flyspace-cli 0.1.5 → 0.1.7

package/dist/cli.js

@@ -430,13 +430,352 @@ async function runConfig(args) {
 }
 
 // src/commands/setup.ts
-import { mkdirSync as mkdirSync4 } from "fs";
+import { execSync as execSync4 } from "child_process";
+import { mkdirSync as mkdirSync5 } from "fs";
+import { join as join7 } from "path";
+import { confirm as confirm2 } from "@inquirer/prompts";
+
+// src/service.ts
+import { execSync } from "child_process";
+import { existsSync as existsSync3 } from "fs";
+import { join as join2 } from "path";
+import { homedir, platform } from "os";
+function serviceLabel(profile) {
+  return profile === DEFAULT_PROFILE ? "ai.flyspace" : `ai.flyspace.${profile}`;
+}
+function plistName(profile) {
+  return `${serviceLabel(profile)}.plist`;
+}
+function plistPath(profile) {
+  return join2(homedir(), "Library", "LaunchAgents", plistName(profile));
+}
+function legacyServiceLabel(profile) {
+  return profile === DEFAULT_PROFILE ? "io.flycoder.flyspace" : `io.flycoder.flyspace.${profile}`;
+}
+function legacyPlistPath(profile) {
+  return join2(homedir(), "Library", "LaunchAgents", `${legacyServiceLabel(profile)}.plist`);
+}
+function systemdUnitName(profile) {
+  return profile === DEFAULT_PROFILE ? "flyspace" : `flyspace-${profile}`;
+}
+function systemdUnitPath(profile) {
+  return join2(homedir(), ".config", "systemd", "user", `${systemdUnitName(profile)}.service`);
+}
+function isServiceInstalled(profile) {
+  if (platform() === "darwin") return existsSync3(plistPath(profile));
+  if (platform() === "linux") return existsSync3(systemdUnitPath(profile));
+  return false;
+}
+function restartService(profile) {
+  const os = platform();
+  if (os === "darwin") {
+    const plist = plistPath(profile);
+    try {
+      execSync(`launchctl unload "${plist}"`, { stdio: "pipe" });
+    } catch {
+    }
+    try {
+      execSync(`launchctl load "${plist}"`, { stdio: "pipe" });
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  if (os === "linux") {
+    try {
+      execSync(`systemctl --user restart ${systemdUnitName(profile)}`, { stdio: "pipe" });
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  return false;
+}
+var HOST_SERVICE_LABEL = "ai.flyspace.dashboard";
+var HOST_SYSTEMD_UNIT = "flyspace-host";
+function hostPlistPath() {
+  return join2(homedir(), "Library", "LaunchAgents", `${HOST_SERVICE_LABEL}.plist`);
+}
+function isHostServiceInstalled() {
+  if (platform() === "darwin") return existsSync3(hostPlistPath());
+  if (platform() === "linux") {
+    return existsSync3(join2(homedir(), ".config", "systemd", "user", `${HOST_SYSTEMD_UNIT}.service`));
+  }
+  return false;
+}
+function restartHostService() {
+  const os = platform();
+  try {
+    if (os === "darwin") {
+      execSync(`launchctl kickstart -k gui/${process.getuid?.()}/${HOST_SERVICE_LABEL}`, { stdio: "pipe" });
+      return true;
+    }
+    if (os === "linux") {
+      execSync(`systemctl --user restart ${HOST_SYSTEMD_UNIT}`, { stdio: "pipe" });
+      return true;
+    }
+  } catch {
+  }
+  return false;
+}
+
+// src/commands/install.ts
+import { existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync3, unlinkSync } from "fs";
+import { execSync as execSync2 } from "child_process";
+import { dirname as dirname2, join as join3, resolve as resolve3 } from "path";
+import { homedir as homedir2, platform as platform2 } from "os";
+function log(msg) {
+  console.log(`
+\x1B[36m>\x1B[0m ${msg}`);
+}
+function success(msg) {
+  console.log(`\x1B[32m+\x1B[0m ${msg}`);
+}
+function warn(msg) {
+  console.log(`\x1B[33m!\x1B[0m ${msg}`);
+}
+function run(cmd, opts = {}) {
+  return execSync2(cmd, {
+    encoding: "utf-8",
+    stdio: opts.silent ? "pipe" : "inherit"
+  }).toString().trim();
+}
+function detectClaudeBinDir() {
+  try {
+    const claudePath = execSync2("which claude", { encoding: "utf-8", stdio: "pipe" }).trim();
+    return claudePath ? dirname2(claudePath) : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function detectCustieBin() {
+  const argv1 = process.argv[1];
+  if (argv1) {
+    return resolve3(argv1);
+  }
+  try {
+    return run("which flyspace", { silent: true });
+  } catch {
+    return "flyspace";
+  }
+}
+function readEnvFile() {
+  if (!existsSync4(paths.CONFIG_FILE)) return {};
+  const vars = {};
+  for (const line of readFileSync3(paths.CONFIG_FILE, "utf-8").split("\n")) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    const eq = trimmed.indexOf("=");
+    if (eq === -1) continue;
+    const key = trimmed.slice(0, eq).trim();
+    const val = trimmed.slice(eq + 1).trim();
+    if (val) vars[key] = val;
+  }
+  return vars;
+}
+function escapeXml(str) {
+  return str.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+function profileSpec() {
+  const profile = getProfile();
+  return {
+    label: serviceLabel(profile),
+    plistPath: plistPath(profile),
+    unitName: systemdUnitName(profile),
+    description: `Flyspace agent host${profile === "default" ? "" : ` (${profile})`}`,
+    // The default profile keeps the bare `start` args so its plist stays
+    // byte-for-byte identical to pre-profile installs (no reinstall needed).
+    args: profile === "default" ? ["start"] : ["start", "--profile", profile],
+    env: readEnvFile(),
+    logName: "custie"
+  };
+}
+function hostSpec() {
+  return {
+    label: HOST_SERVICE_LABEL,
+    plistPath: hostPlistPath(),
+    unitName: HOST_SYSTEMD_UNIT,
+    description: "Flyspace agent Host",
+    args: ["dashboard", "--mode", "host", "--no-open"],
+    env: {},
+    logName: "host"
+  };
+}
+async function installMacOS(spec) {
+  log("Setting up macOS LaunchAgent...");
+  const custieBin = detectCustieBin();
+  const nodePath = process.execPath;
+  const claudeBinDir = detectClaudeBinDir();
+  const logDir = paths.LOG_DIR;
+  mkdirSync2(logDir, { recursive: true });
+  const envVars = spec.env;
+  const homebrewBin = existsSync4("/opt/homebrew/bin") ? "/opt/homebrew/bin" : void 0;
+  const asdfShims = join3(homedir2(), ".asdf", "shims");
+  const asdfBin = existsSync4(asdfShims) ? asdfShims : void 0;
+  const pathParts = [
+    dirname2(nodePath),
+    claudeBinDir,
+    asdfBin,
+    homebrewBin,
+    "/usr/local/bin",
+    "/usr/bin",
+    "/bin"
+  ].filter(Boolean);
+  const programArgsXml = [custieBin, ...spec.args].map((a) => `    <string>${escapeXml(a)}</string>`).join("\n");
+  const plist = `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
+  "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>${spec.label}</string>
+
+  <key>ProgramArguments</key>
+  <array>
+${programArgsXml}
+  </array>
+
+  <key>EnvironmentVariables</key>
+  <dict>
+    <key>PATH</key>
+    <string>${pathParts.join(":")}</string>
+${Object.entries(envVars).map(([k, v]) => `    <key>${k}</key>
+    <string>${escapeXml(v)}</string>`).join("\n")}
+  </dict>
+
+  <key>RunAtLoad</key>
+  <true/>
+
+  <key>KeepAlive</key>
+  <true/>
+
+  <key>StandardOutPath</key>
+  <string>${join3(logDir, `${spec.logName}.log`)}</string>
+
+  <key>StandardErrorPath</key>
+  <string>${join3(logDir, `${spec.logName}-error.log`)}</string>
+</dict>
+</plist>`;
+  const agentPlistPath = spec.plistPath;
+  mkdirSync2(dirname2(agentPlistPath), { recursive: true });
+  try {
+    run(`launchctl unload "${agentPlistPath}"`, { silent: true });
+  } catch {
+  }
+  try {
+    unlinkSync(agentPlistPath);
+  } catch {
+  }
+  writeFileSync3(agentPlistPath, plist);
+  run(`launchctl load "${agentPlistPath}"`, { silent: true });
+  success(`LaunchAgent installed and loaded (${spec.label}).`);
+  console.log(`  Logs: ${logDir}`);
+  console.log(`  Check: launchctl list | grep flyspace`);
+}
+async function installLinux(spec) {
+  log("Setting up systemd user service...");
+  const custieBin = detectCustieBin();
+  const nodePath = process.execPath;
+  const claudeBinDir = detectClaudeBinDir();
+  const logDir = paths.LOG_DIR;
+  mkdirSync2(logDir, { recursive: true });
+  const envLines = Object.entries(spec.env).map(([k, v]) => `Environment="${k}=${v}"`).join("\n");
+  const linuxbrewBin = existsSync4("/home/linuxbrew/.linuxbrew/bin") ? "/home/linuxbrew/.linuxbrew/bin" : void 0;
+  const pathParts = [
+    dirname2(nodePath),
+    claudeBinDir,
+    linuxbrewBin,
+    "/usr/local/bin",
+    "/usr/bin",
+    "/bin"
+  ].filter(Boolean);
+  const execStart = [custieBin, ...spec.args].join(" ");
+  const unit = `[Unit]
+Description=${spec.description}
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+ExecStart=${execStart}
+Restart=on-failure
+RestartSec=5
+${envLines}
+Environment="PATH=${pathParts.join(":")}"
+
+StandardOutput=append:${join3(logDir, `${spec.logName}.log`)}
+StandardError=append:${join3(logDir, `${spec.logName}-error.log`)}
+
+[Install]
+WantedBy=default.target
+`;
+  const unitName = spec.unitName;
+  const unitDir = join3(homedir2(), ".config", "systemd", "user");
+  mkdirSync2(unitDir, { recursive: true });
+  writeFileSync3(join3(unitDir, `${unitName}.service`), unit);
+  run("systemctl --user daemon-reload", { silent: true });
+  run(`systemctl --user enable --now ${unitName}`, { silent: true });
+  success(`systemd user service installed and started (${unitName}).`);
+  console.log(`  Logs: ${logDir}`);
+  console.log(`  Check: systemctl --user status ${unitName}`);
+}
+async function installService(spec) {
+  const os = platform2();
+  if (os === "darwin") await installMacOS(spec);
+  else if (os === "linux") await installLinux(spec);
+  else {
+    warn(`Unsupported platform: ${os}. You'll need to configure autostart manually.`);
+    return false;
+  }
+  return true;
+}
+async function runInstall() {
+  ensureDirs();
+  await installService(profileSpec());
+}
+async function installHostService() {
+  ensureDirs();
+  return installService(hostSpec());
+}
+
+// src/commands/profiles.ts
+import { existsSync as existsSync5, readdirSync, statSync } from "fs";
+import { execSync as execSync3 } from "child_process";
 import { join as join4 } from "path";
+import { platform as platform3 } from "os";
+function listProfiles() {
+  const profiles = [];
+  if (existsSync5(paths.PROFILES_DIR)) {
+    for (const entry of readdirSync(paths.PROFILES_DIR)) {
+      try {
+        if (statSync(join4(paths.PROFILES_DIR, entry)).isDirectory()) {
+          profiles.push(entry);
+        }
+      } catch {
+      }
+    }
+  }
+  return profiles;
+}
+function isServiceRunning(profile) {
+  try {
+    if (platform3() === "darwin") {
+      const out = execSync3("launchctl list", { encoding: "utf-8", stdio: "pipe" });
+      return out.split("\n").some((line) => line.endsWith(`	${serviceLabel(profile)}`));
+    }
+    if (platform3() === "linux") {
+      execSync3(`systemctl --user is-active ${systemdUnitName(profile)}`, { stdio: "pipe" });
+      return true;
+    }
+  } catch {
+  }
+  return false;
+}
 
