flyspace-cli 0.1.14 → 0.1.16

package/dist/cli.js

@@ -5,6 +5,7 @@ import {
   BOT_PROFILE_KEY,
   BRANDING_DEFAULTS,
   BUILT_IN_OUTPUT_STYLES,
+  ChannelCwdError,
   DEFAULT_CODEX_MODEL,
   DEFAULT_TIMEZONE,
   DEFAULT_TITLE_RULES,
@@ -13,6 +14,7 @@ import {
   HandleTakenError,
   InvalidTransferError,
   LastAdminError,
+  MEMORY_TYPES,
   MessageQueue,
   OutputStyleConflictError,
   SKIP_SUBTYPES,
@@ -33,18 +35,23 @@ import {
   canSeeChannel,
   channelSkillsDir,
   claudeAuthFailed,
+  clearClaudeAuthFailed,
   codexAuthAvailable,
   createChannel,
   createMembership,
   createOutputStyle,
   createSkillFile,
   createWorkspace,
+  deleteChannelMemory,
   deleteMembership,
+  deleteMemory,
   deleteOutputStyle,
   deleteSkillFile,
   deleteWorkspace,
+  disableFeatureFlag,
   displayNameFor,
   docsAccessPromptNote,
+  enableFeatureFlag,
   ensureAgentDmChannel,
   ensureGeneralChannel,
   ensureLogicalCwdDir,
@@ -52,15 +59,19 @@ import {
   ensureUsersCached,
   expandPath,
   extractCategories,
+  featureFlagIds,
+  featureFlags,
   findChannel,
   findChannelByAgentName,
   findChannelById,
   findSkillDetail,
   getAgentPaused,
   getAllowGuestAccess,
+  getChannelMemory,
   getChannelRegistry,
   getMembershipByEmail,
   getMembershipByUserId,
+  getMemory,
   getOutputStyleDefault,
   getProfileChannelRegistry,
   getWorkspaceBilling,
@@ -75,21 +86,31 @@ import {
   isCodexModel,
   isCwdUsable,
   isEffort,
+  isFeatureFlagId,
+  isFeatureVisible,
   isLockedPlan,
   isLogicalCwd,
+  isMemoryType,
+  isUuid,
   isValidSkillName,
   lastRunsForWorkspace,
   listActiveUsers,
+  listChannelMemories,
+  listEnabledFeatureFlags,
   listMemberChannels,
   listMemberships,
   listMembershipsByEmail,
+  listMemories,
+  listMemoryEvents,
   listOutputStyles,
   listPluginSkillDetails,
   listSkillFiles,
   listSkills,
+  listThreadMemoryEvents,
   listUsersWithAvatars,
   listWorkspaceSummaries,
   listWorkspaces,
+  loadAgentMemory,
   loadAutomations,
   loadAutomationsFile,
   loadBotIdentity,
@@ -103,6 +124,7 @@ import {
   localDefaults,
   lookupById,
   markInviteResent,
+  markMemoryUsed,
   markWorkspaceAgentConnected,
   markWorkspaceGreeted,
   markWorkspaceProjectsSetup,
@@ -111,6 +133,7 @@ import {
   mimetypeSizeLimit,
   modelLabel,
   pinnedClaudeConfigDir,
+  promoteChannelMemory,
   readSkillFile,
   recentRunsForWorkspace,
   refreshAutomationRegistry,
@@ -122,6 +145,7 @@ import {
   resolveChannelId,
   resolveChannelPrompt,
   resolveCwd,
+  resolveFeatureFlags,
   resolveLogicalCwd,
   resolveSelectedOutputStyle,
   resolveUserId,
@@ -130,12 +154,16 @@ import {
   runnerForModel,
   saveAgentProfile,
   saveBotIdentity,
+  saveChannelMemory,
   saveDashboardSettings,
+  saveMemory,
   saveWorkspaceBranding,
   saveWorkspacePrompt,
+  searchMemories,
   setAgentPaused,
   setAllowGuestAccess,
   setMembershipHandle,
+  setMemoryAutoPaused,
   setOutputStyleDefault,
   setWorkspaceStripeSubscription,
   slackConfigured,
@@ -145,17 +173,21 @@ import {
   syncSlackAvatars,
   transferWorkspaceAdmin,
   tsToIso,
+  undoMemoryEvent,
   updateChannelById,
+  updateChannelMemory,
   updateChannelsMcpConnections,
   updateMembershipRole,
+  updateMemory,
   updateOutputStyle,
   updateWorkspacePlanStatus,
   usageLimitedModels,
   usageLimitedUntil,
+  validateMemoryInput,
   warnOnBrokenChannelCwds,
   workspaceSkillsDir,
   writeSkillFile
-} from "./chunk-DA7SYYKU.js";
+} from "./chunk-2OGLCT7I.js";
 import {
   firstReplyBody,
   getThread,
@@ -614,8 +646,8 @@ async function requestHostDb(req) {
 }
 var BODYLESS_STATUS = /* @__PURE__ */ new Set([101, 204, 205, 304]);
 function dbFetch(send2) {
-  return async (input2, init) => {
-    const req = new Request(input2, init);
+  return async (input2, init2) => {
+    const req = new Request(input2, init2);
     const url = new URL(req.url);
     const method = req.method.toUpperCase();
     const res = await send2({
@@ -678,11 +710,17 @@ function createHostDbClient(via = "socket") {
   });
 }
 
+// src/commands/supabase-via-host.ts
+function useHostDbWithoutCredentials() {
+  const viaHost = !hasSupabaseCredentials() && !!loadCredentials();
+  if (viaHost) setSupabaseClient(createHostDbClient("local-host"));
+  return viaHost;
+}
+
 // src/commands/start.ts
 async function runStart() {
   loadEnvFiles();
-  const viaHost = !hasSupabaseCredentials() && !!loadCredentials();
-  if (viaHost) setSupabaseClient(createHostDbClient("local-host"));
+  const viaHost = useHostDbWithoutCredentials();
   await preflight({ supabaseViaHost: viaHost });
   await startServer();
 }
@@ -1321,14 +1359,14 @@ function detectRunners(history = { claude: false, codex: false }) {
 function scanOnboarding() {
   const byPath = /* @__PURE__ */ new Map();
   const history = { claude: false, codex: false };
-  const add = (rawPath, source, mtime, sessions, trusted = false) => {
+  const add = (rawPath, source, mtime, sessions2, trusted = false) => {
     const path = resolve3(rawPath);
     if (isExcluded(path)) return;
     const existing = byPath.get(path);
     if (existing) {
       if (!existing.sources.includes(source)) existing.sources.push(source);
       existing.lastUsed = Math.max(existing.lastUsed, mtime);
-      existing.sessions += sessions;
+      existing.sessions += sessions2;
       existing.trusted ||= trusted;
     } else {
       byPath.set(path, {
@@ -1336,7 +1374,7 @@ function scanOnboarding() {
         name: basename2(path),
         sources: [source],
         lastUsed: mtime,
-        sessions,
+        sessions: sessions2,
         trusted
       });
     }
@@ -1738,7 +1776,7 @@ async function runAuthCmd(args) {
 }
 
 // src/version.ts
-var CLI_VERSION = true ? "0.1.14" : null;
+var CLI_VERSION = true ? "0.1.16" : null;
 function isOlderVersion(a, b) {
   const parse2 = (v) => v.replace(/^v/, "").split("-")[0].split(".").map(Number);
   const [pa, pb] = [parse2(a), parse2(b)];
@@ -1893,9 +1931,9 @@ import { tmpdir } from "os";
 import { promisify } from "util";
 var execAsync = promisify(execFile);
 var exec = (cmd, args, opts) => {
-  const run3 = execAsync(cmd, args, opts);
-  run3.child.stdin?.end();
-  return run3;
+  const run4 = execAsync(cmd, args, opts);
+  run4.child.stdin?.end();
+  return run4;
 };
 var BOLD3 = "\x1B[1m";
 var DIM3 = "\x1B[2m";
@@ -2016,7 +2054,7 @@ ${BOLD3}Flyspace Doctor${RESET3}
 }
 
 // src/commands/uninstall.ts
-import { existsSync as existsSync7, readFileSync as readFileSync8, rmSync as rmSync4, unlinkSync as unlinkSync2, writeFileSync as writeFileSync6 } from "fs";
+import { existsSync as existsSync7, mkdirSync as mkdirSync7, readFileSync as readFileSync8, rmSync as rmSync4, unlinkSync as unlinkSync2, writeFileSync as writeFileSync6 } from "fs";
 import { confirm as confirm3 } from "@inquirer/prompts";
 import { execSync as execSync5 } from "child_process";
 import { basename as basename3, join as join9 } from "path";
@@ -2083,12 +2121,31 @@ async function runUninstall(args = []) {
   console.log("    - revokes this device and removes every background service");
   for (const t of targets) console.log(`    - deletes ${t}`);
   console.log("  Your channel folders (~/Flyspace) are kept.\n");
-  if (!args.includes("--yes") && !args.includes("-y")) {
+  const backupSources = [paths.BASE_CONFIG_DIR, paths.BASE_DATA_DIR].filter(existsSync7);
+  const interactive = !args.includes("--yes") && !args.includes("-y");
+  let backup = !args.includes("--no-backup") && backupSources.length > 0;
+  if (interactive) {
+    if (backup) backup = await confirm3({ message: "Back up local data first?", default: true });
     if (!await confirm3({ message: "Continue?", default: false })) {
       console.log("  Cancelled.");
       return;
     }
   }
+  let backupFile;
+  if (backup) {
+    const dir = join9(homedir4(), "Flyspace", ".uninstall-backups");
+    mkdirSync7(dir, { recursive: true });
+    const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+    backupFile = join9(dir, `flyspace-${stamp}.tar.gz`);
+    const rel = backupSources.map((s) => `"${s.replace(/^\//, "")}"`).join(" ");
+    try {
+      run2(`tar -czf "${backupFile}" -C / ${rel}`);
+      success2(`Backup saved to ${backupFile}`);
+    } catch (err) {
+      warn2(`Backup failed, nothing was removed: ${err.message}`);
+      return;
+    }
+  }
   const creds = loadCredentials();
   if (creds) {
     try {
@@ -2115,7 +2172,11 @@ async function runUninstall(args = []) {
       success2(`Removed PATH entry from ${rc}`);
     }
   }
-  console.log("\n  Flyspace is uninstalled. Open a new terminal to finish.\n");
+  console.log("\n  Flyspace is uninstalled. Open a new terminal to finish.");
+  if (backupFile) {
+    console.log(`  To restore your local data after reinstalling: tar -xzf "${backupFile}" -C /`);
+  }
+  console.log("");
 }
 
 // src/commands/profiles-cmd.ts
@@ -2230,7 +2291,7 @@ function npmEnv() {
   return home ? { ...process.env, PATH: `${join10(home, "node", "bin")}:${process.env.PATH ?? ""}` } : process.env;
 }
 async function runUpgrade() {
-  const current = "0.1.14";
+  const current = "0.1.16";
   console.log(`Current version: ${current}`);
   console.log("Checking for updates...\n");
   try {
@@ -2550,6 +2611,7 @@ async function handleImport(manager) {
 async function runAutomationCmd(args) {
   const subcommand = args[0];
   loadEnvFiles();
+  useHostDbWithoutCredentials();
   await refreshChannelRegistry();
   await refreshAutomationRegistry();
   const manager = new AutomationManager();
@@ -2870,9 +2932,9 @@ async function runLogs(args) {
 
 // src/commands/slack.ts
 import { execFileSync as execFileSync4 } from "child_process";
-import { existsSync as existsSync26, readFileSync as readFileSync18, writeFileSync as writeFileSync11 } from "fs";
+import { existsSync as existsSync27, readFileSync as readFileSync20, writeFileSync as writeFileSync12 } from "fs";
 import { resolve as resolve6 } from "path";
-import { tmpdir as tmpdir4, homedir as homedir9 } from "os";
+import { tmpdir as tmpdir5, homedir as homedir9 } from "os";
 import { input, confirm as confirm4, select, checkbox } from "@inquirer/prompts";
 import { WebClient as WebClient3 } from "@slack/web-api";
 
@@ -3427,6 +3489,13 @@ function profileFromHost(host, known) {
   const bare = label2.startsWith("api-") ? label2.slice(4) : label2.startsWith("dev-") ? label2.slice(4) : label2;
   return known.includes(bare) ? bare : null;
 }
+function isUnknownWorkspaceHost(host, known) {
+  const name = bareHost(host);
+  if (!name?.endsWith(".flyspace.ai")) return false;
+  const label2 = subdomainLabel(host);
+  if (!label2 || label2 === "dev-admin") return false;
+  return profileFromHost(host, known) === null;
+}
 function workspaceHostname(host, profile) {
   const name = bareHost(host);
   if (!name || !subdomainLabel(host)) return null;
@@ -3837,7 +3906,9 @@ function getStripeClient() {
 
 // src/store/stripe-trial.ts
 var PLAN_INFO = {
-  local: { name: "Local Agent", priceUsd: 9 },
+  // Single-member: a personal Claude subscription can't be shared (see
+  // members-routes.ts, which blocks invites on this plan).
+  local: { name: "Solo", priceUsd: 29 },
   cloud: { name: "Cloud Agent", priceUsd: 49 }
 };
 function priceIdForPlan(plan) {
@@ -3862,6 +3933,7 @@ async function startWorkspaceTrial(workspace, plan, ownerEmail) {
     metadata: { workspace_id: workspace.id, plan }
   });
   await setWorkspaceStripeSubscription(workspace.id, {
+    plan,
     stripeCustomerId: customer.id,
     stripeSubscriptionId: subscription.id,
     planStatus: "trialing"
@@ -4398,15 +4470,27 @@ async function deliverPasswordResetLink(email, redirectTo) {
 }
 
 // src/dashboard/server.ts
-import { existsSync as existsSync25 } from "fs";
+import { existsSync as existsSync26 } from "fs";
 import { createServer } from "net";
-import { join as join23 } from "path";
-import { Hono as Hono34 } from "hono";
+import { join as join25 } from "path";
+import { Hono as Hono35 } from "hono";
+
+// src/dashboard/sentry.ts
+import * as Sentry from "@sentry/node";
+import { HTTPException } from "hono/http-exception";
+var reportingErrorHandler = (err, c) => {
+  if (err instanceof HTTPException) return err.getResponse();
+  Sentry.captureException(err, { extra: { method: c.req.method, path: c.req.path } });
+  console.error(err);
+  return c.text("Internal Server Error", 500);
+};
+
+// src/dashboard/server.ts
 import { serve } from "@hono/node-server";
 import { serveStatic } from "@hono/node-server/serve-static";
 
 // src/reconcile.ts
-import { existsSync as existsSync10, mkdirSync as mkdirSync7, writeFileSync as writeFileSync7 } from "fs";
+import { existsSync as existsSync10, mkdirSync as mkdirSync8, writeFileSync as writeFileSync7 } from "fs";
 async function boundWorkspaces2() {
   return (await boundWorkspaces())?.workspaces ?? null;
 }
@@ -4432,7 +4516,7 @@ async function reconcileProfile(profile) {
       if (!channel.cwd) continue;
       const cwd = expandPath(channel.cwd);
       if (isCwdUsable(cwd)) continue;
-      mkdirSync7(cwd, { recursive: true });
+      mkdirSync8(cwd, { recursive: true });
       log5.push(`channel "${channel.name}" cwd created (${cwd})`);
     }
     return log5;
@@ -4506,45 +4590,18 @@ var RANK = { none: 0, read: 1, write: 2 };
 function docsAccessAtLeast(have, need) {
   return RANK[have] >= RANK[need];
 }
-function isDocsGrant(value) {
-  return value === "read" || value === "write";
-}
-function rowToGrant(row) {
-  return {
-    id: row["id"],
-    channelId: row["channel_id"],
-    membershipId: row["membership_id"],
-    access: row["access"],
-    grantedAt: row["granted_at"]
-  };
-}
-async function listChannelDocsAccess(channelId) {
-  const { data, error: error2 } = await getSupabaseClient().from("channel_docs_access").select("*").eq("channel_id", channelId).order("granted_at", { ascending: true });
-  if (error2) throw new Error(`listChannelDocsAccess(${channelId}): ${error2.message}`);
-  return (data ?? []).map(rowToGrant);
+function isDocsAccess(value) {
+  return value === "none" || value === "read" || value === "write";
 }
-async function getChannelDocsGrant(channelId, membershipId) {
-  const { data, error: error2 } = await getSupabaseClient().from("channel_docs_access").select("*").eq("channel_id", channelId).eq("membership_id", membershipId).maybeSingle();
-  if (error2) throw new Error(`getChannelDocsGrant(${channelId}, ${membershipId}): ${error2.message}`);
-  return data ? rowToGrant(data) : null;
+async function getChannelDocsMemberAccess(channelId) {
+  const { data, error: error2 } = await getSupabaseClient().from("channels").select("docs_member_access").eq("id", channelId).maybeSingle();
+  if (error2) throw new Error(`getChannelDocsMemberAccess(${channelId}): ${error2.message}`);
+  const level = data?.docs_member_access;
+  return isDocsAccess(level) ? level : "none";
 }
-async function upsertChannelDocsAccess(params) {
-  const { data, error: error2 } = await getSupabaseClient().from("channel_docs_access").upsert(
-    { channel_id: params.channelId, membership_id: params.membershipId, access: params.access },
-    { onConflict: "channel_id,membership_id" }
-  ).select("*").single();
-  if (error2) {
-    throw new Error(
-      `upsertChannelDocsAccess(${params.channelId}, ${params.membershipId}): ${error2.message}`
-    );
-  }
-  return rowToGrant(data);
-}
-async function removeChannelDocsAccess(channelId, membershipId) {
-  const { data, error: error2 } = await getSupabaseClient().from("channel_docs_access").delete().eq("channel_id", channelId).eq("membership_id", membershipId).select("id");
-  if (error2) {
-    throw new Error(`removeChannelDocsAccess(${channelId}, ${membershipId}): ${error2.message}`);
-  }
+async function setChannelDocsMemberAccess(channelId, access) {
+  const { data, error: error2 } = await getSupabaseClient().from("channels").update({ docs_member_access: access }).eq("id", channelId).select("id");
+  if (error2) throw new Error(`setChannelDocsMemberAccess(${channelId}): ${error2.message}`);
   return data?.length ? true : false;
 }
 async function resolveForMembership(membership, channelId) {
@@ -4553,8 +4610,7 @@ async function resolveForMembership(membership, channelId) {
   if (members.some((m) => m.membershipId === membership.id && m.role === "channel_admin")) {
     return "write";
   }
-  const grant = await getChannelDocsGrant(channelId, membership.id);
-  return grant?.access ?? "none";
+  return getChannelDocsMemberAccess(channelId);
 }
 async function resolveDocsAccess(ctx, channelId) {
   if (ctx.role === "admin") return "write";
@@ -4576,15 +4632,16 @@ async function filterReadableDocsChannels(ctx, channelIds) {
   if (ctx.role === "admin") return new Set(channelIds);
   const membership = await getMembershipByUserId(ctx.workspaceId, ctx.userId);
   if (!membership) return /* @__PURE__ */ new Set();
+  if (channelIds.length === 0) return /* @__PURE__ */ new Set();
   const db = getSupabaseClient();
-  const [grants, roles] = await Promise.all([
-    db.from("channel_docs_access").select("channel_id").eq("membership_id", membership.id),
+  const [open, roles] = await Promise.all([
+    db.from("channels").select("id").in("id", channelIds).neq("docs_member_access", "none"),
     db.from("channel_members").select("channel_id, role").eq("membership_id", membership.id)
   ]);
-  if (grants.error) throw new Error(`filterReadableDocsChannels: ${grants.error.message}`);
+  if (open.error) throw new Error(`filterReadableDocsChannels: ${open.error.message}`);
   if (roles.error) throw new Error(`filterReadableDocsChannels: ${roles.error.message}`);
   const allowed = /* @__PURE__ */ new Set();
-  for (const r of grants.data ?? []) allowed.add(r.channel_id);
+  for (const r of open.data ?? []) allowed.add(r.id);
   for (const r of roles.data ?? []) {
     if (r.role === "channel_admin") allowed.add(r.channel_id);
   }
@@ -4603,7 +4660,7 @@ var requireDocsAccess = async (c, next) => {
 };
 
