flyspace-cli 0.1.27 → 0.1.30

package/dist/cli.js

@@ -1219,6 +1219,7 @@ import {
   readdirSync as readdirSync2,
   readFileSync as readFileSync7,
   readSync,
+  realpathSync as realpathSync2,
   statSync as statSync2,
   symlinkSync
 } from "fs";
@@ -1362,7 +1363,23 @@ function detectRunners(history = { claude: false, codex: false }) {
     }
   ];
 }
-function scanOnboarding() {
+function linkedTargets(slug) {
+  const out = /* @__PURE__ */ new Map();
+  if (!SLUG_RE.test(slug)) return out;
+  const dir = join7(flyspaceRoot(), slug);
+  try {
+    for (const e of readdirSync2(dir, { withFileTypes: true })) {
+      if (!e.isSymbolicLink()) continue;
+      try {
+        out.set(realpathSync2(join7(dir, e.name)), e.name);
+      } catch {
+      }
+    }
+  } catch {
+  }
+  return out;
+}
+function scanOnboarding(slug) {
   const byPath = /* @__PURE__ */ new Map();
   const history = { claude: false, codex: false };
   const add = (rawPath, source, mtime, sessions2, trusted = false) => {
@@ -1432,6 +1449,18 @@ function scanOnboarding() {
   projects.sort(
     (a, b) => Number(b.sources.length > 1) - Number(a.sources.length > 1) || Number(b.trusted) - Number(a.trusted) || b.lastUsed - a.lastUsed || b.sessions - a.sessions
   );
+  if (slug) {
+    const linked = linkedTargets(slug);
+    for (const p of projects) {
+      let real = p.path;
+      try {
+        real = realpathSync2(p.path);
+      } catch {
+      }
+      const name = linked.get(real);
+      if (name) p.linkedAs = name;
+    }
+  }
   return {
     root: flyspaceRoot(),
     runners: detectRunners(history),
@@ -1443,13 +1472,23 @@ var GENERAL_TEMPLATE_DIR = join7(paths.PACKAGE_ROOT, "templates", "general");
 function makeLink(target, linkPath) {
   symlinkSync(target, linkPath, process.platform === "win32" ? "junction" : "dir");
 }
+var SLUG_RE = /^[a-z0-9][a-z0-9-]*$/;
+function assertLinkable(target) {
+  const home2 = homedir3();
+  const root = existsSync6(flyspaceRoot()) ? realpathSync2(flyspaceRoot()) : flyspaceRoot();
+  const denied = [join7(home2, ".ssh"), join7(home2, "Library"), join7(home2, ".config"), join7(home2, ".gnupg")];
+  if (target === home2 || target === "/" || target === root || target.startsWith(`${root}/`)) {
+    throw new Error(`cannot link ${target}`);
+  }
+  if (denied.some((d) => target === d || target.startsWith(`${d}/`))) throw new Error(`cannot link ${target}`);
+}
 function linkProjectFolders(slug, items) {
-  if (!/^[a-z0-9][a-z0-9-]*$/.test(slug)) throw new Error(`invalid workspace slug: ${slug}`);
+  if (!SLUG_RE.test(slug)) throw new Error(`invalid workspace slug: ${slug}`);
   const dir = join7(flyspaceRoot(), slug);
   mkdirSync5(dir, { recursive: true });
   const results = [];
   for (const item of items) {
-    if (!/^[a-z0-9][a-z0-9-]*$/.test(item.name)) throw new Error(`invalid channel name: ${item.name}`);
+    if (!SLUG_RE.test(item.name)) throw new Error(`invalid channel name: ${item.name}`);
     const dest = join7(dir, item.name);
     let exists = true;
     try {
@@ -1460,10 +1499,21 @@ function linkProjectFolders(slug, items) {
     if (exists && item.name === "general" && !item.path) {
       cpSync(GENERAL_TEMPLATE_DIR, dest, { recursive: true, force: false });
     }
+    if (exists && item.path) {
+      let current = null;
+      try {
+        current = realpathSync2(dest);
+      } catch {
+      }
+      if (current !== realpathSync2(resolve3(item.path))) {
+        throw new Error(`#${item.name} already points at another folder`);
+      }
+    }
     if (!exists) {
       if (item.path) {
         const target = resolve3(item.path);
         if (!statSync2(target).isDirectory()) throw new Error(`not a directory: ${target}`);
+        assertLinkable(realpathSync2(target));
         makeLink(target, dest);
       } else {
         mkdirSync5(dest, { recursive: true });
@@ -1785,7 +1835,7 @@ async function runAuthCmd(args) {
 }
 
 // ../api/src/version.ts
-var CLI_VERSION = true ? "0.1.27" : null;
+var CLI_VERSION = true ? "0.1.30" : null;
 function isOlderVersion(a, b) {
   const parse = (v) => v.replace(/^v/, "").split("-")[0].split(".").map(Number);
   const [pa, pb] = [parse(a), parse(b)];
@@ -2058,11 +2108,11 @@ async function serverReachable() {
     return err.cause ? String(err.cause) : err.message;
   }
 }
-function checkService(name, installed, file, running, fix) {
+function checkService(name, installed, file, running2, fix) {
   if (!installed) bad2(`${name} not installed`, `run: ${fix}`);
   else if (serviceBinaryMissing(file))
     bad2(`${name} points at a CLI that no longer exists`, `run: ${fix}`);
-  else if (!running) bad2(`${name} not running`, `logs: ${tilde3(paths.LOG_DIR)}`);
+  else if (!running2) bad2(`${name} not running`, `logs: ${tilde3(paths.LOG_DIR)}`);
   else ok2(`${name} running`);
 }
 async function runDoctor(args) {
@@ -2331,7 +2381,7 @@ async function runProfiles(args = []) {
 
 // src/commands/upgrade.ts
 import { execSync as execSync6 } from "child_process";
-import { realpathSync as realpathSync2 } from "fs";
+import { realpathSync as realpathSync3 } from "fs";
 import { join as join11 } from "path";
 function restartInstalledProfiles() {
   if (isHostServiceInstalled()) {
@@ -2355,7 +2405,7 @@ Restarting ${installed.length} instance(s)...`);
 function npmInstallCommand() {
   let prefix;
   try {
-    const entry = realpathSync2(process.argv[1] ?? "");
+    const entry = realpathSync3(process.argv[1] ?? "");
     const at = entry.indexOf(`/lib/node_modules/${"flyspace-cli"}/`);
     if (at > 0) prefix = entry.slice(0, at);
   } catch {
@@ -2368,7 +2418,7 @@ function npmEnv() {
   return home2 ? { ...process.env, PATH: `${join11(home2, "node", "bin")}:${process.env.PATH ?? ""}` } : process.env;
 }
 async function runUpgrade() {
-  const current = "0.1.27";
+  const current = "0.1.30";
   console.log(`Current version: ${current}`);
   console.log("Checking for updates...\n");
   try {
@@ -6298,10 +6348,10 @@ async function runMcpCmd(args) {
 }
 
 // src/commands/dashboard.ts
-import { spawn as spawn7, spawnSync } from "child_process";
+import { spawn as spawn8, spawnSync } from "child_process";
 import { existsSync as existsSync32 } from "fs";
 import { platform as platform7 } from "os";
-import { join as join28 } from "path";
+import { join as join29 } from "path";
 
 // src/reconcile.ts
 import { existsSync as existsSync14, mkdirSync as mkdirSync8, writeFileSync as writeFileSync8 } from "fs";
@@ -7348,8 +7398,8 @@ var inFlight = /* @__PURE__ */ new Map();
 async function readOrCreateTranslation(input2) {
   const contentHash = translationHash(input2.title, input2.content);
   const key = `${input2.shareId}:${contentHash}:${input2.lang}`;
-  const running = inFlight.get(key);
-  if (running) return running;
+  const running2 = inFlight.get(key);
+  if (running2) return running2;
   const job = (async () => {
     const cached = await getDocShareTranslation(input2.shareId, input2.lang, contentHash);
     if (cached) return cached;
@@ -8514,7 +8564,7 @@ function createGuestRouter() {
 }
 
 // ../api/src/dashboard/auth-routes.ts
-import { Hono as Hono7 } from "hono";
+import { Hono as Hono8 } from "hono";
 
 // ../api/src/dashboard/supabase-server-client.ts
 import { createServerClient, parseCookieHeader, serializeCookieHeader } from "@supabase/ssr";
@@ -8624,6 +8674,8 @@ function pruneExpired(now) {
     if (entry.expires <= now) resolved.delete(key);
   }
 }
+var SUPPORT_NAME = "Flyspace Support";
+var SUPPORT_AVATAR_URL = "/logo/flyspace-mark.svg";
 async function resolveAuthContext(c, opts = {}) {
   const cookie = c.req?.header("Cookie") ?? "";
   if (!cookie) return resolveAuthContextUncached(c);
@@ -8682,8 +8734,9 @@ async function resolveAuthContextUncached(c) {
     handle: membership.handle,
     role: membership.role,
     workspaceId: workspace.id,
-    name: metadata.name,
-    avatarKey: metadata.avatarKey,
+    // A support admin posts into a customer's workspace as Flyspace, not as
+    // the staff member's personal profile.
+    ...membership.isSupport ? { name: SUPPORT_NAME, isSupport: true } : { name: metadata.name, avatarKey: metadata.avatarKey },
     onboarded: Boolean(metadata.onboardedAt),
     passwordSet: Boolean(metadata.passwordSetAt),
     agentConnectedAt: workspace.agentConnectedAt ?? null,
@@ -8752,1781 +8805,2036 @@ async function verifyTurnstileToken(token) {
   return data.action === void 0 || data.action === "login";
 }
 
-// ../api/src/dashboard/auth-routes.ts
-function createAuthRouter() {
-  const auth = new Hono7();
-  const emailedLink = (deliver) => async (c) => {
-    const body = await c.req.json().catch(() => ({}));
-    const email = body.email?.trim().toLowerCase();
-    if (!email) return c.json({ error: "email is required" }, 400);
-    if (!isDevHost(c) && !await verifyTurnstileToken(body.captchaToken)) {
-      return c.json({ error: "captcha check failed \u2014 please retry" }, 400);
-    }
-    const workspace = await getWorkspaceBySlug(getProfile());
-    if (!workspace) return c.json({ error: "unknown workspace" }, 404);
-    const membership = await getMembershipByEmail(workspace.id, email);
-    if (!membership) {
-      return c.json({ error: "no access \u2014 ask an admin to invite you" }, 403);
-    }
-    try {
-      await deliver(email, callbackUrl(c));
-    } catch (err) {
-      return c.json({ error: err instanceof Error ? err.message : "could not send" }, 500);
-    }
-    return c.json({ sent: true });
+// ../api/src/dashboard/onboarding-routes.ts
+import { Hono as Hono7 } from "hono";
+
+// ../api/src/store/device-store.ts
+import { createHash as createHash7, createPublicKey as createPublicKey2, randomBytes as randomBytes4, randomInt } from "crypto";
+var DEVICE_CODE_TTL_MS = 10 * 6e4;
+var ACCESS_TOKEN_TTL_MS = 15 * 6e4;
+var CHALLENGE_TTL_MS = 2 * 6e4;
+var POLL_INTERVAL_S = 5;
+var sha256 = (s) => createHash7("sha256").update(s).digest("hex");
+function parseEd25519PublicKey(b64) {
+  if (typeof b64 !== "string" || b64.length > 200) return null;
+  try {
+    const key = createPublicKey2({ key: Buffer.from(b64, "base64"), format: "der", type: "spki" });
+    return key.asymmetricKeyType === "ed25519" ? key : null;
+  } catch {
+    return null;
+  }
+}
+var USER_CODE_ALPHABET = "BCDFGHJKMNPQRSTVWXZ";
+function generateUserCode() {
+  const pick = () => Array.from({ length: 4 }, () => USER_CODE_ALPHABET[randomInt(USER_CODE_ALPHABET.length)]).join("");
+  return `${pick()}-${pick()}`;
+}
+function normalizeUserCode(input2) {
+  const raw = input2.toUpperCase().replace(/[\s-]/g, "");
+  if (raw.length !== 8 || [...raw].some((ch) => !USER_CODE_ALPHABET.includes(ch))) return null;
+  return `${raw.slice(0, 4)}-${raw.slice(4)}`;
+}
+function toDevice(r) {
+  return {
+    id: String(r["id"]),
+    userId: String(r["user_id"]),
+    name: String(r["name"]),
+    platform: r["platform"] ?? null,
+    publicKey: String(r["public_key"]),
+    createdAt: String(r["created_at"]),
+    lastSeenAt: r["last_seen_at"] ?? null,
+    revokedAt: r["revoked_at"] ?? null
   };
-  auth.post("/login", emailedLink(deliverSignInLink));
-  auth.post("/forgot-password", emailedLink(deliverPasswordResetLink));
-  auth.get("/session", async (c) => {
-    const ctx = await resolveAuthContext(c, { fresh: c.req.query("fresh") === "1" });
-    if (!ctx) return c.json({ error: "not signed in" }, 401);
-    return c.json({
-      email: ctx.email,
-      handle: ctx.handle,
-      role: ctx.role,
-      name: ctx.name,
-      avatarUrl: ctx.avatarKey ? await signAvatarUrl(ctx.avatarKey) : null,
-      onboarded: ctx.onboarded,
-      passwordSet: ctx.passwordSet,
-      agentConnectedAt: ctx.agentConnectedAt,
-      plan: ctx.plan ?? null,
-      onboarding: { pending: onboardingPending(ctx) }
-    });
-  });
-  auth.patch("/handle", async (c) => {
-    const ctx = await resolveAuthContext(c);
-    if (!ctx) return c.json({ error: "not signed in" }, 401);
-    if (ctx.onboarded) return c.json({ error: "handle can no longer be changed" }, 403);
-    const body = await c.req.json().catch(() => ({}));
-    const handle = body.handle?.trim().replace(/^@/, "").toLowerCase() ?? "";
-    if (!HANDLE_PATTERN.test(handle)) {
-      return c.json(
-        { error: "handle must be 1-32 characters: a-z, 0-9, _ or -, starting with a letter or digit" },
-        400
-      );
-    }
-    try {
-      await setMembershipHandle(ctx.workspaceId, ctx.userId, handle);
-    } catch (err) {
-      if (err instanceof HandleTakenError) return c.json({ error: err.message }, 409);
-      throw err;
-    }
-    return c.json({ handle });
-  });
-  auth.post("/logout", async (c) => {
-    const supabase = createRequestSupabaseClient(c);
-    await supabase.auth.signOut();
-    return c.json({ ok: true });
-  });
-  return auth;
 }
-
-// ../api/src/dashboard/auth-middleware.ts
-var requireWorkspaceMembership = async (c, next) => {
-  const ctx = await resolveAuthContext(c);
-  if (!ctx) return c.json({ error: "not signed in" }, 401);
-  c.set("auth", ctx);
-  return next();
-};
-
-// ../api/src/dashboard/billing-routes.ts
-import { Hono as Hono8 } from "hono";
-function isPlan(value) {
-  return value === "local" || value === "cloud";
+function toPending(r) {
+  return {
+    id: String(r["id"]),
+    userCode: String(r["user_code"]),
+    publicKey: String(r["public_key"]),
+    name: String(r["name"]),
+    platform: r["platform"] ?? null,
+    requesterIp: r["requester_ip"] ?? null,
+    approvedBy: r["approved_by"] ?? null,
+    workspaceIds: r["workspace_ids"] ?? [],
+    deniedAt: r["denied_at"] ?? null,
+    lastPolledAt: r["last_polled_at"] ?? null,
+    expiresAt: String(r["expires_at"]),
+    createdAt: String(r["created_at"])
+  };
 }
-var LOCK_EXEMPT = [/\/billing(\/|$)/, /\/profiles?$/, /\/push\//];
-async function requireActivePlan(c, next) {
-  if (c.req.method === "OPTIONS") return next();
-  if (LOCK_EXEMPT.some((re) => re.test(c.req.path))) return next();
-  const auth = c.get("auth");
-  if (!auth) return next();
-  if (isLockedPlan(await getWorkspacePlanStatus(auth.workspaceId))) {
-    return c.json({ error: "trial ended: add a card to reactivate this workspace", code: "plan_locked" }, 402);
-  }
-  return next();
+function fail(what, error2) {
+  throw new Error(`${what}: ${error2.message}`);
 }
-function createBillingRouter() {
-  const billing = new Hono8();
-  billing.get("/", async (c) => {
-    const auth = c.get("auth");
-    const { planStatus, stripeSubscriptionId } = await getWorkspaceBilling(auth.workspaceId);
-    let trialEnd = null;
-    let plan = null;
-    if (stripeSubscriptionId) {
-      try {
-        const sub = await getStripeClient().subscriptions.retrieve(stripeSubscriptionId);
-        if (planStatus === "trialing" && sub.trial_end) {
-          trialEnd = new Date(sub.trial_end * 1e3).toISOString();
-        }
-        if (isPlan(sub.metadata["plan"])) plan = PLAN_INFO[sub.metadata["plan"]];
-      } catch (err) {
-        console.warn("[billing] subscription lookup failed:", err);
-      }
-    }
-    return c.json({ planStatus, trialEnd, plan, locked: isLockedPlan(planStatus) });
-  });
-  billing.post("/checkout", async (c) => {
-    const auth = c.get("auth");
-    if (auth.role !== "admin") return c.json({ error: "admin access required" }, 403);
-    const { stripeCustomerId, stripeSubscriptionId } = await getWorkspaceBilling(auth.workspaceId);
-    if (!stripeCustomerId) return c.json({ error: "no subscription for this workspace" }, 409);
-    let plan = null;
-    if (stripeSubscriptionId) {
-      try {
-        const sub = await getStripeClient().subscriptions.retrieve(stripeSubscriptionId);
-        if (isPlan(sub.metadata["plan"])) plan = PLAN_INFO[sub.metadata["plan"]];
-      } catch (err) {
-        console.warn("[billing] subscription lookup failed:", err);
-      }
-    }
-    const origin = c.req.header("origin") ?? `https://${trustedHost(c)}`;
-    const session = await getStripeClient().checkout.sessions.create({
-      mode: "setup",
-      currency: "usd",
-      customer: stripeCustomerId,
-      success_url: `${origin}/?billing=done`,
-      cancel_url: `${origin}/`,
-      metadata: { workspace_id: auth.workspaceId },
-      ...plan && {
-        custom_text: {
-          submit: {
-            message: `${plan.name} plan, US$${plan.priceUsd}/month. The first month is charged as soon as this card is saved, then monthly until cancelled.`
-          }
-        }
-      }
+async function createDeviceCode(input2) {
+  const db = getSupabaseClient();
+  await db.from("device_codes").delete().lt("expires_at", (/* @__PURE__ */ new Date()).toISOString());
+  const deviceCode = randomBytes4(32).toString("hex");
+  for (let attempt = 0; attempt < 3; attempt++) {
+    const userCode = generateUserCode();
+    const { error: error2 } = await db.from("device_codes").insert({
+      device_code_hash: sha256(deviceCode),
+      user_code: userCode,
+      public_key: input2.publicKey,
+      name: input2.name,
+      platform: input2.platform,
+      requester_ip: input2.requesterIp,
+      expires_at: new Date(Date.now() + DEVICE_CODE_TTL_MS).toISOString()
     });
-    if (!session.url) return c.json({ error: "Stripe returned no checkout URL" }, 502);
-    return c.json({ url: session.url });
-  });
-  return billing;
+    if (!error2) return { deviceCode, userCode };
+    if (error2.code !== "23505") fail("createDeviceCode", error2);
+  }
+  throw new Error("createDeviceCode: could not allocate a unique user code");
 }
-
-// ../api/src/dashboard/admin-routes.ts
-import { Hono as Hono9 } from "hono";
-
-// ../api/src/dashboard/admin-middleware.ts
-function platformAdminEmails() {
-  const raw = process.env["PLATFORM_ADMIN_EMAILS"] ?? "";
-  return new Set(
-    raw.split(",").map((e) => e.trim().toLowerCase()).filter(Boolean)
-  );
+async function getDeviceCodeBySecret(deviceCode) {
+  const { data, error: error2 } = await getSupabaseClient().from("device_codes").select("*").eq("device_code_hash", sha256(deviceCode)).maybeSingle();
+  if (error2) fail("getDeviceCodeBySecret", error2);
+  return data ? toPending(data) : null;
 }
-var requirePlatformOperator = async (c, next) => {
-  const supabase = createRequestSupabaseClient(c);
-  const {
-    data: { user }
-  } = await supabase.auth.getUser();
-  if (!user?.email) return c.json({ error: "not signed in" }, 401);
-  const email = user.email.trim().toLowerCase();
-  if (!platformAdminEmails().has(email)) {
-    return c.json({ error: "platform operator access required" }, 403);
-  }
-  c.set("platformOperator", { userId: user.id, email });
-  return next();
-};
-
-// ../api/src/dashboard/admin-routes.ts
-var EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
-function createAdminRouter() {
-  const admin = new Hono9();
-  admin.use("*", requirePlatformOperator);
-  admin.get("/workspaces", async (c) => {
-    const summaries = await listWorkspaceSummaries();
-    const workspaces = await Promise.all(
-      summaries.map(async (w) => {
-        const agentModel = cachedProfileConfig(w.slug)?.agentModel;
-        const r2Bytes = await Promise.all(
-          ["chat", SCRATCH_PREFIX].map((prefix) => sumR2PrefixBytes(`${prefix}/${w.slug}/`))
-        ).then(([a, b]) => a + b).catch((err) => {
-          console.error(`[admin] R2 usage for ${w.slug}:`, err.message);
-          return null;
-        });
-        return {
-          ...w,
-          agent: agentModel ? { runner: runnerForModel(agentModel), model: agentModel } : null,
-          r2Bytes,
-          flyVolumeBytes: null
-        };
-      })
+async function getDeviceCodeByUserCode(userCode) {
+  const { data, error: error2 } = await getSupabaseClient().from("device_codes").select("*").eq("user_code", userCode).maybeSingle();
+  if (error2) fail("getDeviceCodeByUserCode", error2);
+  return data ? toPending(data) : null;
+}
+async function markPolled(id) {
+  const { error: error2 } = await getSupabaseClient().from("device_codes").update({ last_polled_at: (/* @__PURE__ */ new Date()).toISOString() }).eq("id", id);
+  if (error2) fail("markPolled", error2);
+}
+async function decideDeviceCode(id, userId, decision) {
+  const { data, error: error2 } = await getSupabaseClient().from("device_codes").update(
+    decision.approve ? { approved_by: userId, workspace_ids: decision.workspaceIds } : { denied_at: (/* @__PURE__ */ new Date()).toISOString() }
+  ).eq("id", id).is("approved_by", null).is("denied_at", null).select("id");
+  if (error2) fail("decideDeviceCode", error2);
+  return (data ?? []).length > 0;
+}
+async function redeemDeviceCode(pending2) {
+  const db = getSupabaseClient();
+  const { data: claimed, error: claimError } = await db.from("device_codes").delete().eq("id", pending2.id).select("id");
+  if (claimError) fail("redeemDeviceCode", claimError);
+  if (!claimed?.length) return null;
+  const existing = pending2.approvedBy ? await findDeviceByKey(pending2.publicKey, pending2.approvedBy) : null;
+  const { data, error: error2 } = existing ? await db.from("devices").update({ name: pending2.name, platform: pending2.platform }).eq("id", existing.id).select("*").single() : await db.from("devices").insert({
+    user_id: pending2.approvedBy,
+    name: pending2.name,
+    platform: pending2.platform,
+    public_key: pending2.publicKey
+  }).select("*").single();
+  if (error2) fail("redeemDeviceCode", error2);
+  const device = toDevice(data);
+  if (pending2.workspaceIds.length) {
+    const { error: bindError } = await db.from("device_workspaces").upsert(
+      pending2.workspaceIds.map((workspaceId) => ({
+        device_id: device.id,
+        workspace_id: workspaceId,
+        bound_by: pending2.approvedBy
+      })),
+      { onConflict: "device_id,workspace_id", ignoreDuplicates: true }
     );
-    return c.json({ workspaces });
-  });
-  admin.get("/invites", async (c) => {
-    const invites = await listSetupInvites();
-    return c.json({ invites });
-  });
-  admin.post("/setup-invites", async (c) => {
-    const body = await c.req.json().catch(() => ({}));
-    const ownerEmail = body.ownerEmail?.trim().toLowerCase();
-    if (!ownerEmail || !EMAIL_RE.test(ownerEmail)) {
-      return c.json({ error: "ownerEmail must be a valid email address" }, 400);
-    }
-    const plan = body.plan === "cloud" ? "cloud" : body.plan === "local" ? "local" : void 0;
-    if (!plan) return c.json({ error: 'plan must be "local" or "cloud"' }, 400);
-    const ownerName = body.ownerName?.trim().slice(0, 80) || null;
-    const message = body.message?.trim() || null;
-    if (message && message.length > INVITE_MESSAGE_MAX) {
-      return c.json({ error: `message must be ${INVITE_MESSAGE_MAX} characters or fewer` }, 400);
-    }
-    const operator = c.get("platformOperator");
-    const token = await issueSetupInvite({
-      email: ownerEmail,
-      ownerName,
-      plan,
-      message,
-      invitedBy: operator.userId
-    });
-    const inviteUrl = new URL(`${workspaceOrigin(c, "app")}/auth/new-workspace`);
-    inviteUrl.searchParams.set("token", token);
-    if (body.sendEmail === false) {
-      return c.json({ email: ownerEmail, inviteLink: inviteUrl.toString() }, 201);
-    }
-    try {
-      await deliverWorkspaceSetupInvite({
-        email: ownerEmail,
-        inviteLink: inviteUrl.toString(),
-        message
-      });
-    } catch (err) {
-      await deleteSetupInvite(token).catch(() => {
-      });
-      return c.json(
-        {
-          error: `the invite email failed: ${err instanceof Error ? err.message : "unknown error"}`
-        },
-        500
-      );
-    }
-    return c.json({ email: ownerEmail, inviteLink: inviteUrl.toString() }, 201);
-  });
-  admin.delete("/setup-invites/:id", async (c) => {
-    await revokeSetupInvite(c.req.param("id"));
-    return c.json({ revoked: true });
-  });
-  admin.post("/setup-invites/:id/resend", async (c) => {
-    const operator = c.get("platformOperator");
-    let token;
-    let invite;
-    try {
-      ({ token, invite } = await reissueSetupInvite(c.req.param("id")));
-    } catch (err) {
-      return c.json({ error: err instanceof Error ? err.message : "resend failed" }, 404);
-    }
-    const inviteUrl = new URL(`${workspaceOrigin(c, "app")}/auth/new-workspace`);
-    inviteUrl.searchParams.set("token", token);
-    if (c.req.query("email") === "false") {
-      return c.json({ sent: false, inviteLink: inviteUrl.toString() });
-    }
-    try {
-      await deliverWorkspaceSetupInvite({
-        email: invite.email,
-        inviteLink: inviteUrl.toString(),
-        message: invite.message
-      });
-    } catch (err) {
-      return c.json(
-        {
-          error: `the invite email failed: ${err instanceof Error ? err.message : "unknown error"}`
-        },
-        500
-      );
-    }
-    return c.json({ sent: true, inviteLink: inviteUrl.toString() });
-  });
-  return admin;
+    if (bindError) fail("redeemDeviceCode", bindError);
+  }
+  return device;
 }
-
-// ../api/src/dashboard/agent-identities.ts
-var BOT_LABEL = "Workspace Agent";
-var BOT_DM_KEY = "claude";
-
-// ../api/src/dashboard/data-api.ts
-import { existsSync as existsSync19 } from "fs";
-import sharp5 from "sharp";
-
-// ../api/src/dashboard/automations-routes.ts
-import { Hono as Hono10 } from "hono";
-var TYPES2 = ["schedule", "trigger", "mention-trigger"];
-function isType(t) {
-  return TYPES2.includes(t);
+async function getDevice(id) {
+  const { data, error: error2 } = await getSupabaseClient().from("devices").select("*").eq("id", id).maybeSingle();
+  if (error2) fail("getDevice", error2);
+  return data ? toDevice(data) : null;
 }
-function sanitize(body) {
-  const { created_by: _b, created_at: _a, ...rest } = body;
-  void _b;
-  void _a;
-  return rest;
+async function findDeviceByKey(publicKey, userId) {
+  const { data, error: error2 } = await getSupabaseClient().from("devices").select("*").eq("public_key", publicKey).eq("user_id", userId).is("revoked_at", null).order("created_at", { ascending: false }).limit(1).maybeSingle();
+  if (error2) fail("findDeviceByKey", error2);
+  return data ? toDevice(data) : null;
 }
-function statusFor(message) {
-  if (/already exists/.test(message)) return 409;
-  if (/not found/.test(message)) return 404;
-  return 400;
+async function issueAccessToken(deviceId) {
+  const token = `fsd_${randomBytes4(32).toString("hex")}`;
+  const { error: error2 } = await getSupabaseClient().from("devices").update({
+    access_token_hash: sha256(token),
+    access_token_expires_at: new Date(Date.now() + ACCESS_TOKEN_TTL_MS).toISOString(),
+    last_seen_at: (/* @__PURE__ */ new Date()).toISOString()
+  }).eq("id", deviceId);
+  if (error2) fail("issueAccessToken", error2);
+  return { token, expiresInS: ACCESS_TOKEN_TTL_MS / 1e3 };
 }
-function createAutomationWriteRouter() {
-  const app = new Hono10();
-  const manager = () => new AutomationManager();
-  app.get("/:type/:name", (c) => {
-    const item = manager().get(c.req.param("name"));
-    if (!item) return c.json({ error: "not found" }, 404);
-    return c.json(item);
-  });
-  app.post("/:type", async (c) => {
-    const type = c.req.param("type");
-    if (!isType(type)) return c.json({ error: "unknown type" }, 400);
-    const body = sanitize(await c.req.json());
-    const next = { ...body, created_at: (/* @__PURE__ */ new Date()).toISOString() };
-    try {
-      const m = manager();
-      if (type === "schedule") await m.addSchedule(next);
-      else if (type === "trigger") await m.addTrigger(next);
-      else await m.addMentionTrigger(next);
-      return c.json(next, 201);
-    } catch (e) {
-      const msg = e.message;
-      const status = statusFor(msg);
-      return c.json(status === 400 ? { errors: [msg] } : { error: msg }, status);
-    }
-  });
-  app.put("/:type/:name", async (c) => {
-    const type = c.req.param("type");
-    if (!isType(type)) return c.json({ error: "unknown type" }, 400);
-    const name = c.req.param("name");
-    const body = sanitize(await c.req.json());
-    try {
-      const m = manager();
-      const existing = m.get(name);
-      const next = {
-        ...body,
-        created_at: existing?.created_at
-      };
-      await m.update(type, name, next);
-      return c.json(next, 200);
-    } catch (e) {
-      const msg = e.message;
-      const status = statusFor(msg);
-      return c.json(status === 400 ? { errors: [msg] } : { error: msg }, status);
-    }
-  });
-  app.delete("/:type/:name", async (c) => {
-    try {
-      await manager().remove(c.req.param("name"));
-      return c.json({ ok: true }, 200);
-    } catch (e) {
-      return c.json({ error: e.message }, 404);
-    }
-  });
-  return app;
+async function deviceForAccessToken(token) {
+  if (!token.startsWith("fsd_")) return null;
+  const { data, error: error2 } = await getSupabaseClient().from("devices").select("*").eq("access_token_hash", sha256(token)).is("revoked_at", null).gt("access_token_expires_at", (/* @__PURE__ */ new Date()).toISOString()).maybeSingle();
+  if (error2) fail("deviceForAccessToken", error2);
+  return data ? toDevice(data) : null;
 }
-
-// ../api/src/dashboard/categories-routes.ts
-import { Hono as Hono11 } from "hono";
-function createCategoryWriteRouter() {
-  const app = new Hono11();
-  app.get("/", async (c) => {
-    const { data, error: error2 } = await getSupabaseClient().from("categories").select("*").eq("profile", getProfile()).order("position", { ascending: true });
-    if (error2) return c.json({ error: error2.message }, 500);
-    return c.json({ categories: data ?? [] });
-  });
-  app.post("/", async (c) => {
-    const body = await c.req.json().catch(() => ({}));
-    const name = typeof body["name"] === "string" ? body["name"].trim() : "";
-    if (!name) return c.json({ errors: ["name is required"] }, 400);
-    const supabase = getSupabaseClient();
-    const { data: last } = await supabase.from("categories").select("position").eq("profile", getProfile()).order("position", { ascending: false }).limit(1);
-    const nextPosition = (last?.[0]?.position ?? -1) + 1;
-    const { data, error: error2 } = await supabase.from("categories").insert({ name, position: nextPosition, profile: getProfile() }).select().single();
-    if (error2) return c.json({ error: error2.message }, 500);
-    return c.json(data, 201);
-  });
-  app.patch("/reorder", async (c) => {
-    const body = await c.req.json().catch(() => ({}));
-    const ids = Array.isArray(body["ids"]) ? body["ids"].filter((x) => typeof x === "string") : [];
-    if (ids.length === 0) return c.json({ errors: ["ids is required"] }, 400);
-    const supabase = getSupabaseClient();
-    const results = await Promise.all(
-      ids.map(
-        (id, position) => supabase.from("categories").update({ position, updated_at: (/* @__PURE__ */ new Date()).toISOString() }).eq("id", id).eq("profile", getProfile())
-      )
-    );
-    const failed2 = results.find((r) => r.error);
-    if (failed2?.error) return c.json({ error: failed2.error.message }, 500);
-    return c.json({ ok: true });
-  });
-  app.put("/:id", async (c) => {
-    const id = c.req.param("id");
-    const body = await c.req.json().catch(() => ({}));
-    const name = typeof body["name"] === "string" ? body["name"].trim() : "";
-    if (!name) return c.json({ errors: ["name is required"] }, 400);
-    const { data, error: error2 } = await getSupabaseClient().from("categories").update({ name, updated_at: (/* @__PURE__ */ new Date()).toISOString() }).eq("id", id).eq("profile", getProfile()).select().single();
-    if (error2) return c.json({ error: error2.message }, 404);
-    return c.json(data);
-  });
-  app.delete("/:id", async (c) => {
-    const id = c.req.param("id");
-    const supabase = getSupabaseClient();
-    const { error: unsetError } = await supabase.from("channels").update({ category_id: null, updated_at: (/* @__PURE__ */ new Date()).toISOString() }).eq("category_id", id);
-    if (unsetError) return c.json({ error: unsetError.message }, 500);
-    await refreshChannelRegistry();
-    const { error: error2 } = await supabase.from("categories").delete().eq("id", id).eq("profile", getProfile());
-    if (error2) return c.json({ error: error2.message }, 404);
-    return c.json({ ok: true });
+async function revokeDevice2(id) {
+  const { error: error2 } = await getSupabaseClient().from("devices").update({ revoked_at: (/* @__PURE__ */ new Date()).toISOString(), access_token_hash: null }).eq("id", id);
+  if (error2) fail("revokeDevice", error2);
+}
+async function createChallenge(deviceId) {
+  const db = getSupabaseClient();
+  await db.from("device_challenges").delete().lt("expires_at", (/* @__PURE__ */ new Date()).toISOString());
+  const nonce = randomBytes4(32).toString("base64url");
+  const { error: error2 } = await db.from("device_challenges").insert({
+    nonce,
+    device_id: deviceId,
+    expires_at: new Date(Date.now() + CHALLENGE_TTL_MS).toISOString()
   });
-  return app;
+  if (error2) fail("createChallenge", error2);
+  return nonce;
 }
-
-// ../api/src/dashboard/chat-routes.ts
-import { Hono as Hono12 } from "hono";
-
-// ../api/src/dashboard/fork-summary.ts
-var GROQ_API_URL3 = "https://api.groq.com/openai/v1/chat/completions";
-var SUMMARY_MODEL = "openai/gpt-oss-120b";
-var MAX_INPUT_CHARS2 = 24e3;
-var TITLE_MAX_CHARS = 80;
-var CONDENSE_SYSTEM_PROMPT = `You turn a chat conversation transcript into a new discussion topic where the work continues. Output EXACTLY two parts separated by one blank line: the first line is a concise topic title (max ${TITLE_MAX_CHARS} characters, no quotes, no Markdown), then a handoff summary of the conversation so far.
-
-Rules:
-- Keep the conversation's own language. If it is Traditional Chinese (Taiwan), stay in Traditional Chinese with Taiwan wording and keep technical terms in English.
-- The summary opens a new thread where the work picks up: state the goal, what has been done or decided so far, and what remains open or should happen next.
-- Weight the END of the transcript more heavily: later messages reflect the current state. If an earlier plan or decision was later changed, superseded, or abandoned, summarize it in one clause at most and lead with what it became. Never present a discarded early approach with the same weight as the latest one.
-- Summarize the WORK, not the run mechanics: ignore status noise such as stopped/cancelled/terminated-run markers (e.g. "\u23F9 Stopped by user."), error or retry notices, and progress placeholders. A run being cut short is never part of the topic \u2014 capture the progress that was made instead.
-- Preserve essential code identifiers, file names, and URLs, but do not reproduce whole code blocks \u2014 describe what they do in one sentence instead.
-- No preamble like "Summary:" \u2014 start directly with the title line.`;
-var FOCUS_TITLE_SYSTEM_PROMPT = `You name a new discussion topic after one chat message that someone is branching off into a focused side-discussion.
-
-Output ONE line only: the title. Nothing else \u2014 no summary, no explanation, no blank line.
-
-Shape:
-- A short noun phrase naming the subject, like a filed ticket's title. Max ${TITLE_MAX_CHARS} characters, and shorter is better.
-- Not a sentence copied from the message, not a quote, not Markdown. No bold, no backticks, no quotes, no trailing punctuation.
-
-Content:
-- Keep the message's own language. If it is Traditional Chinese (Taiwan), stay in Traditional Chinese with Taiwan wording and keep technical terms in English.
-- Name the topic after the FINAL message in the input. Any earlier message is only context for what that message replies to, never the subject of the title.
-- Name that message's central point. A message that diagnoses something is named after the finding, even when its last paragraph proposes a next step \u2014 do not title it after the proposed action.
-- Never reframe it into a different question, never assert a conclusion the message does not reach, and never turn an open investigation into a settled recommendation or a list of steps.
-
-Example \u2014 a message that works out why an admin could not sign in, and closes by suggesting turning email confirmation off:
-admin \u5E33\u865F\u88AB email \u9A57\u8B49\u4FE1\u5361\u4F4F`;
-function clampTitle(title) {
-  return title.length > TITLE_MAX_CHARS ? `${title.slice(0, TITLE_MAX_CHARS - 1)}\u2026` : title;
+async function consumeChallenge(deviceId, nonce) {
+  const { data, error: error2 } = await getSupabaseClient().from("device_challenges").delete().eq("nonce", nonce).eq("device_id", deviceId).gt("expires_at", (/* @__PURE__ */ new Date()).toISOString()).select("nonce");
+  if (error2) fail("consumeChallenge", error2);
+  return (data ?? []).length > 0;
 }
-function deriveTitle(body) {
-  const line = body.split("\n").find((l) => l.trim().length > 0)?.trim() ?? "Forked message";
-  return clampTitle(line);
+async function listAdminWorkspaces(userId) {
+  const { data, error: error2 } = await getSupabaseClient().from("memberships").select("workspace_id, workspaces!inner(slug)").eq("user_id", userId).eq("role", "admin").eq("status", "active");
+  if (error2) fail("listAdminWorkspaces", error2);
+  return (data ?? []).map((r) => ({ id: r.workspace_id, slug: r.workspaces.slug })).sort((a, b) => a.slug.localeCompare(b.slug));
 }
-function cleanTitleLine(raw) {
-  const line = raw.split("\n").find((l) => l.trim().length > 0)?.trim() ?? "";
-  return clampTitle(
-    line.replace(/^#{1,6}\s*/, "").replace(/^[*_`"'\u201c\u2018\u300c\u300e]+|[*_`"'\u201d\u2019\u300d\u300f]+$/g, "").trim()
-  );
+async function listDeviceWorkspaces(device) {
+  const { data, error: error2 } = await getSupabaseClient().from("device_workspaces").select("workspace_id").eq("device_id", device.id);
+  if (error2) fail("listDeviceWorkspaces", error2);
+  const bound = new Set((data ?? []).map((r) => r.workspace_id));
+  return (await listAdminWorkspaces(device.userId)).filter((w) => bound.has(w.id));
 }
-function fallbackTopic(body) {
-  return { title: deriveTitle(body), body };
+async function bindDeviceWorkspace(deviceId, workspaceId, boundBy) {
+  const { error: error2 } = await getSupabaseClient().from("device_workspaces").upsert(
+    { device_id: deviceId, workspace_id: workspaceId, bound_by: boundBy },
+    { onConflict: "device_id,workspace_id", ignoreDuplicates: true }
+  );
+  if (error2) fail("bindDeviceWorkspace", error2);
 }
-function parseTopic(raw, original) {
-  const text = raw.trim();
-  const breakAt = text.indexOf("\n");
-  if (breakAt === -1) return { title: deriveTitle(text), body: text };
-  const title = text.slice(0, breakAt).trim();
-  const body = text.slice(breakAt + 1).trim();
-  if (!title || !body) return fallbackTopic(original);
-  return {
-    title: clampTitle(title),
-    body
-  };
+async function listWorkspaceDevices(workspaceId) {
+  const { data, error: error2 } = await getSupabaseClient().from("device_workspaces").select("devices!inner(*)").eq("workspace_id", workspaceId).is("devices.revoked_at", null);
+  if (error2) fail("listWorkspaceDevices", error2);
+  return (data ?? []).map((r) => toDevice(r.devices)).sort((a, b) => b.createdAt.localeCompare(a.createdAt));
 }
-async function buildForkTopic(transcript, fallbackText, mode = "condense") {
-  const input2 = transcript.length > MAX_INPUT_CHARS2 ? transcript.slice(-MAX_INPUT_CHARS2) : transcript;
-  const fallback = fallbackText ?? transcript;
-  const focus = mode === "focus";
-  const apiKey = process.env["GROQ_API_KEY"];
-  if (!apiKey) return fallbackTopic(fallback);
-  try {
-    const res = await fetch(GROQ_API_URL3, {
-      method: "POST",
-      headers: { "content-type": "application/json", authorization: `Bearer ${apiKey}` },
-      body: JSON.stringify({
-        model: SUMMARY_MODEL,
-        temperature: 0.2,
-        // A title has to sort the message's central claim from the next-step
-        // paragraph it often ends with; 'low' reliably grabs the latter.
-        reasoning_effort: focus ? "medium" : "low",
-        // A title is one short line, but focus mode reasons before answering
-        // and the budget covers reasoning tokens too — too small a cap here
-        // truncates the title mid-word rather than failing.
-        max_tokens: focus ? 512 : 1024,
-        messages: [
-          {
-            role: "system",
-            content: focus ? FOCUS_TITLE_SYSTEM_PROMPT : CONDENSE_SYSTEM_PROMPT
-          },
-          { role: "user", content: input2 }
-        ]
-      })
-    });
-    if (!res.ok) throw new Error(`Groq request failed (${res.status})`);
-    const data = await res.json();
-    const raw = data.choices?.[0]?.message?.content?.trim();
-    if (!raw) throw new Error("Groq returned an empty summary");
-    if (focus) return { title: cleanTitleLine(raw) || deriveTitle(fallback), body: fallback };
-    return parseTopic(raw, fallback);
-  } catch (err) {
-    console.error("Fork summary failed, using original text:", err);
-    return fallbackTopic(fallback);
+var STALE_HOST_MS = 14 * 24 * 60 * 6e4;
+var isStale = (lastSeenAt) => !!lastSeenAt && Date.now() - Date.parse(lastSeenAt) > STALE_HOST_MS;
+async function listWorkspaceHosts(workspaceIds, exceptPublicKey) {
+  const hosts2 = /* @__PURE__ */ new Map();
+  if (!workspaceIds.length) return hosts2;
+  const { data, error: error2 } = await getSupabaseClient().from("device_workspaces").select("workspace_id, devices!inner(name, public_key, revoked_at, last_seen_at)").in("workspace_id", workspaceIds).is("devices.revoked_at", null);
+  if (error2) fail("listWorkspaceHosts", error2);
+  for (const r of data ?? []) {
+    if (r.devices.public_key !== exceptPublicKey && !isStale(r.devices.last_seen_at)) {
+      hosts2.set(r.workspace_id, r.devices.name);
+    }
   }
+  return hosts2;
 }
-
-// ../api/src/dashboard/slack-format.ts
-import { nameToEmoji } from "gemoji";
-var SLACK_EMOJI_ALIASES = {
-  double_vertical_bar: "\u23F8\uFE0F"
-};
-function emojifyShortcode(code) {
-  const name = code.slice(1, -1);
-  return nameToEmoji[name] ?? SLACK_EMOJI_ALIASES[name] ?? code;
-}
-function resolveSlackTokens(text) {
-  return text.replace(/<@([A-Z0-9]+)(?:\|[^>]*)?>/g, (_m, id) => `@${getLocalCache().displayNameFor(id)}`).replace(/<#([A-Z0-9]+)\|([^>]+)>/g, (_m, _id, name) => `#${name}`).replace(/<#([A-Z0-9]+)>/g, (_m, id) => `#${getLocalCache().lookupChannelById(id)?.name ?? id}`).replace(/<!channel>/g, "@channel").replace(/<!here>/g, "@here").replace(/<!everyone>/g, "@everyone").replace(/<!subteam\^[A-Z0-9]+\|@?([^>]+)>/g, "@$1").replace(/<mailto:([^|>]+)\|([^>]+)>/g, (_m, addr, label2) => `[${label2}](mailto:${addr})`).replace(/<(https?:\/\/[^|>]+)\|([^>]+)>/g, (_m, url, label2) => `[${label2}](${url})`).replace(/:[a-z0-9_+-]+:/gi, emojifyShortcode);
+async function releaseStaleHosts(workspaceIds, exceptPublicKey) {
+  if (!workspaceIds.length) return;
+  const db = getSupabaseClient();
+  const { data, error: error2 } = await db.from("device_workspaces").select("device_id, workspace_id, devices!inner(public_key, last_seen_at)").in("workspace_id", workspaceIds);
+  if (error2) fail("releaseStaleHosts", error2);
+  for (const r of data ?? []) {
+    if (r.devices.public_key === exceptPublicKey || !isStale(r.devices.last_seen_at)) continue;
+    const { error: delError } = await db.from("device_workspaces").delete().eq("device_id", r.device_id).eq("workspace_id", r.workspace_id);
+    if (delError) fail("releaseStaleHosts", delError);
+  }
 }
-function slackMrkdwnToMarkdown(text) {
-  return resolveSlackTokens(text).replace(/(?<![\w*])\*(?!\*)(\S(?:[^*\n]*?\S)?)\*(?!\*)(?![\w*])/g, "**$1**").replace(/(?<![\w~])~(?!~)(\S(?:[^~\n]*?\S)?)~(?!~)(?![\w~])/g, "~~$1~~").replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&amp;/g, "&");
+async function userEmail(userId) {
+  const { data, error: error2 } = await getSupabaseClient().auth.admin.getUserById(userId);
+  if (error2) return null;
+  return data.user?.email ?? null;
 }
 