 // src/auth/device-auth.ts
 import { createPrivateKey, createPublicKey, generateKeyPairSync, sign } from "crypto";
-import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync3, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
-import { dirname as dirname2, join as join2 } from "path";
+import { existsSync as existsSync6, mkdirSync as mkdirSync3, readFileSync as readFileSync4, rmSync as rmSync2, writeFileSync as writeFileSync4 } from "fs";
+import { dirname as dirname3, join as join5 } from "path";
 var DEFAULT_API_URL = "https://app.flyspace.ai";
 var EXPIRY_SKEW_MS = 6e4;
 var AuthApiError = class extends Error {
@@ -450,36 +789,36 @@ function apiUrl() {
   return (process.env["FLYSPACE_API_URL"] || DEFAULT_API_URL).replace(/\/+$/, "");
 }
 function deviceKeyPath() {
-  return join2(paths.BASE_CONFIG_DIR, "device.key");
+  return join5(paths.BASE_CONFIG_DIR, "device.key");
 }
 function credentialsPath() {
-  return join2(paths.BASE_CONFIG_DIR, "credentials.json");
+  return join5(paths.BASE_CONFIG_DIR, "credentials.json");
 }
 function ensureDeviceKey(path = deviceKeyPath()) {
   let created = false;
-  if (!existsSync3(path)) {
+  if (!existsSync6(path)) {
     const { privateKey: privateKey2 } = generateKeyPairSync("ed25519");
-    mkdirSync2(dirname2(path), { recursive: true });
-    writeFileSync3(path, privateKey2.export({ type: "pkcs8", format: "pem" }), { mode: 384 });
+    mkdirSync3(dirname3(path), { recursive: true });
+    writeFileSync4(path, privateKey2.export({ type: "pkcs8", format: "pem" }), { mode: 384 });
     created = true;
   }
-  const privateKey = createPrivateKey(readFileSync3(path, "utf8"));
+  const privateKey = createPrivateKey(readFileSync4(path, "utf8"));
   const publicKeyBase64 = createPublicKey(privateKey).export({ type: "spki", format: "der" }).toString(
     "base64"
   );
   return { privateKey, publicKeyBase64, created };
 }
 function loadCredentials(path = credentialsPath()) {
-  if (!existsSync3(path)) return null;
+  if (!existsSync6(path)) return null;
   try {
-    return JSON.parse(readFileSync3(path, "utf8"));
+    return JSON.parse(readFileSync4(path, "utf8"));
   } catch {
     return null;
   }
 }
 function saveCredentials(creds, path = credentialsPath()) {
-  mkdirSync2(dirname2(path), { recursive: true });
-  writeFileSync3(path, `${JSON.stringify(creds, null, 2)}
+  mkdirSync3(dirname3(path), { recursive: true });
+  writeFileSync4(path, `${JSON.stringify(creds, null, 2)}
 `, { mode: 384 });
 }
 function clearLocalAuth() {
@@ -585,6 +924,17 @@ async function fetchWhoAmI(base, token) {
     workspaces: toSlugs(json["workspaces"])
   };
 }
+async function boundWorkspaces() {
+  const creds = loadCredentials();
+  if (!creds) return null;
+  try {
+    const me = await fetchWhoAmI(creds.apiUrl, await getAccessToken());
+    saveCredentials({ ...loadCredentials() ?? creds, workspaces: me.workspaces });
+    return { workspaces: me.workspaces, fresh: true };
+  } catch {
+    return { workspaces: creds.workspaces ?? [], fresh: false };
+  }
+}
 async function revokeDevice(base, token) {
   await expectOk(await post(base, "/api/auth/device/revoke", {}, token), "Revoking this device");
 }
@@ -603,20 +953,20 @@ async function getAccessToken() {
 // src/dashboard/onboarding-scan.ts
 import { execFileSync } from "child_process";
 import {
-  existsSync as existsSync4,
+  existsSync as existsSync7,
   lstatSync,
-  mkdirSync as mkdirSync3,
-  readdirSync,
-  readFileSync as readFileSync4,
-  statSync,
+  mkdirSync as mkdirSync4,
+  readdirSync as readdirSync2,
+  readFileSync as readFileSync5,
+  statSync as statSync2,
   symlinkSync
 } from "fs";
-import { homedir } from "os";
-import { basename, join as join3, resolve as resolve3 } from "path";
+import { homedir as homedir3 } from "os";
+import { basename, join as join6, resolve as resolve4 } from "path";
 var MAX_JSONL_HEAD_BYTES = 64 * 1024;
 var GIT_SCAN_ROOTS = ["Workspaces", "Projects", "code"];
 function flyspaceRoot() {
-  return process.env["FLYSPACE_ROOT"] || join3(homedir(), "Flyspace");
+  return process.env["FLYSPACE_ROOT"] || join6(homedir3(), "Flyspace");
 }
 function onPath(cmd) {
   try {
@@ -627,16 +977,16 @@ function onPath(cmd) {
   }
 }
 function claudeDir() {
-  return process.env["CLAUDE_CONFIG_DIR"] || join3(homedir(), ".claude");
+  return process.env["CLAUDE_CONFIG_DIR"] || join6(homedir3(), ".claude");
 }
 function codexDir() {
-  return process.env["CODEX_HOME"] || join3(homedir(), ".codex");
+  return process.env["CODEX_HOME"] || join6(homedir3(), ".codex");
 }
 function claudeLoggedIn() {
   if (process.env["ANTHROPIC_API_KEY"]) return true;
-  if (existsSync4(join3(claudeDir(), ".credentials.json"))) return true;
+  if (existsSync7(join6(claudeDir(), ".credentials.json"))) return true;
   try {
-    const raw = JSON.parse(readFileSync4(join3(homedir(), ".claude.json"), "utf-8"));
+    const raw = JSON.parse(readFileSync5(join6(homedir3(), ".claude.json"), "utf-8"));
     if (raw.oauthAccount) return true;
   } catch {
   }
@@ -651,23 +1001,23 @@ function claudeLoggedIn() {
   }
 }
 function codexLoggedIn() {
-  return !!process.env["OPENAI_API_KEY"] || existsSync4(join3(codexDir(), "auth.json"));
+  return !!process.env["OPENAI_API_KEY"] || existsSync7(join6(codexDir(), "auth.json"));
 }
 function jsonlFiles(dir, depth) {
   const out = [];
   let entries2;
   try {
-    entries2 = readdirSync(dir, { withFileTypes: true });
+    entries2 = readdirSync2(dir, { withFileTypes: true });
   } catch {
     return out;
   }
   for (const e of entries2) {
-    const full = join3(dir, e.name);
+    const full = join6(dir, e.name);
     if (e.isDirectory()) {
       if (depth > 0) out.push(...jsonlFiles(full, depth - 1));
     } else if (e.name.endsWith(".jsonl")) {
       try {
-        out.push({ file: full, mtime: statSync(full).mtimeMs });
+        out.push({ file: full, mtime: statSync2(full).mtimeMs });
       } catch {
       }
     }
@@ -677,7 +1027,7 @@ function jsonlFiles(dir, depth) {
 function cwdFromTranscript(file) {
   let head;
   try {
-    head = readFileSync4(file, { encoding: "utf-8", flag: "r" }).slice(0, MAX_JSONL_HEAD_BYTES);
+    head = readFileSync5(file, { encoding: "utf-8", flag: "r" }).slice(0, MAX_JSONL_HEAD_BYTES);
   } catch {
     return null;
   }
@@ -694,38 +1044,38 @@ function cwdFromTranscript(file) {
 }
 function codexTrustedPaths() {
   try {
-    const toml = readFileSync4(join3(codexDir(), "config.toml"), "utf-8");
+    const toml = readFileSync5(join6(codexDir(), "config.toml"), "utf-8");
     return [...toml.matchAll(/^\[projects\.(?:"([^"]+)"|'([^']+)')\]/gm)].map((m) => m[1] ?? m[2]);
   } catch {
     return [];
   }
 }
 function isExcluded(path) {
-  const home = homedir();
+  const home = homedir3();
   if (path === home || path === "/") return true;
   if (path === "/tmp" || path.startsWith("/tmp/")) return true;
   if (path === "/private/tmp" || path.startsWith("/private/tmp/")) return true;
   const root = flyspaceRoot();
   if (path === root || path.startsWith(`${root}/`)) return true;
   try {
-    return !statSync(path).isDirectory();
+    return !statSync2(path).isDirectory();
   } catch {
     return true;
   }
 }
 function gitRepos() {
-  const home = homedir();
+  const home = homedir3();
   const found = [];
   for (const rootName of GIT_SCAN_ROOTS) {
-    const root = join3(home, rootName);
+    const root = join6(home, rootName);
     let entries2;
     try {
-      entries2 = readdirSync(root, { withFileTypes: true });
+      entries2 = readdirSync2(root, { withFileTypes: true });
     } catch {
       continue;
     }
     for (const e of entries2) {
-      if (e.isDirectory() && existsSync4(join3(root, e.name, ".git"))) found.push(join3(root, e.name));
+      if (e.isDirectory() && existsSync7(join6(root, e.name, ".git"))) found.push(join6(root, e.name));
     }
   }
   return found;
@@ -750,7 +1100,7 @@ function scanOnboarding() {
   const byPath = /* @__PURE__ */ new Map();
   const history = { claude: false, codex: false };
   const add = (rawPath, source, mtime, sessions, trusted = false) => {
-    const path = resolve3(rawPath);
+    const path = resolve4(rawPath);
     if (isExcluded(path)) return;
     const existing = byPath.get(path);
     if (existing) {
@@ -769,11 +1119,11 @@ function scanOnboarding() {
       });
     }
   };
-  const claudeProjects = join3(claudeDir(), "projects");
+  const claudeProjects = join6(claudeDir(), "projects");
   try {
-    for (const e of readdirSync(claudeProjects, { withFileTypes: true })) {
+    for (const e of readdirSync2(claudeProjects, { withFileTypes: true })) {
       if (!e.isDirectory()) continue;
-      const files = jsonlFiles(join3(claudeProjects, e.name), 0);
+      const files = jsonlFiles(join6(claudeProjects, e.name), 0);
       if (!files.length) continue;
       history.claude = true;
       files.sort((a, b) => b.mtime - a.mtime);
@@ -786,7 +1136,7 @@ function scanOnboarding() {
     }
   } catch {
   }
-  const codexSessions = jsonlFiles(join3(codexDir(), "sessions"), 4);
+  const codexSessions = jsonlFiles(join6(codexDir(), "sessions"), 4);
   if (codexSessions.length) history.codex = true;
   const perCwd = /* @__PURE__ */ new Map();
   for (const f of codexSessions) {
@@ -806,7 +1156,7 @@ function scanOnboarding() {
     for (const repo of gitRepos()) {
       let mtime = 0;
       try {
-        mtime = statSync(repo).mtimeMs;
+        mtime = statSync2(repo).mtimeMs;
       } catch {
       }
       add(repo, "git", mtime, 0);
@@ -828,12 +1178,12 @@ function makeLink(target, linkPath) {
 }
 function linkProjectFolders(slug, items) {
   if (!/^[a-z0-9][a-z0-9-]*$/.test(slug)) throw new Error(`invalid workspace slug: ${slug}`);
-  const dir = join3(flyspaceRoot(), slug);
-  mkdirSync3(dir, { recursive: true });
+  const dir = join6(flyspaceRoot(), slug);
+  mkdirSync4(dir, { recursive: true });
   const results = [];
   for (const item of items) {
     if (!/^[a-z0-9][a-z0-9-]*$/.test(item.name)) throw new Error(`invalid channel name: ${item.name}`);
-    const dest = join3(dir, item.name);
+    const dest = join6(dir, item.name);
     let exists = true;
     try {
       lstatSync(dest);
@@ -842,11 +1192,11 @@ function linkProjectFolders(slug, items) {
     }
     if (!exists) {
       if (item.path) {
-        const target = resolve3(item.path);
