flyspace-cli 0.1.15 → 0.1.16

package/dist/cli.js

@@ -5,6 +5,7 @@ import {
   BOT_PROFILE_KEY,
   BRANDING_DEFAULTS,
   BUILT_IN_OUTPUT_STYLES,
+  ChannelCwdError,
   DEFAULT_CODEX_MODEL,
   DEFAULT_TIMEZONE,
   DEFAULT_TITLE_RULES,
@@ -34,6 +35,7 @@ import {
   canSeeChannel,
   channelSkillsDir,
   claudeAuthFailed,
+  clearClaudeAuthFailed,
   codexAuthAvailable,
   createChannel,
   createMembership,
@@ -42,6 +44,7 @@ import {
   createWorkspace,
   deleteChannelMemory,
   deleteMembership,
+  deleteMemory,
   deleteOutputStyle,
   deleteSkillFile,
   deleteWorkspace,
@@ -68,6 +71,7 @@ import {
   getChannelRegistry,
   getMembershipByEmail,
   getMembershipByUserId,
+  getMemory,
   getOutputStyleDefault,
   getProfileChannelRegistry,
   getWorkspaceBilling,
@@ -96,6 +100,8 @@ import {
   listMemberChannels,
   listMemberships,
   listMembershipsByEmail,
+  listMemories,
+  listMemoryEvents,
   listOutputStyles,
   listPluginSkillDetails,
   listSkillFiles,
@@ -118,6 +124,7 @@ import {
   localDefaults,
   lookupById,
   markInviteResent,
+  markMemoryUsed,
   markWorkspaceAgentConnected,
   markWorkspaceGreeted,
   markWorkspaceProjectsSetup,
@@ -126,6 +133,7 @@ import {
   mimetypeSizeLimit,
   modelLabel,
   pinnedClaudeConfigDir,
+  promoteChannelMemory,
   readSkillFile,
   recentRunsForWorkspace,
   refreshAutomationRegistry,
@@ -148,12 +156,14 @@ import {
   saveBotIdentity,
   saveChannelMemory,
   saveDashboardSettings,
+  saveMemory,
   saveWorkspaceBranding,
   saveWorkspacePrompt,
-  searchChannelMemories,
+  searchMemories,
   setAgentPaused,
   setAllowGuestAccess,
   setMembershipHandle,
+  setMemoryAutoPaused,
   setOutputStyleDefault,
   setWorkspaceStripeSubscription,
   slackConfigured,
@@ -168,6 +178,7 @@ import {
   updateChannelMemory,
   updateChannelsMcpConnections,
   updateMembershipRole,
+  updateMemory,
   updateOutputStyle,
   updateWorkspacePlanStatus,
   usageLimitedModels,
@@ -176,7 +187,7 @@ import {
   warnOnBrokenChannelCwds,
   workspaceSkillsDir,
   writeSkillFile
-} from "./chunk-KFT2YP5W.js";
+} from "./chunk-2OGLCT7I.js";
 import {
   firstReplyBody,
   getThread,
@@ -1348,14 +1359,14 @@ function detectRunners(history = { claude: false, codex: false }) {
 function scanOnboarding() {
   const byPath = /* @__PURE__ */ new Map();
   const history = { claude: false, codex: false };
-  const add = (rawPath, source, mtime, sessions, trusted = false) => {
+  const add = (rawPath, source, mtime, sessions2, trusted = false) => {
     const path = resolve3(rawPath);
     if (isExcluded(path)) return;
     const existing = byPath.get(path);
     if (existing) {
       if (!existing.sources.includes(source)) existing.sources.push(source);
       existing.lastUsed = Math.max(existing.lastUsed, mtime);
-      existing.sessions += sessions;
+      existing.sessions += sessions2;
       existing.trusted ||= trusted;
     } else {
       byPath.set(path, {
@@ -1363,7 +1374,7 @@ function scanOnboarding() {
         name: basename2(path),
         sources: [source],
         lastUsed: mtime,
-        sessions,
+        sessions: sessions2,
         trusted
       });
     }
@@ -1765,7 +1776,7 @@ async function runAuthCmd(args) {
 }
 
 // src/version.ts
-var CLI_VERSION = true ? "0.1.15" : null;
+var CLI_VERSION = true ? "0.1.16" : null;
 function isOlderVersion(a, b) {
   const parse2 = (v) => v.replace(/^v/, "").split("-")[0].split(".").map(Number);
   const [pa, pb] = [parse2(a), parse2(b)];
@@ -2043,7 +2054,7 @@ ${BOLD3}Flyspace Doctor${RESET3}
 }
 
 // src/commands/uninstall.ts
-import { existsSync as existsSync7, readFileSync as readFileSync8, rmSync as rmSync4, unlinkSync as unlinkSync2, writeFileSync as writeFileSync6 } from "fs";
+import { existsSync as existsSync7, mkdirSync as mkdirSync7, readFileSync as readFileSync8, rmSync as rmSync4, unlinkSync as unlinkSync2, writeFileSync as writeFileSync6 } from "fs";
 import { confirm as confirm3 } from "@inquirer/prompts";
 import { execSync as execSync5 } from "child_process";
 import { basename as basename3, join as join9 } from "path";
@@ -2110,12 +2121,31 @@ async function runUninstall(args = []) {
   console.log("    - revokes this device and removes every background service");
   for (const t of targets) console.log(`    - deletes ${t}`);
   console.log("  Your channel folders (~/Flyspace) are kept.\n");
-  if (!args.includes("--yes") && !args.includes("-y")) {
+  const backupSources = [paths.BASE_CONFIG_DIR, paths.BASE_DATA_DIR].filter(existsSync7);
+  const interactive = !args.includes("--yes") && !args.includes("-y");
+  let backup = !args.includes("--no-backup") && backupSources.length > 0;
+  if (interactive) {
+    if (backup) backup = await confirm3({ message: "Back up local data first?", default: true });
     if (!await confirm3({ message: "Continue?", default: false })) {
       console.log("  Cancelled.");
       return;
     }
   }
+  let backupFile;
+  if (backup) {
+    const dir = join9(homedir4(), "Flyspace", ".uninstall-backups");
+    mkdirSync7(dir, { recursive: true });
+    const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+    backupFile = join9(dir, `flyspace-${stamp}.tar.gz`);
+    const rel = backupSources.map((s) => `"${s.replace(/^\//, "")}"`).join(" ");
+    try {
+      run2(`tar -czf "${backupFile}" -C / ${rel}`);
+      success2(`Backup saved to ${backupFile}`);
+    } catch (err) {
+      warn2(`Backup failed, nothing was removed: ${err.message}`);
+      return;
+    }
+  }
   const creds = loadCredentials();
   if (creds) {
     try {
@@ -2142,7 +2172,11 @@ async function runUninstall(args = []) {
       success2(`Removed PATH entry from ${rc}`);
     }
   }
-  console.log("\n  Flyspace is uninstalled. Open a new terminal to finish.\n");
+  console.log("\n  Flyspace is uninstalled. Open a new terminal to finish.");
+  if (backupFile) {
+    console.log(`  To restore your local data after reinstalling: tar -xzf "${backupFile}" -C /`);
+  }
+  console.log("");
 }
 
 // src/commands/profiles-cmd.ts
@@ -2257,7 +2291,7 @@ function npmEnv() {
   return home ? { ...process.env, PATH: `${join10(home, "node", "bin")}:${process.env.PATH ?? ""}` } : process.env;
 }
 async function runUpgrade() {
-  const current = "0.1.15";
+  const current = "0.1.16";
   console.log(`Current version: ${current}`);
   console.log("Checking for updates...\n");
   try {
@@ -2898,7 +2932,7 @@ async function runLogs(args) {
 
 // src/commands/slack.ts
 import { execFileSync as execFileSync4 } from "child_process";
-import { existsSync as existsSync26, readFileSync as readFileSync19, writeFileSync as writeFileSync11 } from "fs";
+import { existsSync as existsSync27, readFileSync as readFileSync20, writeFileSync as writeFileSync12 } from "fs";
 import { resolve as resolve6 } from "path";
 import { tmpdir as tmpdir5, homedir as homedir9 } from "os";
 import { input, confirm as confirm4, select, checkbox } from "@inquirer/prompts";
@@ -4436,10 +4470,10 @@ async function deliverPasswordResetLink(email, redirectTo) {
 }
 
 // src/dashboard/server.ts
-import { existsSync as existsSync25 } from "fs";
+import { existsSync as existsSync26 } from "fs";
 import { createServer } from "net";
-import { join as join24 } from "path";
-import { Hono as Hono34 } from "hono";
+import { join as join25 } from "path";
+import { Hono as Hono35 } from "hono";
 
 // src/dashboard/sentry.ts
 import * as Sentry from "@sentry/node";
@@ -4456,7 +4490,7 @@ import { serve } from "@hono/node-server";
 import { serveStatic } from "@hono/node-server/serve-static";
 
 // src/reconcile.ts
-import { existsSync as existsSync10, mkdirSync as mkdirSync7, writeFileSync as writeFileSync7 } from "fs";
+import { existsSync as existsSync10, mkdirSync as mkdirSync8, writeFileSync as writeFileSync7 } from "fs";
 async function boundWorkspaces2() {
   return (await boundWorkspaces())?.workspaces ?? null;
 }
@@ -4482,7 +4516,7 @@ async function reconcileProfile(profile) {
       if (!channel.cwd) continue;
       const cwd = expandPath(channel.cwd);
       if (isCwdUsable(cwd)) continue;
-      mkdirSync7(cwd, { recursive: true });
+      mkdirSync8(cwd, { recursive: true });
       log5.push(`channel "${channel.name}" cwd created (${cwd})`);
     }
     return log5;
@@ -4556,45 +4590,18 @@ var RANK = { none: 0, read: 1, write: 2 };
 function docsAccessAtLeast(have, need) {
   return RANK[have] >= RANK[need];
 }
-function isDocsGrant(value) {
-  return value === "read" || value === "write";
+function isDocsAccess(value) {
+  return value === "none" || value === "read" || value === "write";
 }
-function rowToGrant(row) {
-  return {
-    id: row["id"],
-    channelId: row["channel_id"],
-    membershipId: row["membership_id"],
-    access: row["access"],
-    grantedAt: row["granted_at"]
-  };
-}
-async function listChannelDocsAccess(channelId) {
-  const { data, error: error2 } = await getSupabaseClient().from("channel_docs_access").select("*").eq("channel_id", channelId).order("granted_at", { ascending: true });
-  if (error2) throw new Error(`listChannelDocsAccess(${channelId}): ${error2.message}`);
-  return (data ?? []).map(rowToGrant);
+async function getChannelDocsMemberAccess(channelId) {
+  const { data, error: error2 } = await getSupabaseClient().from("channels").select("docs_member_access").eq("id", channelId).maybeSingle();
+  if (error2) throw new Error(`getChannelDocsMemberAccess(${channelId}): ${error2.message}`);
+  const level = data?.docs_member_access;
+  return isDocsAccess(level) ? level : "none";
 }
-async function getChannelDocsGrant(channelId, membershipId) {
-  const { data, error: error2 } = await getSupabaseClient().from("channel_docs_access").select("*").eq("channel_id", channelId).eq("membership_id", membershipId).maybeSingle();
-  if (error2) throw new Error(`getChannelDocsGrant(${channelId}, ${membershipId}): ${error2.message}`);
-  return data ? rowToGrant(data) : null;
-}
-async function upsertChannelDocsAccess(params) {
-  const { data, error: error2 } = await getSupabaseClient().from("channel_docs_access").upsert(
-    { channel_id: params.channelId, membership_id: params.membershipId, access: params.access },
-    { onConflict: "channel_id,membership_id" }
-  ).select("*").single();
-  if (error2) {
-    throw new Error(
-      `upsertChannelDocsAccess(${params.channelId}, ${params.membershipId}): ${error2.message}`
-    );
-  }
-  return rowToGrant(data);
-}
-async function removeChannelDocsAccess(channelId, membershipId) {
-  const { data, error: error2 } = await getSupabaseClient().from("channel_docs_access").delete().eq("channel_id", channelId).eq("membership_id", membershipId).select("id");
-  if (error2) {
-    throw new Error(`removeChannelDocsAccess(${channelId}, ${membershipId}): ${error2.message}`);
-  }
+async function setChannelDocsMemberAccess(channelId, access) {
+  const { data, error: error2 } = await getSupabaseClient().from("channels").update({ docs_member_access: access }).eq("id", channelId).select("id");
+  if (error2) throw new Error(`setChannelDocsMemberAccess(${channelId}): ${error2.message}`);
   return data?.length ? true : false;
 }
 async function resolveForMembership(membership, channelId) {
@@ -4603,8 +4610,7 @@ async function resolveForMembership(membership, channelId) {
   if (members.some((m) => m.membershipId === membership.id && m.role === "channel_admin")) {
     return "write";
   }
-  const grant = await getChannelDocsGrant(channelId, membership.id);
-  return grant?.access ?? "none";
+  return getChannelDocsMemberAccess(channelId);
 }
 async function resolveDocsAccess(ctx, channelId) {
   if (ctx.role === "admin") return "write";
@@ -4626,15 +4632,16 @@ async function filterReadableDocsChannels(ctx, channelIds) {
   if (ctx.role === "admin") return new Set(channelIds);
   const membership = await getMembershipByUserId(ctx.workspaceId, ctx.userId);
   if (!membership) return /* @__PURE__ */ new Set();
+  if (channelIds.length === 0) return /* @__PURE__ */ new Set();
   const db = getSupabaseClient();
-  const [grants, roles] = await Promise.all([
-    db.from("channel_docs_access").select("channel_id").eq("membership_id", membership.id),
+  const [open, roles] = await Promise.all([
+    db.from("channels").select("id").in("id", channelIds).neq("docs_member_access", "none"),
     db.from("channel_members").select("channel_id, role").eq("membership_id", membership.id)
   ]);
-  if (grants.error) throw new Error(`filterReadableDocsChannels: ${grants.error.message}`);
+  if (open.error) throw new Error(`filterReadableDocsChannels: ${open.error.message}`);
   if (roles.error) throw new Error(`filterReadableDocsChannels: ${roles.error.message}`);
   const allowed = /* @__PURE__ */ new Set();
-  for (const r of grants.data ?? []) allowed.add(r.channel_id);
+  for (const r of open.data ?? []) allowed.add(r.id);
   for (const r of roles.data ?? []) {
     if (r.role === "channel_admin") allowed.add(r.channel_id);
   }
@@ -4653,7 +4660,7 @@ var requireDocsAccess = async (c, next) => {
 };
 