-// ../api/src/dashboard/thread-relevance.ts
-async function relevantThreadsPage(supabase, handle, channelIds, opts) {
-  const escaped = handle.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-  const { data, error: error2 } = await supabase.rpc("relevant_threads", {
-    handle,
-    mention_pattern: `@${escaped}\\M`,
-    channel_ids: channelIds,
-    before: opts.before ?? null,
-    page_limit: opts.limit
-  });
-  if (error2) throw new Error(`relevant_threads: ${error2.message}`);
-  return data ?? [];
-}
+// ../api/src/dashboard/agent-bridge-data.ts
+import { randomBytes as randomBytes5, randomUUID as randomUUID2, verify as verifyRaw } from "crypto";
+import { WebSocket, WebSocketServer } from "ws";
 
-// ../api/src/dashboard/thread-translate.ts
-import { createHash as createHash7 } from "crypto";
+// ../api/src/dashboard/host-identity.ts
+import { createPrivateKey as createPrivateKey2, createPublicKey as createPublicKey3, generateKeyPairSync as generateKeyPairSync2 } from "crypto";
+import { existsSync as existsSync17, mkdirSync as mkdirSync9, readFileSync as readFileSync16, writeFileSync as writeFileSync9 } from "fs";
+import { dirname as dirname5, join as join17 } from "path";
+function hostPrivateKeyPath() {
+  return process.env["FLYSPACE_HOST_KEY_PATH"] || join17(paths.BASE_CONFIG_DIR, "host.key");
+}
+function loadHostPrivateKey(path = hostPrivateKeyPath()) {
+  if (!existsSync17(path)) {
+    throw new Error(
+      `No Host identity at ${path}. Run \`pnpm run generate-host-key\` on this machine, then set FLYSPACE_HOST_PUBLIC_KEY on the Data process to the printed public key.`
+    );
+  }
+  return createPrivateKey2(readFileSync16(path, "utf8"));
+}
 
-// ../api/src/store/thread-translation-store.ts
-async function getThreadTranslations(lang, keys) {
-  const found = /* @__PURE__ */ new Map();
-  if (keys.length === 0) return found;
-  const clauses = keys.map((k) => `and(reply_id.eq.${k.replyId},body_hash.eq.${k.bodyHash})`).join(",");
-  const { data, error: error2 } = await getSupabaseClient().from("thread_reply_translations").select("reply_id, body, passthrough").eq("lang", lang).or(clauses);
-  if (error2) throw new Error(`getThreadTranslations(${lang}): ${error2.message}`);
-  for (const row of data ?? []) {
-    const replyId = row["reply_id"];
-    found.set(replyId, {
-      replyId,
-      body: row["body"],
-      passthrough: row["passthrough"]
-    });
-  }
-  return found;
+// ../core/src/bridge-protocol.ts
+var HOST_SOCKET_PATH = "/internal/host-socket";
+var DEFAULT_DATA_API_PORT = 4757;
+var CALL_TIMEOUT_MS = 15e3;
+var HEARTBEAT_INTERVAL_MS = 15e3;
+var HEARTBEAT_TIMEOUT_MS = HEARTBEAT_INTERVAL_MS * 2.5;
+var LOCAL_RELAY_PATH = "/internal/agent-call";
+var RELAYED_METHODS = [
+  "onChatMessage",
+  "isAgentThinking",
+  "getAgentActivities",
+  "cancelAgentRun",
+  "regenerateAgentRun",
+  "listAgentRuns"
+];
+function encodeWireMessage(msg) {
+  return JSON.stringify(msg);
 }
-async function putThreadTranslations(lang, rows) {
-  if (rows.length === 0) return;
-  const { error: error2 } = await getSupabaseClient().from("thread_reply_translations").upsert(
-    rows.map((r) => ({
-      reply_id: r.replyId,
-      lang,
-      body_hash: r.bodyHash,
-      body: r.body,
-      passthrough: r.passthrough
-    })),
-    { onConflict: "reply_id,lang,body_hash" }
-  );
-  if (error2) throw new Error(`putThreadTranslations(${lang}): ${error2.message}`);
+function parseWireMessage(raw) {
+  try {
+    return JSON.parse(String(raw));
+  } catch {
+    return null;
+  }
 }
 
-// ../api/src/dashboard/thread-translate.ts
-var GROQ_API_URL4 = "https://api.groq.com/openai/v1/chat/completions";
-var TRANSLATION_MODEL2 = "openai/gpt-oss-120b";
-var RECIPE_VERSION3 = 1;
-var BATCH_CHAR_BUDGET = 16e3;
-var CONTEXT_MESSAGES = 4;
-var MAX_MESSAGE_CHARS = 12e3;
-var MAX_OUTPUT_TOKENS2 = 32768;
-var BY_CODE2 = new Map(TRANSLATION_LANGUAGES.map((l) => [l.code, l]));
-function isTranslatableLanguage2(lang) {
-  return BY_CODE2.has(lang);
+// ../api/src/dashboard/agent-bridge-data.ts
+var hosts = /* @__PURE__ */ new Map();
+var hostStatusListeners = /* @__PURE__ */ new Set();
+function notifyHostStatus() {
+  const online = hosts.size > 0;
+  for (const l of hostStatusListeners) l(online);
 }
-function translationHash2(author, body) {
-  return createHash7("sha256").update(`${RECIPE_VERSION3}
-${author}
-${body}`).digest("hex");
+function removeHost(ws) {
+  if (hosts.delete(ws)) notifyHostStatus();
+}
+function disconnectHostDevice(deviceId) {
+  for (const [ws, scope] of hosts) {
+    if (scope.deviceId !== deviceId) continue;
+    console.log(`[host-socket] closing connection for revoked device ${deviceId}`);
+    removeHost(ws);
+    ws.close(1008, "device revoked");
+  }
+}
+var LAST_SEEN_RESOLUTION_MS = 60 * 6e4;
+var lastCallError = /* @__PURE__ */ new Map();
+function getHostCallError(method, profile = getProfile()) {
+  return lastCallError.get(`${profile}:${method}`) ?? null;
 }
-function systemPrompt2(languageName2) {
-  return `You translate messages from a group chat into ${languageName2}. You are a translator, not an editor, a summarizer, or a participant.
 
-You receive a JSON object with two keys:
-- "context": earlier messages, for reference only. NEVER translate these and never mention them in your output.
-- "translate": the messages to translate, each with an "n" and a "body".
+// ../api/src/dashboard/unique-channel-name.ts
+function uniqueChannelName(raw, taken) {
+  const base = raw.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "project";
+  let name = base;
+  for (let i = 2; taken.has(name); i += 1) name = `${base}-${i}`;
+  taken.add(name);
+  return name;
+}
 
-Reply with ONLY a JSON object of this exact shape, one entry per message in "translate", in the same order:
-{"messages":[{"n":1,"body":"...","already_target":false}]}
+// ../api/src/dashboard/workspace-greeting.ts
+var GROQ_API_URL3 = "https://api.groq.com/openai/v1/chat/completions";
+var GREETING_MODEL = "openai/gpt-oss-20b";
+var TIMEOUT_MS = 6e3;
+var MAX_LISTED_CHANNELS = 8;
+var GUIDES = [
+  "Welcome to Flyspace",
+  "Working with the agent",
+  "Channels and folders",
+  "Docs",
+  "Sharing docs",
+  "Inviting your team",
+  "Automations"
+];
+var SYSTEM_PROMPT = `You write the first message a new Flyspace workspace owner sees, posted in their #general channel. Flyspace is a team chat where an AI agent works inside every channel.
 