-        if (!statSync(target).isDirectory()) throw new Error(`not a directory: ${target}`);
+        const target = resolve4(item.path);
+        if (!statSync2(target).isDirectory()) throw new Error(`not a directory: ${target}`);
         makeLink(target, dest);
       } else {
-        mkdirSync3(dest, { recursive: true });
+        mkdirSync4(dest, { recursive: true });
       }
     }
     results.push({ name: item.name, cwd: `${slug}/${item.name}` });
@@ -857,7 +1207,7 @@ function linkProjectFolders(slug, items) {
 // src/commands/auth.ts
 import { spawn as spawn3 } from "child_process";
 import { confirm } from "@inquirer/prompts";
-import { hostname, platform, release } from "os";
+import { hostname, platform as platform4, release } from "os";
 var BOLD = "\x1B[1m";
 var DIM = "\x1B[2m";
 var GREEN = "\x1B[32m";
@@ -891,8 +1241,8 @@ function defaultDeviceName() {
   return hostname().replace(/\.local$/, "");
 }
 function platformLabel() {
-  if (platform() === "darwin") return `macOS (Darwin ${release()})`;
-  return `${platform()} ${release()}`;
+  if (platform4() === "darwin") return `macOS (Darwin ${release()})`;
+  return `${platform4()} ${release()}`;
 }
 function formatCountdown(ms) {
   const s = Math.max(0, Math.round(ms / 1e3));
@@ -900,7 +1250,7 @@ function formatCountdown(ms) {
 }
 function openBrowser(url) {
   if (process.env["SSH_CONNECTION"] || process.env["SSH_TTY"]) return false;
-  const cmd = platform() === "darwin" ? "open" : platform() === "win32" ? "explorer" : "xdg-open";
+  const cmd = platform4() === "darwin" ? "open" : platform4() === "win32" ? "explorer" : "xdg-open";
   try {
     const child = spawn3(cmd, [url], { stdio: "ignore", detached: true });
     child.on("error", () => {
@@ -1146,350 +1496,172 @@ async function runAuthCmd(args) {
       await login(args.slice(1));
       break;
     case "status":
-      await runStatus();
-      break;
-    case "logout":
-      await runLogout(args.slice(1));
-      break;
-    case "-h":
-    case "--help":
-    case void 0:
-      console.log(HELP);
-      break;
-    default:
-      console.error(`Unknown auth command: ${sub}`);
-      console.log(HELP);
-      process.exit(1);
-  }
-}
-
-// src/commands/setup.ts
-var BOLD2 = "\x1B[1m";
-var DIM2 = "\x1B[2m";
-var GREEN2 = "\x1B[32m";
-var YELLOW2 = "\x1B[33m";
-var RESET2 = "\x1B[0m";
-var HELP2 = `
-  Usage: flyspace setup [options]
-
-  Logs this machine in as a Host, checks for the claude / codex CLIs, and
-  creates ~/Flyspace/<workspace>/ for each workspace it serves. Safe to re-run.
-
-  Options:
-    --name <name>    Device name shown in the Workspace (default: hostname)
-    --no-browser     Only print the approval URL, don't open a browser
-
-  To switch accounts, run: flyspace auth login --force
-`;
-var RUNNER_HINTS = {
-  claude: { install: "npm install -g @anthropic-ai/claude-code", login: "claude" },
-  codex: { install: "npm install -g @openai/codex", login: "codex login" }
-};
-var tilde2 = (p) => p.replace(process.env["HOME"] ?? "\0", "~");
-var ok = (msg) => console.log(`  ${GREEN2}\u2713${RESET2} ${msg}`);
-var bad = (msg) => console.log(`  ${YELLOW2}\u2717${RESET2} ${msg}`);
-async function servedWorkspaces() {
-  const creds = loadCredentials();
-  try {
-    const me = await fetchWhoAmI(creds.apiUrl, await getAccessToken());
-    saveCredentials({ ...loadCredentials() ?? creds, workspaces: me.workspaces });
-    return me.workspaces;
-  } catch {
-    console.log(`  ${DIM2}Couldn't reach the server; using the workspaces saved at login.${RESET2}`);
-    return creds.workspaces ?? [];
-  }
-}
-async function runSetup(args) {
-  if (args.includes("-h") || args.includes("--help")) return void console.log(HELP2);
-  console.log(`
-${BOLD2}Flyspace Setup${RESET2}
-`);
-  const existing = loadCredentials();
-  if (existing) {
-    ok(`Logged in as ${existing.userEmail} on ${existing.deviceName}`);
-  } else {
-    await login(args);
-  }
-  const workspaces = await servedWorkspaces();
-  if (workspaces.length) ok(`Serving ${workspaces.join(", ")}`);
-  else bad(`Not serving any workspace. Only workspace admins can add a Host.`);
-  const runners = detectRunners();
-  for (const r of runners) {
-    if (!r.installed) bad(`${r.id} not installed   ${DIM2}${RUNNER_HINTS[r.id].install}${RESET2}`);
-    else if (!r.loggedIn) bad(`${r.id} not logged in   ${DIM2}run: ${RUNNER_HINTS[r.id].login}${RESET2}`);
-    else ok(`${r.id} ready`);
-  }
-  const anyReady = runners.some((r) => r.installed && r.loggedIn);
-  for (const slug of workspaces) {
-    if (!/^[a-z0-9][a-z0-9-]*$/.test(slug)) continue;
-    const dir = join4(flyspaceRoot(), slug);
-    mkdirSync4(dir, { recursive: true });
-    ok(`Folder ${tilde2(dir)}`);
-  }
-  console.log("\n  Next:");
-  if (!anyReady) {
-    console.log(`    Install and log in to ${BOLD2}claude${RESET2} or ${BOLD2}codex${RESET2} (above) so agents can run here.`);
-  }
-  console.log(`    Start the Host:  ${BOLD2}flyspace dashboard --mode host${RESET2}`);
-  console.log("    Then go back to your browser to finish onboarding.\n");
-  if (!workspaces.length) process.exitCode = 1;
-}
-
-// src/commands/install.ts
-import { existsSync as existsSync6, mkdirSync as mkdirSync5, readFileSync as readFileSync5, writeFileSync as writeFileSync4, unlinkSync } from "fs";
-import { execSync as execSync2 } from "child_process";
-import { dirname as dirname3, join as join6, resolve as resolve4 } from "path";
-import { homedir as homedir3, platform as platform3 } from "os";
-
-// src/service.ts
-import { execSync } from "child_process";
-import { existsSync as existsSync5 } from "fs";
-import { join as join5 } from "path";
-import { homedir as homedir2, platform as platform2 } from "os";
-function serviceLabel(profile) {
-  return profile === DEFAULT_PROFILE ? "ai.flyspace" : `ai.flyspace.${profile}`;
-}
-function plistName(profile) {
-  return `${serviceLabel(profile)}.plist`;
-}
-function plistPath(profile) {
-  return join5(homedir2(), "Library", "LaunchAgents", plistName(profile));
-}
-function legacyServiceLabel(profile) {
-  return profile === DEFAULT_PROFILE ? "io.flycoder.flyspace" : `io.flycoder.flyspace.${profile}`;
-}
-function legacyPlistPath(profile) {
-  return join5(homedir2(), "Library", "LaunchAgents", `${legacyServiceLabel(profile)}.plist`);
-}
-function systemdUnitName(profile) {
-  return profile === DEFAULT_PROFILE ? "flyspace" : `flyspace-${profile}`;
-}
-function systemdUnitPath(profile) {
-  return join5(homedir2(), ".config", "systemd", "user", `${systemdUnitName(profile)}.service`);
-}
-function isServiceInstalled(profile) {
-  if (platform2() === "darwin") return existsSync5(plistPath(profile));
-  if (platform2() === "linux") return existsSync5(systemdUnitPath(profile));
-  return false;
-}
-function restartService(profile) {
-  const os = platform2();
-  if (os === "darwin") {
-    const plist = plistPath(profile);
-    try {
-      execSync(`launchctl unload "${plist}"`, { stdio: "pipe" });
-    } catch {
-    }
-    try {
-      execSync(`launchctl load "${plist}"`, { stdio: "pipe" });
-      return true;
-    } catch {
-      return false;
-    }
-  }
-  if (os === "linux") {
-    try {
-      execSync(`systemctl --user restart ${systemdUnitName(profile)}`, { stdio: "pipe" });
-      return true;
-    } catch {
-      return false;
-    }
-  }
-  return false;
-}
-
-// src/commands/install.ts
-function log(msg) {
-  console.log(`
-\x1B[36m>\x1B[0m ${msg}`);
-}
-function success(msg) {
-  console.log(`\x1B[32m+\x1B[0m ${msg}`);
-}
-function warn(msg) {
-  console.log(`\x1B[33m!\x1B[0m ${msg}`);
-}
-function run(cmd, opts = {}) {
-  return execSync2(cmd, {
-    encoding: "utf-8",
-    stdio: opts.silent ? "pipe" : "inherit"
-  }).toString().trim();
-}
-function detectClaudeBinDir() {
-  try {
-    const claudePath = execSync2("which claude", { encoding: "utf-8", stdio: "pipe" }).trim();
-    return claudePath ? dirname3(claudePath) : void 0;
-  } catch {
-    return void 0;
-  }
-}
-function detectCustieBin() {
-  const argv1 = process.argv[1];
-  if (argv1) {
-    return resolve4(argv1);
-  }
-  try {
-    return run("which flyspace", { silent: true });
-  } catch {
-    return "flyspace";
-  }
-}
-function readEnvFile() {
-  if (!existsSync6(paths.CONFIG_FILE)) return {};
-  const vars = {};
-  for (const line of readFileSync5(paths.CONFIG_FILE, "utf-8").split("\n")) {
-    const trimmed = line.trim();
-    if (!trimmed || trimmed.startsWith("#")) continue;
-    const eq = trimmed.indexOf("=");
-    if (eq === -1) continue;
-    const key = trimmed.slice(0, eq).trim();
-    const val = trimmed.slice(eq + 1).trim();
-    if (val) vars[key] = val;
+      await runStatus();
+      break;
+    case "logout":
+      await runLogout(args.slice(1));
+      break;
+    case "-h":
+    case "--help":
+    case void 0:
+      console.log(HELP);
+      break;
+    default:
+      console.error(`Unknown auth command: ${sub}`);
+      console.log(HELP);
+      process.exit(1);
   }
-  return vars;
-}
-function escapeXml(str) {
-  return str.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
 }
-async function installMacOS() {
-  log("Setting up macOS LaunchAgent...");
-  const profile = getProfile();
-  const custieBin = detectCustieBin();
-  const nodePath = process.execPath;
-  const claudeBinDir = detectClaudeBinDir();
-  const logDir = paths.LOG_DIR;
-  mkdirSync5(logDir, { recursive: true });
-  const envVars = readEnvFile();
-  const homebrewBin = existsSync6("/opt/homebrew/bin") ? "/opt/homebrew/bin" : void 0;
-  const asdfShims = join6(homedir3(), ".asdf", "shims");
-  const asdfBin = existsSync6(asdfShims) ? asdfShims : void 0;
-  const pathParts = [
-    dirname3(nodePath),
-    claudeBinDir,
-    asdfBin,
-    homebrewBin,
-    "/usr/local/bin",
-    "/usr/bin",
-    "/bin"
-  ].filter(Boolean);
-  const programArgs = profile === "default" ? ["start"] : ["start", "--profile", profile];
-  const programArgsXml = [custieBin, ...programArgs].map((a) => `    <string>${escapeXml(a)}</string>`).join("\n");
-  const plist = `<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
-  "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-  <key>Label</key>
-  <string>${serviceLabel(profile)}</string>
-
-  <key>ProgramArguments</key>
-  <array>
-${programArgsXml}
-  </array>
 
