flyspace-cli 0.1.6 → 0.1.7

package/dist/cli.js

@@ -430,6 +430,7 @@ async function runConfig(args) {
 }
 
 // src/commands/setup.ts
+import { execSync as execSync4 } from "child_process";
 import { mkdirSync as mkdirSync5 } from "fs";
 import { join as join7 } from "path";
 import { confirm as confirm2 } from "@inquirer/prompts";
@@ -770,15 +771,6 @@ function isServiceRunning(profile) {
   }
   return false;
 }
-async function runProfiles() {
-  const profiles = listProfiles();
-  console.log("\n  Profiles:\n");
-  for (const profile of profiles) {
-    const status = isServiceRunning(profile) ? "\x1B[32mrunning\x1B[0m" : "\x1B[90mstopped\x1B[0m";
-    console.log(`    ${profile.padEnd(20)} ${status}`);
-  }
-  console.log("\n  Target a profile with --profile <name> on any command.\n");
-}
 
 // src/auth/device-auth.ts
 import { createPrivateKey, createPublicKey, generateKeyPairSync, sign } from "crypto";
@@ -932,6 +924,17 @@ async function fetchWhoAmI(base, token) {
     workspaces: toSlugs(json["workspaces"])
   };
 }
+async function boundWorkspaces() {
+  const creds = loadCredentials();
+  if (!creds) return null;
+  try {
+    const me = await fetchWhoAmI(creds.apiUrl, await getAccessToken());
+    saveCredentials({ ...loadCredentials() ?? creds, workspaces: me.workspaces });
+    return { workspaces: me.workspaces, fresh: true };
+  } catch {
+    return { workspaces: creds.workspaces ?? [], fresh: false };
+  }
+}
 async function revokeDevice(base, token) {
   await expectOk(await post(base, "/api/auth/device/revoke", {}, token), "Revoking this device");
 }
@@ -1510,6 +1513,16 @@ async function runAuthCmd(args) {
   }
 }
 
+// src/version.ts
+var CLI_VERSION = true ? "0.1.7" : null;
+function isOlderVersion(a, b) {
+  const parse2 = (v) => v.replace(/^v/, "").split("-")[0].split(".").map(Number);
+  const [pa, pb] = [parse2(a), parse2(b)];
+  if (pa.length !== 3 || pb.length !== 3 || [...pa, ...pb].some(Number.isNaN)) return false;
+  for (let i = 0; i < 3; i++) if (pa[i] !== pb[i]) return pa[i] < pb[i];
+  return false;
+}
+
 // src/commands/setup.ts
 var BOLD2 = "\x1B[1m";
 var DIM2 = "\x1B[2m";
@@ -1541,15 +1554,20 @@ var tilde2 = (p) => p.replace(process.env["HOME"] ?? "\0", "~");
 var ok = (msg) => console.log(`  ${GREEN2}\u2713${RESET2} ${msg}`);
 var bad = (msg) => console.log(`  ${YELLOW2}\u2717${RESET2} ${msg}`);
 async function servedWorkspaces() {
-  const creds = loadCredentials();
+  const bound = await boundWorkspaces();
+  if (!bound.fresh) console.log(`  ${DIM2}Couldn't reach the server; using the workspaces saved at login.${RESET2}`);
+  return bound.workspaces;
+}
+function checkLatestVersion() {
+  if (!CLI_VERSION) return;
+  let latest = "";
   try {
-    const me = await fetchWhoAmI(creds.apiUrl, await getAccessToken());
-    saveCredentials({ ...loadCredentials() ?? creds, workspaces: me.workspaces });
-    return me.workspaces;
+    latest = execSync4(`npm view ${"flyspace-cli"} version`, { encoding: "utf-8", stdio: "pipe", timeout: 1e4 }).trim();
   } catch {
-    console.log(`  ${DIM2}Couldn't reach the server; using the workspaces saved at login.${RESET2}`);
-    return creds.workspaces ?? [];
+    return;
   }
+  if (!latest || !isOlderVersion(CLI_VERSION, latest)) return;
+  bad(`flyspace ${CLI_VERSION} is out of date (latest ${latest})   ${DIM2}run: flyspace upgrade${RESET2}`);
 }
 function loginArgs(args) {
   const out = [];
@@ -1574,6 +1592,7 @@ async function runSetup(args) {
   console.log(`
 ${BOLD2}Flyspace Setup${RESET2}
 `);
+  checkLatestVersion();
   const existing = loadCredentials();
   let workspaces;
   if (existing) {
@@ -1583,7 +1602,10 @@ ${BOLD2}Flyspace Setup${RESET2}
     console.log(`    Device      ${existing.deviceName}`);
     console.log(`    Workspaces  ${workspaces.length ? workspaces.join(", ") : "(none)"}`);
     const others = listProfiles().filter((p) => p !== "default" && !workspaces.includes(p));
-    if (others.length) console.log(`    ${DIM2}Other local profiles (left alone): ${others.join(", ")}${RESET2}`);
+    if (others.length) {
+      console.log(`    ${DIM2}Not bound here, nothing runs for them: ${others.join(", ")}${RESET2}`);
+      console.log(`    ${DIM2}See: flyspace profiles   Clean up: flyspace profiles remove <name>${RESET2}`);
+    }
     console.log("");
     const keep = args.includes("--yes") || !process.stdin.isTTY ? true : await confirm2({ message: "Keep using this account and device?", default: true });
     if (!keep) {
@@ -1637,7 +1659,7 @@ ${BOLD2}Flyspace Setup${RESET2}
 