-Rules:
-- "already_target" is true when the message is ALREADY written in ${languageName2}. In that case copy "body" through byte for byte, changing nothing at all. A message whose prose is in another language is NOT already_target just because it contains English technical terms, code, or product names.
-- Translate meaning, not words. These are people talking, not prose to be polished. Keep the speaker's register: a terse message stays terse, a casual one stays casual, a rude one stays rude. Do not make anyone sound more formal, more complete, or more articulate than they wrote.
-- A short reply ("\u597D\u554A", "same", "nope") is translated as the natural equivalent in ${languageName2}, using the context to see what it is answering. Never expand it into a full sentence the speaker did not write.
-- Keep the Markdown exactly as it is: same heading levels, list nesting, table shape, link and image syntax, blockquotes, and order. Do not add, merge, split, or reorder anything.
-- Do NOT translate: text inside fenced or inline code blocks, URLs, file paths, command names, or @mentions and /skill tokens. Leave them byte-for-byte identical.
-- Keep established technical terms in English where a fluent speaker of ${languageName2} would keep them in English rather than reaching for a translated coinage.
-- Use the punctuation conventions of ${languageName2}, including full-width punctuation for Chinese and Japanese. Use ordinary ASCII hyphens, never typographic or non-breaking hyphen variants.
-- Never add commentary, notes about your choices, apologies, or an explanation of anything you could not translate.`;
-}
-function normalizeHyphens2(text) {
-  return text.replace(/‐|‑/g, "-");
-}
-function clip(body) {
-  return body.length > MAX_MESSAGE_CHARS ? body.slice(0, MAX_MESSAGE_CHARS) : body;
+- Plain Markdown, 60 to 110 words, in English. No headings, no emoji, no em or en dashes, no sign-off.
+- Greet the owner by name and name the workspace.
+- Say that #general is public: everyone invited to the workspace can see it.
+- If project channels are listed, mention them as #name and say each one is linked to that project folder. Never invent a channel.
+- Mention the trial or the missing Host only if the facts say so.
+- If guides are listed, say they are in the Docs pane of #general and suggest starting with the first one.
+- Use only the facts given. Do not add buttons or a list of next steps: those are appended for you.`;
+function greetingButtons(input2) {
+  const buttons = [];
+  if (!input2.hostConnected) buttons.push("Connect a machine");
+  if (input2.channels[0]) buttons.push(`Summarise #${input2.channels[0]} for me`);
+  if (input2.hostConnected) buttons.push("Give me a quick tour of the guides");
+  if (input2.memberCount <= 1) buttons.push("Invite my team");
+  buttons.push("Set up a daily digest");
+  return buttons.slice(0, 3).map((b) => b.replace(/[|\]]/g, ""));
 }
-function batchMessages(messages) {
-  const batches = [];
-  let current = [];
-  let size = 0;
-  for (const m of messages) {
-    const len = Math.min(m.body.length, MAX_MESSAGE_CHARS);
-    if (current.length > 0 && size + len > BATCH_CHAR_BUDGET) {
-      batches.push(current);
-      current = [];
-      size = 0;
-    }
-    current.push(m);
-    size += len;
-  }
-  if (current.length > 0) batches.push(current);
-  return batches;
+function fallbackGreeting(input2) {
+  const channels = input2.channels.slice(0, MAX_LISTED_CHANNELS).map((c) => `#${c}`);
+  return [
+    `Welcome to ${input2.workspaceName}, ${input2.ownerName}.`,
+    "This is #general. It is public, so everyone you invite to the workspace can see it.",
+    channels.length ? `Your project channels are ready: ${channels.join(", ")}. Each one is linked to its project folder, so the agent there works on the real files.` : "",
+    input2.hostConnected ? "A few short guides are waiting in the Docs pane of #general. Start with Welcome to Flyspace." : "",
+    "Mention the agent in any channel to get started."
+  ].filter(Boolean).join("\n\n");
 }
-async function translateBatch(batch, context, lang) {
-  const language = BY_CODE2.get(lang);
-  if (!language) throw new Error(`unsupported translation language: ${lang}`);
-  const apiKey = process.env["GROQ_API_KEY"];
-  if (!apiKey) throw new Error("GROQ_API_KEY is not configured");
-  const payload = {
-    context: context.map((m) => ({ author: m.author, body: clip(m.body) })),
-    translate: batch.map((m, i) => ({ n: i + 1, author: m.author, body: clip(m.body) }))
-  };
-  const res = await fetch(GROQ_API_URL4, {
+async function groqGreeting(input2, apiKey) {
+  const facts = [
+    `Owner: ${input2.ownerName}`,
+    `Workspace: ${input2.workspaceName}`,
+    `Plan: ${input2.trialing ? "14-day free trial, just started" : "not on a trial"}`,
+    `Host: ${input2.hostConnected ? "a machine is connected, agents can run" : "no machine connected yet, agents cannot run until one is"}`,
+    `Project channels: ${input2.channels.slice(0, MAX_LISTED_CHANNELS).join(", ") || "(none yet)"}`,
+    `Members: ${input2.memberCount}`,
+    `Guides in #general: ${input2.hostConnected ? GUIDES.join(", ") : "(none, no machine connected)"}`
+  ].join("\n");
+  const res = await fetch(GROQ_API_URL3, {
     method: "POST",
+    signal: AbortSignal.timeout(TIMEOUT_MS),
     headers: { "content-type": "application/json", authorization: `Bearer ${apiKey}` },
     body: JSON.stringify({
-      model: TRANSLATION_MODEL2,
-      temperature: 0,
-      max_tokens: MAX_OUTPUT_TOKENS2,
-      response_format: { type: "json_object" },
+      model: GREETING_MODEL,
+      temperature: 0.6,
+      // Reasoning model: the cap covers reasoning tokens too, so keep it roomy.
+      reasoning_effort: "low",
+      max_tokens: 900,
       messages: [
-        { role: "system", content: systemPrompt2(language.name) },
-        { role: "user", content: JSON.stringify(payload) }
+        { role: "system", content: SYSTEM_PROMPT },
+        { role: "user", content: facts }
       ]
     })
   });
-  if (!res.ok) throw new Error(`translation model returned ${res.status}`);
+  if (!res.ok) throw new Error(`Groq request failed (${res.status})`);
   const data = await res.json();
-  const choice = data.choices?.[0];
-  if (choice?.finish_reason === "length") {
-    throw new Error("the translation ran past the model output limit");
-  }
-  const raw = choice?.message?.content?.trim() ?? "";
-  if (!raw) throw new Error("the model returned an empty translation");
-  let parsed;
-  try {
-    parsed = JSON.parse(raw);
-  } catch {
-    throw new Error("the model returned unparseable JSON");
-  }
-  const byNumber = /* @__PURE__ */ new Map();
-  for (const entry of parsed.messages ?? []) {
-    if (typeof entry?.n === "number") byNumber.set(entry.n, entry);
+  const text = data.choices?.[0]?.message?.content?.replace(/\[BUTTONS:[^\]]*\]/g, "").replace(/\s*[–—]\s*/g, ", ").trim();
+  return text || null;
+}
+async function buildGreeting(input2) {
+  let text = null;
+  const apiKey = process.env["GROQ_API_KEY"];
+  if (apiKey) {
+    try {
+      text = await groqGreeting(input2, apiKey);
+    } catch (err) {
+      console.error("Workspace greeting failed, using the fixed template:", err);
+    }
   }
-  return batch.map((m, i) => {
-    const entry = byNumber.get(i + 1);
-    const body = typeof entry?.body === "string" ? entry.body.trim() : "";
-    if (!body) return { id: m.id, body: m.body, passthrough: true };
-    return {
-      id: m.id,
-      body: normalizeHyphens2(body),
-      passthrough: entry?.already_target === true
-    };
-  });
-}
-var inFlight4 = /* @__PURE__ */ new Map();
-async function translateThread(threadId, lang, messages) {
-  if (!BY_CODE2.has(lang)) throw new Error(`unsupported translation language: ${lang}`);
-  if (messages.length === 0) return [];
-  const shape = createHash7("sha256").update(messages.map((m) => translationHash2(m.author, m.body)).join("\n")).digest("hex");
-  const key = `${threadId}:${lang}:${shape}`;
-  const running = inFlight4.get(key);
-  if (running) return running;
-  const job = (async () => {
-    const hashes = messages.map((m) => ({
-      replyId: m.id,
-      bodyHash: translationHash2(m.author, m.body)
-    }));
-    const cached = await getThreadTranslations(lang, hashes);
-    const missing = messages.filter((m) => !cached.has(m.id));
-    const fresh = /* @__PURE__ */ new Map();
-    if (missing.length > 0) {
-      const index = new Map(messages.map((m, i) => [m.id, i]));
-      const batches = batchMessages(missing);
-      const results = await Promise.all(
-        batches.map((batch) => {
-          const first = index.get(batch[0].id) ?? 0;
-          const context = messages.slice(Math.max(0, first - CONTEXT_MESSAGES), first);
-          return translateBatch(batch, context, lang);
-        })
-      );
-      for (const row of results.flat()) fresh.set(row.id, row);
-      const hashById = new Map(hashes.map((h) => [h.replyId, h.bodyHash]));
-      await putThreadTranslations(
-        lang,
-        [...fresh.values()].map((r) => ({
-          replyId: r.id,
-          bodyHash: hashById.get(r.id),
-          body: r.body,
-          passthrough: r.passthrough
-        }))
-      );
-    }
-    return messages.map((m) => {
-      const hit = cached.get(m.id);
-      if (hit) return { id: m.id, body: hit.body, passthrough: hit.passthrough };
-      return fresh.get(m.id) ?? { id: m.id, body: m.body, passthrough: true };
-    });
-  })().finally(() => inFlight4.delete(key));
-  inFlight4.set(key, job);
-  return job;
+  return `${text ?? fallbackGreeting(input2)}
+
+[BUTTONS: ${greetingButtons(input2).join(" | ")}]`;
 }
 