 // src/dashboard/api.ts
-import { Hono as Hono31 } from "hono";
+import { Hono as Hono32 } from "hono";
 
 // src/dashboard/public-share-routes.ts
 import { existsSync as existsSync11, readFileSync as readFileSync10, statSync as statSync3 } from "fs";
@@ -7251,12 +7258,12 @@ async function offlineAgentIdentities() {
 }
 
 // src/dashboard/host-api.ts
-import { existsSync as existsSync20, readFileSync as readFileSync15, statSync as statSync8 } from "fs";
-import { join as join22 } from "path";
+import { existsSync as existsSync21, readFileSync as readFileSync16, statSync as statSync8 } from "fs";
+import { join as join23 } from "path";
 import sharp3 from "sharp";
 
 // src/dashboard/channels-routes.ts
-import { existsSync as existsSync12, mkdirSync as mkdirSync8 } from "fs";
+import { existsSync as existsSync12, mkdirSync as mkdirSync9 } from "fs";
 import { Hono as Hono9 } from "hono";
 
 // src/dashboard/feature-flags-routes.ts
@@ -7329,7 +7336,7 @@ function coerceMemberEmails(raw) {
 }
 function ensureCwdDir(cwd) {
   const expanded = isLogicalCwd(cwd) ? resolveLogicalCwd(cwd) : expandPath(cwd);
-  if (!existsSync12(expanded)) mkdirSync8(expanded, { recursive: true });
+  if (!existsSync12(expanded)) mkdirSync9(expanded, { recursive: true });
 }
 function toResponse(channel) {
   return {
@@ -7367,7 +7374,6 @@ function createChannelWriteRouter() {
     const externalChannelId = typeof body["externalChannelId"] === "string" && body["externalChannelId"].trim() ? body["externalChannelId"].trim() : null;
     const categoryId = typeof body["categoryId"] === "string" && body["categoryId"].trim() ? body["categoryId"].trim() : null;
     try {
-      ensureCwdDir(cwd);
       const channel = await createChannel({
         name,
         cwd,
@@ -7380,9 +7386,10 @@ function createChannelWriteRouter() {
         externalChannelId,
         categoryId
       });
+      ensureCwdDir(cwd);
       return c.json(toResponse(channel), 201);
     } catch (err) {
-      return c.json({ error: err.message }, err instanceof DefaultChannelError ? 400 : 500);
+      return c.json({ error: err.message }, err instanceof DefaultChannelError || err instanceof ChannelCwdError ? 400 : 500);
     }
   });
   app.put("/:id", async (c) => {
@@ -7396,7 +7403,6 @@ function createChannelWriteRouter() {
     if (coerceRuntime(body["runtime"]) === "sandbox" && existing.runtime !== "sandbox" && !await isFeatureEnabled(c, "sandbox"))
       return c.json({ error: "feature not enabled" }, 403);
     try {
-      ensureCwdDir(cwd);
       const channel = await updateChannelById(id, {
         name: typeof body["name"] === "string" ? body["name"] : void 0,
         cwd,
@@ -7409,10 +7415,11 @@ function createChannelWriteRouter() {
         runtime: coerceRuntime(body["runtime"]),
         mounts: coerceMounts(body["mounts"])
       });
+      ensureCwdDir(cwd);
       dropSessionsIfRuntimeChanged(id, existing.runtime, channel.runtime);
       return c.json(toResponse(channel), 200);
     } catch (err) {
-      return c.json({ error: err.message }, err instanceof DefaultChannelError ? 400 : 500);
+      return c.json({ error: err.message }, err instanceof DefaultChannelError || err instanceof ChannelCwdError ? 400 : 500);
     }
   });
   app.patch("/reorder", async (c) => {
@@ -7464,12 +7471,12 @@ function createChannelWriteRouter() {
       patch.archivedAt = body["archived"] ? (/* @__PURE__ */ new Date()).toISOString() : null;
     }
     try {
-      if (patch.cwd) ensureCwdDir(patch.cwd);
       const channel = await updateChannelById(id, patch);
+      if (patch.cwd) ensureCwdDir(patch.cwd);
       dropSessionsIfRuntimeChanged(id, existing.runtime, channel.runtime);
       return c.json(toResponse(channel), 200);
     } catch (err) {
-      return c.json({ error: err.message }, err instanceof DefaultChannelError ? 400 : 500);
+      return c.json({ error: err.message }, err instanceof DefaultChannelError || err instanceof ChannelCwdError ? 400 : 500);
     }
   });
   return app;
@@ -7478,9 +7485,10 @@ function createChannelWriteRouter() {
 // src/dashboard/docs-routes.ts
 import {
   closeSync,
+  createReadStream,
   existsSync as existsSync16,
   lstatSync as lstatSync2,
-  mkdirSync as mkdirSync9,
+  mkdirSync as mkdirSync10,
   openSync,
   readSync,
   readdirSync as readdirSync4,
@@ -7491,6 +7499,7 @@ import {
   statSync as statSync5,
   writeFileSync as writeFileSync9
 } from "fs";
+import { Readable } from "stream";
 import { basename as basename6, dirname as dirname5, extname, join as join20, relative, resolve as resolve4, sep } from "path";
 import { Hono as Hono10 } from "hono";
 import { streamSSE } from "hono/streaming";
@@ -9547,7 +9556,8 @@ var ChatAgent = class {
       };
     }
     const memory = await loadAgentMemory(owningProfile, thread.channel_id, {
-      readable: docsAccess !== "none"
+      readable: docsAccess !== "none",
+      ...isHumanAuthor(msg.author) ? { senderHandle: msg.author } : {}
     });
     if (memory.enabled) channelConfig = { ...channelConfig, disableAutoMemory: true };
     if (memory.memoryPrompt) channelConfig = { ...channelConfig, memoryPrompt: memory.memoryPrompt };
@@ -10346,7 +10356,7 @@ var MEDIA_EXTENSIONS = {
   ".csv": "text/csv; charset=utf-8",
   ".json": "application/json"
 };
-var MAX_RAW_BYTES = 20 * 1024 * 1024;
+var MAX_RAW_BYTES = 100 * 1024 * 1024;
 var ASSET_LIST_EXTENSIONS = /* @__PURE__ */ new Set([
   ".png",
   ".jpg",
@@ -10362,7 +10372,7 @@ var ASSET_LIST_EXTENSIONS = /* @__PURE__ */ new Set([
   ".txt",
   ".csv"
 ]);
-var MAX_UPLOAD_BYTES = MAX_RAW_BYTES;
+var MAX_UPLOAD_BYTES = 20 * 1024 * 1024;
 var CODE_EXTENSIONS = {
   ".js": "javascript",
   ".jsx": "javascript",
@@ -10749,7 +10759,7 @@ function createDocFolder(root, relDir, name) {
     return { status: "exists" };
   } catch {
   }
-  mkdirSync9(abs);
+  mkdirSync10(abs);
   return { status: "ok", path: relative(root, abs).split(sep).join("/"), name: safe };
 }
 function createDocFile(root, relDir, name, content) {
@@ -10866,13 +10876,15 @@ function createDocsRouter({ gate = requireDocsAccess } = {}) {
     }
     if (!stat.isFile()) return c.json({ error: "not found" }, 404);
     if (stat.size > MAX_RAW_BYTES) return c.json({ error: "file too large" }, 413);
-    const data = readFileSync14(resolved2.abs);
-    const headers = { "Content-Type": resolved2.contentType };
-    if (download) {
-      const filename = basename6(resolved2.abs).replace(/"/g, "");
-      headers["Content-Disposition"] = `attachment; filename="${filename}"`;
-    }
-    return c.body(new Uint8Array(data), 200, headers);
+    const name = basename6(resolved2.abs);
+    const asciiName = name.replace(/[^\x20-\x7e]/g, "_").replace(/["\\]/g, "_");
+    const disposition = download ? "attachment" : "inline";
+    const stream = Readable.toWeb(createReadStream(resolved2.abs));
+    return c.body(stream, 200, {
+      "Content-Type": resolved2.contentType,
+      "Content-Length": String(stat.size),
+      "Content-Disposition": `${disposition}; filename="${asciiName}"; filename*=UTF-8''${encodeURIComponent(name)}`
+    });
   });
   app.get("/:id/docs/html", (c) => {
     const { cwd } = resolveChannelConfig(c.req.param("id"));
@@ -11663,6 +11675,9 @@ var PROVIDER_LABELS = {
 };
 var TTL_MS2 = 6e4;
 var cache6 = /* @__PURE__ */ new Map();
+function clearProviderStatusCache() {
+  cache6.clear();
+}
 function binaryOnPath(bin) {
   try {
     execFileSync3(bin, ["--version"], { stdio: "ignore" });
@@ -11697,7 +11712,7 @@ function probe2(runner) {
       runner,
       label: label2,
       connected: false,
-      reason: `${label2} is installed but signed out \u2014 run ${bin} once in a terminal to log in.`
+      reason: `${label2} is installed but signed out. Use Sign in below.`
     };
   }
   return { runner, label: label2, connected: true };
@@ -11707,7 +11722,7 @@ function withAuthFailure(status) {
   return {
     ...status,
     connected: false,
-    reason: `Sign-in expired and could not be refreshed. On the Host, run claude setup-token, add the token to ~/.config/flyspace/profiles/${getProfile()}/config.env as CLAUDE_CODE_OAUTH_TOKEN, then restart the Host.`
+    reason: "Sign-in expired and could not be refreshed. Use Sign in again below."
   };
 }
 function providerStatuses() {
@@ -11721,6 +11736,232 @@ function providerStatuses() {
   return statuses.map((st) => st.runner === "claude" && st.connected ? withAuthFailure(st) : st);
 }
 