-  <key>EnvironmentVariables</key>
-  <dict>
-    <key>PATH</key>
-    <string>${pathParts.join(":")}</string>
-${Object.entries(envVars).map(([k, v]) => `    <key>${k}</key>
-    <string>${escapeXml(v)}</string>`).join("\n")}
-  </dict>
+// src/version.ts
+var CLI_VERSION = true ? "0.1.7" : null;
+function isOlderVersion(a, b) {
+  const parse2 = (v) => v.replace(/^v/, "").split("-")[0].split(".").map(Number);
+  const [pa, pb] = [parse2(a), parse2(b)];
+  if (pa.length !== 3 || pb.length !== 3 || [...pa, ...pb].some(Number.isNaN)) return false;
+  for (let i = 0; i < 3; i++) if (pa[i] !== pb[i]) return pa[i] < pb[i];
+  return false;
+}
 
-  <key>RunAtLoad</key>
-  <true/>
+// src/commands/setup.ts
+var BOLD2 = "\x1B[1m";
+var DIM2 = "\x1B[2m";
+var GREEN2 = "\x1B[32m";
+var YELLOW2 = "\x1B[33m";
+var RESET2 = "\x1B[0m";
+var HELP2 = `
+  Usage: flyspace setup [options]
 
-  <key>KeepAlive</key>
-  <true/>
+  Logs this machine in as a Host, checks for the claude / codex CLIs, and
+  creates ~/Flyspace/<workspace>/ for each workspace it serves. Safe to re-run.
 
-  <key>StandardOutPath</key>
-  <string>${join6(logDir, "custie.log")}</string>
+  Options:
+    --name <name>    Device name shown in the Workspace (default: hostname)
+    --no-browser     Only print the approval URL, don't open a browser
+    --yes            Keep the current login without asking
+    --start-host     Run the agent Host in the background (installs it as a
+                     service the first time)
+    --restart        With --start-host: restart the Host and this machine's
+                     workspace services so they pick up a new CLI version
 