-// ../api/src/dashboard/chat-routes.ts
-function isNonEmptyString(v) {
-  return typeof v === "string" && v.trim().length > 0;
+// ../api/src/dashboard/onboarding-routes.ts
+var MAX_FOLDERS = 20;
+var CHANNEL_NAME_RE = /^[a-z0-9][a-z0-9-]*$/;
+function isWorkspaceOwner(ctx) {
+  return ctx?.role === "admin" && !ctx.isSupport;
 }
-function sanitizeModel(v) {
-  if (typeof v !== "string") return null;
-  const model = v.trim().toLowerCase();
-  return isAllowedModel(model) ? model : null;
+async function isHostOwner(ctx) {
+  if (ctx.role !== "admin") return false;
+  if (ctx.isSupport) return true;
+  return (await listWorkspaceDevices(ctx.workspaceId)).some((d) => d.userId === ctx.userId);
 }
-async function threadModel(threadId) {
-  const { data } = await getSupabaseClient().from("thread_replies").select("model").eq("thread_id", threadId).not("model", "is", null).order("created_at", { ascending: false }).limit(1).maybeSingle();
-  return sanitizeModel(data?.model);
+function hostUnavailable(c, agent, method) {
+  return c.json({ error: "host offline", reason: agent.getHostCallFailure?.(method) ?? "offline" }, 503);
 }
-function requestedModel(c, model) {
-  return c.get("auth")?.role === "admin" ? sanitizeModel(model) : null;
+function createOnboardingRouter(agent) {
+  const app = new Hono7();
+  app.get("/scan", async (c) => {
+    const ctx = await resolveAuthContext(c);
+    if (ctx?.role !== "admin") return c.json({ error: "admin access required" }, 403);
+    const scan = await agent.scanOnboarding?.(getProfile());
+    if (!scan) return hostUnavailable(c, agent, "scanOnboarding");
+    return c.json(scan);
+  });
+  app.post("/channels", async (c) => {
+    const ctx = await resolveAuthContext(c);
+    if (ctx?.role !== "admin") return c.json({ error: "admin access required" }, 403);
+    const body = await c.req.json().catch(() => ({}));
+    const runner = body["agent"];
+    const folders = Array.isArray(body["folders"]) ? body["folders"].filter((f) => typeof f === "string" && f.length > 0) : [];
+    if (folders.length > MAX_FOLDERS) return c.json({ error: `at most ${MAX_FOLDERS} folders` }, 400);
+    const scan = await agent.scanOnboarding?.();
+    if (!scan) return hostUnavailable(c, agent, "scanOnboarding");
+    const offered = new Map(scan.projects.map((p) => [p.path, p]));
+    const unknown = folders.find((f) => !offered.has(f));
+    if (unknown) return c.json({ error: "folder was not offered by the scan" }, 400);
+    const taken = new Set(getProfileChannelRegistry().map((ch) => ch.name));
+    taken.add("general");
+    const items = [{ name: "general" }];
+    for (const path of folders) items.push({ name: uniqueChannelName(offered.get(path).name, taken), path });
+    const linked = await agent.linkProjectFolders?.(getProfile(), items);
+    if (!linked) return hostUnavailable(c, agent, "linkProjectFolders");
+    if (runner === "claude" || runner === "codex") {
+      await agent.saveLocalDashboardSettings?.({ providers: [{ runner }] });
+    }
+    const created = [];
+    for (const l of linked) {
+      created.push(
+        l.name === "general" ? await ensureGeneralChannel() : await createChannel({ name: l.name, cwd: l.cwd })
+      );
+    }
+    await markWorkspaceProjectsSetup(ctx.workspaceId);
+    return c.json({ channels: created.map((ch) => ({ id: ch.id, name: ch.name })) }, 201);
+  });
+  app.post("/link-folder", async (c) => {
+    const ctx = await resolveAuthContext(c);
+    if (!isWorkspaceOwner(ctx)) return c.json({ error: "workspace owner access required" }, 403);
+    const body = await c.req.json().catch(() => ({}));
+    const path = typeof body["path"] === "string" ? body["path"].trim() : "";
+    const name = typeof body["name"] === "string" ? body["name"].trim() : "";
+    if (!path || !CHANNEL_NAME_RE.test(name)) return c.json({ error: "path and a valid name are required" }, 400);
+    if (getProfileChannelRegistry().some((ch) => ch.name === name)) {
+      return c.json({ error: `#${name} already exists` }, 409);
+    }
+    if (body["manual"] === true) {
+      const devices = await listWorkspaceDevices(ctx.workspaceId);
+      if (!devices.some((d) => d.userId === ctx.userId)) {
+        return c.json({ error: "a path can only be typed on your own machine" }, 403);
+      }
+    } else {
+      const scan = await agent.scanOnboarding?.(getProfile());
+      if (!scan) return hostUnavailable(c, agent, "scanOnboarding");
+      if (!scan.projects.some((p) => p.path === path)) {
+        return c.json({ error: "folder was not offered by the scan" }, 400);
+      }
+    }
+    const linked = await agent.linkProjectFolders?.(getProfile(), [{ name, path }]);
+    if (!linked) {
+      const hostError = getHostCallError("linkProjectFolders");
+      if (hostError) return c.json({ error: hostError }, 409);
+      return hostUnavailable(c, agent, "linkProjectFolders");
+    }
+    return c.json({ cwd: linked[0].cwd });
+  });
+  app.post("/reset", async (c) => {
+    const ctx = await resolveAuthContext(c);
+    if (ctx?.role !== "admin") return c.json({ error: "admin access required" }, 403);
+    const { error: error2 } = await getSupabaseClient().from("threads").delete().eq("client_key", ctx.workspaceId);
+    if (error2) return c.json({ error: error2.message }, 500);
+    await resetWorkspaceOnboarding(ctx.workspaceId);
+    return c.json({ ok: true });
+  });
+  app.get("/greeting", async (c) => {
+    const ctx = await resolveAuthContext(c);
+    if (ctx?.role !== "admin") return c.json({ pending: false });
+    const greetedAt = await getWorkspaceGreetedAt(ctx.workspaceId);
+    const pending2 = !!ctx.projectsSetupAt && !greetedAt;
+    if (!pending2) return c.json({ pending: pending2, channelId: null, threadId: null });
+    const general = await ensureGeneralChannel();
+    const threadId = await ensureGreetingThread(ctx.workspaceId, general.id, ctx.name?.trim() || ctx.handle);
+    return c.json({ pending: pending2, channelId: general.id, threadId });
+  });
+  app.post("/greeting", async (c) => {
+    const ctx = await resolveAuthContext(c);
+    if (ctx?.role !== "admin") return c.json({ error: "admin access required" }, 403);
+    const supabase = getSupabaseClient();
+    const general = await ensureGeneralChannel();
+    const ownerName = ctx.name?.trim() || ctx.handle;
+    const threadId = await ensureGreetingThread(ctx.workspaceId, general.id, ownerName);
+    if (!threadId) return c.json({ error: "could not create the welcome thread" }, 500);
+    const done = { channelId: general.id, threadId };
+    const replied = await supabase.from("thread_replies").select("id").eq("thread_id", threadId).limit(1).maybeSingle();
+    if (replied.data) return c.json(done);
+    if (await getWorkspaceGreetedAt(ctx.workspaceId))
+      return c.json({ error: "already greeted" }, 409);
+    const [branding, billing, members] = await Promise.all([
+      getWorkspaceBranding(getProfile()).catch(() => null),
+      getWorkspaceBilling(ctx.workspaceId).catch(() => null),
+      listMemberships(ctx.workspaceId).catch(() => [])
+    ]);
+    const body = await buildGreeting({
+      ownerName,
+      workspaceName: branding?.displayName || getProfile(),
+      trialing: billing?.planStatus === "trialing",
+      hostConnected: !!ctx.agentConnectedAt,
+      channels: getProfileChannelRegistry().filter((ch) => !ch.isDefault && !ch.dmKey && !ch.agentName && !ch.archivedAt).map((ch) => ch.name),
+      memberCount: members.filter((m) => !m.isSupport).length
+    });
+    const again = await supabase.from("thread_replies").select("id").eq("thread_id", threadId).limit(1).maybeSingle();
+    if (again.data) return c.json(done);
+    const reply = await supabase.from("thread_replies").insert({ thread_id: threadId, author: AGENT_AUTHOR, body });
+    if (reply.error) return c.json({ error: reply.error.message }, 500);
+    await markWorkspaceGreeted(ctx.workspaceId);
+    return c.json(done, 201);
+  });
+  return app;
 }
-function sanitizeEffort(v) {
-  if (typeof v !== "string") return null;
-  const effort = v.trim().toLowerCase();
-  return isEffort(effort) ? effort : null;
+async function ensureGreetingThread(workspaceId, channelId, ownerName) {
+  const supabase = getSupabaseClient();
+  const existing = () => supabase.from("threads").select("id").eq("client_key", workspaceId).maybeSingle();
+  const found = await existing();
+  if (found.data) return found.data.id;
+  const { data, error: error2 } = await supabase.from("threads").insert({
+    channel_id: channelId,
+    title: `Welcome to your Flyspace, ${ownerName}!`,
+    author: AGENT_AUTHOR,
+    client_key: workspaceId
+  }).select("id").single();
+  if (data) return data.id;
+  return error2?.code === "23505" ? (await existing()).data?.id ?? null : null;
 }
-function requestedEffort(c, effort) {
-  return c.get("auth")?.role === "admin" ? sanitizeEffort(effort) : null;
+
+// ../api/src/dashboard/auth-routes.ts
+function createAuthRouter() {
+  const auth = new Hono8();
+  const emailedLink = (deliver) => async (c) => {
+    const body = await c.req.json().catch(() => ({}));
+    const email = body.email?.trim().toLowerCase();
+    if (!email) return c.json({ error: "email is required" }, 400);
+    if (!isDevHost(c) && !await verifyTurnstileToken(body.captchaToken)) {
+      return c.json({ error: "captcha check failed \u2014 please retry" }, 400);
+    }
+    const workspace = await getWorkspaceBySlug(getProfile());
+    if (!workspace) return c.json({ error: "unknown workspace" }, 404);
+    const membership = await getMembershipByEmail(workspace.id, email);
+    if (!membership) {
+      return c.json({ error: "no access \u2014 ask an admin to invite you" }, 403);
+    }
+    try {
+      await deliver(email, callbackUrl(c));
+    } catch (err) {
+      return c.json({ error: err instanceof Error ? err.message : "could not send" }, 500);
+    }
+    return c.json({ sent: true });
+  };
+  auth.post("/login", emailedLink(deliverSignInLink));
+  auth.post("/forgot-password", emailedLink(deliverPasswordResetLink));
+  auth.get("/session", async (c) => {
+    const ctx = await resolveAuthContext(c, { fresh: c.req.query("fresh") === "1" });
+    if (!ctx) return c.json({ error: "not signed in" }, 401);
+    return c.json({
+      email: ctx.email,
+      handle: ctx.handle,
+      role: ctx.role,
+      name: ctx.name,
+      avatarUrl: ctx.isSupport ? SUPPORT_AVATAR_URL : ctx.avatarKey ? await signAvatarUrl(ctx.avatarKey) : null,
+      onboarded: ctx.onboarded,
+      passwordSet: ctx.passwordSet,
+      agentConnectedAt: ctx.agentConnectedAt,
+      plan: ctx.plan ?? null,
+      onboarding: { pending: onboardingPending(ctx) },
+      owner: isWorkspaceOwner(ctx),
+      // Only the Host's owner can run `flyspace upgrade` on it, so other
+      // admins never see the upgrade banner. Support staff can tell them to.
+      hostOwner: await isHostOwner(ctx)
+    });
+  });
+  auth.patch("/handle", async (c) => {
+    const ctx = await resolveAuthContext(c);
+    if (!ctx) return c.json({ error: "not signed in" }, 401);
+    if (ctx.onboarded) return c.json({ error: "handle can no longer be changed" }, 403);
+    const body = await c.req.json().catch(() => ({}));
+    const handle = body.handle?.trim().replace(/^@/, "").toLowerCase() ?? "";
+    if (!HANDLE_PATTERN.test(handle)) {
+      return c.json(
+        { error: "handle must be 1-32 characters: a-z, 0-9, _ or -, starting with a letter or digit" },
+        400
+      );
+    }
+    try {
+      await setMembershipHandle(ctx.workspaceId, ctx.userId, handle);
+    } catch (err) {
+      if (err instanceof HandleTakenError) return c.json({ error: err.message }, 409);
+      throw err;
+    }
+    return c.json({ handle });
+  });
+  auth.post("/logout", async (c) => {
+    const supabase = createRequestSupabaseClient(c);
+    await supabase.auth.signOut();
+    return c.json({ ok: true });
+  });
+  return auth;
 }
-function effortFromRow(v) {
-  return typeof v === "string" && isEffort(v) ? v : void 0;
+
+// ../api/src/dashboard/auth-middleware.ts
+var requireWorkspaceMembership = async (c, next) => {
+  const ctx = await resolveAuthContext(c);
+  if (!ctx) return c.json({ error: "not signed in" }, 401);
+  c.set("auth", ctx);
+  return next();
+};
+
+// ../api/src/dashboard/billing-routes.ts
+import { Hono as Hono9 } from "hono";
+function isPlan(value) {
+  return value === "local" || value === "cloud";
 }
-var BOARD_STATUSES = [
-  "backlog",
-  "todo",
-  "in_progress",
-  "in_review",
-  "done",
-  "cancelled"
-];
-var NO_STATUS_COLUMN = "none";
-function boardColumnParam(status) {
-  if (status === NO_STATUS_COLUMN) return NO_STATUS_COLUMN;
-  return BOARD_STATUSES.includes(status) ? status : null;
-}
-var THREAD_CHUNK_SIZE = 25;
-var THREADS_PAGE_SIZE = 30;
-var THREADS_PAGE_SIZE_MAX = 100;
-var REPLIES_PAGE_SIZE = 50;
-var REPLIES_PAGE_SIZE_MAX = 200;
-var TRANSLATABLE_REPLIES_MAX = 400;
-var BOARD_PAGE_SIZE = 50;
-var BOARD_PAGE_SIZE_MAX = 100;
-function ownChannelIds(c) {
-  const viewer = c.get("auth");
-  return new Set(
-    getProfileChannelRegistry().filter((ch) => canSeeChannel(ch, viewer)).flatMap((ch) => ch.externalChannelId ? [ch.id, ch.externalChannelId] : [ch.id])
-  );
-}
-async function globalChannelMeta(c) {
-  const viewer = c.get("auth");
-  const map = /* @__PURE__ */ new Map();
-  const channels = getChannelRegistry();
-  let workspaceIdBySlug = /* @__PURE__ */ new Map();
-  let roleByWorkspaceId = /* @__PURE__ */ new Map();
-  if (viewer?.email && channels.length > 0) {
-    const [workspaces, memberships] = await Promise.all([
-      listWorkspaces(),
-      listMembershipsByEmail(viewer.email)
-    ]);
-    workspaceIdBySlug = new Map(workspaces.map((w) => [w.slug, w.id]));
-    roleByWorkspaceId = new Map(memberships.map((m) => [m.workspaceId, m.role]));
-  }
-  for (const ch of channels) {
-    const workspaceId = workspaceIdBySlug.get(ch.profile);
-    const role = workspaceId ? roleByWorkspaceId.get(workspaceId) : void 0;
-    if (!canSeeChannel(ch, { email: viewer?.email, role })) continue;
-    const meta = { workspace: ch.profile, channelName: ch.name, agentName: ch.agentName };
-    map.set(ch.id, meta);
-    if (ch.externalChannelId) map.set(ch.externalChannelId, meta);
+var LOCK_EXEMPT = [/\/billing(\/|$)/, /\/profiles?$/, /\/push\//];
+async function requireActivePlan(c, next) {
+  if (c.req.method === "OPTIONS") return next();
+  if (LOCK_EXEMPT.some((re) => re.test(c.req.path))) return next();
+  const auth = c.get("auth");
+  if (!auth) return next();
+  if (isLockedPlan(await getWorkspacePlanStatus(auth.workspaceId))) {
+    return c.json({ error: "trial ended: add a card to reactivate this workspace", code: "plan_locked" }, 402);
   }
-  return map;
-}
-async function threadIsKnown(threadId, c) {
-  const { data } = await getSupabaseClient().from("threads").select("channel_id").eq("id", threadId).single();
-  const channelId = data?.channel_id;
-  return !!channelId && (await globalChannelMeta(c)).has(channelId);
-}
-function chunk(items, size) {
-  const out = [];
-  for (let i = 0; i < items.length; i += size) out.push(items.slice(i, i + size));
-  return out;
+  return next();
 }
-async function withPreviews(supabase, threads) {
-  const chunkResults = await Promise.all(
-    chunk(
-      threads.map((t) => t.id),
-      THREAD_CHUNK_SIZE
-    ).map(
-      (ids) => supabase.from("thread_replies").select("thread_id, body, author, external_user_id").in("thread_id", ids).is("archived_at", null).order("created_at", { ascending: true })
-    )
-  );
-  const previewByThread = /* @__PURE__ */ new Map();
-  for (const { data } of chunkResults) {
-    for (const r of data ?? []) {
-      const entry = previewByThread.get(r.thread_id);
-      if (entry) {
-        entry.count += 1;
-        entry.lastAuthor = r.author;
-        entry.participants.delete(r.author);
-        entry.participants.set(r.author, r.external_user_id ?? null);
-      } else
-        previewByThread.set(r.thread_id, {
-          count: 1,
-          firstBody: r.body,
-          lastAuthor: r.author,
-          participants: /* @__PURE__ */ new Map()
-        });
+function createBillingRouter() {
+  const billing = new Hono9();
+  billing.get("/", async (c) => {
+    const auth = c.get("auth");
+    const { planStatus, stripeSubscriptionId } = await getWorkspaceBilling(auth.workspaceId);
+    let trialEnd = null;
+    let plan = null;
+    if (stripeSubscriptionId) {
+      try {
+        const sub = await getStripeClient().subscriptions.retrieve(stripeSubscriptionId);
+        if (planStatus === "trialing" && sub.trial_end) {
+          trialEnd = new Date(sub.trial_end * 1e3).toISOString();
+        }
+        if (isPlan(sub.metadata["plan"])) plan = PLAN_INFO[sub.metadata["plan"]];
+      } catch (err) {
+        console.warn("[billing] subscription lookup failed:", err);
+      }
     }
-  }
-  return threads.map((t) => {
-    const entry = previewByThread.get(t.id);
-    return {
-      ...t,
-      reply_count: Math.max(0, (entry?.count ?? 0) - 1),
-      preview: entry?.firstBody ? slackMrkdwnToMarkdown(entry.firstBody) : null,
-      // Who spoke last, counting only replies AFTER the opening message —
-      // the reader's own handle here means there is nothing new for them to
-      // read, on this browser or any other (see web/src/lib/thread-unread).
-      last_reply_author: entry && entry.count > 1 ? entry.lastAuthor : null,
-      // Everyone who replied, most recent first, for the row's avatar stack.
-      participants: [...entry?.participants ?? []].reverse().map(([author, external_user_id]) => ({ author, external_user_id }))
-    };
+    return c.json({ planStatus, trialEnd, plan, locked: isLockedPlan(planStatus) });
   });
-}
-async function labelThread(channelId, body, scope) {
-  const channel = getProfileChannelRegistry().find(
-    (ch) => ch.id === channelId || ch.externalChannelId === channelId
-  );
-  if (!channel) return null;
-  const supabase = getSupabaseClient();
-  const { data: recent } = await supabase.from("threads").select("auto_title, title").eq("channel_id", channelId).order("created_at", { ascending: false }).limit(50);
-  const existingCategories = extractCategories(
-    (recent ?? []).flatMap((t) => [
-      t.auto_title,
-      t.title
-    ])
-  );
-  return buildAutoTitle({
-    channelName: channel.name,
-    channelPrompt: channel.prompt,
-    workspacePrompt: loadWorkspacePrompt().prompt,
-    titlePrompt: (await loadWorkspaceBranding()).autoTitlePrompt,
-    existingCategories,
-    body,
-    scope
+  billing.post("/checkout", async (c) => {
+    const auth = c.get("auth");
+    if (auth.role !== "admin") return c.json({ error: "admin access required" }, 403);
+    const { stripeCustomerId, stripeSubscriptionId } = await getWorkspaceBilling(auth.workspaceId);
+    if (!stripeCustomerId) return c.json({ error: "no subscription for this workspace" }, 409);
+    let plan = null;
+    if (stripeSubscriptionId) {
+      try {
+        const sub = await getStripeClient().subscriptions.retrieve(stripeSubscriptionId);
+        if (isPlan(sub.metadata["plan"])) plan = PLAN_INFO[sub.metadata["plan"]];
+      } catch (err) {
+        console.warn("[billing] subscription lookup failed:", err);
+      }
+    }
+    const origin = c.req.header("origin") ?? `https://${trustedHost(c)}`;
+    const session = await getStripeClient().checkout.sessions.create({
+      mode: "setup",
+      currency: "usd",
+      customer: stripeCustomerId,
+      success_url: `${origin}/?billing=done`,
+      cancel_url: `${origin}/`,
+      metadata: { workspace_id: auth.workspaceId },
+      ...plan && {
+        custom_text: {
+          submit: {
+            message: `${plan.name} plan, US$${plan.priceUsd}/month. The first month is charged as soon as this card is saved, then monthly until cancelled.`
+          }
+        }
+      }
+    });
+    if (!session.url) return c.json({ error: "Stripe returned no checkout URL" }, 502);
+    return c.json({ url: session.url });
   });
+  return billing;
 }
-async function generateAutoTitle(threadId, channelId, body) {
-  if ((await loadWorkspaceBranding()).autoTitleEnabled === false) return;
-  const autoTitle = await labelThread(channelId, body);
-  if (!autoTitle) return;
-  const supabase = getSupabaseClient();
-  await supabase.from("threads").update({ auto_title: autoTitle }).eq("id", threadId).is("title", null);
+
+// ../api/src/dashboard/admin-routes.ts
+import { Hono as Hono10 } from "hono";
+
+// ../api/src/dashboard/admin-middleware.ts
+function platformAdminEmails() {
+  const raw = process.env["PLATFORM_ADMIN_EMAILS"] ?? "";
+  return new Set(
+    raw.split(",").map((e) => e.trim().toLowerCase()).filter(Boolean)
+  );
 }
-function createChatRouter(agent = {}) {
-  const app = new Hono12();
+var requirePlatformOperator = async (c, next) => {
+  const supabase = createRequestSupabaseClient(c);
   const {
-    onChatMessage: onMessage,
-    isAgentThinking,
-    getAgentActivities,
-    cancelAgentRun,
-    regenerateAgentRun,
-    listAgentRuns
-  } = agent;
-  app.post(
-    "/threads/:id/agent-cancel",
-    async (c) => c.json({ cancelled: await cancelAgentRun?.(c.req.param("id")) ?? false })
-  );
-  app.post(
-    "/threads/:id/agent-regenerate",
-    async (c) => c.json({ started: await regenerateAgentRun?.(c.req.param("id")) ?? false })
-  );
-  app.get(
-    "/threads/:id/agent-status",
-    async (c) => c.json({
-      thinking: await isAgentThinking?.(c.req.param("id")) ?? false,
-      activities: await getAgentActivities?.(c.req.param("id")) ?? []
-    })
-  );
-  app.get("/agent-runs", async (c) => c.json({ threadIds: await listAgentRuns?.() ?? [] }));
-  app.get("/channels/:channelId/threads", async (c) => {
-    const channelId = c.req.param("channelId");
-    if (!ownChannelIds(c).has(channelId)) return c.json({ error: "unknown channel" }, 404);
-    const requestedLimit = Number(c.req.query("limit"));
-    const limit = Number.isFinite(requestedLimit) && requestedLimit > 0 ? Math.min(requestedLimit, THREADS_PAGE_SIZE_MAX) : THREADS_PAGE_SIZE;
-    const before = c.req.query("before");
-    const sortColumn = c.req.query("sort") === "activity" ? "updated_at" : "created_at";
-    const statusParam = c.req.query("status");
-    const statusFilter = statusParam ? [
-      ...new Set(
-        statusParam.split(",").map(boardColumnParam).filter((s) => s !== null)
-      )
-    ] : [];
-    const supabase = getSupabaseClient();
-    let query = supabase.from("threads").select("*").eq("channel_id", channelId).is("archived_at", null).order(sortColumn, { ascending: false }).limit(limit);
-    if (before) query = query.lt(sortColumn, before);
-    if (statusFilter.length) {
-      const withoutNone = statusFilter.filter((s) => s !== NO_STATUS_COLUMN);
-      const includeNone = statusFilter.includes(NO_STATUS_COLUMN);
-      if (includeNone && withoutNone.length) {
-        query = query.or(`board_status.in.(${withoutNone.join(",")}),board_status.is.null`);
-      } else if (includeNone) {
-        query = query.is("board_status", null);
-      } else {
-        query = query.in("board_status", withoutNone);
-      }
-    }
-    const { data: threads, error: error2 } = await query;
-    if (error2) return c.json({ error: error2.message }, 500);
-    if (!threads || threads.length === 0) return c.json({ threads: [], nextCursor: null });
-    const withPreview = await withPreviews(supabase, threads);
-    const nextCursor = threads.length === limit ? threads[threads.length - 1][sortColumn] : null;
-    return c.json({ threads: withPreview, nextCursor });
-  });
-  app.get("/channels/:channelId/board/:status", async (c) => {
-    const channelId = c.req.param("channelId");
-    if (!ownChannelIds(c).has(channelId)) return c.json({ error: "unknown channel" }, 404);
-    const column = boardColumnParam(c.req.param("status"));
-    if (!column) {
-      return c.json(
-        { error: `status must be one of: ${[...BOARD_STATUSES, NO_STATUS_COLUMN].join(", ")}` },
-        400
-      );
-    }
-    const requestedLimit = Number(c.req.query("limit"));
-    const limit = Number.isFinite(requestedLimit) && requestedLimit > 0 ? Math.min(requestedLimit, BOARD_PAGE_SIZE_MAX) : BOARD_PAGE_SIZE;
-    const before = c.req.query("before");
-    const supabase = getSupabaseClient();
-    let query = supabase.from("threads").select("*").eq("channel_id", channelId);
-    query = column === NO_STATUS_COLUMN ? query.is("board_status", null) : query.eq("board_status", column);
-    query = query.is("archived_at", null).order("updated_at", { ascending: false }).limit(limit);
-    if (before) query = query.lt("updated_at", before);
-    const { data: threads, error: error2 } = await query;
-    if (error2) return c.json({ error: error2.message }, 500);
-    if (!threads || threads.length === 0) return c.json({ threads: [], nextCursor: null });
-    const withPreview = await withPreviews(supabase, threads);
-    const nextCursor = threads.length === limit ? threads[threads.length - 1].updated_at : null;
-    return c.json({ threads: withPreview, nextCursor });
-  });
-  app.get("/board/:status", async (c) => {
-    const column = boardColumnParam(c.req.param("status"));
-    if (!column) {
-      return c.json(
-        { error: `status must be one of: ${[...BOARD_STATUSES, NO_STATUS_COLUMN].join(", ")}` },
-        400
-      );
-    }
-    const requestedLimit = Number(c.req.query("limit"));
-    const limit = Number.isFinite(requestedLimit) && requestedLimit > 0 ? Math.min(requestedLimit, BOARD_PAGE_SIZE_MAX) : BOARD_PAGE_SIZE;
-    const before = c.req.query("before");
-    const meta = c.req.query("scope") === "all" ? await globalChannelMeta(c) : null;
-    const supabase = getSupabaseClient();
-    let query = supabase.from("threads").select("*").in("channel_id", meta ? [...meta.keys()] : [...ownChannelIds(c)]);
-    query = column === NO_STATUS_COLUMN ? query.is("board_status", null) : query.eq("board_status", column);
-    query = query.is("archived_at", null).order("updated_at", { ascending: false }).limit(limit);
-    if (before) query = query.lt("updated_at", before);
-    const { data: threads, error: error2 } = await query;
-    if (error2) return c.json({ error: error2.message }, 500);
-    if (!threads || threads.length === 0) return c.json({ threads: [], nextCursor: null });
-    const withPreview = await withPreviews(supabase, threads);
-    const labelled = meta ? withPreview.map((t) => {
-      const channelMeta = meta.get(t.channel_id ?? "");
-      return {
-        ...t,
-        workspace: channelMeta?.workspace ?? null,
-        channel_name: channelMeta?.channelName ?? null,
-        agent_name: channelMeta?.agentName ?? null
-      };
-    }) : withPreview;
-    const nextCursor = threads.length === limit ? threads[threads.length - 1].updated_at : null;
-    return c.json({ threads: labelled, nextCursor });
-  });
-  app.get("/threads", async (c) => {
-    const requestedLimit = Number(c.req.query("limit"));
-    const limit = Number.isFinite(requestedLimit) && requestedLimit > 0 ? Math.min(requestedLimit, THREADS_PAGE_SIZE_MAX) : THREADS_PAGE_SIZE;
-    const before = c.req.query("before");
-    const meta = c.req.query("scope") === "all" ? await globalChannelMeta(c) : null;
-    const relevantTo = c.req.query("relevantTo");
-    const supabase = getSupabaseClient();
-    const channelIds = meta ? [...meta.keys()] : [...ownChannelIds(c)];
-    let threads;
-    if (isNonEmptyString(relevantTo)) {
-      try {
-        threads = await relevantThreadsPage(supabase, relevantTo, channelIds, { before, limit });
-      } catch (err) {
-        return c.json({ error: err instanceof Error ? err.message : String(err) }, 500);
-      }
-    } else {
-      let query = supabase.from("threads").select("*").in("channel_id", channelIds).is("archived_at", null).order("updated_at", { ascending: false }).limit(limit);
-      if (before) query = query.lt("updated_at", before);
-      const { data, error: error2 } = await query;
-      if (error2) return c.json({ error: error2.message }, 500);
-      threads = data;
-    }
-    if (!threads || threads.length === 0) return c.json({ threads: [], nextCursor: null });
-    const threadIds = threads.map((t) => t.id);
-    const chunkResults = await Promise.all(
-      chunk(threadIds, THREAD_CHUNK_SIZE).map(
-        (ids) => supabase.from("thread_replies").select("*").in("thread_id", ids).is("archived_at", null).order("created_at", { ascending: true })
-      )
+    data: { user }
+  } = await supabase.auth.getUser();
+  if (!user?.email) return c.json({ error: "not signed in" }, 401);
+  const email = user.email.trim().toLowerCase();
+  if (!platformAdminEmails().has(email)) {
+    return c.json({ error: "platform operator access required" }, 403);
+  }
+  c.set("platformOperator", { userId: user.id, email });
+  return next();
+};
+
+// ../api/src/dashboard/admin-routes.ts
+var EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+function createAdminRouter() {
+  const admin = new Hono10();
+  admin.use("*", requirePlatformOperator);
+  admin.get("/workspaces", async (c) => {
+    const summaries = await listWorkspaceSummaries();
+    const workspaces = await Promise.all(
+      summaries.map(async (w) => {
+        const agentModel = cachedProfileConfig(w.slug)?.agentModel;
+        const r2Bytes = await Promise.all(
+          ["chat", SCRATCH_PREFIX].map((prefix) => sumR2PrefixBytes(`${prefix}/${w.slug}/`))
+        ).then(([a, b]) => a + b).catch((err) => {
+          console.error(`[admin] R2 usage for ${w.slug}:`, err.message);
+          return null;
+        });
+        return {
+          ...w,
+          agent: agentModel ? { runner: runnerForModel(agentModel), model: agentModel } : null,
+          r2Bytes,
+          flyVolumeBytes: null
+        };
+      })
     );
-    const repliesByThread = /* @__PURE__ */ new Map();
-    for (const { data } of chunkResults) {
-      for (const r of data ?? []) {
-        const arr = repliesByThread.get(r.thread_id);
-        if (arr) arr.push(r);
-        else repliesByThread.set(r.thread_id, [r]);
-      }
-    }
-    const withReplies = threads.map((t) => {
-      const channelMeta = meta?.get(t.channel_id);
-      return {
-        ...t,
-        ...meta ? {
-          workspace: channelMeta?.workspace ?? null,
-          channel_name: channelMeta?.channelName ?? null,
-          agent_name: channelMeta?.agentName ?? null
-        } : {},
-        replies: (repliesByThread.get(t.id) ?? []).map((r) => ({
-          ...r,
-          body: slackMrkdwnToMarkdown(r.body)
-        }))
-      };
-    });
-    const nextCursor = threads.length === limit ? threads[threads.length - 1].updated_at : null;
-    return c.json({ threads: withReplies, nextCursor });
+    return c.json({ workspaces });
   });
-  app.get("/threads/archived", async (c) => {
-    if (c.get("auth")?.role !== "admin") {
-      return c.json({ error: "only an admin can view archived topics" }, 403);
-    }
-    const requestedLimit = Number(c.req.query("limit"));
-    const limit = Number.isFinite(requestedLimit) && requestedLimit > 0 ? Math.min(requestedLimit, THREADS_PAGE_SIZE_MAX) : THREADS_PAGE_SIZE;
-    const before = c.req.query("before");
-    const supabase = getSupabaseClient();
-    let query = supabase.from("threads").select("*").in("channel_id", [...ownChannelIds(c)]).not("archived_at", "is", null).order("archived_at", { ascending: false }).limit(limit);
-    if (before) query = query.lt("archived_at", before);
-    const { data: threads, error: error2 } = await query;
-    if (error2) return c.json({ error: error2.message }, 500);
-    if (!threads || threads.length === 0) return c.json({ threads: [], nextCursor: null });
-    const withPreview = await withPreviews(supabase, threads);
-    const nextCursor = threads.length === limit ? threads[threads.length - 1].archived_at : null;
-    return c.json({ threads: withPreview, nextCursor });
+  admin.get("/invites", async (c) => {
+    const invites = await listSetupInvites();
+    return c.json({ invites });
   });
-  app.get("/threads/:id", async (c) => {
-    const id = c.req.param("id");
-    const requestedLimit = Number(c.req.query("limit"));
-    const limit = Number.isFinite(requestedLimit) && requestedLimit > 0 ? Math.min(requestedLimit, REPLIES_PAGE_SIZE_MAX) : REPLIES_PAGE_SIZE;
-    const before = c.req.query("before");
-    let repliesQuery = getSupabaseClient().from("thread_replies").select("*, reactions:reply_reactions(emoji, author)").eq("thread_id", id).is("archived_at", null).order("created_at", { ascending: false }).limit(limit);
-    if (before) repliesQuery = repliesQuery.lt("created_at", before);
-    const [thread, replies, opening] = await Promise.all([
-      getSupabaseClient().from("threads").select("*").eq("id", id).single(),
-      repliesQuery,
-      // The opening message, fetched separately because the replies page
-      // above is newest-first: on a long thread the opener isn't in it. It
-      // is what the header falls back to on a thread with no title of its
-      // own (see threadCrumbLabel) — a title is never written on the
-      // thread's behalf, so an untitled row must still be able to show and
-      // rename a topic.
-      getSupabaseClient().from("thread_replies").select("body").eq("thread_id", id).is("archived_at", null).order("created_at", { ascending: true }).limit(1)
-    ]);
-    if (thread.error) return c.json({ error: thread.error.message }, 404);
-    if (replies.error) return c.json({ error: replies.error.message }, 500);
-    const channelId = thread.data?.channel_id;
-    const meta = await globalChannelMeta(c);
-    const channelMeta = channelId ? meta.get(channelId) : void 0;
-    if (!channelId || !channelMeta) {
-      return c.json({ error: "not found" }, 404);
+  admin.post("/setup-invites", async (c) => {
+    const body = await c.req.json().catch(() => ({}));
+    const ownerEmail = body.ownerEmail?.trim().toLowerCase();
+    if (!ownerEmail || !EMAIL_RE.test(ownerEmail)) {
+      return c.json({ error: "ownerEmail must be a valid email address" }, 400);
     }
-    const page2 = replies.data ?? [];
-    const nextCursor = page2.length === limit ? page2[page2.length - 1].created_at : null;
-    const formattedReplies = page2.reverse().map((r) => ({
-      ...r,
-      body: slackMrkdwnToMarkdown(r.body)
-    }));
-    const openingBody = (opening.data ?? [])[0]?.body;
-    return c.json({
-      ...thread.data,
-      // Always stamped (not just on `?scope=all` feeds, see the `/threads`
-      // route above) — the reply pane can be opened directly by id (global
-      // board, permalink) without the active workspace's channel map ever
-      // having loaded this thread's channel, so the header needs its own
-      // workspace/channel label rather than depending on that cache.
-      workspace: channelMeta.workspace,
-      channel_name: channelMeta.channelName,
-      agent_name: channelMeta.agentName,
-      preview: openingBody ? slackMrkdwnToMarkdown(openingBody) : null,
-      replies: formattedReplies,
-      nextCursor
+    const plan = body.plan === "cloud" ? "cloud" : body.plan === "local" ? "local" : void 0;
+    if (!plan) return c.json({ error: 'plan must be "local" or "cloud"' }, 400);
+    const ownerName = body.ownerName?.trim().slice(0, 80) || null;
+    const message = body.message?.trim() || null;
+    if (message && message.length > INVITE_MESSAGE_MAX) {
+      return c.json({ error: `message must be ${INVITE_MESSAGE_MAX} characters or fewer` }, 400);
+    }
+    const operator = c.get("platformOperator");
+    const token = await issueSetupInvite({
+      email: ownerEmail,
+      ownerName,
+      plan,
+      message,
+      invitedBy: operator.userId
     });
-  });
-  app.post("/threads/:id/translation/:lang", async (c) => {
-    const id = c.req.param("id");
-    const lang = canonicalLanguage(c.req.param("lang"));
-    if (!isTranslatableLanguage2(lang)) return c.json({ error: "unsupported language" }, 400);
-    const [thread, replies] = await Promise.all([
-      getSupabaseClient().from("threads").select("channel_id").eq("id", id).single(),
-      getSupabaseClient().from("thread_replies").select("id, author, body").eq("thread_id", id).is("archived_at", null).order("created_at", { ascending: true }).limit(TRANSLATABLE_REPLIES_MAX)
-    ]);
-    if (thread.error) return c.json({ error: "not found" }, 404);
-    if (replies.error) return c.json({ error: replies.error.message }, 500);
-    const channelId = thread.data?.channel_id;
-    if (!channelId || !(await globalChannelMeta(c)).has(channelId)) {
-      return c.json({ error: "not found" }, 404);
+    const inviteUrl = new URL(`${workspaceOrigin(c, "app")}/auth/new-workspace`);
+    inviteUrl.searchParams.set("token", token);
+    if (body.sendEmail === false) {
+      return c.json({ email: ownerEmail, inviteLink: inviteUrl.toString() }, 201);
     }
-    const messages = (replies.data ?? []).map(
-      (r) => ({ id: r.id, author: r.author, body: slackMrkdwnToMarkdown(r.body) })
-    );
     try {
-      return c.json({ lang, messages: await translateThread(id, lang, messages) });
+      await deliverWorkspaceSetupInvite({
+        email: ownerEmail,
+        inviteLink: inviteUrl.toString(),
+        message
+      });
     } catch (err) {
-      const message = err instanceof Error ? err.message : "translation failed";
-      console.error(`Thread translation failed (${id} \u2192 ${lang}):`, err);
-      return c.json({ error: message }, 502);
+      await deleteSetupInvite(token).catch(() => {
+      });
+      return c.json(
+        {
+          error: `the invite email failed: ${err instanceof Error ? err.message : "unknown error"}`
+        },
+        500
+      );
     }
+    return c.json({ email: ownerEmail, inviteLink: inviteUrl.toString() }, 201);
   });
-  app.patch("/threads/:id/board-status", async (c) => {
-    const id = c.req.param("id");
-    const input2 = await c.req.json().catch(() => null);
-    const value = input2?.board_status ?? null;
-    if (value !== null && !BOARD_STATUSES.includes(value)) {
+  admin.delete("/setup-invites/:id", async (c) => {
+    await revokeSetupInvite(c.req.param("id"));
+    return c.json({ revoked: true });
+  });
+  admin.post("/setup-invites/:id/resend", async (c) => {
+    const operator = c.get("platformOperator");
+    let token;
+    let invite;
+    try {
+      ({ token, invite } = await reissueSetupInvite(c.req.param("id")));
+    } catch (err) {
+      return c.json({ error: err instanceof Error ? err.message : "resend failed" }, 404);
+    }
+    const inviteUrl = new URL(`${workspaceOrigin(c, "app")}/auth/new-workspace`);
+    inviteUrl.searchParams.set("token", token);
+    if (c.req.query("email") === "false") {
+      return c.json({ sent: false, inviteLink: inviteUrl.toString() });
+    }
+    try {
+      await deliverWorkspaceSetupInvite({
+        email: invite.email,
+        inviteLink: inviteUrl.toString(),
+        message: invite.message
+      });
+    } catch (err) {
       return c.json(
-        { error: `board_status must be null or one of: ${BOARD_STATUSES.join(", ")}` },
-        400
+        {
+          error: `the invite email failed: ${err instanceof Error ? err.message : "unknown error"}`
+        },
+        500
       );
     }
-    if (!await threadIsKnown(id, c)) return c.json({ error: "not found" }, 404);
-    const { data: thread, error: error2 } = await getSupabaseClient().from("threads").update({ board_status: value }).eq("id", id).select().single();
-    if (error2) return c.json({ error: error2.message }, 500);
-    return c.json(thread);
+    return c.json({ sent: true, inviteLink: inviteUrl.toString() });
   });
-  app.patch("/threads/:id", async (c) => {
-    const id = c.req.param("id");
-    const input2 = await c.req.json().catch(() => null);
-    const raw = input2?.title;
-    if (raw !== null && !isNonEmptyString(raw)) {
-      return c.json({ errors: ["title must be a non-empty string, or null to clear it"] }, 400);
+  return admin;
+}
+
+// ../api/src/dashboard/agent-identities.ts
+var BOT_LABEL = "Workspace Agent";
+var BOT_DM_KEY = "claude";
+
+// ../api/src/dashboard/data-api.ts
+import { existsSync as existsSync19 } from "fs";
+import sharp5 from "sharp";
+
+// ../api/src/dashboard/automations-routes.ts
+import { Hono as Hono11 } from "hono";
+var TYPES2 = ["schedule", "trigger", "mention-trigger"];
+function isType(t) {
+  return TYPES2.includes(t);
+}
+function sanitize(body) {
+  const { created_by: _b, created_at: _a, ...rest } = body;
+  void _b;
+  void _a;
+  return rest;
+}
+function statusFor(message) {
+  if (/already exists/.test(message)) return 409;
+  if (/not found/.test(message)) return 404;
+  return 400;
+}
+function createAutomationWriteRouter() {
+  const app = new Hono11();
+  const manager = () => new AutomationManager();
+  app.get("/:type/:name", (c) => {
+    const item = manager().get(c.req.param("name"));
+    if (!item) return c.json({ error: "not found" }, 404);
+    return c.json(item);
+  });
+  app.post("/:type", async (c) => {
+    const type = c.req.param("type");
+    if (!isType(type)) return c.json({ error: "unknown type" }, 400);
+    const body = sanitize(await c.req.json());
+    const next = { ...body, created_at: (/* @__PURE__ */ new Date()).toISOString() };
+    try {
+      const m = manager();
+      if (type === "schedule") await m.addSchedule(next);
+      else if (type === "trigger") await m.addTrigger(next);
+      else await m.addMentionTrigger(next);
+      return c.json(next, 201);
+    } catch (e) {
+      const msg = e.message;
+      const status = statusFor(msg);
+      return c.json(status === 400 ? { errors: [msg] } : { error: msg }, status);
     }
-    const title = raw === null ? null : raw.trim();
-    if (!await threadIsKnown(id, c)) return c.json({ error: "not found" }, 404);
-    const { data: thread, error: error2 } = await getSupabaseClient().from("threads").update({ title }).eq("id", id).select().single();
-    if (error2) return c.json({ error: error2.message }, 500);
-    return c.json(thread);
   });
-  app.post("/threads/:id/suggest-title", async (c) => {
-    const id = c.req.param("id");
-    if (!await threadIsKnown(id, c)) return c.json({ error: "not found" }, 404);
-    const { data: thread } = await getSupabaseClient().from("threads").select("channel_id").eq("id", id).single();
-    if (!thread) return c.json({ error: "not found" }, 404);
-    const { data: rows, error: error2 } = await getSupabaseClient().from("thread_replies").select("author, body").eq("thread_id", id).is("archived_at", null).order("created_at", { ascending: true });
-    if (error2) return c.json({ error: error2.message }, 500);
-    const transcript = (rows ?? []).map((r) => `${r.author}: ${slackMrkdwnToMarkdown(r.body)}`).join("\n\n");
-    const title = await labelThread(thread.channel_id, transcript, "thread");
-    if (!title) return c.json({ error: "could not generate a topic" }, 502);
-    return c.json({ title });
+  app.put("/:type/:name", async (c) => {
+    const type = c.req.param("type");
+    if (!isType(type)) return c.json({ error: "unknown type" }, 400);
+    const name = c.req.param("name");
+    const body = sanitize(await c.req.json());
+    try {
+      const m = manager();
+      const existing = m.get(name);
+      const next = {
+        ...body,
+        created_at: existing?.created_at
+      };
+      await m.update(type, name, next);
+      return c.json(next, 200);
+    } catch (e) {
+      const msg = e.message;
+      const status = statusFor(msg);
+      return c.json(status === 400 ? { errors: [msg] } : { error: msg }, status);
+    }
   });
-  app.patch("/replies/:replyId", async (c) => {
-    const replyId = c.req.param("replyId");
-    const input2 = await c.req.json().catch(() => null);
-    const author = input2?.author;
-    const body = input2?.body;
-    if (!isNonEmptyString(author) || !isNonEmptyString(body)) {
-      return c.json({ errors: ["author and body are required"] }, 400);
+  app.delete("/:type/:name", async (c) => {
+    try {
+      await manager().remove(c.req.param("name"));
+      return c.json({ ok: true }, 200);
+    } catch (e) {
+      return c.json({ error: e.message }, 404);
     }
+  });
+  return app;
+}
+
+// ../api/src/dashboard/categories-routes.ts
+import { Hono as Hono12 } from "hono";
+function createCategoryWriteRouter() {
+  const app = new Hono12();
+  app.get("/", async (c) => {
+    const { data, error: error2 } = await getSupabaseClient().from("categories").select("*").eq("profile", getProfile()).order("position", { ascending: true });
+    if (error2) return c.json({ error: error2.message }, 500);
+    return c.json({ categories: data ?? [] });
+  });
+  app.post("/", async (c) => {
+    const body = await c.req.json().catch(() => ({}));
+    const name = typeof body["name"] === "string" ? body["name"].trim() : "";
+    if (!name) return c.json({ errors: ["name is required"] }, 400);
     const supabase = getSupabaseClient();
-    const { data: existing, error: fetchError } = await supabase.from("thread_replies").select("*").eq("id", replyId).single();
-    if (fetchError) return c.json({ error: fetchError.message }, 404);
-    if (!await threadIsKnown(existing.thread_id, c)) return c.json({ error: "not found" }, 404);
-    if (existing.author !== author) {
-      return c.json({ error: "only the author can edit a message" }, 403);
-    }
-    const { data: reply, error: error2 } = await supabase.from("thread_replies").update({ body, edited_at: (/* @__PURE__ */ new Date()).toISOString() }).eq("id", replyId).select().single();
+    const { data: last } = await supabase.from("categories").select("position").eq("profile", getProfile()).order("position", { ascending: false }).limit(1);
+    const nextPosition = (last?.[0]?.position ?? -1) + 1;
+    const { data, error: error2 } = await supabase.from("categories").insert({ name, position: nextPosition, profile: getProfile() }).select().single();
     if (error2) return c.json({ error: error2.message }, 500);
-    if (isHumanAuthor(author)) {
-      const { data: latest2 } = await supabase.from("thread_replies").select("id").eq("thread_id", existing.thread_id).is("archived_at", null).order("created_at", { ascending: false }).limit(1).maybeSingle();
-      if (latest2?.id === replyId) {
-        await Promise.resolve(regenerateAgentRun?.(existing.thread_id, replyId)).catch(() => {
-        });
-      }
-    }
-    return c.json(reply);
+    return c.json(data, 201);
   });
-  app.post("/replies/:replyId/reactions", async (c) => {
-    const replyId = c.req.param("replyId");
-    const input2 = await c.req.json().catch(() => null);
-    const author = input2?.author;
-    const emoji = input2?.emoji;
-    if (!isNonEmptyString(author) || !isNonEmptyString(emoji)) {
-      return c.json({ errors: ["author and emoji are required"] }, 400);
-    }
+  app.patch("/reorder", async (c) => {
+    const body = await c.req.json().catch(() => ({}));
+    const ids = Array.isArray(body["ids"]) ? body["ids"].filter((x) => typeof x === "string") : [];
+    if (ids.length === 0) return c.json({ errors: ["ids is required"] }, 400);
     const supabase = getSupabaseClient();
-    const { data: reply, error: replyError } = await supabase.from("thread_replies").select("thread_id").eq("id", replyId).single();
-    if (replyError) return c.json({ error: "not found" }, 404);
-    if (!await threadIsKnown(reply.thread_id, c)) return c.json({ error: "not found" }, 404);
-    const { data: existing, error: existingError } = await supabase.from("reply_reactions").select("id").eq("reply_id", replyId).eq("emoji", emoji).eq("author", author).maybeSingle();
-    if (existingError) return c.json({ error: existingError.message }, 500);
-    if (existing) {
-      const { error: error2 } = await supabase.from("reply_reactions").delete().eq("id", existing.id);
-      if (error2) return c.json({ error: error2.message }, 500);
-    } else {
-      const { error: error2 } = await supabase.from("reply_reactions").insert({ reply_id: replyId, emoji, author });
-      if (error2 && error2.code !== "23505") return c.json({ error: error2.message }, 500);
-    }
-    const { data: reactions, error: reactionsError } = await supabase.from("reply_reactions").select("emoji, author").eq("reply_id", replyId);
-    if (reactionsError) return c.json({ error: reactionsError.message }, 500);
-    return c.json({ reactions: reactions ?? [] });
+    const results = await Promise.all(
+      ids.map(
+        (id, position) => supabase.from("categories").update({ position, updated_at: (/* @__PURE__ */ new Date()).toISOString() }).eq("id", id).eq("profile", getProfile())
+      )
+    );
+    const failed2 = results.find((r) => r.error);
+    if (failed2?.error) return c.json({ error: failed2.error.message }, 500);
+    return c.json({ ok: true });
   });
-  app.patch("/threads/:id/archive", async (c) => {
-    if (c.get("auth")?.role !== "admin") {
-      return c.json({ error: "only an admin can archive a topic" }, 403);
-    }
+  app.put("/:id", async (c) => {
     const id = c.req.param("id");
-    const input2 = await c.req.json().catch(() => null);
-    const archived = input2?.archived;
-    if (typeof archived !== "boolean") {
-      return c.json({ errors: ["archived (boolean) is required"] }, 400);
-    }
-    if (!await threadIsKnown(id, c)) return c.json({ error: "not found" }, 404);
-    const { data: thread, error: error2 } = await getSupabaseClient().from("threads").update({ archived_at: archived ? (/* @__PURE__ */ new Date()).toISOString() : null }).eq("id", id).select().single();
-    if (error2) return c.json({ error: error2.message }, 500);
-    return c.json(thread);
+    const body = await c.req.json().catch(() => ({}));
+    const name = typeof body["name"] === "string" ? body["name"].trim() : "";
+    if (!name) return c.json({ errors: ["name is required"] }, 400);
+    const { data, error: error2 } = await getSupabaseClient().from("categories").update({ name, updated_at: (/* @__PURE__ */ new Date()).toISOString() }).eq("id", id).eq("profile", getProfile()).select().single();
+    if (error2) return c.json({ error: error2.message }, 404);
+    return c.json(data);
   });
-  app.post("/channels/:channelId/threads", async (c) => {
-    const channelId = c.req.param("channelId");
-    if (!ownChannelIds(c).has(channelId)) return c.json({ error: "unknown channel" }, 404);
-    const input2 = await c.req.json();
-    if (!isNonEmptyString(input2.author) || !isNonEmptyString(input2.body)) {
-      return c.json({ errors: ["author and body are required"] }, 400);
-    }
-    const clientKey2 = isNonEmptyString(input2.clientKey) ? input2.clientKey : null;
-    const model = requestedModel(c, input2.model);
-    const effort = requestedEffort(c, input2.effort);
+  app.delete("/:id", async (c) => {
+    const id = c.req.param("id");
     const supabase = getSupabaseClient();
-    let thread;
-    let replayed = false;
-    const { data: inserted, error: threadError } = await supabase.from("threads").insert({
-      channel_id: channelId,
-      // A stored title means someone named the topic. A blank one is not a
-      // name, so it lands as null and the topic is derived from the
-      // opening message at display time (see threadCrumbLabel).
-      title: isNonEmptyString(input2.title) ? input2.title.trim() : null,
-      author: input2.author,
-      client_key: clientKey2
-    }).select().single();
-    if (threadError) {
-      if (!clientKey2 || threadError.code !== "23505") {
-        return c.json({ error: threadError.message }, 500);
-      }
-      const { data: existing } = await supabase.from("threads").select("*").eq("client_key", clientKey2).single();
-      if (!existing) return c.json({ error: threadError.message }, 500);
-      thread = existing;
-      replayed = true;
-    } else {
-      thread = inserted;
-    }
-    let { data: reply } = replayed && clientKey2 ? await supabase.from("thread_replies").select("*").eq("client_key", clientKey2).single() : { data: null };
-    let replyCompleted = false;
-    if (!reply) {
-      const { data: insertedReply, error: replyError } = await supabase.from("thread_replies").insert({
-        thread_id: thread.id,
-        author: input2.author,
-        body: input2.body,
-        client_key: clientKey2,
-        model,
-        effort
-      }).select().single();
-      if (replyError) return c.json({ error: replyError.message }, 500);
-      reply = insertedReply;
-      replyCompleted = true;
-    }
-    if (!replayed || replyCompleted) {
-      onMessage?.({
-        threadId: thread.id,
-        replyId: reply.id,
-        author: input2.author,
-        body: input2.body,
-        // From the row, not `model`/`effort`: on the replay path the reply
-        // predates this request, so its own stored override is the source of
-        // truth.
-        model: reply["model"] ?? void 0,
-        effort: effortFromRow(reply["effort"])
-      });
-    }
-    if (!replayed && thread["title"] == null) {
-      void generateAutoTitle(thread.id, channelId, input2.body).catch(
-        (err) => console.error("Auto title failed:", err)
-      );
-    }
-    return c.json({ ...thread, replies: [reply] }, replayed ? 200 : 201);
-  });
-  app.post("/replies/:replyId/fork", async (c) => {
-    const replyId = c.req.param("replyId");
-    const input2 = await c.req.json().catch(() => null);
-    const author = input2?.author;
-    if (!isNonEmptyString(author)) {
-      return c.json({ errors: ["author is required"] }, 400);
-    }
-    const mode = input2?.mode === "focus" ? "focus" : "condense";
-    const supabase = getSupabaseClient();
-    const { data: source, error: sourceError } = await supabase.from("thread_replies").select("*").eq("id", replyId).single();
-    if (sourceError) return c.json({ error: sourceError.message }, 404);
-    const { data: sourceThread, error: sourceThreadError } = await supabase.from("threads").select("*").eq("id", source.thread_id).single();
-    if (sourceThreadError) return c.json({ error: sourceThreadError.message }, 404);
-    if (!(await globalChannelMeta(c)).has(sourceThread.channel_id)) {
-      return c.json({ error: "not found" }, 404);
-    }
-    const { data: priorReplies } = await supabase.from("thread_replies").select("author, body, created_at").eq("thread_id", source.thread_id).lte("created_at", source.created_at).is("archived_at", null).order("created_at", { ascending: true });
-    const priorRows = priorReplies ?? [];
-    const sourceText = slackMrkdwnToMarkdown(source.body);
-    const FOCUS_CONTEXT_BELOW_CHARS = 280;
-    const inputRows = mode === "focus" ? priorRows.slice(sourceText.length < FOCUS_CONTEXT_BELOW_CHARS ? -2 : -1) : priorRows;
-    const transcript = inputRows.map((r) => `${r.author}: ${slackMrkdwnToMarkdown(r.body)}`).join("\n\n");
-    const { title, body } = await buildForkTopic(transcript || sourceText, sourceText, mode);
-    const backlink = `/chat/${encodeURIComponent(sourceThread.channel_id)}/${sourceThread.id}#m-${replyId.slice(0, 8)}`;
-    const openingBody = `${body}
-
-> \u2442 Forked from [a message by ${source.author}](${backlink})`;
-    const { data: thread, error: threadError } = await supabase.from("threads").insert({ channel_id: sourceThread.channel_id, title, author }).select().single();
-    if (threadError) return c.json({ error: threadError.message }, 500);
-    const { data: reply, error: replyError } = await supabase.from("thread_replies").insert({ thread_id: thread.id, author, body: openingBody }).select().single();
-    if (replyError) return c.json({ error: replyError.message }, 500);
-    onMessage?.({
-      threadId: thread.id,
-      replyId: reply.id,
-      author,
-      body: openingBody
-    });
-    return c.json({ ...thread, replies: [reply] }, 201);
-  });
-  app.post("/threads/:id/replies", async (c) => {
-    const threadId = c.req.param("id");
-    const input2 = await c.req.json();
-    if (!isNonEmptyString(input2.author) || !isNonEmptyString(input2.body)) {
-      return c.json({ errors: ["author and body are required"] }, 400);
-    }
-    const clientKey2 = isNonEmptyString(input2.clientKey) ? input2.clientKey : null;
-    const effort = requestedEffort(c, input2.effort);
-    if (!await threadIsKnown(threadId, c)) return c.json({ error: "not found" }, 404);
-    const model = requestedModel(c, input2.model) ?? await threadModel(threadId);
-    const { data, error: error2 } = await getSupabaseClient().from("thread_replies").insert({
-      thread_id: threadId,
-      author: input2.author,
-      body: input2.body,
-      client_key: clientKey2,
-      model,
-      effort
-    }).select().single();
-    if (error2) {
-      if (clientKey2 && error2.code === "23505") {
-        const { data: existing } = await getSupabaseClient().from("thread_replies").select("*").eq("client_key", clientKey2).single();
-        if (existing) return c.json(existing, 200);
-      }
-      return c.json({ error: error2.message }, 500);
-    }
-    onMessage?.({
-      threadId,
-      replyId: data.id,
-      author: input2.author,
-      body: input2.body,
-      model: data.model ?? void 0,
-      effort: effortFromRow(data.effort)
-    });
-    return c.json(data, 201);
+    const { error: unsetError } = await supabase.from("channels").update({ category_id: null, updated_at: (/* @__PURE__ */ new Date()).toISOString() }).eq("category_id", id);
+    if (unsetError) return c.json({ error: unsetError.message }, 500);
+    await refreshChannelRegistry();
+    const { error: error2 } = await supabase.from("categories").delete().eq("id", id).eq("profile", getProfile());
+    if (error2) return c.json({ error: error2.message }, 404);
+    return c.json({ ok: true });
   });
   return app;
 }
 