+// src/dashboard/provider-login.ts
+import { spawn as spawn6 } from "child_process";
+import { randomUUID as randomUUID2 } from "crypto";
+import { chmodSync, existsSync as existsSync20, mkdirSync as mkdirSync11, readFileSync as readFileSync15, writeFileSync as writeFileSync10 } from "fs";
+import { createRequire } from "module";
+import { dirname as dirname7, join as join22 } from "path";
+import { Hono as Hono13 } from "hono";
+var SESSION_TTL_MS = 10 * 6e4;
+var URL_WAIT_MS = 3e4;
+var TOKEN_WAIT_MS = 6e4;
+var sessions = /* @__PURE__ */ new Map();
+function stripAnsi(raw) {
+  return raw.replace(/\x1b\][^\x07]*\x07/g, "").replace(/\x1b\[\d*G/g, " ").replace(/\x1b\[[0-9;?<>=]*[A-Za-z~]/g, "").replace(/\x1b[78=>]/g, "");
+}
+function parseClaudeAuthUrl(raw) {
+  return stripAnsi(raw).match(/https:\/\/\S+\/oauth\/authorize\?\S+/)?.[0];
+}
+function parseClaudeToken(raw) {
+  return stripAnsi(raw).match(/sk-ant-oat[A-Za-z0-9_-]+/)?.[0];
+}
+function parseCodexDeviceAuth(raw) {
+  const text = stripAnsi(raw);
+  const url = text.match(/https:\/\/\S+\/device\b\S*/)?.[0];
+  const code = text.match(/\b([A-Z0-9]{4,}-[A-Z0-9]{4,})\b/)?.[1];
+  return url && code ? { url, code } : void 0;
+}
+function upsertEnvLine(content, key, value) {
+  const line = `${key}=${value}`;
+  const re = new RegExp(`^\\s*(?:export\\s+)?${key}=.*$`, "m");
+  if (re.test(content)) return content.replace(re, line);
+  return `${content}${content && !content.endsWith("\n") ? "\n" : ""}${line}
+`;
+}
+function finish(id, status, error2) {
+  const s = sessions.get(id);
+  if (!s || s.status !== "pending") return;
+  s.status = status;
+  s.error = error2;
+  s.kill();
+  clearTimeout(s.timer);
+  s.timer = setTimeout(() => sessions.delete(id), 6e4);
+  clearProviderStatusCache();
+}
+function track(session) {
+  const id = randomUUID2();
+  const s = {
+    ...session,
+    status: "pending",
+    output: "",
+    timer: setTimeout(() => finish(id, "failed", "Sign-in timed out. Start again."), SESSION_TTL_MS)
+  };
+  sessions.set(id, s);
+  return [id, s];
+}
+function waitFor(s, parse2, ms) {
+  return new Promise((resolve7) => {
+    const started = Date.now();
+    const tick = setInterval(() => {
+      const v = parse2();
+      if (v !== void 0 || s.status !== "pending" || Date.now() - started > ms) {
+        clearInterval(tick);
+        resolve7(v);
+      }
+    }, 200);
+  });
+}
+function loadPty() {
+  const require2 = createRequire(import.meta.url);
+  const root = dirname7(require2.resolve("node-pty/package.json"));
+  const helper = join22(root, "prebuilds", `${process.platform}-${process.arch}`, "spawn-helper");
+  try {
+    if (existsSync20(helper)) chmodSync(helper, 493);
+  } catch {
+  }
+  return require2("node-pty");
+}
+function cliEnv() {
+  const configDir2 = profileClaudeConfigDir();
+  const codexHome = profileEnv("CODEX_HOME");
+  return {
+    ...process.env,
+    // Never pop a browser on the Host: the person signing in isn't there.
+    BROWSER: "true",
+    ...configDir2 ? { CLAUDE_CONFIG_DIR: configDir2 } : {},
+    ...codexHome ? { CODEX_HOME: codexHome } : {}
+  };
+}
+async function startClaude() {
+  const pty = loadPty().spawn("claude", ["setup-token"], {
+    // Wide enough that the URL and token are never wrapped.
+    cols: 2e3,
+    rows: 50,
+    env: cliEnv()
+  });
+  const [id, s] = track({ runner: "claude", kill: () => pty.kill(), configFile: paths.CONFIG_FILE, pty });
+  pty.onData((d) => {
+    s.output += d;
+  });
+  pty.onExit(() => {
+    if (s.status === "pending" && !parseClaudeToken(s.output)) {
+      finish(id, "failed", "The claude CLI exited before sign-in finished.");
+    }
+  });
+  const url = await waitFor(s, () => parseClaudeAuthUrl(s.output), URL_WAIT_MS);
+  if (!url) {
+    finish(id, "failed");
+    throw new Error("claude setup-token did not print a sign-in URL.");
+  }
+  return { id, url };
+}
+async function submitClaudeCode(id, code) {
+  const s = sessions.get(id);
+  if (!s || s.runner !== "claude" || !s.pty) throw new Error("Sign-in session not found. Start again.");
+  if (s.status !== "pending") throw new Error(s.error ?? "Sign-in already finished.");
+  s.output = "";
+  s.pty.write(`${code.trim()}\r`);
+  const token = await waitFor(s, () => parseClaudeToken(s.output), TOKEN_WAIT_MS);
+  if (!token) {
+    finish(id, "failed", "Claude did not accept that code. Start again and paste the full code.");
+    throw new Error("Claude did not accept that code. Start again and paste the full code.");
+  }
+  mkdirSync11(dirname7(s.configFile), { recursive: true });
+  const current = existsSync20(s.configFile) ? readFileSync15(s.configFile, "utf-8") : "";
+  writeFileSync10(s.configFile, upsertEnvLine(current, "CLAUDE_CODE_OAUTH_TOKEN", token), { mode: 384 });
+  const cached = cachedProfileConfig();
+  if (cached) cached.env["CLAUDE_CODE_OAUTH_TOKEN"] = token;
+  clearClaudeAuthFailed();
+  finish(id, "done");
+}
+async function startCodex() {
+  const child = spawn6("codex", ["login", "--device-auth"], {
+    env: cliEnv(),
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  const [id, s] = track({ runner: "codex", kill: () => child.kill(), configFile: paths.CONFIG_FILE });
+  const onData = (d) => {
+    s.output += d.toString();
+  };
+  child.stdout?.on("data", onData);
+  child.stderr?.on("data", onData);
+  child.on("error", () => finish(id, "failed", "Could not run the codex CLI on the Host."));
+  child.on(
+    "exit",
+    (code) => finish(id, code === 0 ? "done" : "failed", code === 0 ? void 0 : "Codex sign-in did not complete.")
+  );
+  const auth = await waitFor(s, () => parseCodexDeviceAuth(s.output), URL_WAIT_MS);
+  if (!auth) {
+    finish(id, "failed");
+    throw new Error("codex login did not print a device code.");
+  }
+  return { id, ...auth };
+}
+function requireAdmin3(auth) {
+  return auth?.role === "admin" ? null : "admin access required";
+}
+function failure2(c, err) {
+  return c.json({ error: err.message }, 500);
+}
+function createProviderLoginRouter() {
+  const app = new Hono13();
+  app.use("*", async (c, next) => {
+    const denied = requireAdmin3(c.get("auth"));
+    if (denied) return c.json({ error: denied }, 403);
+    await next();
+  });
+  app.post("/:runner/login", async (c) => {
+    const runner = c.req.param("runner");
+    try {
+      if (runner === "claude") return c.json(await startClaude());
+      if (runner === "codex") return c.json(await startCodex());
+    } catch (err) {
+      return failure2(c, err);
+    }
+    return c.json({ error: "unknown provider" }, 404);
+  });
+  app.post("/claude/login/:id/code", async (c) => {
+    const body = await c.req.json().catch(() => ({}));
+    const code = body["code"];
+    if (typeof code !== "string" || !code.trim()) return c.json({ error: "code is required" }, 400);
+    try {
+      await submitClaudeCode(c.req.param("id"), code);
+    } catch (err) {
+      return c.json({ error: err.message }, 400);
+    }
+    return c.json({ status: "done" });
+  });
+  app.get("/:runner/login/:id", (c) => {
+    const s = sessions.get(c.req.param("id"));
+    if (!s || s.runner !== c.req.param("runner")) return c.json({ error: "session not found" }, 404);
+    return c.json({ status: s.status, ...s.error ? { error: s.error } : {} });
+  });
+  return app;
+}
+async function handleProviderLoginRequest(req) {
+  const app = new Hono13();
+  app.use("*", async (c, next) => {
+    c.set("auth", { role: "admin" });
+    await next();
+  });
+  app.route("/", createProviderLoginRouter());
+  const res = await app.request(req.path, {
+    method: req.method,
+    ...req.body !== void 0 && {
+      body: JSON.stringify(req.body),
+      headers: { "content-type": "application/json" }
+    }
+  });
+  return { status: res.status, body: await res.json().catch(() => null) };
+}
+function registerRelayedProviderLoginRoutes(api, agent) {
+  const relay3 = async (c) => {
+    const denied = requireAdmin3(c.get("auth"));
+    if (denied) return c.json({ error: denied }, 403);
+    const method = c.req.method;
+    const body = method === "GET" ? void 0 : await c.req.json().catch(() => null);
+    const path = c.req.path.slice(c.req.path.indexOf("/settings/providers") + "/settings/providers".length);
+    const result = await agent.providerLoginRequest?.({ method, path, body });
+    if (!result) {
+      return c.json({ error: "Signing in needs the Host machine, which is not connected right now." }, 503);
+    }
+    return c.json(result.body, result.status);
+  };
+  api.all("/settings/providers/:runner/login", relay3);
+  api.all("/settings/providers/:runner/login/*", relay3);
+}
+
 // src/dashboard/host-api.ts
 function registerHostRoutes(api) {
   api.get("/channels/:id/skills", (c) => {
@@ -11769,6 +12010,7 @@ function registerHostRoutes(api) {
     return c.json({ ...await saveWorkspaceBranding(patch), ...local });
   });
   api.get("/settings/providers", (c) => c.json({ providers: providerStatuses() }));
+  api.route("/settings/providers", createProviderLoginRouter());
   api.get(
     "/settings/usage-limit",
     (c) => c.json({
@@ -11827,8 +12069,8 @@ function registerHostRoutes(api) {
     const errors = c.req.query("error") === "true" || c.req.query("error") === "1";
     const limit = Math.min(Number(c.req.query("limit")) || 200, 2e3);
     const filename = errors ? "custie-error.log" : "custie.log";
-    const file = join22(paths.LOG_DIR, filename);
-    const exists = existsSync20(file);
+    const file = join23(paths.LOG_DIR, filename);
+    const exists = existsSync21(file);
     return c.json({
       file,
       exists,
@@ -11838,18 +12080,18 @@ function registerHostRoutes(api) {
   });
 }
 function tailFile(file, limit) {
-  if (!existsSync20(file)) return [];
-  const lines = readFileSync15(file, "utf-8").split("\n");
+  if (!existsSync21(file)) return [];
+  const lines = readFileSync16(file, "utf-8").split("\n");
   if (lines.at(-1) === "") lines.pop();
   return lines.slice(-limit);
 }
 
 // src/dashboard/data-api.ts
-import { existsSync as existsSync22 } from "fs";
+import { existsSync as existsSync23 } from "fs";
 import sharp5 from "sharp";
 
 // src/dashboard/automations-routes.ts
-import { Hono as Hono13 } from "hono";
+import { Hono as Hono14 } from "hono";
 var TYPES2 = ["schedule", "trigger", "mention-trigger"];
 function isType(t) {
   return TYPES2.includes(t);
@@ -11866,7 +12108,7 @@ function statusFor(message) {
   return 400;
 }
 function createAutomationWriteRouter() {
-  const app = new Hono13();
+  const app = new Hono14();
   const manager = () => new AutomationManager();
   app.get("/:type/:name", (c) => {
     const item = manager().get(c.req.param("name"));
@@ -11922,9 +12164,9 @@ function createAutomationWriteRouter() {
 }
 
 // src/dashboard/categories-routes.ts
-import { Hono as Hono14 } from "hono";
+import { Hono as Hono15 } from "hono";
 function createCategoryWriteRouter() {
-  const app = new Hono14();
+  const app = new Hono15();
   app.get("/", async (c) => {
     const { data, error: error2 } = await getSupabaseClient().from("categories").select("*").eq("profile", getProfile()).order("position", { ascending: true });
     if (error2) return c.json({ error: error2.message }, 500);
@@ -11978,7 +12220,7 @@ function createCategoryWriteRouter() {
 }
 
 // src/dashboard/chat-routes.ts
-import { Hono as Hono15 } from "hono";
+import { Hono as Hono16 } from "hono";
 
 // src/dashboard/fork-summary.ts
 var GROQ_API_URL6 = "https://api.groq.com/openai/v1/chat/completions";
@@ -12398,7 +12640,7 @@ async function withPreviews(supabase, threads) {
       threads.map((t) => t.id),
       THREAD_CHUNK_SIZE
     ).map(
-      (ids) => supabase.from("thread_replies").select("thread_id, body, author").in("thread_id", ids).is("archived_at", null).order("created_at", { ascending: true })
+      (ids) => supabase.from("thread_replies").select("thread_id, body, author, external_user_id").in("thread_id", ids).is("archived_at", null).order("created_at", { ascending: true })
     )
   );
   const previewByThread = /* @__PURE__ */ new Map();
@@ -12408,8 +12650,15 @@ async function withPreviews(supabase, threads) {
       if (entry) {
         entry.count += 1;
         entry.lastAuthor = r.author;
+        entry.participants.delete(r.author);
+        entry.participants.set(r.author, r.external_user_id ?? null);
       } else
-        previewByThread.set(r.thread_id, { count: 1, firstBody: r.body, lastAuthor: r.author });
+        previewByThread.set(r.thread_id, {
+          count: 1,
+          firstBody: r.body,
+          lastAuthor: r.author,
+          participants: /* @__PURE__ */ new Map()
+        });
     }
   }
   return threads.map((t) => {
@@ -12421,7 +12670,9 @@ async function withPreviews(supabase, threads) {
       // Who spoke last, counting only replies AFTER the opening message —
       // the reader's own handle here means there is nothing new for them to
       // read, on this browser or any other (see web/src/lib/thread-unread).
-      last_reply_author: entry && entry.count > 1 ? entry.lastAuthor : null
+      last_reply_author: entry && entry.count > 1 ? entry.lastAuthor : null,
+      // Everyone who replied, most recent first, for the row's avatar stack.
+      participants: [...entry?.participants ?? []].reverse().map(([author, external_user_id]) => ({ author, external_user_id }))
     };
   });
 }
@@ -12456,7 +12707,7 @@ async function generateAutoTitle(threadId, channelId, body) {
   await supabase.from("threads").update({ auto_title: autoTitle }).eq("id", threadId).is("title", null);
 }
 function createChatRouter(agent = {}) {
-  const app = new Hono15();
+  const app = new Hono16();
   const {
     onChatMessage: onMessage,
     isAgentThinking,
@@ -12963,7 +13214,7 @@ function createChatRouter(agent = {}) {
 }
 