 // src/dashboard/api.ts
-import { Hono as Hono31 } from "hono";
+import { Hono as Hono32 } from "hono";
 
 // src/dashboard/public-share-routes.ts
 import { existsSync as existsSync11, readFileSync as readFileSync10, statSync as statSync3 } from "fs";
@@ -4747,15 +4804,15 @@ async function createDocShare(input2) {
   if (error2) throw new Error(`createDocShare(${input2.sourcePath}): ${error2.message}`);
   return rowToShare(data);
 }
-async function updateDocShareSnapshot(id, snapshot3, features) {
+async function updateDocShareSnapshot(id, snapshot2, features) {
   const { data, error: error2 } = await getSupabaseClient().from("doc_shares").update({
-    title: snapshot3.title,
-    content: snapshot3.content,
-    asset_keys: snapshot3.assetKeys,
+    title: snapshot2.title,
+    content: snapshot2.content,
+    asset_keys: snapshot2.assetKeys,
     // Re-detected with the snapshot: a re-publish can carry a rewritten
     // article, and one written in another language than last time is exactly
     // the case a stale value would get wrong.
-    source_lang: snapshot3.sourceLang,
+    source_lang: snapshot2.sourceLang,
     audio_enabled: features.audioEnabled,
     ask_enabled: features.askEnabled,
     social_enabled: features.socialEnabled,
@@ -5683,9 +5740,9 @@ async function synthesizeWithRetry(script, voice) {
 }
 var renderQueue = Promise.resolve();
 function queued(job) {
-  const run3 = renderQueue.then(job, job);
-  renderQueue = run3.catch(() => void 0);
-  return run3;
+  const run4 = renderQueue.then(job, job);
+  renderQueue = run4.catch(() => void 0);
+  return run4;
 }
 function renderArticleAudio(title, content, lang) {
   return queued(() => renderArticleAudioNow(title, content, lang));
@@ -5759,12 +5816,12 @@ function queueShareAudio(share) {
   }
   const current = inFlight2.get(share.id);
   if (current?.hash === hash) return current.done;
-  const run3 = () => runShareAudioJob(share, hash).catch((err) => {
+  const run4 = () => runShareAudioJob(share, hash).catch((err) => {
     console.error(`share audio job crashed (${share.id}):`, err);
   }).finally(() => {
     if (inFlight2.get(share.id)?.hash === hash) inFlight2.delete(share.id);
   });
-  const done = current ? current.done.then(run3) : run3();
+  const done = current ? current.done.then(run4) : run4();
   inFlight2.set(share.id, { hash, done });
   return done;
 }
@@ -6689,8 +6746,8 @@ function routeCookieWrites(all, label2, writes) {
 
 // src/dashboard/supabase-server-client.ts
 var REQUEST_TIMEOUT_MS2 = 5e3;
-function fetchWithTimeout(input2, init) {
-  return fetch(input2, { ...init, signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS2) });
+function fetchWithTimeout(input2, init2) {
+  return fetch(input2, { ...init2, signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS2) });
 }
 function createRequestSupabaseClient(c) {
   const url = process.env["SUPABASE_URL"];
@@ -6732,7 +6789,7 @@ function createRequestSupabaseClient(c) {
 }
 
 // src/dashboard/auth-context.ts
-import { HTTPException } from "hono/http-exception";
+import { HTTPException as HTTPException2 } from "hono/http-exception";
 import { isAuthApiError, isAuthRetryableFetchError } from "@supabase/supabase-js";
 function onboardingPending(ctx) {
   const pending3 = [];
@@ -6789,10 +6846,10 @@ async function resolveAuthContextUncached(c) {
     } = await getUserWithRetry(supabase));
   } catch (err) {
     if (isAuthRetryableFetchError(err)) {
-      throw new HTTPException(503, { message: "auth service unreachable" });
+      throw new HTTPException2(503, { message: "auth service unreachable" });
     }
     if (isAuthApiError(err) && err.status === 429) {
-      throw new HTTPException(503, { message: "auth service rate limited" });
+      throw new HTTPException2(503, { message: "auth service rate limited" });
     }
     return null;
   }
@@ -7201,91 +7258,16 @@ async function offlineAgentIdentities() {
 }
 
 // src/dashboard/host-api.ts
-import { existsSync as existsSync20, readFileSync as readFileSync14, statSync as statSync8 } from "fs";
-import { join as join21 } from "path";
+import { existsSync as existsSync21, readFileSync as readFileSync16, statSync as statSync8 } from "fs";
+import { join as join23 } from "path";
 import sharp3 from "sharp";
 
 // src/dashboard/channels-routes.ts
-import { existsSync as existsSync12, mkdirSync as mkdirSync8 } from "fs";
+import { existsSync as existsSync12, mkdirSync as mkdirSync9 } from "fs";
 import { Hono as Hono9 } from "hono";
 
 // src/dashboard/feature-flags-routes.ts
 import { Hono as Hono8 } from "hono";
-
-// src/feature-flags.ts
-var featureFlags = {
-  "ai-cost": {
-    title: "AI cost",
-    description: "Shows admins what the agent has spent: a Cost section in a channel's AI overview and a per-thread cost in the thread menu. Estimated at API list rates, so on a Claude subscription it will not match your bill.",
-    stage: "beta"
-  },
-  "read-aloud": {
-    title: "Read aloud",
-    description: "Listen to messages, threads and docs as audio. Still rough in places, and each playback uses text-to-speech.",
-    stage: "beta"
-  },
-  excalidraw: {
-    title: "Excalidraw",
-    description: "Create and edit whiteboard drawings (.excalidraw files) in the Docs pane. Existing drawings stay viewable with this off.",
-    stage: "beta"
-  },
-  sandbox: {
-    title: "Sandbox runtime",
-    description: "Run a channel agent in an isolated sandbox without Docker. Channels already on Sandbox keep working with this off.",
-    stage: "beta"
-  },
-  dictation: {
-    title: "Dictation",
-    description: "A mic button in the message composer that turns speech into text as you talk. Each phrase uses speech-to-text.",
-    stage: "dev"
-  },
-  "agent-memory": {
-    title: "Agent memory",
-    description: "Channel memory the agent reads every turn, saved by the agent and picked up from idle threads, with a Memory tab and an undo chip. While on, Claude's built-in auto memory is switched off so the two can be compared; turning this off keeps every memory.",
-    stage: "beta"
-  }
-};
-var featureFlagIds = Object.keys(featureFlags);
-function isFeatureFlagId(id) {
-  return Object.hasOwn(featureFlags, id);
-}
-function isFeatureVisible(stage, devHost) {
-  return stage === "beta" || stage === "dev" && devHost;
-}
-function resolveFeatureFlags(enabledIds, devHost) {
-  const enabled = new Set(enabledIds);
-  const out = {};
-  for (const id of featureFlagIds) {
-    const stage = featureFlags[id].stage;
-    out[id] = stage === "ga" || isFeatureVisible(stage, devHost) && enabled.has(id);
-  }
-  return out;
-}
-
-// src/store/feature-flag-store.ts
-async function listEnabledFeatureFlags(workspaceId) {
-  const { data, error: error2 } = await getSupabaseClient().from("feature_flags").select("flag_id").eq("workspace_id", workspaceId);
-  if (error2) throw new Error(`listEnabledFeatureFlags(${workspaceId}): ${error2.message}`);
-  return (data ?? []).map((r) => r.flag_id);
-}
-async function listEnabledFeatureFlagsBySlug(slug) {
-  const { data, error: error2 } = await getSupabaseClient().from("workspaces").select("id").eq("slug", slug).maybeSingle();
-  if (error2) throw new Error(`listEnabledFeatureFlagsBySlug(${slug}): ${error2.message}`);
-  return data ? listEnabledFeatureFlags(data.id) : [];
-}
-async function enableFeatureFlag(workspaceId, flagId, userId) {
-  const { error: error2 } = await getSupabaseClient().from("feature_flags").upsert(
-    { workspace_id: workspaceId, flag_id: flagId, enabled_by: userId },
-    { onConflict: "workspace_id,flag_id" }
-  );
-  if (error2) throw new Error(`enableFeatureFlag(${workspaceId}, ${flagId}): ${error2.message}`);
-}
-async function disableFeatureFlag(workspaceId, flagId) {
-  const { error: error2 } = await getSupabaseClient().from("feature_flags").delete().eq("workspace_id", workspaceId).eq("flag_id", flagId);
-  if (error2) throw new Error(`disableFeatureFlag(${workspaceId}, ${flagId}): ${error2.message}`);
-}
-
-// src/dashboard/feature-flags-routes.ts
 async function isFeatureEnabled(c, flagId) {
   const auth = c.get("auth");
   const enabled = await listEnabledFeatureFlags(auth.workspaceId);
@@ -7354,7 +7336,7 @@ function coerceMemberEmails(raw) {
 }
 function ensureCwdDir(cwd) {
   const expanded = isLogicalCwd(cwd) ? resolveLogicalCwd(cwd) : expandPath(cwd);
-  if (!existsSync12(expanded)) mkdirSync8(expanded, { recursive: true });
+  if (!existsSync12(expanded)) mkdirSync9(expanded, { recursive: true });
 }
 function toResponse(channel) {
   return {
@@ -7392,7 +7374,6 @@ function createChannelWriteRouter() {
     const externalChannelId = typeof body["externalChannelId"] === "string" && body["externalChannelId"].trim() ? body["externalChannelId"].trim() : null;
     const categoryId = typeof body["categoryId"] === "string" && body["categoryId"].trim() ? body["categoryId"].trim() : null;
     try {
-      ensureCwdDir(cwd);
       const channel = await createChannel({
         name,
         cwd,
@@ -7405,9 +7386,10 @@ function createChannelWriteRouter() {
         externalChannelId,
         categoryId
       });
+      ensureCwdDir(cwd);
       return c.json(toResponse(channel), 201);
     } catch (err) {
-      return c.json({ error: err.message }, err instanceof DefaultChannelError ? 400 : 500);
+      return c.json({ error: err.message }, err instanceof DefaultChannelError || err instanceof ChannelCwdError ? 400 : 500);
     }
   });
   app.put("/:id", async (c) => {
@@ -7421,7 +7403,6 @@ function createChannelWriteRouter() {
     if (coerceRuntime(body["runtime"]) === "sandbox" && existing.runtime !== "sandbox" && !await isFeatureEnabled(c, "sandbox"))
       return c.json({ error: "feature not enabled" }, 403);
     try {
-      ensureCwdDir(cwd);
       const channel = await updateChannelById(id, {
         name: typeof body["name"] === "string" ? body["name"] : void 0,
         cwd,
@@ -7434,10 +7415,11 @@ function createChannelWriteRouter() {
         runtime: coerceRuntime(body["runtime"]),
         mounts: coerceMounts(body["mounts"])
       });
+      ensureCwdDir(cwd);
       dropSessionsIfRuntimeChanged(id, existing.runtime, channel.runtime);
       return c.json(toResponse(channel), 200);
     } catch (err) {
-      return c.json({ error: err.message }, err instanceof DefaultChannelError ? 400 : 500);
+      return c.json({ error: err.message }, err instanceof DefaultChannelError || err instanceof ChannelCwdError ? 400 : 500);
     }
   });
   app.patch("/reorder", async (c) => {
@@ -7489,12 +7471,12 @@ function createChannelWriteRouter() {
       patch.archivedAt = body["archived"] ? (/* @__PURE__ */ new Date()).toISOString() : null;
     }
     try {
-      if (patch.cwd) ensureCwdDir(patch.cwd);
       const channel = await updateChannelById(id, patch);
+      if (patch.cwd) ensureCwdDir(patch.cwd);
       dropSessionsIfRuntimeChanged(id, existing.runtime, channel.runtime);
       return c.json(toResponse(channel), 200);
     } catch (err) {
-      return c.json({ error: err.message }, err instanceof DefaultChannelError ? 400 : 500);
+      return c.json({ error: err.message }, err instanceof DefaultChannelError || err instanceof ChannelCwdError ? 400 : 500);
     }
   });
   return app;
@@ -7503,20 +7485,22 @@ function createChannelWriteRouter() {
 // src/dashboard/docs-routes.ts
 import {
   closeSync,
+  createReadStream,
   existsSync as existsSync16,
   lstatSync as lstatSync2,
-  mkdirSync as mkdirSync9,
+  mkdirSync as mkdirSync10,
   openSync,
   readSync,
   readdirSync as readdirSync4,
-  readFileSync as readFileSync13,
+  readFileSync as readFileSync14,
   realpathSync as realpathSync3,
   renameSync,
-  rmSync as rmSync7,
+  rmSync as rmSync8,
   statSync as statSync5,
   writeFileSync as writeFileSync9
 } from "fs";
-import { basename as basename6, dirname as dirname5, extname, join as join19, relative, resolve as resolve4, sep } from "path";
+import { Readable } from "stream";
+import { basename as basename6, dirname as dirname5, extname, join as join20, relative, resolve as resolve4, sep } from "path";
 import { Hono as Hono10 } from "hono";
 import { streamSSE } from "hono/streaming";
 
@@ -7800,7 +7784,7 @@ async function readOrQueueDocAudio(input2) {
 }
 
 // src/dashboard/artifact-export.ts
-import { readFileSync as readFileSync12 } from "fs";
+import { readFileSync as readFileSync13 } from "fs";
 
 // src/dashboard/chat-agent.ts
 import { homedir as homedir7 } from "os";
@@ -8584,234 +8568,128 @@ function readAgentPersona(configDir2, cwd, name) {
   }
 }
 