 // src/commands/uninstall.ts
 import { existsSync as existsSync8, unlinkSync as unlinkSync2 } from "fs";
-import { execSync as execSync4 } from "child_process";
+import { execSync as execSync5 } from "child_process";
 import { basename as basename2, join as join8 } from "path";
 import { homedir as homedir4, platform as platform5 } from "os";
 function log2(msg) {
@@ -1651,7 +1673,7 @@ function warn2(msg) {
   console.log(`\x1B[33m!\x1B[0m ${msg}`);
 }
 function run2(cmd) {
-  execSync4(cmd, { encoding: "utf-8", stdio: "pipe" });
+  execSync5(cmd, { encoding: "utf-8", stdio: "pipe" });
 }
 async function runUninstall() {
   const os = platform5();
@@ -1698,8 +1720,89 @@ async function runUninstall() {
   console.log("\n  Config and data directories were NOT removed.");
 }
 
+// src/commands/profiles-cmd.ts
+import { rmSync as rmSync3 } from "fs";
+var OPERATOR_NOTE = "This machine is an operator Host (it has Supabase credentials), so it serves every workspace, bound or not.";
+var USAGE = `
+  Usage: flyspace profiles [list]
+         flyspace profiles remove <name>
+
+  list     Every local profile, whether this Host is bound to it, and the
+           state of its scheduler service.
+  remove   Unload a profile's scheduler and delete its local config. Only for
+           profiles this Host is not bound to; the Workspace itself, its
+           channel folders and its data directory are left alone.
+`;
+async function boundHere() {
+  const bound = await boundWorkspaces();
+  if (bound && !bound.fresh) console.log("  \x1B[2mCouldn't reach the server; using the workspaces saved at login.\x1B[0m");
+  return bound?.workspaces ?? null;
+}
+async function listCmd() {
+  const bound = await boundHere();
+  console.log("\n  Profiles:\n");
+  console.log(`    ${"NAME".padEnd(24)} ${"BOUND HERE".padEnd(12)} SCHEDULER`);
+  for (const profile of listProfiles()) {
+    const scheduler = !isServiceInstalled(profile) ? "\x1B[90mnot installed\x1B[0m" : isServiceRunning(profile) ? "\x1B[32mrunning\x1B[0m" : "\x1B[90mstopped\x1B[0m";
+    const here = bound === null ? "-".padEnd(12) : bound.includes(profile) ? "yes".padEnd(12) : `\x1B[33m${"no".padEnd(12)}\x1B[0m`;
+    console.log(`    ${profile.padEnd(24)} ${here} ${scheduler}`);
+  }
+  const missing = (bound ?? []).filter((w) => !listProfiles().includes(w));
+  for (const w of missing) console.log(`    ${w.padEnd(24)} ${"yes".padEnd(12)} \x1B[33mno local profile yet\x1B[0m`);
+  if (bound?.length === 0) {
+    console.log("\n  This Host is not bound to any workspace, so no scheduler runs here. Run: flyspace setup");
+  }
+  if (hasSupabaseCredentials()) {
+    console.log(`
+  ${OPERATOR_NOTE}`);
+  } else if (bound && listProfiles().some((p) => p !== DEFAULT_PROFILE && !bound.includes(p))) {
+    console.log("\n  Profiles not bound here run nothing on this machine. Remove one with: flyspace profiles remove <name>");
+  }
+  console.log("");
+}
+async function removeCmd(name) {
+  if (!name) return void console.log(USAGE);
+  if (name === DEFAULT_PROFILE) {
+    console.error("  The default profile cannot be removed.");
+    process.exit(1);
+  }
+  if (!listProfiles().includes(name)) {
+    console.error(`  No local profile named "${name}".`);
+    process.exit(1);
+  }
