flyspace-cli 0.1.6 → 0.1.9

package/dist/cli.js

@@ -52,6 +52,7 @@ import {
   expandPath,
   extractCategories,
   findChannel,
+  findChannelByAgentName,
   findChannelById,
   findSkillDetail,
   getAgentPaused,
@@ -106,6 +107,7 @@ import {
   mcpStrictConfigEnabled,
   mimetypeSizeLimit,
   modelLabel,
+  pinnedClaudeConfigDir,
   readSkillFile,
   recentRunsForWorkspace,
   refreshAutomationRegistry,
@@ -150,7 +152,7 @@ import {
   warnOnBrokenChannelCwds,
   workspaceSkillsDir,
   writeSkillFile
-} from "./chunk-BZYTXXF7.js";
+} from "./chunk-JG6LNX5D.js";
 import {
   firstReplyBody,
   getThread,
@@ -430,13 +432,14 @@ async function runConfig(args) {
 }
 
 // src/commands/setup.ts
+import { execSync as execSync4 } from "child_process";
 import { mkdirSync as mkdirSync5 } from "fs";
 import { join as join7 } from "path";
 import { confirm as confirm2 } from "@inquirer/prompts";
 
 // src/service.ts
 import { execSync } from "child_process";
-import { existsSync as existsSync3 } from "fs";
+import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
 import { join as join2 } from "path";
 import { homedir, platform } from "os";
 function serviceLabel(profile) {
@@ -465,6 +468,22 @@ function isServiceInstalled(profile) {
   if (platform() === "linux") return existsSync3(systemdUnitPath(profile));
   return false;
 }
+function serviceBinaryMissing(file) {
+  let text;
+  try {
+    text = readFileSync3(file, "utf-8");
+  } catch {
+    return false;
+  }
+  const bin = text.match(/<key>ProgramArguments<\/key>\s*<array>\s*<string>([^<]+)<\/string>/)?.[1] ?? text.match(/^ExecStart=(\S+)/m)?.[1];
+  return !!bin && !existsSync3(bin);
+}
+function profileServiceFile(profile) {
+  return platform() === "darwin" ? plistPath(profile) : systemdUnitPath(profile);
+}
+function hostServiceFile() {
+  return platform() === "darwin" ? hostPlistPath() : join2(homedir(), ".config", "systemd", "user", `${HOST_SYSTEMD_UNIT}.service`);
+}
 function restartService(profile) {
   const os = platform();
   if (os === "darwin") {
@@ -496,10 +515,7 @@ function hostPlistPath() {
   return join2(homedir(), "Library", "LaunchAgents", `${HOST_SERVICE_LABEL}.plist`);
 }
 function isHostServiceInstalled() {
-  if (platform() === "darwin") return existsSync3(hostPlistPath());
-  if (platform() === "linux") {
-    return existsSync3(join2(homedir(), ".config", "systemd", "user", `${HOST_SYSTEMD_UNIT}.service`));
-  }
+  if (platform() === "darwin" || platform() === "linux") return existsSync3(hostServiceFile());
   return false;
 }
 function restartHostService() {
@@ -517,9 +533,29 @@ function restartHostService() {
   }
   return false;
 }
+function serviceActive(label2, unit) {
+  try {
+    if (platform() === "darwin") {
+      const out = execSync(`launchctl print gui/${process.getuid?.()}/${label2}`, { encoding: "utf-8", stdio: "pipe" });
+      return /^\s*state = running$/m.test(out);
+    }
+    if (platform() === "linux") {
+      execSync(`systemctl --user is-active --quiet ${unit}`, { stdio: "pipe" });
+      return true;
+    }
+  } catch {
+  }
+  return false;
+}
+function isServiceRunning(profile) {
+  return serviceActive(serviceLabel(profile), systemdUnitName(profile));
+}
+function isHostServiceRunning() {
+  return serviceActive(HOST_SERVICE_LABEL, HOST_SYSTEMD_UNIT);
+}
 