-// src/store/memory-store.ts
-var MEMORY_TYPES = ["preference", "decision", "fact", "reference"];
-var NAME_RE = /^[a-z0-9]+(-[a-z0-9]+)*$/;
-var DESCRIPTION_MAX = 200;
-var BODY_MAX = 4e3;
-var MEMORY_INDEX_MAX_CHARS = 8e3;
-function isMemoryType(value) {
-  return MEMORY_TYPES.includes(value);
-}
-function validateMemoryInput(input2) {
-  if (!NAME_RE.test(input2.name))
-    throw new Error("name must be a kebab-case slug, e.g. deploy-flow");
-  if (!isMemoryType(input2.type)) throw new Error(`type must be one of ${MEMORY_TYPES.join(", ")}`);
-  const description = input2.description.trim();
-  if (!description || description.includes("\n") || description.length > DESCRIPTION_MAX) {
-    throw new Error(`description must be one line of at most ${DESCRIPTION_MAX} characters`);
-  }
-  const body = input2.body.trim();
-  if (!body || body.length > BODY_MAX) {
-    throw new Error(`body must be 1 to ${BODY_MAX} characters`);
+// src/dashboard/memory-extraction-runner.ts
+import { spawn as spawn4 } from "child_process";
+import { mkdtempSync as mkdtempSync2, readFileSync as readFileSync12, rmSync as rmSync7 } from "fs";
+import { tmpdir as tmpdir3 } from "os";
+import { join as join18 } from "path";
+var CLAUDE_MODEL = "sonnet";
+var CODEX_MODEL = "gpt-6-astra";
+var CODEX_EFFORT = "low";
+var TIMEOUT_MS = 15e4;
+function buildInvocation(runner, req, dir, auth, baseEnv = process.env) {
+  const env = { ...baseEnv, CLAUDE_CODE_DISABLE_AUTO_MEMORY: "1" };
+  if (runner === "codex") {
+    const outputFile = join18(dir, "last-message.txt");
+    return {
+      command: "codex",
+      args: [
+        "exec",
+        "--ephemeral",
+        // No MCP servers, profiles or hooks from the user's config.toml; auth
+        // still comes from CODEX_HOME.
+        "--ignore-user-config",
+        "--skip-git-repo-check",
+        "-s",
+        "read-only",
+        "-m",
+        CODEX_MODEL,
+        "-c",
+        `model_reasoning_effort=${CODEX_EFFORT}`,
+        "--output-last-message",
+        outputFile,
+        // Codex has no separate system prompt flag; `-` reads the prompt from stdin.
+        "-"
+      ],
+      stdin: `${req.system}
+
+---
+
+${req.user}`,
+      env,
+      outputFile
+    };
   }
-}
-function rowToMemory(row) {
+  const pinned = pinnedClaudeConfigDir(auth.claudeConfigDir);
+  if (pinned) env["CLAUDE_CONFIG_DIR"] = pinned;
+  else delete env["CLAUDE_CONFIG_DIR"];
+  if (auth.claudeCodeOauthToken) env["CLAUDE_CODE_OAUTH_TOKEN"] = auth.claudeCodeOauthToken;
+  else delete env["CLAUDE_CODE_OAUTH_TOKEN"];
   return {
-    id: row["id"],
-    channelId: row["channel_id"],
-    name: row["name"],
-    description: row["description"],
-    type: row["type"],
-    body: row["body"],
-    sourceThreadId: row["source_thread_id"] ?? null,
-    createdBy: row["created_by"],
-    createdAt: row["created_at"],
-    updatedAt: row["updated_at"]
+    command: "claude",
+    args: [
+      "-p",
+      "--model",
+      CLAUDE_MODEL,
+      "--no-session-persistence",
+      "--tools",
+      "",
+      "--strict-mcp-config",
+      "--setting-sources",
+      "",
+      "--system-prompt",
+      req.system
+    ],
+    stdin: req.user,
+    env
   };
 }
-async function listChannelMemories(channelId) {
-  const { data, error: error2 } = await getSupabaseClient().from("memories").select("*").eq("scope", "channel").eq("channel_id", channelId).order("updated_at", { ascending: false });
-  if (error2) throw new Error(`listChannelMemories(${channelId}): ${error2.message}`);
-  return (data ?? []).map(rowToMemory);
-}
-async function getChannelMemory(channelId, name) {
-  const { data, error: error2 } = await getSupabaseClient().from("memories").select("*").eq("scope", "channel").eq("channel_id", channelId).eq("name", name).maybeSingle();
-  if (error2) throw new Error(`getChannelMemory(${channelId}, ${name}): ${error2.message}`);
-  return data ? rowToMemory(data) : null;
-}
-async function saveChannelMemory(input2, actor) {
-  validateMemoryInput(input2);
-  const supabase = getSupabaseClient();
-  const existing = await getChannelMemory(input2.channelId, input2.name);
-  const fields = {
-    description: input2.description.trim(),
-    type: input2.type,
-    body: input2.body.trim(),
-    source_thread_id: input2.sourceThreadId ?? existing?.sourceThreadId ?? null,
-    created_by: input2.createdBy
-  };
-  if (existing && sameContent(existing, fields)) {
-    return { memory: existing, created: false, changed: false };
-  }
-  const { data, error: error2 } = existing ? await supabase.from("memories").update({ ...fields, updated_at: (/* @__PURE__ */ new Date()).toISOString() }).eq("id", existing.id).select("*").single() : await supabase.from("memories").insert({ ...fields, scope: "channel", channel_id: input2.channelId, name: input2.name }).select("*").single();
-  if (error2)
-    throw new Error(`saveChannelMemory(${input2.channelId}, ${input2.name}): ${error2.message}`);
-  const memory = rowToMemory(data);
-  await logMemoryEvent({
-    memory,
-    action: existing ? "update" : "create",
-    before: existing ? snapshot(existing) : null,
-    after: snapshot(memory),
-    actor,
-    threadId: input2.sourceThreadId ?? null
-  });
-  return { memory, created: !existing, changed: true };
-}
-async function updateChannelMemory(channelId, memoryId, patch, actor) {
-  const existing = (await listChannelMemories(channelId)).find((m) => m.id === memoryId);
-  if (!existing) return null;
-  const { memory } = await saveChannelMemory(
-    {
-      channelId,
-      name: existing.name,
-      description: patch.description ?? existing.description,
-      type: patch.type ?? existing.type,
-      body: patch.body ?? existing.body,
-      createdBy: existing.createdBy
-    },
-    actor
-  );
-  return memory;
-}
-async function searchChannelMemories(channelId, query) {
-  const words = query.replaceAll(/[,()*%\\]/g, " ").split(/\s+/).filter(Boolean);
-  if (!words.length) return [];
-  let request = getSupabaseClient().from("memories").select("*").eq("scope", "channel").eq("channel_id", channelId);
-  for (const word of words) {
-    request = request.or(`name.ilike.*${word}*,description.ilike.*${word}*,body.ilike.*${word}*`);
-  }
-  const { data, error: error2 } = await request.order("updated_at", { ascending: false }).limit(20);
-  if (error2) throw new Error(`searchChannelMemories(${channelId}): ${error2.message}`);
-  return (data ?? []).map(rowToMemory);
-}
-async function deleteChannelMemory(channelId, idOrName, actor, threadId) {
-  const { data, error: error2 } = await getSupabaseClient().from("memories").delete().eq("scope", "channel").eq("channel_id", channelId).eq(isUuid(idOrName) ? "id" : "name", idOrName).select("*");
-  if (error2) throw new Error(`deleteChannelMemory(${channelId}, ${idOrName}): ${error2.message}`);
-  const deleted = (data ?? []).map(rowToMemory);
-  for (const memory of deleted) {
-    await logMemoryEvent({
-      memory,
-      action: "delete",
-      before: snapshot(memory),
-      after: null,
-      actor,
-      threadId: threadId ?? null
+function run3(inv, cwd) {
+  return new Promise((resolve7) => {
+    const child = spawn4(inv.command, inv.args, {
+      cwd,
+      env: inv.env,
+      stdio: ["pipe", "pipe", "pipe"]
     });
-  }
-  return deleted.length > 0;
-}
-function snapshot(m) {
-  return {
-    description: m.description,
-    type: m.type,
-    body: m.body,
-    sourceThreadId: m.sourceThreadId,
-    createdBy: m.createdBy
-  };
-}
-function sameContent(m, other) {
-  return m.description === other.description && m.type === other.type && m.body === other.body;
-}
-async function logMemoryEvent(e) {
-  const { error: error2 } = await getSupabaseClient().from("memory_events").insert({
-    channel_id: e.memory.channelId,
-    memory_id: e.action === "delete" ? null : e.memory.id,
-    thread_id: e.threadId,
-    name: e.memory.name,
-    action: e.action,
-    before: e.before,
-    after: e.after,
-    actor: e.actor
+    let stdout = "";
+    let stderr = "";
+    const timer2 = setTimeout(() => child.kill("SIGTERM"), TIMEOUT_MS);
+    child.stdout.on("data", (chunk3) => stdout += chunk3.toString());
+    child.stderr.on("data", (chunk3) => stderr += chunk3.toString());
+    child.on("error", (err) => {
+      clearTimeout(timer2);
+      console.error(`[memory-extraction] ${inv.command} failed to start:`, err.message);
+      resolve7({ ok: false });
+    });
+    child.on("close", (code) => {
+      clearTimeout(timer2);
+      if (code !== 0) {
+        const detail = (stderr || stdout).trim().split("\n").at(-1) ?? "";
+        console.error(`[memory-extraction] ${inv.command} exited ${code}: ${detail.slice(0, 200)}`);
+        resolve7({ ok: false });
+        return;
+      }
+      let raw = stdout;
+      if (inv.outputFile) {
+        try {
+          raw = readFileSync12(inv.outputFile, "utf-8");
+        } catch {
+          raw = "";
+        }
+      }
+      resolve7({ ok: true, raw });
+    });
+    child.stdin.end(inv.stdin);
   });
-  if (error2) console.error(`[memory] event log failed for ${e.memory.name}:`, error2.message);
 }
-function rowToEvent(row) {
-  return {
-    id: row["id"],
-    channelId: row["channel_id"],
-    memoryId: row["memory_id"] ?? null,
-    threadId: row["thread_id"] ?? null,
-    name: row["name"],
-    action: row["action"],
-    before: row["before"] ?? null,
-    after: row["after"] ?? null,
-    actor: row["actor"],
-    createdAt: row["created_at"],
-    undoneAt: row["undone_at"] ?? null
-  };
-}
-async function listThreadMemoryEvents(channelId, threadId) {
-  const { data, error: error2 } = await getSupabaseClient().from("memory_events").select("*").eq("channel_id", channelId).eq("thread_id", threadId).order("created_at", { ascending: false }).limit(50);
-  if (error2) throw new Error(`listThreadMemoryEvents(${threadId}): ${error2.message}`);
-  return (data ?? []).map(rowToEvent);
-}
-async function undoMemoryEvent(channelId, eventId) {
-  const supabase = getSupabaseClient();
-  const { data, error: error2 } = await supabase.from("memory_events").select("*").eq("id", eventId).eq("channel_id", channelId).maybeSingle();
-  if (error2) throw new Error(`undoMemoryEvent(${eventId}): ${error2.message}`);
-  if (!data) return "not-found";
-  const event = rowToEvent(data);
-  if (event.undoneAt) return "already-undone";
-  const current = await getChannelMemory(channelId, event.name);
-  const unchangedSince = current && event.after ? sameContent(current, event.after) : !current && !event.after;
-  if (!unchangedSince) return "conflict";
-  const claimed = await supabase.from("memory_events").update({ undone_at: (/* @__PURE__ */ new Date()).toISOString() }).eq("id", eventId).is("undone_at", null).select("id");
-  if (claimed.error) throw new Error(`undoMemoryEvent(${eventId}): ${claimed.error.message}`);
-  if (!(claimed.data ?? []).length) return "already-undone";
-  const before = event.before;
-  const restore = before ? {
-    description: before.description,
-    type: before.type,
-    body: before.body,
-    source_thread_id: before.sourceThreadId,
-    created_by: before.createdBy
-  } : null;
-  const { error: writeError } = !restore ? await supabase.from("memories").delete().eq("id", current.id) : current ? await supabase.from("memories").update({ ...restore, updated_at: (/* @__PURE__ */ new Date()).toISOString() }).eq("id", current.id) : await supabase.from("memories").insert({ ...restore, scope: "channel", channel_id: channelId, name: event.name });
-  if (writeError) {
-    await supabase.from("memory_events").update({ undone_at: null }).eq("id", eventId);
-    throw new Error(`undoMemoryEvent(${eventId}): ${writeError.message}`);
-  }
-  return "undone";
-}
-function isUuid(value) {
-  return /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(value);
-}
-function formatMemoryPrompt(channelId, memories) {
-  const lines = [];
-  let used = 0;
-  let omitted = 0;
-  for (const m of memories) {
-    const line = `- \`${m.name}\` (${m.type}): ${m.description}`;
-    if (used + line.length > MEMORY_INDEX_MAX_CHARS) {
-      omitted++;
-      continue;
-    }
-    lines.push(line);
-    used += line.length + 1;
+async function completeMemoryExtraction(req) {
+  const runner = runnerForModel(loadDashboardSettings().agent);
+  const config = resolveChannelConfig(req.channelId);
+  const dir = mkdtempSync2(join18(tmpdir3(), "flyspace-memory-"));
+  try {
+    const inv = buildInvocation(runner, req, dir, {
+      ...config.claudeConfigDir ? { claudeConfigDir: config.claudeConfigDir } : {},
+      ...config.claudeCodeOauthToken ? { claudeCodeOauthToken: config.claudeCodeOauthToken } : {}
+    });
+    return await run3(inv, dir);
+  } finally {
+    rmSync7(dir, { recursive: true, force: true });
   }
-  const index = lines.length ? lines.join("\n") + (omitted ? `
-- (${omitted} older memories not listed; find them with \`memory search\`)` : "") : "(none yet)";
-  return [
-    `## Channel memory`,
-    ``,
-    `This channel has a persistent memory shared by every thread in it and by every agent runner. Use it instead of any built-in memory directory of your own CLI.`,
-    ``,
-    `- Read a memory: \`flyspace memory get --channel ${channelId} <name>\``,
-    `- Search: \`flyspace memory search --channel ${channelId} <words>\``,
-    `- Save or overwrite: \`flyspace memory save --channel ${channelId} --name <kebab-slug> --type <${MEMORY_TYPES.join("|")}> --description "<one line>" --body "<text>" [--thread <thread-id>]\``,
-    `- Delete one that turned out wrong: \`flyspace memory delete --channel ${channelId} <name> [--thread <thread-id>]\``,
-    ``,
-    `Save when someone asks you to remember something, corrects you, or a decision is made that later threads will need. Save what is not derivable from the code, git history or docs: decisions and why, preferences, corrections, where external things live. Do not save one-off details of this conversation. Check the index first and update an existing memory rather than adding a near-duplicate. Write memories in English. Pass \`--thread\` with the thread id from the \`[context: ...]\` header, so the thread shows what changed and it can be undone there.`,
-    ``,
-    `Index:`,
-    index
-  ].join("\n");
 }
 
 // src/dashboard/rollover-summary.ts
-import { spawn as spawn4 } from "child_process";
-import { tmpdir as tmpdir3 } from "os";
+import { spawn as spawn5 } from "child_process";
+import { tmpdir as tmpdir4 } from "os";
 var HAIKU_MODEL = "haiku";
 var CJK_PATTERN = /[　-〿぀-ヿ㐀-䶿一-鿿豈-﫿＀-￯]/;
 function estimateTokens(text) {
@@ -8870,11 +8748,11 @@ function runHaikuPrint(input2, claudeConfigDir, claudeCodeOauthToken) {
     if (claudeConfigDir) env["CLAUDE_CONFIG_DIR"] = claudeConfigDir;
     if (claudeCodeOauthToken) env["CLAUDE_CODE_OAUTH_TOKEN"] = claudeCodeOauthToken;
     else delete env["CLAUDE_CODE_OAUTH_TOKEN"];
-    const child = spawn4("claude", args, {
+    const child = spawn5("claude", args, {
       // A stateless rewrite touches no files — tmpdir keeps it that way and
       // avoids picking up an unrelated project's own CLAUDE.md/AGENTS.md,
       // unlike the channel's own cwd the main turn runs in.
-      cwd: tmpdir3(),
+      cwd: tmpdir4(),
       env,
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -9077,7 +8955,7 @@ ${recent.map((m) => `${m.author}: ${m.body}`).join("\n")}`;
 