+  if (hasSupabaseCredentials()) {
+    console.error(`  ${OPERATOR_NOTE} Removing a profile would stop that workspace's schedules.`);
+    process.exit(1);
+  }
+  const bound = await boundHere();
+  if (bound === null) {
+    console.error("  This machine has no device login, so it serves every workspace; removing a profile would be undone.");
+    process.exit(1);
+  }
+  if (bound.includes(name)) {
+    console.error(`  This Host is still bound to "${name}" on the server, so the Host would reinstall it within a minute.`);
+    console.error("  Unbinding a Host from a workspace is not available yet.");
+    process.exit(1);
+  }
+  const { configDir: configDir2, dataDir } = runWithProfile(name, () => ({ configDir: paths.CONFIG_DIR, dataDir: paths.DATA_DIR }));
+  if (isServiceInstalled(name)) await runWithProfile(name, runUninstall);
+  rmSync3(configDir2, { recursive: true, force: true });
+  console.log(`\x1B[32m+\x1B[0m Local config removed: ${configDir2}`);
+  console.log(`
+  Kept: ${dataDir} (sessions, logs) and any ~/Flyspace/${name}/ channel folders.`);
+  console.log(`  The workspace and its server-side records are unchanged; this only cleaned up this machine.
+`);
+}
+async function runProfiles(args = []) {
+  loadEnvFiles();
+  const [sub, name] = args;
+  if (sub === "remove" || sub === "rm") return removeCmd(name);
+  if (!sub || sub === "list" || sub === "ls") return listCmd();
+  console.log(USAGE);
+}
+
 // src/commands/upgrade.ts
-import { execSync as execSync5 } from "child_process";
+import { execSync as execSync6 } from "child_process";
 function restartInstalledProfiles() {
   if (isHostServiceInstalled()) {
     console.log(restartHostService() ? "\nHost restarted." : "\nHost restart failed; run: flyspace setup --start-host --restart");
@@ -1720,18 +1823,18 @@ Restarting ${installed.length} instance(s)...`);
   }
 }
 async function runUpgrade() {
-  const current = "0.1.6";
+  const current = "0.1.7";
   console.log(`Current version: ${current}`);
   console.log("Checking for updates...\n");
   try {
-    const latest = execSync5(`npm view ${"flyspace-cli"} version`, { encoding: "utf-8" }).trim();
+    const latest = execSync6(`npm view ${"flyspace-cli"} version`, { encoding: "utf-8" }).trim();
     if (latest === current) {
       console.log(`Already on the latest version (${current}).`);
       return;
     }
     console.log(`New version available: ${latest}`);
     console.log("Upgrading...\n");
-    execSync5(`npm install -g ${"flyspace-cli"}@latest`, { stdio: "inherit" });
+    execSync6(`npm install -g ${"flyspace-cli"}@latest`, { stdio: "inherit" });
     console.log(`
 Upgraded from ${current} to ${latest}.`);
     restartInstalledProfiles();
@@ -1747,7 +1850,7 @@ You can upgrade manually with: npm install -g ${"flyspace-cli"}@latest`);
 
 // src/commands/automation.ts
 import { WebClient } from "@slack/web-api";
-var USAGE = `
+var USAGE2 = `
   Usage: flyspace automation <subcommand> [options]
 
   Subcommands:
@@ -2085,7 +2188,7 @@ async function runAutomationCmd(args) {
       await handleRun(manager, args[1]);
       break;
     default:
-      console.log(USAGE);
+      console.log(USAGE2);
       break;
   }
 }
@@ -2276,7 +2379,7 @@ function breakdown(store, by, days) {
 }
 