-// ../api/src/dashboard/doc-shares-routes.ts
+// ../api/src/dashboard/chat-routes.ts
 import { Hono as Hono13 } from "hono";
 
-// ../api/src/dashboard/doc-share-features.ts
-import { DeleteObjectCommand as DeleteObjectCommand2 } from "@aws-sdk/client-s3";
-var DEFAULT_FEATURES = {
-  audioEnabled: false,
-  askEnabled: true,
-  socialEnabled: false,
-  brandingEnabled: true,
-  translationEnabled: false,
-  translationLangs: []
-};
-var HTML_FEATURES = {
-  audioEnabled: false,
-  askEnabled: false,
-  socialEnabled: false,
-  brandingEnabled: false,
-  translationEnabled: false,
-  translationLangs: []
-};
-function resolveFeatures(requested, existing) {
-  const base = existing ?? DEFAULT_FEATURES;
-  return {
-    audioEnabled: requested?.audio ?? base.audioEnabled,
-    askEnabled: requested?.ask ?? base.askEnabled,
-    socialEnabled: requested?.social ?? base.socialEnabled,
-    brandingEnabled: requested?.branding ?? base.brandingEnabled,
-    translationEnabled: requested?.translation ?? base.translationEnabled,
-    // Replaced wholesale, not merged: the allowlist IS the answer to "which
-    // languages does this link offer", and a merge would make removing one
-    // impossible.
-    translationLangs: requested?.translationLangs ?? base.translationLangs
-  };
-}
-async function deleteShareAssets(keys) {
-  const client2 = getR2Client();
-  const bucket = getR2Bucket();
-  for (const key of keys) {
-    try {
-      await client2.send(new DeleteObjectCommand2({ Bucket: bucket, Key: key }));
-    } catch {
-    }
-  }
-}
-async function updateShareFeatures(share, requested) {
-  if (share.kind === "html") return share;
-  if (share.kind === "excalidraw") {
-    if (requested.branding === void 0) return share;
-    return updateDocShareFeatures(share.id, { ...share, brandingEnabled: requested.branding });
-  }
-  const features = resolveFeatures(requested, share);
-  const updated = await updateDocShareFeatures(share.id, features);
-  if (!updated) return null;
-  if (features.audioEnabled) void queueShareAudio(updated);
-  else if (share.audioEnabled) await dropShareAudio(share);
-  return updated;
-}
+// ../api/src/dashboard/fork-summary.ts
+var GROQ_API_URL4 = "https://api.groq.com/openai/v1/chat/completions";
+var SUMMARY_MODEL = "openai/gpt-oss-120b";
+var MAX_INPUT_CHARS2 = 24e3;
+var TITLE_MAX_CHARS = 80;
+var CONDENSE_SYSTEM_PROMPT = `You turn a chat conversation transcript into a new discussion topic where the work continues. Output EXACTLY two parts separated by one blank line: the first line is a concise topic title (max ${TITLE_MAX_CHARS} characters, no quotes, no Markdown), then a handoff summary of the conversation so far.
 
-// ../api/src/dashboard/agent-bridge-data.ts
-import { randomBytes as randomBytes5, randomUUID as randomUUID2, verify as verifyRaw } from "crypto";
-import { WebSocket, WebSocketServer } from "ws";
+Rules:
+- Keep the conversation's own language. If it is Traditional Chinese (Taiwan), stay in Traditional Chinese with Taiwan wording and keep technical terms in English.
+- The summary opens a new thread where the work picks up: state the goal, what has been done or decided so far, and what remains open or should happen next.
+- Weight the END of the transcript more heavily: later messages reflect the current state. If an earlier plan or decision was later changed, superseded, or abandoned, summarize it in one clause at most and lead with what it became. Never present a discarded early approach with the same weight as the latest one.
+- Summarize the WORK, not the run mechanics: ignore status noise such as stopped/cancelled/terminated-run markers (e.g. "\u23F9 Stopped by user."), error or retry notices, and progress placeholders. A run being cut short is never part of the topic \u2014 capture the progress that was made instead.
+- Preserve essential code identifiers, file names, and URLs, but do not reproduce whole code blocks \u2014 describe what they do in one sentence instead.
+- No preamble like "Summary:" \u2014 start directly with the title line.`;
+var FOCUS_TITLE_SYSTEM_PROMPT = `You name a new discussion topic after one chat message that someone is branching off into a focused side-discussion.
 
-// ../api/src/dashboard/host-identity.ts
-import { createPrivateKey as createPrivateKey2, createPublicKey as createPublicKey2, generateKeyPairSync as generateKeyPairSync2 } from "crypto";
-import { existsSync as existsSync17, mkdirSync as mkdirSync9, readFileSync as readFileSync16, writeFileSync as writeFileSync9 } from "fs";
-import { dirname as dirname5, join as join17 } from "path";
-function hostPrivateKeyPath() {
-  return process.env["FLYSPACE_HOST_KEY_PATH"] || join17(paths.BASE_CONFIG_DIR, "host.key");
-}
-function loadHostPrivateKey(path = hostPrivateKeyPath()) {
-  if (!existsSync17(path)) {
-    throw new Error(
-      `No Host identity at ${path}. Run \`pnpm run generate-host-key\` on this machine, then set FLYSPACE_HOST_PUBLIC_KEY on the Data process to the printed public key.`
-    );
-  }
-  return createPrivateKey2(readFileSync16(path, "utf8"));
-}
+Output ONE line only: the title. Nothing else \u2014 no summary, no explanation, no blank line.
 