 // src/dashboard/attachment-downloader.ts
 import { writeFile } from "fs/promises";
-import { join as join18 } from "path";
+import { join as join19 } from "path";
 import { GetObjectCommand as GetObjectCommand4 } from "@aws-sdk/client-s3";
 var debug = process.env["DEBUG"] === "true";
 var ATTACHMENT_LINK = /\]\(\/api\/attachments\/([^)?\s]+)(?:\?[^)\s]*)?\)/g;
@@ -9124,7 +9002,7 @@ async function downloadOne(key) {
     if (bytes.length > sizeLimit) {
       return { kind: "skip", skipped: { name, mimetype, reason: "too_large" } };
     }
-    const localPath = join18(paths.UPLOADS_DIR, lastSegment);
+    const localPath = join19(paths.UPLOADS_DIR, lastSegment);
     await writeFile(localPath, bytes);
     if (debug)
       console.log(`[attachment-downloader] saved ${key} -> ${localPath} (${bytes.length} bytes)`);
@@ -9296,21 +9174,21 @@ var ChatAgent = class {
    * kill.
    */
   async maybeSupersede(msg) {
-    const run3 = this.activeRuns.get(msg.threadId);
-    if (!run3 || run3.msg.author !== msg.author || run3.msg.replyId === msg.replyId) return;
+    const run4 = this.activeRuns.get(msg.threadId);
+    if (!run4 || run4.msg.author !== msg.author || run4.msg.replyId === msg.replyId) return;
     try {
-      if (!await this.shouldInterrupt(run3.msg.body, msg.body)) return;
+      if (!await this.shouldInterrupt(run4.msg.body, msg.body)) return;
     } catch (err) {
       console.error("[chat-agent] interrupt classifier failed:", err.message);
       return;
     }
-    if (this.activeRuns.get(msg.threadId) !== run3) return;
+    if (this.activeRuns.get(msg.threadId) !== run4) return;
     console.log(
       `[chat-agent] follow-up supersedes in-flight run \u2014 aborting. thread=${msg.threadId}`
     );
-    run3.superseded = true;
+    run4.superseded = true;
     this.supersedingReplies.add(msg.replyId);
-    run3.abort.abort();
+    run4.abort.abort();
   }
   /**
    * Picks up messages nobody answered. `handleMessage` is fire-and-forget and
@@ -9473,6 +9351,11 @@ var ChatAgent = class {
     return data.filter((r) => r.id !== excludeReplyId).reverse().slice(-limit).map((r) => ({ author: r.author, body: r.body }));
   }
   /** Whether a reply run is currently in flight for this thread. */
+  /** One idle memory extraction call (see memory-extraction-runner.ts). Not a
+   *  turn: no thread, session, queue slot or usage row. */
+  completeMemoryExtraction(req) {
+    return completeMemoryExtraction(req);
+  }
   isThinking(threadId) {
     return this.activeRuns.has(threadId);
   }
@@ -9508,9 +9391,9 @@ var ChatAgent = class {
    * continue with `--resume`. Returns whether a run was actually in flight —
    * a queued-but-not-started message is not affected. */
   cancel(threadId) {
-    const run3 = this.activeRuns.get(threadId);
-    if (!run3) return false;
-    run3.abort.abort();
+    const run4 = this.activeRuns.get(threadId);
+    if (!run4) return false;
+    run4.abort.abort();
     return true;
   }
   /**
@@ -9672,18 +9555,12 @@ var ChatAgent = class {
         ...docsAccessUnverified ? { docsAccessUnverified } : {}
       };
     }
-    const agentMemory = await listEnabledFeatureFlagsBySlug(owningProfile).then((ids) => resolveFeatureFlags(ids, false)["agent-memory"]).catch((err) => {
-      console.error("[chat-agent] feature flag lookup failed:", err.message);
-      return false;
+    const memory = await loadAgentMemory(owningProfile, thread.channel_id, {
+      readable: docsAccess !== "none",
+      ...isHumanAuthor(msg.author) ? { senderHandle: msg.author } : {}
     });
-    if (agentMemory) channelConfig = { ...channelConfig, disableAutoMemory: true };
-    if (agentMemory && docsAccess !== "none" && isUuid(thread.channel_id)) {
-      const memoryPrompt = await listChannelMemories(thread.channel_id).then((memories) => formatMemoryPrompt(thread.channel_id, memories)).catch((err) => {
-        console.error("[chat-agent] memory lookup failed:", err.message);
-        return void 0;
-      });
-      if (memoryPrompt) channelConfig = { ...channelConfig, memoryPrompt };
-    }
+    if (memory.enabled) channelConfig = { ...channelConfig, disableAutoMemory: true };
+    if (memory.memoryPrompt) channelConfig = { ...channelConfig, memoryPrompt: memory.memoryPrompt };
     const store = this.openSessionStore();
     try {
       const channelKey = `chat:${thread.channel_id}`;
@@ -10411,7 +10288,7 @@ async function exportDocAsArtifact(channelId, docPath) {
   );
   const abs = resolveDocPath(channelConfig.cwd, docPath);
   if (!abs) throw new Error(`doc not found: ${docPath}`);
-  const content = readFileSync12(abs, "utf8");
+  const content = readFileSync13(abs, "utf8");
   const title = extractTitle(abs, "md");
   const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
   const prompt = `Publish the document at \`${docPath}\` (already read below) as a Claude Artifact, then record the result as a stub file under this channel's \`docs/artifacts/\` folder (create the folder if it doesn't exist).
@@ -10479,7 +10356,7 @@ var MEDIA_EXTENSIONS = {
   ".csv": "text/csv; charset=utf-8",
   ".json": "application/json"
 };
-var MAX_RAW_BYTES = 20 * 1024 * 1024;
+var MAX_RAW_BYTES = 100 * 1024 * 1024;
 var ASSET_LIST_EXTENSIONS = /* @__PURE__ */ new Set([
   ".png",
   ".jpg",
@@ -10495,7 +10372,7 @@ var ASSET_LIST_EXTENSIONS = /* @__PURE__ */ new Set([
   ".txt",
   ".csv"
 ]);
-var MAX_UPLOAD_BYTES = MAX_RAW_BYTES;
+var MAX_UPLOAD_BYTES = 20 * 1024 * 1024;
 var CODE_EXTENSIONS = {
   ".js": "javascript",
   ".jsx": "javascript",
@@ -10668,7 +10545,7 @@ function probeDir(absDir, showHidden) {
         return false;
       }
       if (!showHidden && entry.name.startsWith(".")) continue;
-      const abs = join19(dir, entry.name);
+      const abs = join20(dir, entry.name);
       const kind = entryKind(entry, abs);
       if (kind === "dir") {
         if (SKIP_DIRS.has(entry.name)) hasOther = true;
@@ -10688,14 +10565,14 @@ function probeDir(absDir, showHidden) {
 }
 function readGitBranch(dir) {
   try {
-    let gitDir = join19(dir, ".git");
+    let gitDir = join20(dir, ".git");
     if (statSync5(gitDir).isFile()) {
-      const pointer = readFileSync13(gitDir, "utf8").trim();
+      const pointer = readFileSync14(gitDir, "utf8").trim();
       const match = pointer.match(/^gitdir:\s*(.+)$/);
       if (!match) return void 0;
       gitDir = resolve4(dir, match[1]);
     }
-    const head = readFileSync13(join19(gitDir, "HEAD"), "utf8").trim();
+    const head = readFileSync14(join20(gitDir, "HEAD"), "utf8").trim();
     const branchMatch = head.match(/^ref:\s*refs\/heads\/(.+)$/);
     if (branchMatch) return branchMatch[1];
     return /^[0-9a-f]{7,40}$/i.test(head) ? head.slice(0, 7) : void 0;
@@ -10717,14 +10594,14 @@ function listDocLevel(root, relDir = "", sort = "newest", showHidden = false) {
   for (const entry of entries2) {
     if (dirs.length + docs.length >= MAX_ENTRIES) break;
     if (!showHidden && entry.name.startsWith(".")) continue;
-    const abs = join19(absDir, entry.name);
+    const abs = join20(absDir, entry.name);
     const path = relative(root, abs).split(sep).join("/");
     const kind = entryKind(entry, abs);
     if (kind === "dir") {
       if (SKIP_DIRS.has(entry.name)) continue;
       const probe3 = probeDir(abs, showHidden);
       if (!probe3.hasDocs && probe3.hasOther) continue;
-      const isRepo = existsSync16(join19(abs, ".git"));
+      const isRepo = existsSync16(join20(abs, ".git"));
       dirs.push({
         path,
         name: entry.name,
@@ -10760,7 +10637,7 @@ function flatDocs(root, {
     for (const entry of entries2) {
       if (hits.length >= MAX_FLAT_DOCS) return;
       if (!showHidden && entry.name.startsWith(".")) continue;
-      const abs = join19(dir, entry.name);
+      const abs = join20(dir, entry.name);
       const kind = entryKind(entry, abs);
       if (kind === "dir") {
         if (!SKIP_DIRS.has(entry.name)) walk(abs, depth + 1);
@@ -10840,7 +10717,7 @@ function uniqueName(absDir, name) {
   let candidate = name;
   for (let n = 1; n < 1e3; n++) {
     try {
-      statSync5(join19(absDir, candidate));
+      statSync5(join20(absDir, candidate));
     } catch {
       return candidate;
     }
@@ -10862,7 +10739,7 @@ function saveUploadedFile(root, relDir, name, data) {
   if (!(ext in DOC_EXTENSIONS) && !ASSET_LIST_EXTENSIONS.has(ext)) return { status: "bad-type" };
   if (data.byteLength > MAX_UPLOAD_BYTES) return { status: "too-large" };
   const final = uniqueName(absDir, safe);
-  const abs = join19(absDir, final);
+  const abs = join20(absDir, final);
   writeFileSync9(abs, data);
   return { status: "ok", path: relative(root, abs).split(sep).join("/"), name: final };
 }
@@ -10876,13 +10753,13 @@ function createDocFolder(root, relDir, name) {
   }
   const safe = sanitizeUploadName(name);
   if (!safe) return { status: "bad-name" };
-  const abs = join19(absDir, safe);
+  const abs = join20(absDir, safe);
   try {
     statSync5(abs);
     return { status: "exists" };
   } catch {
   }
-  mkdirSync9(abs);
+  mkdirSync10(abs);
   return { status: "ok", path: relative(root, abs).split(sep).join("/"), name: safe };
 }
 function createDocFile(root, relDir, name, content) {
@@ -10899,7 +10776,7 @@ function createDocFile(root, relDir, name, content) {
   if (!(ext in DOC_EXTENSIONS) && !(ext in CODE_EXTENSIONS)) return { status: "bad-name" };
   if (SKIP_FILES.has(safe)) return { status: "bad-name" };
   if (Buffer.byteLength(content, "utf8") > MAX_CONTENT_BYTES) return { status: "too-large" };
-  const abs = join19(absDir, safe);
+  const abs = join20(absDir, safe);
   try {
     writeFileSync9(abs, content, { encoding: "utf8", flag: "wx" });
   } catch (err) {
@@ -10937,7 +10814,7 @@ function moveDocEntry(root, from, to) {
   } catch {
     return { status: "bad-target" };
   }
-  const finalAbs = join19(absToDir, name);
+  const finalAbs = join20(absToDir, name);
   if (isDir2 && (finalAbs === absFrom || finalAbs.startsWith(absFrom + sep))) {
     return { status: "into-self" };
   }
@@ -10960,7 +10837,7 @@ function deleteDocEntry(root, path) {
   }
   const isDir2 = stat.isDirectory();
   if (!isDir2 && !stat.isFile() && !stat.isSymbolicLink()) return { status: "not-found" };
-  rmSync7(abs, { recursive: isDir2 });
+  rmSync8(abs, { recursive: isDir2 });
   return {
     status: "ok",
     path: relative(root, abs).split(sep).join("/"),
@@ -10999,13 +10876,15 @@ function createDocsRouter({ gate = requireDocsAccess } = {}) {
     }
     if (!stat.isFile()) return c.json({ error: "not found" }, 404);
     if (stat.size > MAX_RAW_BYTES) return c.json({ error: "file too large" }, 413);
-    const data = readFileSync13(resolved2.abs);
-    const headers = { "Content-Type": resolved2.contentType };
-    if (download) {
-      const filename = basename6(resolved2.abs).replace(/"/g, "");
-      headers["Content-Disposition"] = `attachment; filename="${filename}"`;
-    }
-    return c.body(new Uint8Array(data), 200, headers);
+    const name = basename6(resolved2.abs);
+    const asciiName = name.replace(/[^\x20-\x7e]/g, "_").replace(/["\\]/g, "_");
+    const disposition = download ? "attachment" : "inline";
+    const stream = Readable.toWeb(createReadStream(resolved2.abs));
+    return c.body(stream, 200, {
+      "Content-Type": resolved2.contentType,
+      "Content-Length": String(stat.size),
+      "Content-Disposition": `${disposition}; filename="${asciiName}"; filename*=UTF-8''${encodeURIComponent(name)}`
+    });
   });
   app.get("/:id/docs/html", (c) => {
     const { cwd } = resolveChannelConfig(c.req.param("id"));
@@ -11019,7 +10898,7 @@ function createDocsRouter({ gate = requireDocsAccess } = {}) {
     }
     if (!stat.isFile()) return c.json({ error: "not found" }, 404);
     if (stat.size > MAX_RAW_BYTES) return c.json({ error: "file too large" }, 413);
-    return c.body(new Uint8Array(readFileSync13(abs)), 200, {
+    return c.body(new Uint8Array(readFileSync14(abs)), 200, {
       "Content-Type": "text/html; charset=utf-8",
       "Content-Security-Policy": HTML_SHARE_CSP,
       "X-Content-Type-Options": "nosniff",
@@ -11204,7 +11083,7 @@ function createDocsRouter({ gate = requireDocsAccess } = {}) {
       title: kind ? extractTitle(abs, kind) : basename6(abs),
       mtime: stat.mtime.toISOString(),
       tooLarge: tooLarge || void 0,
-      content: tooLarge ? "" : readFileSync13(abs, "utf8")
+      content: tooLarge ? "" : readFileSync14(abs, "utf8")
     });
   });
   app.put("/:id/docs/content", async (c) => {
@@ -11247,7 +11126,7 @@ function createDocsRouter({ gate = requireDocsAccess } = {}) {
       channel,
       rel,
       title: extractTitle(abs, "md"),
-      content: readFileSync13(abs, "utf8")
+      content: readFileSync14(abs, "utf8")
     };
   };
   app.get("/:id/docs/translation/:lang", async (c) => {
@@ -11470,7 +11349,7 @@ function ownSkills(scope, dir) {
     return [{ scope, name, description, body, path, plugin: null, mtime }];
   });
 }
-function snapshot2(scopes) {
+function snapshot(scopes) {
   const wants = (scope) => !scopes || scopes.has(scope);
   const configDir2 = profileClaudeConfigDir();
   const rows = [];
@@ -11505,7 +11384,7 @@ async function pushSkillScopes(scopes) {
   if (!mirrorEnabled()) return;
   const workspace = getProfile();
   const supabase = getSupabaseClient();
-  const rows = snapshot2(scopes ? new Set(scopes) : void 0);
+  const rows = snapshot(scopes ? new Set(scopes) : void 0);
   let query = supabase.from("skill_files").select("scope, name, hash").eq("workspace", workspace);
   if (scopes) query = query.in("scope", scopes);
   const { data, error: error2 } = await query;
@@ -11789,13 +11668,16 @@ function registerMirroredSkillRoutes(api, agent) {
 import { execFileSync as execFileSync3 } from "child_process";
 import { existsSync as existsSync19 } from "fs";
 import { homedir as homedir8 } from "os";
-import { join as join20, resolve as resolve5 } from "path";
+import { join as join21, resolve as resolve5 } from "path";
 var PROVIDER_LABELS = {
   claude: "Claude Code",
   codex: "Codex"
 };
 var TTL_MS2 = 6e4;
 var cache6 = /* @__PURE__ */ new Map();
+function clearProviderStatusCache() {
+  cache6.clear();
+}
 function binaryOnPath(bin) {
   try {
     execFileSync3(bin, ["--version"], { stdio: "ignore" });
@@ -11807,7 +11689,7 @@ function binaryOnPath(bin) {
 function claudeAuthAvailable() {
   if (profileEnv("CLAUDE_CODE_OAUTH_TOKEN")?.trim()) return true;
   const configDir2 = profileClaudeConfigDir() || resolve5(homedir8(), ".claude");
-  if (existsSync19(join20(configDir2, ".credentials.json"))) return true;
+  if (existsSync19(join21(configDir2, ".credentials.json"))) return true;
   if (process.platform !== "darwin") return false;
   try {
     execFileSync3("security", ["find-generic-password", "-s", "Claude Code-credentials"], {
@@ -11830,7 +11712,7 @@ function probe2(runner) {
       runner,
       label: label2,
       connected: false,
-      reason: `${label2} is installed but signed out \u2014 run ${bin} once in a terminal to log in.`
+      reason: `${label2} is installed but signed out. Use Sign in below.`
     };
   }
   return { runner, label: label2, connected: true };
@@ -11840,7 +11722,7 @@ function withAuthFailure(status) {
   return {
     ...status,
     connected: false,
-    reason: `Sign-in expired and could not be refreshed. On the Host, run claude setup-token, add the token to ~/.config/flyspace/profiles/${getProfile()}/config.env as CLAUDE_CODE_OAUTH_TOKEN, then restart the Host.`
+    reason: "Sign-in expired and could not be refreshed. Use Sign in again below."
   };
 }
 function providerStatuses() {
@@ -11854,6 +11736,232 @@ function providerStatuses() {
   return statuses.map((st) => st.runner === "claude" && st.connected ? withAuthFailure(st) : st);
 }
 
+// src/dashboard/provider-login.ts
+import { spawn as spawn6 } from "child_process";
+import { randomUUID as randomUUID2 } from "crypto";
+import { chmodSync, existsSync as existsSync20, mkdirSync as mkdirSync11, readFileSync as readFileSync15, writeFileSync as writeFileSync10 } from "fs";
+import { createRequire } from "module";
+import { dirname as dirname7, join as join22 } from "path";
+import { Hono as Hono13 } from "hono";
+var SESSION_TTL_MS = 10 * 6e4;
+var URL_WAIT_MS = 3e4;
+var TOKEN_WAIT_MS = 6e4;
+var sessions = /* @__PURE__ */ new Map();
+function stripAnsi(raw) {
+  return raw.replace(/\x1b\][^\x07]*\x07/g, "").replace(/\x1b\[\d*G/g, " ").replace(/\x1b\[[0-9;?<>=]*[A-Za-z~]/g, "").replace(/\x1b[78=>]/g, "");
+}
+function parseClaudeAuthUrl(raw) {
+  return stripAnsi(raw).match(/https:\/\/\S+\/oauth\/authorize\?\S+/)?.[0];
+}
+function parseClaudeToken(raw) {
+  return stripAnsi(raw).match(/sk-ant-oat[A-Za-z0-9_-]+/)?.[0];
+}
+function parseCodexDeviceAuth(raw) {
+  const text = stripAnsi(raw);
+  const url = text.match(/https:\/\/\S+\/device\b\S*/)?.[0];
+  const code = text.match(/\b([A-Z0-9]{4,}-[A-Z0-9]{4,})\b/)?.[1];
+  return url && code ? { url, code } : void 0;
+}
+function upsertEnvLine(content, key, value) {
+  const line = `${key}=${value}`;
+  const re = new RegExp(`^\\s*(?:export\\s+)?${key}=.*$`, "m");
+  if (re.test(content)) return content.replace(re, line);
+  return `${content}${content && !content.endsWith("\n") ? "\n" : ""}${line}
+`;
+}
+function finish(id, status, error2) {
+  const s = sessions.get(id);
+  if (!s || s.status !== "pending") return;
+  s.status = status;
+  s.error = error2;
+  s.kill();
+  clearTimeout(s.timer);
+  s.timer = setTimeout(() => sessions.delete(id), 6e4);
+  clearProviderStatusCache();
+}
+function track(session) {
+  const id = randomUUID2();
+  const s = {
+    ...session,
+    status: "pending",
+    output: "",
+    timer: setTimeout(() => finish(id, "failed", "Sign-in timed out. Start again."), SESSION_TTL_MS)
+  };
+  sessions.set(id, s);
+  return [id, s];
+}
+function waitFor(s, parse2, ms) {
+  return new Promise((resolve7) => {
+    const started = Date.now();
+    const tick = setInterval(() => {
+      const v = parse2();
+      if (v !== void 0 || s.status !== "pending" || Date.now() - started > ms) {
+        clearInterval(tick);
+        resolve7(v);
+      }
+    }, 200);
+  });
+}
+function loadPty() {
+  const require2 = createRequire(import.meta.url);
+  const root = dirname7(require2.resolve("node-pty/package.json"));
+  const helper = join22(root, "prebuilds", `${process.platform}-${process.arch}`, "spawn-helper");
+  try {
+    if (existsSync20(helper)) chmodSync(helper, 493);
+  } catch {
+  }
+  return require2("node-pty");
+}
+function cliEnv() {
+  const configDir2 = profileClaudeConfigDir();
+  const codexHome = profileEnv("CODEX_HOME");
+  return {
+    ...process.env,
+    // Never pop a browser on the Host: the person signing in isn't there.
+    BROWSER: "true",
+    ...configDir2 ? { CLAUDE_CONFIG_DIR: configDir2 } : {},
+    ...codexHome ? { CODEX_HOME: codexHome } : {}
+  };
+}
+async function startClaude() {
+  const pty = loadPty().spawn("claude", ["setup-token"], {
+    // Wide enough that the URL and token are never wrapped.
+    cols: 2e3,
+    rows: 50,
+    env: cliEnv()
+  });
+  const [id, s] = track({ runner: "claude", kill: () => pty.kill(), configFile: paths.CONFIG_FILE, pty });
+  pty.onData((d) => {
+    s.output += d;
+  });
+  pty.onExit(() => {
+    if (s.status === "pending" && !parseClaudeToken(s.output)) {
+      finish(id, "failed", "The claude CLI exited before sign-in finished.");
+    }
+  });
+  const url = await waitFor(s, () => parseClaudeAuthUrl(s.output), URL_WAIT_MS);
+  if (!url) {
+    finish(id, "failed");
+    throw new Error("claude setup-token did not print a sign-in URL.");
+  }
+  return { id, url };
+}
+async function submitClaudeCode(id, code) {
+  const s = sessions.get(id);
+  if (!s || s.runner !== "claude" || !s.pty) throw new Error("Sign-in session not found. Start again.");
+  if (s.status !== "pending") throw new Error(s.error ?? "Sign-in already finished.");
+  s.output = "";
+  s.pty.write(`${code.trim()}\r`);
+  const token = await waitFor(s, () => parseClaudeToken(s.output), TOKEN_WAIT_MS);
+  if (!token) {
+    finish(id, "failed", "Claude did not accept that code. Start again and paste the full code.");
+    throw new Error("Claude did not accept that code. Start again and paste the full code.");
+  }
+  mkdirSync11(dirname7(s.configFile), { recursive: true });
+  const current = existsSync20(s.configFile) ? readFileSync15(s.configFile, "utf-8") : "";
+  writeFileSync10(s.configFile, upsertEnvLine(current, "CLAUDE_CODE_OAUTH_TOKEN", token), { mode: 384 });
+  const cached = cachedProfileConfig();
+  if (cached) cached.env["CLAUDE_CODE_OAUTH_TOKEN"] = token;
+  clearClaudeAuthFailed();
+  finish(id, "done");
+}
+async function startCodex() {
+  const child = spawn6("codex", ["login", "--device-auth"], {
+    env: cliEnv(),
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  const [id, s] = track({ runner: "codex", kill: () => child.kill(), configFile: paths.CONFIG_FILE });
+  const onData = (d) => {
+    s.output += d.toString();
+  };
+  child.stdout?.on("data", onData);
+  child.stderr?.on("data", onData);
+  child.on("error", () => finish(id, "failed", "Could not run the codex CLI on the Host."));
+  child.on(
+    "exit",
+    (code) => finish(id, code === 0 ? "done" : "failed", code === 0 ? void 0 : "Codex sign-in did not complete.")
+  );
+  const auth = await waitFor(s, () => parseCodexDeviceAuth(s.output), URL_WAIT_MS);
+  if (!auth) {
+    finish(id, "failed");
+    throw new Error("codex login did not print a device code.");
+  }
+  return { id, ...auth };
+}
+function requireAdmin3(auth) {
+  return auth?.role === "admin" ? null : "admin access required";
+}
+function failure2(c, err) {
+  return c.json({ error: err.message }, 500);
+}
+function createProviderLoginRouter() {
+  const app = new Hono13();
+  app.use("*", async (c, next) => {
+    const denied = requireAdmin3(c.get("auth"));
+    if (denied) return c.json({ error: denied }, 403);
+    await next();
+  });
+  app.post("/:runner/login", async (c) => {
+    const runner = c.req.param("runner");
+    try {
+      if (runner === "claude") return c.json(await startClaude());
+      if (runner === "codex") return c.json(await startCodex());
+    } catch (err) {
+      return failure2(c, err);
+    }
+    return c.json({ error: "unknown provider" }, 404);
+  });
+  app.post("/claude/login/:id/code", async (c) => {
+    const body = await c.req.json().catch(() => ({}));
+    const code = body["code"];
+    if (typeof code !== "string" || !code.trim()) return c.json({ error: "code is required" }, 400);
+    try {
+      await submitClaudeCode(c.req.param("id"), code);
+    } catch (err) {
+      return c.json({ error: err.message }, 400);
+    }
+    return c.json({ status: "done" });
+  });
+  app.get("/:runner/login/:id", (c) => {
+    const s = sessions.get(c.req.param("id"));
+    if (!s || s.runner !== c.req.param("runner")) return c.json({ error: "session not found" }, 404);
+    return c.json({ status: s.status, ...s.error ? { error: s.error } : {} });
+  });
+  return app;
+}
+async function handleProviderLoginRequest(req) {
+  const app = new Hono13();
+  app.use("*", async (c, next) => {
+    c.set("auth", { role: "admin" });
+    await next();
+  });
+  app.route("/", createProviderLoginRouter());
+  const res = await app.request(req.path, {
+    method: req.method,
+    ...req.body !== void 0 && {
+      body: JSON.stringify(req.body),
+      headers: { "content-type": "application/json" }
+    }
+  });
+  return { status: res.status, body: await res.json().catch(() => null) };
+}
+function registerRelayedProviderLoginRoutes(api, agent) {
+  const relay3 = async (c) => {
+    const denied = requireAdmin3(c.get("auth"));
+    if (denied) return c.json({ error: denied }, 403);
+    const method = c.req.method;
+    const body = method === "GET" ? void 0 : await c.req.json().catch(() => null);
+    const path = c.req.path.slice(c.req.path.indexOf("/settings/providers") + "/settings/providers".length);
+    const result = await agent.providerLoginRequest?.({ method, path, body });
+    if (!result) {
+      return c.json({ error: "Signing in needs the Host machine, which is not connected right now." }, 503);
+    }
+    return c.json(result.body, result.status);
+  };
+  api.all("/settings/providers/:runner/login", relay3);
+  api.all("/settings/providers/:runner/login/*", relay3);
+}
+
 // src/dashboard/host-api.ts
 function registerHostRoutes(api) {
   api.get("/channels/:id/skills", (c) => {
@@ -11902,6 +12010,7 @@ function registerHostRoutes(api) {
     return c.json({ ...await saveWorkspaceBranding(patch), ...local });
   });
   api.get("/settings/providers", (c) => c.json({ providers: providerStatuses() }));
+  api.route("/settings/providers", createProviderLoginRouter());
   api.get(
     "/settings/usage-limit",
     (c) => c.json({
@@ -11960,8 +12069,8 @@ function registerHostRoutes(api) {
     const errors = c.req.query("error") === "true" || c.req.query("error") === "1";
     const limit = Math.min(Number(c.req.query("limit")) || 200, 2e3);
     const filename = errors ? "custie-error.log" : "custie.log";
-    const file = join21(paths.LOG_DIR, filename);
-    const exists = existsSync20(file);
+    const file = join23(paths.LOG_DIR, filename);
+    const exists = existsSync21(file);
     return c.json({
       file,
       exists,
@@ -11971,18 +12080,18 @@ function registerHostRoutes(api) {
   });
 }
 function tailFile(file, limit) {
-  if (!existsSync20(file)) return [];
-  const lines = readFileSync14(file, "utf-8").split("\n");
+  if (!existsSync21(file)) return [];
+  const lines = readFileSync16(file, "utf-8").split("\n");
   if (lines.at(-1) === "") lines.pop();
   return lines.slice(-limit);
 }
 