 // src/dashboard/doc-shares-routes.ts
-import { Hono as Hono16 } from "hono";
+import { Hono as Hono17 } from "hono";
 
 // src/dashboard/doc-share-features.ts
 import { DeleteObjectCommand as DeleteObjectCommand3 } from "@aws-sdk/client-s3";
@@ -13147,7 +13398,7 @@ function resolveChannel2(c) {
 }
 var LIST_LIMIT = 500;
 function createDocShareListRouter() {
-  const app = new Hono16();
+  const app = new Hono17();
   app.get("/shares", async (c) => {
     const viewer = c.get("auth");
     const readable = await filterReadableDocsChannels(
@@ -13191,7 +13442,7 @@ function createDocShareListRouter() {
   return app;
 }
 function createDocShareWriteRouter(agent = {}) {
-  const app = new Hono16();
+  const app = new Hono17();
   app.use("/:id/docs/share", requireDocsAccess);
   app.use("/:id/docs/share/*", requireDocsAccess);
   app.use("/:id/docs/shares", requireDocsAccess);
@@ -13348,7 +13599,7 @@ function createDocShareWriteRouter(agent = {}) {
 }
 
 // src/dashboard/search-routes.ts
-import { Hono as Hono17 } from "hono";
+import { Hono as Hono18 } from "hono";
 function matchScore(q, fields) {
   const terms = q.toLowerCase().split(/\s+/).filter(Boolean);
   if (terms.length === 0) return 0;
@@ -13496,7 +13747,7 @@ function searchAutomations(q) {
 }
 var RESULT_LIMIT = 30;
 function createSearchRouter() {
-  const app = new Hono17();
+  const app = new Hono18();
   app.get("/", async (c) => {
     const q = c.req.query("q")?.trim();
     if (!q) return c.json({ results: [] });
@@ -13512,8 +13763,8 @@ function createSearchRouter() {
 }
 
 // src/dashboard/uploads-routes.ts
-import { randomUUID as randomUUID2 } from "crypto";
-import { Hono as Hono18 } from "hono";
+import { randomUUID as randomUUID3 } from "crypto";
+import { Hono as Hono19 } from "hono";
 import { PutObjectCommand as PutObjectCommand3, GetObjectCommand as GetObjectCommand5 } from "@aws-sdk/client-s3";
 import { getSignedUrl as getSignedUrl4 } from "@aws-sdk/s3-request-presigner";
 var MAX_FILE_BYTES = 10 * 1024 * 1024;
@@ -13528,7 +13779,7 @@ function encodeKeyForUrl(key) {
   return key.split("/").map(encodeURIComponent).join("/");
 }
 function createUploadsRouter() {
-  const app = new Hono18();
+  const app = new Hono19();
   app.post("/uploads", async (c) => {
     const body = await c.req.parseBody().catch(() => null);
     const file = body?.["file"];
@@ -13536,7 +13787,7 @@ function createUploadsRouter() {
     if (file.size > MAX_FILE_BYTES) {
       return c.json({ error: `file must be ${MAX_FILE_BYTES / (1024 * 1024)}MB or smaller` }, 400);
     }
-    const key = `${KEY_PREFIX2}/${getProfile()}/${randomUUID2()}-${sanitizeFilename(file.name)}`;
+    const key = `${KEY_PREFIX2}/${getProfile()}/${randomUUID3()}-${sanitizeFilename(file.name)}`;
     const buffer = Buffer.from(await file.arrayBuffer());
     await getR2Client().send(
       new PutObjectCommand3({
@@ -13573,14 +13824,14 @@ function createUploadsRouter() {
 }
 
 // src/dashboard/transcribe-routes.ts
-import { Hono as Hono19 } from "hono";
+import { Hono as Hono20 } from "hono";
 var GROQ_TRANSCRIBE_URL = "https://api.groq.com/openai/v1/audio/transcriptions";
 var MODEL = "whisper-large-v3-turbo";
 var MAX_AUDIO_BYTES = 5 * 1024 * 1024;
 var MAX_PROMPT_CHARS = 400;
 var NO_SPEECH_THRESHOLD = 0.6;
 function createTranscribeRouter() {
-  const app = new Hono19();
+  const app = new Hono20();
   app.post("/transcribe", async (c) => {
     if (!await isFeatureEnabled(c, "dictation"))
       return c.json({ error: "feature not enabled" }, 403);
@@ -13619,8 +13870,8 @@ function createTranscribeRouter() {
 }
 
 // src/dashboard/avatars-routes.ts
-import { createHash as createHash10, randomUUID as randomUUID3 } from "crypto";
-import { Hono as Hono20 } from "hono";
+import { createHash as createHash10, randomUUID as randomUUID4 } from "crypto";
+import { Hono as Hono21 } from "hono";
 import sharp4 from "sharp";
 import { PutObjectCommand as PutObjectCommand4, DeleteObjectCommand as DeleteObjectCommand4 } from "@aws-sdk/client-s3";
 var AVATAR_SIZE = 192;
@@ -13658,7 +13909,7 @@ async function storeAvatar(file, owner) {
   if (file.size > MAX_AVATAR_BYTES) return { error: "avatar must be 2MB or smaller" };
   const original = Buffer.from(await file.arrayBuffer());
   const resized = await sharp4(original).resize({ width: AVATAR_SIZE, height: AVATAR_SIZE, fit: "cover" }).png().toBuffer();
-  const key = `${avatarKeyPrefix()}${owner}-${randomUUID3()}.png`;
+  const key = `${avatarKeyPrefix()}${owner}-${randomUUID4()}.png`;
   await getR2Client().send(
     new PutObjectCommand4({
       Bucket: getR2Bucket(),
@@ -13673,7 +13924,7 @@ function avatarKeyPrefix() {
   return `${KEY_PREFIX3}/${getProfile()}/`;
 }
 function createAvatarsRouter() {
-  const app = new Hono20();
+  const app = new Hono21();
   app.get("/avatars/slack", async (c) => {
     const ctx = await resolveAuthContext(c);
     if (!ctx) return c.json({ error: "not signed in" }, 401);
@@ -13722,7 +13973,7 @@ function createAvatarsRouter() {
 }
 
 // src/dashboard/members-routes.ts
-import { Hono as Hono21 } from "hono";
+import { Hono as Hono22 } from "hono";
 function inviteLinkFor(c, token) {
   const url = new URL("/auth/invite", callbackUrl(c));
   url.searchParams.set("token", token);
@@ -13730,7 +13981,7 @@ function inviteLinkFor(c, token) {
 }
 var EMAIL_RE2 = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
 function createMembersRouter() {
-  const members = new Hono21();
+  const members = new Hono22();
   members.get("/", async (c) => {
     const ctx = await resolveAuthContext(c);
     if (ctx?.role !== "admin") return c.json({ error: "admin access required" }, 403);
@@ -13771,7 +14022,7 @@ function createMembersRouter() {
         return { userId: m.userId, handle: m.handle, role: m.role, avatarUrl };
       })
     );
-    return c.json({ members: directory });
+    return c.json({ workspaceId: ctx.workspaceId, members: directory });
   });
   members.post("/:userId/dm", async (c) => {
     const ctx = await resolveAuthContext(c);
@@ -13945,7 +14196,7 @@ function createMembersRouter() {
 }
 
 // src/dashboard/notifications-routes.ts
-import { Hono as Hono22 } from "hono";
+import { Hono as Hono23 } from "hono";
 
 // src/store/notification-store.ts
 function rowToNotification(row) {
@@ -14013,7 +14264,7 @@ async function markAllRead(channelIds, userId) {
 
 // src/dashboard/notifications-routes.ts
 function createNotificationsRouter() {
-  const notifications = new Hono22();
+  const notifications = new Hono23();
   notifications.get("/", async (c) => {
     const auth = c.get("auth");
     const channelIds = getProfileChannelRegistry().filter((ch) => canSeeChannel(ch, auth)).map((ch) => ch.id);
@@ -14040,7 +14291,7 @@ function createNotificationsRouter() {
   return notifications;
 }
 function createThreadReadRouter() {
-  const threads = new Hono22();
+  const threads = new Hono23();
   threads.post("/threads/:threadId/read", async (c) => {
     const { userId } = c.get("auth");
     const threadId = c.req.param("threadId");
@@ -14052,7 +14303,7 @@ function createThreadReadRouter() {
 }
 
 // src/dashboard/push-routes.ts
-import { Hono as Hono23 } from "hono";
+import { Hono as Hono24 } from "hono";
 
 // src/push/send.ts
 import webpush from "web-push";
@@ -14155,7 +14406,7 @@ async function pushToUser(userId, payload) {
 
 // src/dashboard/push-routes.ts
 function createPushRouter() {
-  const push = new Hono23();
+  const push = new Hono24();
   push.get("/key", (c) => c.json({ publicKey: getVapidPublicKey() }));
   push.post("/subscribe", async (c) => {
     const { userId } = c.get("auth");
@@ -14186,7 +14437,7 @@ function createPushRouter() {
 }
 
 // src/dashboard/mcp-oauth-routes.ts
-import { Hono as Hono24 } from "hono";
+import { Hono as Hono25 } from "hono";
 var CONNECTIONS_PAGE = "/settings/connections";
 function callbackUri(c) {
   const proto = c.req.header("x-forwarded-proto") ?? "http";
@@ -14201,7 +14452,7 @@ function backToDashboard(c, to, params) {
   return c.redirect(`${target.pathname}${target.search}`);
 }
 function createMcpOAuthRouter() {
-  const app = new Hono24();
+  const app = new Hono25();
   app.get("/oauth/:provider/start", async (c) => {
     const auth = c.get("auth");
     if (auth.role !== "admin") return c.json({ error: "admin access required" }, 403);
@@ -14328,7 +14579,7 @@ function createMcpOAuthRouter() {
 }
 
 // src/dashboard/mcp-routes.ts
-import { Hono as Hono25 } from "hono";
+import { Hono as Hono26 } from "hono";
 
 // src/mcp/transport.ts
 var KINDS = ["inherit", "npx", "local", "http", "sse"];
@@ -14422,7 +14673,7 @@ function fromServerCommand(command) {
 