-// ../api/src/store/device-store.ts
-import { createHash as createHash8, createPublicKey as createPublicKey3, randomBytes as randomBytes4, randomInt } from "crypto";
-var DEVICE_CODE_TTL_MS = 10 * 6e4;
-var ACCESS_TOKEN_TTL_MS = 15 * 6e4;
-var CHALLENGE_TTL_MS = 2 * 6e4;
-var POLL_INTERVAL_S = 5;
-var sha256 = (s) => createHash8("sha256").update(s).digest("hex");
-function parseEd25519PublicKey(b64) {
-  if (typeof b64 !== "string" || b64.length > 200) return null;
-  try {
-    const key = createPublicKey3({ key: Buffer.from(b64, "base64"), format: "der", type: "spki" });
-    return key.asymmetricKeyType === "ed25519" ? key : null;
-  } catch {
-    return null;
-  }
+Shape:
+- A short noun phrase naming the subject, like a filed ticket's title. Max ${TITLE_MAX_CHARS} characters, and shorter is better.
+- Not a sentence copied from the message, not a quote, not Markdown. No bold, no backticks, no quotes, no trailing punctuation.
+
+Content:
+- Keep the message's own language. If it is Traditional Chinese (Taiwan), stay in Traditional Chinese with Taiwan wording and keep technical terms in English.
+- Name the topic after the FINAL message in the input. Any earlier message is only context for what that message replies to, never the subject of the title.
+- Name that message's central point. A message that diagnoses something is named after the finding, even when its last paragraph proposes a next step \u2014 do not title it after the proposed action.
+- Never reframe it into a different question, never assert a conclusion the message does not reach, and never turn an open investigation into a settled recommendation or a list of steps.
+
+Example \u2014 a message that works out why an admin could not sign in, and closes by suggesting turning email confirmation off:
+admin \u5E33\u865F\u88AB email \u9A57\u8B49\u4FE1\u5361\u4F4F`;
+function clampTitle(title) {
+  return title.length > TITLE_MAX_CHARS ? `${title.slice(0, TITLE_MAX_CHARS - 1)}\u2026` : title;
 }
-var USER_CODE_ALPHABET = "BCDFGHJKMNPQRSTVWXZ";
-function generateUserCode() {
-  const pick = () => Array.from({ length: 4 }, () => USER_CODE_ALPHABET[randomInt(USER_CODE_ALPHABET.length)]).join("");
-  return `${pick()}-${pick()}`;
+function deriveTitle(body) {
+  const line = body.split("\n").find((l) => l.trim().length > 0)?.trim() ?? "Forked message";
+  return clampTitle(line);
 }
-function normalizeUserCode(input2) {
-  const raw = input2.toUpperCase().replace(/[\s-]/g, "");
-  if (raw.length !== 8 || [...raw].some((ch) => !USER_CODE_ALPHABET.includes(ch))) return null;
-  return `${raw.slice(0, 4)}-${raw.slice(4)}`;
+function cleanTitleLine(raw) {
+  const line = raw.split("\n").find((l) => l.trim().length > 0)?.trim() ?? "";
+  return clampTitle(
+    line.replace(/^#{1,6}\s*/, "").replace(/^[*_`"'\u201c\u2018\u300c\u300e]+|[*_`"'\u201d\u2019\u300d\u300f]+$/g, "").trim()
+  );
 }
-function toDevice(r) {
-  return {
-    id: String(r["id"]),
-    userId: String(r["user_id"]),
-    name: String(r["name"]),
-    platform: r["platform"] ?? null,
-    publicKey: String(r["public_key"]),
-    createdAt: String(r["created_at"]),
-    lastSeenAt: r["last_seen_at"] ?? null,
-    revokedAt: r["revoked_at"] ?? null
-  };
+function fallbackTopic(body) {
+  return { title: deriveTitle(body), body };
 }
-function toPending(r) {
+function parseTopic(raw, original) {
+  const text = raw.trim();
+  const breakAt = text.indexOf("\n");
+  if (breakAt === -1) return { title: deriveTitle(text), body: text };
+  const title = text.slice(0, breakAt).trim();
+  const body = text.slice(breakAt + 1).trim();
+  if (!title || !body) return fallbackTopic(original);
   return {
-    id: String(r["id"]),
-    userCode: String(r["user_code"]),
-    publicKey: String(r["public_key"]),
-    name: String(r["name"]),
-    platform: r["platform"] ?? null,
-    requesterIp: r["requester_ip"] ?? null,
-    approvedBy: r["approved_by"] ?? null,
-    workspaceIds: r["workspace_ids"] ?? [],
-    deniedAt: r["denied_at"] ?? null,
-    lastPolledAt: r["last_polled_at"] ?? null,
-    expiresAt: String(r["expires_at"]),
-    createdAt: String(r["created_at"])
+    title: clampTitle(title),
+    body
   };
 }
-function fail(what, error2) {
-  throw new Error(`${what}: ${error2.message}`);
-}
-async function createDeviceCode(input2) {
-  const db = getSupabaseClient();
-  await db.from("device_codes").delete().lt("expires_at", (/* @__PURE__ */ new Date()).toISOString());
-  const deviceCode = randomBytes4(32).toString("hex");
-  for (let attempt = 0; attempt < 3; attempt++) {
-    const userCode = generateUserCode();
-    const { error: error2 } = await db.from("device_codes").insert({
-      device_code_hash: sha256(deviceCode),
-      user_code: userCode,
-      public_key: input2.publicKey,
-      name: input2.name,
-      platform: input2.platform,
-      requester_ip: input2.requesterIp,
-      expires_at: new Date(Date.now() + DEVICE_CODE_TTL_MS).toISOString()
+async function buildForkTopic(transcript, fallbackText, mode = "condense") {
+  const input2 = transcript.length > MAX_INPUT_CHARS2 ? transcript.slice(-MAX_INPUT_CHARS2) : transcript;
+  const fallback = fallbackText ?? transcript;
+  const focus = mode === "focus";
+  const apiKey = process.env["GROQ_API_KEY"];
+  if (!apiKey) return fallbackTopic(fallback);
+  try {
+    const res = await fetch(GROQ_API_URL4, {
+      method: "POST",
+      headers: { "content-type": "application/json", authorization: `Bearer ${apiKey}` },
+      body: JSON.stringify({
+        model: SUMMARY_MODEL,
+        temperature: 0.2,
+        // A title has to sort the message's central claim from the next-step
+        // paragraph it often ends with; 'low' reliably grabs the latter.
+        reasoning_effort: focus ? "medium" : "low",
+        // A title is one short line, but focus mode reasons before answering
+        // and the budget covers reasoning tokens too — too small a cap here
+        // truncates the title mid-word rather than failing.
+        max_tokens: focus ? 512 : 1024,
+        messages: [
+          {
+            role: "system",
+            content: focus ? FOCUS_TITLE_SYSTEM_PROMPT : CONDENSE_SYSTEM_PROMPT
+          },
+          { role: "user", content: input2 }
+        ]
+      })
     });
-    if (!error2) return { deviceCode, userCode };
-    if (error2.code !== "23505") fail("createDeviceCode", error2);
+    if (!res.ok) throw new Error(`Groq request failed (${res.status})`);
+    const data = await res.json();
+    const raw = data.choices?.[0]?.message?.content?.trim();
+    if (!raw) throw new Error("Groq returned an empty summary");
+    if (focus) return { title: cleanTitleLine(raw) || deriveTitle(fallback), body: fallback };
+    return parseTopic(raw, fallback);
+  } catch (err) {
+    console.error("Fork summary failed, using original text:", err);
+    return fallbackTopic(fallback);
   }
-  throw new Error("createDeviceCode: could not allocate a unique user code");
 }
-async function getDeviceCodeBySecret(deviceCode) {
-  const { data, error: error2 } = await getSupabaseClient().from("device_codes").select("*").eq("device_code_hash", sha256(deviceCode)).maybeSingle();
-  if (error2) fail("getDeviceCodeBySecret", error2);
-  return data ? toPending(data) : null;
+
+// ../api/src/dashboard/slack-format.ts
+import { nameToEmoji } from "gemoji";
+var SLACK_EMOJI_ALIASES = {
+  double_vertical_bar: "\u23F8\uFE0F"
+};
+function emojifyShortcode(code) {
+  const name = code.slice(1, -1);
+  return nameToEmoji[name] ?? SLACK_EMOJI_ALIASES[name] ?? code;
 }
-async function getDeviceCodeByUserCode(userCode) {
-  const { data, error: error2 } = await getSupabaseClient().from("device_codes").select("*").eq("user_code", userCode).maybeSingle();
-  if (error2) fail("getDeviceCodeByUserCode", error2);
-  return data ? toPending(data) : null;
+function resolveSlackTokens(text) {
+  return text.replace(/<@([A-Z0-9]+)(?:\|[^>]*)?>/g, (_m, id) => `@${getLocalCache().displayNameFor(id)}`).replace(/<#([A-Z0-9]+)\|([^>]+)>/g, (_m, _id, name) => `#${name}`).replace(/<#([A-Z0-9]+)>/g, (_m, id) => `#${getLocalCache().lookupChannelById(id)?.name ?? id}`).replace(/<!channel>/g, "@channel").replace(/<!here>/g, "@here").replace(/<!everyone>/g, "@everyone").replace(/<!subteam\^[A-Z0-9]+\|@?([^>]+)>/g, "@$1").replace(/<mailto:([^|>]+)\|([^>]+)>/g, (_m, addr, label2) => `[${label2}](mailto:${addr})`).replace(/<(https?:\/\/[^|>]+)\|([^>]+)>/g, (_m, url, label2) => `[${label2}](${url})`).replace(/:[a-z0-9_+-]+:/gi, emojifyShortcode);
 }
-async function markPolled(id) {
-  const { error: error2 } = await getSupabaseClient().from("device_codes").update({ last_polled_at: (/* @__PURE__ */ new Date()).toISOString() }).eq("id", id);
-  if (error2) fail("markPolled", error2);
+function slackMrkdwnToMarkdown(text) {
+  return resolveSlackTokens(text).replace(/(?<![\w*])\*(?!\*)(\S(?:[^*\n]*?\S)?)\*(?!\*)(?![\w*])/g, "**$1**").replace(/(?<![\w~])~(?!~)(\S(?:[^~\n]*?\S)?)~(?!~)(?![\w~])/g, "~~$1~~").replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&amp;/g, "&");
 }
-async function decideDeviceCode(id, userId, decision) {
-  const { data, error: error2 } = await getSupabaseClient().from("device_codes").update(
-    decision.approve ? { approved_by: userId, workspace_ids: decision.workspaceIds } : { denied_at: (/* @__PURE__ */ new Date()).toISOString() }
-  ).eq("id", id).is("approved_by", null).is("denied_at", null).select("id");
-  if (error2) fail("decideDeviceCode", error2);
-  return (data ?? []).length > 0;
+
+// ../api/src/dashboard/thread-relevance.ts
+async function relevantThreadsPage(supabase, handle, channelIds, opts) {
+  const escaped = handle.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const { data, error: error2 } = await supabase.rpc("relevant_threads", {
+    handle,
+    mention_pattern: `@${escaped}\\M`,
+    channel_ids: channelIds,
+    before: opts.before ?? null,
+    page_limit: opts.limit
+  });
+  if (error2) throw new Error(`relevant_threads: ${error2.message}`);
+  return data ?? [];
 }
-async function redeemDeviceCode(pending2) {
-  const db = getSupabaseClient();
-  const { data: claimed, error: claimError } = await db.from("device_codes").delete().eq("id", pending2.id).select("id");
-  if (claimError) fail("redeemDeviceCode", claimError);
-  if (!claimed?.length) return null;
-  const existing = pending2.approvedBy ? await findDeviceByKey(pending2.publicKey, pending2.approvedBy) : null;
-  const { data, error: error2 } = existing ? await db.from("devices").update({ name: pending2.name, platform: pending2.platform }).eq("id", existing.id).select("*").single() : await db.from("devices").insert({
-    user_id: pending2.approvedBy,
-    name: pending2.name,
-    platform: pending2.platform,
-    public_key: pending2.publicKey
-  }).select("*").single();
-  if (error2) fail("redeemDeviceCode", error2);
-  const device = toDevice(data);
-  if (pending2.workspaceIds.length) {
-    const { error: bindError } = await db.from("device_workspaces").upsert(
-      pending2.workspaceIds.map((workspaceId) => ({
-        device_id: device.id,
-        workspace_id: workspaceId,
-        bound_by: pending2.approvedBy
-      })),
-      { onConflict: "device_id,workspace_id", ignoreDuplicates: true }
-    );
-    if (bindError) fail("redeemDeviceCode", bindError);
+
+// ../api/src/dashboard/thread-translate.ts
+import { createHash as createHash8 } from "crypto";
+
+// ../api/src/store/thread-translation-store.ts
+async function getThreadTranslations(lang, keys) {
+  const found = /* @__PURE__ */ new Map();
+  if (keys.length === 0) return found;
+  const clauses = keys.map((k) => `and(reply_id.eq.${k.replyId},body_hash.eq.${k.bodyHash})`).join(",");
+  const { data, error: error2 } = await getSupabaseClient().from("thread_reply_translations").select("reply_id, body, passthrough").eq("lang", lang).or(clauses);
+  if (error2) throw new Error(`getThreadTranslations(${lang}): ${error2.message}`);
+  for (const row of data ?? []) {
+    const replyId = row["reply_id"];
+    found.set(replyId, {
+      replyId,
+      body: row["body"],
+      passthrough: row["passthrough"]
+    });
   }
-  return device;
+  return found;
 }
-async function getDevice(id) {
-  const { data, error: error2 } = await getSupabaseClient().from("devices").select("*").eq("id", id).maybeSingle();
-  if (error2) fail("getDevice", error2);
-  return data ? toDevice(data) : null;
+async function putThreadTranslations(lang, rows) {
+  if (rows.length === 0) return;
+  const { error: error2 } = await getSupabaseClient().from("thread_reply_translations").upsert(
+    rows.map((r) => ({
+      reply_id: r.replyId,
+      lang,
+      body_hash: r.bodyHash,
+      body: r.body,
+      passthrough: r.passthrough
+    })),
+    { onConflict: "reply_id,lang,body_hash" }
+  );
+  if (error2) throw new Error(`putThreadTranslations(${lang}): ${error2.message}`);
 }
-async function findDeviceByKey(publicKey, userId) {
-  const { data, error: error2 } = await getSupabaseClient().from("devices").select("*").eq("public_key", publicKey).eq("user_id", userId).is("revoked_at", null).order("created_at", { ascending: false }).limit(1).maybeSingle();
-  if (error2) fail("findDeviceByKey", error2);
-  return data ? toDevice(data) : null;
+
+// ../api/src/dashboard/thread-translate.ts
+var GROQ_API_URL5 = "https://api.groq.com/openai/v1/chat/completions";
+var TRANSLATION_MODEL2 = "openai/gpt-oss-120b";
+var RECIPE_VERSION3 = 1;
+var BATCH_CHAR_BUDGET = 16e3;
+var CONTEXT_MESSAGES = 4;
+var MAX_MESSAGE_CHARS = 12e3;
+var MAX_OUTPUT_TOKENS2 = 32768;
+var BY_CODE2 = new Map(TRANSLATION_LANGUAGES.map((l) => [l.code, l]));
+function isTranslatableLanguage2(lang) {
+  return BY_CODE2.has(lang);
 }
-async function issueAccessToken(deviceId) {
-  const token = `fsd_${randomBytes4(32).toString("hex")}`;
-  const { error: error2 } = await getSupabaseClient().from("devices").update({
-    access_token_hash: sha256(token),
-    access_token_expires_at: new Date(Date.now() + ACCESS_TOKEN_TTL_MS).toISOString(),
-    last_seen_at: (/* @__PURE__ */ new Date()).toISOString()
-  }).eq("id", deviceId);
-  if (error2) fail("issueAccessToken", error2);
-  return { token, expiresInS: ACCESS_TOKEN_TTL_MS / 1e3 };
+function translationHash2(author, body) {
+  return createHash8("sha256").update(`${RECIPE_VERSION3}
+${author}
+${body}`).digest("hex");
 }
-async function deviceForAccessToken(token) {
-  if (!token.startsWith("fsd_")) return null;
-  const { data, error: error2 } = await getSupabaseClient().from("devices").select("*").eq("access_token_hash", sha256(token)).is("revoked_at", null).gt("access_token_expires_at", (/* @__PURE__ */ new Date()).toISOString()).maybeSingle();
-  if (error2) fail("deviceForAccessToken", error2);
-  return data ? toDevice(data) : null;
+function systemPrompt2(languageName2) {
+  return `You translate messages from a group chat into ${languageName2}. You are a translator, not an editor, a summarizer, or a participant.
+
+You receive a JSON object with two keys:
+- "context": earlier messages, for reference only. NEVER translate these and never mention them in your output.
+- "translate": the messages to translate, each with an "n" and a "body".
+
+Reply with ONLY a JSON object of this exact shape, one entry per message in "translate", in the same order:
+{"messages":[{"n":1,"body":"...","already_target":false}]}
+
+Rules:
+- "already_target" is true when the message is ALREADY written in ${languageName2}. In that case copy "body" through byte for byte, changing nothing at all. A message whose prose is in another language is NOT already_target just because it contains English technical terms, code, or product names.
+- Translate meaning, not words. These are people talking, not prose to be polished. Keep the speaker's register: a terse message stays terse, a casual one stays casual, a rude one stays rude. Do not make anyone sound more formal, more complete, or more articulate than they wrote.
+- A short reply ("\u597D\u554A", "same", "nope") is translated as the natural equivalent in ${languageName2}, using the context to see what it is answering. Never expand it into a full sentence the speaker did not write.
+- Keep the Markdown exactly as it is: same heading levels, list nesting, table shape, link and image syntax, blockquotes, and order. Do not add, merge, split, or reorder anything.
+- Do NOT translate: text inside fenced or inline code blocks, URLs, file paths, command names, or @mentions and /skill tokens. Leave them byte-for-byte identical.
+- Keep established technical terms in English where a fluent speaker of ${languageName2} would keep them in English rather than reaching for a translated coinage.
+- Use the punctuation conventions of ${languageName2}, including full-width punctuation for Chinese and Japanese. Use ordinary ASCII hyphens, never typographic or non-breaking hyphen variants.
+- Never add commentary, notes about your choices, apologies, or an explanation of anything you could not translate.`;
 }
-async function revokeDevice2(id) {
-  const { error: error2 } = await getSupabaseClient().from("devices").update({ revoked_at: (/* @__PURE__ */ new Date()).toISOString(), access_token_hash: null }).eq("id", id);
-  if (error2) fail("revokeDevice", error2);
+function normalizeHyphens2(text) {
+  return text.replace(/‐|‑/g, "-");
 }
-async function createChallenge(deviceId) {
-  const db = getSupabaseClient();
-  await db.from("device_challenges").delete().lt("expires_at", (/* @__PURE__ */ new Date()).toISOString());
-  const nonce = randomBytes4(32).toString("base64url");
-  const { error: error2 } = await db.from("device_challenges").insert({
-    nonce,
-    device_id: deviceId,
-    expires_at: new Date(Date.now() + CHALLENGE_TTL_MS).toISOString()
+function clip(body) {
+  return body.length > MAX_MESSAGE_CHARS ? body.slice(0, MAX_MESSAGE_CHARS) : body;
+}
+function batchMessages(messages) {
+  const batches = [];
+  let current = [];
+  let size = 0;
+  for (const m of messages) {
+    const len = Math.min(m.body.length, MAX_MESSAGE_CHARS);
+    if (current.length > 0 && size + len > BATCH_CHAR_BUDGET) {
+      batches.push(current);
+      current = [];
+      size = 0;
+    }
+    current.push(m);
+    size += len;
+  }
+  if (current.length > 0) batches.push(current);
+  return batches;
+}
+async function translateBatch(batch, context, lang) {
+  const language = BY_CODE2.get(lang);
+  if (!language) throw new Error(`unsupported translation language: ${lang}`);
+  const apiKey = process.env["GROQ_API_KEY"];
+  if (!apiKey) throw new Error("GROQ_API_KEY is not configured");
+  const payload = {
+    context: context.map((m) => ({ author: m.author, body: clip(m.body) })),
+    translate: batch.map((m, i) => ({ n: i + 1, author: m.author, body: clip(m.body) }))
+  };
+  const res = await fetch(GROQ_API_URL5, {
+    method: "POST",
+    headers: { "content-type": "application/json", authorization: `Bearer ${apiKey}` },
+    body: JSON.stringify({
+      model: TRANSLATION_MODEL2,
+      temperature: 0,
+      max_tokens: MAX_OUTPUT_TOKENS2,
+      response_format: { type: "json_object" },
+      messages: [
+        { role: "system", content: systemPrompt2(language.name) },
+        { role: "user", content: JSON.stringify(payload) }
+      ]
+    })
+  });
+  if (!res.ok) throw new Error(`translation model returned ${res.status}`);
+  const data = await res.json();
+  const choice = data.choices?.[0];
+  if (choice?.finish_reason === "length") {
+    throw new Error("the translation ran past the model output limit");
+  }
+  const raw = choice?.message?.content?.trim() ?? "";
+  if (!raw) throw new Error("the model returned an empty translation");
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new Error("the model returned unparseable JSON");
+  }
+  const byNumber = /* @__PURE__ */ new Map();
+  for (const entry of parsed.messages ?? []) {
+    if (typeof entry?.n === "number") byNumber.set(entry.n, entry);
+  }
+  return batch.map((m, i) => {
+    const entry = byNumber.get(i + 1);
+    const body = typeof entry?.body === "string" ? entry.body.trim() : "";
+    if (!body) return { id: m.id, body: m.body, passthrough: true };
+    return {
+      id: m.id,
+      body: normalizeHyphens2(body),
+      passthrough: entry?.already_target === true
+    };
+  });
+}
+var inFlight4 = /* @__PURE__ */ new Map();
+async function translateThread(threadId, lang, messages) {
+  if (!BY_CODE2.has(lang)) throw new Error(`unsupported translation language: ${lang}`);
+  if (messages.length === 0) return [];
+  const shape = createHash8("sha256").update(messages.map((m) => translationHash2(m.author, m.body)).join("\n")).digest("hex");
+  const key = `${threadId}:${lang}:${shape}`;
+  const running2 = inFlight4.get(key);
+  if (running2) return running2;
+  const job = (async () => {
+    const hashes = messages.map((m) => ({
+      replyId: m.id,
+      bodyHash: translationHash2(m.author, m.body)
+    }));
+    const cached = await getThreadTranslations(lang, hashes);
+    const missing = messages.filter((m) => !cached.has(m.id));
+    const fresh = /* @__PURE__ */ new Map();
+    if (missing.length > 0) {
+      const index = new Map(messages.map((m, i) => [m.id, i]));
+      const batches = batchMessages(missing);
+      const results = await Promise.all(
+        batches.map((batch) => {
+          const first = index.get(batch[0].id) ?? 0;
+          const context = messages.slice(Math.max(0, first - CONTEXT_MESSAGES), first);
+          return translateBatch(batch, context, lang);
+        })
+      );
+      for (const row of results.flat()) fresh.set(row.id, row);
+      const hashById = new Map(hashes.map((h) => [h.replyId, h.bodyHash]));
+      await putThreadTranslations(
+        lang,
+        [...fresh.values()].map((r) => ({
+          replyId: r.id,
+          bodyHash: hashById.get(r.id),
+          body: r.body,
+          passthrough: r.passthrough
+        }))
+      );
+    }
+    return messages.map((m) => {
+      const hit = cached.get(m.id);
+      if (hit) return { id: m.id, body: hit.body, passthrough: hit.passthrough };
+      return fresh.get(m.id) ?? { id: m.id, body: m.body, passthrough: true };
+    });
+  })().finally(() => inFlight4.delete(key));
+  inFlight4.set(key, job);
+  return job;
+}
+
+// ../api/src/dashboard/chat-routes.ts
+function isNonEmptyString(v) {
+  return typeof v === "string" && v.trim().length > 0;
+}
+function sanitizeModel(v) {
+  if (typeof v !== "string") return null;
+  const model = v.trim().toLowerCase();
+  return isAllowedModel(model) ? model : null;
+}
+async function threadModel(threadId) {
+  const { data } = await getSupabaseClient().from("thread_replies").select("model").eq("thread_id", threadId).not("model", "is", null).order("created_at", { ascending: false }).limit(1).maybeSingle();
+  return sanitizeModel(data?.model);
+}
+function requestedModel(c, model) {
+  return c.get("auth")?.role === "admin" ? sanitizeModel(model) : null;
+}
+function sanitizeEffort(v) {
+  if (typeof v !== "string") return null;
+  const effort = v.trim().toLowerCase();
+  return isEffort(effort) ? effort : null;
+}
+function requestedEffort(c, effort) {
+  return c.get("auth")?.role === "admin" ? sanitizeEffort(effort) : null;
+}
+function effortFromRow(v) {
+  return typeof v === "string" && isEffort(v) ? v : void 0;
+}
+var BOARD_STATUSES = [
+  "backlog",
+  "todo",
+  "in_progress",
+  "in_review",
+  "done",
+  "cancelled"
+];
+var NO_STATUS_COLUMN = "none";
+function boardColumnParam(status) {
+  if (status === NO_STATUS_COLUMN) return NO_STATUS_COLUMN;
+  return BOARD_STATUSES.includes(status) ? status : null;
+}
+var THREAD_CHUNK_SIZE = 25;
+var THREADS_PAGE_SIZE = 30;
+var THREADS_PAGE_SIZE_MAX = 100;
+var REPLIES_PAGE_SIZE = 50;
+var REPLIES_PAGE_SIZE_MAX = 200;
+var TRANSLATABLE_REPLIES_MAX = 400;
+var BOARD_PAGE_SIZE = 50;
+var BOARD_PAGE_SIZE_MAX = 100;
+function ownChannelIds(c) {
+  const viewer = c.get("auth");
+  return new Set(
+    getProfileChannelRegistry().filter((ch) => canSeeChannel(ch, viewer)).flatMap((ch) => ch.externalChannelId ? [ch.id, ch.externalChannelId] : [ch.id])
+  );
+}
+async function globalChannelMeta(c) {
+  const viewer = c.get("auth");
+  const map = /* @__PURE__ */ new Map();
+  const channels = getChannelRegistry();
+  let workspaceIdBySlug = /* @__PURE__ */ new Map();
+  let roleByWorkspaceId = /* @__PURE__ */ new Map();
+  if (viewer?.email && channels.length > 0) {
+    const [workspaces, memberships] = await Promise.all([
+      listWorkspaces(),
+      listMembershipsByEmail(viewer.email)
+    ]);
+    workspaceIdBySlug = new Map(workspaces.map((w) => [w.slug, w.id]));
+    roleByWorkspaceId = new Map(memberships.map((m) => [m.workspaceId, m.role]));
+  }
+  for (const ch of channels) {
+    const workspaceId = workspaceIdBySlug.get(ch.profile);
+    const role = workspaceId ? roleByWorkspaceId.get(workspaceId) : void 0;
+    if (!canSeeChannel(ch, { email: viewer?.email, role })) continue;
+    const meta = { workspace: ch.profile, channelName: ch.name, agentName: ch.agentName };
+    map.set(ch.id, meta);
+    if (ch.externalChannelId) map.set(ch.externalChannelId, meta);
+  }
+  return map;
+}
+async function threadIsKnown(threadId, c) {
+  const { data } = await getSupabaseClient().from("threads").select("channel_id").eq("id", threadId).single();
+  const channelId = data?.channel_id;
+  return !!channelId && (await globalChannelMeta(c)).has(channelId);
+}
+function chunk(items, size) {
+  const out = [];
+  for (let i = 0; i < items.length; i += size) out.push(items.slice(i, i + size));
+  return out;
+}
+async function withPreviews(supabase, threads) {
+  const chunkResults = await Promise.all(
+    chunk(
+      threads.map((t) => t.id),
+      THREAD_CHUNK_SIZE
+    ).map(
+      (ids) => supabase.from("thread_replies").select("thread_id, body, author, external_user_id").in("thread_id", ids).is("archived_at", null).order("created_at", { ascending: true })
+    )
+  );
+  const previewByThread = /* @__PURE__ */ new Map();
+  for (const { data } of chunkResults) {
+    for (const r of data ?? []) {
+      const entry = previewByThread.get(r.thread_id);
+      if (entry) {
+        entry.count += 1;
+        entry.lastAuthor = r.author;
+        entry.participants.delete(r.author);
+        entry.participants.set(r.author, r.external_user_id ?? null);
+      } else
+        previewByThread.set(r.thread_id, {
+          count: 1,
+          firstBody: r.body,
+          lastAuthor: r.author,
+          participants: /* @__PURE__ */ new Map()
+        });
+    }
+  }
+  return threads.map((t) => {
+    const entry = previewByThread.get(t.id);
+    return {
+      ...t,
+      reply_count: Math.max(0, (entry?.count ?? 0) - 1),
+      preview: entry?.firstBody ? slackMrkdwnToMarkdown(entry.firstBody) : null,
+      // Who spoke last, counting only replies AFTER the opening message —
+      // the reader's own handle here means there is nothing new for them to
+      // read, on this browser or any other (see web/src/lib/thread-unread).
+      last_reply_author: entry && entry.count > 1 ? entry.lastAuthor : null,
+      // Everyone who replied, most recent first, for the row's avatar stack.
+      participants: [...entry?.participants ?? []].reverse().map(([author, external_user_id]) => ({ author, external_user_id }))
+    };
+  });
+}
+async function labelThread(channelId, body, scope) {
+  const channel = getProfileChannelRegistry().find(
+    (ch) => ch.id === channelId || ch.externalChannelId === channelId
+  );
+  if (!channel) return null;
+  const supabase = getSupabaseClient();
+  const { data: recent } = await supabase.from("threads").select("auto_title, title").eq("channel_id", channelId).order("created_at", { ascending: false }).limit(50);
+  const existingCategories = extractCategories(
+    (recent ?? []).flatMap((t) => [
+      t.auto_title,
+      t.title
+    ])
+  );
+  return buildAutoTitle({
+    channelName: channel.name,
+    channelPrompt: channel.prompt,
+    workspacePrompt: loadWorkspacePrompt().prompt,
+    titlePrompt: (await loadWorkspaceBranding()).autoTitlePrompt,
+    existingCategories,
+    body,
+    scope
+  });
+}
+async function generateAutoTitle(threadId, channelId, body) {
+  if ((await loadWorkspaceBranding()).autoTitleEnabled === false) return;
+  const autoTitle = await labelThread(channelId, body);
+  if (!autoTitle) return;
+  const supabase = getSupabaseClient();
+  await supabase.from("threads").update({ auto_title: autoTitle }).eq("id", threadId).is("title", null);
+}
+function createChatRouter(agent = {}) {
+  const app = new Hono13();
+  const {
+    onChatMessage: onMessage,
+    isAgentThinking,
+    getAgentActivities,
+    cancelAgentRun,
+    regenerateAgentRun,
+    listAgentRuns
+  } = agent;
+  app.post(
+    "/threads/:id/agent-cancel",
+    async (c) => c.json({ cancelled: await cancelAgentRun?.(c.req.param("id")) ?? false })
+  );
+  app.post(
+    "/threads/:id/agent-regenerate",
+    async (c) => c.json({ started: await regenerateAgentRun?.(c.req.param("id")) ?? false })
+  );
+  app.get(
+    "/threads/:id/agent-status",
+    async (c) => c.json({
+      thinking: await isAgentThinking?.(c.req.param("id")) ?? false,
+      activities: await getAgentActivities?.(c.req.param("id")) ?? []
+    })
+  );
+  app.get("/agent-runs", async (c) => c.json({ threadIds: await listAgentRuns?.() ?? [] }));
+  app.get("/channels/:channelId/threads", async (c) => {
+    const channelId = c.req.param("channelId");
+    if (!ownChannelIds(c).has(channelId)) return c.json({ error: "unknown channel" }, 404);
+    const requestedLimit = Number(c.req.query("limit"));
+    const limit = Number.isFinite(requestedLimit) && requestedLimit > 0 ? Math.min(requestedLimit, THREADS_PAGE_SIZE_MAX) : THREADS_PAGE_SIZE;
+    const before = c.req.query("before");
+    const sortColumn = c.req.query("sort") === "activity" ? "updated_at" : "created_at";
+    const statusParam = c.req.query("status");
+    const statusFilter = statusParam ? [
+      ...new Set(
+        statusParam.split(",").map(boardColumnParam).filter((s) => s !== null)
+      )
+    ] : [];
+    const supabase = getSupabaseClient();
+    let query = supabase.from("threads").select("*").eq("channel_id", channelId).is("archived_at", null).order(sortColumn, { ascending: false }).limit(limit);
+    if (before) query = query.lt(sortColumn, before);
+    if (statusFilter.length) {
+      const withoutNone = statusFilter.filter((s) => s !== NO_STATUS_COLUMN);
+      const includeNone = statusFilter.includes(NO_STATUS_COLUMN);
+      if (includeNone && withoutNone.length) {
+        query = query.or(`board_status.in.(${withoutNone.join(",")}),board_status.is.null`);
+      } else if (includeNone) {
+        query = query.is("board_status", null);
+      } else {
+        query = query.in("board_status", withoutNone);
+      }
+    }
+    const { data: threads, error: error2 } = await query;
+    if (error2) return c.json({ error: error2.message }, 500);
+    if (!threads || threads.length === 0) return c.json({ threads: [], nextCursor: null });
+    const withPreview = await withPreviews(supabase, threads);
+    const nextCursor = threads.length === limit ? threads[threads.length - 1][sortColumn] : null;
+    return c.json({ threads: withPreview, nextCursor });
+  });
+  app.get("/channels/:channelId/board/:status", async (c) => {
+    const channelId = c.req.param("channelId");
+    if (!ownChannelIds(c).has(channelId)) return c.json({ error: "unknown channel" }, 404);
+    const column = boardColumnParam(c.req.param("status"));
+    if (!column) {
+      return c.json(
+        { error: `status must be one of: ${[...BOARD_STATUSES, NO_STATUS_COLUMN].join(", ")}` },
+        400
+      );
+    }
+    const requestedLimit = Number(c.req.query("limit"));
+    const limit = Number.isFinite(requestedLimit) && requestedLimit > 0 ? Math.min(requestedLimit, BOARD_PAGE_SIZE_MAX) : BOARD_PAGE_SIZE;
+    const before = c.req.query("before");
+    const supabase = getSupabaseClient();
+    let query = supabase.from("threads").select("*").eq("channel_id", channelId);
+    query = column === NO_STATUS_COLUMN ? query.is("board_status", null) : query.eq("board_status", column);
+    query = query.is("archived_at", null).order("updated_at", { ascending: false }).limit(limit);
+    if (before) query = query.lt("updated_at", before);
+    const { data: threads, error: error2 } = await query;
+    if (error2) return c.json({ error: error2.message }, 500);
+    if (!threads || threads.length === 0) return c.json({ threads: [], nextCursor: null });
+    const withPreview = await withPreviews(supabase, threads);
+    const nextCursor = threads.length === limit ? threads[threads.length - 1].updated_at : null;
+    return c.json({ threads: withPreview, nextCursor });
+  });
+  app.get("/board/:status", async (c) => {
+    const column = boardColumnParam(c.req.param("status"));
+    if (!column) {
+      return c.json(
+        { error: `status must be one of: ${[...BOARD_STATUSES, NO_STATUS_COLUMN].join(", ")}` },
+        400
+      );
+    }
+    const requestedLimit = Number(c.req.query("limit"));
+    const limit = Number.isFinite(requestedLimit) && requestedLimit > 0 ? Math.min(requestedLimit, BOARD_PAGE_SIZE_MAX) : BOARD_PAGE_SIZE;
+    const before = c.req.query("before");
+    const meta = c.req.query("scope") === "all" ? await globalChannelMeta(c) : null;
+    const supabase = getSupabaseClient();
+    let query = supabase.from("threads").select("*").in("channel_id", meta ? [...meta.keys()] : [...ownChannelIds(c)]);
+    query = column === NO_STATUS_COLUMN ? query.is("board_status", null) : query.eq("board_status", column);
+    query = query.is("archived_at", null).order("updated_at", { ascending: false }).limit(limit);
+    if (before) query = query.lt("updated_at", before);
+    const { data: threads, error: error2 } = await query;
+    if (error2) return c.json({ error: error2.message }, 500);
+    if (!threads || threads.length === 0) return c.json({ threads: [], nextCursor: null });
+    const withPreview = await withPreviews(supabase, threads);
+    const labelled = meta ? withPreview.map((t) => {
+      const channelMeta = meta.get(t.channel_id ?? "");
+      return {
+        ...t,
+        workspace: channelMeta?.workspace ?? null,
+        channel_name: channelMeta?.channelName ?? null,
+        agent_name: channelMeta?.agentName ?? null
+      };
+    }) : withPreview;
+    const nextCursor = threads.length === limit ? threads[threads.length - 1].updated_at : null;
+    return c.json({ threads: labelled, nextCursor });
+  });
+  app.get("/threads", async (c) => {
+    const requestedLimit = Number(c.req.query("limit"));
+    const limit = Number.isFinite(requestedLimit) && requestedLimit > 0 ? Math.min(requestedLimit, THREADS_PAGE_SIZE_MAX) : THREADS_PAGE_SIZE;
+    const before = c.req.query("before");
+    const meta = c.req.query("scope") === "all" ? await globalChannelMeta(c) : null;
+    const relevantTo = c.req.query("relevantTo");
+    const supabase = getSupabaseClient();
+    const channelIds = meta ? [...meta.keys()] : [...ownChannelIds(c)];
+    let threads;
+    if (isNonEmptyString(relevantTo)) {
+      try {
+        threads = await relevantThreadsPage(supabase, relevantTo, channelIds, { before, limit });
+      } catch (err) {
+        return c.json({ error: err instanceof Error ? err.message : String(err) }, 500);
+      }
+    } else {
+      let query = supabase.from("threads").select("*").in("channel_id", channelIds).is("archived_at", null).order("updated_at", { ascending: false }).limit(limit);
+      if (before) query = query.lt("updated_at", before);
+      const { data, error: error2 } = await query;
+      if (error2) return c.json({ error: error2.message }, 500);
+      threads = data;
+    }
+    if (!threads || threads.length === 0) return c.json({ threads: [], nextCursor: null });
+    const threadIds = threads.map((t) => t.id);
+    const chunkResults = await Promise.all(
+      chunk(threadIds, THREAD_CHUNK_SIZE).map(
+        (ids) => supabase.from("thread_replies").select("*").in("thread_id", ids).is("archived_at", null).order("created_at", { ascending: true })
+      )
+    );
+    const repliesByThread = /* @__PURE__ */ new Map();
+    for (const { data } of chunkResults) {
+      for (const r of data ?? []) {
+        const arr = repliesByThread.get(r.thread_id);
+        if (arr) arr.push(r);
+        else repliesByThread.set(r.thread_id, [r]);
+      }
+    }
+    const withReplies = threads.map((t) => {
+      const channelMeta = meta?.get(t.channel_id);
+      return {
+        ...t,
+        ...meta ? {
+          workspace: channelMeta?.workspace ?? null,
+          channel_name: channelMeta?.channelName ?? null,
+          agent_name: channelMeta?.agentName ?? null
+        } : {},
+        replies: (repliesByThread.get(t.id) ?? []).map((r) => ({
+          ...r,
+          body: slackMrkdwnToMarkdown(r.body)
+        }))
+      };
+    });
+    const nextCursor = threads.length === limit ? threads[threads.length - 1].updated_at : null;
+    return c.json({ threads: withReplies, nextCursor });
+  });
+  app.get("/threads/archived", async (c) => {
+    if (c.get("auth")?.role !== "admin") {
+      return c.json({ error: "only an admin can view archived topics" }, 403);
+    }
+    const requestedLimit = Number(c.req.query("limit"));
+    const limit = Number.isFinite(requestedLimit) && requestedLimit > 0 ? Math.min(requestedLimit, THREADS_PAGE_SIZE_MAX) : THREADS_PAGE_SIZE;
+    const before = c.req.query("before");
+    const supabase = getSupabaseClient();
+    let query = supabase.from("threads").select("*").in("channel_id", [...ownChannelIds(c)]).not("archived_at", "is", null).order("archived_at", { ascending: false }).limit(limit);
+    if (before) query = query.lt("archived_at", before);
+    const { data: threads, error: error2 } = await query;
+    if (error2) return c.json({ error: error2.message }, 500);
+    if (!threads || threads.length === 0) return c.json({ threads: [], nextCursor: null });
+    const withPreview = await withPreviews(supabase, threads);
+    const nextCursor = threads.length === limit ? threads[threads.length - 1].archived_at : null;
+    return c.json({ threads: withPreview, nextCursor });
+  });
+  app.get("/threads/:id", async (c) => {
+    const id = c.req.param("id");
+    const requestedLimit = Number(c.req.query("limit"));
+    const limit = Number.isFinite(requestedLimit) && requestedLimit > 0 ? Math.min(requestedLimit, REPLIES_PAGE_SIZE_MAX) : REPLIES_PAGE_SIZE;
+    const before = c.req.query("before");
+    let repliesQuery = getSupabaseClient().from("thread_replies").select("*, reactions:reply_reactions(emoji, author)").eq("thread_id", id).is("archived_at", null).order("created_at", { ascending: false }).limit(limit);
+    if (before) repliesQuery = repliesQuery.lt("created_at", before);
+    const [thread, replies, opening] = await Promise.all([
+      getSupabaseClient().from("threads").select("*").eq("id", id).single(),
+      repliesQuery,
+      // The opening message, fetched separately because the replies page
+      // above is newest-first: on a long thread the opener isn't in it. It
+      // is what the header falls back to on a thread with no title of its
+      // own (see threadCrumbLabel) — a title is never written on the
+      // thread's behalf, so an untitled row must still be able to show and
+      // rename a topic.
+      getSupabaseClient().from("thread_replies").select("body").eq("thread_id", id).is("archived_at", null).order("created_at", { ascending: true }).limit(1)
+    ]);
+    if (thread.error) return c.json({ error: thread.error.message }, 404);
+    if (replies.error) return c.json({ error: replies.error.message }, 500);
+    const channelId = thread.data?.channel_id;
+    const meta = await globalChannelMeta(c);
+    const channelMeta = channelId ? meta.get(channelId) : void 0;
+    if (!channelId || !channelMeta) {
+      return c.json({ error: "not found" }, 404);
+    }
+    const page2 = replies.data ?? [];
+    const nextCursor = page2.length === limit ? page2[page2.length - 1].created_at : null;
+    const formattedReplies = page2.reverse().map((r) => ({
+      ...r,
+      body: slackMrkdwnToMarkdown(r.body)
+    }));
+    const openingBody = (opening.data ?? [])[0]?.body;
+    return c.json({
+      ...thread.data,
+      // Always stamped (not just on `?scope=all` feeds, see the `/threads`
+      // route above) — the reply pane can be opened directly by id (global
+      // board, permalink) without the active workspace's channel map ever
+      // having loaded this thread's channel, so the header needs its own
+      // workspace/channel label rather than depending on that cache.
+      workspace: channelMeta.workspace,
+      channel_name: channelMeta.channelName,
+      agent_name: channelMeta.agentName,
+      preview: openingBody ? slackMrkdwnToMarkdown(openingBody) : null,
+      replies: formattedReplies,
+      nextCursor
+    });
+  });
+  app.post("/threads/:id/translation/:lang", async (c) => {
+    const id = c.req.param("id");
+    const lang = canonicalLanguage(c.req.param("lang"));
+    if (!isTranslatableLanguage2(lang)) return c.json({ error: "unsupported language" }, 400);
+    const [thread, replies] = await Promise.all([
+      getSupabaseClient().from("threads").select("channel_id").eq("id", id).single(),
+      getSupabaseClient().from("thread_replies").select("id, author, body").eq("thread_id", id).is("archived_at", null).order("created_at", { ascending: true }).limit(TRANSLATABLE_REPLIES_MAX)
+    ]);
+    if (thread.error) return c.json({ error: "not found" }, 404);
+    if (replies.error) return c.json({ error: replies.error.message }, 500);
+    const channelId = thread.data?.channel_id;
+    if (!channelId || !(await globalChannelMeta(c)).has(channelId)) {
+      return c.json({ error: "not found" }, 404);
+    }
+    const messages = (replies.data ?? []).map(
+      (r) => ({ id: r.id, author: r.author, body: slackMrkdwnToMarkdown(r.body) })
+    );
+    try {
+      return c.json({ lang, messages: await translateThread(id, lang, messages) });
+    } catch (err) {
+      const message = err instanceof Error ? err.message : "translation failed";
+      console.error(`Thread translation failed (${id} \u2192 ${lang}):`, err);
+      return c.json({ error: message }, 502);
+    }
+  });
+  app.patch("/threads/:id/board-status", async (c) => {
+    const id = c.req.param("id");
+    const input2 = await c.req.json().catch(() => null);
+    const value = input2?.board_status ?? null;
+    if (value !== null && !BOARD_STATUSES.includes(value)) {
+      return c.json(
+        { error: `board_status must be null or one of: ${BOARD_STATUSES.join(", ")}` },
+        400
+      );
+    }
+    if (!await threadIsKnown(id, c)) return c.json({ error: "not found" }, 404);
+    const { data: thread, error: error2 } = await getSupabaseClient().from("threads").update({ board_status: value }).eq("id", id).select().single();
+    if (error2) return c.json({ error: error2.message }, 500);
+    return c.json(thread);
+  });
+  app.patch("/threads/:id", async (c) => {
+    const id = c.req.param("id");
+    const input2 = await c.req.json().catch(() => null);
+    const raw = input2?.title;
+    if (raw !== null && !isNonEmptyString(raw)) {
+      return c.json({ errors: ["title must be a non-empty string, or null to clear it"] }, 400);
+    }
+    const title = raw === null ? null : raw.trim();
+    if (!await threadIsKnown(id, c)) return c.json({ error: "not found" }, 404);
+    const { data: thread, error: error2 } = await getSupabaseClient().from("threads").update({ title }).eq("id", id).select().single();
+    if (error2) return c.json({ error: error2.message }, 500);
+    return c.json(thread);
+  });
+  app.post("/threads/:id/suggest-title", async (c) => {
+    const id = c.req.param("id");
+    if (!await threadIsKnown(id, c)) return c.json({ error: "not found" }, 404);
+    const { data: thread } = await getSupabaseClient().from("threads").select("channel_id").eq("id", id).single();
+    if (!thread) return c.json({ error: "not found" }, 404);
+    const { data: rows, error: error2 } = await getSupabaseClient().from("thread_replies").select("author, body").eq("thread_id", id).is("archived_at", null).order("created_at", { ascending: true });
+    if (error2) return c.json({ error: error2.message }, 500);
+    const transcript = (rows ?? []).map((r) => `${r.author}: ${slackMrkdwnToMarkdown(r.body)}`).join("\n\n");
+    const title = await labelThread(thread.channel_id, transcript, "thread");
+    if (!title) return c.json({ error: "could not generate a topic" }, 502);
+    return c.json({ title });
+  });
+  app.patch("/replies/:replyId", async (c) => {
+    const replyId = c.req.param("replyId");
+    const input2 = await c.req.json().catch(() => null);
+    const author = input2?.author;
+    const body = input2?.body;
+    if (!isNonEmptyString(author) || !isNonEmptyString(body)) {
+      return c.json({ errors: ["author and body are required"] }, 400);
+    }
+    const supabase = getSupabaseClient();
+    const { data: existing, error: fetchError } = await supabase.from("thread_replies").select("*").eq("id", replyId).single();
+    if (fetchError) return c.json({ error: fetchError.message }, 404);
+    if (!await threadIsKnown(existing.thread_id, c)) return c.json({ error: "not found" }, 404);
+    if (existing.author !== author) {
+      return c.json({ error: "only the author can edit a message" }, 403);
+    }
+    const { data: reply, error: error2 } = await supabase.from("thread_replies").update({ body, edited_at: (/* @__PURE__ */ new Date()).toISOString() }).eq("id", replyId).select().single();
+    if (error2) return c.json({ error: error2.message }, 500);
+    if (isHumanAuthor(author)) {
+      const { data: latest2 } = await supabase.from("thread_replies").select("id").eq("thread_id", existing.thread_id).is("archived_at", null).order("created_at", { ascending: false }).limit(1).maybeSingle();
+      if (latest2?.id === replyId) {
+        await Promise.resolve(regenerateAgentRun?.(existing.thread_id, replyId)).catch(() => {
+        });
+      }
+    }
+    return c.json(reply);
+  });
+  app.post("/replies/:replyId/reactions", async (c) => {
+    const replyId = c.req.param("replyId");
+    const input2 = await c.req.json().catch(() => null);
+    const author = input2?.author;
+    const emoji = input2?.emoji;
+    if (!isNonEmptyString(author) || !isNonEmptyString(emoji)) {
+      return c.json({ errors: ["author and emoji are required"] }, 400);
+    }
+    const supabase = getSupabaseClient();
+    const { data: reply, error: replyError } = await supabase.from("thread_replies").select("thread_id").eq("id", replyId).single();
+    if (replyError) return c.json({ error: "not found" }, 404);
+    if (!await threadIsKnown(reply.thread_id, c)) return c.json({ error: "not found" }, 404);
+    const { data: existing, error: existingError } = await supabase.from("reply_reactions").select("id").eq("reply_id", replyId).eq("emoji", emoji).eq("author", author).maybeSingle();
+    if (existingError) return c.json({ error: existingError.message }, 500);
+    if (existing) {
+      const { error: error2 } = await supabase.from("reply_reactions").delete().eq("id", existing.id);
+      if (error2) return c.json({ error: error2.message }, 500);
+    } else {
+      const { error: error2 } = await supabase.from("reply_reactions").insert({ reply_id: replyId, emoji, author });
+      if (error2 && error2.code !== "23505") return c.json({ error: error2.message }, 500);
+    }
+    const { data: reactions, error: reactionsError } = await supabase.from("reply_reactions").select("emoji, author").eq("reply_id", replyId);
+    if (reactionsError) return c.json({ error: reactionsError.message }, 500);
+    return c.json({ reactions: reactions ?? [] });
+  });
+  app.patch("/threads/:id/archive", async (c) => {
+    if (c.get("auth")?.role !== "admin") {
+      return c.json({ error: "only an admin can archive a topic" }, 403);
+    }
+    const id = c.req.param("id");
+    const input2 = await c.req.json().catch(() => null);
+    const archived = input2?.archived;
+    if (typeof archived !== "boolean") {
+      return c.json({ errors: ["archived (boolean) is required"] }, 400);
+    }
+    if (!await threadIsKnown(id, c)) return c.json({ error: "not found" }, 404);
+    const { data: thread, error: error2 } = await getSupabaseClient().from("threads").update({ archived_at: archived ? (/* @__PURE__ */ new Date()).toISOString() : null }).eq("id", id).select().single();
+    if (error2) return c.json({ error: error2.message }, 500);
+    return c.json(thread);
+  });
+  app.post("/channels/:channelId/threads", async (c) => {
+    const channelId = c.req.param("channelId");
+    if (!ownChannelIds(c).has(channelId)) return c.json({ error: "unknown channel" }, 404);
+    const input2 = await c.req.json();
+    if (!isNonEmptyString(input2.author) || !isNonEmptyString(input2.body)) {
+      return c.json({ errors: ["author and body are required"] }, 400);
+    }
+    const clientKey2 = isNonEmptyString(input2.clientKey) ? input2.clientKey : null;
+    const model = requestedModel(c, input2.model);
+    const effort = requestedEffort(c, input2.effort);
+    const supabase = getSupabaseClient();
+    let thread;
+    let replayed = false;
+    const { data: inserted, error: threadError } = await supabase.from("threads").insert({
+      channel_id: channelId,
+      // A stored title means someone named the topic. A blank one is not a
+      // name, so it lands as null and the topic is derived from the
+      // opening message at display time (see threadCrumbLabel).
+      title: isNonEmptyString(input2.title) ? input2.title.trim() : null,
+      author: input2.author,
+      client_key: clientKey2
+    }).select().single();
+    if (threadError) {
+      if (!clientKey2 || threadError.code !== "23505") {
+        return c.json({ error: threadError.message }, 500);
+      }
+      const { data: existing } = await supabase.from("threads").select("*").eq("client_key", clientKey2).single();
+      if (!existing) return c.json({ error: threadError.message }, 500);
+      thread = existing;
+      replayed = true;
+    } else {
+      thread = inserted;
+    }
+    let { data: reply } = replayed && clientKey2 ? await supabase.from("thread_replies").select("*").eq("client_key", clientKey2).single() : { data: null };
+    let replyCompleted = false;
+    if (!reply) {
+      const { data: insertedReply, error: replyError } = await supabase.from("thread_replies").insert({
+        thread_id: thread.id,
+        author: input2.author,
+        body: input2.body,
+        client_key: clientKey2,
+        model,
+        effort
+      }).select().single();
+      if (replyError) return c.json({ error: replyError.message }, 500);
+      reply = insertedReply;
+      replyCompleted = true;
+    }
+    if (!replayed || replyCompleted) {
+      onMessage?.({
+        threadId: thread.id,
+        replyId: reply.id,
+        author: input2.author,
+        body: input2.body,
+        // From the row, not `model`/`effort`: on the replay path the reply
+        // predates this request, so its own stored override is the source of
+        // truth.
+        model: reply["model"] ?? void 0,
+        effort: effortFromRow(reply["effort"])
+      });
+    }
+    if (!replayed && thread["title"] == null) {
+      void generateAutoTitle(thread.id, channelId, input2.body).catch(
+        (err) => console.error("Auto title failed:", err)
+      );
+    }
+    return c.json({ ...thread, replies: [reply] }, replayed ? 200 : 201);
   });
-  if (error2) fail("createChallenge", error2);
-  return nonce;
-}
-async function consumeChallenge(deviceId, nonce) {
-  const { data, error: error2 } = await getSupabaseClient().from("device_challenges").delete().eq("nonce", nonce).eq("device_id", deviceId).gt("expires_at", (/* @__PURE__ */ new Date()).toISOString()).select("nonce");
-  if (error2) fail("consumeChallenge", error2);
-  return (data ?? []).length > 0;
-}
-async function listAdminWorkspaces(userId) {
-  const { data, error: error2 } = await getSupabaseClient().from("memberships").select("workspace_id, workspaces!inner(slug)").eq("user_id", userId).eq("role", "admin").eq("status", "active");
-  if (error2) fail("listAdminWorkspaces", error2);
-  return (data ?? []).map((r) => ({ id: r.workspace_id, slug: r.workspaces.slug })).sort((a, b) => a.slug.localeCompare(b.slug));
-}
-async function listDeviceWorkspaces(device) {
-  const { data, error: error2 } = await getSupabaseClient().from("device_workspaces").select("workspace_id").eq("device_id", device.id);
-  if (error2) fail("listDeviceWorkspaces", error2);
-  const bound = new Set((data ?? []).map((r) => r.workspace_id));
-  return (await listAdminWorkspaces(device.userId)).filter((w) => bound.has(w.id));
-}
-async function bindDeviceWorkspace(deviceId, workspaceId, boundBy) {
-  const { error: error2 } = await getSupabaseClient().from("device_workspaces").upsert(
-    { device_id: deviceId, workspace_id: workspaceId, bound_by: boundBy },
-    { onConflict: "device_id,workspace_id", ignoreDuplicates: true }
-  );
-  if (error2) fail("bindDeviceWorkspace", error2);
-}
-async function listWorkspaceDevices(workspaceId) {
-  const { data, error: error2 } = await getSupabaseClient().from("device_workspaces").select("devices!inner(*)").eq("workspace_id", workspaceId).is("devices.revoked_at", null);
-  if (error2) fail("listWorkspaceDevices", error2);
-  return (data ?? []).map((r) => toDevice(r.devices)).sort((a, b) => b.createdAt.localeCompare(a.createdAt));
-}
-var STALE_HOST_MS = 14 * 24 * 60 * 6e4;
-var isStale = (lastSeenAt) => !!lastSeenAt && Date.now() - Date.parse(lastSeenAt) > STALE_HOST_MS;
-async function listWorkspaceHosts(workspaceIds, exceptPublicKey) {
-  const hosts2 = /* @__PURE__ */ new Map();
-  if (!workspaceIds.length) return hosts2;
-  const { data, error: error2 } = await getSupabaseClient().from("device_workspaces").select("workspace_id, devices!inner(name, public_key, revoked_at, last_seen_at)").in("workspace_id", workspaceIds).is("devices.revoked_at", null);
-  if (error2) fail("listWorkspaceHosts", error2);
-  for (const r of data ?? []) {
-    if (r.devices.public_key !== exceptPublicKey && !isStale(r.devices.last_seen_at)) {
-      hosts2.set(r.workspace_id, r.devices.name);
+  app.post("/replies/:replyId/fork", async (c) => {
+    const replyId = c.req.param("replyId");
+    const input2 = await c.req.json().catch(() => null);
+    const author = input2?.author;
+    if (!isNonEmptyString(author)) {
+      return c.json({ errors: ["author is required"] }, 400);
     }
-  }
-  return hosts2;
-}
-async function releaseStaleHosts(workspaceIds, exceptPublicKey) {
-  if (!workspaceIds.length) return;
-  const db = getSupabaseClient();
-  const { data, error: error2 } = await db.from("device_workspaces").select("device_id, workspace_id, devices!inner(public_key, last_seen_at)").in("workspace_id", workspaceIds);
-  if (error2) fail("releaseStaleHosts", error2);
-  for (const r of data ?? []) {
-    if (r.devices.public_key === exceptPublicKey || !isStale(r.devices.last_seen_at)) continue;
-    const { error: delError } = await db.from("device_workspaces").delete().eq("device_id", r.device_id).eq("workspace_id", r.workspace_id);
-    if (delError) fail("releaseStaleHosts", delError);
-  }
-}
-async function userEmail(userId) {
-  const { data, error: error2 } = await getSupabaseClient().auth.admin.getUserById(userId);
-  if (error2) return null;
-  return data.user?.email ?? null;
-}
+    const mode = input2?.mode === "focus" ? "focus" : "condense";
+    const supabase = getSupabaseClient();
+    const { data: source, error: sourceError } = await supabase.from("thread_replies").select("*").eq("id", replyId).single();
+    if (sourceError) return c.json({ error: sourceError.message }, 404);
+    const { data: sourceThread, error: sourceThreadError } = await supabase.from("threads").select("*").eq("id", source.thread_id).single();
+    if (sourceThreadError) return c.json({ error: sourceThreadError.message }, 404);
+    if (!(await globalChannelMeta(c)).has(sourceThread.channel_id)) {
+      return c.json({ error: "not found" }, 404);
+    }
+    const { data: priorReplies } = await supabase.from("thread_replies").select("author, body, created_at").eq("thread_id", source.thread_id).lte("created_at", source.created_at).is("archived_at", null).order("created_at", { ascending: true });
+    const priorRows = priorReplies ?? [];
+    const sourceText = slackMrkdwnToMarkdown(source.body);
+    const FOCUS_CONTEXT_BELOW_CHARS = 280;
+    const inputRows = mode === "focus" ? priorRows.slice(sourceText.length < FOCUS_CONTEXT_BELOW_CHARS ? -2 : -1) : priorRows;
+    const transcript = inputRows.map((r) => `${r.author}: ${slackMrkdwnToMarkdown(r.body)}`).join("\n\n");
+    const { title, body } = await buildForkTopic(transcript || sourceText, sourceText, mode);
+    const backlink = `/chat/${encodeURIComponent(sourceThread.channel_id)}/${sourceThread.id}#m-${replyId.slice(0, 8)}`;
+    const openingBody = `${body}
 