 // src/dashboard/data-api.ts
-import { existsSync as existsSync22 } from "fs";
+import { existsSync as existsSync23 } from "fs";
 import sharp5 from "sharp";
 
 // src/dashboard/automations-routes.ts
-import { Hono as Hono13 } from "hono";
+import { Hono as Hono14 } from "hono";
 var TYPES2 = ["schedule", "trigger", "mention-trigger"];
 function isType(t) {
   return TYPES2.includes(t);
@@ -11999,7 +12108,7 @@ function statusFor(message) {
   return 400;
 }
 function createAutomationWriteRouter() {
-  const app = new Hono13();
+  const app = new Hono14();
   const manager = () => new AutomationManager();
   app.get("/:type/:name", (c) => {
     const item = manager().get(c.req.param("name"));
@@ -12055,9 +12164,9 @@ function createAutomationWriteRouter() {
 }
 
 // src/dashboard/categories-routes.ts
-import { Hono as Hono14 } from "hono";
+import { Hono as Hono15 } from "hono";
 function createCategoryWriteRouter() {
-  const app = new Hono14();
+  const app = new Hono15();
   app.get("/", async (c) => {
     const { data, error: error2 } = await getSupabaseClient().from("categories").select("*").eq("profile", getProfile()).order("position", { ascending: true });
     if (error2) return c.json({ error: error2.message }, 500);
@@ -12111,7 +12220,7 @@ function createCategoryWriteRouter() {
 }
 
 // src/dashboard/chat-routes.ts
-import { Hono as Hono15 } from "hono";
+import { Hono as Hono16 } from "hono";
 
 // src/dashboard/fork-summary.ts
 var GROQ_API_URL6 = "https://api.groq.com/openai/v1/chat/completions";
@@ -12531,7 +12640,7 @@ async function withPreviews(supabase, threads) {
       threads.map((t) => t.id),
       THREAD_CHUNK_SIZE
     ).map(
-      (ids) => supabase.from("thread_replies").select("thread_id, body, author").in("thread_id", ids).is("archived_at", null).order("created_at", { ascending: true })
+      (ids) => supabase.from("thread_replies").select("thread_id, body, author, external_user_id").in("thread_id", ids).is("archived_at", null).order("created_at", { ascending: true })
     )
   );
   const previewByThread = /* @__PURE__ */ new Map();
@@ -12541,8 +12650,15 @@ async function withPreviews(supabase, threads) {
       if (entry) {
         entry.count += 1;
         entry.lastAuthor = r.author;
+        entry.participants.delete(r.author);
+        entry.participants.set(r.author, r.external_user_id ?? null);
       } else
-        previewByThread.set(r.thread_id, { count: 1, firstBody: r.body, lastAuthor: r.author });
+        previewByThread.set(r.thread_id, {
+          count: 1,
+          firstBody: r.body,
+          lastAuthor: r.author,
+          participants: /* @__PURE__ */ new Map()
+        });
     }
   }
   return threads.map((t) => {
@@ -12554,7 +12670,9 @@ async function withPreviews(supabase, threads) {
       // Who spoke last, counting only replies AFTER the opening message —
       // the reader's own handle here means there is nothing new for them to
       // read, on this browser or any other (see web/src/lib/thread-unread).
-      last_reply_author: entry && entry.count > 1 ? entry.lastAuthor : null
+      last_reply_author: entry && entry.count > 1 ? entry.lastAuthor : null,
+      // Everyone who replied, most recent first, for the row's avatar stack.
+      participants: [...entry?.participants ?? []].reverse().map(([author, external_user_id]) => ({ author, external_user_id }))
     };
   });
 }
@@ -12589,7 +12707,7 @@ async function generateAutoTitle(threadId, channelId, body) {
   await supabase.from("threads").update({ auto_title: autoTitle }).eq("id", threadId).is("title", null);
 }
 function createChatRouter(agent = {}) {
-  const app = new Hono15();
+  const app = new Hono16();
   const {
     onChatMessage: onMessage,
     isAgentThinking,
@@ -13096,7 +13214,7 @@ function createChatRouter(agent = {}) {
 }
 
 // src/dashboard/doc-shares-routes.ts
-import { Hono as Hono16 } from "hono";
+import { Hono as Hono17 } from "hono";
 
 // src/dashboard/doc-share-features.ts
 import { DeleteObjectCommand as DeleteObjectCommand3 } from "@aws-sdk/client-s3";
@@ -13280,7 +13398,7 @@ function resolveChannel2(c) {
 }
 var LIST_LIMIT = 500;
 function createDocShareListRouter() {
-  const app = new Hono16();
+  const app = new Hono17();
   app.get("/shares", async (c) => {
     const viewer = c.get("auth");
     const readable = await filterReadableDocsChannels(
@@ -13324,7 +13442,7 @@ function createDocShareListRouter() {
   return app;
 }
 function createDocShareWriteRouter(agent = {}) {
-  const app = new Hono16();
+  const app = new Hono17();
   app.use("/:id/docs/share", requireDocsAccess);
   app.use("/:id/docs/share/*", requireDocsAccess);
   app.use("/:id/docs/shares", requireDocsAccess);
@@ -13481,7 +13599,7 @@ function createDocShareWriteRouter(agent = {}) {
 }
 
 // src/dashboard/search-routes.ts
-import { Hono as Hono17 } from "hono";
+import { Hono as Hono18 } from "hono";
 function matchScore(q, fields) {
   const terms = q.toLowerCase().split(/\s+/).filter(Boolean);
   if (terms.length === 0) return 0;
@@ -13629,7 +13747,7 @@ function searchAutomations(q) {
 }
 var RESULT_LIMIT = 30;
 function createSearchRouter() {
-  const app = new Hono17();
+  const app = new Hono18();
   app.get("/", async (c) => {
     const q = c.req.query("q")?.trim();
     if (!q) return c.json({ results: [] });
@@ -13645,8 +13763,8 @@ function createSearchRouter() {
 }
 
 // src/dashboard/uploads-routes.ts
-import { randomUUID as randomUUID2 } from "crypto";
-import { Hono as Hono18 } from "hono";
+import { randomUUID as randomUUID3 } from "crypto";
+import { Hono as Hono19 } from "hono";
 import { PutObjectCommand as PutObjectCommand3, GetObjectCommand as GetObjectCommand5 } from "@aws-sdk/client-s3";
 import { getSignedUrl as getSignedUrl4 } from "@aws-sdk/s3-request-presigner";
 var MAX_FILE_BYTES = 10 * 1024 * 1024;
@@ -13661,7 +13779,7 @@ function encodeKeyForUrl(key) {
   return key.split("/").map(encodeURIComponent).join("/");
 }
 function createUploadsRouter() {
-  const app = new Hono18();
+  const app = new Hono19();
   app.post("/uploads", async (c) => {
     const body = await c.req.parseBody().catch(() => null);
     const file = body?.["file"];
@@ -13669,7 +13787,7 @@ function createUploadsRouter() {
     if (file.size > MAX_FILE_BYTES) {
       return c.json({ error: `file must be ${MAX_FILE_BYTES / (1024 * 1024)}MB or smaller` }, 400);
     }
-    const key = `${KEY_PREFIX2}/${getProfile()}/${randomUUID2()}-${sanitizeFilename(file.name)}`;
+    const key = `${KEY_PREFIX2}/${getProfile()}/${randomUUID3()}-${sanitizeFilename(file.name)}`;
     const buffer = Buffer.from(await file.arrayBuffer());
     await getR2Client().send(
       new PutObjectCommand3({
@@ -13706,14 +13824,14 @@ function createUploadsRouter() {
 }
 
 // src/dashboard/transcribe-routes.ts
-import { Hono as Hono19 } from "hono";
+import { Hono as Hono20 } from "hono";
 var GROQ_TRANSCRIBE_URL = "https://api.groq.com/openai/v1/audio/transcriptions";
 var MODEL = "whisper-large-v3-turbo";
 var MAX_AUDIO_BYTES = 5 * 1024 * 1024;
 var MAX_PROMPT_CHARS = 400;
 var NO_SPEECH_THRESHOLD = 0.6;
 function createTranscribeRouter() {
-  const app = new Hono19();
+  const app = new Hono20();
   app.post("/transcribe", async (c) => {
     if (!await isFeatureEnabled(c, "dictation"))
       return c.json({ error: "feature not enabled" }, 403);
@@ -13752,8 +13870,8 @@ function createTranscribeRouter() {
 }
 
 // src/dashboard/avatars-routes.ts
-import { createHash as createHash10, randomUUID as randomUUID3 } from "crypto";
-import { Hono as Hono20 } from "hono";
+import { createHash as createHash10, randomUUID as randomUUID4 } from "crypto";
+import { Hono as Hono21 } from "hono";
 import sharp4 from "sharp";
 import { PutObjectCommand as PutObjectCommand4, DeleteObjectCommand as DeleteObjectCommand4 } from "@aws-sdk/client-s3";
 var AVATAR_SIZE = 192;
@@ -13791,7 +13909,7 @@ async function storeAvatar(file, owner) {
   if (file.size > MAX_AVATAR_BYTES) return { error: "avatar must be 2MB or smaller" };
   const original = Buffer.from(await file.arrayBuffer());
   const resized = await sharp4(original).resize({ width: AVATAR_SIZE, height: AVATAR_SIZE, fit: "cover" }).png().toBuffer();
-  const key = `${avatarKeyPrefix()}${owner}-${randomUUID3()}.png`;
+  const key = `${avatarKeyPrefix()}${owner}-${randomUUID4()}.png`;
   await getR2Client().send(
     new PutObjectCommand4({
       Bucket: getR2Bucket(),
@@ -13806,7 +13924,7 @@ function avatarKeyPrefix() {
   return `${KEY_PREFIX3}/${getProfile()}/`;
 }
 function createAvatarsRouter() {
-  const app = new Hono20();
+  const app = new Hono21();
   app.get("/avatars/slack", async (c) => {
     const ctx = await resolveAuthContext(c);
     if (!ctx) return c.json({ error: "not signed in" }, 401);
@@ -13855,7 +13973,7 @@ function createAvatarsRouter() {
 }
 
 // src/dashboard/members-routes.ts
-import { Hono as Hono21 } from "hono";
+import { Hono as Hono22 } from "hono";
 function inviteLinkFor(c, token) {
   const url = new URL("/auth/invite", callbackUrl(c));
   url.searchParams.set("token", token);
@@ -13863,7 +13981,7 @@ function inviteLinkFor(c, token) {
 }
 var EMAIL_RE2 = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
 function createMembersRouter() {
-  const members = new Hono21();
+  const members = new Hono22();
   members.get("/", async (c) => {
     const ctx = await resolveAuthContext(c);
     if (ctx?.role !== "admin") return c.json({ error: "admin access required" }, 403);
@@ -13904,7 +14022,7 @@ function createMembersRouter() {
         return { userId: m.userId, handle: m.handle, role: m.role, avatarUrl };
       })
     );
-    return c.json({ members: directory });
+    return c.json({ workspaceId: ctx.workspaceId, members: directory });
   });
   members.post("/:userId/dm", async (c) => {
     const ctx = await resolveAuthContext(c);
@@ -13956,6 +14074,10 @@ function createMembersRouter() {
     if (avatarKey && !avatarKey.startsWith(`${avatarKeyPrefix()}invite-${ctx.userId}-`)) {
       return c.json({ error: "unknown avatar" }, 400);
     }
+    const { plan } = await getWorkspaceBilling(ctx.workspaceId);
+    if (plan === "local") {
+      return c.json({ error: "The Solo plan is for one person. Upgrade to invite members." }, 403);
+    }
     const existing = await getMembershipByEmail(ctx.workspaceId, email);
     if (existing) return c.json({ error: "already a member of this workspace" }, 409);
     let membership;
@@ -14074,7 +14196,7 @@ function createMembersRouter() {
 }
 
 // src/dashboard/notifications-routes.ts
-import { Hono as Hono22 } from "hono";
+import { Hono as Hono23 } from "hono";
 
 // src/store/notification-store.ts
 function rowToNotification(row) {
@@ -14142,7 +14264,7 @@ async function markAllRead(channelIds, userId) {
 
 // src/dashboard/notifications-routes.ts
 function createNotificationsRouter() {
-  const notifications = new Hono22();
+  const notifications = new Hono23();
   notifications.get("/", async (c) => {
     const auth = c.get("auth");
     const channelIds = getProfileChannelRegistry().filter((ch) => canSeeChannel(ch, auth)).map((ch) => ch.id);
@@ -14169,7 +14291,7 @@ function createNotificationsRouter() {
   return notifications;
 }
 function createThreadReadRouter() {
-  const threads = new Hono22();
+  const threads = new Hono23();
   threads.post("/threads/:threadId/read", async (c) => {
     const { userId } = c.get("auth");
     const threadId = c.req.param("threadId");
@@ -14181,7 +14303,7 @@ function createThreadReadRouter() {
 }
 
 // src/dashboard/push-routes.ts
-import { Hono as Hono23 } from "hono";
+import { Hono as Hono24 } from "hono";
 
 // src/push/send.ts
 import webpush from "web-push";
@@ -14284,7 +14406,7 @@ async function pushToUser(userId, payload) {
 
 // src/dashboard/push-routes.ts
 function createPushRouter() {
-  const push = new Hono23();
+  const push = new Hono24();
   push.get("/key", (c) => c.json({ publicKey: getVapidPublicKey() }));
   push.post("/subscribe", async (c) => {
     const { userId } = c.get("auth");
@@ -14315,7 +14437,7 @@ function createPushRouter() {
 }
 
 // src/dashboard/mcp-oauth-routes.ts
-import { Hono as Hono24 } from "hono";
+import { Hono as Hono25 } from "hono";
 var CONNECTIONS_PAGE = "/settings/connections";
 function callbackUri(c) {
   const proto = c.req.header("x-forwarded-proto") ?? "http";
@@ -14330,7 +14452,7 @@ function backToDashboard(c, to, params) {
   return c.redirect(`${target.pathname}${target.search}`);
 }
 function createMcpOAuthRouter() {
-  const app = new Hono24();
+  const app = new Hono25();
   app.get("/oauth/:provider/start", async (c) => {
     const auth = c.get("auth");
     if (auth.role !== "admin") return c.json({ error: "admin access required" }, 403);
@@ -14457,7 +14579,7 @@ function createMcpOAuthRouter() {
 }
 
 // src/dashboard/mcp-routes.ts
-import { Hono as Hono25 } from "hono";
+import { Hono as Hono26 } from "hono";
 
 // src/mcp/transport.ts
 var KINDS = ["inherit", "npx", "local", "http", "sse"];
@@ -14551,7 +14673,7 @@ function fromServerCommand(command) {
 
 // src/dashboard/mcp-routes.ts
 var CUSTOM_PROVIDER = "custom";
-function requireAdmin3(auth) {
+function requireAdmin4(auth) {
   return auth?.role === "admin" ? null : "admin access required";
 }
 function toResponse4(connection, channelIds, providerCommand = null) {
@@ -14587,9 +14709,9 @@ function bindingsByConnection() {
   return map;
 }
 function createMcpRouter() {
-  const app = new Hono25();
+  const app = new Hono26();
   app.get("/providers", async (c) => {
-    const denied = requireAdmin3(c.get("auth"));
+    const denied = requireAdmin4(c.get("auth"));
     if (denied) return c.json({ error: denied }, 403);
     const providers = await listMcpProviders();
     return c.json({
@@ -14607,7 +14729,7 @@ function createMcpRouter() {
   });
   app.get("/connections", async (c) => {
     const auth = c.get("auth");
-    const denied = requireAdmin3(auth);
+    const denied = requireAdmin4(auth);
     if (denied) return c.json({ error: denied }, 403);
     const connections = await listMcpConnections(auth.workspaceId);
     const commands = new Map(
@@ -14622,7 +14744,7 @@ function createMcpRouter() {
   });
   app.post("/connections", async (c) => {
     const auth = c.get("auth");
-    const denied = requireAdmin3(auth);
+    const denied = requireAdmin4(auth);
     if (denied) return c.json({ error: denied }, 403);
     const body = await c.req.json().catch(() => null);
     const label2 = typeof body?.label === "string" ? body.label.trim() : "";
@@ -14659,7 +14781,7 @@ function createMcpRouter() {
   });
   app.patch("/connections/:id", async (c) => {
     const auth = c.get("auth");
-    const denied = requireAdmin3(auth);
+    const denied = requireAdmin4(auth);
     if (denied) return c.json({ error: denied }, 403);
     const body = await c.req.json().catch(() => null);
     if (!body) return c.json({ error: "a body is required" }, 400);
@@ -14690,7 +14812,7 @@ function createMcpRouter() {
   });
   app.put("/connections/:id/credential", async (c) => {
     const auth = c.get("auth");
-    const denied = requireAdmin3(auth);
+    const denied = requireAdmin4(auth);
     if (denied) return c.json({ error: denied }, 403);
     const body = await c.req.json().catch(() => null);
     const raw = body?.apiKey;
@@ -14708,7 +14830,7 @@ function createMcpRouter() {
   });
   app.put("/connections/:id/channels", async (c) => {
     const auth = c.get("auth");
-    const denied = requireAdmin3(auth);
+    const denied = requireAdmin4(auth);
     if (denied) return c.json({ error: denied }, 403);
     const id = c.req.param("id");
     const connection = await getMcpConnection(auth.workspaceId, id);
@@ -14735,7 +14857,7 @@ function createMcpRouter() {
   });
   app.delete("/connections/:id", async (c) => {
     const auth = c.get("auth");
-    const denied = requireAdmin3(auth);
+    const denied = requireAdmin4(auth);
     if (denied) return c.json({ error: denied }, 403);
     const deleted = await deleteMcpConnection(auth.workspaceId, c.req.param("id"));
     if (!deleted) return c.json({ error: "connection not found" }, 404);
@@ -14846,7 +14968,7 @@ async function sessionUsageForThreads(workspace, threadTsList) {
 }
 