-  <key>StandardErrorPath</key>
-  <string>${join6(logDir, "custie-error.log")}</string>
-</dict>
-</plist>`;
-  const agentPlistPath = plistPath(profile);
-  mkdirSync5(dirname3(agentPlistPath), { recursive: true });
+  To switch accounts, run: flyspace auth login --force
+`;
+var RUNNER_HINTS = {
+  claude: { install: "npm install -g @anthropic-ai/claude-code", login: "claude" },
+  codex: { install: "npm install -g @openai/codex", login: "codex login" }
+};
+var tilde2 = (p) => p.replace(process.env["HOME"] ?? "\0", "~");
+var ok = (msg) => console.log(`  ${GREEN2}\u2713${RESET2} ${msg}`);
+var bad = (msg) => console.log(`  ${YELLOW2}\u2717${RESET2} ${msg}`);
+async function servedWorkspaces() {
+  const bound = await boundWorkspaces();
+  if (!bound.fresh) console.log(`  ${DIM2}Couldn't reach the server; using the workspaces saved at login.${RESET2}`);
+  return bound.workspaces;
+}
+function checkLatestVersion() {
+  if (!CLI_VERSION) return;
+  let latest = "";
   try {
-    run(`launchctl unload "${agentPlistPath}"`, { silent: true });
+    latest = execSync4(`npm view ${"flyspace-cli"} version`, { encoding: "utf-8", stdio: "pipe", timeout: 1e4 }).trim();
   } catch {
+    return;
   }
-  try {
-    unlinkSync(agentPlistPath);
-  } catch {
+  if (!latest || !isOlderVersion(CLI_VERSION, latest)) return;
+  bad(`flyspace ${CLI_VERSION} is out of date (latest ${latest})   ${DIM2}run: flyspace upgrade${RESET2}`);
+}
+function loginArgs(args) {
+  const out = [];
+  for (let i = 0; i < args.length; i++) {
+    const a = args[i];
+    if (a === "--name") out.push(a, args[++i] ?? "");
+    else if (a.startsWith("--name=") || a === "--no-browser") out.push(a);
   }
-  writeFileSync4(agentPlistPath, plist);
-  run(`launchctl load "${agentPlistPath}"`, { silent: true });
-  success(`LaunchAgent installed and loaded (profile: ${profile}).`);
-  console.log(`  Logs: ${logDir}`);
-  console.log(`  Check: launchctl list | grep flyspace`);
+  return out;
 }
-async function installLinux() {
-  log("Setting up systemd user service...");
-  const profile = getProfile();
-  const custieBin = detectCustieBin();
-  const nodePath = process.execPath;
-  const claudeBinDir = detectClaudeBinDir();
-  const logDir = paths.LOG_DIR;
-  mkdirSync5(logDir, { recursive: true });
-  const envVars = readEnvFile();
-  const envLines = Object.entries(envVars).map(([k, v]) => `Environment="${k}=${v}"`).join("\n");
-  const linuxbrewBin = existsSync6("/home/linuxbrew/.linuxbrew/bin") ? "/home/linuxbrew/.linuxbrew/bin" : void 0;
-  const pathParts = [
-    dirname3(nodePath),
-    claudeBinDir,
-    linuxbrewBin,
-    "/usr/local/bin",
-    "/usr/bin",
-    "/bin"
-  ].filter(Boolean);
-  const execStart = profile === "default" ? `${custieBin} start` : `${custieBin} start --profile ${profile}`;
-  const unit = `[Unit]
-Description=Flyspace agent host${profile === "default" ? "" : ` (${profile})`}
-After=network-online.target
-Wants=network-online.target
-
-[Service]
-Type=simple
-ExecStart=${execStart}
-Restart=on-failure
-RestartSec=5
-${envLines}
-Environment="PATH=${pathParts.join(":")}"
-
-StandardOutput=append:${join6(logDir, "custie.log")}
-StandardError=append:${join6(logDir, "custie-error.log")}
-
-[Install]
-WantedBy=default.target
-`;
-  const unitName = systemdUnitName(profile);
-  const unitDir = join6(homedir3(), ".config", "systemd", "user");
-  mkdirSync5(unitDir, { recursive: true });
-  writeFileSync4(join6(unitDir, `${unitName}.service`), unit);
-  run("systemctl --user daemon-reload", { silent: true });
-  run(`systemctl --user enable --now ${unitName}`, { silent: true });
-  success(`systemd user service installed and started (profile: ${profile}).`);
-  console.log(`  Logs: ${logDir}`);
-  console.log(`  Check: systemctl --user status ${unitName}`);
+function restartHostServices(workspaces) {
+  if (restartHostService()) ok("Host restarted on the new version");
+  else bad("Could not restart the Host service   run: flyspace setup --start-host --restart");
+  for (const slug of workspaces) {
+    if (!isServiceInstalled(slug)) continue;
+    if (restartService(slug)) ok(`${slug} scheduler restarted`);
+    else bad(`${slug} scheduler did not restart   run: flyspace restart --profile ${slug}`);
+  }
 }
-async function runInstall() {
-  ensureDirs();
-  const os = platform3();
-  if (os === "darwin") {
-    await installMacOS();
-  } else if (os === "linux") {
-    await installLinux();
+async function runSetup(args) {
+  if (args.includes("-h") || args.includes("--help")) return void console.log(HELP2);
+  console.log(`
+${BOLD2}Flyspace Setup${RESET2}
+`);
+  checkLatestVersion();
+  const existing = loadCredentials();
+  let workspaces;
+  if (existing) {
+    workspaces = await servedWorkspaces();
+    console.log(`  This machine is already a Host:`);
+    console.log(`    Account     ${existing.userEmail}`);
+    console.log(`    Device      ${existing.deviceName}`);
+    console.log(`    Workspaces  ${workspaces.length ? workspaces.join(", ") : "(none)"}`);
+    const others = listProfiles().filter((p) => p !== "default" && !workspaces.includes(p));
+    if (others.length) {
+      console.log(`    ${DIM2}Not bound here, nothing runs for them: ${others.join(", ")}${RESET2}`);
+      console.log(`    ${DIM2}See: flyspace profiles   Clean up: flyspace profiles remove <name>${RESET2}`);
+    }
+    console.log("");
+    const keep = args.includes("--yes") || !process.stdin.isTTY ? true : await confirm2({ message: "Keep using this account and device?", default: true });
+    if (!keep) {
+      await login([...loginArgs(args), "--force"]);
+      workspaces = await servedWorkspaces();
+    }
   } else {
-    warn(`Unsupported platform: ${os}. You'll need to configure autostart manually.`);
+    await login(loginArgs(args));
+    workspaces = await servedWorkspaces();
+  }
+  if (workspaces.length) ok(`Registered as the Host for ${workspaces.join(", ")}`);
+  else bad(`Not serving any workspace. Only workspace admins can add a Host.`);
+  const runners = detectRunners();
+  for (const r of runners) {
+    if (!r.installed) bad(`${r.id} not installed   ${DIM2}${RUNNER_HINTS[r.id].install}${RESET2}`);
+    else if (!r.loggedIn) bad(`${r.id} not logged in   ${DIM2}run: ${RUNNER_HINTS[r.id].login}${RESET2}`);
+    else ok(`${r.id} ready`);
+  }
+  const anyReady = runners.some((r) => r.installed && r.loggedIn);
+  for (const slug of workspaces) {
+    if (!/^[a-z0-9][a-z0-9-]*$/.test(slug)) continue;
+    const dir = join7(flyspaceRoot(), slug);
+    mkdirSync5(dir, { recursive: true });
+    ok(`Folder ${tilde2(dir)}`);
+  }
+  let hostRunning = false;
+  if (args.includes("--start-host") && workspaces.length) {
+    if (!isHostServiceInstalled()) {
+      hostRunning = await installHostService();
+      if (hostRunning) ok(`Host running in the background   ${DIM2}logs: ${tilde2(paths.LOG_DIR)}/host.log${RESET2}`);
+    } else {
+      hostRunning = true;
+      if (args.includes("--restart")) restartHostServices(workspaces);
+      else ok("Host service already installed");
+    }
+  }
+  console.log("\n  Next:");
+  if (!anyReady) {
+    console.log(`    Install and log in to ${BOLD2}claude${RESET2} or ${BOLD2}codex${RESET2} (above) so agents can run here.`);
+  }
+  if (hostRunning) {
+    console.log("    The Host keeps running after you close this terminal and starts again at login.");
+    const stop = process.platform === "darwin" ? `launchctl bootout gui/$(id -u)/${HOST_SERVICE_LABEL}` : `systemctl --user disable --now ${HOST_SYSTEMD_UNIT}`;
+    console.log(`    To stop it: ${BOLD2}${stop}${RESET2}`);
+  } else {
+    console.log(`    Start the Host:  ${BOLD2}flyspace setup --start-host${RESET2}`);
   }
+  console.log("    Then go back to your browser to finish onboarding.\n");
+  if (!workspaces.length) process.exitCode = 1;
 }
 
 // src/commands/uninstall.ts
-import { existsSync as existsSync7, unlinkSync as unlinkSync2 } from "fs";
-import { execSync as execSync3 } from "child_process";
-import { basename as basename2, join as join7 } from "path";
-import { homedir as homedir4, platform as platform4 } from "os";
+import { existsSync as existsSync8, unlinkSync as unlinkSync2 } from "fs";
+import { execSync as execSync5 } from "child_process";
+import { basename as basename2, join as join8 } from "path";
+import { homedir as homedir4, platform as platform5 } from "os";
 function log2(msg) {
   console.log(`
 \x1B[36m>\x1B[0m ${msg}`);
@@ -1501,16 +1673,16 @@ function warn2(msg) {
   console.log(`\x1B[33m!\x1B[0m ${msg}`);
 }
 function run2(cmd) {
-  execSync3(cmd, { encoding: "utf-8", stdio: "pipe" });
+  execSync5(cmd, { encoding: "utf-8", stdio: "pipe" });
 }
 async function runUninstall() {
-  const os = platform4();
+  const os = platform5();
   const profile = getProfile();
   log2("Uninstalling Flyspace service...");
   if (os === "darwin") {
     const removed = [];
     for (const plist of [plistPath(profile), legacyPlistPath(profile)]) {
-      if (!existsSync7(plist)) continue;
+      if (!existsSync8(plist)) continue;
       try {
         run2(`launchctl unload "${plist}"`);
       } catch {
@@ -1532,7 +1704,7 @@ async function runUninstall() {
       run2(`systemctl --user disable --now ${unitName}`);
     } catch {
     }
-    const unitPath = join7(homedir4(), ".config", "systemd", "user", `${unitName}.service`);
+    const unitPath = join8(homedir4(), ".config", "systemd", "user", `${unitName}.service`);
     try {
       unlinkSync2(unitPath);
     } catch {
@@ -1548,53 +1720,94 @@ async function runUninstall() {
   console.log("\n  Config and data directories were NOT removed.");
 }
 
-// src/commands/profiles.ts
-import { existsSync as existsSync8, readdirSync as readdirSync2, statSync as statSync2 } from "fs";
-import { execSync as execSync4 } from "child_process";
-import { join as join8 } from "path";
-import { platform as platform5 } from "os";
-function listProfiles() {
-  const profiles = [];
-  if (existsSync8(paths.PROFILES_DIR)) {
-    for (const entry of readdirSync2(paths.PROFILES_DIR)) {
-      try {
-        if (statSync2(join8(paths.PROFILES_DIR, entry)).isDirectory()) {
-          profiles.push(entry);
-        }
-      } catch {
-      }
-    }
-  }
-  return profiles;
+// src/commands/profiles-cmd.ts
+import { rmSync as rmSync3 } from "fs";
+var OPERATOR_NOTE = "This machine is an operator Host (it has Supabase credentials), so it serves every workspace, bound or not.";
+var USAGE = `
+  Usage: flyspace profiles [list]
+         flyspace profiles remove <name>
+
+  list     Every local profile, whether this Host is bound to it, and the
+           state of its scheduler service.
+  remove   Unload a profile's scheduler and delete its local config. Only for
+           profiles this Host is not bound to; the Workspace itself, its
+           channel folders and its data directory are left alone.
+`;
+async function boundHere() {
+  const bound = await boundWorkspaces();
+  if (bound && !bound.fresh) console.log("  \x1B[2mCouldn't reach the server; using the workspaces saved at login.\x1B[0m");
+  return bound?.workspaces ?? null;
 }
-function isServiceRunning(profile) {
-  try {
-    if (platform5() === "darwin") {
-      const out = execSync4("launchctl list", { encoding: "utf-8", stdio: "pipe" });
-      return out.split("\n").some((line) => line.endsWith(`	${serviceLabel(profile)}`));
-    }
-    if (platform5() === "linux") {
-      execSync4(`systemctl --user is-active ${systemdUnitName(profile)}`, { stdio: "pipe" });
-      return true;
-    }
-  } catch {
+async function listCmd() {
+  const bound = await boundHere();
+  console.log("\n  Profiles:\n");
+  console.log(`    ${"NAME".padEnd(24)} ${"BOUND HERE".padEnd(12)} SCHEDULER`);
+  for (const profile of listProfiles()) {
+    const scheduler = !isServiceInstalled(profile) ? "\x1B[90mnot installed\x1B[0m" : isServiceRunning(profile) ? "\x1B[32mrunning\x1B[0m" : "\x1B[90mstopped\x1B[0m";
+    const here = bound === null ? "-".padEnd(12) : bound.includes(profile) ? "yes".padEnd(12) : `\x1B[33m${"no".padEnd(12)}\x1B[0m`;
+    console.log(`    ${profile.padEnd(24)} ${here} ${scheduler}`);
   }
-  return false;
+  const missing = (bound ?? []).filter((w) => !listProfiles().includes(w));
+  for (const w of missing) console.log(`    ${w.padEnd(24)} ${"yes".padEnd(12)} \x1B[33mno local profile yet\x1B[0m`);
+  if (bound?.length === 0) {
+    console.log("\n  This Host is not bound to any workspace, so no scheduler runs here. Run: flyspace setup");
+  }
+  if (hasSupabaseCredentials()) {
+    console.log(`
+  ${OPERATOR_NOTE}`);
+  } else if (bound && listProfiles().some((p) => p !== DEFAULT_PROFILE && !bound.includes(p))) {
+    console.log("\n  Profiles not bound here run nothing on this machine. Remove one with: flyspace profiles remove <name>");
+  }
+  console.log("");
 }
-async function runProfiles() {
-  const profiles = listProfiles();
-  console.log("\n  Profiles:\n");
-  for (const profile of profiles) {
-    const status = isServiceRunning(profile) ? "\x1B[32mrunning\x1B[0m" : "\x1B[90mstopped\x1B[0m";
-    console.log(`    ${profile.padEnd(20)} ${status}`);
+async function removeCmd(name) {
+  if (!name) return void console.log(USAGE);
+  if (name === DEFAULT_PROFILE) {
+    console.error("  The default profile cannot be removed.");
+    process.exit(1);
+  }
+  if (!listProfiles().includes(name)) {
+    console.error(`  No local profile named "${name}".`);
+    process.exit(1);
+  }
+  if (hasSupabaseCredentials()) {
+    console.error(`  ${OPERATOR_NOTE} Removing a profile would stop that workspace's schedules.`);
+    process.exit(1);
+  }
+  const bound = await boundHere();
+  if (bound === null) {
+    console.error("  This machine has no device login, so it serves every workspace; removing a profile would be undone.");
+    process.exit(1);
+  }
+  if (bound.includes(name)) {
+    console.error(`  This Host is still bound to "${name}" on the server, so the Host would reinstall it within a minute.`);
+    console.error("  Unbinding a Host from a workspace is not available yet.");
+    process.exit(1);
   }
-  console.log("\n  Target a profile with --profile <name> on any command.\n");
+  const { configDir: configDir2, dataDir } = runWithProfile(name, () => ({ configDir: paths.CONFIG_DIR, dataDir: paths.DATA_DIR }));
+  if (isServiceInstalled(name)) await runWithProfile(name, runUninstall);
+  rmSync3(configDir2, { recursive: true, force: true });
+  console.log(`\x1B[32m+\x1B[0m Local config removed: ${configDir2}`);
+  console.log(`
+  Kept: ${dataDir} (sessions, logs) and any ~/Flyspace/${name}/ channel folders.`);
+  console.log(`  The workspace and its server-side records are unchanged; this only cleaned up this machine.
+`);
+}
+async function runProfiles(args = []) {
+  loadEnvFiles();
+  const [sub, name] = args;
+  if (sub === "remove" || sub === "rm") return removeCmd(name);
+  if (!sub || sub === "list" || sub === "ls") return listCmd();
+  console.log(USAGE);
 }
 
