execFileSync2(process.platform === "win32" ? "where" : "which", [cmd], { stdio: "ignore" });
     return true;
   } catch {
     return false;
   }
 }
 function claudeDir() {
-  return process.env["CLAUDE_CONFIG_DIR"] || join6(homedir3(), ".claude");
+  return process.env["CLAUDE_CONFIG_DIR"] || join7(homedir3(), ".claude");
 }
 function codexDir() {
-  return process.env["CODEX_HOME"] || join6(homedir3(), ".codex");
+  return process.env["CODEX_HOME"] || join7(homedir3(), ".codex");
 }
 function claudeLoggedIn() {
   if (process.env["ANTHROPIC_API_KEY"]) return true;
-  if (existsSync6(join6(claudeDir(), ".credentials.json"))) return true;
+  if (existsSync6(join7(claudeDir(), ".credentials.json"))) return true;
   try {
-    const raw = JSON.parse(readFileSync6(join6(homedir3(), ".claude.json"), "utf-8"));
+    const raw = JSON.parse(readFileSync7(join7(homedir3(), ".claude.json"), "utf-8"));
     if (raw.oauthAccount) return true;
   } catch {
   }
   if (process.platform !== "darwin") return false;
   try {
-    execFileSync("security", ["find-generic-password", "-s", "Claude Code-credentials"], {
+    execFileSync2("security", ["find-generic-password", "-s", "Claude Code-credentials"], {
       stdio: "ignore"
     });
     return true;
@@ -1027,7 +1250,7 @@ function claudeLoggedIn() {
   }
 }
 function codexLoggedIn() {
-  return !!process.env["OPENAI_API_KEY"] || existsSync6(join6(codexDir(), "auth.json"));
+  return !!process.env["OPENAI_API_KEY"] || existsSync6(join7(codexDir(), "auth.json"));
 }
 function jsonlFiles(dir, depth) {
   const out = [];
@@ -1038,7 +1261,7 @@ function jsonlFiles(dir, depth) {
     return out;
   }
   for (const e of entries2) {
-    const full = join6(dir, e.name);
+    const full = join7(dir, e.name);
     if (e.isDirectory()) {
       if (depth > 0) out.push(...jsonlFiles(full, depth - 1));
     } else if (e.name.endsWith(".jsonl")) {
@@ -1053,7 +1276,7 @@ function jsonlFiles(dir, depth) {
 function cwdFromTranscript(file) {
   let head;
   try {
-    head = readFileSync6(file, { encoding: "utf-8", flag: "r" }).slice(0, MAX_JSONL_HEAD_BYTES);
+    head = readFileSync7(file, { encoding: "utf-8", flag: "r" }).slice(0, MAX_JSONL_HEAD_BYTES);
   } catch {
     return null;
   }
@@ -1070,7 +1293,7 @@ function cwdFromTranscript(file) {
 }
 function codexTrustedPaths() {
   try {
-    const toml = readFileSync6(join6(codexDir(), "config.toml"), "utf-8");
+    const toml = readFileSync7(join7(codexDir(), "config.toml"), "utf-8");
     return [...toml.matchAll(/^\[projects\.(?:"([^"]+)"|'([^']+)')\]/gm)].map((m) => m[1] ?? m[2]);
   } catch {
     return [];
@@ -1093,7 +1316,7 @@ function gitRepos() {
   const home = homedir3();
   const found = [];
   for (const rootName of GIT_SCAN_ROOTS) {
-    const root = join6(home, rootName);
+    const root = join7(home, rootName);
     let entries2;
     try {
       entries2 = readdirSync2(root, { withFileTypes: true });
@@ -1101,7 +1324,7 @@ function gitRepos() {
       continue;
     }
     for (const e of entries2) {
-      if (e.isDirectory() && existsSync6(join6(root, e.name, ".git"))) found.push(join6(root, e.name));
+      if (e.isDirectory() && existsSync6(join7(root, e.name, ".git"))) found.push(join7(root, e.name));
     }
   }
   return found;
@@ -1145,11 +1368,11 @@ function scanOnboarding() {
       });
     }
   };
-  const claudeProjects = join6(claudeDir(), "projects");
+  const claudeProjects = join7(claudeDir(), "projects");
   try {
     for (const e of readdirSync2(claudeProjects, { withFileTypes: true })) {
       if (!e.isDirectory()) continue;
-      const files = jsonlFiles(join6(claudeProjects, e.name), 0);
+      const files = jsonlFiles(join7(claudeProjects, e.name), 0);
       if (!files.length) continue;
       history.claude = true;
       files.sort((a, b) => b.mtime - a.mtime);
@@ -1162,7 +1385,7 @@ function scanOnboarding() {
     }
   } catch {
   }
-  const codexSessions = jsonlFiles(join6(codexDir(), "sessions"), 4);
+  const codexSessions = jsonlFiles(join7(codexDir(), "sessions"), 4);
   if (codexSessions.length) history.codex = true;
   const perCwd = /* @__PURE__ */ new Map();
   for (const f of codexSessions) {
@@ -1199,17 +1422,18 @@ function scanOnboarding() {
     fromGitScan
   };
 }
+var GENERAL_TEMPLATE_DIR = join7(paths.PACKAGE_ROOT, "templates", "general");
 function makeLink(target, linkPath) {
   symlinkSync(target, linkPath, process.platform === "win32" ? "junction" : "dir");
 }
 function linkProjectFolders(slug, items) {
   if (!/^[a-z0-9][a-z0-9-]*$/.test(slug)) throw new Error(`invalid workspace slug: ${slug}`);
-  const dir = join6(flyspaceRoot(), slug);
-  mkdirSync4(dir, { recursive: true });
+  const dir = join7(flyspaceRoot(), slug);
+  mkdirSync5(dir, { recursive: true });
   const results = [];
   for (const item of items) {
     if (!/^[a-z0-9][a-z0-9-]*$/.test(item.name)) throw new Error(`invalid channel name: ${item.name}`);
-    const dest = join6(dir, item.name);
+    const dest = join7(dir, item.name);
     let exists = true;
     try {
       lstatSync(dest);
@@ -1222,7 +1446,8 @@ function linkProjectFolders(slug, items) {
         if (!statSync2(target).isDirectory()) throw new Error(`not a directory: ${target}`);
         makeLink(target, dest);
       } else {
-        mkdirSync4(dest, { recursive: true });
+        mkdirSync5(dest, { recursive: true });
+        if (item.name === "general") cpSync(GENERAL_TEMPLATE_DIR, dest, { recursive: true });
       }
     }
     results.push({ name: item.name, cwd: `${slug}/${item.name}` });
@@ -1540,7 +1765,7 @@ async function runAuthCmd(args) {
 }
 
 // src/version.ts
-var CLI_VERSION = true ? "0.1.13" : null;
+var CLI_VERSION = true ? "0.1.15" : null;
 function isOlderVersion(a, b) {
   const parse2 = (v) => v.replace(/^v/, "").split("-")[0].split(".").map(Number);
   const [pa, pb] = [parse2(a), parse2(b)];
@@ -1654,8 +1879,8 @@ ${BOLD2}Flyspace Setup${RESET2}
   const anyReady = runners.some((r) => r.installed && r.loggedIn);
   for (const slug of workspaces) {
     if (!/^[a-z0-9][a-z0-9-]*$/.test(slug)) continue;
-    const dir = join7(flyspaceRoot(), slug);
-    mkdirSync5(dir, { recursive: true });
+    const dir = join8(flyspaceRoot(), slug);
+    mkdirSync6(dir, { recursive: true });
     ok(`Folder ${tilde2(dir)}`);
   }
   let hostRunning = false;
@@ -1695,9 +1920,9 @@ import { tmpdir } from "os";
 import { promisify } from "util";
 var execAsync = promisify(execFile);
 var exec = (cmd, args, opts) => {
-  const run3 = execAsync(cmd, args, opts);
-  run3.child.stdin?.end();
-  return run3;
+  const run4 = execAsync(cmd, args, opts);
+  run4.child.stdin?.end();
+  return run4;
 };
 var BOLD3 = "\x1B[1m";
 var DIM3 = "\x1B[2m";
@@ -1818,10 +2043,10 @@ ${BOLD3}Flyspace Doctor${RESET3}
 }
 
 // src/commands/uninstall.ts
-import { existsSync as existsSync7, readFileSync as readFileSync7, rmSync as rmSync3, unlinkSync as unlinkSync2, writeFileSync as writeFileSync5 } from "fs";
+import { existsSync as existsSync7, readFileSync as readFileSync8, rmSync as rmSync4, unlinkSync as unlinkSync2, writeFileSync as writeFileSync6 } from "fs";
 import { confirm as confirm3 } from "@inquirer/prompts";
 import { execSync as execSync5 } from "child_process";
-import { basename as basename3, join as join8 } from "path";
+import { basename as basename3, join as join9 } from "path";
 import { homedir as homedir4, platform as platform5 } from "os";
 function log2(msg) {
   console.log(`
@@ -1864,7 +2089,7 @@ async function runServiceUninstall(profile = getProfile()) {
       run2(`systemctl --user disable --now ${unitName}`);
     } catch {
     }
-    const unitPath = join8(homedir4(), ".config", "systemd", "user", `${unitName}.service`);
+    const unitPath = join9(homedir4(), ".config", "systemd", "user", `${unitName}.service`);
     try {
       unlinkSync2(unitPath);
     } catch {
@@ -1879,7 +2104,7 @@ async function runServiceUninstall(profile = getProfile()) {
   }
 }
 async function runUninstall(args = []) {
-  const prefix = process.env["FLYSPACE_PREFIX"] || join8(homedir4(), ".flyspace");
+  const prefix = process.env["FLYSPACE_PREFIX"] || join9(homedir4(), ".flyspace");
   const targets = [paths.BASE_CONFIG_DIR, paths.BASE_DATA_DIR, prefix].filter(existsSync7);
   console.log("\n  This removes Flyspace from this machine:");
   console.log("    - revokes this device and removes every background service");
@@ -1905,15 +2130,15 @@ async function runUninstall(args = []) {
     await runServiceUninstall(profile);
   }
   for (const t of targets) {
-    rmSync3(t, { recursive: true, force: true });
+    rmSync4(t, { recursive: true, force: true });
     success2(`Deleted ${t}`);
   }
-  for (const rc of [".zshrc", ".bashrc", ".profile"].map((f) => join8(homedir4(), f))) {
+  for (const rc of [".zshrc", ".bashrc", ".profile"].map((f) => join9(homedir4(), f))) {
     if (!existsSync7(rc)) continue;
-    const before = readFileSync7(rc, "utf-8");
+    const before = readFileSync8(rc, "utf-8");
     const after = before.replace(/\n# Flyspace CLI\nexport PATH="[^"\n]*\.flyspace\/bin:\$PATH"\n?/g, "\n");
     if (after !== before) {
-      writeFileSync5(rc, after);
+      writeFileSync6(rc, after);
       success2(`Removed PATH entry from ${rc}`);
     }
   }
@@ -1921,7 +2146,7 @@ async function runUninstall(args = []) {
 }
 
 // src/commands/profiles-cmd.ts
-import { rmSync as rmSync4 } from "fs";
+import { rmSync as rmSync5 } from "fs";
 var USAGE = `
   Usage: flyspace profiles [list]
          flyspace profiles remove <name>
@@ -1978,7 +2203,7 @@ async function removeCmd(name) {
   }
   const { configDir: configDir2, dataDir } = runWithProfile(name, () => ({ configDir: paths.CONFIG_DIR, dataDir: paths.DATA_DIR }));
   if (isServiceInstalled(name)) await runWithProfile(name, runUninstall);
-  rmSync4(configDir2, { recursive: true, force: true });
+  rmSync5(configDir2, { recursive: true, force: true });
   console.log(`\x1B[32m+\x1B[0m Local config removed: ${configDir2}`);
   console.log(`
   Kept: ${dataDir} (sessions, logs) and any ~/Flyspace/${name}/ channel folders.`);
@@ -1996,7 +2221,7 @@ async function runProfiles(args = []) {
 // src/commands/upgrade.ts
 import { execSync as execSync6 } from "child_process";
 import { realpathSync as realpathSync2 } from "fs";
-import { join as join9 } from "path";
+import { join as join10 } from "path";
 function restartInstalledProfiles() {
   if (isHostServiceInstalled()) {
     console.log(restartHostService() ? "\nHost restarted." : "\nHost restart failed; run: flyspace setup --start-host --restart");
@@ -2029,10 +2254,10 @@ function npmInstallCommand() {
 }
 function npmEnv() {
   const home = flyspaceHome();
-  return home ? { ...process.env, PATH: `${join9(home, "node", "bin")}:${process.env.PATH ?? ""}` } : process.env;
+  return home ? { ...process.env, PATH: `${join10(home, "node", "bin")}:${process.env.PATH ?? ""}` } : process.env;
 }
 async function runUpgrade() {
-  const current = "0.1.13";
+  const current = "0.1.15";
   console.log(`Current version: ${current}`);
   console.log("Checking for updates...\n");
   try {
@@ -2352,6 +2577,7 @@ async function handleImport(manager) {
 async function runAutomationCmd(args) {
   const subcommand = args[0];
   loadEnvFiles();
+  useHostDbWithoutCredentials();
   await refreshChannelRegistry();
   await refreshAutomationRegistry();
   const manager = new AutomationManager();
@@ -2646,11 +2872,11 @@ async function runRestart() {
 // src/commands/logs.ts
 import { spawn as spawn3 } from "child_process";
 import { existsSync as existsSync9 } from "fs";
-import { join as join10 } from "path";
+import { join as join11 } from "path";
 async function runLogs(args) {
   const showErrors = args.includes("--error") || args.includes("-e");
   const filename = showErrors ? "custie-error.log" : "custie.log";
-  const logFile = join10(paths.LOG_DIR, filename);
+  const logFile = join11(paths.LOG_DIR, filename);
   if (!existsSync9(logFile)) {
     console.error(`Log file not found: ${logFile}`);
     console.error("Is the service installed? Run `flyspace install` first.");
@@ -2672,14 +2898,14 @@ async function runLogs(args) {
 
 // src/commands/slack.ts
 import { execFileSync as execFileSync4 } from "child_process";
-import { existsSync as existsSync26, readFileSync as readFileSync18, writeFileSync as writeFileSync11 } from "fs";
+import { existsSync as existsSync26, readFileSync as readFileSync19, writeFileSync as writeFileSync11 } from "fs";
 import { resolve as resolve6 } from "path";
-import { tmpdir as tmpdir4, homedir as homedir9 } from "os";
+import { tmpdir as tmpdir5, homedir as homedir9 } from "os";
 import { input, confirm as confirm4, select, checkbox } from "@inquirer/prompts";
 import { WebClient as WebClient3 } from "@slack/web-api";
 
 // src/store/auth-links.ts
-import { createClient } from "@supabase/supabase-js";
+import { createClient as createClient2 } from "@supabase/supabase-js";
 function toAuthLink(data) {
   const userId = data.user?.id;
   const actionLink = data.properties?.action_link;
@@ -2703,7 +2929,7 @@ async function mintSession(email) {
   if (error2) throw new Error(error2.message);
   const tokenHash = data.properties?.hashed_token;
   if (!tokenHash) throw new Error("Supabase returned no token hash");
-  const scratch = createClient(process.env["SUPABASE_URL"], process.env["SUPABASE_SECRET_KEY"], {
+  const scratch = createClient2(process.env["SUPABASE_URL"], process.env["SUPABASE_SECRET_KEY"], {
     auth: { persistSession: false, autoRefreshToken: false }
   });
   const verified = await scratch.auth.verifyOtp({ token_hash: tokenHash, type: "magiclink" });
@@ -2729,7 +2955,7 @@ async function emailForToken(token, type) {
 