 // src/dashboard/usage-report.ts
-import { existsSync as existsSync21 } from "fs";
+import { existsSync as existsSync22 } from "fs";
 function mergeByLabel(buckets) {
   const merged = /* @__PURE__ */ new Map();
   for (const bucket of buckets) {
@@ -14892,7 +15014,7 @@ function toReport(days, rows, labelChannel) {
   };
 }
 function fromLocalStore(days, labelChannel) {
-  if (!existsSync21(paths.DB_FILE)) return { ...EMPTY, days };
+  if (!existsSync22(paths.DB_FILE)) return { ...EMPTY, days };
   const window = days === 0 ? void 0 : days;
   const store = new UsageStore(paths.DB_FILE);
   try {
@@ -14934,7 +15056,7 @@ async function buildChannelUsageReport(channelId, days, labelChannel) {
     const { totals, byDay } = await channelUsageForWorkspace(workspace, aliasIds, window);
     return { days, totals: totals.runs > 0 ? totals : null, byDay };
   } catch {
-    if (!existsSync21(paths.DB_FILE)) return { days, totals: null, byDay: [] };
+    if (!existsSync22(paths.DB_FILE)) return { days, totals: null, byDay: [] };
     const store = new UsageStore(paths.DB_FILE);
     try {
       const targetLabel = labelChannel(channelId);
@@ -14956,7 +15078,7 @@ async function buildThreadUsage(threadTs) {
     if (totals.runs === 0) return { threadTs, totals: null, byModel: [] };
     return { threadTs, totals, byModel };
   } catch {
-    if (!existsSync21(paths.DB_FILE)) return { threadTs, totals: null, byModel: [] };
+    if (!existsSync22(paths.DB_FILE)) return { threadTs, totals: null, byModel: [] };
     const store = new UsageStore(paths.DB_FILE);
     try {
       const totals = store.threadTotals(threadTs);
@@ -14969,7 +15091,7 @@ async function buildThreadUsage(threadTs) {
 }
 
 // src/dashboard/channel-members-routes.ts
-import { Hono as Hono26 } from "hono";
+import { Hono as Hono27 } from "hono";
 async function isChannelAdmin(ctx, channelId) {
   if (ctx.role === "admin") return true;
   const membership = await getMembershipByUserId(ctx.workspaceId, ctx.userId);
@@ -14978,7 +15100,7 @@ async function isChannelAdmin(ctx, channelId) {
   return members.some((m) => m.membershipId === membership.id && m.role === "channel_admin");
 }
 function createChannelMembersRouter() {
-  const router = new Hono26();
+  const router = new Hono27();
   router.get("/:id/members", async (c) => {
     const ctx = await resolveAuthContext(c);
     if (!ctx) return c.json({ error: "workspace access required" }, 403);
@@ -15026,9 +15148,9 @@ function createChannelMembersRouter() {
     if (!await isChannelAdmin(ctx, channelId)) {
       return c.json({ error: "channel admin access required" }, 403);
     }
-    return c.json({ grants: await listChannelDocsAccess(channelId) });
+    return c.json({ memberAccess: await getChannelDocsMemberAccess(channelId) });
   });
-  router.put("/:id/docs-access/:membershipId", async (c) => {
+  router.put("/:id/docs-access", async (c) => {
     const ctx = await resolveAuthContext(c);
     if (!ctx) return c.json({ error: "workspace access required" }, 403);
     const channelId = c.req.param("id");
@@ -15036,32 +15158,31 @@ function createChannelMembersRouter() {
       return c.json({ error: "channel admin access required" }, 403);
     }
     const body = await c.req.json().catch(() => ({}));
-    if (!isDocsGrant(body.access)) {
-      return c.json({ error: "access must be 'read' or 'write'" }, 400);
+    if (!isDocsAccess(body.memberAccess)) {
+      return c.json({ error: "memberAccess must be 'none', 'read' or 'write'" }, 400);
     }
-    const grant = await upsertChannelDocsAccess({
-      channelId,
-      membershipId: c.req.param("membershipId"),
-      access: body.access
-    });
-    return c.json({ grant });
-  });
-  router.delete("/:id/docs-access/:membershipId", async (c) => {
-    const ctx = await resolveAuthContext(c);
-    if (!ctx) return c.json({ error: "workspace access required" }, 403);
-    const channelId = c.req.param("id");
-    if (!await isChannelAdmin(ctx, channelId)) {
-      return c.json({ error: "channel admin access required" }, 403);
+    if (!await setChannelDocsMemberAccess(channelId, body.memberAccess)) {
+      return c.json({ error: "no such channel" }, 404);
     }
-    const removed = await removeChannelDocsAccess(channelId, c.req.param("membershipId"));
-    if (!removed) return c.json({ error: "no such docs grant" }, 404);
-    return c.body(null, 204);
+    return c.json({ memberAccess: body.memberAccess });
   });
   return router;
 }
 
 // src/dashboard/memories-routes.ts
-import { Hono as Hono27 } from "hono";
+import { Hono as Hono28 } from "hono";
+async function readPatch(c) {
+  const body = await c.req.json().catch(() => ({}));
+  const patch = {};
+  if (typeof body["description"] === "string") patch.description = body["description"];
+  if (typeof body["body"] === "string") patch.body = body["body"];
+  const type = body["type"];
+  if (type !== void 0) {
+    if (!isMemoryType(type)) return "invalid type";
+    patch.type = type;
+  }
+  return patch;
+}
 var requireChannelVisible = async (c, next) => {
   const channel = findChannel(c.req.param("id"));
   if (!channel || !canSeeChannel(channel, c.get("auth"))) {
@@ -15077,7 +15198,7 @@ var requireAgentMemory = async (c, next) => {
   await next();
 };
 function createMemoriesRouter() {
-  const router = new Hono27();
+  const router = new Hono28();
   for (const path of [
     "/:id/memories",
     "/:id/memories/*",
@@ -15092,15 +15213,8 @@ function createMemoriesRouter() {
   router.patch("/:id/memories/:memoryId", async (c) => {
     const memoryId = c.req.param("memoryId");
     if (!isUuid(memoryId)) return c.json({ error: "invalid memory id" }, 400);
-    const body = await c.req.json().catch(() => ({}));
-    const patch = {};
-    if (typeof body["description"] === "string") patch.description = body["description"];
-    if (typeof body["body"] === "string") patch.body = body["body"];
-    const type = body["type"];
-    if (type !== void 0) {
-      if (!isMemoryType(type)) return c.json({ error: "invalid type" }, 400);
-      patch.type = type;
-    }
+    const patch = await readPatch(c);
+    if (typeof patch === "string") return c.json({ error: patch }, 400);
     try {
       const memory = await updateChannelMemory(c.get("memoryChannelId"), memoryId, patch, "user");
       if (!memory) return c.json({ error: "memory not found" }, 404);
@@ -15116,9 +15230,28 @@ function createMemoriesRouter() {
     if (!deleted) return c.json({ error: "memory not found" }, 404);
     return c.json({ ok: true });
   });
+  router.post("/:id/memories/:memoryId/promote", async (c) => {
+    const memoryId = c.req.param("memoryId");
+    if (!isUuid(memoryId)) return c.json({ error: "invalid memory id" }, 400);
+    if (c.get("auth").role !== "admin") {
+      return c.json({ error: "Only a Workspace Admin can move a memory to the workspace." }, 403);
+    }
+    if (findChannel(c.get("memoryChannelId"))?.visibility !== "public") {
+      return c.json({ error: "Memories of a private channel stay in that channel." }, 403);
+    }
+    const result = await promoteChannelMemory(c.get("memoryChannelId"), memoryId);
+    if (!result.ok && result.reason === "not-found") return c.json({ error: "memory not found" }, 404);
+    if (!result.ok) {
+      return c.json({ error: "The workspace already has a memory with this name." }, 409);
+    }
+    return c.json({ memory: result.memory });
+  });
   router.get("/:id/memory-events", async (c) => {
-    const threadId = c.req.query("thread") ?? "";
-    if (!isUuid(threadId)) return c.json({ error: "thread query parameter required" }, 400);
+    const threadId = c.req.query("thread");
+    if (threadId === void 0) {
+      return c.json({ events: await listMemoryEvents(c.get("memoryChannelId"), { limit: 20 }) });
+    }
+    if (!isUuid(threadId)) return c.json({ error: "invalid thread id" }, 400);
     return c.json({ events: await listThreadMemoryEvents(c.get("memoryChannelId"), threadId) });
   });
   router.post("/:id/memory-events/:eventId/undo", async (c) => {
@@ -15137,9 +15270,68 @@ function createMemoriesRouter() {
   });
   return router;
 }
+function createScopedMemoriesRouter() {
+  const router = new Hono28();
+  router.use("*", requireAgentMemory);
+  const workspace = (c) => ({
+    scope: "workspace",
+    workspaceId: c.get("auth").workspaceId
+  });
+  const mine = (c) => ({
+    scope: "user",
+    workspaceId: c.get("auth").workspaceId,
+    userId: c.get("auth").userId
+  });
+  router.on(["PATCH", "DELETE"], "/workspace/*", async (c, next) => {
+    if (c.get("auth").role !== "admin") {
+      return c.json({ error: "Only a Workspace Admin can change workspace memory." }, 403);
+    }
+    await next();
+  });
+  for (const [path, target] of [
+    ["/workspace", workspace],
+    ["/me", mine]
+  ]) {
+    router.get(path, async (c) => c.json({ memories: await listMemories(target(c)) }));
+    router.patch(`${path}/:memoryId`, async (c) => {
+      const memoryId = c.req.param("memoryId") ?? "";
+      if (!isUuid(memoryId)) return c.json({ error: "invalid memory id" }, 400);
+      const patch = await readPatch(c);
+      if (typeof patch === "string") return c.json({ error: patch }, 400);
+      try {
+        const memory = await updateMemory(target(c), memoryId, patch, "user");
+        if (!memory) return c.json({ error: "memory not found" }, 404);
+        return c.json({ memory });
+      } catch (err) {
+        return c.json({ error: err.message }, 400);
+      }
+    });
+    router.delete(`${path}/:memoryId`, async (c) => {
+      const memoryId = c.req.param("memoryId") ?? "";
+      if (!isUuid(memoryId)) return c.json({ error: "invalid memory id" }, 400);
+      if (!await deleteMemory(target(c), memoryId, "user")) {
+        return c.json({ error: "memory not found" }, 404);
+      }
+      return c.json({ ok: true });
+    });
+  }
+  router.get("/me-settings", async (c) => {
+    const auth = c.get("auth");
+    const membership = await getMembershipByUserId(auth.workspaceId, auth.userId);
+    return c.json({ autoPaused: membership?.memoryAutoPaused ?? false });
+  });
+  router.put("/me-settings", async (c) => {
+    const body = await c.req.json().catch(() => ({}));
+    if (typeof body["autoPaused"] !== "boolean") return c.json({ error: "autoPaused must be a boolean" }, 400);
+    const auth = c.get("auth");
+    await setMemoryAutoPaused(auth.workspaceId, auth.userId, body["autoPaused"]);
+    return c.json({ autoPaused: body["autoPaused"] });
+  });
+  return router;
+}
 
 // src/dashboard/onboarding-routes.ts
-import { Hono as Hono28 } from "hono";
+import { Hono as Hono29 } from "hono";
 
 // src/dashboard/unique-channel-name.ts
 function uniqueChannelName(raw, taken) {
@@ -15153,7 +15345,7 @@ function uniqueChannelName(raw, taken) {
 // src/dashboard/workspace-greeting.ts
 var GROQ_API_URL8 = "https://api.groq.com/openai/v1/chat/completions";
 var GREETING_MODEL = "openai/gpt-oss-20b";
-var TIMEOUT_MS = 6e3;
+var TIMEOUT_MS2 = 6e3;
 var MAX_LISTED_CHANNELS = 8;
 var GUIDES = [
   "Welcome to Flyspace",
@@ -15203,7 +15395,7 @@ async function groqGreeting(input2, apiKey) {
   ].join("\n");
   const res = await fetch(GROQ_API_URL8, {
     method: "POST",
-    signal: AbortSignal.timeout(TIMEOUT_MS),
+    signal: AbortSignal.timeout(TIMEOUT_MS2),
     headers: { "content-type": "application/json", authorization: `Bearer ${apiKey}` },
     body: JSON.stringify({
       model: GREETING_MODEL,
@@ -15240,7 +15432,7 @@ async function buildGreeting(input2) {
 // src/dashboard/onboarding-routes.ts
 var MAX_FOLDERS = 20;
 function createOnboardingRouter(agent) {
-  const app = new Hono28();
+  const app = new Hono29();
   app.get("/scan", async (c) => {
     const ctx = await resolveAuthContext(c);
     if (ctx?.role !== "admin") return c.json({ error: "admin access required" }, 403);
@@ -15406,13 +15598,13 @@ function firstSentence(body) {
 function threadLabel(row) {
   return row.title?.trim() || firstSentence(row.thread_replies?.[0]?.body);
 }
-async function resolveThreadLinks(sessions) {
+async function resolveThreadLinks(sessions2) {
   const chatIds = [
-    ...new Set(sessions.filter((s) => s.channelId.startsWith("chat:")).map((s) => s.threadTs))
+    ...new Set(sessions2.filter((s) => s.channelId.startsWith("chat:")).map((s) => s.threadTs))
   ];
   const externalKeys = [
     ...new Set(
-      sessions.filter((s) => !s.channelId.startsWith("chat:")).map((s) => `${s.channelId}:${s.threadTs}`)
+      sessions2.filter((s) => !s.channelId.startsWith("chat:")).map((s) => `${s.channelId}:${s.threadTs}`)
     )
   ];
   const chat = /* @__PURE__ */ new Map();
@@ -15445,8 +15637,8 @@ function registerDataRoutes(api, agent = {}) {
   api.get("/host/status", async (c) => {
     const online = agent.isHostOnline?.(getProfile()) ?? false;
     if (!online) {
-      const failure2 = agent.getHostOfflineReason?.() ?? null;
-      return c.json({ online: false, reason: failure2?.reason ?? null, since: failure2?.since ?? null });
+      const failure3 = agent.getHostOfflineReason?.() ?? null;
+      return c.json({ online: false, reason: failure3?.reason ?? null, since: failure3?.since ?? null });
     }
     const auth = c.get("auth");
     const paused = await getAgentPaused(auth.workspaceId);
@@ -15497,6 +15689,7 @@ function registerDataRoutes(api, agent = {}) {
   api.route("/onboarding", createOnboardingRouter(agent));
   api.route("/channels", createChannelMembersRouter());
   api.route("/channels", createMemoriesRouter());
+  api.route("/memories", createScopedMemoriesRouter());
   api.route("/docs", createDocShareListRouter());
   api.get("/users", (c) => c.json({ users: listActiveUsers() }));
   api.route("/categories", createCategoryWriteRouter());
@@ -15504,17 +15697,17 @@ function registerDataRoutes(api, agent = {}) {
     const auto = loadEffectiveAutomations();
     const runs = /* @__PURE__ */ new Map();
     try {
-      for (const [name, run3] of await lastRunsForWorkspace(getProfile())) {
-        runs.set(name, { lastRun: run3.lastRunAt.toISOString(), lastStatus: run3.lastStatus });
+      for (const [name, run4] of await lastRunsForWorkspace(getProfile())) {
+        runs.set(name, { lastRun: run4.lastRunAt.toISOString(), lastStatus: run4.lastStatus });
       }
     } catch {
-      if (existsSync22(paths.DB_FILE)) {
+      if (existsSync23(paths.DB_FILE)) {
         const runStore = new AutomationRunStore(paths.DB_FILE);
         try {
-          for (const run3 of runStore.listLastRuns()) {
-            runs.set(run3.name, {
-              lastRun: run3.lastRunAt.toISOString(),
-              lastStatus: run3.lastStatus
+          for (const run4 of runStore.listLastRuns()) {
+            runs.set(run4.name, {
+              lastRun: run4.lastRunAt.toISOString(),
+              lastStatus: run4.lastStatus
             });
           }
         } finally {
@@ -15570,7 +15763,7 @@ function registerDataRoutes(api, agent = {}) {
       const runs = (await recentRunsForWorkspace(getProfile(), 200)).map(toResponse5);
       return c.json({ runs });
     } catch {
-      if (!existsSync22(paths.DB_FILE)) return c.json({ runs: [] });
+      if (!existsSync23(paths.DB_FILE)) return c.json({ runs: [] });
       const runStore = new AutomationRunStore(paths.DB_FILE);
       try {
         const runs = runStore.listRuns(200).map(toResponse5);
@@ -15692,7 +15885,7 @@ function registerDataRoutes(api, agent = {}) {
     } catch {
       latest = /* @__PURE__ */ new Map();
       totals = /* @__PURE__ */ new Map();
-      if (existsSync22(paths.DB_FILE)) {
+      if (existsSync23(paths.DB_FILE)) {
         const usageStore = new UsageStore(paths.DB_FILE);
         try {
           latest = usageStore.latestByThread(threadTsList);
@@ -15703,25 +15896,25 @@ function registerDataRoutes(api, agent = {}) {
       }
     }
     const threadLinks = await resolveThreadLinks(raw);
-    const sessions = raw.map((s) => {
-      const run3 = latest.get(s.threadTs);
-      const turns = run3?.numTurns ?? 1;
-      const total = run3 ? run3.inputTokens + run3.cacheReadTokens + run3.cacheCreationTokens : void 0;
+    const sessions2 = raw.map((s) => {
+      const run4 = latest.get(s.threadTs);
+      const turns = run4?.numTurns ?? 1;
+      const total = run4 ? run4.inputTokens + run4.cacheReadTokens + run4.cacheCreationTokens : void 0;
       const link = s.channelId.startsWith("chat:") ? threadLinks.chat.get(s.threadTs) : threadLinks.external.get(`${s.channelId}:${s.threadTs}`);
       return {
         ...s,
         channelLabel: channelLabel(s.channelId),
-        model: run3?.model,
-        numTurns: run3?.numTurns,
+        model: run4?.model,
+        numTurns: run4?.numTurns,
         contextTokens: total !== void 0 ? Math.round(total / (turns > 0 ? turns : 1)) : void 0,
-        rolledOver: run3?.label === "rollover",
+        rolledOver: run4?.label === "rollover",
         threadTitle: link?.title ?? void 0,
         chatChannelId: link?.chatChannelId,
         chatThreadId: link?.chatThreadId,
         costUsd: totals.get(s.threadTs)?.costUsd
       };
     });
-    return c.json({ sessions });
+    return c.json({ sessions: sessions2 });
   });
   const LOGO_SIZE = 256;
   const MAX_LOGO_BYTES = 2 * 1024 * 1024;
@@ -15747,18 +15940,18 @@ function registerDataRoutes(api, agent = {}) {
 // src/dashboard/device-auth-routes.ts
 import { verify } from "crypto";
 import { getConnInfo } from "@hono/node-server/conninfo";
-import { Hono as Hono30 } from "hono";
+import { Hono as Hono31 } from "hono";
 