 // src/commands/upgrade.ts
-import { execSync as execSync5 } from "child_process";
+import { execSync as execSync6 } from "child_process";
 function restartInstalledProfiles() {
-  const installed = listProfiles().filter(isServiceInstalled);
+  if (isHostServiceInstalled()) {
+    console.log(restartHostService() ? "\nHost restarted." : "\nHost restart failed; run: flyspace setup --start-host --restart");
+  }
+  const installed = (loadCredentials()?.workspaces ?? listProfiles()).filter(isServiceInstalled);
   if (installed.length === 0) {
     console.log("\nNo installed services to restart.");
     return;
@@ -1610,18 +1823,18 @@ Restarting ${installed.length} instance(s)...`);
   }
 }
 async function runUpgrade() {
-  const current = "0.1.5";
+  const current = "0.1.7";
   console.log(`Current version: ${current}`);
   console.log("Checking for updates...\n");
   try {
-    const latest = execSync5(`npm view ${"flyspace-cli"} version`, { encoding: "utf-8" }).trim();
+    const latest = execSync6(`npm view ${"flyspace-cli"} version`, { encoding: "utf-8" }).trim();
     if (latest === current) {
       console.log(`Already on the latest version (${current}).`);
       return;
     }
     console.log(`New version available: ${latest}`);
     console.log("Upgrading...\n");
-    execSync5(`npm install -g ${"flyspace-cli"}@latest`, { stdio: "inherit" });
+    execSync6(`npm install -g ${"flyspace-cli"}@latest`, { stdio: "inherit" });
     console.log(`
 Upgraded from ${current} to ${latest}.`);
     restartInstalledProfiles();
@@ -1637,7 +1850,7 @@ You can upgrade manually with: npm install -g ${"flyspace-cli"}@latest`);
 
 // src/commands/automation.ts
 import { WebClient } from "@slack/web-api";
-var USAGE = `
+var USAGE2 = `
   Usage: flyspace automation <subcommand> [options]
 
   Subcommands:
@@ -1975,7 +2188,7 @@ async function runAutomationCmd(args) {
       await handleRun(manager, args[1]);
       break;
     default:
-      console.log(USAGE);
+      console.log(USAGE2);
       break;
   }
 }
@@ -2166,7 +2379,7 @@ function breakdown(store, by, days) {
 }
 
 // src/commands/stop.ts
-import { execSync as execSync6 } from "child_process";
+import { execSync as execSync7 } from "child_process";
 import { platform as platform6 } from "os";
 function log3(msg) {
   console.log(`
@@ -2185,7 +2398,7 @@ async function runStop() {
     const plist = plistPath(profile);
     log3("Stopping Flyspace service...");
     try {
-      execSync6(`launchctl unload "${plist}"`, { stdio: "pipe" });
+      execSync7(`launchctl unload "${plist}"`, { stdio: "pipe" });
       success3("Service stopped. Run `flyspace restart` to start again.");
     } catch {
       warn3("Service is not currently loaded.");
@@ -2193,7 +2406,7 @@ async function runStop() {
   } else if (os === "linux") {
     log3("Stopping Flyspace service...");
     try {
-      execSync6(`systemctl --user stop ${systemdUnitName(profile)}`, { stdio: "pipe" });
+      execSync7(`systemctl --user stop ${systemdUnitName(profile)}`, { stdio: "pipe" });
       success3("Service stopped. Run `flyspace restart` to start again.");
     } catch {
       warn3("Service is not currently running.");
@@ -2253,7 +2466,7 @@ import { execFileSync as execFileSync4 } from "child_process";
 import { existsSync as existsSync27, readFileSync as readFileSync16, writeFileSync as writeFileSync10 } from "fs";
 import { resolve as resolve7 } from "path";
 import { tmpdir as tmpdir3, homedir as homedir9 } from "os";
-import { input, confirm as confirm2, select, checkbox } from "@inquirer/prompts";
+import { input, confirm as confirm3, select, checkbox } from "@inquirer/prompts";
 import { WebClient as WebClient3 } from "@slack/web-api";
 
 // src/store/auth-links.ts
@@ -3420,8 +3633,8 @@ function setupPage(c, token, invite, form = {}) {
   );
 }
 function createAuthConfirmRouter() {
-  const confirm3 = new Hono();
-  confirm3.get("/confirm", withResolvedProfile, async (c) => {
+  const confirm4 = new Hono();
+  confirm4.get("/confirm", withResolvedProfile, async (c) => {
     const settings = await loadWorkspaceBranding();
     const display = fontOf(settings.font).stack;
     const name = settings.displayName?.trim() || getProfile();
@@ -3458,7 +3671,7 @@ function createAuthConfirmRouter() {
       )
     );
   });
-  confirm3.post("/confirm", withResolvedProfile, async (c) => {
+  confirm4.post("/confirm", withResolvedProfile, async (c) => {
     const form = await c.req.parseBody();
     const params = readParams({
       token: typeof form["token"] === "string" ? form["token"] : void 0,
@@ -3469,7 +3682,7 @@ function createAuthConfirmRouter() {
     if (!target) return c.text("SUPABASE_URL is not configured", 500);
     return c.redirect(target, 303);
   });
-  confirm3.get("/invite", withResolvedProfile, async (c) => {
+  confirm4.get("/invite", withResolvedProfile, async (c) => {
     const token = c.req.query("token")?.trim() ?? "";
     const lookup = await findInvite(token);
     const brandingWorkspace = lookup.state === "valid" ? await getWorkspaceById(lookup.invite.workspaceId) : null;
@@ -3515,7 +3728,7 @@ function createAuthConfirmRouter() {
       )
     );
   });
-  confirm3.post("/invite", withResolvedProfile, async (c) => {
+  confirm4.post("/invite", withResolvedProfile, async (c) => {
     const form = await c.req.parseBody();
     const token = typeof form["token"] === "string" ? form["token"].trim() : "";
     const back = `/auth/invite?token=${encodeURIComponent(token)}`;
@@ -3532,7 +3745,7 @@ function createAuthConfirmRouter() {
     if (!await consumeInvite(lookup.invite.id)) return c.redirect(back, 303);
     return c.redirect(target, 303);
   });
-  confirm3.get("/new-workspace", async (c) => {
+  confirm4.get("/new-workspace", async (c) => {
     const token = c.req.query("token")?.trim() ?? "";
     const lookup = INVITE_TOKEN.test(token) ? await lookupSetupInvite(token) : { state: "unknown" };
     if (lookup.state === "valid") return c.html(setupPage(c, token, lookup.invite));
@@ -3560,7 +3773,7 @@ function createAuthConfirmRouter() {
       status
     );
   });
-  confirm3.post("/new-workspace", async (c) => {
+  confirm4.post("/new-workspace", async (c) => {
     const form = await c.req.parseBody();
     const token = typeof form["token"] === "string" ? form["token"].trim() : "";
     const slug = typeof form["slug"] === "string" ? form["slug"].trim().toLowerCase() : "";
@@ -3667,7 +3880,7 @@ function createAuthConfirmRouter() {
     }
     return c.redirect(`${origin}/login?email=${encodeURIComponent(invite.email)}`, 303);
   });
-  return confirm3;
+  return confirm4;
 }
 function confirmLinkFor(origin, actionLink, intent) {
   try {
@@ -3787,6 +4000,9 @@ import { serveStatic } from "@hono/node-server/serve-static";
 
 // src/reconcile.ts
 import { existsSync as existsSync11, mkdirSync as mkdirSync6, writeFileSync as writeFileSync5 } from "fs";
+async function boundWorkspaces2() {
+  return (await boundWorkspaces())?.workspaces ?? null;
+}
 async function reconcileProfile(profile) {
   return runWithProfile(profile, async () => {
     const log5 = [];
@@ -3812,8 +4028,8 @@ async function reconcileProfile(profile) {
   });
 }
 async function reconcileAll() {
-  const workspaces = await listWorkspaces();
-  const slugs = /* @__PURE__ */ new Set([...workspaces.map((w) => w.slug), ...listProfiles()]);
+  const bound = hasSupabaseCredentials() ? null : await boundWorkspaces2();
+  const slugs = new Set(bound ?? [...(await listWorkspaces()).map((w) => w.slug), ...listProfiles()]);
   const results = /* @__PURE__ */ new Map();
   for (const slug of slugs) {
     try {
@@ -3826,7 +4042,8 @@ async function reconcileAll() {
   return results;
 }
 async function ensureServices() {
-  const slugs = /* @__PURE__ */ new Set([...(await listWorkspaces()).map((w) => w.slug), ...listProfiles()]);
+  const bound = await boundWorkspaces2();
+  const slugs = new Set(bound ?? [...(await listWorkspaces()).map((w) => w.slug), ...listProfiles()]);
   slugs.delete(DEFAULT_PROFILE);
   const installed = [];
   for (const slug of slugs) {
@@ -6839,7 +7056,7 @@ import {
   readFileSync as readFileSync10,
   realpathSync,
   renameSync,
-  rmSync as rmSync4,
+  rmSync as rmSync5,
   statSync as statSync5,
   writeFileSync as writeFileSync7
 } from "fs";
@@ -7133,7 +7350,7 @@ import { readFileSync as readFileSync9 } from "fs";
 import { homedir as homedir7 } from "os";
 