 // src/dashboard/profile-config.ts
 import { homedir as homedir5 } from "os";
-import { join as join11 } from "path";
+import { join as join12 } from "path";
 
 // src/dashboard/profile-config-cache.ts
 var cache = /* @__PURE__ */ new Map();
@@ -2748,7 +2974,7 @@ function profileEnv(key) {
 function profileClaudeConfigDir() {
   const config = cachedProfileConfig();
   if (!config) return process.env["CLAUDE_CONFIG_DIR"] || void 0;
-  return config.env["CLAUDE_CONFIG_DIR"]?.trim() || join11(homedir5(), ".claude");
+  return config.env["CLAUDE_CONFIG_DIR"]?.trim() || join12(homedir5(), ".claude");
 }
 function profileOauthToken() {
   const env = cachedProfileConfig()?.env ?? {};
@@ -2850,7 +3076,7 @@ async function sendEmail(email) {
 }
 
 // src/store/invite-store.ts
-import { createHash, randomBytes } from "crypto";
+import { createHash, randomBytes as randomBytes2 } from "crypto";
 var INVITE_TTL_DAYS = 7;
 var INVITE_MESSAGE_MAX = 500;
 function hashInviteToken(token) {
@@ -2860,7 +3086,7 @@ async function issueInvite(membershipId, message) {
   const db = getSupabaseClient();
   const { error: clearError } = await db.from("workspace_invites").delete().eq("membership_id", membershipId).is("accepted_at", null);
   if (clearError) throw new Error(`issueInvite(${membershipId}): ${clearError.message}`);
-  const token = randomBytes(32).toString("hex");
+  const token = randomBytes2(32).toString("hex");
   const expiresAt = new Date(Date.now() + INVITE_TTL_DAYS * 24 * 60 * 60 * 1e3);
   const { error: error2 } = await db.from("workspace_invites").insert({
     membership_id: membershipId,
@@ -3229,6 +3455,13 @@ function profileFromHost(host, known) {
   const bare = label2.startsWith("api-") ? label2.slice(4) : label2.startsWith("dev-") ? label2.slice(4) : label2;
   return known.includes(bare) ? bare : null;
 }
+function isUnknownWorkspaceHost(host, known) {
+  const name = bareHost(host);
+  if (!name?.endsWith(".flyspace.ai")) return false;
+  const label2 = subdomainLabel(host);
+  if (!label2 || label2 === "dev-admin") return false;
+  return profileFromHost(host, known) === null;
+}
 function workspaceHostname(host, profile) {
   const name = bareHost(host);
   if (!name || !subdomainLabel(host)) return null;
@@ -3300,9 +3533,9 @@ function workspaceOrigin(c, slug) {
 }
 
 // src/store/setup-invite-store.ts
-import { randomBytes as randomBytes2 } from "crypto";
+import { randomBytes as randomBytes3 } from "crypto";
 async function issueSetupInvite(params) {
-  const token = randomBytes2(32).toString("hex");
+  const token = randomBytes3(32).toString("hex");
   const expiresAt = new Date(Date.now() + INVITE_TTL_DAYS * 24 * 60 * 60 * 1e3);
   const { error: error2 } = await getSupabaseClient().from("workspace_setup_invites").insert({
     email: params.email,
@@ -3329,7 +3562,7 @@ async function reissueSetupInvite(id) {
   const { data, error: error2 } = await db.from("workspace_setup_invites").select("email, owner_name, message").eq("id", id).is("accepted_at", null).maybeSingle();
   if (error2) throw new Error(`reissueSetupInvite(${id}): ${error2.message}`);
   if (!data) throw new Error("no pending invite with that id");
-  const token = randomBytes2(32).toString("hex");
+  const token = randomBytes3(32).toString("hex");
   const expiresAt = new Date(Date.now() + INVITE_TTL_DAYS * 24 * 60 * 60 * 1e3);
   const { error: updateError } = await db.from("workspace_setup_invites").update({ token_hash: hashInviteToken(token), expires_at: expiresAt.toISOString() }).eq("id", id);
   if (updateError) throw new Error(`reissueSetupInvite(${id}): ${updateError.message}`);
@@ -3639,7 +3872,9 @@ function getStripeClient() {
 
 // src/store/stripe-trial.ts
 var PLAN_INFO = {
-  local: { name: "Local Agent", priceUsd: 9 },
+  // Single-member: a personal Claude subscription can't be shared (see
+  // members-routes.ts, which blocks invites on this plan).
+  local: { name: "Solo", priceUsd: 29 },
   cloud: { name: "Cloud Agent", priceUsd: 49 }
 };
 function priceIdForPlan(plan) {
@@ -3664,6 +3899,7 @@ async function startWorkspaceTrial(workspace, plan, ownerEmail) {
     metadata: { workspace_id: workspace.id, plan }
   });
   await setWorkspaceStripeSubscription(workspace.id, {
+    plan,
     stripeCustomerId: customer.id,
     stripeSubscriptionId: subscription.id,
     planStatus: "trialing"
@@ -4202,13 +4438,25 @@ async function deliverPasswordResetLink(email, redirectTo) {
 // src/dashboard/server.ts
 import { existsSync as existsSync25 } from "fs";
 import { createServer } from "net";
-import { join as join23 } from "path";
+import { join as join24 } from "path";
 import { Hono as Hono34 } from "hono";
+
+// src/dashboard/sentry.ts
+import * as Sentry from "@sentry/node";
+import { HTTPException } from "hono/http-exception";
+var reportingErrorHandler = (err, c) => {
+  if (err instanceof HTTPException) return err.getResponse();
+  Sentry.captureException(err, { extra: { method: c.req.method, path: c.req.path } });
+  console.error(err);
+  return c.text("Internal Server Error", 500);
+};
+
+// src/dashboard/server.ts
 import { serve } from "@hono/node-server";
 import { serveStatic } from "@hono/node-server/serve-static";
 
 // src/reconcile.ts
-import { existsSync as existsSync10, mkdirSync as mkdirSync6, writeFileSync as writeFileSync6 } from "fs";
+import { existsSync as existsSync10, mkdirSync as mkdirSync7, writeFileSync as writeFileSync7 } from "fs";
 async function boundWorkspaces2() {
   return (await boundWorkspaces())?.workspaces ?? null;
 }
@@ -4225,7 +4473,7 @@ async function reconcileProfile(profile) {
     if (!hadConfigDir) log5.push(`config dir created (${paths.CONFIG_DIR})`);
     if (!hadDataDir) log5.push(`data dir created (${paths.DATA_DIR})`);
     if (!existsSync10(paths.CONFIG_FILE)) {
-      writeFileSync6(paths.CONFIG_FILE, `BOT_NAME=${profile}
+      writeFileSync7(paths.CONFIG_FILE, `BOT_NAME=${profile}
 `);
       log5.push(`config.env written (${paths.CONFIG_FILE})`);
     }
@@ -4234,7 +4482,7 @@ async function reconcileProfile(profile) {
       if (!channel.cwd) continue;
       const cwd = expandPath(channel.cwd);
       if (isCwdUsable(cwd)) continue;
-      mkdirSync6(cwd, { recursive: true });
+      mkdirSync7(cwd, { recursive: true });
       log5.push(`channel "${channel.name}" cwd created (${cwd})`);
     }
     return log5;
@@ -4396,8 +4644,10 @@ async function filterReadableDocsChannels(ctx, channelIds) {
 // src/dashboard/docs-access-gate.ts
 var requireDocsAccess = async (c, next) => {
   const auth = c.get("auth");
+  const channelId = c.req.param("id") ?? "";
+  if (findChannelById(channelId)?.profile !== getProfile()) return c.json({ error: "channel not found" }, 404);
   const need = c.req.method === "GET" ? "read" : "write";
-  const have = auth ? await resolveDocsAccess(auth, c.req.param("id") ?? "") : "none";
+  const have = auth ? await resolveDocsAccess(auth, channelId) : "none";
   if (!docsAccessAtLeast(have, need)) return c.json({ error: "docs access required" }, 403);
   await next();
 };
@@ -4406,8 +4656,8 @@ var requireDocsAccess = async (c, next) => {
 import { Hono as Hono31 } from "hono";
 
 // src/dashboard/public-share-routes.ts
-import { existsSync as existsSync11, readFileSync as readFileSync9, statSync as statSync3 } from "fs";
-import { join as join13 } from "path";
+import { existsSync as existsSync11, readFileSync as readFileSync10, statSync as statSync3 } from "fs";
+import { join as join14 } from "path";
 import { Hono as Hono3 } from "hono";
 import { GetObjectCommand } from "@aws-sdk/client-s3";
 import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
@@ -4547,15 +4797,15 @@ async function createDocShare(input2) {
   if (error2) throw new Error(`createDocShare(${input2.sourcePath}): ${error2.message}`);
   return rowToShare(data);
 }
-async function updateDocShareSnapshot(id, snapshot3, features) {
+async function updateDocShareSnapshot(id, snapshot2, features) {
   const { data, error: error2 } = await getSupabaseClient().from("doc_shares").update({
-    title: snapshot3.title,
-    content: snapshot3.content,
-    asset_keys: snapshot3.assetKeys,
+    title: snapshot2.title,
+    content: snapshot2.content,
+    asset_keys: snapshot2.assetKeys,
     // Re-detected with the snapshot: a re-publish can carry a rewritten
     // article, and one written in another language than last time is exactly
     // the case a stale value would get wrong.
-    source_lang: snapshot3.sourceLang,
+    source_lang: snapshot2.sourceLang,
     audio_enabled: features.audioEnabled,
     ask_enabled: features.askEnabled,
     social_enabled: features.socialEnabled,
@@ -4872,12 +5122,12 @@ function injectShareHead(html, head) {
 
 // src/dashboard/app-icon.ts
 import { createHash as createHash2 } from "crypto";
-import { readFileSync as readFileSync8 } from "fs";
-import { join as join12 } from "path";
+import { readFileSync as readFileSync9 } from "fs";
+import { join as join13 } from "path";
 import sharp from "sharp";
 var PLATE = "#0A0A0F";
-var MARK_FILE = join12(paths.PACKAGE_ROOT, "web", "public", "icons", "icon-512.png");
-var MARK_SVG_FILE = join12(paths.PACKAGE_ROOT, "web", "public", "favicon.svg");
+var MARK_FILE = join13(paths.PACKAGE_ROOT, "web", "public", "icons", "icon-512.png");
+var MARK_SVG_FILE = join13(paths.PACKAGE_ROOT, "web", "public", "favicon.svg");
 var LAYOUT = {
   standard: { logo: 0.7, logoCx: 0.5, logoCy: 0.48, badge: 0.27, badgeCx: 0.22, badgeCy: 0.76 },
   maskable: { logo: 0.56, logoCx: 0.5, logoCy: 0.48, badge: 0.23, badgeCx: 0.33, badgeCy: 0.66 }
@@ -4900,7 +5150,7 @@ function roundedPlate(size, fill = PLATE) {
 }
 async function renderBadge(box) {
   const transparent = { r: 0, g: 0, b: 0, alpha: 0 };
-  const raster = await sharp(readFileSync8(MARK_SVG_FILE)).resize(512, 512, { fit: "contain", background: transparent }).png().toBuffer();
+  const raster = await sharp(readFileSync9(MARK_SVG_FILE)).resize(512, 512, { fit: "contain", background: transparent }).png().toBuffer();
   return sharp(raster).trim().resize(box, box, { fit: "contain", background: transparent }).png().toBuffer();
 }
 async function sampleBackground(logo) {
@@ -4955,7 +5205,7 @@ async function renderAppIcon({
   if (hit) return hit;
   const out = logo && await composeIcon(logo, size, maskable, plain).catch(() => null) || // No workspace logo to lead with — the stock mark is still the best icon,
   // either on its usual dark plate or, for a favicon, trimmed and bare.
-  (transparent ? await renderBadge(size) : await sharp(readFileSync8(MARK_FILE)).resize(size, size, { fit: "cover" }).png().toBuffer());
+  (transparent ? await renderBadge(size) : await sharp(readFileSync9(MARK_FILE)).resize(size, size, { fit: "cover" }).png().toBuffer());
   cache3.set(key, out);
   return out;
 }
@@ -5483,9 +5733,9 @@ async function synthesizeWithRetry(script, voice) {
 }
 var renderQueue = Promise.resolve();
 function queued(job) {
-  const run3 = renderQueue.then(job, job);
-  renderQueue = run3.catch(() => void 0);
-  return run3;
+  const run4 = renderQueue.then(job, job);
+  renderQueue = run4.catch(() => void 0);
+  return run4;
 }
 function renderArticleAudio(title, content, lang) {
   return queued(() => renderArticleAudioNow(title, content, lang));
@@ -5559,12 +5809,12 @@ function queueShareAudio(share) {
   }
   const current = inFlight2.get(share.id);
   if (current?.hash === hash) return current.done;
-  const run3 = () => runShareAudioJob(share, hash).catch((err) => {
+  const run4 = () => runShareAudioJob(share, hash).catch((err) => {
     console.error(`share audio job crashed (${share.id}):`, err);
   }).finally(() => {
     if (inFlight2.get(share.id)?.hash === hash) inFlight2.delete(share.id);
   });
-  const done = current ? current.done.then(run3) : run3();
+  const done = current ? current.done.then(run4) : run4();
   inFlight2.set(share.id, { hash, done });
   return done;
 }
@@ -6173,7 +6423,7 @@ var shellCache = null;
 function readShell(path) {
   const { mtimeMs } = statSync3(path);
   if (shellCache?.mtimeMs === mtimeMs) return shellCache.html;
-  const html = readFileSync9(path, "utf8").replaceAll('"/assets/', `"${BUILD_PREFIX}/`);
+  const html = readFileSync10(path, "utf8").replaceAll('"/assets/', `"${BUILD_PREFIX}/`);
   shellCache = { mtimeMs, html };
   return html;
 }
@@ -6193,17 +6443,17 @@ function serveBuildFile(c, webDist, dir, name) {
   if (!type || !/^[A-Za-z0-9._-]+$/.test(name) || name.includes("..")) {
     return c.text("not found", 404);
   }
-  const path = join13(webDist, dir, name);
+  const path = join14(webDist, dir, name);
   if (!existsSync11(path)) return c.text("not found", 404);
   c.header("Content-Type", type);
   c.header("Cache-Control", "public, max-age=31536000, immutable");
   if (ext === ".css") {
-    return c.body(readFileSync9(path, "utf8").replaceAll("url(/fonts/", `url(${BUILD_PREFIX}/fonts/`));
+    return c.body(readFileSync10(path, "utf8").replaceAll("url(/fonts/", `url(${BUILD_PREFIX}/fonts/`));
   }
   if (ext === ".js") {
-    return c.body(readFileSync9(path, "utf8").replaceAll('"/assets/', `"${BUILD_PREFIX}/`));
+    return c.body(readFileSync10(path, "utf8").replaceAll('"/assets/', `"${BUILD_PREFIX}/`));
   }
-  return c.body(new Uint8Array(readFileSync9(path)));
+  return c.body(new Uint8Array(readFileSync10(path)));
 }
 var HTML_SHARE_CSP = "sandbox allow-scripts allow-forms allow-modals allow-popups allow-popups-to-escape-sandbox";
 function servePublishedHtml(c, share) {
@@ -6339,7 +6589,7 @@ ${analytics}` : head);
     const requested = c.req.param("lang");
     const lang = canonicalLanguage(requested);
     if (!isTranslatableLanguage(lang)) return next();
-    const shell = join13(webDist, "index.html");
+    const shell = join14(webDist, "index.html");
     if (!existsSync11(shell)) return next();
     const share = await getDocShare(c.req.param("id"));
     if (!share) return next();
@@ -6375,7 +6625,7 @@ ${analytics}` : head);
     const share = await getDocShare(c.req.param("id"));
     if (!share) return next();
     if (share.kind === "html") return servePublishedHtml(c, share);
-    const shell = join13(webDist, "index.html");
+    const shell = join14(webDist, "index.html");
     if (!existsSync11(shell)) return next();
     return readerPage(
       c,
@@ -6488,9 +6738,9 @@ function routeCookieWrites(all, label2, writes) {
 }
 