 // src/dashboard/mcp-routes.ts
 var CUSTOM_PROVIDER = "custom";
-function requireAdmin3(auth) {
+function requireAdmin4(auth) {
   return auth?.role === "admin" ? null : "admin access required";
 }
 function toResponse4(connection, channelIds, providerCommand = null) {
@@ -14458,9 +14709,9 @@ function bindingsByConnection() {
   return map;
 }
 function createMcpRouter() {
-  const app = new Hono25();
+  const app = new Hono26();
   app.get("/providers", async (c) => {
-    const denied = requireAdmin3(c.get("auth"));
+    const denied = requireAdmin4(c.get("auth"));
     if (denied) return c.json({ error: denied }, 403);
     const providers = await listMcpProviders();
     return c.json({
@@ -14478,7 +14729,7 @@ function createMcpRouter() {
   });
   app.get("/connections", async (c) => {
     const auth = c.get("auth");
-    const denied = requireAdmin3(auth);
+    const denied = requireAdmin4(auth);
     if (denied) return c.json({ error: denied }, 403);
     const connections = await listMcpConnections(auth.workspaceId);
     const commands = new Map(
@@ -14493,7 +14744,7 @@ function createMcpRouter() {
   });
   app.post("/connections", async (c) => {
     const auth = c.get("auth");
-    const denied = requireAdmin3(auth);
+    const denied = requireAdmin4(auth);
     if (denied) return c.json({ error: denied }, 403);
     const body = await c.req.json().catch(() => null);
     const label2 = typeof body?.label === "string" ? body.label.trim() : "";
@@ -14530,7 +14781,7 @@ function createMcpRouter() {
   });
   app.patch("/connections/:id", async (c) => {
     const auth = c.get("auth");
-    const denied = requireAdmin3(auth);
+    const denied = requireAdmin4(auth);
     if (denied) return c.json({ error: denied }, 403);
     const body = await c.req.json().catch(() => null);
     if (!body) return c.json({ error: "a body is required" }, 400);
@@ -14561,7 +14812,7 @@ function createMcpRouter() {
   });
   app.put("/connections/:id/credential", async (c) => {
     const auth = c.get("auth");
-    const denied = requireAdmin3(auth);
+    const denied = requireAdmin4(auth);
     if (denied) return c.json({ error: denied }, 403);
     const body = await c.req.json().catch(() => null);
     const raw = body?.apiKey;
@@ -14579,7 +14830,7 @@ function createMcpRouter() {
   });
   app.put("/connections/:id/channels", async (c) => {
     const auth = c.get("auth");
-    const denied = requireAdmin3(auth);
+    const denied = requireAdmin4(auth);
     if (denied) return c.json({ error: denied }, 403);
     const id = c.req.param("id");
     const connection = await getMcpConnection(auth.workspaceId, id);
@@ -14606,7 +14857,7 @@ function createMcpRouter() {
   });
   app.delete("/connections/:id", async (c) => {
     const auth = c.get("auth");
-    const denied = requireAdmin3(auth);
+    const denied = requireAdmin4(auth);
     if (denied) return c.json({ error: denied }, 403);
     const deleted = await deleteMcpConnection(auth.workspaceId, c.req.param("id"));
     if (!deleted) return c.json({ error: "connection not found" }, 404);
@@ -14717,7 +14968,7 @@ async function sessionUsageForThreads(workspace, threadTsList) {
 }
 
 // src/dashboard/usage-report.ts
-import { existsSync as existsSync21 } from "fs";
+import { existsSync as existsSync22 } from "fs";
 function mergeByLabel(buckets) {
   const merged = /* @__PURE__ */ new Map();
   for (const bucket of buckets) {
@@ -14763,7 +15014,7 @@ function toReport(days, rows, labelChannel) {
   };
 }
 function fromLocalStore(days, labelChannel) {
-  if (!existsSync21(paths.DB_FILE)) return { ...EMPTY, days };
+  if (!existsSync22(paths.DB_FILE)) return { ...EMPTY, days };
   const window = days === 0 ? void 0 : days;
   const store = new UsageStore(paths.DB_FILE);
   try {
@@ -14805,7 +15056,7 @@ async function buildChannelUsageReport(channelId, days, labelChannel) {
     const { totals, byDay } = await channelUsageForWorkspace(workspace, aliasIds, window);
     return { days, totals: totals.runs > 0 ? totals : null, byDay };
   } catch {
-    if (!existsSync21(paths.DB_FILE)) return { days, totals: null, byDay: [] };
+    if (!existsSync22(paths.DB_FILE)) return { days, totals: null, byDay: [] };
     const store = new UsageStore(paths.DB_FILE);
     try {
       const targetLabel = labelChannel(channelId);
@@ -14827,7 +15078,7 @@ async function buildThreadUsage(threadTs) {
     if (totals.runs === 0) return { threadTs, totals: null, byModel: [] };
     return { threadTs, totals, byModel };
   } catch {
-    if (!existsSync21(paths.DB_FILE)) return { threadTs, totals: null, byModel: [] };
+    if (!existsSync22(paths.DB_FILE)) return { threadTs, totals: null, byModel: [] };
     const store = new UsageStore(paths.DB_FILE);
     try {
       const totals = store.threadTotals(threadTs);
@@ -14840,7 +15091,7 @@ async function buildThreadUsage(threadTs) {
 }
 
 // src/dashboard/channel-members-routes.ts
-import { Hono as Hono26 } from "hono";
+import { Hono as Hono27 } from "hono";
 async function isChannelAdmin(ctx, channelId) {
   if (ctx.role === "admin") return true;
   const membership = await getMembershipByUserId(ctx.workspaceId, ctx.userId);
@@ -14849,7 +15100,7 @@ async function isChannelAdmin(ctx, channelId) {
   return members.some((m) => m.membershipId === membership.id && m.role === "channel_admin");
 }
 function createChannelMembersRouter() {
-  const router = new Hono26();
+  const router = new Hono27();
   router.get("/:id/members", async (c) => {
     const ctx = await resolveAuthContext(c);
     if (!ctx) return c.json({ error: "workspace access required" }, 403);
@@ -14897,9 +15148,9 @@ function createChannelMembersRouter() {
     if (!await isChannelAdmin(ctx, channelId)) {
       return c.json({ error: "channel admin access required" }, 403);
     }
-    return c.json({ grants: await listChannelDocsAccess(channelId) });
+    return c.json({ memberAccess: await getChannelDocsMemberAccess(channelId) });
   });
-  router.put("/:id/docs-access/:membershipId", async (c) => {
+  router.put("/:id/docs-access", async (c) => {
     const ctx = await resolveAuthContext(c);
     if (!ctx) return c.json({ error: "workspace access required" }, 403);
     const channelId = c.req.param("id");
@@ -14907,32 +15158,31 @@ function createChannelMembersRouter() {
       return c.json({ error: "channel admin access required" }, 403);
     }
     const body = await c.req.json().catch(() => ({}));
-    if (!isDocsGrant(body.access)) {
-      return c.json({ error: "access must be 'read' or 'write'" }, 400);
+    if (!isDocsAccess(body.memberAccess)) {
+      return c.json({ error: "memberAccess must be 'none', 'read' or 'write'" }, 400);
     }
-    const grant = await upsertChannelDocsAccess({
-      channelId,
-      membershipId: c.req.param("membershipId"),
-      access: body.access
-    });
-    return c.json({ grant });
-  });
-  router.delete("/:id/docs-access/:membershipId", async (c) => {
-    const ctx = await resolveAuthContext(c);
-    if (!ctx) return c.json({ error: "workspace access required" }, 403);
-    const channelId = c.req.param("id");
-    if (!await isChannelAdmin(ctx, channelId)) {
-      return c.json({ error: "channel admin access required" }, 403);
+    if (!await setChannelDocsMemberAccess(channelId, body.memberAccess)) {
+      return c.json({ error: "no such channel" }, 404);
     }
-    const removed = await removeChannelDocsAccess(channelId, c.req.param("membershipId"));
-    if (!removed) return c.json({ error: "no such docs grant" }, 404);
-    return c.body(null, 204);
+    return c.json({ memberAccess: body.memberAccess });
   });
   return router;
 }
 
 // src/dashboard/memories-routes.ts
-import { Hono as Hono27 } from "hono";
+import { Hono as Hono28 } from "hono";
+async function readPatch(c) {
+  const body = await c.req.json().catch(() => ({}));
+  const patch = {};
+  if (typeof body["description"] === "string") patch.description = body["description"];
+  if (typeof body["body"] === "string") patch.body = body["body"];
+  const type = body["type"];
+  if (type !== void 0) {
+    if (!isMemoryType(type)) return "invalid type";
+    patch.type = type;
+  }
+  return patch;
+}
 var requireChannelVisible = async (c, next) => {
   const channel = findChannel(c.req.param("id"));
   if (!channel || !canSeeChannel(channel, c.get("auth"))) {
@@ -14948,7 +15198,7 @@ var requireAgentMemory = async (c, next) => {
   await next();
 };
 function createMemoriesRouter() {
-  const router = new Hono27();
+  const router = new Hono28();
   for (const path of [
     "/:id/memories",
     "/:id/memories/*",
@@ -14963,15 +15213,8 @@ function createMemoriesRouter() {
   router.patch("/:id/memories/:memoryId", async (c) => {
     const memoryId = c.req.param("memoryId");
     if (!isUuid(memoryId)) return c.json({ error: "invalid memory id" }, 400);
-    const body = await c.req.json().catch(() => ({}));
-    const patch = {};
-    if (typeof body["description"] === "string") patch.description = body["description"];
-    if (typeof body["body"] === "string") patch.body = body["body"];
-    const type = body["type"];
-    if (type !== void 0) {
-      if (!isMemoryType(type)) return c.json({ error: "invalid type" }, 400);
-      patch.type = type;
-    }
+    const patch = await readPatch(c);
+    if (typeof patch === "string") return c.json({ error: patch }, 400);
     try {
       const memory = await updateChannelMemory(c.get("memoryChannelId"), memoryId, patch, "user");
       if (!memory) return c.json({ error: "memory not found" }, 404);
@@ -14987,9 +15230,28 @@ function createMemoriesRouter() {
     if (!deleted) return c.json({ error: "memory not found" }, 404);
     return c.json({ ok: true });
   });
+  router.post("/:id/memories/:memoryId/promote", async (c) => {
+    const memoryId = c.req.param("memoryId");
+    if (!isUuid(memoryId)) return c.json({ error: "invalid memory id" }, 400);
+    if (c.get("auth").role !== "admin") {
+      return c.json({ error: "Only a Workspace Admin can move a memory to the workspace." }, 403);
+    }
+    if (findChannel(c.get("memoryChannelId"))?.visibility !== "public") {
+      return c.json({ error: "Memories of a private channel stay in that channel." }, 403);
+    }
+    const result = await promoteChannelMemory(c.get("memoryChannelId"), memoryId);
+    if (!result.ok && result.reason === "not-found") return c.json({ error: "memory not found" }, 404);
+    if (!result.ok) {
+      return c.json({ error: "The workspace already has a memory with this name." }, 409);
+    }
+    return c.json({ memory: result.memory });
+  });
   router.get("/:id/memory-events", async (c) => {
-    const threadId = c.req.query("thread") ?? "";
-    if (!isUuid(threadId)) return c.json({ error: "thread query parameter required" }, 400);
+    const threadId = c.req.query("thread");
+    if (threadId === void 0) {
+      return c.json({ events: await listMemoryEvents(c.get("memoryChannelId"), { limit: 20 }) });
+    }
+    if (!isUuid(threadId)) return c.json({ error: "invalid thread id" }, 400);
     return c.json({ events: await listThreadMemoryEvents(c.get("memoryChannelId"), threadId) });
   });
   router.post("/:id/memory-events/:eventId/undo", async (c) => {
@@ -15008,9 +15270,68 @@ function createMemoriesRouter() {
   });
   return router;
 }
+function createScopedMemoriesRouter() {
+  const router = new Hono28();
+  router.use("*", requireAgentMemory);
+  const workspace = (c) => ({
+    scope: "workspace",
+    workspaceId: c.get("auth").workspaceId
+  });
+  const mine = (c) => ({
+    scope: "user",
+    workspaceId: c.get("auth").workspaceId,
+    userId: c.get("auth").userId
+  });
+  router.on(["PATCH", "DELETE"], "/workspace/*", async (c, next) => {
+    if (c.get("auth").role !== "admin") {
+      return c.json({ error: "Only a Workspace Admin can change workspace memory." }, 403);
+    }
+    await next();
+  });
+  for (const [path, target] of [
+    ["/workspace", workspace],
+    ["/me", mine]
+  ]) {
+    router.get(path, async (c) => c.json({ memories: await listMemories(target(c)) }));
+    router.patch(`${path}/:memoryId`, async (c) => {
+      const memoryId = c.req.param("memoryId") ?? "";
+      if (!isUuid(memoryId)) return c.json({ error: "invalid memory id" }, 400);
+      const patch = await readPatch(c);
+      if (typeof patch === "string") return c.json({ error: patch }, 400);
+      try {
+        const memory = await updateMemory(target(c), memoryId, patch, "user");
+        if (!memory) return c.json({ error: "memory not found" }, 404);
+        return c.json({ memory });
+      } catch (err) {
+        return c.json({ error: err.message }, 400);
+      }
+    });
+    router.delete(`${path}/:memoryId`, async (c) => {
+      const memoryId = c.req.param("memoryId") ?? "";
+      if (!isUuid(memoryId)) return c.json({ error: "invalid memory id" }, 400);
+      if (!await deleteMemory(target(c), memoryId, "user")) {
+        return c.json({ error: "memory not found" }, 404);
+      }
+      return c.json({ ok: true });
+    });
+  }
+  router.get("/me-settings", async (c) => {
+    const auth = c.get("auth");
+    const membership = await getMembershipByUserId(auth.workspaceId, auth.userId);
+    return c.json({ autoPaused: membership?.memoryAutoPaused ?? false });
+  });
+  router.put("/me-settings", async (c) => {
+    const body = await c.req.json().catch(() => ({}));
+    if (typeof body["autoPaused"] !== "boolean") return c.json({ error: "autoPaused must be a boolean" }, 400);
+    const auth = c.get("auth");
+    await setMemoryAutoPaused(auth.workspaceId, auth.userId, body["autoPaused"]);
+    return c.json({ autoPaused: body["autoPaused"] });
+  });
+  return router;
+}
 