 // src/mcp/config.ts
-import { mkdtempSync, rmSync as rmSync3, writeFileSync as writeFileSync6 } from "fs";
+import { mkdtempSync, rmSync as rmSync4, writeFileSync as writeFileSync6 } from "fs";
 import { tmpdir } from "os";
 import { join as join14 } from "path";
 
@@ -7826,7 +8043,7 @@ function writeMcpConfigFile(config) {
   writeFileSync6(path, JSON.stringify(config), { mode: 384 });
   return {
     path,
-    cleanup: () => rmSync3(dir, { recursive: true, force: true })
+    cleanup: () => rmSync4(dir, { recursive: true, force: true })
   };
 }
 async function withMcpConfig(profile, connectionIds, fn) {
@@ -10042,7 +10259,7 @@ function deleteDocEntry(root, path) {
   }
   const isDir2 = stat.isDirectory();
   if (!isDir2 && !stat.isFile() && !stat.isSymbolicLink()) return { status: "not-found" };
-  rmSync4(abs, { recursive: isDir2 });
+  rmSync5(abs, { recursive: isDir2 });
   return {
     status: "ok",
     path: relative(root, abs).split(sep).join("/"),
@@ -14759,7 +14976,7 @@ function loadHostPublicKey() {
 // src/dashboard/host-lock.ts
 import { execFileSync as execFileSync3 } from "child_process";
 import { randomBytes as randomBytes5 } from "crypto";
-import { mkdirSync as mkdirSync10, readFileSync as readFileSync13, rmSync as rmSync5, writeFileSync as writeFileSync9 } from "fs";
+import { mkdirSync as mkdirSync10, readFileSync as readFileSync13, rmSync as rmSync6, writeFileSync as writeFileSync9 } from "fs";
 import { join as join21 } from "path";
 function hostLockPath() {
   return join21(paths.BASE_DATA_DIR, "host.lock");
@@ -14795,7 +15012,7 @@ function acquireHostLock() {
     try {
       writeFileSync9(path, body, { flag: "wx", mode: 384 });
       const release2 = () => {
-        if (readLockPid(path) === process.pid) rmSync5(path, { force: true });
+        if (readLockPid(path) === process.pid) rmSync6(path, { force: true });
       };
       process.once("exit", release2);
       return release2;
@@ -14809,7 +15026,7 @@ function acquireHostLock() {
           `Another Flyspace Host is already running on this machine (pid ${holder}). Stop it first, or check for a second CLI install (\`which -a flyspace\`). Two Hosts overwrite each other's skill mirror.`
         );
       }
-      rmSync5(path, { force: true });
+      rmSync6(path, { force: true });
     }
   }
   throw new Error(`Could not take the Host lock at ${path}`);
@@ -15027,16 +15244,35 @@ async function listWorkspaceDevices(workspaceId) {
   if (error2) fail("listWorkspaceDevices", error2);
   return (data ?? []).map((r) => toDevice(r.devices)).sort((a, b) => b.createdAt.localeCompare(a.createdAt));
 }
+async function touchDevice(deviceId) {
+  const { error: error2 } = await getSupabaseClient().from("devices").update({ last_seen_at: (/* @__PURE__ */ new Date()).toISOString() }).eq("id", deviceId);
+  if (error2) fail("touchDevice", error2);
+}
+var STALE_HOST_MS = 14 * 24 * 60 * 6e4;
+var isStale = (lastSeenAt) => !!lastSeenAt && Date.now() - Date.parse(lastSeenAt) > STALE_HOST_MS;
 async function listWorkspaceHosts(workspaceIds, exceptPublicKey) {
   const hosts2 = /* @__PURE__ */ new Map();
   if (!workspaceIds.length) return hosts2;
-  const { data, error: error2 } = await getSupabaseClient().from("device_workspaces").select("workspace_id, devices!inner(name, public_key, revoked_at)").in("workspace_id", workspaceIds).is("devices.revoked_at", null);
+  const { data, error: error2 } = await getSupabaseClient().from("device_workspaces").select("workspace_id, devices!inner(name, public_key, revoked_at, last_seen_at)").in("workspace_id", workspaceIds).is("devices.revoked_at", null);
   if (error2) fail("listWorkspaceHosts", error2);
   for (const r of data ?? []) {
-    if (r.devices.public_key !== exceptPublicKey) hosts2.set(r.workspace_id, r.devices.name);
+    if (r.devices.public_key !== exceptPublicKey && !isStale(r.devices.last_seen_at)) {
+      hosts2.set(r.workspace_id, r.devices.name);
+    }
   }
   return hosts2;
 }
+async function releaseStaleHosts(workspaceIds, exceptPublicKey) {
+  if (!workspaceIds.length) return;
+  const db = getSupabaseClient();
+  const { data, error: error2 } = await db.from("device_workspaces").select("device_id, workspace_id, devices!inner(public_key, last_seen_at)").in("workspace_id", workspaceIds);
+  if (error2) fail("releaseStaleHosts", error2);
+  for (const r of data ?? []) {
+    if (r.devices.public_key === exceptPublicKey || !isStale(r.devices.last_seen_at)) continue;
+    const { error: delError } = await db.from("device_workspaces").delete().eq("device_id", r.device_id).eq("workspace_id", r.workspace_id);
+    if (delError) fail("releaseStaleHosts", delError);
+  }
+}
 async function userEmail(userId) {
   const { data, error: error2 } = await getSupabaseClient().auth.admin.getUserById(userId);
   if (error2) return null;
@@ -15819,9 +16055,21 @@ async function revalidateDeviceScopes() {
       continue;
     }
     const workspaces = (await listDeviceWorkspaces(device)).map((w) => w.slug);
-    for (const scope of hosts.values()) if (scope.deviceId === deviceId) scope.workspaces = workspaces;
+    for (const [ws, scope] of hosts) {
+      if (scope.deviceId !== deviceId) continue;
+      const changed = (scope.workspaces ?? []).join() !== workspaces.join();
+      scope.workspaces = workspaces;
+      if (changed) send(ws, { type: "workspaces", workspaces });
+    }
+    if (!device.lastSeenAt || Date.now() - Date.parse(device.lastSeenAt) > LAST_SEEN_RESOLUTION_MS) {
+      await touchDevice(deviceId);
+    }
   }
 }
+var LAST_SEEN_RESOLUTION_MS = 60 * 6e4;
+function minCliVersion() {
+  return process.env["FLYSPACE_MIN_CLI_VERSION"]?.trim() || null;
+}
 function attachHostSocket(server) {
   const wss = new WebSocketServer({ server, path: HOST_SOCKET_PATH });
   const legacyPublicKey = loadHostPublicKey();
@@ -15862,10 +16110,19 @@ function attachHostSocket(server) {
             ws.close(1008, "bad signature");
             return;
           }
+          const min = minCliVersion();
+          if (min && msg.cliVersion && isOlderVersion(msg.cliVersion, min)) {
+            console.error(`[host-socket] rejecting Host on CLI ${msg.cliVersion} (minimum ${min})`);
+            send(ws, { type: "auth-failed", reason: "cli too old", minCliVersion: min });
+            ws.close(1008, "cli too old");
+            return;
+          }
           supersedeSameIdentity(scope2, ws);
           lastAuthFailure = null;
           addHost(ws, scope2);
-          send(ws, { type: "auth-ok" });
+          send(ws, scope2.workspaces ? { type: "auth-ok", workspaces: scope2.workspaces } : { type: "auth-ok" });
+          if (scope2.deviceId) void touchDevice(scope2.deviceId).catch(() => {
+          });
           console.log(`[host-socket] Host authenticated (authPath: ${scope2.authPath})`);
           if (scope2.workspaces) void markAgentConnected(scope2.workspaces);
         })();
@@ -15988,7 +16245,7 @@ function remoteAgentCallbacks() {
 }
 var RECONNECT_BASE_MS = 1e3;
 var RECONNECT_MAX_MS = 3e4;
-function connectHostSocket(url, callbacks, onAuthenticated) {
+function connectHostSocket(url, callbacks, onAuthenticated, onWorkspaces) {
   const credentials = loadCredentials();
   const deviceId = credentials?.deviceId;
   const privateKey = deviceId ? ensureDeviceKey().privateKey : loadHostPrivateKey();
@@ -16020,11 +16277,23 @@ function connectHostSocket(url, callbacks, onAuthenticated) {
       if (!msg) return;
       if (msg.type === "challenge") {
         const signature = signRaw(null, Buffer.from(msg.nonce, "base64"), privateKey).toString("base64");
-        send(ws, deviceId ? { type: "auth", signature, deviceId } : { type: "auth", signature });
+        const version = CLI_VERSION ? { cliVersion: CLI_VERSION } : {};
+        send(ws, deviceId ? { type: "auth", signature, deviceId, ...version } : { type: "auth", signature, ...version });
         return;
       }
       if (msg.type === "auth-failed") {
         console.error(`[host-socket] auth rejected: ${msg.reason}`);
+        if (msg.minCliVersion) {
+          console.error(
+            `[host-socket] This Host runs flyspace ${CLI_VERSION} but the Workspace needs ${msg.minCliVersion} or later.
+  Upgrade, then restart the Host:  flyspace upgrade`
+          );
+          stopped = true;
+        }
+        return;
+      }
+      if (msg.type === "workspaces") {
+        onWorkspaces?.(msg.workspaces);
         return;
       }
       if (msg.type === "auth-ok") {
@@ -16036,6 +16305,7 @@ function connectHostSocket(url, callbacks, onAuthenticated) {
           send(ws, { type: "host-config", configs: buildHostConfigSnapshot() });
         }, HOST_CONFIG_PUSH_INTERVAL_MS);
         onAuthenticated?.();
+        if (msg.workspaces) onWorkspaces?.(msg.workspaces);
         return;
       }
       if (msg.type === "db-result") {
@@ -16378,6 +16648,7 @@ function createDeviceAuthRouter() {
     if (!decided) {
       return c.json({ error: "That code was already used." }, 409);
     }
+    await releaseStaleHosts(workspaceIds, pending3.publicKey);
     return c.json({ ok: true });
   });
   return app;
@@ -16750,7 +17021,7 @@ async function startDashboardServer(preferredPort = DEFAULT_DASHBOARD_PORT, host
   const bootCallbacks = new Proxy({}, {
     get: (_t, prop) => lateCallbacks?.[prop]
   });
-  const earlyHostSocket = mode === "host" && !hasSupabaseCredentials() && loadCredentials() ? (setSupabaseClient(createHostDbClient()), connectHostSocket(dataSocketUrl(), bootCallbacks, () => onHostConnected?.())) : void 0;
+  const earlyHostSocket = mode === "host" && !hasSupabaseCredentials() && loadCredentials() ? (setSupabaseClient(createHostDbClient()), connectHostSocket(dataSocketUrl(), bootCallbacks, () => onHostConnected?.(), onBindingsChanged)) : void 0;
   if (servesHost) {
     await reconcileAll().catch(
       (err) => console.error("[dashboard] reconcileAll failed:", err.message)
@@ -16802,7 +17073,9 @@ async function startDashboardServer(preferredPort = DEFAULT_DASHBOARD_PORT, host
   } else {
     app.route("/share", createPublicShareAssetRouter(WEB_DIST));
     app.route("/", createAppIconRouter());
-    app.use("/*", serveStatic({ root: WEB_DIST }));
+    if (existsSync26(WEB_DIST) || existsSync26(join22(paths.PACKAGE_ROOT, "web", "package.json"))) {
+      app.use("/*", serveStatic({ root: WEB_DIST }));
+    }
     app.get("/assets/*", (c) => c.text("stale asset \u2014 reload for the current build", 404));
     const spaFallback = serveStatic({ path: join22(WEB_DIST, "index.html") });
     app.get("*", async (c, next) => {
@@ -16823,7 +17096,7 @@ The JSON API is live under /api.` : "This install has no bundled Workspace UI.\n
   if (mode === "host") relayToken = publishHostEndpoint(port);
   if (mode === "data") attachHostSocket(server);
   const stopHostStatusBroadcast = mode === "data" ? startHostStatusBroadcast() : void 0;
-  const hostSocketClient = earlyHostSocket ?? (mode === "host" && chatAgent ? connectHostSocket(dataSocketUrl(), localAgentCallbacks(chatAgent), () => onHostConnected?.()) : void 0);
+  const hostSocketClient = earlyHostSocket ?? (mode === "host" && chatAgent ? connectHostSocket(dataSocketUrl(), localAgentCallbacks(chatAgent), () => onHostConnected?.(), onBindingsChanged) : void 0);
   const stopPushWatcher = earlyHostSocket ? () => {
   } : startPushWatcher();
   const displayHost = host === "0.0.0.0" || host === "::" ? "127.0.0.1" : host;
@@ -16844,6 +17117,13 @@ The JSON API is live under /api.` : "This install has no bundled Workspace UI.\n
     }
   };
 }
+function onBindingsChanged(workspaces) {
+  const creds = loadCredentials();
+  if (!creds || (creds.workspaces ?? []).join() === workspaces.join()) return;
+  saveCredentials({ ...creds, workspaces });
+  console.log(`[dashboard] now serving: ${workspaces.join(", ") || "(none)"}`);
+  void reconcileAll().then(() => ensureServices()).catch((err) => console.error("[dashboard] applying new bindings failed:", err.message));
+}
 var SERVICE_CHECK_MS = 6e4;
 function watchServices() {
   const tick = () => void ensureServices().then((slugs) => slugs.length && console.log(`[dashboard] installed scheduler service for: ${slugs.join(", ")}`)).catch((err) => console.error("[dashboard] ensureServices failed:", err.message));
@@ -17053,7 +17333,7 @@ Done. ${totalThreads} threads, ${totalReplies} messages upserted.`);
 }
 