 // src/commands/stop.ts
-import { execSync as execSync6 } from "child_process";
+import { execSync as execSync7 } from "child_process";
 import { platform as platform6 } from "os";
 function log3(msg) {
   console.log(`
@@ -2295,7 +2398,7 @@ async function runStop() {
     const plist = plistPath(profile);
     log3("Stopping Flyspace service...");
     try {
-      execSync6(`launchctl unload "${plist}"`, { stdio: "pipe" });
+      execSync7(`launchctl unload "${plist}"`, { stdio: "pipe" });
       success3("Service stopped. Run `flyspace restart` to start again.");
     } catch {
       warn3("Service is not currently loaded.");
@@ -2303,7 +2406,7 @@ async function runStop() {
   } else if (os === "linux") {
     log3("Stopping Flyspace service...");
     try {
-      execSync6(`systemctl --user stop ${systemdUnitName(profile)}`, { stdio: "pipe" });
+      execSync7(`systemctl --user stop ${systemdUnitName(profile)}`, { stdio: "pipe" });
       success3("Service stopped. Run `flyspace restart` to start again.");
     } catch {
       warn3("Service is not currently running.");
@@ -3897,16 +4000,8 @@ import { serveStatic } from "@hono/node-server/serve-static";
 
 // src/reconcile.ts
 import { existsSync as existsSync11, mkdirSync as mkdirSync6, writeFileSync as writeFileSync5 } from "fs";
-async function boundWorkspaces() {
-  const creds = loadCredentials();
-  if (!creds) return null;
-  try {
-    const me = await fetchWhoAmI(creds.apiUrl, await getAccessToken());
-    saveCredentials({ ...loadCredentials() ?? creds, workspaces: me.workspaces });
-    return me.workspaces;
-  } catch {
-    return creds.workspaces ?? [];
-  }
+async function boundWorkspaces2() {
+  return (await boundWorkspaces())?.workspaces ?? null;
 }
 async function reconcileProfile(profile) {
   return runWithProfile(profile, async () => {
@@ -3933,7 +4028,7 @@ async function reconcileProfile(profile) {
   });
 }
 async function reconcileAll() {
-  const bound = hasSupabaseCredentials() ? null : await boundWorkspaces();
+  const bound = hasSupabaseCredentials() ? null : await boundWorkspaces2();
   const slugs = new Set(bound ?? [...(await listWorkspaces()).map((w) => w.slug), ...listProfiles()]);
   const results = /* @__PURE__ */ new Map();
   for (const slug of slugs) {
@@ -3947,7 +4042,7 @@ async function reconcileAll() {
   return results;
 }
 async function ensureServices() {
-  const bound = await boundWorkspaces();
+  const bound = await boundWorkspaces2();
   const slugs = new Set(bound ?? [...(await listWorkspaces()).map((w) => w.slug), ...listProfiles()]);
   slugs.delete(DEFAULT_PROFILE);
   const installed = [];
@@ -6961,7 +7056,7 @@ import {
   readFileSync as readFileSync10,
   realpathSync,
   renameSync,
-  rmSync as rmSync4,
+  rmSync as rmSync5,
   statSync as statSync5,
   writeFileSync as writeFileSync7
 } from "fs";
@@ -7255,7 +7350,7 @@ import { readFileSync as readFileSync9 } from "fs";
 import { homedir as homedir7 } from "os";
 
 // src/mcp/config.ts
-import { mkdtempSync, rmSync as rmSync3, writeFileSync as writeFileSync6 } from "fs";
+import { mkdtempSync, rmSync as rmSync4, writeFileSync as writeFileSync6 } from "fs";
 import { tmpdir } from "os";
 import { join as join14 } from "path";
 