 // src/dashboard/onboarding-routes.ts
-import { Hono as Hono28 } from "hono";
+import { Hono as Hono29 } from "hono";
 
 // src/dashboard/unique-channel-name.ts
 function uniqueChannelName(raw, taken) {
@@ -15111,7 +15432,7 @@ async function buildGreeting(input2) {
 // src/dashboard/onboarding-routes.ts
 var MAX_FOLDERS = 20;
 function createOnboardingRouter(agent) {
-  const app = new Hono28();
+  const app = new Hono29();
   app.get("/scan", async (c) => {
     const ctx = await resolveAuthContext(c);
     if (ctx?.role !== "admin") return c.json({ error: "admin access required" }, 403);
@@ -15277,13 +15598,13 @@ function firstSentence(body) {
 function threadLabel(row) {
   return row.title?.trim() || firstSentence(row.thread_replies?.[0]?.body);
 }
-async function resolveThreadLinks(sessions) {
+async function resolveThreadLinks(sessions2) {
   const chatIds = [
-    ...new Set(sessions.filter((s) => s.channelId.startsWith("chat:")).map((s) => s.threadTs))
+    ...new Set(sessions2.filter((s) => s.channelId.startsWith("chat:")).map((s) => s.threadTs))
   ];
   const externalKeys = [
     ...new Set(
-      sessions.filter((s) => !s.channelId.startsWith("chat:")).map((s) => `${s.channelId}:${s.threadTs}`)
+      sessions2.filter((s) => !s.channelId.startsWith("chat:")).map((s) => `${s.channelId}:${s.threadTs}`)
     )
   ];
   const chat = /* @__PURE__ */ new Map();
@@ -15316,8 +15637,8 @@ function registerDataRoutes(api, agent = {}) {
   api.get("/host/status", async (c) => {
     const online = agent.isHostOnline?.(getProfile()) ?? false;
     if (!online) {
-      const failure2 = agent.getHostOfflineReason?.() ?? null;
-      return c.json({ online: false, reason: failure2?.reason ?? null, since: failure2?.since ?? null });
+      const failure3 = agent.getHostOfflineReason?.() ?? null;
+      return c.json({ online: false, reason: failure3?.reason ?? null, since: failure3?.since ?? null });
     }
     const auth = c.get("auth");
     const paused = await getAgentPaused(auth.workspaceId);
@@ -15368,6 +15689,7 @@ function registerDataRoutes(api, agent = {}) {
   api.route("/onboarding", createOnboardingRouter(agent));
   api.route("/channels", createChannelMembersRouter());
   api.route("/channels", createMemoriesRouter());
+  api.route("/memories", createScopedMemoriesRouter());
   api.route("/docs", createDocShareListRouter());
   api.get("/users", (c) => c.json({ users: listActiveUsers() }));
   api.route("/categories", createCategoryWriteRouter());
@@ -15379,7 +15701,7 @@ function registerDataRoutes(api, agent = {}) {
         runs.set(name, { lastRun: run4.lastRunAt.toISOString(), lastStatus: run4.lastStatus });
       }
     } catch {
-      if (existsSync22(paths.DB_FILE)) {
+      if (existsSync23(paths.DB_FILE)) {
         const runStore = new AutomationRunStore(paths.DB_FILE);
         try {
           for (const run4 of runStore.listLastRuns()) {
@@ -15441,7 +15763,7 @@ function registerDataRoutes(api, agent = {}) {
       const runs = (await recentRunsForWorkspace(getProfile(), 200)).map(toResponse5);
       return c.json({ runs });
     } catch {
-      if (!existsSync22(paths.DB_FILE)) return c.json({ runs: [] });
+      if (!existsSync23(paths.DB_FILE)) return c.json({ runs: [] });
       const runStore = new AutomationRunStore(paths.DB_FILE);
       try {
         const runs = runStore.listRuns(200).map(toResponse5);
@@ -15563,7 +15885,7 @@ function registerDataRoutes(api, agent = {}) {
     } catch {
       latest = /* @__PURE__ */ new Map();
       totals = /* @__PURE__ */ new Map();
-      if (existsSync22(paths.DB_FILE)) {
+      if (existsSync23(paths.DB_FILE)) {
         const usageStore = new UsageStore(paths.DB_FILE);
         try {
           latest = usageStore.latestByThread(threadTsList);
@@ -15574,7 +15896,7 @@ function registerDataRoutes(api, agent = {}) {
       }
     }
     const threadLinks = await resolveThreadLinks(raw);
-    const sessions = raw.map((s) => {
+    const sessions2 = raw.map((s) => {
       const run4 = latest.get(s.threadTs);
       const turns = run4?.numTurns ?? 1;
       const total = run4 ? run4.inputTokens + run4.cacheReadTokens + run4.cacheCreationTokens : void 0;
@@ -15592,7 +15914,7 @@ function registerDataRoutes(api, agent = {}) {
         costUsd: totals.get(s.threadTs)?.costUsd
       };
     });
-    return c.json({ sessions });
+    return c.json({ sessions: sessions2 });
   });
   const LOGO_SIZE = 256;
   const MAX_LOGO_BYTES = 2 * 1024 * 1024;
@@ -15618,18 +15940,18 @@ function registerDataRoutes(api, agent = {}) {
 // src/dashboard/device-auth-routes.ts
 import { verify } from "crypto";
 import { getConnInfo } from "@hono/node-server/conninfo";
-import { Hono as Hono30 } from "hono";
+import { Hono as Hono31 } from "hono";
 
 // src/dashboard/agent-bridge.ts
-import { randomBytes as randomBytes8, randomUUID as randomUUID4, sign as signRaw, timingSafeEqual as timingSafeEqual2, verify as verifyRaw } from "crypto";
+import { randomBytes as randomBytes8, randomUUID as randomUUID5, sign as signRaw, timingSafeEqual as timingSafeEqual2, verify as verifyRaw } from "crypto";
 
 // src/dashboard/docs-relay.ts
-import { Hono as Hono29 } from "hono";
+import { Hono as Hono30 } from "hono";
 import { streamSSE as streamSSE2 } from "hono/streaming";
 var FORWARDED_HEADERS = ["content-type", "host", "accept-language"];
 var RETURNED_HEADERS = ["content-type", "content-disposition", "content-security-policy", "cache-control"];
 async function handleDocsRequest(req) {
-  const app = new Hono29();
+  const app = new Hono30();
   app.use("*", async (c, next) => {
     c.set("auth", req.auth);
     await next();
@@ -15688,24 +16010,24 @@ function relay2(agent) {
 }
 
 // src/dashboard/agent-bridge.ts
-import { existsSync as existsSync24, readFileSync as readFileSync18 } from "fs";
+import { existsSync as existsSync25, readFileSync as readFileSync19 } from "fs";
 import dotenv from "dotenv";
 import { WebSocket, WebSocketServer } from "ws";
 
 // src/dashboard/host-identity.ts
 import { createPrivateKey as createPrivateKey2, createPublicKey as createPublicKey2, generateKeyPairSync as generateKeyPairSync2 } from "crypto";
-import { existsSync as existsSync23, mkdirSync as mkdirSync10, readFileSync as readFileSync16, writeFileSync as writeFileSync10 } from "fs";
-import { dirname as dirname7, join as join23 } from "path";
+import { existsSync as existsSync24, mkdirSync as mkdirSync12, readFileSync as readFileSync17, writeFileSync as writeFileSync11 } from "fs";
+import { dirname as dirname8, join as join24 } from "path";
 function hostPrivateKeyPath() {
-  return process.env["FLYSPACE_HOST_KEY_PATH"] || join23(paths.BASE_CONFIG_DIR, "host.key");
+  return process.env["FLYSPACE_HOST_KEY_PATH"] || join24(paths.BASE_CONFIG_DIR, "host.key");
 }
 function loadHostPrivateKey(path = hostPrivateKeyPath()) {
-  if (!existsSync23(path)) {
+  if (!existsSync24(path)) {
     throw new Error(
       `No Host identity at ${path}. Run \`pnpm run generate-host-key\` on this machine, then set FLYSPACE_HOST_PUBLIC_KEY on the Data process to the printed public key.`
     );
   }
-  return createPrivateKey2(readFileSync16(path, "utf8"));
+  return createPrivateKey2(readFileSync17(path, "utf8"));
 }
 function loadHostPublicKey() {
   const b64 = process.env["FLYSPACE_HOST_PUBLIC_KEY"];
@@ -15950,7 +16272,7 @@ async function userEmail(userId) {
 
 // src/dashboard/doc-share-publisher.ts
 import { randomBytes as randomBytes7 } from "crypto";
-import { readFileSync as readFileSync17, statSync as statSync9 } from "fs";
+import { readFileSync as readFileSync18, statSync as statSync9 } from "fs";
 import { extname as extname2, posix } from "path";
 import { CopyObjectCommand, PutObjectCommand as PutObjectCommand5 } from "@aws-sdk/client-s3";
 