 // src/commands/slack.ts
-var USAGE2 = `
+var USAGE3 = `
   Usage: flyspace slack <subcommand> [options]
 
   Subcommands:
@@ -17381,7 +17661,7 @@ async function ensureClaudeCodeReady() {
       console.log("  Open a new terminal and run \x1B[1mclaude\x1B[0m to complete the sign-in flow,");
       console.log("  then come back here.\n");
     }
-    const proceed = await confirm2({
+    const proceed = await confirm3({
       message: "Continue setup anyway?",
       default: false
     });
@@ -17841,7 +18121,7 @@ async function runSlackSetup(args) {
     if (!prereq) return;
     const { claudeConfigDir } = prereq;
     if (existsSync27(paths.CONFIG_FILE)) {
-      const reconfigure = await confirm2({
+      const reconfigure = await confirm3({
         message: `Config already exists at ${paths.CONFIG_FILE}. Reconfigure?`,
         default: false
       });
@@ -17988,13 +18268,13 @@ async function runSlackCmd(args) {
       break;
     }
     default:
-      console.log(USAGE2);
+      console.log(USAGE3);
       break;
   }
 }
 
 // src/commands/chat.ts
-var USAGE3 = `
+var USAGE4 = `
   Usage: flyspace chat <subcommand> [options]
 
   Subcommands:
@@ -18140,17 +18420,17 @@ async function runChatCmd(args) {
     case "-h":
     case "--help":
     case void 0:
-      console.log(USAGE3);
+      console.log(USAGE4);
       break;
     default:
       console.error(`Unknown subcommand: ${subcommand}`);
-      console.log(USAGE3);
+      console.log(USAGE4);
       process.exit(1);
   }
 }
 
 // src/commands/mcp.ts
-var USAGE4 = `
+var USAGE5 = `
 Usage: flyspace mcp <server>
 
   Run one of Flyspace's own MCP servers on stdio. Spawned by the agent runtime
@@ -18167,7 +18447,7 @@ Usage: flyspace mcp <server>
 async function runMcpCmd(args) {
   const server = args[0];
   if (!server || server === "-h" || server === "--help") {
-    console.log(USAGE4.trim());
+    console.log(USAGE5.trim());
     return;
   }
   restoreStdout();
@@ -18180,7 +18460,7 @@ async function runMcpCmd(args) {
     }
     default:
       console.error(`Unknown MCP server: ${server}`);
-      console.error(USAGE4.trim());
+      console.error(USAGE5.trim());
       process.exit(1);
   }
 }
@@ -18231,9 +18511,10 @@ async function runDashboard(args) {
   if (mode === "host") acquireHostLock();
   ensureWebBuild();
   const server = await startDashboardServer(preferredPort, host, mode);
-  const profile = getProfile();
+  const served = mode === "host" ? loadCredentials()?.workspaces : void 0;
+  const scope = served ? `workspaces: ${served.join(", ") || "none"}` : `profile: ${getProfile()}`;
   console.log(`
-  Flyspace dashboard (profile: ${profile}, mode: ${mode})`);
+  Flyspace dashboard (${scope}, mode: ${mode})`);
   console.log(`  ${server.url}`);
   if (server.port !== preferredPort) {
     console.log(`  (port ${preferredPort} was busy \u2014 using ${server.port})`);
@@ -18255,7 +18536,7 @@ async function runDashboard(args) {
 
 // src/commands/workspace.ts
 import { existsSync as existsSync29, mkdirSync as mkdirSync11, writeFileSync as writeFileSync11 } from "fs";
-var USAGE5 = `
+var USAGE6 = `
   Usage: flyspace workspace <subcommand> [options]
 
   Subcommands:
@@ -18334,7 +18615,7 @@ async function bindThisHost(workspaceId) {
     return;
   }
   await bindDeviceWorkspace(device.id, workspaceId, device.userId);
-  console.log(`  bound to Host "${device.name}" (restart it to pick up the new workspace)`);
+  console.log(`  bound to Host "${device.name}" (a running Host picks it up within a minute)`);
 }
 function provisionLocal(botName) {
   ensureDirs();
@@ -18394,13 +18675,13 @@ async function runWorkspaceCmd(args) {
       await handleCreate(args.slice(1));
       break;
     default:
-      console.log(USAGE5);
+      console.log(USAGE6);
       process.exit(args[0] ? 1 : 0);
   }
 }
 
 // src/commands/reconcile.ts
-var USAGE6 = `
+var USAGE7 = `
   Usage: flyspace reconcile [<workspace> | --all]
 
   Repair a workspace's local filesystem state (profile dir, config.env,
@@ -18420,7 +18701,7 @@ function printLog(name, log5) {
 }
 async function runReconcileCmd(args) {
   if (args.includes("-h") || args.includes("--help")) {
-    console.log(USAGE6);
+    console.log(USAGE7);
     return;
   }
   loadEnvFiles();
@@ -18436,7 +18717,7 @@ async function runReconcileCmd(args) {
 
 // src/cli.ts
 var XERO_USAGE = false ? "    xero         Connect to Xero and expose it as an MCP server\n" : "";
-var USAGE7 = `
+var USAGE8 = `
   Usage: flyspace <command> [options]
 
   Commands:
@@ -18455,7 +18736,7 @@ var USAGE7 = `
     usage        Show agent token usage and cost for this workspace
     slack        Query Slack (channels, users, post messages)
     chat         Inspect dashboard chat channels and move threads between them
-    profiles     List instances and their service status
+    profiles     List local profiles (bound here? scheduler?) or remove one
     workspace    Provision a workspace (Supabase rows + local profile dirs)
     reconcile    Repair a workspace's local files against Supabase
 ${XERO_USAGE}    dashboard    Start the read-only management dashboard (web UI)
@@ -18543,8 +18824,9 @@ async function main() {
     case "chat":
       await runChatCmd(args.slice(1));
       break;
+    case "profile":
     case "profiles":
-      await runProfiles();
+      await runProfiles(args.slice(1));
       break;
     case "dashboard":
       await runDashboard(args.slice(1));
@@ -18554,12 +18836,12 @@ async function main() {
       break;
     case "-v":
     case "--version":
-      printRaw("0.1.5");
+      printRaw("0.1.7");
       break;
     case "-h":
     case "--help":
     case void 0:
-      printRaw(USAGE7);
+      printRaw(USAGE8);
       break;
     case "xero":
       if (false) {
@@ -18570,7 +18852,7 @@ async function main() {
     // falls through
     default:
       printRaw(`Unknown command: ${command}`);
-      printRaw(USAGE7);
+      printRaw(USAGE8);
       process.exit(1);
   }
 }