@@ -7948,7 +8043,7 @@ function writeMcpConfigFile(config) {
   writeFileSync6(path, JSON.stringify(config), { mode: 384 });
   return {
     path,
-    cleanup: () => rmSync3(dir, { recursive: true, force: true })
+    cleanup: () => rmSync4(dir, { recursive: true, force: true })
   };
 }
 async function withMcpConfig(profile, connectionIds, fn) {
@@ -10164,7 +10259,7 @@ function deleteDocEntry(root, path) {
   }
   const isDir2 = stat.isDirectory();
   if (!isDir2 && !stat.isFile() && !stat.isSymbolicLink()) return { status: "not-found" };
-  rmSync4(abs, { recursive: isDir2 });
+  rmSync5(abs, { recursive: isDir2 });
   return {
     status: "ok",
     path: relative(root, abs).split(sep).join("/"),
@@ -14881,7 +14976,7 @@ function loadHostPublicKey() {
 // src/dashboard/host-lock.ts
 import { execFileSync as execFileSync3 } from "child_process";
 import { randomBytes as randomBytes5 } from "crypto";
-import { mkdirSync as mkdirSync10, readFileSync as readFileSync13, rmSync as rmSync5, writeFileSync as writeFileSync9 } from "fs";
+import { mkdirSync as mkdirSync10, readFileSync as readFileSync13, rmSync as rmSync6, writeFileSync as writeFileSync9 } from "fs";
 import { join as join21 } from "path";
 function hostLockPath() {
   return join21(paths.BASE_DATA_DIR, "host.lock");
@@ -14917,7 +15012,7 @@ function acquireHostLock() {
     try {
       writeFileSync9(path, body, { flag: "wx", mode: 384 });
       const release2 = () => {
-        if (readLockPid(path) === process.pid) rmSync5(path, { force: true });
+        if (readLockPid(path) === process.pid) rmSync6(path, { force: true });
       };
       process.once("exit", release2);
       return release2;
@@ -14931,7 +15026,7 @@ function acquireHostLock() {
           `Another Flyspace Host is already running on this machine (pid ${holder}). Stop it first, or check for a second CLI install (\`which -a flyspace\`). Two Hosts overwrite each other's skill mirror.`
         );
       }
-      rmSync5(path, { force: true });
+      rmSync6(path, { force: true });
     }
   }
   throw new Error(`Could not take the Host lock at ${path}`);
@@ -15149,16 +15244,35 @@ async function listWorkspaceDevices(workspaceId) {
   if (error2) fail("listWorkspaceDevices", error2);
   return (data ?? []).map((r) => toDevice(r.devices)).sort((a, b) => b.createdAt.localeCompare(a.createdAt));
 }
+async function touchDevice(deviceId) {
+  const { error: error2 } = await getSupabaseClient().from("devices").update({ last_seen_at: (/* @__PURE__ */ new Date()).toISOString() }).eq("id", deviceId);
+  if (error2) fail("touchDevice", error2);
+}
+var STALE_HOST_MS = 14 * 24 * 60 * 6e4;
+var isStale = (lastSeenAt) => !!lastSeenAt && Date.now() - Date.parse(lastSeenAt) > STALE_HOST_MS;
 async function listWorkspaceHosts(workspaceIds, exceptPublicKey) {
   const hosts2 = /* @__PURE__ */ new Map();
   if (!workspaceIds.length) return hosts2;
-  const { data, error: error2 } = await getSupabaseClient().from("device_workspaces").select("workspace_id, devices!inner(name, public_key, revoked_at)").in("workspace_id", workspaceIds).is("devices.revoked_at", null);
+  const { data, error: error2 } = await getSupabaseClient().from("device_workspaces").select("workspace_id, devices!inner(name, public_key, revoked_at, last_seen_at)").in("workspace_id", workspaceIds).is("devices.revoked_at", null);
   if (error2) fail("listWorkspaceHosts", error2);
   for (const r of data ?? []) {
-    if (r.devices.public_key !== exceptPublicKey) hosts2.set(r.workspace_id, r.devices.name);
+    if (r.devices.public_key !== exceptPublicKey && !isStale(r.devices.last_seen_at)) {
+      hosts2.set(r.workspace_id, r.devices.name);
+    }
   }
   return hosts2;
 }
+async function releaseStaleHosts(workspaceIds, exceptPublicKey) {
+  if (!workspaceIds.length) return;