@@ -16137,7 +16459,7 @@ async function buildSnapshot(cwd, sourcePath, shareId) {
   }
   if (!stat.isFile()) return { status: "not-found" };
   if (stat.size > MAX_CONTENT_BYTES2) return { status: "too-large" };
-  const source = readFileSync17(abs, "utf8");
+  const source = readFileSync18(abs, "utf8");
   const title = extractTitle(abs, kind === "markdown" ? "md" : kind);
   if (kind === "excalidraw") {
     try {
@@ -16217,7 +16539,7 @@ async function buildSnapshot(cwd, sourcePath, shareId) {
       let text = null;
       try {
         const size = statSync9(docAbs).size;
-        if (size <= budget) text = readFileSync17(docAbs, "utf8");
+        if (size <= budget) text = readFileSync18(docAbs, "utf8");
       } catch {
         continue;
       }
@@ -16234,7 +16556,7 @@ async function buildSnapshot(cwd, sourcePath, shareId) {
     let body;
     try {
       if (statSync9(resolved2.abs).size > MAX_ASSET_BYTES) continue;
-      body = readFileSync17(resolved2.abs);
+      body = readFileSync18(resolved2.abs);
     } catch {
       continue;
     }
@@ -16327,13 +16649,14 @@ var METHODS = {
   threads: ["GET", "HEAD", "POST", "PATCH"],
   thread_replies: ["GET", "HEAD", "POST", "PATCH"],
   memberships: ["GET", "HEAD"],
+  feature_flags: ["GET", "HEAD"],
   channel_members: ["GET", "HEAD"],
-  channel_docs_access: ["GET", "HEAD"],
   memories: ALL,
   memory_events: ["GET", "HEAD", "POST", "PATCH"]
 };
-var CHANNEL_SCOPED = /* @__PURE__ */ new Set(["channel_members", "channel_docs_access"]);
-var CHANNEL_OWNED = /* @__PURE__ */ new Set(["memories", "memory_events"]);
+var CHANNEL_SCOPED = /* @__PURE__ */ new Set(["channel_members"]);
+var MEMORY_TABLES = /* @__PURE__ */ new Set(["memories", "memory_events"]);
+var MEMORY_KEYS = ["channel_id", "workspace_id", "user_id", "scope"];
 var FORWARDED_HEADERS2 = ["accept", "content-type", "prefer", "range"];
 var deny = (message, status = 403) => ({
   status,
@@ -16440,7 +16763,30 @@ async function proxyHostDb(workspaces, req, forward, assigned = workspaces ?? []
       }
     }
     params.append(slugColumn, inList(scope));
-  } else if (table === "memberships") {
+  } else if (MEMORY_TABLES.has(table)) {
+    const [workspaceIds, channelIds] = await Promise.all([
+      ownedWorkspaceIds(forward, workspaces),
+      ownedChannelIds(forward, workspaces)
+    ]);
+    if (!workspaceIds || !channelIds) return deny("Could not resolve the device workspaces.", 502);
+    if (method === "POST") {
+      const ok3 = rows.length > 0 && rows.every((r) => {
+        const channel = r["channel_id"];
+        if (channel !== void 0 && channel !== null) {
+          return typeof channel === "string" && channelIds.includes(channel);
+        }
+        return typeof r["workspace_id"] === "string" && workspaceIds.includes(r["workspace_id"]);
+      });
+      if (!ok3) return deny(`Every ${table} row must belong to a channel or workspace of the device.`);
+    }
+    if (method === "PATCH") {
+      const patch = bodyRows(req.body);
+      if (!patch || patch.some((r) => MEMORY_KEYS.some((k) => k in r))) {
+        return deny(`A ${table} row cannot move to another channel, workspace or person.`);
+      }
+    }
+    params.append("workspace_id", inList(workspaceIds));
+  } else if (table === "memberships" || table === "feature_flags") {
     const workspaceIds = await ownedWorkspaceIds(forward, workspaces);
     if (!workspaceIds) return deny("Could not resolve the device workspaces.", 502);
     params.append("workspace_id", inList(workspaceIds));
@@ -16449,16 +16795,6 @@ async function proxyHostDb(workspaces, req, forward, assigned = workspaces ?? []
     if (!channelIds) return deny("Could not resolve the device workspaces.", 502);
     if (CHANNEL_SCOPED.has(table)) {
       params.append("channel_id", inList(channelIds));
-    } else if (CHANNEL_OWNED.has(table)) {
-      if (method === "POST") {
-        const ok3 = rows.length > 0 && rows.every((r) => typeof r["channel_id"] === "string" && channelIds.includes(r["channel_id"]));
-        if (!ok3) return deny(`Every ${table} row must belong to a channel of the device workspaces.`);
-      }
-      if (method === "PATCH") {
-        const patch = bodyRows(req.body);
-        if (!patch || patch.some((r) => "channel_id" in r)) return deny(`A ${table} row cannot move channels.`);
-      }
-      params.append("channel_id", inList(channelIds));
     } else if (table === "threads") {
       if (method === "POST") {
         const ok3 = rows.length > 0 && rows.every((r) => typeof r["channel_id"] === "string" && channelIds.includes(r["channel_id"]));
@@ -16532,7 +16868,7 @@ function dataSocketUrl() {
   return `ws://127.0.0.1:${process.env["FLYSPACE_DATA_API_PORT"] ?? DEFAULT_DATA_API_PORT}${HOST_SOCKET_PATH}`;
 }
 function listLocalSessions() {
-  if (!existsSync24(paths.DB_FILE)) return [];
+  if (!existsSync25(paths.DB_FILE)) return [];
   const store = new SessionStore(paths.DB_FILE);
   try {
     return store.listSessions();
@@ -16559,6 +16895,7 @@ function localAgentCallbacks(chatAgent) {
     saveLocalDashboardSettings: (patch) => saveDashboardSettings(patch),
     writeSkill: (ref, write) => writeSkillAndSync(ref, write),
     outputStylesRequest: (req) => handleOutputStylesRequest(req),
+    providerLoginRequest: (req) => handleProviderLoginRequest(req),
     docsRequest: (req) => handleDocsRequest(req),
     listSessions: () => listLocalSessions(),
     scanOnboarding: () => scanOnboarding(),
@@ -16571,7 +16908,7 @@ function buildHostConfigSnapshot() {
   const snapshot2 = {};
   for (const profile of listProfiles()) {
     snapshot2[profile] = runWithProfile(profile, () => ({
-      env: existsSync24(paths.CONFIG_FILE) ? dotenv.parse(readFileSync18(paths.CONFIG_FILE, "utf-8")) : {},
+      env: existsSync25(paths.CONFIG_FILE) ? dotenv.parse(readFileSync19(paths.CONFIG_FILE, "utf-8")) : {},
       agentModel: loadDashboardSettings().agent
     }));
   }
@@ -16784,7 +17121,7 @@ function callHost(method, args, timeoutMs = CALL_TIMEOUT_MS) {
     return Promise.resolve(null);
   }
   if (method === "docsRequest") console.log(`[host-socket] docsRequest for "${profile}" -> device ${hosts.get(ws)?.deviceId ?? "legacy"}`);
-  const id = randomUUID4();
+  const id = randomUUID5();
   return new Promise((resolve7) => {
     const timer2 = setTimeout(() => {
       pending2.delete(id);
@@ -16848,6 +17185,8 @@ function remoteAgentCallbacks() {
     writeSkill: (ref, write) => callHost("writeSkill", [ref, write]),
     // Same posture as writeSkill: `null` becomes a 503.
     outputStylesRequest: (req) => callHost("outputStylesRequest", [req]),
+    // Submitting a Claude code waits on the CLI to mint the token.
+    providerLoginRequest: (req) => callHost("providerLoginRequest", [req], DOCS_CALL_TIMEOUT_MS),
     // Same posture again. Longer timeout: a first translation of a doc runs a
     // model call on the Host before it answers.
     docsRequest: (req) => callHost("docsRequest", [req], DOCS_CALL_TIMEOUT_MS),
@@ -17112,7 +17451,7 @@ async function boundWorkspaceIds(publicKey, userId) {
   return new Set(existing ? (await listDeviceWorkspaces(existing)).map((w) => w.id) : []);
 }
 function createDeviceAuthRouter() {
-  const app = new Hono30();
+  const app = new Hono31();
   app.post("/code", async (c) => {
     const body = await readBody(c);
     const publicKey = typeof body["public_key"] === "string" ? body["public_key"] : "";
@@ -17276,7 +17615,7 @@ function createDeviceAuthRouter() {
 
 // src/dashboard/api.ts
 function createApiRouter(agent = {}, mode = "all") {
-  const api = new Hono31();
+  const api = new Hono32();
   api.use("*", async (c, next) => {
     const known = await listKnownWorkspaces();
     const fromHost = profileFromHost(trustedHost(c), known);
@@ -17332,6 +17671,7 @@ function createApiRouter(agent = {}, mode = "all") {
     });
     registerMirroredSkillRoutes(api, agent);
     registerRelayedOutputStylesRoutes(api, agent);
+    registerRelayedProviderLoginRoutes(api, agent);
     api.get("/channels/:id/docs/flat", requireDocsAccess, async (c) => {
       const { cwd } = resolveChannelConfig(c.req.param("id"));
       const query = c.req.query("q") ?? "";
@@ -17389,7 +17729,7 @@ function createApiRouter(agent = {}, mode = "all") {
 }
 
 // src/dashboard/app-icon-routes.ts
-import { Hono as Hono32 } from "hono";
+import { Hono as Hono33 } from "hono";
 var NEUTRAL_MANIFEST = {
   id: "/",
   name: "Flyspace",
@@ -17427,7 +17767,7 @@ async function withResolvedProfile2(c, next) {
   return profile ? runWithProfile(profile, () => next()) : next();
 }
 function createAppIconRouter() {
-  const app = new Hono32();
+  const app = new Hono33();
   app.get("/manifest.json", withResolvedProfile2, async (c) => {
     if (!await resolvedProfileHost(c)) return c.json(NEUTRAL_MANIFEST);
     const profile = getProfile();
@@ -17467,7 +17807,7 @@ function pngResponse(c, png) {
 }
 
 // src/dashboard/stripe-routes.ts
-import { Hono as Hono33 } from "hono";
+import { Hono as Hono34 } from "hono";
 function planStatusFor(status) {
   const known = ["trialing", "active", "paused", "canceled"];
   return known.includes(status) ? status : null;
@@ -17510,7 +17850,7 @@ async function handleCardAdded(session) {
   }
 }
 function createStripeWebhookRouter() {
-  const stripeRouter = new Hono33();
+  const stripeRouter = new Hono34();
   stripeRouter.post("/webhook", async (c) => {
     const secret = process.env["STRIPE_WEBHOOK_SECRET"];
     const signature = c.req.header("stripe-signature");
@@ -17621,7 +17961,7 @@ function startHostStatusBroadcast() {
 
 // src/dashboard/server.ts
 var DEFAULT_DASHBOARD_PORT = 4747;
-var WEB_DIST = join24(paths.PACKAGE_ROOT, "web", "dist");
+var WEB_DIST = join25(paths.PACKAGE_ROOT, "web", "dist");
 var DEFAULT_DASHBOARD_HOST = "127.0.0.1";
 async function findFreePort(start, host = DEFAULT_DASHBOARD_HOST, attempts = 50) {
   for (let port = start; port < start + attempts; port++) {
@@ -17670,7 +18010,7 @@ async function startDashboardServer(preferredPort = DEFAULT_DASHBOARD_PORT, host
   const mirrorsSkills = mode === "host" || process.env["FLYSPACE_SKILL_SYNC"] === "1";
   const stopSkillSync = mirrorsSkills ? installSkillSync(listProfiles()) : () => {
   };
-  const app = new Hono34();
+  const app = new Hono35();
   app.onError(reportingErrorHandler);
   app.use("*", async (c, next) => {
     await next();
@@ -17710,14 +18050,14 @@ async function startDashboardServer(preferredPort = DEFAULT_DASHBOARD_PORT, host
   } else {
     app.route("/share", createPublicShareAssetRouter(WEB_DIST));
     app.route("/", createAppIconRouter());
-    if (existsSync25(WEB_DIST) || existsSync25(join24(paths.PACKAGE_ROOT, "web", "package.json"))) {
+    if (existsSync26(WEB_DIST) || existsSync26(join25(paths.PACKAGE_ROOT, "web", "package.json"))) {
       app.use("/*", serveStatic({ root: WEB_DIST }));
     }
     app.get("/assets/*", (c) => c.text("stale asset \u2014 reload for the current build", 404));
-    const spaFallback = serveStatic({ path: join24(WEB_DIST, "index.html") });
+    const spaFallback = serveStatic({ path: join25(WEB_DIST, "index.html") });
     app.get("*", async (c, next) => {
-      if (!existsSync25(join24(WEB_DIST, "index.html"))) {
-        const isCheckout = existsSync25(join24(paths.PACKAGE_ROOT, "web", "package.json"));
+      if (!existsSync26(join25(WEB_DIST, "index.html"))) {
+        const isCheckout = existsSync26(join25(paths.PACKAGE_ROOT, "web", "package.json"));
         return c.text(
           isCheckout ? `Workspace UI build missing (${WEB_DIST}).
 Run \`pnpm --dir web build\` (or \`pnpm --dir web dev\`).
@@ -18155,7 +18495,7 @@ async function threadReplies(client2, nameOrId, ts2) {
 async function postMessage(client2, args) {
   const channelArg = getArg2(args, "--channel");
   const textFilePath = getArg2(args, "--text-file");
-  const text = textFilePath ? readFileSync19(textFilePath, "utf8") : getArg2(args, "--text");
+  const text = textFilePath ? readFileSync20(textFilePath, "utf8") : getArg2(args, "--text");
   const threadTs = getArg2(args, "--thread");
   const markdown = args.includes("--markdown");
   const broadcast = args.includes("--broadcast") && Boolean(threadTs);
@@ -18253,7 +18593,7 @@ function defaultClaudeConfigDir() {
   return process.env.CLAUDE_CONFIG_DIR || resolve6(homedir9(), ".claude");
 }
 function hasClaudeCredentials(configDir2) {
-  if (existsSync26(resolve6(configDir2, ".credentials.json"))) {
+  if (existsSync27(resolve6(configDir2, ".credentials.json"))) {
     return true;
   }
   if (process.platform === "darwin") {
@@ -18310,7 +18650,7 @@ async function ensureClaudeCodeReady() {
 }
 function getManifestYaml(botName) {
   const manifestPath = resolve6(paths.PACKAGE_ROOT, "slack-app-manifest.yml");
-  const raw = readFileSync19(manifestPath, "utf-8");
+  const raw = readFileSync20(manifestPath, "utf-8");
   return raw.replace(/name: Custie/g, `name: ${botName}`);
 }
 async function stepPersonalise() {
@@ -18617,7 +18957,7 @@ async function stepBrowserTokens(botName) {
       let settled = false;
       let interval;
       let timeout;
-      const finish = (action) => {
+      const finish2 = (action) => {
         if (settled) return;
         settled = true;
         clearInterval(interval);
@@ -18626,7 +18966,7 @@ async function stepBrowserTokens(botName) {
       };
       const checkUrl = (p) => {
         if (p.url().includes("install-on-team?success=1")) {
-          finish(() => resolve7(p));
+          finish2(() => resolve7(p));
         }
       };
       context.on("page", (newPage) => {
@@ -18637,7 +18977,7 @@ async function stepBrowserTokens(botName) {
         for (const p of context.pages()) checkUrl(p);
       }, 1e3);
       timeout = setTimeout(() => {
-        finish(() => reject(new Error("Timed out waiting for the app to be installed.")));
+        finish2(() => reject(new Error("Timed out waiting for the app to be installed.")));
       }, 12e4);
     });
     success4("App installed! Extracting Bot Token...");
@@ -18727,7 +19067,7 @@ function writeConfigFile(config) {
     `OWNER_USER_ID=${config.ownerUserId}`,
     ``
   ].join("\n");
-  writeFileSync11(paths.CONFIG_FILE, envContent);
+  writeFileSync12(paths.CONFIG_FILE, envContent);
   success4(`Config written to ${paths.CONFIG_FILE}`);
 }
 function printNextSteps() {
@@ -18739,11 +19079,11 @@ function printNextSteps() {
   console.log("     Run \x1B[1mflyspace service install\x1B[0m\n");
 }
 function copyDefaultPrompt(botName) {
-  if (!existsSync26(paths.PROMPT_FILE)) {
+  if (!existsSync27(paths.PROMPT_FILE)) {
     const defaultPrompt = resolve6(paths.PACKAGE_ROOT, "system.default.md");
-    if (existsSync26(defaultPrompt)) {
-      const content = readFileSync19(defaultPrompt, "utf-8").replace(/\{\{botName\}\}/g, botName);
-      writeFileSync11(paths.PROMPT_FILE, content);
+    if (existsSync27(defaultPrompt)) {
+      const content = readFileSync20(defaultPrompt, "utf-8").replace(/\{\{botName\}\}/g, botName);
+      writeFileSync12(paths.PROMPT_FILE, content);
       success4(`Default prompt copied to ${paths.PROMPT_FILE}`);
     }
   }
@@ -18755,7 +19095,7 @@ async function runSlackSetup(args) {
     const prereq = await ensureClaudeCodeReady();
     if (!prereq) return;
     const { claudeConfigDir } = prereq;
-    if (existsSync26(paths.CONFIG_FILE)) {
+    if (existsSync27(paths.CONFIG_FILE)) {
       const reconfigure = await confirm4({
         message: `Config already exists at ${paths.CONFIG_FILE}. Reconfigure?`,
         default: false
@@ -19066,21 +19406,21 @@ async function runChatCmd(args) {
 }
 