 // src/dashboard/supabase-server-client.ts
-var REQUEST_TIMEOUT_MS = 5e3;
-function fetchWithTimeout(input2, init) {
-  return fetch(input2, { ...init, signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS) });
+var REQUEST_TIMEOUT_MS2 = 5e3;
+function fetchWithTimeout(input2, init2) {
+  return fetch(input2, { ...init2, signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS2) });
 }
 function createRequestSupabaseClient(c) {
   const url = process.env["SUPABASE_URL"];
@@ -6532,7 +6782,7 @@ function createRequestSupabaseClient(c) {
 }
 
 // src/dashboard/auth-context.ts
-import { HTTPException } from "hono/http-exception";
+import { HTTPException as HTTPException2 } from "hono/http-exception";
 import { isAuthApiError, isAuthRetryableFetchError } from "@supabase/supabase-js";
 function onboardingPending(ctx) {
   const pending3 = [];
@@ -6589,10 +6839,10 @@ async function resolveAuthContextUncached(c) {
     } = await getUserWithRetry(supabase));
   } catch (err) {
     if (isAuthRetryableFetchError(err)) {
-      throw new HTTPException(503, { message: "auth service unreachable" });
+      throw new HTTPException2(503, { message: "auth service unreachable" });
     }
     if (isAuthApiError(err) && err.status === 429) {
-      throw new HTTPException(503, { message: "auth service rate limited" });
+      throw new HTTPException2(503, { message: "auth service rate limited" });
     }
     return null;
   }
@@ -6642,13 +6892,13 @@ async function signAvatarUrl(key) {
 
 // src/dashboard/turnstile.ts
 var VERIFY_URL = "https://challenges.cloudflare.com/turnstile/v0/siteverify";
-var REQUEST_TIMEOUT_MS2 = 5e3;
+var REQUEST_TIMEOUT_MS3 = 5e3;
 function siteverify(secret, token) {
   return fetch(VERIFY_URL, {
     method: "POST",
     headers: { "content-type": "application/x-www-form-urlencoded" },
     body: new URLSearchParams({ secret, response: token }),
-    signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS2)
+    signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS3)
   });
 }
 async function verifyTurnstileToken(token) {
@@ -6991,101 +7241,26 @@ async function resolveAgentIdentities() {
     })
   );
 }
-async function offlineAgentIdentities() {
-  const identity = await loadBotIdentity();
-  const dm = findChannelByAgentName(BOT_DM_KEY) ?? await ensureAgentDmChannel(BOT_DM_KEY, {
-    name: identity.displayName ?? BOT_LABEL,
-    cwd: resolveChannelConfig("").cwd
-  });
-  return [{ name: BOT_DM_KEY, label: BOT_LABEL, kind: "main", channelId: dm.id, ...identity }];
-}
-
-// src/dashboard/host-api.ts
-import { existsSync as existsSync20, readFileSync as readFileSync13, statSync as statSync8 } from "fs";
-import { join as join20 } from "path";
-import sharp3 from "sharp";
-
-// src/dashboard/channels-routes.ts
-import { existsSync as existsSync12, mkdirSync as mkdirSync7 } from "fs";
-import { Hono as Hono9 } from "hono";
-
-// src/dashboard/feature-flags-routes.ts
-import { Hono as Hono8 } from "hono";
-
-// src/feature-flags.ts
-var featureFlags = {
-  "ai-cost": {
-    title: "AI cost",
-    description: "Shows admins what the agent has spent: a Cost section in a channel's AI overview and a per-thread cost in the thread menu. Estimated at API list rates, so on a Claude subscription it will not match your bill.",
-    stage: "beta"
-  },
-  "read-aloud": {
-    title: "Read aloud",
-    description: "Listen to messages, threads and docs as audio. Still rough in places, and each playback uses text-to-speech.",
-    stage: "beta"
-  },
-  excalidraw: {
-    title: "Excalidraw",
-    description: "Create and edit whiteboard drawings (.excalidraw files) in the Docs pane. Existing drawings stay viewable with this off.",
-    stage: "beta"
-  },
-  sandbox: {
-    title: "Sandbox runtime",
-    description: "Run a channel agent in an isolated sandbox without Docker. Channels already on Sandbox keep working with this off.",
-    stage: "beta"
-  },
-  dictation: {
-    title: "Dictation",
-    description: "A mic button in the message composer that turns speech into text as you talk. Each phrase uses speech-to-text.",
-    stage: "dev"
-  },
-  "agent-memory": {
-    title: "Agent memory",
-    description: "Channel memory the agent reads every turn, saved by the agent and picked up from idle threads, with a Memory tab and an undo chip. While on, Claude's built-in auto memory is switched off so the two can be compared; turning this off keeps every memory.",
-    stage: "beta"
-  }
-};
-var featureFlagIds = Object.keys(featureFlags);
-function isFeatureFlagId(id) {
-  return Object.hasOwn(featureFlags, id);
-}
-function isFeatureVisible(stage, devHost) {
-  return stage === "beta" || stage === "dev" && devHost;
-}
-function resolveFeatureFlags(enabledIds, devHost) {
-  const enabled = new Set(enabledIds);
-  const out = {};
-  for (const id of featureFlagIds) {
-    const stage = featureFlags[id].stage;
-    out[id] = stage === "ga" || isFeatureVisible(stage, devHost) && enabled.has(id);
-  }
-  return out;
-}
-
-// src/store/feature-flag-store.ts
-async function listEnabledFeatureFlags(workspaceId) {
-  const { data, error: error2 } = await getSupabaseClient().from("feature_flags").select("flag_id").eq("workspace_id", workspaceId);
-  if (error2) throw new Error(`listEnabledFeatureFlags(${workspaceId}): ${error2.message}`);
-  return (data ?? []).map((r) => r.flag_id);
-}
-async function listEnabledFeatureFlagsBySlug(slug) {
-  const { data, error: error2 } = await getSupabaseClient().from("workspaces").select("id").eq("slug", slug).maybeSingle();
-  if (error2) throw new Error(`listEnabledFeatureFlagsBySlug(${slug}): ${error2.message}`);
-  return data ? listEnabledFeatureFlags(data.id) : [];
-}
-async function enableFeatureFlag(workspaceId, flagId, userId) {
-  const { error: error2 } = await getSupabaseClient().from("feature_flags").upsert(
-    { workspace_id: workspaceId, flag_id: flagId, enabled_by: userId },
-    { onConflict: "workspace_id,flag_id" }
-  );
-  if (error2) throw new Error(`enableFeatureFlag(${workspaceId}, ${flagId}): ${error2.message}`);
-}
-async function disableFeatureFlag(workspaceId, flagId) {
-  const { error: error2 } = await getSupabaseClient().from("feature_flags").delete().eq("workspace_id", workspaceId).eq("flag_id", flagId);
-  if (error2) throw new Error(`disableFeatureFlag(${workspaceId}, ${flagId}): ${error2.message}`);
+async function offlineAgentIdentities() {
+  const identity = await loadBotIdentity();
+  const dm = findChannelByAgentName(BOT_DM_KEY) ?? await ensureAgentDmChannel(BOT_DM_KEY, {
+    name: identity.displayName ?? BOT_LABEL,
+    cwd: resolveChannelConfig("").cwd
+  });
+  return [{ name: BOT_DM_KEY, label: BOT_LABEL, kind: "main", channelId: dm.id, ...identity }];
 }
 
+// src/dashboard/host-api.ts
+import { existsSync as existsSync20, readFileSync as readFileSync15, statSync as statSync8 } from "fs";
+import { join as join22 } from "path";
+import sharp3 from "sharp";
+
+// src/dashboard/channels-routes.ts
+import { existsSync as existsSync12, mkdirSync as mkdirSync8 } from "fs";
+import { Hono as Hono9 } from "hono";
+
 // src/dashboard/feature-flags-routes.ts
+import { Hono as Hono8 } from "hono";
 async function isFeatureEnabled(c, flagId) {
   const auth = c.get("auth");
   const enabled = await listEnabledFeatureFlags(auth.workspaceId);
@@ -7154,7 +7329,7 @@ function coerceMemberEmails(raw) {
 }
 function ensureCwdDir(cwd) {
   const expanded = isLogicalCwd(cwd) ? resolveLogicalCwd(cwd) : expandPath(cwd);
-  if (!existsSync12(expanded)) mkdirSync7(expanded, { recursive: true });
+  if (!existsSync12(expanded)) mkdirSync8(expanded, { recursive: true });
 }
 function toResponse(channel) {
   return {
@@ -7305,24 +7480,24 @@ import {
   closeSync,
   existsSync as existsSync16,
   lstatSync as lstatSync2,
-  mkdirSync as mkdirSync8,
+  mkdirSync as mkdirSync9,
   openSync,
   readSync,
   readdirSync as readdirSync4,
-  readFileSync as readFileSync12,
+  readFileSync as readFileSync14,
   realpathSync as realpathSync3,
   renameSync,
-  rmSync as rmSync6,
+  rmSync as rmSync8,
   statSync as statSync5,
-  writeFileSync as writeFileSync8
+  writeFileSync as writeFileSync9
 } from "fs";
-import { basename as basename6, dirname as dirname5, extname, join as join18, relative, resolve as resolve4, sep } from "path";
+import { basename as basename6, dirname as dirname5, extname, join as join20, relative, resolve as resolve4, sep } from "path";
 import { Hono as Hono10 } from "hono";
 import { streamSSE } from "hono/streaming";
 
 // src/dashboard/docs-watcher.ts
 import { existsSync as existsSync13, watch } from "fs";
-import { basename as basename4, join as join14 } from "path";
+import { basename as basename4, join as join15 } from "path";
 var DEBOUNCE_MS = 200;
 var MAX_PENDING = 200;
 var IGNORED_SEGMENTS = /* @__PURE__ */ new Set([
@@ -7363,7 +7538,7 @@ function watchDocs(cwd, listener) {
       const current = entries.get(cwd);
       if (!current || filename === null) return;
       const rel = filename.split("\\").join("/");
-      if (rel === root && !existsSync13(join14(cwd, rel))) return;
+      if (rel === root && !existsSync13(join15(cwd, rel))) return;
       if (isIgnoredDocPath(rel)) return;
       if (current.pending.size < MAX_PENDING) current.pending.add(rel);
       if (current.timer === null) current.timer = setTimeout(() => flush(cwd), DEBOUNCE_MS);
@@ -7600,18 +7775,18 @@ async function readOrQueueDocAudio(input2) {
 }
 
 // src/dashboard/artifact-export.ts
-import { readFileSync as readFileSync11 } from "fs";
+import { readFileSync as readFileSync13 } from "fs";
 
 // src/dashboard/chat-agent.ts
 import { homedir as homedir7 } from "os";
 
 // src/mcp/config.ts
-import { mkdtempSync, rmSync as rmSync5, writeFileSync as writeFileSync7 } from "fs";
+import { mkdtempSync, rmSync as rmSync6, writeFileSync as writeFileSync8 } from "fs";
 import { tmpdir as tmpdir2 } from "os";
-import { join as join15 } from "path";
+import { join as join16 } from "path";
 
 // src/mcp/crypto.ts
-import { createCipheriv, createDecipheriv, randomBytes as randomBytes3, timingSafeEqual } from "crypto";
+import { createCipheriv, createDecipheriv, randomBytes as randomBytes4, timingSafeEqual } from "crypto";
 var ALGORITHM = "aes-256-gcm";
 var KEY_BYTES = 32;
 var IV_BYTES = 12;
@@ -7644,7 +7819,7 @@ function currentKeyVersion() {
   );
 }
 function encrypt(key, purpose, plaintext) {
-  const iv = randomBytes3(IV_BYTES);
+  const iv = randomBytes4(IV_BYTES);
   const cipher = createCipheriv(ALGORITHM, key, iv);
   cipher.setAAD(Buffer.from(purpose, "utf8"));
   const ciphertext = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
@@ -7664,7 +7839,7 @@ function decrypt(key, purpose, blob) {
 }
 function createEnvelope() {
   const keyVersion = currentKeyVersion();
-  const key = randomBytes3(KEY_BYTES);
+  const key = randomBytes4(KEY_BYTES);
   const wrappedDek = encrypt(
     readMasterKey(keyVersion),
     purposeForDek(keyVersion),
@@ -7730,7 +7905,7 @@ function secretsMatch(a, b) {
 }
 
 // src/mcp/oauth.ts
-import { createHash as createHash7, randomBytes as randomBytes4 } from "crypto";
+import { createHash as createHash7, randomBytes as randomBytes5 } from "crypto";
 var RESERVED_AUTHORIZE_PARAMS = /* @__PURE__ */ new Set([
   "client_id",
   "redirect_uri",
@@ -7744,10 +7919,10 @@ function base64url(buffer) {
   return buffer.toString("base64").replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 }
 function createStateToken() {
-  return base64url(randomBytes4(32));
+  return base64url(randomBytes5(32));
 }
 function createPkcePair() {
-  const verifier = base64url(randomBytes4(32));
+  const verifier = base64url(randomBytes5(32));
   const challenge = base64url(createHash7("sha256").update(verifier).digest());
   return { verifier, challenge };
 }
@@ -8294,12 +8469,12 @@ async function buildMcpConfig(profile, connectionIds) {
   return { config, skipped };
 }
 function writeMcpConfigFile(config) {
-  const dir = mkdtempSync(join15(tmpdir2(), "flyspace-mcp-"));
-  const path = join15(dir, "mcp-config.json");
-  writeFileSync7(path, JSON.stringify(config), { mode: 384 });
+  const dir = mkdtempSync(join16(tmpdir2(), "flyspace-mcp-"));
+  const path = join16(dir, "mcp-config.json");
+  writeFileSync8(path, JSON.stringify(config), { mode: 384 });
   return {
     path,
-    cleanup: () => rmSync5(dir, { recursive: true, force: true })
+    cleanup: () => rmSync6(dir, { recursive: true, force: true })
   };
 }
 async function withMcpConfig(profile, connectionIds, fn) {
@@ -8316,22 +8491,22 @@ async function withMcpConfig(profile, connectionIds, fn) {
 }
 