+  const db = getSupabaseClient();
+  const { data, error: error2 } = await db.from("device_workspaces").select("device_id, workspace_id, devices!inner(public_key, last_seen_at)").in("workspace_id", workspaceIds);
+  if (error2) fail("releaseStaleHosts", error2);
+  for (const r of data ?? []) {
+    if (r.devices.public_key === exceptPublicKey || !isStale(r.devices.last_seen_at)) continue;
+    const { error: delError } = await db.from("device_workspaces").delete().eq("device_id", r.device_id).eq("workspace_id", r.workspace_id);
+    if (delError) fail("releaseStaleHosts", delError);
+  }
+}
 async function userEmail(userId) {
   const { data, error: error2 } = await getSupabaseClient().auth.admin.getUserById(userId);
   if (error2) return null;
@@ -15941,9 +16055,21 @@ async function revalidateDeviceScopes() {
       continue;
     }
     const workspaces = (await listDeviceWorkspaces(device)).map((w) => w.slug);
-    for (const scope of hosts.values()) if (scope.deviceId === deviceId) scope.workspaces = workspaces;
+    for (const [ws, scope] of hosts) {
+      if (scope.deviceId !== deviceId) continue;
+      const changed = (scope.workspaces ?? []).join() !== workspaces.join();
+      scope.workspaces = workspaces;
+      if (changed) send(ws, { type: "workspaces", workspaces });
+    }
+    if (!device.lastSeenAt || Date.now() - Date.parse(device.lastSeenAt) > LAST_SEEN_RESOLUTION_MS) {
+      await touchDevice(deviceId);
+    }
   }
 }
+var LAST_SEEN_RESOLUTION_MS = 60 * 6e4;
+function minCliVersion() {
+  return process.env["FLYSPACE_MIN_CLI_VERSION"]?.trim() || null;
+}
 function attachHostSocket(server) {
   const wss = new WebSocketServer({ server, path: HOST_SOCKET_PATH });
   const legacyPublicKey = loadHostPublicKey();
@@ -15984,10 +16110,19 @@ function attachHostSocket(server) {
             ws.close(1008, "bad signature");
             return;
           }
+          const min = minCliVersion();
+          if (min && msg.cliVersion && isOlderVersion(msg.cliVersion, min)) {
+            console.error(`[host-socket] rejecting Host on CLI ${msg.cliVersion} (minimum ${min})`);
+            send(ws, { type: "auth-failed", reason: "cli too old", minCliVersion: min });
+            ws.close(1008, "cli too old");
+            return;
+          }
           supersedeSameIdentity(scope2, ws);
           lastAuthFailure = null;
           addHost(ws, scope2);
-          send(ws, { type: "auth-ok" });
+          send(ws, scope2.workspaces ? { type: "auth-ok", workspaces: scope2.workspaces } : { type: "auth-ok" });
+          if (scope2.deviceId) void touchDevice(scope2.deviceId).catch(() => {
+          });
           console.log(`[host-socket] Host authenticated (authPath: ${scope2.authPath})`);
           if (scope2.workspaces) void markAgentConnected(scope2.workspaces);
         })();
@@ -16110,7 +16245,7 @@ function remoteAgentCallbacks() {
 }
 var RECONNECT_BASE_MS = 1e3;
 var RECONNECT_MAX_MS = 3e4;
-function connectHostSocket(url, callbacks, onAuthenticated) {
+function connectHostSocket(url, callbacks, onAuthenticated, onWorkspaces) {
   const credentials = loadCredentials();
   const deviceId = credentials?.deviceId;
   const privateKey = deviceId ? ensureDeviceKey().privateKey : loadHostPrivateKey();
@@ -16142,11 +16277,23 @@ function connectHostSocket(url, callbacks, onAuthenticated) {
       if (!msg) return;
       if (msg.type === "challenge") {
         const signature = signRaw(null, Buffer.from(msg.nonce, "base64"), privateKey).toString("base64");
-        send(ws, deviceId ? { type: "auth", signature, deviceId } : { type: "auth", signature });
+        const version = CLI_VERSION ? { cliVersion: CLI_VERSION } : {};
+        send(ws, deviceId ? { type: "auth", signature, deviceId, ...version } : { type: "auth", signature, ...version });
         return;