 // src/dashboard/agent-bridge.ts
-import { randomBytes as randomBytes8, randomUUID as randomUUID4, sign as signRaw, timingSafeEqual as timingSafeEqual2, verify as verifyRaw } from "crypto";
+import { randomBytes as randomBytes8, randomUUID as randomUUID5, sign as signRaw, timingSafeEqual as timingSafeEqual2, verify as verifyRaw } from "crypto";
 
 // src/dashboard/docs-relay.ts
-import { Hono as Hono29 } from "hono";
+import { Hono as Hono30 } from "hono";
 import { streamSSE as streamSSE2 } from "hono/streaming";
 var FORWARDED_HEADERS = ["content-type", "host", "accept-language"];
 var RETURNED_HEADERS = ["content-type", "content-disposition", "content-security-policy", "cache-control"];
 async function handleDocsRequest(req) {
-  const app = new Hono29();
+  const app = new Hono30();
   app.use("*", async (c, next) => {
     c.set("auth", req.auth);
     await next();
@@ -15817,24 +16010,24 @@ function relay2(agent) {
 }
 
 // src/dashboard/agent-bridge.ts
-import { existsSync as existsSync24, readFileSync as readFileSync17 } from "fs";
+import { existsSync as existsSync25, readFileSync as readFileSync19 } from "fs";
 import dotenv from "dotenv";
 import { WebSocket, WebSocketServer } from "ws";
 
 // src/dashboard/host-identity.ts
 import { createPrivateKey as createPrivateKey2, createPublicKey as createPublicKey2, generateKeyPairSync as generateKeyPairSync2 } from "crypto";
-import { existsSync as existsSync23, mkdirSync as mkdirSync10, readFileSync as readFileSync15, writeFileSync as writeFileSync10 } from "fs";
-import { dirname as dirname7, join as join22 } from "path";
+import { existsSync as existsSync24, mkdirSync as mkdirSync12, readFileSync as readFileSync17, writeFileSync as writeFileSync11 } from "fs";
+import { dirname as dirname8, join as join24 } from "path";
 function hostPrivateKeyPath() {
-  return process.env["FLYSPACE_HOST_KEY_PATH"] || join22(paths.BASE_CONFIG_DIR, "host.key");
+  return process.env["FLYSPACE_HOST_KEY_PATH"] || join24(paths.BASE_CONFIG_DIR, "host.key");
 }
 function loadHostPrivateKey(path = hostPrivateKeyPath()) {
-  if (!existsSync23(path)) {
+  if (!existsSync24(path)) {
     throw new Error(
       `No Host identity at ${path}. Run \`pnpm run generate-host-key\` on this machine, then set FLYSPACE_HOST_PUBLIC_KEY on the Data process to the printed public key.`
     );
   }
-  return createPrivateKey2(readFileSync15(path, "utf8"));
+  return createPrivateKey2(readFileSync17(path, "utf8"));
 }
 function loadHostPublicKey() {
   const b64 = process.env["FLYSPACE_HOST_PUBLIC_KEY"];
@@ -16079,7 +16272,7 @@ async function userEmail(userId) {
 
 // src/dashboard/doc-share-publisher.ts
 import { randomBytes as randomBytes7 } from "crypto";
-import { readFileSync as readFileSync16, statSync as statSync9 } from "fs";
+import { readFileSync as readFileSync18, statSync as statSync9 } from "fs";
 import { extname as extname2, posix } from "path";
 import { CopyObjectCommand, PutObjectCommand as PutObjectCommand5 } from "@aws-sdk/client-s3";
 
@@ -16266,7 +16459,7 @@ async function buildSnapshot(cwd, sourcePath, shareId) {
   }
   if (!stat.isFile()) return { status: "not-found" };
   if (stat.size > MAX_CONTENT_BYTES2) return { status: "too-large" };
-  const source = readFileSync16(abs, "utf8");
+  const source = readFileSync18(abs, "utf8");
   const title = extractTitle(abs, kind === "markdown" ? "md" : kind);
   if (kind === "excalidraw") {
     try {
@@ -16346,7 +16539,7 @@ async function buildSnapshot(cwd, sourcePath, shareId) {
       let text = null;
       try {
         const size = statSync9(docAbs).size;
-        if (size <= budget) text = readFileSync16(docAbs, "utf8");
+        if (size <= budget) text = readFileSync18(docAbs, "utf8");
       } catch {
         continue;
       }
@@ -16363,7 +16556,7 @@ async function buildSnapshot(cwd, sourcePath, shareId) {
     let body;
     try {
       if (statSync9(resolved2.abs).size > MAX_ASSET_BYTES) continue;
-      body = readFileSync16(resolved2.abs);
+      body = readFileSync18(resolved2.abs);
     } catch {
       continue;
     }
@@ -16405,7 +16598,7 @@ async function publishDocShare(input2) {
     ...HTML_FEATURES,
     brandingEnabled: resolveFeatures(input2.features, existing).brandingEnabled
   } : html ? HTML_FEATURES : resolveFeatures(input2.features, existing);
-  const snapshot3 = {
+  const snapshot2 = {
     ...built,
     sourceLang: html ? null : await detectSourceLanguage(built.title, built.content)
   };
@@ -16415,8 +16608,8 @@ async function publishDocShare(input2) {
       const renamed = await setDocShareSlug(existing.id, slug);
       if (!renamed) return { status: "not-found" };
     }
-    const share2 = await updateDocShareSnapshot(existing.id, snapshot3, features);
-    const stale = existing.assetKeys.filter((key) => !snapshot3.assetKeys.includes(key));
+    const share2 = await updateDocShareSnapshot(existing.id, snapshot2, features);
+    const stale = existing.assetKeys.filter((key) => !snapshot2.assetKeys.includes(key));
     await deleteShareAssets(stale);
     if (!features.audioEnabled && existing.audioEnabled) await dropShareAudio(existing);
     void queueShareAudio(share2);
@@ -16430,7 +16623,7 @@ async function publishDocShare(input2) {
     channelId: input2.channelId,
     sourcePath: input2.sourcePath,
     createdBy: input2.createdBy,
-    ...snapshot3,
+    ...snapshot2,
     ...features
   });
   void queueShareAudio(share);
@@ -16456,10 +16649,14 @@ var METHODS = {
   threads: ["GET", "HEAD", "POST", "PATCH"],
   thread_replies: ["GET", "HEAD", "POST", "PATCH"],
   memberships: ["GET", "HEAD"],
+  feature_flags: ["GET", "HEAD"],
   channel_members: ["GET", "HEAD"],
-  channel_docs_access: ["GET", "HEAD"]
+  memories: ALL,
+  memory_events: ["GET", "HEAD", "POST", "PATCH"]
 };
-var CHANNEL_SCOPED = /* @__PURE__ */ new Set(["channel_members", "channel_docs_access"]);
+var CHANNEL_SCOPED = /* @__PURE__ */ new Set(["channel_members"]);
+var MEMORY_TABLES = /* @__PURE__ */ new Set(["memories", "memory_events"]);
+var MEMORY_KEYS = ["channel_id", "workspace_id", "user_id", "scope"];
 var FORWARDED_HEADERS2 = ["accept", "content-type", "prefer", "range"];
 var deny = (message, status = 403) => ({
   status,
@@ -16566,7 +16763,30 @@ async function proxyHostDb(workspaces, req, forward, assigned = workspaces ?? []
       }
     }
     params.append(slugColumn, inList(scope));
-  } else if (table === "memberships") {
+  } else if (MEMORY_TABLES.has(table)) {
+    const [workspaceIds, channelIds] = await Promise.all([
+      ownedWorkspaceIds(forward, workspaces),
+      ownedChannelIds(forward, workspaces)
+    ]);
+    if (!workspaceIds || !channelIds) return deny("Could not resolve the device workspaces.", 502);
+    if (method === "POST") {
+      const ok3 = rows.length > 0 && rows.every((r) => {
+        const channel = r["channel_id"];
+        if (channel !== void 0 && channel !== null) {
+          return typeof channel === "string" && channelIds.includes(channel);
+        }
+        return typeof r["workspace_id"] === "string" && workspaceIds.includes(r["workspace_id"]);
+      });
+      if (!ok3) return deny(`Every ${table} row must belong to a channel or workspace of the device.`);
+    }
+    if (method === "PATCH") {
+      const patch = bodyRows(req.body);
+      if (!patch || patch.some((r) => MEMORY_KEYS.some((k) => k in r))) {
+        return deny(`A ${table} row cannot move to another channel, workspace or person.`);
+      }
+    }
+    params.append("workspace_id", inList(workspaceIds));
+  } else if (table === "memberships" || table === "feature_flags") {
     const workspaceIds = await ownedWorkspaceIds(forward, workspaces);
     if (!workspaceIds) return deny("Could not resolve the device workspaces.", 502);
     params.append("workspace_id", inList(workspaceIds));
@@ -16648,7 +16868,7 @@ function dataSocketUrl() {
   return `ws://127.0.0.1:${process.env["FLYSPACE_DATA_API_PORT"] ?? DEFAULT_DATA_API_PORT}${HOST_SOCKET_PATH}`;
 }
 function listLocalSessions() {
-  if (!existsSync24(paths.DB_FILE)) return [];
+  if (!existsSync25(paths.DB_FILE)) return [];
   const store = new SessionStore(paths.DB_FILE);
   try {
     return store.listSessions();
@@ -16664,6 +16884,7 @@ function localAgentCallbacks(chatAgent) {
     cancelAgentRun: (threadId) => chatAgent.cancel(threadId),
     regenerateAgentRun: (threadId) => chatAgent.regenerate(threadId),
     listAgentRuns: () => chatAgent.runningThreadIds(),
+    completeMemoryExtraction: (req) => chatAgent.completeMemoryExtraction(req),
     listMissingCwds: () => auditChannelCwds().map((ch) => ch.id),
     listRunningProfiles: () => listProfiles().filter(isServiceRunning2),
     getAgentIdentities: () => resolveAgentIdentities(),
@@ -16674,6 +16895,7 @@ function localAgentCallbacks(chatAgent) {
     saveLocalDashboardSettings: (patch) => saveDashboardSettings(patch),
     writeSkill: (ref, write) => writeSkillAndSync(ref, write),
     outputStylesRequest: (req) => handleOutputStylesRequest(req),
+    providerLoginRequest: (req) => handleProviderLoginRequest(req),
     docsRequest: (req) => handleDocsRequest(req),
     listSessions: () => listLocalSessions(),
     scanOnboarding: () => scanOnboarding(),
@@ -16683,14 +16905,14 @@ function localAgentCallbacks(chatAgent) {
 }
 var HOST_CONFIG_PUSH_INTERVAL_MS = 6e4;
 function buildHostConfigSnapshot() {
-  const snapshot3 = {};
+  const snapshot2 = {};
   for (const profile of listProfiles()) {
-    snapshot3[profile] = runWithProfile(profile, () => ({
-      env: existsSync24(paths.CONFIG_FILE) ? dotenv.parse(readFileSync17(paths.CONFIG_FILE, "utf-8")) : {},
+    snapshot2[profile] = runWithProfile(profile, () => ({
+      env: existsSync25(paths.CONFIG_FILE) ? dotenv.parse(readFileSync19(paths.CONFIG_FILE, "utf-8")) : {},
       agentModel: loadDashboardSettings().agent
     }));
   }
-  return snapshot3;
+  return snapshot2;
 }
 function startLocalProfileConfigHydration() {
   setProfileConfigCache(buildHostConfigSnapshot());
@@ -16699,6 +16921,7 @@ function startLocalProfileConfigHydration() {
 }
 var CALL_TIMEOUT_MS = 15e3;
 var DOCS_CALL_TIMEOUT_MS = 12e4;
+var MEMORY_EXTRACTION_TIMEOUT_MS = 165e3;
 var AUTH_TIMEOUT_MS = 5e3;
 var HEARTBEAT_INTERVAL_MS = 15e3;
 var HEARTBEAT_TIMEOUT_MS = HEARTBEAT_INTERVAL_MS * 2.5;
@@ -16898,7 +17121,7 @@ function callHost(method, args, timeoutMs = CALL_TIMEOUT_MS) {
     return Promise.resolve(null);
   }
   if (method === "docsRequest") console.log(`[host-socket] docsRequest for "${profile}" -> device ${hosts.get(ws)?.deviceId ?? "legacy"}`);
-  const id = randomUUID4();
+  const id = randomUUID5();
   return new Promise((resolve7) => {
     const timer2 = setTimeout(() => {
       pending2.delete(id);
@@ -16926,6 +17149,9 @@ function remoteAgentCallbacks() {
     cancelAgentRun: async (threadId) => await callHost("cancelAgentRun", [threadId]) ?? false,
     regenerateAgentRun: async (threadId) => await callHost("regenerateAgentRun", [threadId]) ?? false,
     listAgentRuns: async () => await callHost("listAgentRuns", []) ?? [],
+    // `null` (no Host, or no answer in time) passes through: the extractor
+    // reads it as a failed call and retries the thread next sweep.
+    completeMemoryExtraction: (req) => callHost("completeMemoryExtraction", [req], MEMORY_EXTRACTION_TIMEOUT_MS),
     // Deliberately passes `null` through rather than defaulting to `[]`: with
     // no Host connected, claiming every folder is fine would be a guess.
     listMissingCwds: () => callHost("listMissingCwds", []),
@@ -16959,6 +17185,8 @@ function remoteAgentCallbacks() {
     writeSkill: (ref, write) => callHost("writeSkill", [ref, write]),
     // Same posture as writeSkill: `null` becomes a 503.
     outputStylesRequest: (req) => callHost("outputStylesRequest", [req]),
+    // Submitting a Claude code waits on the CLI to mint the token.
+    providerLoginRequest: (req) => callHost("providerLoginRequest", [req], DOCS_CALL_TIMEOUT_MS),
     // Same posture again. Longer timeout: a first translation of a doc runs a
     // model call on the Host before it answers.
     docsRequest: (req) => callHost("docsRequest", [req], DOCS_CALL_TIMEOUT_MS),
@@ -17223,7 +17451,7 @@ async function boundWorkspaceIds(publicKey, userId) {
   return new Set(existing ? (await listDeviceWorkspaces(existing)).map((w) => w.id) : []);
 }
 function createDeviceAuthRouter() {
-  const app = new Hono30();
+  const app = new Hono31();
   app.post("/code", async (c) => {
     const body = await readBody(c);
     const publicKey = typeof body["public_key"] === "string" ? body["public_key"] : "";
@@ -17387,7 +17615,7 @@ function createDeviceAuthRouter() {
 
 // src/dashboard/api.ts
 function createApiRouter(agent = {}, mode = "all") {
-  const api = new Hono31();
+  const api = new Hono32();
   api.use("*", async (c, next) => {
     const known = await listKnownWorkspaces();
     const fromHost = profileFromHost(trustedHost(c), known);
@@ -17411,6 +17639,7 @@ function createApiRouter(agent = {}, mode = "all") {
     const resolved2 = requested && known.includes(requested) ? requested : profileFromHost(trustedHost(c), known);
     if (!resolved2) {
       return c.json({
+        unknownWorkspace: isUnknownWorkspaceHost(trustedHost(c), known),
         theme: BRANDING_DEFAULTS.theme,
         font: BRANDING_DEFAULTS.font,
         displayName: "Flyspace",
@@ -17442,6 +17671,7 @@ function createApiRouter(agent = {}, mode = "all") {
     });
     registerMirroredSkillRoutes(api, agent);
     registerRelayedOutputStylesRoutes(api, agent);
+    registerRelayedProviderLoginRoutes(api, agent);
     api.get("/channels/:id/docs/flat", requireDocsAccess, async (c) => {
       const { cwd } = resolveChannelConfig(c.req.param("id"));
       const query = c.req.query("q") ?? "";
@@ -17499,7 +17729,7 @@ function createApiRouter(agent = {}, mode = "all") {
 }
 
 // src/dashboard/app-icon-routes.ts
-import { Hono as Hono32 } from "hono";
+import { Hono as Hono33 } from "hono";
 var NEUTRAL_MANIFEST = {
   id: "/",
   name: "Flyspace",
@@ -17537,7 +17767,7 @@ async function withResolvedProfile2(c, next) {
   return profile ? runWithProfile(profile, () => next()) : next();
 }
 function createAppIconRouter() {
-  const app = new Hono32();
+  const app = new Hono33();
   app.get("/manifest.json", withResolvedProfile2, async (c) => {
     if (!await resolvedProfileHost(c)) return c.json(NEUTRAL_MANIFEST);
     const profile = getProfile();
@@ -17577,7 +17807,7 @@ function pngResponse(c, png) {
 }
 
 // src/dashboard/stripe-routes.ts
-import { Hono as Hono33 } from "hono";
+import { Hono as Hono34 } from "hono";
 function planStatusFor(status) {
   const known = ["trialing", "active", "paused", "canceled"];
   return known.includes(status) ? status : null;
@@ -17620,7 +17850,7 @@ async function handleCardAdded(session) {
   }
 }
 function createStripeWebhookRouter() {
-  const stripeRouter = new Hono33();
+  const stripeRouter = new Hono34();
   stripeRouter.post("/webhook", async (c) => {
     const secret = process.env["STRIPE_WEBHOOK_SECRET"];
     const signature = c.req.header("stripe-signature");
@@ -17731,7 +17961,7 @@ function startHostStatusBroadcast() {
 