 // src/claude/agents.ts
-import { existsSync as existsSync14, readdirSync as readdirSync3, readFileSync as readFileSync10 } from "fs";
+import { existsSync as existsSync14, readdirSync as readdirSync3, readFileSync as readFileSync11 } from "fs";
 import { homedir as homedir6 } from "os";
-import { basename as basename5, join as join16 } from "path";
+import { basename as basename5, join as join17 } from "path";
 import yaml from "js-yaml";
 function defaultConfigDir() {
-  return join16(homedir6(), ".claude");
+  return join17(homedir6(), ".claude");
 }
 function expandHome(p) {
   if (p === "~") return homedir6();
-  if (p.startsWith("~/")) return join16(homedir6(), p.slice(2));
+  if (p.startsWith("~/")) return join17(homedir6(), p.slice(2));
   return p;
 }
 function parseFrontmatter(file) {
   let content;
   try {
-    content = readFileSync10(file, "utf-8");
+    content = readFileSync11(file, "utf-8");
   } catch {
     return {};
   }
@@ -8355,7 +8530,7 @@ function collectFrom(root, source) {
     return [];
   }
   return entries2.map((file) => {
-    const path = join16(root, file);
+    const path = join17(root, file);
     const fm = parseFrontmatter(path);
     const name = fm.name?.trim() || basename5(file, ".md");
     return { name, description: (fm.description ?? "").trim(), source, path };
@@ -8364,8 +8539,8 @@ function collectFrom(root, source) {
 function listAgents(configDir2, cwd) {
   const base = configDir2 ? expandHome(configDir2) : defaultConfigDir();
   const collected = [
-    ...collectFrom(join16(cwd, ".claude", "agents"), "project"),
-    ...collectFrom(join16(base, "agents"), "user")
+    ...collectFrom(join17(cwd, ".claude", "agents"), "project"),
+    ...collectFrom(join17(base, "agents"), "user")
   ];
   const byName = /* @__PURE__ */ new Map();
   for (const agent of collected) {
@@ -8377,241 +8552,135 @@ function readAgentPersona(configDir2, cwd, name) {
   const agent = listAgents(configDir2, cwd).find((a) => a.name === name);
   if (!agent) return void 0;
   try {
-    const content = readFileSync10(agent.path, "utf-8");
+    const content = readFileSync11(agent.path, "utf-8");
     return content.replace(/^---\r?\n[\s\S]*?\r?\n---\r?\n?/, "").trim();
   } catch {
     return void 0;
   }
 }
 
-// src/store/memory-store.ts
-var MEMORY_TYPES = ["preference", "decision", "fact", "reference"];
-var NAME_RE = /^[a-z0-9]+(-[a-z0-9]+)*$/;
-var DESCRIPTION_MAX = 200;
-var BODY_MAX = 4e3;
-var MEMORY_INDEX_MAX_CHARS = 8e3;
-function isMemoryType(value) {
-  return MEMORY_TYPES.includes(value);
-}
-function validateMemoryInput(input2) {
-  if (!NAME_RE.test(input2.name))
-    throw new Error("name must be a kebab-case slug, e.g. deploy-flow");
-  if (!isMemoryType(input2.type)) throw new Error(`type must be one of ${MEMORY_TYPES.join(", ")}`);
-  const description = input2.description.trim();
-  if (!description || description.includes("\n") || description.length > DESCRIPTION_MAX) {
-    throw new Error(`description must be one line of at most ${DESCRIPTION_MAX} characters`);
-  }
-  const body = input2.body.trim();
-  if (!body || body.length > BODY_MAX) {
-    throw new Error(`body must be 1 to ${BODY_MAX} characters`);
+// src/dashboard/memory-extraction-runner.ts
+import { spawn as spawn4 } from "child_process";
+import { mkdtempSync as mkdtempSync2, readFileSync as readFileSync12, rmSync as rmSync7 } from "fs";
+import { tmpdir as tmpdir3 } from "os";
+import { join as join18 } from "path";
+var CLAUDE_MODEL = "sonnet";
+var CODEX_MODEL = "gpt-6-astra";
+var CODEX_EFFORT = "low";
+var TIMEOUT_MS = 15e4;
+function buildInvocation(runner, req, dir, auth, baseEnv = process.env) {
+  const env = { ...baseEnv, CLAUDE_CODE_DISABLE_AUTO_MEMORY: "1" };
+  if (runner === "codex") {
+    const outputFile = join18(dir, "last-message.txt");
+    return {
+      command: "codex",
+      args: [
+        "exec",
+        "--ephemeral",
+        // No MCP servers, profiles or hooks from the user's config.toml; auth
+        // still comes from CODEX_HOME.
+        "--ignore-user-config",
+        "--skip-git-repo-check",
+        "-s",
+        "read-only",
+        "-m",
+        CODEX_MODEL,
+        "-c",
+        `model_reasoning_effort=${CODEX_EFFORT}`,
+        "--output-last-message",
+        outputFile,
+        // Codex has no separate system prompt flag; `-` reads the prompt from stdin.
+        "-"
+      ],
+      stdin: `${req.system}
+
+---
+
+${req.user}`,
+      env,
+      outputFile
+    };
   }
-}
-function rowToMemory(row) {
+  const pinned = pinnedClaudeConfigDir(auth.claudeConfigDir);
+  if (pinned) env["CLAUDE_CONFIG_DIR"] = pinned;
+  else delete env["CLAUDE_CONFIG_DIR"];
+  if (auth.claudeCodeOauthToken) env["CLAUDE_CODE_OAUTH_TOKEN"] = auth.claudeCodeOauthToken;
+  else delete env["CLAUDE_CODE_OAUTH_TOKEN"];
   return {
-    id: row["id"],
-    channelId: row["channel_id"],
-    name: row["name"],
-    description: row["description"],
-    type: row["type"],
-    body: row["body"],
-    sourceThreadId: row["source_thread_id"] ?? null,
-    createdBy: row["created_by"],
-    createdAt: row["created_at"],
-    updatedAt: row["updated_at"]
+    command: "claude",
+    args: [
+      "-p",
+      "--model",
+      CLAUDE_MODEL,
+      "--no-session-persistence",
+      "--tools",
+      "",
+      "--strict-mcp-config",
+      "--setting-sources",
+      "",
+      "--system-prompt",
+      req.system
+    ],
+    stdin: req.user,
+    env
   };
 }
-async function listChannelMemories(channelId) {
-  const { data, error: error2 } = await getSupabaseClient().from("memories").select("*").eq("scope", "channel").eq("channel_id", channelId).order("updated_at", { ascending: false });
-  if (error2) throw new Error(`listChannelMemories(${channelId}): ${error2.message}`);
-  return (data ?? []).map(rowToMemory);
-}
-async function getChannelMemory(channelId, name) {
-  const { data, error: error2 } = await getSupabaseClient().from("memories").select("*").eq("scope", "channel").eq("channel_id", channelId).eq("name", name).maybeSingle();
-  if (error2) throw new Error(`getChannelMemory(${channelId}, ${name}): ${error2.message}`);
-  return data ? rowToMemory(data) : null;
-}
-async function saveChannelMemory(input2, actor) {
-  validateMemoryInput(input2);
-  const supabase = getSupabaseClient();
-  const existing = await getChannelMemory(input2.channelId, input2.name);
-  const fields = {
-    description: input2.description.trim(),
-    type: input2.type,
-    body: input2.body.trim(),
-    source_thread_id: input2.sourceThreadId ?? existing?.sourceThreadId ?? null,
-    created_by: input2.createdBy
-  };
-  if (existing && sameContent(existing, fields)) {
-    return { memory: existing, created: false, changed: false };
-  }
-  const { data, error: error2 } = existing ? await supabase.from("memories").update({ ...fields, updated_at: (/* @__PURE__ */ new Date()).toISOString() }).eq("id", existing.id).select("*").single() : await supabase.from("memories").insert({ ...fields, scope: "channel", channel_id: input2.channelId, name: input2.name }).select("*").single();
-  if (error2)
-    throw new Error(`saveChannelMemory(${input2.channelId}, ${input2.name}): ${error2.message}`);
-  const memory = rowToMemory(data);
-  await logMemoryEvent({
-    memory,
-    action: existing ? "update" : "create",
-    before: existing ? snapshot(existing) : null,
-    after: snapshot(memory),
-    actor,
-    threadId: input2.sourceThreadId ?? null
-  });
-  return { memory, created: !existing, changed: true };
-}
-async function updateChannelMemory(channelId, memoryId, patch, actor) {
-  const existing = (await listChannelMemories(channelId)).find((m) => m.id === memoryId);
-  if (!existing) return null;
-  const { memory } = await saveChannelMemory(
-    {
-      channelId,
-      name: existing.name,
-      description: patch.description ?? existing.description,
-      type: patch.type ?? existing.type,
-      body: patch.body ?? existing.body,
-      createdBy: existing.createdBy
-    },
-    actor
-  );
-  return memory;
-}
-async function searchChannelMemories(channelId, query) {
-  const words = query.replaceAll(/[,()*%\\]/g, " ").split(/\s+/).filter(Boolean);
-  if (!words.length) return [];
-  let request2 = getSupabaseClient().from("memories").select("*").eq("scope", "channel").eq("channel_id", channelId);
-  for (const word of words) {
-    request2 = request2.or(`name.ilike.*${word}*,description.ilike.*${word}*,body.ilike.*${word}*`);
-  }
-  const { data, error: error2 } = await request2.order("updated_at", { ascending: false }).limit(20);
-  if (error2) throw new Error(`searchChannelMemories(${channelId}): ${error2.message}`);
-  return (data ?? []).map(rowToMemory);
-}
-async function deleteChannelMemory(channelId, idOrName, actor, threadId) {
-  const { data, error: error2 } = await getSupabaseClient().from("memories").delete().eq("scope", "channel").eq("channel_id", channelId).eq(isUuid(idOrName) ? "id" : "name", idOrName).select("*");
-  if (error2) throw new Error(`deleteChannelMemory(${channelId}, ${idOrName}): ${error2.message}`);
-  const deleted = (data ?? []).map(rowToMemory);
-  for (const memory of deleted) {
-    await logMemoryEvent({
-      memory,
-      action: "delete",
-      before: snapshot(memory),
-      after: null,
-      actor,
-      threadId: threadId ?? null
+function run3(inv, cwd) {
+  return new Promise((resolve7) => {
+    const child = spawn4(inv.command, inv.args, {
+      cwd,
+      env: inv.env,
+      stdio: ["pipe", "pipe", "pipe"]
     });
-  }
-  return deleted.length > 0;
-}
-function snapshot(m) {
-  return {
-    description: m.description,
-    type: m.type,
-    body: m.body,
-    sourceThreadId: m.sourceThreadId,
-    createdBy: m.createdBy
-  };
-}
-function sameContent(m, other) {
-  return m.description === other.description && m.type === other.type && m.body === other.body;
-}
-async function logMemoryEvent(e) {
-  const { error: error2 } = await getSupabaseClient().from("memory_events").insert({
-    channel_id: e.memory.channelId,
-    memory_id: e.action === "delete" ? null : e.memory.id,
-    thread_id: e.threadId,
-    name: e.memory.name,
-    action: e.action,
-    before: e.before,
-    after: e.after,
-    actor: e.actor
+    let stdout = "";
+    let stderr = "";
+    const timer2 = setTimeout(() => child.kill("SIGTERM"), TIMEOUT_MS);
+    child.stdout.on("data", (chunk3) => stdout += chunk3.toString());
+    child.stderr.on("data", (chunk3) => stderr += chunk3.toString());
+    child.on("error", (err) => {
+      clearTimeout(timer2);
+      console.error(`[memory-extraction] ${inv.command} failed to start:`, err.message);
+      resolve7({ ok: false });
+    });
+    child.on("close", (code) => {
+      clearTimeout(timer2);
+      if (code !== 0) {
+        const detail = (stderr || stdout).trim().split("\n").at(-1) ?? "";
+        console.error(`[memory-extraction] ${inv.command} exited ${code}: ${detail.slice(0, 200)}`);
+        resolve7({ ok: false });
+        return;
+      }
+      let raw = stdout;
+      if (inv.outputFile) {
+        try {
+          raw = readFileSync12(inv.outputFile, "utf-8");
+        } catch {
+          raw = "";
+        }
+      }
+      resolve7({ ok: true, raw });
+    });
+    child.stdin.end(inv.stdin);
   });
-  if (error2) console.error(`[memory] event log failed for ${e.memory.name}:`, error2.message);
-}
-function rowToEvent(row) {
-  return {
-    id: row["id"],
-    channelId: row["channel_id"],
-    memoryId: row["memory_id"] ?? null,
-    threadId: row["thread_id"] ?? null,
-    name: row["name"],
-    action: row["action"],
-    before: row["before"] ?? null,
-    after: row["after"] ?? null,
-    actor: row["actor"],
-    createdAt: row["created_at"],
-    undoneAt: row["undone_at"] ?? null
-  };
 }
-async function listThreadMemoryEvents(channelId, threadId) {
-  const { data, error: error2 } = await getSupabaseClient().from("memory_events").select("*").eq("channel_id", channelId).eq("thread_id", threadId).order("created_at", { ascending: false }).limit(50);
-  if (error2) throw new Error(`listThreadMemoryEvents(${threadId}): ${error2.message}`);
-  return (data ?? []).map(rowToEvent);
-}
-async function undoMemoryEvent(channelId, eventId) {
-  const supabase = getSupabaseClient();
-  const { data, error: error2 } = await supabase.from("memory_events").select("*").eq("id", eventId).eq("channel_id", channelId).maybeSingle();
-  if (error2) throw new Error(`undoMemoryEvent(${eventId}): ${error2.message}`);
-  if (!data) return "not-found";
-  const event = rowToEvent(data);
-  if (event.undoneAt) return "already-undone";
-  const current = await getChannelMemory(channelId, event.name);
-  const unchangedSince = current && event.after ? sameContent(current, event.after) : !current && !event.after;
-  if (!unchangedSince) return "conflict";
-  const claimed = await supabase.from("memory_events").update({ undone_at: (/* @__PURE__ */ new Date()).toISOString() }).eq("id", eventId).is("undone_at", null).select("id");
-  if (claimed.error) throw new Error(`undoMemoryEvent(${eventId}): ${claimed.error.message}`);
-  if (!(claimed.data ?? []).length) return "already-undone";
-  const before = event.before;
-  const restore = before ? {
-    description: before.description,
-    type: before.type,
-    body: before.body,
-    source_thread_id: before.sourceThreadId,
-    created_by: before.createdBy
-  } : null;
-  const { error: writeError } = !restore ? await supabase.from("memories").delete().eq("id", current.id) : current ? await supabase.from("memories").update({ ...restore, updated_at: (/* @__PURE__ */ new Date()).toISOString() }).eq("id", current.id) : await supabase.from("memories").insert({ ...restore, scope: "channel", channel_id: channelId, name: event.name });
-  if (writeError) {
-    await supabase.from("memory_events").update({ undone_at: null }).eq("id", eventId);
-    throw new Error(`undoMemoryEvent(${eventId}): ${writeError.message}`);
-  }
-  return "undone";
-}
-function isUuid(value) {
-  return /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(value);
-}
-function formatMemoryPrompt(channelId, memories) {
-  const lines = [];
-  let used = 0;
-  let omitted = 0;
-  for (const m of memories) {
-    const line = `- \`${m.name}\` (${m.type}): ${m.description}`;
-    if (used + line.length > MEMORY_INDEX_MAX_CHARS) {
-      omitted++;
-      continue;
-    }
-    lines.push(line);
-    used += line.length + 1;
+async function completeMemoryExtraction(req) {
+  const runner = runnerForModel(loadDashboardSettings().agent);
+  const config = resolveChannelConfig(req.channelId);
+  const dir = mkdtempSync2(join18(tmpdir3(), "flyspace-memory-"));
+  try {
+    const inv = buildInvocation(runner, req, dir, {
+      ...config.claudeConfigDir ? { claudeConfigDir: config.claudeConfigDir } : {},
+      ...config.claudeCodeOauthToken ? { claudeCodeOauthToken: config.claudeCodeOauthToken } : {}
+    });
+    return await run3(inv, dir);
+  } finally {
+    rmSync7(dir, { recursive: true, force: true });
   }
-  const index = lines.length ? lines.join("\n") + (omitted ? `
-- (${omitted} older memories not listed; find them with \`memory search\`)` : "") : "(none yet)";
-  return [
-    `## Channel memory`,
-    ``,
-    `This channel has a persistent memory shared by every thread in it and by every agent runner. Use it instead of any built-in memory directory of your own CLI.`,
-    ``,
-    `- Read a memory: \`flyspace memory get --channel ${channelId} <name>\``,
-    `- Search: \`flyspace memory search --channel ${channelId} <words>\``,
-    `- Save or overwrite: \`flyspace memory save --channel ${channelId} --name <kebab-slug> --type <${MEMORY_TYPES.join("|")}> --description "<one line>" --body "<text>" [--thread <thread-id>]\``,
-    `- Delete one that turned out wrong: \`flyspace memory delete --channel ${channelId} <name> [--thread <thread-id>]\``,
-    ``,
-    `Save when someone asks you to remember something, corrects you, or a decision is made that later threads will need. Save what is not derivable from the code, git history or docs: decisions and why, preferences, corrections, where external things live. Do not save one-off details of this conversation. Check the index first and update an existing memory rather than adding a near-duplicate. Write memories in English. Pass \`--thread\` with the thread id from the \`[context: ...]\` header, so the thread shows what changed and it can be undone there.`,
-    ``,
-    `Index:`,
-    index
-  ].join("\n");
 }
 