 // src/commands/memory.ts
-import { readFileSync as readFileSync21 } from "fs";
+import { readFileSync as readFileSync22 } from "fs";
 
 // src/store/claude-memory-import.ts
-import { existsSync as existsSync27, readdirSync as readdirSync5, readFileSync as readFileSync20 } from "fs";
+import { existsSync as existsSync28, readdirSync as readdirSync5, readFileSync as readFileSync21 } from "fs";
 import { homedir as homedir10 } from "os";
-import { basename as basename8, join as join25 } from "path";
+import { basename as basename8, join as join26 } from "path";
 import dotenv2 from "dotenv";
 function claudeMemoryDir(cwd, configDir2) {
-  return join25(configDir2, "projects", cwd.replaceAll(/[^a-zA-Z0-9]/g, "-"), "memory");
+  return join26(configDir2, "projects", cwd.replaceAll(/[^a-zA-Z0-9]/g, "-"), "memory");
 }
 function profileClaudeConfigDirFor(profile) {
-  const dir = profile === "default" ? paths.BASE_CONFIG_DIR : join25(paths.PROFILES_DIR, profile);
-  const file = join25(dir, "config.env");
-  const env = existsSync27(file) ? dotenv2.parse(readFileSync20(file)) : {};
-  return env["CLAUDE_CONFIG_DIR"]?.trim() || join25(homedir10(), ".claude");
+  const dir = profile === "default" ? paths.BASE_CONFIG_DIR : join26(paths.PROFILES_DIR, profile);
+  const file = join26(dir, "config.env");
+  const env = existsSync28(file) ? dotenv2.parse(readFileSync21(file)) : {};
+  return env["CLAUDE_CONFIG_DIR"]?.trim() || join26(homedir10(), ".claude");
 }
 var TYPE_MAP = {
   user: "preference",
@@ -19125,11 +19465,11 @@ function parseClaudeMemory(fileName, text, channelId) {
   return input2;
 }
 async function importClaudeMemories(dir, channelId, opts = {}) {
-  if (!existsSync27(dir)) throw new Error(`No Claude memory directory at ${dir}`);
+  if (!existsSync28(dir)) throw new Error(`No Claude memory directory at ${dir}`);
   const files = readdirSync5(dir).filter((f) => f.endsWith(".md") && f !== "MEMORY.md").sort();
   const results = [];
   for (const file of files) {
-    const parsed = parseClaudeMemory(file, readFileSync20(join25(dir, file), "utf-8"), channelId);
+    const parsed = parseClaudeMemory(file, readFileSync21(join26(dir, file), "utf-8"), channelId);
     if ("skip" in parsed) {
       results.push({ file, outcome: "skipped", reason: parsed.skip });
       continue;
@@ -19164,6 +19504,12 @@ var USAGE5 = `
                                          Defaults to the channel profile's CLAUDE_CONFIG_DIR
                                          (or ~/.claude)/projects/<cwd slug>/memory
 
+  Scope (list, get, search, save, delete; default: the channel's memory):
+    --scope user --user <user-id>        That member's personal memory, in the channel's
+                                         workspace. Only ever the current sender's.
+    --scope workspace                    The workspace's memory. Read-only here: only a
+                                         Workspace Admin changes it, from Settings.
+
   Types: ${MEMORY_TYPES.join(", ")}
 `;
 function getArg4(args, flag) {
@@ -19194,17 +19540,23 @@ async function runMemoryCmd(args) {
   if (!channelArg) throw new Error("--channel <name-or-id> is required");
   const channel = await resolveChannel(channelArg, getArg4(rest, "--profile-name"));
   const words = positionals(rest);
+  const target = await resolveTarget(rest, channel);
+  const where = target.scope === "channel" ? channel.name : `${target.scope} memory`;
+  if (target.scope === "workspace" && (subcommand === "save" || subcommand === "delete")) {
+    throw new Error("Workspace memory is read-only to the agent; a Workspace Admin manages it.");
+  }
   switch (subcommand) {
     case "list": {
-      const memories = await listChannelMemories(channel.id);
+      const memories = await listMemories(target);
       console.log(memories.length ? memories.map(indexLine).join("\n") : "No memories yet.");
       break;
     }
     case "get": {
       const name = words[0];
       if (!name) throw new Error("Usage: flyspace memory get --channel <c> <name>");
-      const memory = await getChannelMemory(channel.id, name);
-      if (!memory) throw new Error(`No memory named ${name} in ${channel.name}.`);
+      const memory = await getMemory(target, name);
+      if (!memory) throw new Error(`No memory named ${name} in ${where}.`);
+      await markMemoryUsed(memory);
       console.log(`# ${memory.name} (${memory.type})
 
 ${memory.description}
@@ -19214,7 +19566,7 @@ ${memory.body}`);
     }
     case "search": {
       if (!words.length) throw new Error("Usage: flyspace memory search --channel <c> <words...>");
-      const hits = await searchChannelMemories(channel.id, words.join(" "));
+      const hits = await searchMemories(target, words.join(" "));
       console.log(hits.length ? hits.map(indexLine).join("\n") : "No matching memories.");
       break;
     }
@@ -19229,11 +19581,11 @@ ${memory.body}`);
         );
       }
       if (!isMemoryType(type)) throw new Error(`--type must be one of ${MEMORY_TYPES.join(", ")}`);
-      const body = bodyArg === "-" ? readFileSync21(0, "utf-8") : bodyArg;
+      const body = bodyArg === "-" ? readFileSync22(0, "utf-8") : bodyArg;
       const thread = getArg4(rest, "--thread");
-      const { created, changed } = await saveChannelMemory(
+      const { created, changed } = await saveMemory(
+        target,
         {
-          channelId: channel.id,
           name,
           type,
           description,
@@ -19244,18 +19596,19 @@ ${memory.body}`);
         "agent"
       );
       const verb = created ? "Saved" : changed ? "Updated" : "Unchanged:";
-      console.log(`${verb} memory ${name} in ${channel.name}.`);
+      console.log(`${verb} memory ${name} in ${where}.`);
       break;
     }
     case "delete": {
       const ref = words[0];
       if (!ref) throw new Error("Usage: flyspace memory delete --channel <c> <name-or-id>");
-      const deleted = await deleteChannelMemory(channel.id, ref, "agent", getArg4(rest, "--thread"));
-      if (!deleted) throw new Error(`No memory ${ref} in ${channel.name}.`);
+      const deleted = await deleteMemory(target, ref, "agent", getArg4(rest, "--thread"));
+      if (!deleted) throw new Error(`No memory ${ref} in ${where}.`);
       console.log(`Deleted memory ${ref}.`);
       break;
     }
     case "import": {
+      if (target.scope !== "channel") throw new Error("import only fills a channel memory");
       const dir = getArg4(rest, "--dir") ?? claudeMemoryDir(channel.cwd, profileClaudeConfigDirFor(channel.profile));
       const dryRun = rest.includes("--dry-run");
       const results = await importClaudeMemories(dir, channel.id, { dryRun });
@@ -19275,6 +19628,19 @@ ${memory.body}`);
       process.exit(1);
   }
 }
+async function resolveTarget(args, channel) {
+  const scope = getArg4(args, "--scope") ?? "channel";
+  if (scope === "channel") return { scope: "channel", channelId: channel.id };
+  if (scope !== "user" && scope !== "workspace") {
+    throw new Error("--scope must be channel, user or workspace");
+  }
+  const workspace = await getWorkspaceBySlug(channel.profile);
+  if (!workspace) throw new Error(`No workspace for ${channel.profile}.`);
+  if (scope === "workspace") return { scope, workspaceId: workspace.id };
+  const userId = getArg4(args, "--user");
+  if (!userId) throw new Error("--scope user needs --user <user-id>");
+  return { scope, workspaceId: workspace.id, userId };
+}
 
 // src/commands/mcp.ts
 var USAGE6 = `
@@ -19313,10 +19679,10 @@ async function runMcpCmd(args) {
 }
 
 // src/commands/dashboard.ts
-import { spawn as spawn6, spawnSync } from "child_process";
-import { existsSync as existsSync28 } from "fs";
+import { spawn as spawn7, spawnSync } from "child_process";
+import { existsSync as existsSync29 } from "fs";
 import { platform as platform7 } from "os";
-import { join as join26 } from "path";
+import { join as join27 } from "path";
 function flagValue(args, name) {
   const eq = args.find((a) => a.startsWith(`--${name}=`));
   if (eq) return eq.slice(`--${name}=`.length);
@@ -19326,13 +19692,13 @@ function flagValue(args, name) {
 function openBrowser2(url) {
   const cmd = platform7() === "darwin" ? "open" : platform7() === "win32" ? "start" : "xdg-open";
   try {
-    spawn6(cmd, [url], { stdio: "ignore", detached: true }).unref();
+    spawn7(cmd, [url], { stdio: "ignore", detached: true }).unref();
   } catch {
   }
 }
 function ensureWebBuild() {
-  if (existsSync28(join26(paths.PACKAGE_ROOT, "web", "dist", "index.html"))) return;
-  if (!existsSync28(join26(paths.PACKAGE_ROOT, "web", "package.json"))) return;
+  if (existsSync29(join27(paths.PACKAGE_ROOT, "web", "dist", "index.html"))) return;
+  if (!existsSync29(join27(paths.PACKAGE_ROOT, "web", "package.json"))) return;
   console.log("  web/dist missing \u2014 building the dashboard UI (pnpm --dir web build)...");
   const result = spawnSync("pnpm", ["--dir", "web", "build"], {
     cwd: paths.PACKAGE_ROOT,
@@ -19382,7 +19748,7 @@ async function runDashboard(args) {
 }
 
 // src/commands/workspace.ts
-import { existsSync as existsSync29, mkdirSync as mkdirSync11, writeFileSync as writeFileSync12 } from "fs";
+import { existsSync as existsSync30, mkdirSync as mkdirSync13, writeFileSync as writeFileSync13 } from "fs";
 var USAGE7 = `
   Usage: flyspace workspace <subcommand> [options]
 
@@ -19468,10 +19834,10 @@ function provisionLocal(botName) {
   ensureDirs();
   console.log(`  config dir ready (${paths.CONFIG_DIR})`);
   console.log(`  data dir ready (${paths.DATA_DIR})`);
-  if (existsSync29(paths.CONFIG_FILE)) {
+  if (existsSync30(paths.CONFIG_FILE)) {
     console.log("  config.env exists");
   } else {
-    writeFileSync12(paths.CONFIG_FILE, `BOT_NAME=${botName}
+    writeFileSync13(paths.CONFIG_FILE, `BOT_NAME=${botName}
 `);
     console.log(`  config.env written (${paths.CONFIG_FILE})`);
   }
@@ -19485,8 +19851,8 @@ async function provisionChannels(specs) {
       continue;
     }
     const cwd = expandPath(spec.cwd);
-    if (!existsSync29(cwd)) {
-      mkdirSync11(cwd, { recursive: true });
+    if (!existsSync30(cwd)) {
+      mkdirSync13(cwd, { recursive: true });
       console.log(`  created cwd ${cwd}`);
     }
     await createChannel({ name: spec.name, cwd, position: index });
@@ -19695,7 +20061,7 @@ async function main() {
       break;
     case "-v":
     case "--version":
-      printRaw("0.1.15");
+      printRaw("0.1.16");
       break;
     case "-h":
     case "--help":