       }
       if (msg.type === "auth-failed") {
         console.error(`[host-socket] auth rejected: ${msg.reason}`);
+        if (msg.minCliVersion) {
+          console.error(
+            `[host-socket] This Host runs flyspace ${CLI_VERSION} but the Workspace needs ${msg.minCliVersion} or later.
+  Upgrade, then restart the Host:  flyspace upgrade`
+          );
+          stopped = true;
+        }
+        return;
+      }
+      if (msg.type === "workspaces") {
+        onWorkspaces?.(msg.workspaces);
         return;
       }
       if (msg.type === "auth-ok") {
@@ -16158,6 +16305,7 @@ function connectHostSocket(url, callbacks, onAuthenticated) {
           send(ws, { type: "host-config", configs: buildHostConfigSnapshot() });
         }, HOST_CONFIG_PUSH_INTERVAL_MS);
         onAuthenticated?.();
+        if (msg.workspaces) onWorkspaces?.(msg.workspaces);
         return;
       }
       if (msg.type === "db-result") {
@@ -16500,6 +16648,7 @@ function createDeviceAuthRouter() {
     if (!decided) {
       return c.json({ error: "That code was already used." }, 409);
     }
+    await releaseStaleHosts(workspaceIds, pending3.publicKey);
     return c.json({ ok: true });
   });
   return app;
@@ -16872,7 +17021,7 @@ async function startDashboardServer(preferredPort = DEFAULT_DASHBOARD_PORT, host
   const bootCallbacks = new Proxy({}, {
     get: (_t, prop) => lateCallbacks?.[prop]
   });
-  const earlyHostSocket = mode === "host" && !hasSupabaseCredentials() && loadCredentials() ? (setSupabaseClient(createHostDbClient()), connectHostSocket(dataSocketUrl(), bootCallbacks, () => onHostConnected?.())) : void 0;
+  const earlyHostSocket = mode === "host" && !hasSupabaseCredentials() && loadCredentials() ? (setSupabaseClient(createHostDbClient()), connectHostSocket(dataSocketUrl(), bootCallbacks, () => onHostConnected?.(), onBindingsChanged)) : void 0;
   if (servesHost) {
     await reconcileAll().catch(
       (err) => console.error("[dashboard] reconcileAll failed:", err.message)
@@ -16947,7 +17096,7 @@ The JSON API is live under /api.` : "This install has no bundled Workspace UI.\n
   if (mode === "host") relayToken = publishHostEndpoint(port);
   if (mode === "data") attachHostSocket(server);
   const stopHostStatusBroadcast = mode === "data" ? startHostStatusBroadcast() : void 0;
-  const hostSocketClient = earlyHostSocket ?? (mode === "host" && chatAgent ? connectHostSocket(dataSocketUrl(), localAgentCallbacks(chatAgent), () => onHostConnected?.()) : void 0);
+  const hostSocketClient = earlyHostSocket ?? (mode === "host" && chatAgent ? connectHostSocket(dataSocketUrl(), localAgentCallbacks(chatAgent), () => onHostConnected?.(), onBindingsChanged) : void 0);
   const stopPushWatcher = earlyHostSocket ? () => {
   } : startPushWatcher();
   const displayHost = host === "0.0.0.0" || host === "::" ? "127.0.0.1" : host;
@@ -16968,6 +17117,13 @@ The JSON API is live under /api.` : "This install has no bundled Workspace UI.\n
     }
   };
 }
+function onBindingsChanged(workspaces) {
+  const creds = loadCredentials();
+  if (!creds || (creds.workspaces ?? []).join() === workspaces.join()) return;
+  saveCredentials({ ...creds, workspaces });
+  console.log(`[dashboard] now serving: ${workspaces.join(", ") || "(none)"}`);
+  void reconcileAll().then(() => ensureServices()).catch((err) => console.error("[dashboard] applying new bindings failed:", err.message));
+}
 var SERVICE_CHECK_MS = 6e4;
 function watchServices() {
   const tick = () => void ensureServices().then((slugs) => slugs.length && console.log(`[dashboard] installed scheduler service for: ${slugs.join(", ")}`)).catch((err) => console.error("[dashboard] ensureServices failed:", err.message));
@@ -17177,7 +17333,7 @@ Done. ${totalThreads} threads, ${totalReplies} messages upserted.`);
 }
 