 // src/dashboard/rollover-summary.ts
-import { spawn as spawn4 } from "child_process";
-import { tmpdir as tmpdir3 } from "os";
+import { spawn as spawn5 } from "child_process";
+import { tmpdir as tmpdir4 } from "os";
 var HAIKU_MODEL = "haiku";
 var CJK_PATTERN = /[　-〿぀-ヿ㐀-䶿一-鿿豈-﫿＀-￯]/;
 function estimateTokens(text) {
@@ -8670,11 +8739,11 @@ function runHaikuPrint(input2, claudeConfigDir, claudeCodeOauthToken) {
     if (claudeConfigDir) env["CLAUDE_CONFIG_DIR"] = claudeConfigDir;
     if (claudeCodeOauthToken) env["CLAUDE_CODE_OAUTH_TOKEN"] = claudeCodeOauthToken;
     else delete env["CLAUDE_CODE_OAUTH_TOKEN"];
-    const child = spawn4("claude", args, {
+    const child = spawn5("claude", args, {
       // A stateless rewrite touches no files — tmpdir keeps it that way and
       // avoids picking up an unrelated project's own CLAUDE.md/AGENTS.md,
       // unlike the channel's own cwd the main turn runs in.
-      cwd: tmpdir3(),
+      cwd: tmpdir4(),
       env,
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -8877,7 +8946,7 @@ ${recent.map((m) => `${m.author}: ${m.body}`).join("\n")}`;
 
 // src/dashboard/attachment-downloader.ts
 import { writeFile } from "fs/promises";
-import { join as join17 } from "path";
+import { join as join19 } from "path";
 import { GetObjectCommand as GetObjectCommand4 } from "@aws-sdk/client-s3";
 var debug = process.env["DEBUG"] === "true";
 var ATTACHMENT_LINK = /\]\(\/api\/attachments\/([^)?\s]+)(?:\?[^)\s]*)?\)/g;
@@ -8924,7 +8993,7 @@ async function downloadOne(key) {
     if (bytes.length > sizeLimit) {
       return { kind: "skip", skipped: { name, mimetype, reason: "too_large" } };
     }
-    const localPath = join17(paths.UPLOADS_DIR, lastSegment);
+    const localPath = join19(paths.UPLOADS_DIR, lastSegment);
     await writeFile(localPath, bytes);
     if (debug)
       console.log(`[attachment-downloader] saved ${key} -> ${localPath} (${bytes.length} bytes)`);
@@ -9096,21 +9165,21 @@ var ChatAgent = class {
    * kill.
    */
   async maybeSupersede(msg) {
-    const run3 = this.activeRuns.get(msg.threadId);
-    if (!run3 || run3.msg.author !== msg.author || run3.msg.replyId === msg.replyId) return;
+    const run4 = this.activeRuns.get(msg.threadId);
+    if (!run4 || run4.msg.author !== msg.author || run4.msg.replyId === msg.replyId) return;
     try {
-      if (!await this.shouldInterrupt(run3.msg.body, msg.body)) return;
+      if (!await this.shouldInterrupt(run4.msg.body, msg.body)) return;
     } catch (err) {
       console.error("[chat-agent] interrupt classifier failed:", err.message);
       return;
     }
-    if (this.activeRuns.get(msg.threadId) !== run3) return;
+    if (this.activeRuns.get(msg.threadId) !== run4) return;
     console.log(
       `[chat-agent] follow-up supersedes in-flight run \u2014 aborting. thread=${msg.threadId}`
     );
-    run3.superseded = true;
+    run4.superseded = true;
     this.supersedingReplies.add(msg.replyId);
-    run3.abort.abort();
+    run4.abort.abort();
   }
   /**
    * Picks up messages nobody answered. `handleMessage` is fire-and-forget and
@@ -9273,6 +9342,11 @@ var ChatAgent = class {
     return data.filter((r) => r.id !== excludeReplyId).reverse().slice(-limit).map((r) => ({ author: r.author, body: r.body }));
   }
   /** Whether a reply run is currently in flight for this thread. */
+  /** One idle memory extraction call (see memory-extraction-runner.ts). Not a
+   *  turn: no thread, session, queue slot or usage row. */
+  completeMemoryExtraction(req) {
+    return completeMemoryExtraction(req);
+  }
   isThinking(threadId) {
     return this.activeRuns.has(threadId);
   }
@@ -9308,9 +9382,9 @@ var ChatAgent = class {
    * continue with `--resume`. Returns whether a run was actually in flight —
    * a queued-but-not-started message is not affected. */
   cancel(threadId) {
-    const run3 = this.activeRuns.get(threadId);
-    if (!run3) return false;
-    run3.abort.abort();
+    const run4 = this.activeRuns.get(threadId);
+    if (!run4) return false;
+    run4.abort.abort();
     return true;
   }
   /**
@@ -9472,18 +9546,11 @@ var ChatAgent = class {
         ...docsAccessUnverified ? { docsAccessUnverified } : {}
       };
     }
-    const agentMemory = await listEnabledFeatureFlagsBySlug(owningProfile).then((ids) => resolveFeatureFlags(ids, false)["agent-memory"]).catch((err) => {
-      console.error("[chat-agent] feature flag lookup failed:", err.message);
-      return false;
+    const memory = await loadAgentMemory(owningProfile, thread.channel_id, {
+      readable: docsAccess !== "none"
     });
-    if (agentMemory) channelConfig = { ...channelConfig, disableAutoMemory: true };
-    if (agentMemory && docsAccess !== "none" && isUuid(thread.channel_id)) {
-      const memoryPrompt = await listChannelMemories(thread.channel_id).then((memories) => formatMemoryPrompt(thread.channel_id, memories)).catch((err) => {
-        console.error("[chat-agent] memory lookup failed:", err.message);
-        return void 0;
-      });
-      if (memoryPrompt) channelConfig = { ...channelConfig, memoryPrompt };
-    }
+    if (memory.enabled) channelConfig = { ...channelConfig, disableAutoMemory: true };
+    if (memory.memoryPrompt) channelConfig = { ...channelConfig, memoryPrompt: memory.memoryPrompt };
     const store = this.openSessionStore();
     try {
       const channelKey = `chat:${thread.channel_id}`;
@@ -10211,7 +10278,7 @@ async function exportDocAsArtifact(channelId, docPath) {
   );
   const abs = resolveDocPath(channelConfig.cwd, docPath);
   if (!abs) throw new Error(`doc not found: ${docPath}`);
-  const content = readFileSync11(abs, "utf8");
+  const content = readFileSync13(abs, "utf8");
   const title = extractTitle(abs, "md");
   const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
   const prompt = `Publish the document at \`${docPath}\` (already read below) as a Claude Artifact, then record the result as a stub file under this channel's \`docs/artifacts/\` folder (create the folder if it doesn't exist).
@@ -10468,7 +10535,7 @@ function probeDir(absDir, showHidden) {
         return false;
       }
       if (!showHidden && entry.name.startsWith(".")) continue;
-      const abs = join18(dir, entry.name);
+      const abs = join20(dir, entry.name);
       const kind = entryKind(entry, abs);
       if (kind === "dir") {
         if (SKIP_DIRS.has(entry.name)) hasOther = true;
@@ -10488,14 +10555,14 @@ function probeDir(absDir, showHidden) {
 }
 function readGitBranch(dir) {
   try {
-    let gitDir = join18(dir, ".git");
+    let gitDir = join20(dir, ".git");
     if (statSync5(gitDir).isFile()) {
-      const pointer = readFileSync12(gitDir, "utf8").trim();
+      const pointer = readFileSync14(gitDir, "utf8").trim();
       const match = pointer.match(/^gitdir:\s*(.+)$/);
       if (!match) return void 0;
       gitDir = resolve4(dir, match[1]);
     }
-    const head = readFileSync12(join18(gitDir, "HEAD"), "utf8").trim();
+    const head = readFileSync14(join20(gitDir, "HEAD"), "utf8").trim();
     const branchMatch = head.match(/^ref:\s*refs\/heads\/(.+)$/);
     if (branchMatch) return branchMatch[1];
     return /^[0-9a-f]{7,40}$/i.test(head) ? head.slice(0, 7) : void 0;
@@ -10517,14 +10584,14 @@ function listDocLevel(root, relDir = "", sort = "newest", showHidden = false) {
   for (const entry of entries2) {
     if (dirs.length + docs.length >= MAX_ENTRIES) break;
     if (!showHidden && entry.name.startsWith(".")) continue;
-    const abs = join18(absDir, entry.name);
+    const abs = join20(absDir, entry.name);
     const path = relative(root, abs).split(sep).join("/");
     const kind = entryKind(entry, abs);
     if (kind === "dir") {
       if (SKIP_DIRS.has(entry.name)) continue;
       const probe3 = probeDir(abs, showHidden);
       if (!probe3.hasDocs && probe3.hasOther) continue;
-      const isRepo = existsSync16(join18(abs, ".git"));
+      const isRepo = existsSync16(join20(abs, ".git"));
       dirs.push({
         path,
         name: entry.name,
@@ -10560,7 +10627,7 @@ function flatDocs(root, {
     for (const entry of entries2) {
       if (hits.length >= MAX_FLAT_DOCS) return;
       if (!showHidden && entry.name.startsWith(".")) continue;
-      const abs = join18(dir, entry.name);
+      const abs = join20(dir, entry.name);
       const kind = entryKind(entry, abs);
       if (kind === "dir") {
         if (!SKIP_DIRS.has(entry.name)) walk(abs, depth + 1);
@@ -10602,7 +10669,7 @@ function writeDocContent(root, rel, content, baseMtime) {
   if (Buffer.byteLength(content, "utf8") > MAX_CONTENT_BYTES) {
     return { status: "too-large" };
   }
-  writeFileSync8(abs, content, "utf8");
+  writeFileSync9(abs, content, "utf8");
   return { status: "ok", mtime: statSync5(abs).mtime.toISOString() };
 }
 function resolveRawPath(root, rel) {
@@ -10640,7 +10707,7 @@ function uniqueName(absDir, name) {
   let candidate = name;
   for (let n = 1; n < 1e3; n++) {
     try {
-      statSync5(join18(absDir, candidate));
+      statSync5(join20(absDir, candidate));
     } catch {
       return candidate;
     }
@@ -10662,8 +10729,8 @@ function saveUploadedFile(root, relDir, name, data) {
   if (!(ext in DOC_EXTENSIONS) && !ASSET_LIST_EXTENSIONS.has(ext)) return { status: "bad-type" };
   if (data.byteLength > MAX_UPLOAD_BYTES) return { status: "too-large" };
   const final = uniqueName(absDir, safe);
-  const abs = join18(absDir, final);
-  writeFileSync8(abs, data);
+  const abs = join20(absDir, final);
+  writeFileSync9(abs, data);
   return { status: "ok", path: relative(root, abs).split(sep).join("/"), name: final };
 }
 function createDocFolder(root, relDir, name) {
@@ -10676,13 +10743,13 @@ function createDocFolder(root, relDir, name) {
   }
   const safe = sanitizeUploadName(name);
   if (!safe) return { status: "bad-name" };
-  const abs = join18(absDir, safe);
+  const abs = join20(absDir, safe);
   try {
     statSync5(abs);
     return { status: "exists" };
   } catch {
   }
-  mkdirSync8(abs);
+  mkdirSync9(abs);
   return { status: "ok", path: relative(root, abs).split(sep).join("/"), name: safe };
 }
 function createDocFile(root, relDir, name, content) {
@@ -10699,9 +10766,9 @@ function createDocFile(root, relDir, name, content) {
   if (!(ext in DOC_EXTENSIONS) && !(ext in CODE_EXTENSIONS)) return { status: "bad-name" };
   if (SKIP_FILES.has(safe)) return { status: "bad-name" };
   if (Buffer.byteLength(content, "utf8") > MAX_CONTENT_BYTES) return { status: "too-large" };
-  const abs = join18(absDir, safe);
+  const abs = join20(absDir, safe);
   try {
-    writeFileSync8(abs, content, { encoding: "utf8", flag: "wx" });
+    writeFileSync9(abs, content, { encoding: "utf8", flag: "wx" });
   } catch (err) {
     if (err.code === "EEXIST") return { status: "exists" };
     throw err;
@@ -10737,7 +10804,7 @@ function moveDocEntry(root, from, to) {
   } catch {
     return { status: "bad-target" };
   }
-  const finalAbs = join18(absToDir, name);
+  const finalAbs = join20(absToDir, name);
   if (isDir2 && (finalAbs === absFrom || finalAbs.startsWith(absFrom + sep))) {
     return { status: "into-self" };
   }
@@ -10760,7 +10827,7 @@ function deleteDocEntry(root, path) {
   }
   const isDir2 = stat.isDirectory();
   if (!isDir2 && !stat.isFile() && !stat.isSymbolicLink()) return { status: "not-found" };
-  rmSync6(abs, { recursive: isDir2 });
+  rmSync8(abs, { recursive: isDir2 });
   return {
     status: "ok",
     path: relative(root, abs).split(sep).join("/"),
@@ -10799,7 +10866,7 @@ function createDocsRouter({ gate = requireDocsAccess } = {}) {
     }
     if (!stat.isFile()) return c.json({ error: "not found" }, 404);
     if (stat.size > MAX_RAW_BYTES) return c.json({ error: "file too large" }, 413);
-    const data = readFileSync12(resolved2.abs);
+    const data = readFileSync14(resolved2.abs);
     const headers = { "Content-Type": resolved2.contentType };
     if (download) {
       const filename = basename6(resolved2.abs).replace(/"/g, "");
@@ -10819,7 +10886,7 @@ function createDocsRouter({ gate = requireDocsAccess } = {}) {
     }
     if (!stat.isFile()) return c.json({ error: "not found" }, 404);
     if (stat.size > MAX_RAW_BYTES) return c.json({ error: "file too large" }, 413);
-    return c.body(new Uint8Array(readFileSync12(abs)), 200, {
+    return c.body(new Uint8Array(readFileSync14(abs)), 200, {
       "Content-Type": "text/html; charset=utf-8",
       "Content-Security-Policy": HTML_SHARE_CSP,
       "X-Content-Type-Options": "nosniff",
@@ -11004,7 +11071,7 @@ function createDocsRouter({ gate = requireDocsAccess } = {}) {
       title: kind ? extractTitle(abs, kind) : basename6(abs),
       mtime: stat.mtime.toISOString(),
       tooLarge: tooLarge || void 0,
-      content: tooLarge ? "" : readFileSync12(abs, "utf8")
+      content: tooLarge ? "" : readFileSync14(abs, "utf8")
     });
   });
   app.put("/:id/docs/content", async (c) => {
@@ -11047,7 +11114,7 @@ function createDocsRouter({ gate = requireDocsAccess } = {}) {
       channel,
       rel,
       title: extractTitle(abs, "md"),
-      content: readFileSync12(abs, "utf8")
+      content: readFileSync14(abs, "utf8")
     };
   };
   app.get("/:id/docs/translation/:lang", async (c) => {
@@ -11270,7 +11337,7 @@ function ownSkills(scope, dir) {
     return [{ scope, name, description, body, path, plugin: null, mtime }];
   });
 }
-function snapshot2(scopes) {
+function snapshot(scopes) {
   const wants = (scope) => !scopes || scopes.has(scope);
   const configDir2 = profileClaudeConfigDir();
   const rows = [];
@@ -11305,7 +11372,7 @@ async function pushSkillScopes(scopes) {
   if (!mirrorEnabled()) return;
   const workspace = getProfile();
   const supabase = getSupabaseClient();
-  const rows = snapshot2(scopes ? new Set(scopes) : void 0);
+  const rows = snapshot(scopes ? new Set(scopes) : void 0);
   let query = supabase.from("skill_files").select("scope, name, hash").eq("workspace", workspace);
   if (scopes) query = query.in("scope", scopes);
   const { data, error: error2 } = await query;
@@ -11586,10 +11653,10 @@ function registerMirroredSkillRoutes(api, agent) {
 }
 