 // src/commands/install.ts
-import { existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync3, unlinkSync } from "fs";
+import { existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync4, writeFileSync as writeFileSync3, unlinkSync } from "fs";
 import { execSync as execSync2 } from "child_process";
 import { dirname as dirname2, join as join3, resolve as resolve3 } from "path";
 import { homedir as homedir2, platform as platform2 } from "os";
@@ -547,6 +583,11 @@ function detectClaudeBinDir() {
     return void 0;
   }
 }
+function nodeShimDirs() {
+  return [join3(homedir2(), ".local", "share", "mise", "shims"), join3(homedir2(), ".asdf", "shims")].filter(
+    (d) => existsSync4(d)
+  );
+}
 function detectCustieBin() {
   const argv1 = process.argv[1];
   if (argv1) {
@@ -561,7 +602,7 @@ function detectCustieBin() {
 function readEnvFile() {
   if (!existsSync4(paths.CONFIG_FILE)) return {};
   const vars = {};
-  for (const line of readFileSync3(paths.CONFIG_FILE, "utf-8").split("\n")) {
+  for (const line of readFileSync4(paths.CONFIG_FILE, "utf-8").split("\n")) {
     const trimmed = line.trim();
     if (!trimmed || trimmed.startsWith("#")) continue;
     const eq = trimmed.indexOf("=");
@@ -609,12 +650,10 @@ async function installMacOS(spec) {
   mkdirSync2(logDir, { recursive: true });
   const envVars = spec.env;
   const homebrewBin = existsSync4("/opt/homebrew/bin") ? "/opt/homebrew/bin" : void 0;
-  const asdfShims = join3(homedir2(), ".asdf", "shims");
-  const asdfBin = existsSync4(asdfShims) ? asdfShims : void 0;
   const pathParts = [
     dirname2(nodePath),
     claudeBinDir,
-    asdfBin,
+    ...nodeShimDirs(),
     homebrewBin,
     "/usr/local/bin",
     "/usr/bin",
@@ -683,6 +722,7 @@ async function installLinux(spec) {
   const pathParts = [
     dirname2(nodePath),
     claudeBinDir,
+    ...nodeShimDirs(),
     linuxbrewBin,
     "/usr/local/bin",
     "/usr/bin",
@@ -756,7 +796,7 @@ function listProfiles() {
   }
   return profiles;
 }
-function isServiceRunning(profile) {
+function isServiceRunning2(profile) {
   try {
     if (platform3() === "darwin") {
       const out = execSync3("launchctl list", { encoding: "utf-8", stdio: "pipe" });
@@ -770,19 +810,10 @@ function isServiceRunning(profile) {
   }
   return false;
 }
-async function runProfiles() {
-  const profiles = listProfiles();
-  console.log("\n  Profiles:\n");
-  for (const profile of profiles) {
-    const status = isServiceRunning(profile) ? "\x1B[32mrunning\x1B[0m" : "\x1B[90mstopped\x1B[0m";
-    console.log(`    ${profile.padEnd(20)} ${status}`);
-  }
-  console.log("\n  Target a profile with --profile <name> on any command.\n");
-}
 