-// ../core/src/bridge-protocol.ts
-var HOST_SOCKET_PATH = "/internal/host-socket";
-var DEFAULT_DATA_API_PORT = 4757;
-var CALL_TIMEOUT_MS = 15e3;
-var HEARTBEAT_INTERVAL_MS = 15e3;
-var HEARTBEAT_TIMEOUT_MS = HEARTBEAT_INTERVAL_MS * 2.5;
-var LOCAL_RELAY_PATH = "/internal/agent-call";
-var RELAYED_METHODS = [
-  "onChatMessage",
-  "isAgentThinking",
-  "getAgentActivities",
-  "cancelAgentRun",
-  "regenerateAgentRun",
-  "listAgentRuns"
-];
-function encodeWireMessage(msg) {
-  return JSON.stringify(msg);
-}
-function parseWireMessage(raw) {
-  try {
-    return JSON.parse(String(raw));
-  } catch {
-    return null;
-  }
+> \u2442 Forked from [a message by ${source.author}](${backlink})`;
+    const { data: thread, error: threadError } = await supabase.from("threads").insert({ channel_id: sourceThread.channel_id, title, author }).select().single();
+    if (threadError) return c.json({ error: threadError.message }, 500);
+    const { data: reply, error: replyError } = await supabase.from("thread_replies").insert({ thread_id: thread.id, author, body: openingBody }).select().single();
+    if (replyError) return c.json({ error: replyError.message }, 500);
+    onMessage?.({
+      threadId: thread.id,
+      replyId: reply.id,
+      author,
+      body: openingBody
+    });
+    return c.json({ ...thread, replies: [reply] }, 201);
+  });
+  app.post("/threads/:id/replies", async (c) => {
+    const threadId = c.req.param("id");
+    const input2 = await c.req.json();
+    if (!isNonEmptyString(input2.author) || !isNonEmptyString(input2.body)) {
+      return c.json({ errors: ["author and body are required"] }, 400);
+    }
+    const clientKey2 = isNonEmptyString(input2.clientKey) ? input2.clientKey : null;
+    const effort = requestedEffort(c, input2.effort);
+    if (!await threadIsKnown(threadId, c)) return c.json({ error: "not found" }, 404);
+    const model = requestedModel(c, input2.model) ?? await threadModel(threadId);
+    const { data, error: error2 } = await getSupabaseClient().from("thread_replies").insert({
+      thread_id: threadId,
+      author: input2.author,
+      body: input2.body,
+      client_key: clientKey2,
+      model,
+      effort
+    }).select().single();
+    if (error2) {
+      if (clientKey2 && error2.code === "23505") {
+        const { data: existing } = await getSupabaseClient().from("thread_replies").select("*").eq("client_key", clientKey2).single();
+        if (existing) return c.json(existing, 200);
+      }
+      return c.json({ error: error2.message }, 500);
+    }
+    onMessage?.({
+      threadId,
+      replyId: data.id,
+      author: input2.author,
+      body: input2.body,
+      model: data.model ?? void 0,
+      effort: effortFromRow(data.effort)
+    });
+    return c.json(data, 201);
+  });
+  return app;
 }
 
-// ../api/src/dashboard/agent-bridge-data.ts
-var hosts = /* @__PURE__ */ new Map();
-var hostStatusListeners = /* @__PURE__ */ new Set();
-function notifyHostStatus() {
-  const online = hosts.size > 0;
-  for (const l of hostStatusListeners) l(online);
-}
-function removeHost(ws) {
-  if (hosts.delete(ws)) notifyHostStatus();
+// ../api/src/dashboard/doc-shares-routes.ts
+import { Hono as Hono14 } from "hono";
+
+// ../api/src/dashboard/doc-share-features.ts
+import { DeleteObjectCommand as DeleteObjectCommand2 } from "@aws-sdk/client-s3";
+var DEFAULT_FEATURES = {
+  audioEnabled: false,
+  askEnabled: true,
+  socialEnabled: false,
+  brandingEnabled: true,
+  translationEnabled: false,
+  translationLangs: []
+};
+var HTML_FEATURES = {
+  audioEnabled: false,
+  askEnabled: false,
+  socialEnabled: false,
+  brandingEnabled: false,
+  translationEnabled: false,
+  translationLangs: []
+};
+function resolveFeatures(requested, existing) {
+  const base = existing ?? DEFAULT_FEATURES;
+  return {
+    audioEnabled: requested?.audio ?? base.audioEnabled,
+    askEnabled: requested?.ask ?? base.askEnabled,
+    socialEnabled: requested?.social ?? base.socialEnabled,
+    brandingEnabled: requested?.branding ?? base.brandingEnabled,
+    translationEnabled: requested?.translation ?? base.translationEnabled,
+    // Replaced wholesale, not merged: the allowlist IS the answer to "which
+    // languages does this link offer", and a merge would make removing one
+    // impossible.
+    translationLangs: requested?.translationLangs ?? base.translationLangs
+  };
 }
-function disconnectHostDevice(deviceId) {
-  for (const [ws, scope] of hosts) {
-    if (scope.deviceId !== deviceId) continue;
-    console.log(`[host-socket] closing connection for revoked device ${deviceId}`);
-    removeHost(ws);
-    ws.close(1008, "device revoked");
+async function deleteShareAssets(keys) {
+  const client2 = getR2Client();
+  const bucket = getR2Bucket();
+  for (const key of keys) {
+    try {
+      await client2.send(new DeleteObjectCommand2({ Bucket: bucket, Key: key }));
+    } catch {
+    }
   }
 }
-var LAST_SEEN_RESOLUTION_MS = 60 * 6e4;
-var lastCallError = /* @__PURE__ */ new Map();
-function getHostCallError(method, profile = getProfile()) {
-  return lastCallError.get(`${profile}:${method}`) ?? null;
+async function updateShareFeatures(share, requested) {
+  if (share.kind === "html") return share;
+  if (share.kind === "excalidraw") {
+    if (requested.branding === void 0) return share;
+    return updateDocShareFeatures(share.id, { ...share, brandingEnabled: requested.branding });
+  }
+  const features = resolveFeatures(requested, share);
+  const updated = await updateDocShareFeatures(share.id, features);
+  if (!updated) return null;
+  if (features.audioEnabled) void queueShareAudio(updated);
+  else if (share.audioEnabled) await dropShareAudio(share);
+  return updated;
 }
 
 // ../api/src/dashboard/doc-share-publish.ts
@@ -10537,7 +10845,7 @@ import { CopyObjectCommand, PutObjectCommand as PutObjectCommand2 } from "@aws-s
 var SHARE_ASSET_PLACEHOLDER = "/share/{{flyspace-share-id}}/assets/";
 
 // ../api/src/dashboard/share-language.ts
-var GROQ_API_URL5 = "https://api.groq.com/openai/v1/chat/completions";
+var GROQ_API_URL6 = "https://api.groq.com/openai/v1/chat/completions";
 var CLASSIFIER_MODEL = "openai/gpt-oss-20b";
 var SAMPLE_CHARS = 4e3;
 var NOISE = [
@@ -10576,7 +10884,7 @@ async function detectSourceLanguage(title, content) {
   const sample = languageSample(title, content);
   if (sample.length < MIN_SAMPLE_CHARS) return null;
   try {
-    const res = await fetch(GROQ_API_URL5, {
+    const res = await fetch(GROQ_API_URL6, {
       method: "POST",
       headers: { "content-type": "application/json", authorization: `Bearer ${apiKey}` },
       body: JSON.stringify({
@@ -10806,7 +11114,7 @@ function resolveChannel2(c) {
 }
 var LIST_LIMIT = 500;
 function createDocShareListRouter() {
-  const app = new Hono13();
+  const app = new Hono14();
   app.get("/shares", async (c) => {
     const viewer = c.get("auth");
     const readable = await filterReadableDocsChannels(
@@ -10850,7 +11158,7 @@ function createDocShareListRouter() {
   return app;
 }
 function createDocShareWriteRouter(agent = {}) {
-  const app = new Hono13();
+  const app = new Hono14();
   app.use("/:id/docs/share", requireDocsAccess);
   app.use("/:id/docs/share/*", requireDocsAccess);
   app.use("/:id/docs/shares", requireDocsAccess);
@@ -11023,7 +11331,7 @@ function createDocShareWriteRouter(agent = {}) {
 }
 
 // ../api/src/dashboard/search-routes.ts
-import { Hono as Hono14 } from "hono";
+import { Hono as Hono15 } from "hono";
 function matchScore(q, fields) {
   const terms = q.toLowerCase().split(/\s+/).filter(Boolean);
   if (terms.length === 0) return 0;
@@ -11171,7 +11479,7 @@ function searchAutomations(q) {
 }
 var RESULT_LIMIT = 30;
 function createSearchRouter() {
-  const app = new Hono14();
+  const app = new Hono15();
   app.get("/", async (c) => {
     const q = c.req.query("q")?.trim();
     if (!q) return c.json({ results: [] });
@@ -11187,14 +11495,14 @@ function createSearchRouter() {
 }
 
 // ../api/src/dashboard/feature-flags-routes.ts
-import { Hono as Hono15 } from "hono";
+import { Hono as Hono16 } from "hono";
 async function isFeatureEnabled(c, flagId) {
   const auth = c.get("auth");
   const enabled = await listEnabledFeatureFlags(auth.workspaceId);
   return resolveFeatureFlags(enabled, isDevHost(c))[flagId];
 }
 function createFeatureFlagsRouter() {
-  const app = new Hono15();
+  const app = new Hono16();
   app.get("/", async (c) => {
     const auth = c.get("auth");
     const devHost = isDevHost(c);
@@ -11221,7 +11529,7 @@ function createFeatureFlagsRouter() {
 
 // ../api/src/dashboard/uploads-routes.ts
 import { randomUUID as randomUUID3 } from "crypto";
-import { Hono as Hono16 } from "hono";
+import { Hono as Hono17 } from "hono";
 import { PutObjectCommand as PutObjectCommand3, GetObjectCommand as GetObjectCommand3 } from "@aws-sdk/client-s3";
 import { getSignedUrl as getSignedUrl3 } from "@aws-sdk/s3-request-presigner";
 var MAX_FILE_BYTES = 10 * 1024 * 1024;
@@ -11236,7 +11544,7 @@ function encodeKeyForUrl(key) {
   return key.split("/").map(encodeURIComponent).join("/");
 }
 function createUploadsRouter() {
-  const app = new Hono16();
+  const app = new Hono17();
   app.post("/uploads", async (c) => {
     const body = await c.req.parseBody().catch(() => null);
     const file = body?.["file"];
@@ -11281,14 +11589,14 @@ function createUploadsRouter() {
 }
 
 // ../api/src/dashboard/transcribe-routes.ts
-import { Hono as Hono17 } from "hono";
+import { Hono as Hono18 } from "hono";
 var GROQ_TRANSCRIBE_URL = "https://api.groq.com/openai/v1/audio/transcriptions";
 var MODEL = "whisper-large-v3-turbo";
 var MAX_AUDIO_BYTES = 5 * 1024 * 1024;
 var MAX_PROMPT_CHARS = 400;
 var NO_SPEECH_THRESHOLD = 0.6;
 function createTranscribeRouter() {
-  const app = new Hono17();
+  const app = new Hono18();
   app.post("/transcribe", async (c) => {
     if (!await isFeatureEnabled(c, "dictation"))
       return c.json({ error: "feature not enabled" }, 403);
@@ -11328,7 +11636,7 @@ function createTranscribeRouter() {
 
 // ../api/src/dashboard/avatars-routes.ts
 import { createHash as createHash9, randomUUID as randomUUID4 } from "crypto";
-import { Hono as Hono18 } from "hono";
+import { Hono as Hono19 } from "hono";
 import sharp4 from "sharp";
 import { PutObjectCommand as PutObjectCommand4, DeleteObjectCommand as DeleteObjectCommand3 } from "@aws-sdk/client-s3";
 var AVATAR_SIZE = 192;
@@ -11381,7 +11689,7 @@ function avatarKeyPrefix() {
   return `${KEY_PREFIX2}/${getProfile()}/`;
 }
 function createAvatarsRouter() {
-  const app = new Hono18();
+  const app = new Hono19();
   app.get("/avatars/slack", async (c) => {
     const ctx = await resolveAuthContext(c);
     if (!ctx) return c.json({ error: "not signed in" }, 401);
@@ -11430,7 +11738,7 @@ function createAvatarsRouter() {
 }
 