 // src/dashboard/providers.ts
-import { execFileSync as execFileSync2 } from "child_process";
+import { execFileSync as execFileSync3 } from "child_process";
 import { existsSync as existsSync19 } from "fs";
 import { homedir as homedir8 } from "os";
-import { join as join19, resolve as resolve5 } from "path";
+import { join as join21, resolve as resolve5 } from "path";
 var PROVIDER_LABELS = {
   claude: "Claude Code",
   codex: "Codex"
@@ -11598,7 +11665,7 @@ var TTL_MS2 = 6e4;
 var cache6 = /* @__PURE__ */ new Map();
 function binaryOnPath(bin) {
   try {
-    execFileSync2(bin, ["--version"], { stdio: "ignore" });
+    execFileSync3(bin, ["--version"], { stdio: "ignore" });
     return true;
   } catch {
     return false;
@@ -11607,10 +11674,10 @@ function binaryOnPath(bin) {
 function claudeAuthAvailable() {
   if (profileEnv("CLAUDE_CODE_OAUTH_TOKEN")?.trim()) return true;
   const configDir2 = profileClaudeConfigDir() || resolve5(homedir8(), ".claude");
-  if (existsSync19(join19(configDir2, ".credentials.json"))) return true;
+  if (existsSync19(join21(configDir2, ".credentials.json"))) return true;
   if (process.platform !== "darwin") return false;
   try {
-    execFileSync2("security", ["find-generic-password", "-s", "Claude Code-credentials"], {
+    execFileSync3("security", ["find-generic-password", "-s", "Claude Code-credentials"], {
       stdio: "ignore"
     });
     return true;
@@ -11760,7 +11827,7 @@ function registerHostRoutes(api) {
     const errors = c.req.query("error") === "true" || c.req.query("error") === "1";
     const limit = Math.min(Number(c.req.query("limit")) || 200, 2e3);
     const filename = errors ? "custie-error.log" : "custie.log";
-    const file = join20(paths.LOG_DIR, filename);
+    const file = join22(paths.LOG_DIR, filename);
     const exists = existsSync20(file);
     return c.json({
       file,
@@ -11772,7 +11839,7 @@ function registerHostRoutes(api) {
 }
 function tailFile(file, limit) {
   if (!existsSync20(file)) return [];
-  const lines = readFileSync13(file, "utf-8").split("\n");
+  const lines = readFileSync15(file, "utf-8").split("\n");
   if (lines.at(-1) === "") lines.pop();
   return lines.slice(-limit);
 }
@@ -13445,7 +13512,7 @@ function createSearchRouter() {
 }
 
 // src/dashboard/uploads-routes.ts
-import { randomUUID } from "crypto";
+import { randomUUID as randomUUID2 } from "crypto";
 import { Hono as Hono18 } from "hono";
 import { PutObjectCommand as PutObjectCommand3, GetObjectCommand as GetObjectCommand5 } from "@aws-sdk/client-s3";
 import { getSignedUrl as getSignedUrl4 } from "@aws-sdk/s3-request-presigner";
@@ -13469,7 +13536,7 @@ function createUploadsRouter() {
     if (file.size > MAX_FILE_BYTES) {
       return c.json({ error: `file must be ${MAX_FILE_BYTES / (1024 * 1024)}MB or smaller` }, 400);
     }
-    const key = `${KEY_PREFIX2}/${getProfile()}/${randomUUID()}-${sanitizeFilename(file.name)}`;
+    const key = `${KEY_PREFIX2}/${getProfile()}/${randomUUID2()}-${sanitizeFilename(file.name)}`;
     const buffer = Buffer.from(await file.arrayBuffer());
     await getR2Client().send(
       new PutObjectCommand3({
@@ -13552,7 +13619,7 @@ function createTranscribeRouter() {
 }
 
 // src/dashboard/avatars-routes.ts
-import { createHash as createHash10, randomUUID as randomUUID2 } from "crypto";
+import { createHash as createHash10, randomUUID as randomUUID3 } from "crypto";
 import { Hono as Hono20 } from "hono";
 import sharp4 from "sharp";
 import { PutObjectCommand as PutObjectCommand4, DeleteObjectCommand as DeleteObjectCommand4 } from "@aws-sdk/client-s3";
@@ -13591,7 +13658,7 @@ async function storeAvatar(file, owner) {
   if (file.size > MAX_AVATAR_BYTES) return { error: "avatar must be 2MB or smaller" };
   const original = Buffer.from(await file.arrayBuffer());
   const resized = await sharp4(original).resize({ width: AVATAR_SIZE, height: AVATAR_SIZE, fit: "cover" }).png().toBuffer();
-  const key = `${avatarKeyPrefix()}${owner}-${randomUUID2()}.png`;
+  const key = `${avatarKeyPrefix()}${owner}-${randomUUID3()}.png`;
   await getR2Client().send(
     new PutObjectCommand4({
       Bucket: getR2Bucket(),
@@ -13756,6 +13823,10 @@ function createMembersRouter() {
     if (avatarKey && !avatarKey.startsWith(`${avatarKeyPrefix()}invite-${ctx.userId}-`)) {
       return c.json({ error: "unknown avatar" }, 400);
     }
+    const { plan } = await getWorkspaceBilling(ctx.workspaceId);
+    if (plan === "local") {
+      return c.json({ error: "The Solo plan is for one person. Upgrade to invite members." }, 403);
+    }
     const existing = await getMembershipByEmail(ctx.workspaceId, email);
     if (existing) return c.json({ error: "already a member of this workspace" }, 409);
     let membership;
@@ -14953,8 +15024,16 @@ function uniqueChannelName(raw, taken) {
 // src/dashboard/workspace-greeting.ts
 var GROQ_API_URL8 = "https://api.groq.com/openai/v1/chat/completions";
 var GREETING_MODEL = "openai/gpt-oss-20b";
-var TIMEOUT_MS = 6e3;
+var TIMEOUT_MS2 = 6e3;
 var MAX_LISTED_CHANNELS = 8;
+var GUIDES = [
+  "Welcome to Flyspace",
+  "Working with the agent",
+  "Channels and folders",
+  "Docs",
+  "Inviting your team",
+  "Automations"
+];
 var SYSTEM_PROMPT4 = `You write the first message a new Flyspace workspace owner sees, posted in their #general channel. Flyspace is a team chat where an AI agent works inside every channel.
 
 - Plain Markdown, 60 to 110 words, in English. No headings, no emoji, no em or en dashes, no sign-off.
@@ -14962,11 +15041,13 @@ var SYSTEM_PROMPT4 = `You write the first message a new Flyspace workspace owner
 - Say that #general is public: everyone invited to the workspace can see it.
 - If project channels are listed, mention them as #name and say each one is linked to that project folder. Never invent a channel.
 - Mention the trial or the missing Host only if the facts say so.
+- If guides are listed, say they are in the Docs pane of #general and suggest starting with the first one.
 - Use only the facts given. Do not add buttons or a list of next steps: those are appended for you.`;
 function greetingButtons(input2) {
   const buttons = [];
   if (!input2.hostConnected) buttons.push("Connect a machine");
   if (input2.channels[0]) buttons.push(`Summarise #${input2.channels[0]} for me`);
+  if (input2.hostConnected) buttons.push("Give me a quick tour of the guides");
   if (input2.memberCount <= 1) buttons.push("Invite my team");
   buttons.push("Set up a daily digest");
   return buttons.slice(0, 3).map((b) => b.replace(/[|\]]/g, ""));
@@ -14977,6 +15058,7 @@ function fallbackGreeting(input2) {
     `Welcome to ${input2.workspaceName}, ${input2.ownerName}.`,
     "This is #general. It is public, so everyone you invite to the workspace can see it.",
     channels.length ? `Your project channels are ready: ${channels.join(", ")}. Each one is linked to its project folder, so the agent there works on the real files.` : "",
+    input2.hostConnected ? "A few short guides are waiting in the Docs pane of #general. Start with Welcome to Flyspace." : "",
     "Mention the agent in any channel to get started."
   ].filter(Boolean).join("\n\n");
 }
@@ -14987,11 +15069,12 @@ async function groqGreeting(input2, apiKey) {
     `Plan: ${input2.trialing ? "14-day free trial, just started" : "not on a trial"}`,
     `Host: ${input2.hostConnected ? "a machine is connected, agents can run" : "no machine connected yet, agents cannot run until one is"}`,
     `Project channels: ${input2.channels.slice(0, MAX_LISTED_CHANNELS).join(", ") || "(none yet)"}`,
-    `Members: ${input2.memberCount}`
+    `Members: ${input2.memberCount}`,
+    `Guides in #general: ${input2.hostConnected ? GUIDES.join(", ") : "(none, no machine connected)"}`
   ].join("\n");
   const res = await fetch(GROQ_API_URL8, {
     method: "POST",
-    signal: AbortSignal.timeout(TIMEOUT_MS),
+    signal: AbortSignal.timeout(TIMEOUT_MS2),
     headers: { "content-type": "application/json", authorization: `Bearer ${apiKey}` },
     body: JSON.stringify({
       model: GREETING_MODEL,
@@ -15069,6 +15152,14 @@ function createOnboardingRouter(agent) {
     await markWorkspaceProjectsSetup(ctx.workspaceId);
     return c.json({ channels: created.map((ch) => ({ id: ch.id, name: ch.name })) }, 201);
   });
+  app.get("/greeting", async (c) => {
+    const ctx = await resolveAuthContext(c);
+    if (ctx?.role !== "admin") return c.json({ pending: false });
+    const greetedAt = await getWorkspaceGreetedAt(ctx.workspaceId);
+    const pending3 = !!ctx.projectsSetupAt && !greetedAt;
+    const general = pending3 ? await ensureGeneralChannel() : null;
+    return c.json({ pending: pending3, channelId: general?.id ?? null });
+  });
   app.post("/greeting", async (c) => {
     const ctx = await resolveAuthContext(c);
     if (ctx?.role !== "admin") return c.json({ error: "admin access required" }, 403);
@@ -15077,6 +15168,8 @@ function createOnboardingRouter(agent) {
     const existing = () => supabase.from("threads").select("id").eq("client_key", ctx.workspaceId).maybeSingle();
     const found = await existing();
     if (found.data) return c.json({ channelId: general.id, threadId: found.data.id });
+    if (await getWorkspaceGreetedAt(ctx.workspaceId))
+      return c.json({ error: "already greeted" }, 409);
     const [branding, billing, members] = await Promise.all([
       getWorkspaceBranding(getProfile()).catch(() => null),
       getWorkspaceBilling(ctx.workspaceId).catch(() => null),
@@ -15107,6 +15200,7 @@ function createOnboardingRouter(agent) {
       await supabase.from("threads").delete().eq("id", thread.id);
       return c.json({ error: reply.error.message }, 500);
     }
+    await markWorkspaceGreeted(ctx.workspaceId);
     return c.json({ channelId: general.id, threadId: thread.id }, 201);
   });
   return app;
@@ -15281,17 +15375,17 @@ function registerDataRoutes(api, agent = {}) {
     const auto = loadEffectiveAutomations();
     const runs = /* @__PURE__ */ new Map();
     try {
-      for (const [name, run3] of await lastRunsForWorkspace(getProfile())) {
-        runs.set(name, { lastRun: run3.lastRunAt.toISOString(), lastStatus: run3.lastStatus });
+      for (const [name, run4] of await lastRunsForWorkspace(getProfile())) {
+        runs.set(name, { lastRun: run4.lastRunAt.toISOString(), lastStatus: run4.lastStatus });
       }
     } catch {
       if (existsSync22(paths.DB_FILE)) {
         const runStore = new AutomationRunStore(paths.DB_FILE);
         try {
-          for (const run3 of runStore.listLastRuns()) {
-            runs.set(run3.name, {
-              lastRun: run3.lastRunAt.toISOString(),
-              lastStatus: run3.lastStatus
+          for (const run4 of runStore.listLastRuns()) {
+            runs.set(run4.name, {
+              lastRun: run4.lastRunAt.toISOString(),
+              lastStatus: run4.lastStatus
             });
           }
         } finally {
@@ -15481,17 +15575,17 @@ function registerDataRoutes(api, agent = {}) {
     }
     const threadLinks = await resolveThreadLinks(raw);
     const sessions = raw.map((s) => {
-      const run3 = latest.get(s.threadTs);
-      const turns = run3?.numTurns ?? 1;
-      const total = run3 ? run3.inputTokens + run3.cacheReadTokens + run3.cacheCreationTokens : void 0;
+      const run4 = latest.get(s.threadTs);
+      const turns = run4?.numTurns ?? 1;
+      const total = run4 ? run4.inputTokens + run4.cacheReadTokens + run4.cacheCreationTokens : void 0;
       const link = s.channelId.startsWith("chat:") ? threadLinks.chat.get(s.threadTs) : threadLinks.external.get(`${s.channelId}:${s.threadTs}`);
       return {
         ...s,
         channelLabel: channelLabel(s.channelId),
-        model: run3?.model,
-        numTurns: run3?.numTurns,
+        model: run4?.model,
+        numTurns: run4?.numTurns,
         contextTokens: total !== void 0 ? Math.round(total / (turns > 0 ? turns : 1)) : void 0,
-        rolledOver: run3?.label === "rollover",
+        rolledOver: run4?.label === "rollover",
         threadTitle: link?.title ?? void 0,
         chatChannelId: link?.chatChannelId,
         chatThreadId: link?.chatThreadId,
@@ -15594,16 +15688,16 @@ function relay2(agent) {
 }
 