 // src/dashboard/server.ts
 var DEFAULT_DASHBOARD_PORT = 4747;
-var WEB_DIST = join23(paths.PACKAGE_ROOT, "web", "dist");
+var WEB_DIST = join25(paths.PACKAGE_ROOT, "web", "dist");
 var DEFAULT_DASHBOARD_HOST = "127.0.0.1";
 async function findFreePort(start, host = DEFAULT_DASHBOARD_HOST, attempts = 50) {
   for (let port = start; port < start + attempts; port++) {
@@ -17780,7 +18010,8 @@ async function startDashboardServer(preferredPort = DEFAULT_DASHBOARD_PORT, host
   const mirrorsSkills = mode === "host" || process.env["FLYSPACE_SKILL_SYNC"] === "1";
   const stopSkillSync = mirrorsSkills ? installSkillSync(listProfiles()) : () => {
   };
-  const app = new Hono34();
+  const app = new Hono35();
+  app.onError(reportingErrorHandler);
   app.use("*", async (c, next) => {
     await next();
     if (c.req.path.startsWith("/assets/")) {
@@ -17819,14 +18050,14 @@ async function startDashboardServer(preferredPort = DEFAULT_DASHBOARD_PORT, host
   } else {
     app.route("/share", createPublicShareAssetRouter(WEB_DIST));
     app.route("/", createAppIconRouter());
-    if (existsSync25(WEB_DIST) || existsSync25(join23(paths.PACKAGE_ROOT, "web", "package.json"))) {
+    if (existsSync26(WEB_DIST) || existsSync26(join25(paths.PACKAGE_ROOT, "web", "package.json"))) {
       app.use("/*", serveStatic({ root: WEB_DIST }));
     }
     app.get("/assets/*", (c) => c.text("stale asset \u2014 reload for the current build", 404));
-    const spaFallback = serveStatic({ path: join23(WEB_DIST, "index.html") });
+    const spaFallback = serveStatic({ path: join25(WEB_DIST, "index.html") });
     app.get("*", async (c, next) => {
-      if (!existsSync25(join23(WEB_DIST, "index.html"))) {
-        const isCheckout = existsSync25(join23(paths.PACKAGE_ROOT, "web", "package.json"));
+      if (!existsSync26(join25(WEB_DIST, "index.html"))) {
+        const isCheckout = existsSync26(join25(paths.PACKAGE_ROOT, "web", "package.json"));
         return c.text(
           isCheckout ? `Workspace UI build missing (${WEB_DIST}).
 Run \`pnpm --dir web build\` (or \`pnpm --dir web dev\`).
@@ -18264,7 +18495,7 @@ async function threadReplies(client2, nameOrId, ts2) {
 async function postMessage(client2, args) {
   const channelArg = getArg2(args, "--channel");
   const textFilePath = getArg2(args, "--text-file");
-  const text = textFilePath ? readFileSync18(textFilePath, "utf8") : getArg2(args, "--text");
+  const text = textFilePath ? readFileSync20(textFilePath, "utf8") : getArg2(args, "--text");
   const threadTs = getArg2(args, "--thread");
   const markdown = args.includes("--markdown");
   const broadcast = args.includes("--broadcast") && Boolean(threadTs);
@@ -18362,7 +18593,7 @@ function defaultClaudeConfigDir() {
   return process.env.CLAUDE_CONFIG_DIR || resolve6(homedir9(), ".claude");
 }
 function hasClaudeCredentials(configDir2) {
-  if (existsSync26(resolve6(configDir2, ".credentials.json"))) {
+  if (existsSync27(resolve6(configDir2, ".credentials.json"))) {
     return true;
   }
   if (process.platform === "darwin") {
@@ -18419,7 +18650,7 @@ async function ensureClaudeCodeReady() {
 }
 function getManifestYaml(botName) {
   const manifestPath = resolve6(paths.PACKAGE_ROOT, "slack-app-manifest.yml");
-  const raw = readFileSync18(manifestPath, "utf-8");
+  const raw = readFileSync20(manifestPath, "utf-8");
   return raw.replace(/name: Custie/g, `name: ${botName}`);
 }
 async function stepPersonalise() {
@@ -18632,7 +18863,7 @@ async function stepBrowserTokens(botName) {
     })
   ));
   const DEBUG = process.argv.includes("--debug");
-  const USER_DATA_DIR = resolve6(tmpdir4(), "custie-playwright-profile");
+  const USER_DATA_DIR = resolve6(tmpdir5(), "custie-playwright-profile");
   let context;
   try {
     log4("Opening browser \u2014 a Slack login page will appear.\n");
@@ -18726,7 +18957,7 @@ async function stepBrowserTokens(botName) {
       let settled = false;
       let interval;
       let timeout;
-      const finish = (action) => {
+      const finish2 = (action) => {
         if (settled) return;
         settled = true;
         clearInterval(interval);
@@ -18735,7 +18966,7 @@ async function stepBrowserTokens(botName) {
       };
       const checkUrl = (p) => {
         if (p.url().includes("install-on-team?success=1")) {
-          finish(() => resolve7(p));
+          finish2(() => resolve7(p));
         }
       };
       context.on("page", (newPage) => {
@@ -18746,7 +18977,7 @@ async function stepBrowserTokens(botName) {
         for (const p of context.pages()) checkUrl(p);
       }, 1e3);
       timeout = setTimeout(() => {
-        finish(() => reject(new Error("Timed out waiting for the app to be installed.")));
+        finish2(() => reject(new Error("Timed out waiting for the app to be installed.")));
       }, 12e4);
     });
     success4("App installed! Extracting Bot Token...");
@@ -18836,7 +19067,7 @@ function writeConfigFile(config) {
     `OWNER_USER_ID=${config.ownerUserId}`,
     ``
   ].join("\n");
-  writeFileSync11(paths.CONFIG_FILE, envContent);
+  writeFileSync12(paths.CONFIG_FILE, envContent);
   success4(`Config written to ${paths.CONFIG_FILE}`);
 }
 function printNextSteps() {
@@ -18848,11 +19079,11 @@ function printNextSteps() {
   console.log("     Run \x1B[1mflyspace service install\x1B[0m\n");
 }
 function copyDefaultPrompt(botName) {
-  if (!existsSync26(paths.PROMPT_FILE)) {
+  if (!existsSync27(paths.PROMPT_FILE)) {
     const defaultPrompt = resolve6(paths.PACKAGE_ROOT, "system.default.md");
-    if (existsSync26(defaultPrompt)) {
-      const content = readFileSync18(defaultPrompt, "utf-8").replace(/\{\{botName\}\}/g, botName);
-      writeFileSync11(paths.PROMPT_FILE, content);
+    if (existsSync27(defaultPrompt)) {
+      const content = readFileSync20(defaultPrompt, "utf-8").replace(/\{\{botName\}\}/g, botName);
+      writeFileSync12(paths.PROMPT_FILE, content);
       success4(`Default prompt copied to ${paths.PROMPT_FILE}`);
     }
   }
@@ -18864,7 +19095,7 @@ async function runSlackSetup(args) {
     const prereq = await ensureClaudeCodeReady();
     if (!prereq) return;
     const { claudeConfigDir } = prereq;
-    if (existsSync26(paths.CONFIG_FILE)) {
+    if (existsSync27(paths.CONFIG_FILE)) {
       const reconfigure = await confirm4({
         message: `Config already exists at ${paths.CONFIG_FILE}. Reconfigure?`,
         default: false
@@ -19146,6 +19377,7 @@ async function runPost(args) {
 }
 async function runChatCmd(args) {
   loadEnvFiles();
+  useHostDbWithoutCredentials();
   const subcommand = args[0];
   const rest = args.slice(1);
   switch (subcommand) {
@@ -19174,21 +19406,21 @@ async function runChatCmd(args) {
 }
 
 // src/commands/memory.ts
-import { readFileSync as readFileSync20 } from "fs";
+import { readFileSync as readFileSync22 } from "fs";
 
 // src/store/claude-memory-import.ts
-import { existsSync as existsSync27, readdirSync as readdirSync5, readFileSync as readFileSync19 } from "fs";
+import { existsSync as existsSync28, readdirSync as readdirSync5, readFileSync as readFileSync21 } from "fs";
 import { homedir as homedir10 } from "os";
-import { basename as basename8, join as join24 } from "path";
+import { basename as basename8, join as join26 } from "path";
 import dotenv2 from "dotenv";
 function claudeMemoryDir(cwd, configDir2) {
-  return join24(configDir2, "projects", cwd.replaceAll(/[^a-zA-Z0-9]/g, "-"), "memory");
+  return join26(configDir2, "projects", cwd.replaceAll(/[^a-zA-Z0-9]/g, "-"), "memory");
 }
 function profileClaudeConfigDirFor(profile) {
-  const dir = profile === "default" ? paths.BASE_CONFIG_DIR : join24(paths.PROFILES_DIR, profile);
-  const file = join24(dir, "config.env");
-  const env = existsSync27(file) ? dotenv2.parse(readFileSync19(file)) : {};
-  return env["CLAUDE_CONFIG_DIR"]?.trim() || join24(homedir10(), ".claude");
+  const dir = profile === "default" ? paths.BASE_CONFIG_DIR : join26(paths.PROFILES_DIR, profile);
+  const file = join26(dir, "config.env");
+  const env = existsSync28(file) ? dotenv2.parse(readFileSync21(file)) : {};
+  return env["CLAUDE_CONFIG_DIR"]?.trim() || join26(homedir10(), ".claude");
 }
 var TYPE_MAP = {
   user: "preference",
@@ -19196,7 +19428,7 @@ var TYPE_MAP = {
   project: "fact",
   reference: "reference"
 };
-var DESCRIPTION_MAX2 = 200;
+var DESCRIPTION_MAX = 200;
 function unquote2(value) {
   const v = value.trim();
   return /^(["']).*\1$/.test(v) ? v.slice(1, -1) : v;
@@ -19214,8 +19446,8 @@ function parseClaudeMemory(fileName, text, channelId) {
   }
   const name = slugify(fields["name"] || basename8(fileName, ".md"));
   let description = (fields["description"] ?? "").replaceAll(/\s+/g, " ").trim();
-  if (description.length > DESCRIPTION_MAX2) {
-    description = `${description.slice(0, DESCRIPTION_MAX2 - 3).trimEnd()}...`;
+  if (description.length > DESCRIPTION_MAX) {
+    description = `${description.slice(0, DESCRIPTION_MAX - 3).trimEnd()}...`;
   }
   const input2 = {
     channelId,
@@ -19233,11 +19465,11 @@ function parseClaudeMemory(fileName, text, channelId) {
   return input2;
 }
 async function importClaudeMemories(dir, channelId, opts = {}) {
-  if (!existsSync27(dir)) throw new Error(`No Claude memory directory at ${dir}`);
+  if (!existsSync28(dir)) throw new Error(`No Claude memory directory at ${dir}`);
   const files = readdirSync5(dir).filter((f) => f.endsWith(".md") && f !== "MEMORY.md").sort();
   const results = [];
   for (const file of files) {
-    const parsed = parseClaudeMemory(file, readFileSync19(join24(dir, file), "utf-8"), channelId);
+    const parsed = parseClaudeMemory(file, readFileSync21(join26(dir, file), "utf-8"), channelId);
     if ("skip" in parsed) {
       results.push({ file, outcome: "skipped", reason: parsed.skip });
       continue;
@@ -19272,6 +19504,12 @@ var USAGE5 = `
                                          Defaults to the channel profile's CLAUDE_CONFIG_DIR
                                          (or ~/.claude)/projects/<cwd slug>/memory
 
+  Scope (list, get, search, save, delete; default: the channel's memory):
+    --scope user --user <user-id>        That member's personal memory, in the channel's
+                                         workspace. Only ever the current sender's.
+    --scope workspace                    The workspace's memory. Read-only here: only a
+                                         Workspace Admin changes it, from Settings.
+
   Types: ${MEMORY_TYPES.join(", ")}
 `;
 function getArg4(args, flag) {
@@ -19291,6 +19529,7 @@ function indexLine(m) {
 }
 async function runMemoryCmd(args) {
   loadEnvFiles();
+  useHostDbWithoutCredentials();
   const subcommand = args[0];
   const rest = args.slice(1);
   if (!subcommand || subcommand === "-h" || subcommand === "--help") {
@@ -19301,17 +19540,23 @@ async function runMemoryCmd(args) {
   if (!channelArg) throw new Error("--channel <name-or-id> is required");
   const channel = await resolveChannel(channelArg, getArg4(rest, "--profile-name"));
   const words = positionals(rest);
+  const target = await resolveTarget(rest, channel);
+  const where = target.scope === "channel" ? channel.name : `${target.scope} memory`;
+  if (target.scope === "workspace" && (subcommand === "save" || subcommand === "delete")) {
+    throw new Error("Workspace memory is read-only to the agent; a Workspace Admin manages it.");
+  }
   switch (subcommand) {
     case "list": {
-      const memories = await listChannelMemories(channel.id);
+      const memories = await listMemories(target);
       console.log(memories.length ? memories.map(indexLine).join("\n") : "No memories yet.");
       break;
     }
     case "get": {
       const name = words[0];
       if (!name) throw new Error("Usage: flyspace memory get --channel <c> <name>");
-      const memory = await getChannelMemory(channel.id, name);
-      if (!memory) throw new Error(`No memory named ${name} in ${channel.name}.`);
+      const memory = await getMemory(target, name);
+      if (!memory) throw new Error(`No memory named ${name} in ${where}.`);
+      await markMemoryUsed(memory);
       console.log(`# ${memory.name} (${memory.type})
 
 ${memory.description}
@@ -19321,7 +19566,7 @@ ${memory.body}`);
     }
     case "search": {
       if (!words.length) throw new Error("Usage: flyspace memory search --channel <c> <words...>");
-      const hits = await searchChannelMemories(channel.id, words.join(" "));
+      const hits = await searchMemories(target, words.join(" "));
       console.log(hits.length ? hits.map(indexLine).join("\n") : "No matching memories.");
       break;
     }
@@ -19336,11 +19581,11 @@ ${memory.body}`);
         );
       }
       if (!isMemoryType(type)) throw new Error(`--type must be one of ${MEMORY_TYPES.join(", ")}`);
-      const body = bodyArg === "-" ? readFileSync20(0, "utf-8") : bodyArg;
+      const body = bodyArg === "-" ? readFileSync22(0, "utf-8") : bodyArg;
       const thread = getArg4(rest, "--thread");
-      const { created, changed } = await saveChannelMemory(
+      const { created, changed } = await saveMemory(
+        target,
         {
-          channelId: channel.id,
           name,
           type,
           description,
@@ -19351,18 +19596,19 @@ ${memory.body}`);
         "agent"
       );
       const verb = created ? "Saved" : changed ? "Updated" : "Unchanged:";
-      console.log(`${verb} memory ${name} in ${channel.name}.`);
+      console.log(`${verb} memory ${name} in ${where}.`);
       break;
     }
     case "delete": {
       const ref = words[0];
       if (!ref) throw new Error("Usage: flyspace memory delete --channel <c> <name-or-id>");
-      const deleted = await deleteChannelMemory(channel.id, ref, "agent", getArg4(rest, "--thread"));
-      if (!deleted) throw new Error(`No memory ${ref} in ${channel.name}.`);
+      const deleted = await deleteMemory(target, ref, "agent", getArg4(rest, "--thread"));
+      if (!deleted) throw new Error(`No memory ${ref} in ${where}.`);
       console.log(`Deleted memory ${ref}.`);
       break;
     }
     case "import": {
+      if (target.scope !== "channel") throw new Error("import only fills a channel memory");
       const dir = getArg4(rest, "--dir") ?? claudeMemoryDir(channel.cwd, profileClaudeConfigDirFor(channel.profile));
       const dryRun = rest.includes("--dry-run");
       const results = await importClaudeMemories(dir, channel.id, { dryRun });
@@ -19382,6 +19628,19 @@ ${memory.body}`);
       process.exit(1);
   }
 }
+async function resolveTarget(args, channel) {
+  const scope = getArg4(args, "--scope") ?? "channel";
+  if (scope === "channel") return { scope: "channel", channelId: channel.id };
+  if (scope !== "user" && scope !== "workspace") {
+    throw new Error("--scope must be channel, user or workspace");
+  }
+  const workspace = await getWorkspaceBySlug(channel.profile);
+  if (!workspace) throw new Error(`No workspace for ${channel.profile}.`);
+  if (scope === "workspace") return { scope, workspaceId: workspace.id };
+  const userId = getArg4(args, "--user");
+  if (!userId) throw new Error("--scope user needs --user <user-id>");
+  return { scope, workspaceId: workspace.id, userId };
+}
 
 // src/commands/mcp.ts
 var USAGE6 = `
@@ -19420,10 +19679,10 @@ async function runMcpCmd(args) {
 }
 
 // src/commands/dashboard.ts
-import { spawn as spawn5, spawnSync } from "child_process";
-import { existsSync as existsSync28 } from "fs";
+import { spawn as spawn7, spawnSync } from "child_process";
+import { existsSync as existsSync29 } from "fs";
 import { platform as platform7 } from "os";
-import { join as join25 } from "path";
+import { join as join27 } from "path";
 function flagValue(args, name) {
   const eq = args.find((a) => a.startsWith(`--${name}=`));
   if (eq) return eq.slice(`--${name}=`.length);
@@ -19433,13 +19692,13 @@ function flagValue(args, name) {
 function openBrowser2(url) {
   const cmd = platform7() === "darwin" ? "open" : platform7() === "win32" ? "start" : "xdg-open";
   try {
-    spawn5(cmd, [url], { stdio: "ignore", detached: true }).unref();
+    spawn7(cmd, [url], { stdio: "ignore", detached: true }).unref();
   } catch {
   }
 }
 function ensureWebBuild() {
-  if (existsSync28(join25(paths.PACKAGE_ROOT, "web", "dist", "index.html"))) return;
-  if (!existsSync28(join25(paths.PACKAGE_ROOT, "web", "package.json"))) return;
+  if (existsSync29(join27(paths.PACKAGE_ROOT, "web", "dist", "index.html"))) return;
+  if (!existsSync29(join27(paths.PACKAGE_ROOT, "web", "package.json"))) return;
   console.log("  web/dist missing \u2014 building the dashboard UI (pnpm --dir web build)...");
   const result = spawnSync("pnpm", ["--dir", "web", "build"], {
     cwd: paths.PACKAGE_ROOT,
@@ -19489,7 +19748,7 @@ async function runDashboard(args) {
 }
 
 // src/commands/workspace.ts
-import { existsSync as existsSync29, mkdirSync as mkdirSync11, writeFileSync as writeFileSync12 } from "fs";
+import { existsSync as existsSync30, mkdirSync as mkdirSync13, writeFileSync as writeFileSync13 } from "fs";
 var USAGE7 = `
   Usage: flyspace workspace <subcommand> [options]
 
@@ -19575,10 +19834,10 @@ function provisionLocal(botName) {
   ensureDirs();
   console.log(`  config dir ready (${paths.CONFIG_DIR})`);
   console.log(`  data dir ready (${paths.DATA_DIR})`);
-  if (existsSync29(paths.CONFIG_FILE)) {
+  if (existsSync30(paths.CONFIG_FILE)) {
     console.log("  config.env exists");
   } else {
-    writeFileSync12(paths.CONFIG_FILE, `BOT_NAME=${botName}
+    writeFileSync13(paths.CONFIG_FILE, `BOT_NAME=${botName}
 `);
     console.log(`  config.env written (${paths.CONFIG_FILE})`);
   }
@@ -19592,8 +19851,8 @@ async function provisionChannels(specs) {
       continue;
     }
     const cwd = expandPath(spec.cwd);
-    if (!existsSync29(cwd)) {
-      mkdirSync11(cwd, { recursive: true });
+    if (!existsSync30(cwd)) {
+      mkdirSync13(cwd, { recursive: true });
       console.log(`  created cwd ${cwd}`);
     }
     await createChannel({ name: spec.name, cwd, position: index });
@@ -19802,7 +20061,7 @@ async function main() {
       break;
     case "-v":
     case "--version":
-      printRaw("0.1.14");
+      printRaw("0.1.16");
       break;
     case "-h":
     case "--help":