 // ../api/src/dashboard/members-routes.ts
-import { Hono as Hono19 } from "hono";
+import { Hono as Hono20 } from "hono";
 function inviteLinkFor(c, token) {
   const url = new URL("/auth/invite", callbackUrl(c));
   url.searchParams.set("token", token);
@@ -11438,7 +11746,7 @@ function inviteLinkFor(c, token) {
 }
 var EMAIL_RE2 = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
 function createMembersRouter() {
-  const members = new Hono19();
+  const members = new Hono20();
   members.get("/", async (c) => {
     const ctx = await resolveAuthContext(c);
     if (ctx?.role !== "admin") return c.json({ error: "admin access required" }, 403);
@@ -11665,7 +11973,7 @@ function createMembersRouter() {
 }
 
 // ../api/src/dashboard/notifications-routes.ts
-import { Hono as Hono20 } from "hono";
+import { Hono as Hono21 } from "hono";
 
 // ../api/src/store/notification-store.ts
 function rowToNotification(row) {
@@ -11733,7 +12041,7 @@ async function markAllRead(channelIds, userId) {
 
 // ../api/src/dashboard/notifications-routes.ts
 function createNotificationsRouter() {
-  const notifications = new Hono20();
+  const notifications = new Hono21();
   notifications.get("/", async (c) => {
     const auth = c.get("auth");
     const channelIds = getProfileChannelRegistry().filter((ch) => canSeeChannel(ch, auth)).map((ch) => ch.id);
@@ -11760,7 +12068,7 @@ function createNotificationsRouter() {
   return notifications;
 }
 function createThreadReadRouter() {
-  const threads = new Hono20();
+  const threads = new Hono21();
   threads.post("/threads/:threadId/read", async (c) => {
     const { userId } = c.get("auth");
     const threadId = c.req.param("threadId");
@@ -11772,7 +12080,7 @@ function createThreadReadRouter() {
 }
 
 // ../api/src/dashboard/push-routes.ts
-import { Hono as Hono21 } from "hono";
+import { Hono as Hono22 } from "hono";
 
 // ../api/src/push/send.ts
 import webpush from "web-push";
@@ -11875,7 +12183,7 @@ async function pushToUser(userId, payload) {
 
 // ../api/src/dashboard/push-routes.ts
 function createPushRouter() {
-  const push = new Hono21();
+  const push = new Hono22();
   push.get("/key", (c) => c.json({ publicKey: getVapidPublicKey() }));
   push.post("/subscribe", async (c) => {
     const { userId } = c.get("auth");
@@ -11906,7 +12214,7 @@ function createPushRouter() {
 }
 
 // ../api/src/dashboard/mcp-oauth-routes.ts
-import { Hono as Hono22 } from "hono";
+import { Hono as Hono23 } from "hono";
 
 // ../api/src/mcp/crypto.ts
 import { createCipheriv, createDecipheriv, randomBytes as randomBytes7, timingSafeEqual } from "crypto";
@@ -12421,7 +12729,7 @@ function backToDashboard(c, to, params) {
   return c.redirect(`${target.pathname}${target.search}`);
 }
 function createMcpOAuthRouter() {
-  const app = new Hono22();
+  const app = new Hono23();
   app.get("/oauth/:provider/start", async (c) => {
     const auth = c.get("auth");
     if (auth.role !== "admin") return c.json({ error: "admin access required" }, 403);
@@ -12548,7 +12856,7 @@ function createMcpOAuthRouter() {
 }
 
 // ../api/src/dashboard/mcp-routes.ts
-import { Hono as Hono23 } from "hono";
+import { Hono as Hono24 } from "hono";
 
 // ../api/src/mcp/transport.ts
 var KINDS = ["inherit", "npx", "local", "http", "sse"];
@@ -12678,7 +12986,7 @@ function bindingsByConnection() {
   return map;
 }
 function createMcpRouter() {
-  const app = new Hono23();
+  const app = new Hono24();
   app.get("/providers", async (c) => {
     const denied = requireAdmin(c.get("auth"));
     if (denied) return c.json({ error: denied }, 403);
@@ -13060,7 +13368,7 @@ async function buildThreadUsage(threadTs) {
 }
 
 // ../api/src/dashboard/channel-members-routes.ts
-import { Hono as Hono24 } from "hono";
+import { Hono as Hono25 } from "hono";
 async function isChannelAdmin(ctx, channelId) {
   if (ctx.role === "admin") return true;
   const membership = await getMembershipByUserId(ctx.workspaceId, ctx.userId);
@@ -13069,7 +13377,7 @@ async function isChannelAdmin(ctx, channelId) {
   return members.some((m) => m.membershipId === membership.id && m.role === "channel_admin");
 }
 function createChannelMembersRouter() {
-  const router = new Hono24();
+  const router = new Hono25();
   router.get("/:id/members", async (c) => {
     const ctx = await resolveAuthContext(c);
     if (!ctx) return c.json({ error: "workspace access required" }, 403);
@@ -13139,7 +13447,7 @@ function createChannelMembersRouter() {
 }
 
 // ../api/src/dashboard/memories-routes.ts
-import { Hono as Hono25 } from "hono";
+import { Hono as Hono26 } from "hono";
 async function readPatch(c) {
   const body = await c.req.json().catch(() => ({}));
   const patch = {};
@@ -13167,7 +13475,7 @@ var requireAgentMemory = async (c, next) => {
   await next();
 };
 function createMemoriesRouter() {
-  const router = new Hono25();
+  const router = new Hono26();
   for (const path of [
     "/:id/memories",
     "/:id/memories/*",
@@ -13240,7 +13548,7 @@ function createMemoriesRouter() {
   return router;
 }
 function createScopedMemoriesRouter() {
-  const router = new Hono25();
+  const router = new Hono26();
   router.use("*", requireAgentMemory);
   const workspace = (c) => ({
     scope: "workspace",
@@ -13299,218 +13607,6 @@ function createScopedMemoriesRouter() {
   return router;
 }
 
-// ../api/src/dashboard/onboarding-routes.ts
-import { Hono as Hono26 } from "hono";
-
-// ../api/src/dashboard/unique-channel-name.ts
-function uniqueChannelName(raw, taken) {
-  const base = raw.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "project";
-  let name = base;
-  for (let i = 2; taken.has(name); i += 1) name = `${base}-${i}`;
-  taken.add(name);
-  return name;
-}
-
-// ../api/src/dashboard/workspace-greeting.ts
-var GROQ_API_URL6 = "https://api.groq.com/openai/v1/chat/completions";
-var GREETING_MODEL = "openai/gpt-oss-20b";
-var TIMEOUT_MS = 6e3;
-var MAX_LISTED_CHANNELS = 8;
-var GUIDES = [
-  "Welcome to Flyspace",
-  "Working with the agent",
-  "Channels and folders",
-  "Docs",
-  "Sharing docs",
-  "Inviting your team",
-  "Automations"
-];
-var SYSTEM_PROMPT = `You write the first message a new Flyspace workspace owner sees, posted in their #general channel. Flyspace is a team chat where an AI agent works inside every channel.
-
-- Plain Markdown, 60 to 110 words, in English. No headings, no emoji, no em or en dashes, no sign-off.
-- Greet the owner by name and name the workspace.
-- Say that #general is public: everyone invited to the workspace can see it.
-- If project channels are listed, mention them as #name and say each one is linked to that project folder. Never invent a channel.
-- Mention the trial or the missing Host only if the facts say so.
-- If guides are listed, say they are in the Docs pane of #general and suggest starting with the first one.
-- Use only the facts given. Do not add buttons or a list of next steps: those are appended for you.`;
-function greetingButtons(input2) {
-  const buttons = [];
-  if (!input2.hostConnected) buttons.push("Connect a machine");
-  if (input2.channels[0]) buttons.push(`Summarise #${input2.channels[0]} for me`);
-  if (input2.hostConnected) buttons.push("Give me a quick tour of the guides");
-  if (input2.memberCount <= 1) buttons.push("Invite my team");
-  buttons.push("Set up a daily digest");
-  return buttons.slice(0, 3).map((b) => b.replace(/[|\]]/g, ""));
-}
-function fallbackGreeting(input2) {
-  const channels = input2.channels.slice(0, MAX_LISTED_CHANNELS).map((c) => `#${c}`);
-  return [
-    `Welcome to ${input2.workspaceName}, ${input2.ownerName}.`,
-    "This is #general. It is public, so everyone you invite to the workspace can see it.",
-    channels.length ? `Your project channels are ready: ${channels.join(", ")}. Each one is linked to its project folder, so the agent there works on the real files.` : "",
-    input2.hostConnected ? "A few short guides are waiting in the Docs pane of #general. Start with Welcome to Flyspace." : "",
-    "Mention the agent in any channel to get started."
-  ].filter(Boolean).join("\n\n");
-}
-async function groqGreeting(input2, apiKey) {
-  const facts = [
-    `Owner: ${input2.ownerName}`,
-    `Workspace: ${input2.workspaceName}`,
-    `Plan: ${input2.trialing ? "14-day free trial, just started" : "not on a trial"}`,
-    `Host: ${input2.hostConnected ? "a machine is connected, agents can run" : "no machine connected yet, agents cannot run until one is"}`,
-    `Project channels: ${input2.channels.slice(0, MAX_LISTED_CHANNELS).join(", ") || "(none yet)"}`,
-    `Members: ${input2.memberCount}`,
-    `Guides in #general: ${input2.hostConnected ? GUIDES.join(", ") : "(none, no machine connected)"}`
-  ].join("\n");
-  const res = await fetch(GROQ_API_URL6, {
-    method: "POST",
-    signal: AbortSignal.timeout(TIMEOUT_MS),
-    headers: { "content-type": "application/json", authorization: `Bearer ${apiKey}` },
-    body: JSON.stringify({
-      model: GREETING_MODEL,
-      temperature: 0.6,
-      // Reasoning model: the cap covers reasoning tokens too, so keep it roomy.
-      reasoning_effort: "low",
-      max_tokens: 900,
-      messages: [
-        { role: "system", content: SYSTEM_PROMPT },
-        { role: "user", content: facts }
-      ]
-    })
-  });
-  if (!res.ok) throw new Error(`Groq request failed (${res.status})`);
-  const data = await res.json();
-  const text = data.choices?.[0]?.message?.content?.replace(/\[BUTTONS:[^\]]*\]/g, "").replace(/\s*[–—]\s*/g, ", ").trim();
-  return text || null;
-}
-async function buildGreeting(input2) {
-  let text = null;
-  const apiKey = process.env["GROQ_API_KEY"];
-  if (apiKey) {
-    try {
-      text = await groqGreeting(input2, apiKey);
-    } catch (err) {
-      console.error("Workspace greeting failed, using the fixed template:", err);
-    }
-  }
-  return `${text ?? fallbackGreeting(input2)}
-
-[BUTTONS: ${greetingButtons(input2).join(" | ")}]`;
-}
-
-// ../api/src/dashboard/onboarding-routes.ts
-var MAX_FOLDERS = 20;
-function hostUnavailable(c, agent, method) {
-  return c.json({ error: "host offline", reason: agent.getHostCallFailure?.(method) ?? "offline" }, 503);
-}
-function createOnboardingRouter(agent) {
-  const app = new Hono26();
-  app.get("/scan", async (c) => {
-    const ctx = await resolveAuthContext(c);
-    if (ctx?.role !== "admin") return c.json({ error: "admin access required" }, 403);
-    const scan = await agent.scanOnboarding?.();
-    if (!scan) return hostUnavailable(c, agent, "scanOnboarding");
-    return c.json(scan);
-  });
-  app.post("/channels", async (c) => {
-    const ctx = await resolveAuthContext(c);
-    if (ctx?.role !== "admin") return c.json({ error: "admin access required" }, 403);
-    const body = await c.req.json().catch(() => ({}));
-    const runner = body["agent"];
-    const folders = Array.isArray(body["folders"]) ? body["folders"].filter((f) => typeof f === "string" && f.length > 0) : [];
-    if (folders.length > MAX_FOLDERS) return c.json({ error: `at most ${MAX_FOLDERS} folders` }, 400);
-    const scan = await agent.scanOnboarding?.();
-    if (!scan) return hostUnavailable(c, agent, "scanOnboarding");
-    const offered = new Map(scan.projects.map((p) => [p.path, p]));
-    const unknown = folders.find((f) => !offered.has(f));
-    if (unknown) return c.json({ error: "folder was not offered by the scan" }, 400);
-    const taken = new Set(getProfileChannelRegistry().map((ch) => ch.name));
-    taken.add("general");
-    const items = [{ name: "general" }];
-    for (const path of folders) items.push({ name: uniqueChannelName(offered.get(path).name, taken), path });
-    const linked = await agent.linkProjectFolders?.(getProfile(), items);
-    if (!linked) return hostUnavailable(c, agent, "linkProjectFolders");
-    if (runner === "claude" || runner === "codex") {
-      await agent.saveLocalDashboardSettings?.({ providers: [{ runner }] });
-    }
-    const created = [];
-    for (const l of linked) {
-      created.push(
-        l.name === "general" ? await ensureGeneralChannel() : await createChannel({ name: l.name, cwd: l.cwd })
-      );
-    }
-    await markWorkspaceProjectsSetup(ctx.workspaceId);
-    return c.json({ channels: created.map((ch) => ({ id: ch.id, name: ch.name })) }, 201);
-  });
-  app.post("/reset", async (c) => {
-    const ctx = await resolveAuthContext(c);
-    if (ctx?.role !== "admin") return c.json({ error: "admin access required" }, 403);
-    const { error: error2 } = await getSupabaseClient().from("threads").delete().eq("client_key", ctx.workspaceId);
-    if (error2) return c.json({ error: error2.message }, 500);
-    await resetWorkspaceOnboarding(ctx.workspaceId);
-    return c.json({ ok: true });
-  });
-  app.get("/greeting", async (c) => {
-    const ctx = await resolveAuthContext(c);
-    if (ctx?.role !== "admin") return c.json({ pending: false });
-    const greetedAt = await getWorkspaceGreetedAt(ctx.workspaceId);
-    const pending2 = !!ctx.projectsSetupAt && !greetedAt;
-    if (!pending2) return c.json({ pending: pending2, channelId: null, threadId: null });
-    const general = await ensureGeneralChannel();
-    const threadId = await ensureGreetingThread(ctx.workspaceId, general.id, ctx.name?.trim() || ctx.handle);
-    return c.json({ pending: pending2, channelId: general.id, threadId });
-  });
-  app.post("/greeting", async (c) => {
-    const ctx = await resolveAuthContext(c);
-    if (ctx?.role !== "admin") return c.json({ error: "admin access required" }, 403);
-    const supabase = getSupabaseClient();
-    const general = await ensureGeneralChannel();
-    const ownerName = ctx.name?.trim() || ctx.handle;
-    const threadId = await ensureGreetingThread(ctx.workspaceId, general.id, ownerName);
-    if (!threadId) return c.json({ error: "could not create the welcome thread" }, 500);
-    const done = { channelId: general.id, threadId };
-    const replied = await supabase.from("thread_replies").select("id").eq("thread_id", threadId).limit(1).maybeSingle();
-    if (replied.data) return c.json(done);
-    if (await getWorkspaceGreetedAt(ctx.workspaceId))
-      return c.json({ error: "already greeted" }, 409);
-    const [branding, billing, members] = await Promise.all([
-      getWorkspaceBranding(getProfile()).catch(() => null),
-      getWorkspaceBilling(ctx.workspaceId).catch(() => null),
-      listMemberships(ctx.workspaceId).catch(() => [])
-    ]);
-    const body = await buildGreeting({
-      ownerName,
-      workspaceName: branding?.displayName || getProfile(),
-      trialing: billing?.planStatus === "trialing",
-      hostConnected: !!ctx.agentConnectedAt,
-      channels: getProfileChannelRegistry().filter((ch) => !ch.isDefault && !ch.dmKey && !ch.agentName && !ch.archivedAt).map((ch) => ch.name),
-      memberCount: members.filter((m) => !m.isSupport).length
-    });
-    const again = await supabase.from("thread_replies").select("id").eq("thread_id", threadId).limit(1).maybeSingle();
-    if (again.data) return c.json(done);
-    const reply = await supabase.from("thread_replies").insert({ thread_id: threadId, author: AGENT_AUTHOR, body });
-    if (reply.error) return c.json({ error: reply.error.message }, 500);
-    await markWorkspaceGreeted(ctx.workspaceId);
-    return c.json(done, 201);
-  });
-  return app;
-}
-async function ensureGreetingThread(workspaceId, channelId, ownerName) {
-  const supabase = getSupabaseClient();
-  const existing = () => supabase.from("threads").select("id").eq("client_key", workspaceId).maybeSingle();
-  const found = await existing();
-  if (found.data) return found.data.id;
-  const { data, error: error2 } = await supabase.from("threads").insert({
-    channel_id: channelId,
-    title: `Welcome to your Flyspace, ${ownerName}!`,
-    author: AGENT_AUTHOR,
-    client_key: workspaceId
-  }).select("id").single();
-  if (data) return data.id;
-  return error2?.code === "23505" ? (await existing()).data?.id ?? null : null;
-}
-
 // ../api/src/dashboard/host-status-signal.ts
 var HOST_STATUS_CHANNEL = "host-status";
 var channelReady = null;
@@ -13610,6 +13706,7 @@ async function resolveThreadLinks(sessions2) {
 }
 
 // ../api/src/dashboard/data-api.ts
+var SELF_UPGRADE_MIN_VERSION = "0.1.30";
 function registerDataRoutes(api, agent = {}) {
   api.get("/profile", (c) => c.json({ profile: getProfile() }));
   api.get("/host/status", async (c) => {
@@ -13623,7 +13720,20 @@ function registerDataRoutes(api, agent = {}) {
     const cliVersion = agent.getHostCliVersion?.(getProfile()) ?? null;
     const latest2 = cliVersion ? await latestCliVersion() : null;
     const outdated = !!(cliVersion && latest2 && isOlderVersion(cliVersion, latest2));
-    return c.json({ online: !paused, cliVersion, ...outdated ? { latestCliVersion: latest2 } : {} });
+    const selfUpgrade = !!cliVersion && !isOlderVersion(cliVersion, SELF_UPGRADE_MIN_VERSION);
+    return c.json({
+      online: !paused,
+      cliVersion,
+      selfUpgrade,
+      ...outdated ? { latestCliVersion: latest2 } : {}
+    });
+  });
+  api.post("/host/upgrade", async (c) => {
+    const auth = c.get("auth");
+    if (!await isHostOwner(auth)) return c.json({ error: "only the Host owner can upgrade it" }, 403);
+    const res = await agent.upgradeHost?.();
+    if (!res) return c.json({ error: "Host is offline" }, 503);
+    return c.json(res, 202);
   });
   api.get("/channels", async (c) => {
     const auth = c.get("auth");
@@ -13811,9 +13921,9 @@ function registerDataRoutes(api, agent = {}) {
     void broadcastHostStatusChange();
     let cancelled = 0;
     if (body.paused) {
-      const running = await agent.listAgentRuns?.() ?? [];
-      if (running.length > 0) {
-        const { data } = await getSupabaseClient().from("threads").select("id, channel_id").in("id", running);
+      const running2 = await agent.listAgentRuns?.() ?? [];
+      if (running2.length > 0) {
+        const { data } = await getSupabaseClient().from("threads").select("id, channel_id").in("id", running2);
         const profile = getProfile();
         for (const t of data ?? []) {
           if (findOwningProfile(t.channel_id) !== profile) continue;
@@ -13831,7 +13941,7 @@ function registerDataRoutes(api, agent = {}) {
     const host = trustedHost(c);
     const known = await listKnownWorkspaces();
     const hostProfile = profileFromHost(host, known);
-    const running = new Set(await agent.listRunningProfiles?.() ?? []);
+    const running2 = new Set(await agent.listRunningProfiles?.() ?? []);
     const auth = c.get("auth");
     const [{ data: memberships }, workspaces] = await Promise.all([
       getSupabaseClient().from("memberships").select("workspace_id").eq("user_id", auth.userId),
@@ -13848,7 +13958,7 @@ function registerDataRoutes(api, agent = {}) {
         return {
           name,
           active: name === active,
-          running: running.has(name),
+          running: running2.has(name),
           displayName: branding.displayName,
           logo: branding.logo,
           hostname: (hostProfile ? workspaceHostname(host, name) : null) ?? void 0
@@ -14222,16 +14332,16 @@ function installSkillSync(profiles, options = {}) {
   if (!databaseReachable()) return () => {
   };
   const { intervalMs = SYNC_INTERVAL_MS, onError = (e) => console.error("[skill-sync]", e) } = options;
-  let running = false;
+  let running2 = false;
   const tick = async () => {
-    if (running) return;
-    running = true;
+    if (running2) return;
+    running2 = true;
     try {
       for (const profile of profiles) {
         await runWithProfile(profile, () => pushSkillScopes()).catch(onError);
       }
     } finally {
-      running = false;
+      running2 = false;
     }
   };
   void tick();
@@ -14671,7 +14781,7 @@ import {
   readSync as readSync2,
   readdirSync as readdirSync5,
   readFileSync as readFileSync20,
-  realpathSync as realpathSync3,
+  realpathSync as realpathSync4,
   renameSync,
   rmSync as rmSync8,
   statSync as statSync6,
@@ -14783,8 +14893,8 @@ var inFlight5 = /* @__PURE__ */ new Map();
 async function readOrCreateDocTranslation(input2) {
   const contentHash = translationHash(input2.title, input2.content);
   const key = `${input2.channelId}:${input2.sourcePath}:${contentHash}:${input2.lang}`;
-  const running = inFlight5.get(key);
-  if (running) return running;
+  const running2 = inFlight5.get(key);
+  if (running2) return running2;
   const job = (async () => {
     const cached = await getDocTranslation(input2.channelId, input2.sourcePath, input2.lang, contentHash);
     if (cached) return cached;
@@ -17514,7 +17624,7 @@ function moveDocEntry(root, from, to) {
     return { status: "into-self" };
   }
   try {
-    if (realpathSync3(finalAbs) !== realpathSync3(absFrom)) return { status: "exists" };
+    if (realpathSync4(finalAbs) !== realpathSync4(absFrom)) return { status: "exists" };
   } catch {
   }
   renameSync(absFrom, finalAbs);
@@ -18741,6 +18851,26 @@ function readDocShareBundle({ cwd, sourcePath }) {
   return { status: "ok", kind, title, content: content + renderAttachments(attachments), assets };
 }
 
+// src/dashboard/host-upgrade.ts
+import { spawn as spawn7 } from "child_process";
+import { mkdirSync as mkdirSync13, openSync as openSync3 } from "fs";
+import { join as join27 } from "path";
+var running = false;
+function startHostUpgrade() {
+  if (running) return { started: false };
+  mkdirSync13(paths.LOG_DIR, { recursive: true });
+  const log5 = openSync3(join27(paths.LOG_DIR, "host-upgrade.log"), "a");
+  const child = spawn7(process.execPath, [process.argv[1] ?? "", "upgrade"], {
+    detached: true,
+    stdio: ["ignore", log5, log5]
+  });
+  running = true;
+  child.on("exit", () => running = false);
+  child.on("error", () => running = false);
+  child.unref();
+  return { started: true };
+}
+
 // src/dashboard/agent-bridge-host.ts
 var HOSTED_DATA_SOCKET_ORIGIN = "wss://flyspace-api.fly.dev";
 function dataSocketUrl() {
@@ -18781,7 +18911,8 @@ function localAgentCallbacks(chatAgent) {
     docsRequest: (req) => handleDocsRequest(req),
     hostRequest: (req) => handleHostRequest(req),
     listSessions: () => listLocalSessions(),
-    scanOnboarding: () => scanOnboarding(),
+    upgradeHost: () => startHostUpgrade(),
+    scanOnboarding: (slug) => scanOnboarding(slug),
     linkProjectFolders: (slug, items) => linkProjectFolders(slug, items),
     isHostOnline: () => true
   };
@@ -19038,7 +19169,7 @@ function startPushWatcher() {
 
 // src/dashboard/machine-server.ts
 import { existsSync as existsSync31 } from "fs";
-import { join as join27 } from "path";
+import { join as join28 } from "path";
 import { serveStatic } from "@hono/node-server/serve-static";
 
 // src/dashboard/app-icon-routes.ts
@@ -19120,7 +19251,7 @@ function pngResponse(c, png) {
 }
 
 // src/dashboard/machine-server.ts
-var WEB_DIST = join27(paths.WEB_ROOT, "dist");
+var WEB_DIST = join28(paths.WEB_ROOT, "dist");
 async function bootMachine() {
   await reconcileAll().catch(
     (err) => console.error("[dashboard] reconcileAll failed:", err.message)
@@ -19140,14 +19271,14 @@ async function bootMachine() {
 function mountSpa(app) {
   app.route("/share", createPublicShareAssetRouter(WEB_DIST));
   app.route("/", createAppIconRouter());
-  if (existsSync31(WEB_DIST) || existsSync31(join27(paths.WEB_ROOT, "package.json"))) {
+  if (existsSync31(WEB_DIST) || existsSync31(join28(paths.WEB_ROOT, "package.json"))) {
     app.use("/*", serveStatic({ root: WEB_DIST }));
   }
   app.get("/assets/*", (c) => c.text("stale asset \u2014 reload for the current build", 404));
-  const spaFallback = serveStatic({ path: join27(WEB_DIST, "index.html") });
+  const spaFallback = serveStatic({ path: join28(WEB_DIST, "index.html") });
   app.get("*", async (c, next) => {
-    if (!existsSync31(join27(WEB_DIST, "index.html"))) {
-      const isCheckout = existsSync31(join27(paths.WEB_ROOT, "package.json"));
+    if (!existsSync31(join28(WEB_DIST, "index.html"))) {
+      const isCheckout = existsSync31(join28(paths.WEB_ROOT, "package.json"));
       return c.text(
         isCheckout ? `Workspace UI build missing (${WEB_DIST}).
 Run \`pnpm build:web\` from the repo root.
@@ -19276,13 +19407,13 @@ function flagValue(args, name) {
 function openBrowser2(url) {
   const cmd = platform7() === "darwin" ? "open" : platform7() === "win32" ? "start" : "xdg-open";
   try {
-    spawn7(cmd, [url], { stdio: "ignore", detached: true }).unref();
+    spawn8(cmd, [url], { stdio: "ignore", detached: true }).unref();
   } catch {
   }
 }
 function ensureWebBuild() {
-  if (existsSync32(join28(paths.WEB_ROOT, "dist", "index.html"))) return;
-  if (!existsSync32(join28(paths.WEB_ROOT, "package.json"))) return;
+  if (existsSync32(join29(paths.WEB_ROOT, "dist", "index.html"))) return;
+  if (!existsSync32(join29(paths.WEB_ROOT, "package.json"))) return;
   console.log("  packages/ui/dist missing, building the dashboard UI...");
   const result = spawnSync("pnpm", ["build"], {
     cwd: paths.WEB_ROOT,
@@ -19332,7 +19463,7 @@ async function runDashboard(args) {
 }
 
 // src/commands/workspace.ts
-import { existsSync as existsSync33, mkdirSync as mkdirSync13, writeFileSync as writeFileSync13 } from "fs";
+import { existsSync as existsSync33, mkdirSync as mkdirSync14, writeFileSync as writeFileSync13 } from "fs";
 var USAGE7 = `
   Usage: flyspace workspace <subcommand> [options]
 
@@ -19436,7 +19567,7 @@ async function provisionChannels(specs) {
     }
     const cwd = expandPath(spec.cwd);
     if (!existsSync33(cwd)) {
-      mkdirSync13(cwd, { recursive: true });
+      mkdirSync14(cwd, { recursive: true });
       console.log(`  created cwd ${cwd}`);
     }
     await createChannel({ name: spec.name, cwd, position: index });
@@ -19513,10 +19644,10 @@ async function runReconcileCmd(args) {
 }
 
 // src/cli.ts
-import { join as join29 } from "path";
+import { join as join30 } from "path";
 var home = flyspaceHome();
 if (home) {
-  const bin = join29(home, "bin");
+  const bin = join30(home, "bin");
   const path = process.env.PATH ?? "";
   if (!path.split(":").includes(bin)) process.env.PATH = path ? `${bin}:${path}` : bin;
 }
@@ -19654,7 +19785,7 @@ async function main() {
       break;
     case "-v":
     case "--version":
-      printRaw("0.1.27");
+      printRaw("0.1.30");
       break;
     case "-h":
     case "--help":