 // src/dashboard/agent-bridge.ts
-import { existsSync as existsSync24, readFileSync as readFileSync17 } from "fs";
+import { existsSync as existsSync24, readFileSync as readFileSync18 } from "fs";
 import dotenv from "dotenv";
 import { WebSocket, WebSocketServer } from "ws";
 
 // src/dashboard/host-identity.ts
 import { createPrivateKey as createPrivateKey2, createPublicKey as createPublicKey2, generateKeyPairSync as generateKeyPairSync2 } from "crypto";
-import { existsSync as existsSync23, mkdirSync as mkdirSync9, readFileSync as readFileSync14, writeFileSync as writeFileSync9 } from "fs";
-import { dirname as dirname7, join as join21 } from "path";
+import { existsSync as existsSync23, mkdirSync as mkdirSync10, readFileSync as readFileSync16, writeFileSync as writeFileSync10 } from "fs";
+import { dirname as dirname7, join as join23 } from "path";
 function hostPrivateKeyPath() {
-  return process.env["FLYSPACE_HOST_KEY_PATH"] || join21(paths.BASE_CONFIG_DIR, "host.key");
+  return process.env["FLYSPACE_HOST_KEY_PATH"] || join23(paths.BASE_CONFIG_DIR, "host.key");
 }
 function loadHostPrivateKey(path = hostPrivateKeyPath()) {
   if (!existsSync23(path)) {
@@ -15611,7 +15705,7 @@ function loadHostPrivateKey(path = hostPrivateKeyPath()) {
       `No Host identity at ${path}. Run \`pnpm run generate-host-key\` on this machine, then set FLYSPACE_HOST_PUBLIC_KEY on the Data process to the printed public key.`
     );
   }
-  return createPrivateKey2(readFileSync14(path, "utf8"));
+  return createPrivateKey2(readFileSync16(path, "utf8"));
 }
 function loadHostPublicKey() {
   const b64 = process.env["FLYSPACE_HOST_PUBLIC_KEY"];
@@ -15624,82 +15718,6 @@ function loadHostPublicKey() {
   }
 }
 
-// src/dashboard/host-lock.ts
-import { execFileSync as execFileSync3 } from "child_process";
-import { randomBytes as randomBytes5 } from "crypto";
-import { mkdirSync as mkdirSync10, readFileSync as readFileSync15, rmSync as rmSync7, writeFileSync as writeFileSync10 } from "fs";
-import { join as join22 } from "path";
-function hostLockPath() {
-  return join22(paths.BASE_DATA_DIR, "host.lock");
-}
-function isLiveFlyspace(pid) {
-  try {
-    process.kill(pid, 0);
-    const command = execFileSync3("ps", ["-p", String(pid), "-o", "command="], {
-      encoding: "utf8"
-    });
-    return command.includes("flyspace") || command.includes("host-server");
-  } catch {
-    return false;
-  }
-}
-function readLockPid(path) {
-  try {
-    const pid = Number(JSON.parse(readFileSync15(path, "utf8")).pid);
-    return Number.isInteger(pid) && pid > 0 ? pid : null;
-  } catch {
-    return null;
-  }
-}
-function acquireHostLock() {
-  const path = hostLockPath();
-  mkdirSync10(paths.BASE_DATA_DIR, { recursive: true });
-  const body = JSON.stringify({
-    pid: process.pid,
-    startedAt: (/* @__PURE__ */ new Date()).toISOString(),
-    execPath: process.argv[1] ?? ""
-  });
-  for (let attempt = 0; attempt < 2; attempt++) {
-    try {
-      writeFileSync10(path, body, { flag: "wx", mode: 384 });
-      const release2 = () => {
-        if (readLockPid(path) === process.pid) rmSync7(path, { force: true });
-      };
-      process.once("exit", release2);
-      return release2;
-    } catch (err) {
-      if (err.code !== "EEXIST") throw err;
-      const holder = readLockPid(path);
-      if (holder === process.pid) return () => {
-      };
-      if (holder && isLiveFlyspace(holder)) {
-        throw new Error(
-          `Another Flyspace Host is already running on this machine (pid ${holder}). Stop it first, or check for a second CLI install (\`which -a flyspace\`). Two Hosts overwrite each other's skill mirror.`
-        );
-      }
-      rmSync7(path, { force: true });
-    }
-  }
-  throw new Error(`Could not take the Host lock at ${path}`);
-}
-function publishHostEndpoint(port) {
-  const path = hostLockPath();
-  if (readLockPid(path) !== process.pid) return null;
-  const token = randomBytes5(32).toString("hex");
-  const lock = JSON.parse(readFileSync15(path, "utf8"));
-  writeFileSync10(path, JSON.stringify({ ...lock, port, token }), { mode: 384 });
-  return token;
-}
-function readHostEndpoint() {
-  try {
-    const { pid, port, token } = JSON.parse(readFileSync15(hostLockPath(), "utf8"));
-    if (pid === process.pid || !Number.isInteger(port) || typeof token !== "string") return null;
-    return { port, token };
-  } catch {
-    return null;
-  }
-}
-
 // src/store/device-store.ts
 import { createHash as createHash11, createPublicKey as createPublicKey3, randomBytes as randomBytes6, randomInt } from "crypto";
 var DEVICE_CODE_TTL_MS = 10 * 6e4;
@@ -15932,7 +15950,7 @@ async function userEmail(userId) {
 
 // src/dashboard/doc-share-publisher.ts
 import { randomBytes as randomBytes7 } from "crypto";
-import { readFileSync as readFileSync16, statSync as statSync9 } from "fs";
+import { readFileSync as readFileSync17, statSync as statSync9 } from "fs";
 import { extname as extname2, posix } from "path";
 import { CopyObjectCommand, PutObjectCommand as PutObjectCommand5 } from "@aws-sdk/client-s3";
 
@@ -16119,7 +16137,7 @@ async function buildSnapshot(cwd, sourcePath, shareId) {
   }
   if (!stat.isFile()) return { status: "not-found" };
   if (stat.size > MAX_CONTENT_BYTES2) return { status: "too-large" };
-  const source = readFileSync16(abs, "utf8");
+  const source = readFileSync17(abs, "utf8");
   const title = extractTitle(abs, kind === "markdown" ? "md" : kind);
   if (kind === "excalidraw") {
     try {
@@ -16199,7 +16217,7 @@ async function buildSnapshot(cwd, sourcePath, shareId) {
       let text = null;
       try {
         const size = statSync9(docAbs).size;
-        if (size <= budget) text = readFileSync16(docAbs, "utf8");
+        if (size <= budget) text = readFileSync17(docAbs, "utf8");
       } catch {
         continue;
       }
@@ -16216,7 +16234,7 @@ async function buildSnapshot(cwd, sourcePath, shareId) {
     let body;
     try {
       if (statSync9(resolved2.abs).size > MAX_ASSET_BYTES) continue;
-      body = readFileSync16(resolved2.abs);
+      body = readFileSync17(resolved2.abs);
     } catch {
       continue;
     }
@@ -16258,7 +16276,7 @@ async function publishDocShare(input2) {
     ...HTML_FEATURES,
     brandingEnabled: resolveFeatures(input2.features, existing).brandingEnabled
   } : html ? HTML_FEATURES : resolveFeatures(input2.features, existing);
-  const snapshot3 = {
+  const snapshot2 = {
     ...built,
     sourceLang: html ? null : await detectSourceLanguage(built.title, built.content)
   };
@@ -16268,8 +16286,8 @@ async function publishDocShare(input2) {
       const renamed = await setDocShareSlug(existing.id, slug);
       if (!renamed) return { status: "not-found" };
     }
-    const share2 = await updateDocShareSnapshot(existing.id, snapshot3, features);
-    const stale = existing.assetKeys.filter((key) => !snapshot3.assetKeys.includes(key));
+    const share2 = await updateDocShareSnapshot(existing.id, snapshot2, features);
+    const stale = existing.assetKeys.filter((key) => !snapshot2.assetKeys.includes(key));
     await deleteShareAssets(stale);
     if (!features.audioEnabled && existing.audioEnabled) await dropShareAudio(existing);
     void queueShareAudio(share2);
@@ -16283,7 +16301,7 @@ async function publishDocShare(input2) {
     channelId: input2.channelId,
     sourcePath: input2.sourcePath,
     createdBy: input2.createdBy,
-    ...snapshot3,
+    ...snapshot2,
     ...features
   });
   void queueShareAudio(share);
@@ -16310,9 +16328,12 @@ var METHODS = {
   thread_replies: ["GET", "HEAD", "POST", "PATCH"],
   memberships: ["GET", "HEAD"],
   channel_members: ["GET", "HEAD"],
-  channel_docs_access: ["GET", "HEAD"]
+  channel_docs_access: ["GET", "HEAD"],
+  memories: ALL,
+  memory_events: ["GET", "HEAD", "POST", "PATCH"]
 };
 var CHANNEL_SCOPED = /* @__PURE__ */ new Set(["channel_members", "channel_docs_access"]);
+var CHANNEL_OWNED = /* @__PURE__ */ new Set(["memories", "memory_events"]);
 var FORWARDED_HEADERS2 = ["accept", "content-type", "prefer", "range"];
 var deny = (message, status = 403) => ({
   status,
@@ -16428,6 +16449,16 @@ async function proxyHostDb(workspaces, req, forward, assigned = workspaces ?? []
     if (!channelIds) return deny("Could not resolve the device workspaces.", 502);
     if (CHANNEL_SCOPED.has(table)) {
       params.append("channel_id", inList(channelIds));
+    } else if (CHANNEL_OWNED.has(table)) {
+      if (method === "POST") {
+        const ok3 = rows.length > 0 && rows.every((r) => typeof r["channel_id"] === "string" && channelIds.includes(r["channel_id"]));
+        if (!ok3) return deny(`Every ${table} row must belong to a channel of the device workspaces.`);
+      }
+      if (method === "PATCH") {
+        const patch = bodyRows(req.body);
+        if (!patch || patch.some((r) => "channel_id" in r)) return deny(`A ${table} row cannot move channels.`);
+      }
+      params.append("channel_id", inList(channelIds));
     } else if (table === "threads") {
       if (method === "POST") {
         const ok3 = rows.length > 0 && rows.every((r) => typeof r["channel_id"] === "string" && channelIds.includes(r["channel_id"]));
@@ -16490,98 +16521,6 @@ var forwardToSupabase = async (req) => {
   };
 };
 
-// src/dashboard/host-db-client.ts
-import { createClient as createClient2 } from "@supabase/supabase-js";
-import { randomUUID as randomUUID3 } from "crypto";
-var REQUEST_TIMEOUT_MS3 = 3e4;
-var pending = /* @__PURE__ */ new Map();
-var sender = null;
-var onSender = [];
-function setHostDbSender(fn) {
-  sender = fn;
-  if (!fn) return;
-  const waiting = onSender;
-  onSender = [];
-  for (const wake of waiting) wake();
-}
-function handleHostDbResult(id, res) {
-  const p = pending.get(id);
-  if (!p) return;
-  pending.delete(id);
-  clearTimeout(p.timer);
-  p.resolve(res);
-}
-function whenConnected() {
-  if (sender) return Promise.resolve(sender);
-  return new Promise((resolve7, reject) => {
-    const timer2 = setTimeout(() => {
-      onSender = onSender.filter((w) => w !== wake);
-      reject(new Error("Host is not connected to the Data API"));
-    }, REQUEST_TIMEOUT_MS3);
-    const wake = () => {
-      clearTimeout(timer2);
-      resolve7(sender);
-    };
-    onSender.push(wake);
-  });
-}
-async function request(req) {
-  const send2 = await whenConnected();
-  const id = randomUUID3();
-  return new Promise((resolve7, reject) => {
-    const timer2 = setTimeout(() => {
-      pending.delete(id);
-      reject(new Error("Data API did not answer in time"));
-    }, REQUEST_TIMEOUT_MS3);
-    pending.set(id, { resolve: resolve7, reject, timer: timer2 });
-    send2({ type: "db", id, req });
-  });
-}
-var BODYLESS_STATUS = /* @__PURE__ */ new Set([101, 204, 205, 304]);
-var hostDbFetch = async (input2, init) => {
-  const req = new Request(input2, init);
-  const url = new URL(req.url);
-  const method = req.method.toUpperCase();
-  const res = await request({
-    method,
-    path: `${url.pathname}${url.search}`,
-    headers: Object.fromEntries(req.headers.entries()),
-    body: method === "GET" || method === "HEAD" ? void 0 : await req.text()
-  });
-  const noBody = method === "HEAD" || BODYLESS_STATUS.has(res.status);
-  return new Response(noBody ? null : res.body, { status: res.status, headers: res.headers });
-};
-function relayChannel(topic) {
-  const channel = {
-    on: () => channel,
-    subscribe: (callback) => {
-      queueMicrotask(() => callback?.("SUBSCRIBED"));
-      return channel;
-    },
-    send: async (msg) => {
-      if (msg.type !== "broadcast" || !sender) return "error";
-      sender({ type: "db-broadcast", topic, event: msg.event, payload: msg.payload ?? {} });
-      return "ok";
-    },
-    unsubscribe: async () => "ok"
-  };
-  return channel;
-}
-function createHostDbClient() {
-  const client2 = createClient2("https://host-db.invalid", "host-device", {
-    auth: { persistSession: false, autoRefreshToken: false },
-    global: { fetch: hostDbFetch }
-  });
-  return new Proxy(client2, {
-    get(target, prop) {
-      if (prop === "channel") return relayChannel;
-      if (prop === "removeChannel") return async () => "ok";
-      const value = Reflect.get(target, prop, target);
-      return typeof value === "function" ? value.bind(target) : value;
-    }
-  });
-}
-
 // src/dashboard/agent-bridge.ts
 var HOST_SOCKET_PATH = "/internal/host-socket";
 var DEFAULT_DATA_API_PORT = 4757;
@@ -16609,6 +16548,7 @@ function localAgentCallbacks(chatAgent) {
     cancelAgentRun: (threadId) => chatAgent.cancel(threadId),
     regenerateAgentRun: (threadId) => chatAgent.regenerate(threadId),
     listAgentRuns: () => chatAgent.runningThreadIds(),
+    completeMemoryExtraction: (req) => chatAgent.completeMemoryExtraction(req),
     listMissingCwds: () => auditChannelCwds().map((ch) => ch.id),
     listRunningProfiles: () => listProfiles().filter(isServiceRunning2),
     getAgentIdentities: () => resolveAgentIdentities(),
@@ -16628,14 +16568,14 @@ function localAgentCallbacks(chatAgent) {
 }
 var HOST_CONFIG_PUSH_INTERVAL_MS = 6e4;
 function buildHostConfigSnapshot() {
-  const snapshot3 = {};
+  const snapshot2 = {};
   for (const profile of listProfiles()) {
-    snapshot3[profile] = runWithProfile(profile, () => ({
-      env: existsSync24(paths.CONFIG_FILE) ? dotenv.parse(readFileSync17(paths.CONFIG_FILE, "utf-8")) : {},
+    snapshot2[profile] = runWithProfile(profile, () => ({
+      env: existsSync24(paths.CONFIG_FILE) ? dotenv.parse(readFileSync18(paths.CONFIG_FILE, "utf-8")) : {},
       agentModel: loadDashboardSettings().agent
     }));
   }
-  return snapshot3;
+  return snapshot2;
 }
 function startLocalProfileConfigHydration() {
   setProfileConfigCache(buildHostConfigSnapshot());
@@ -16644,6 +16584,7 @@ function startLocalProfileConfigHydration() {
 }
 var CALL_TIMEOUT_MS = 15e3;
 var DOCS_CALL_TIMEOUT_MS = 12e4;
+var MEMORY_EXTRACTION_TIMEOUT_MS = 165e3;
 var AUTH_TIMEOUT_MS = 5e3;
 var HEARTBEAT_INTERVAL_MS = 15e3;
 var HEARTBEAT_TIMEOUT_MS = HEARTBEAT_INTERVAL_MS * 2.5;
@@ -16842,6 +16783,7 @@ function callHost(method, args, timeoutMs = CALL_TIMEOUT_MS) {
     );
     return Promise.resolve(null);
   }
+  if (method === "docsRequest") console.log(`[host-socket] docsRequest for "${profile}" -> device ${hosts.get(ws)?.deviceId ?? "legacy"}`);
   const id = randomUUID4();
   return new Promise((resolve7) => {
     const timer2 = setTimeout(() => {
@@ -16870,6 +16812,9 @@ function remoteAgentCallbacks() {
     cancelAgentRun: async (threadId) => await callHost("cancelAgentRun", [threadId]) ?? false,
     regenerateAgentRun: async (threadId) => await callHost("regenerateAgentRun", [threadId]) ?? false,
     listAgentRuns: async () => await callHost("listAgentRuns", []) ?? [],
+    // `null` (no Host, or no answer in time) passes through: the extractor
+    // reads it as a failed call and retries the thread next sweep.
+    completeMemoryExtraction: (req) => callHost("completeMemoryExtraction", [req], MEMORY_EXTRACTION_TIMEOUT_MS),
     // Deliberately passes `null` through rather than defaulting to `[]`: with
     // no Host connected, claiming every folder is fine would be a guess.
     listMissingCwds: () => callHost("listMissingCwds", []),
@@ -17066,12 +17011,13 @@ function relayedAgentCallbacks(local) {
     ...Object.fromEntries(RELAYED_METHODS.map((method) => [method, relay3(method)]))
   };
 }
-async function handleLocalRelay(req, callbacks, token) {
+function relayAuthorized(req, token) {
   const given = Buffer.from(req.headers.get("authorization") ?? "");
   const expected = Buffer.from(`Bearer ${token}`);
-  if (!token || given.length !== expected.length || !timingSafeEqual2(given, expected)) {
-    return Response.json({ error: "unauthorized" }, { status: 401 });
-  }
+  return !!token && given.length === expected.length && timingSafeEqual2(given, expected);
+}
+async function handleLocalRelay(req, callbacks, token) {
+  if (!relayAuthorized(req, token)) return Response.json({ error: "unauthorized" }, { status: 401 });
   const body = await req.json().catch(() => null);
   const method = RELAYED_METHODS.find((m) => m === body?.method);
   if (!body || !method || typeof body.profile !== "string" || !Array.isArray(body.args)) {
@@ -17354,6 +17300,7 @@ function createApiRouter(agent = {}, mode = "all") {
     const resolved2 = requested && known.includes(requested) ? requested : profileFromHost(trustedHost(c), known);
     if (!resolved2) {
       return c.json({
+        unknownWorkspace: isUnknownWorkspaceHost(trustedHost(c), known),
         theme: BRANDING_DEFAULTS.theme,
         font: BRANDING_DEFAULTS.font,
         displayName: "Flyspace",
@@ -17674,7 +17621,7 @@ function startHostStatusBroadcast() {
 