 // src/commands/slack.ts
-var USAGE2 = `
+var USAGE3 = `
   Usage: flyspace slack <subcommand> [options]
 
   Subcommands:
@@ -18112,13 +18268,13 @@ async function runSlackCmd(args) {
       break;
     }
     default:
-      console.log(USAGE2);
+      console.log(USAGE3);
       break;
   }
 }
 
 // src/commands/chat.ts
-var USAGE3 = `
+var USAGE4 = `
   Usage: flyspace chat <subcommand> [options]
 
   Subcommands:
@@ -18264,17 +18420,17 @@ async function runChatCmd(args) {
     case "-h":
     case "--help":
     case void 0:
-      console.log(USAGE3);
+      console.log(USAGE4);
       break;
     default:
       console.error(`Unknown subcommand: ${subcommand}`);
-      console.log(USAGE3);
+      console.log(USAGE4);
       process.exit(1);
   }
 }
 
 // src/commands/mcp.ts
-var USAGE4 = `
+var USAGE5 = `
 Usage: flyspace mcp <server>
 
   Run one of Flyspace's own MCP servers on stdio. Spawned by the agent runtime
@@ -18291,7 +18447,7 @@ Usage: flyspace mcp <server>
 async function runMcpCmd(args) {
   const server = args[0];
   if (!server || server === "-h" || server === "--help") {
-    console.log(USAGE4.trim());
+    console.log(USAGE5.trim());
     return;
   }
   restoreStdout();
@@ -18304,7 +18460,7 @@ async function runMcpCmd(args) {
     }
     default:
       console.error(`Unknown MCP server: ${server}`);
-      console.error(USAGE4.trim());
+      console.error(USAGE5.trim());
       process.exit(1);
   }
 }
@@ -18380,7 +18536,7 @@ async function runDashboard(args) {
 
 // src/commands/workspace.ts
 import { existsSync as existsSync29, mkdirSync as mkdirSync11, writeFileSync as writeFileSync11 } from "fs";
-var USAGE5 = `
+var USAGE6 = `
   Usage: flyspace workspace <subcommand> [options]
 
   Subcommands:
@@ -18459,7 +18615,7 @@ async function bindThisHost(workspaceId) {
     return;
   }
   await bindDeviceWorkspace(device.id, workspaceId, device.userId);
-  console.log(`  bound to Host "${device.name}" (restart it to pick up the new workspace)`);
+  console.log(`  bound to Host "${device.name}" (a running Host picks it up within a minute)`);
 }
 function provisionLocal(botName) {
   ensureDirs();
@@ -18519,13 +18675,13 @@ async function runWorkspaceCmd(args) {
       await handleCreate(args.slice(1));
       break;
     default:
-      console.log(USAGE5);
+      console.log(USAGE6);
       process.exit(args[0] ? 1 : 0);
   }
 }
 
 // src/commands/reconcile.ts
-var USAGE6 = `
+var USAGE7 = `
   Usage: flyspace reconcile [<workspace> | --all]
 
   Repair a workspace's local filesystem state (profile dir, config.env,
@@ -18545,7 +18701,7 @@ function printLog(name, log5) {
 }
 async function runReconcileCmd(args) {
   if (args.includes("-h") || args.includes("--help")) {
-    console.log(USAGE6);
+    console.log(USAGE7);
     return;
   }
   loadEnvFiles();
@@ -18561,7 +18717,7 @@ async function runReconcileCmd(args) {
 
 // src/cli.ts
 var XERO_USAGE = false ? "    xero         Connect to Xero and expose it as an MCP server\n" : "";
-var USAGE7 = `
+var USAGE8 = `
   Usage: flyspace <command> [options]
 
   Commands:
@@ -18580,7 +18736,7 @@ var USAGE7 = `
     usage        Show agent token usage and cost for this workspace
     slack        Query Slack (channels, users, post messages)
     chat         Inspect dashboard chat channels and move threads between them
-    profiles     List instances and their service status
+    profiles     List local profiles (bound here? scheduler?) or remove one
     workspace    Provision a workspace (Supabase rows + local profile dirs)
     reconcile    Repair a workspace's local files against Supabase
 ${XERO_USAGE}    dashboard    Start the read-only management dashboard (web UI)
@@ -18668,8 +18824,9 @@ async function main() {
     case "chat":
       await runChatCmd(args.slice(1));
       break;
+    case "profile":
     case "profiles":
-      await runProfiles();
+      await runProfiles(args.slice(1));
       break;
     case "dashboard":
       await runDashboard(args.slice(1));
@@ -18679,12 +18836,12 @@ async function main() {
       break;
     case "-v":
     case "--version":
-      printRaw("0.1.6");
+      printRaw("0.1.7");
       break;
     case "-h":
     case "--help":
     case void 0:
-      printRaw(USAGE7);
+      printRaw(USAGE8);
       break;
     case "xero":
       if (false) {
@@ -18695,7 +18852,7 @@ async function main() {
     // falls through
     default:
       printRaw(`Unknown command: ${command}`);
-      printRaw(USAGE7);
+      printRaw(USAGE8);
       process.exit(1);
   }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flyspace-cli",
-  "version": "0.1.6",
+  "version": "0.1.7",
   "description": "AI-native headless community OS",
   "license": "SEE LICENSE IN LICENSE",
   "private": false,