 // src/dashboard/server.ts
 var DEFAULT_DASHBOARD_PORT = 4747;
-var WEB_DIST = join23(paths.PACKAGE_ROOT, "web", "dist");
+var WEB_DIST = join24(paths.PACKAGE_ROOT, "web", "dist");
 var DEFAULT_DASHBOARD_HOST = "127.0.0.1";
 async function findFreePort(start, host = DEFAULT_DASHBOARD_HOST, attempts = 50) {
   for (let port = start; port < start + attempts; port++) {
@@ -17724,6 +17671,7 @@ async function startDashboardServer(preferredPort = DEFAULT_DASHBOARD_PORT, host
   const stopSkillSync = mirrorsSkills ? installSkillSync(listProfiles()) : () => {
   };
   const app = new Hono34();
+  app.onError(reportingErrorHandler);
   app.use("*", async (c, next) => {
     await next();
     if (c.req.path.startsWith("/assets/")) {
@@ -17738,6 +17686,20 @@ async function startDashboardServer(preferredPort = DEFAULT_DASHBOARD_PORT, host
   let relayToken = null;
   if (mode === "host") {
     app.post(LOCAL_RELAY_PATH, (c) => handleLocalRelay(c.req.raw, agent, relayToken));
+    if (earlyHostSocket) {
+      app.post(LOCAL_DB_PATH, async (c) => {
+        if (!relayAuthorized(c.req.raw, relayToken)) return c.json({ error: "unauthorized" }, 401);
+        const req = await c.req.json().catch(() => null);
+        if (!req || typeof req.method !== "string" || typeof req.path !== "string") {
+          return c.json({ error: "bad request" }, 400);
+        }
+        try {
+          return c.json(await requestHostDb(req));
+        } catch (err) {
+          return c.json({ error: err.message }, 503);
+        }
+      });
+    }
   }
   app.route("/stripe", createStripeWebhookRouter());
   if (!servesHost) {
@@ -17748,14 +17710,14 @@ async function startDashboardServer(preferredPort = DEFAULT_DASHBOARD_PORT, host
   } else {
     app.route("/share", createPublicShareAssetRouter(WEB_DIST));
     app.route("/", createAppIconRouter());
-    if (existsSync25(WEB_DIST) || existsSync25(join23(paths.PACKAGE_ROOT, "web", "package.json"))) {
+    if (existsSync25(WEB_DIST) || existsSync25(join24(paths.PACKAGE_ROOT, "web", "package.json"))) {
       app.use("/*", serveStatic({ root: WEB_DIST }));
     }
     app.get("/assets/*", (c) => c.text("stale asset \u2014 reload for the current build", 404));
-    const spaFallback = serveStatic({ path: join23(WEB_DIST, "index.html") });
+    const spaFallback = serveStatic({ path: join24(WEB_DIST, "index.html") });
     app.get("*", async (c, next) => {
-      if (!existsSync25(join23(WEB_DIST, "index.html"))) {
-        const isCheckout = existsSync25(join23(paths.PACKAGE_ROOT, "web", "package.json"));
+      if (!existsSync25(join24(WEB_DIST, "index.html"))) {
+        const isCheckout = existsSync25(join24(paths.PACKAGE_ROOT, "web", "package.json"));
         return c.text(
           isCheckout ? `Workspace UI build missing (${WEB_DIST}).
 Run \`pnpm --dir web build\` (or \`pnpm --dir web dev\`).
@@ -18193,7 +18155,7 @@ async function threadReplies(client2, nameOrId, ts2) {
 async function postMessage(client2, args) {
   const channelArg = getArg2(args, "--channel");
   const textFilePath = getArg2(args, "--text-file");
-  const text = textFilePath ? readFileSync18(textFilePath, "utf8") : getArg2(args, "--text");
+  const text = textFilePath ? readFileSync19(textFilePath, "utf8") : getArg2(args, "--text");
   const threadTs = getArg2(args, "--thread");
   const markdown = args.includes("--markdown");
   const broadcast = args.includes("--broadcast") && Boolean(threadTs);
@@ -18348,7 +18310,7 @@ async function ensureClaudeCodeReady() {
 }
 function getManifestYaml(botName) {
   const manifestPath = resolve6(paths.PACKAGE_ROOT, "slack-app-manifest.yml");
-  const raw = readFileSync18(manifestPath, "utf-8");
+  const raw = readFileSync19(manifestPath, "utf-8");
   return raw.replace(/name: Custie/g, `name: ${botName}`);
 }
 async function stepPersonalise() {
@@ -18561,7 +18523,7 @@ async function stepBrowserTokens(botName) {
     })
   ));
   const DEBUG = process.argv.includes("--debug");
-  const USER_DATA_DIR = resolve6(tmpdir4(), "custie-playwright-profile");
+  const USER_DATA_DIR = resolve6(tmpdir5(), "custie-playwright-profile");
   let context;
   try {
     log4("Opening browser \u2014 a Slack login page will appear.\n");
@@ -18780,7 +18742,7 @@ function copyDefaultPrompt(botName) {
   if (!existsSync26(paths.PROMPT_FILE)) {
     const defaultPrompt = resolve6(paths.PACKAGE_ROOT, "system.default.md");
     if (existsSync26(defaultPrompt)) {
-      const content = readFileSync18(defaultPrompt, "utf-8").replace(/\{\{botName\}\}/g, botName);
+      const content = readFileSync19(defaultPrompt, "utf-8").replace(/\{\{botName\}\}/g, botName);
       writeFileSync11(paths.PROMPT_FILE, content);
       success4(`Default prompt copied to ${paths.PROMPT_FILE}`);
     }
@@ -19075,6 +19037,7 @@ async function runPost(args) {
 }
 async function runChatCmd(args) {
   loadEnvFiles();
+  useHostDbWithoutCredentials();
   const subcommand = args[0];
   const rest = args.slice(1);
   switch (subcommand) {
@@ -19103,21 +19066,21 @@ async function runChatCmd(args) {
 }
 
 // src/commands/memory.ts
-import { readFileSync as readFileSync20 } from "fs";
+import { readFileSync as readFileSync21 } from "fs";
 
 // src/store/claude-memory-import.ts
-import { existsSync as existsSync27, readdirSync as readdirSync5, readFileSync as readFileSync19 } from "fs";
+import { existsSync as existsSync27, readdirSync as readdirSync5, readFileSync as readFileSync20 } from "fs";
 import { homedir as homedir10 } from "os";
-import { basename as basename8, join as join24 } from "path";
+import { basename as basename8, join as join25 } from "path";
 import dotenv2 from "dotenv";
 function claudeMemoryDir(cwd, configDir2) {
-  return join24(configDir2, "projects", cwd.replaceAll(/[^a-zA-Z0-9]/g, "-"), "memory");
+  return join25(configDir2, "projects", cwd.replaceAll(/[^a-zA-Z0-9]/g, "-"), "memory");
 }
 function profileClaudeConfigDirFor(profile) {
-  const dir = profile === "default" ? paths.BASE_CONFIG_DIR : join24(paths.PROFILES_DIR, profile);
-  const file = join24(dir, "config.env");
-  const env = existsSync27(file) ? dotenv2.parse(readFileSync19(file)) : {};
-  return env["CLAUDE_CONFIG_DIR"]?.trim() || join24(homedir10(), ".claude");
+  const dir = profile === "default" ? paths.BASE_CONFIG_DIR : join25(paths.PROFILES_DIR, profile);
+  const file = join25(dir, "config.env");
+  const env = existsSync27(file) ? dotenv2.parse(readFileSync20(file)) : {};
+  return env["CLAUDE_CONFIG_DIR"]?.trim() || join25(homedir10(), ".claude");
 }
 var TYPE_MAP = {
   user: "preference",
@@ -19125,7 +19088,7 @@ var TYPE_MAP = {
   project: "fact",
   reference: "reference"
 };
-var DESCRIPTION_MAX2 = 200;
+var DESCRIPTION_MAX = 200;
 function unquote2(value) {
   const v = value.trim();
   return /^(["']).*\1$/.test(v) ? v.slice(1, -1) : v;
@@ -19143,8 +19106,8 @@ function parseClaudeMemory(fileName, text, channelId) {
   }
   const name = slugify(fields["name"] || basename8(fileName, ".md"));
   let description = (fields["description"] ?? "").replaceAll(/\s+/g, " ").trim();
-  if (description.length > DESCRIPTION_MAX2) {
-    description = `${description.slice(0, DESCRIPTION_MAX2 - 3).trimEnd()}...`;
+  if (description.length > DESCRIPTION_MAX) {
+    description = `${description.slice(0, DESCRIPTION_MAX - 3).trimEnd()}...`;
   }
   const input2 = {
     channelId,
@@ -19166,7 +19129,7 @@ async function importClaudeMemories(dir, channelId, opts = {}) {
   const files = readdirSync5(dir).filter((f) => f.endsWith(".md") && f !== "MEMORY.md").sort();
   const results = [];
   for (const file of files) {
-    const parsed = parseClaudeMemory(file, readFileSync19(join24(dir, file), "utf-8"), channelId);
+    const parsed = parseClaudeMemory(file, readFileSync20(join25(dir, file), "utf-8"), channelId);
     if ("skip" in parsed) {
       results.push({ file, outcome: "skipped", reason: parsed.skip });
       continue;
@@ -19220,6 +19183,7 @@ function indexLine(m) {
 }
 async function runMemoryCmd(args) {
   loadEnvFiles();
+  useHostDbWithoutCredentials();
   const subcommand = args[0];
   const rest = args.slice(1);
   if (!subcommand || subcommand === "-h" || subcommand === "--help") {
@@ -19265,7 +19229,7 @@ ${memory.body}`);
         );
       }
       if (!isMemoryType(type)) throw new Error(`--type must be one of ${MEMORY_TYPES.join(", ")}`);
-      const body = bodyArg === "-" ? readFileSync20(0, "utf-8") : bodyArg;
+      const body = bodyArg === "-" ? readFileSync21(0, "utf-8") : bodyArg;
       const thread = getArg4(rest, "--thread");
       const { created, changed } = await saveChannelMemory(
         {
@@ -19349,10 +19313,10 @@ async function runMcpCmd(args) {
 }
 
 // src/commands/dashboard.ts
-import { spawn as spawn5, spawnSync } from "child_process";
+import { spawn as spawn6, spawnSync } from "child_process";
 import { existsSync as existsSync28 } from "fs";
 import { platform as platform7 } from "os";
-import { join as join25 } from "path";
+import { join as join26 } from "path";
 function flagValue(args, name) {
   const eq = args.find((a) => a.startsWith(`--${name}=`));
   if (eq) return eq.slice(`--${name}=`.length);
@@ -19362,13 +19326,13 @@ function flagValue(args, name) {
 function openBrowser2(url) {
   const cmd = platform7() === "darwin" ? "open" : platform7() === "win32" ? "start" : "xdg-open";
   try {
-    spawn5(cmd, [url], { stdio: "ignore", detached: true }).unref();
+    spawn6(cmd, [url], { stdio: "ignore", detached: true }).unref();
   } catch {
   }
 }
 function ensureWebBuild() {
-  if (existsSync28(join25(paths.PACKAGE_ROOT, "web", "dist", "index.html"))) return;
-  if (!existsSync28(join25(paths.PACKAGE_ROOT, "web", "package.json"))) return;
+  if (existsSync28(join26(paths.PACKAGE_ROOT, "web", "dist", "index.html"))) return;
+  if (!existsSync28(join26(paths.PACKAGE_ROOT, "web", "package.json"))) return;
   console.log("  web/dist missing \u2014 building the dashboard UI (pnpm --dir web build)...");
   const result = spawnSync("pnpm", ["--dir", "web", "build"], {
     cwd: paths.PACKAGE_ROOT,
@@ -19731,7 +19695,7 @@ async function main() {
       break;
     case "-v":
     case "--version":
-      printRaw("0.1.13");
+      printRaw("0.1.15");
       break;
     case "-h":
     case "--help":