 // src/auth/device-auth.ts
 import { createPrivateKey, createPublicKey, generateKeyPairSync, sign } from "crypto";
-import { existsSync as existsSync6, mkdirSync as mkdirSync3, readFileSync as readFileSync4, rmSync as rmSync2, writeFileSync as writeFileSync4 } from "fs";
+import { existsSync as existsSync6, mkdirSync as mkdirSync3, readFileSync as readFileSync5, rmSync as rmSync2, writeFileSync as writeFileSync4 } from "fs";
 import { dirname as dirname3, join as join5 } from "path";
 var DEFAULT_API_URL = "https://app.flyspace.ai";
 var EXPIRY_SKEW_MS = 6e4;
@@ -810,7 +841,7 @@ function ensureDeviceKey(path = deviceKeyPath()) {
     writeFileSync4(path, privateKey2.export({ type: "pkcs8", format: "pem" }), { mode: 384 });
     created = true;
   }
-  const privateKey = createPrivateKey(readFileSync4(path, "utf8"));
+  const privateKey = createPrivateKey(readFileSync5(path, "utf8"));
   const publicKeyBase64 = createPublicKey(privateKey).export({ type: "spki", format: "der" }).toString(
     "base64"
   );
@@ -819,7 +850,7 @@ function ensureDeviceKey(path = deviceKeyPath()) {
 function loadCredentials(path = credentialsPath()) {
   if (!existsSync6(path)) return null;
   try {
-    return JSON.parse(readFileSync4(path, "utf8"));
+    return JSON.parse(readFileSync5(path, "utf8"));
   } catch {
     return null;
   }
@@ -932,6 +963,17 @@ async function fetchWhoAmI(base, token) {
     workspaces: toSlugs(json["workspaces"])
   };
 }
+async function boundWorkspaces() {
+  const creds = loadCredentials();
+  if (!creds) return null;
+  try {
+    const me = await fetchWhoAmI(creds.apiUrl, await getAccessToken());
+    saveCredentials({ ...loadCredentials() ?? creds, workspaces: me.workspaces });
+    return { workspaces: me.workspaces, fresh: true };
+  } catch {
+    return { workspaces: creds.workspaces ?? [], fresh: false };
+  }
+}
 async function revokeDevice(base, token) {
   await expectOk(await post(base, "/api/auth/device/revoke", {}, token), "Revoking this device");
 }
@@ -954,7 +996,7 @@ import {
   lstatSync,
   mkdirSync as mkdirSync4,
   readdirSync as readdirSync2,
-  readFileSync as readFileSync5,
+  readFileSync as readFileSync6,
   statSync as statSync2,
   symlinkSync
 } from "fs";
@@ -983,7 +1025,7 @@ function claudeLoggedIn() {
   if (process.env["ANTHROPIC_API_KEY"]) return true;
   if (existsSync7(join6(claudeDir(), ".credentials.json"))) return true;
   try {
-    const raw = JSON.parse(readFileSync5(join6(homedir3(), ".claude.json"), "utf-8"));
+    const raw = JSON.parse(readFileSync6(join6(homedir3(), ".claude.json"), "utf-8"));
     if (raw.oauthAccount) return true;
   } catch {
   }
@@ -1024,7 +1066,7 @@ function jsonlFiles(dir, depth) {
 function cwdFromTranscript(file) {
   let head;
   try {
-    head = readFileSync5(file, { encoding: "utf-8", flag: "r" }).slice(0, MAX_JSONL_HEAD_BYTES);
+    head = readFileSync6(file, { encoding: "utf-8", flag: "r" }).slice(0, MAX_JSONL_HEAD_BYTES);
   } catch {
     return null;
   }
@@ -1041,7 +1083,7 @@ function cwdFromTranscript(file) {
 }
 function codexTrustedPaths() {
   try {
-    const toml = readFileSync5(join6(codexDir(), "config.toml"), "utf-8");
+    const toml = readFileSync6(join6(codexDir(), "config.toml"), "utf-8");
     return [...toml.matchAll(/^\[projects\.(?:"([^"]+)"|'([^']+)')\]/gm)].map((m) => m[1] ?? m[2]);
   } catch {
     return [];
@@ -1510,6 +1552,16 @@ async function runAuthCmd(args) {
   }
 }
 
+// src/version.ts
+var CLI_VERSION = true ? "0.1.9" : null;
+function isOlderVersion(a, b) {
+  const parse2 = (v) => v.replace(/^v/, "").split("-")[0].split(".").map(Number);
+  const [pa, pb] = [parse2(a), parse2(b)];
+  if (pa.length !== 3 || pb.length !== 3 || [...pa, ...pb].some(Number.isNaN)) return false;
+  for (let i = 0; i < 3; i++) if (pa[i] !== pb[i]) return pa[i] < pb[i];
+  return false;
+}
+
 // src/commands/setup.ts
 var BOLD2 = "\x1B[1m";
 var DIM2 = "\x1B[2m";
@@ -1541,15 +1593,21 @@ var tilde2 = (p) => p.replace(process.env["HOME"] ?? "\0", "~");
 var ok = (msg) => console.log(`  ${GREEN2}\u2713${RESET2} ${msg}`);
 var bad = (msg) => console.log(`  ${YELLOW2}\u2717${RESET2} ${msg}`);
 async function servedWorkspaces() {
-  const creds = loadCredentials();
+  const bound = await boundWorkspaces();
+  if (!bound.fresh) console.log(`  ${DIM2}Couldn't reach the server; using the workspaces saved at login.${RESET2}`);
+  return bound.workspaces;
+}
+function checkLatestVersion() {
+  if (!CLI_VERSION) return true;
+  let latest = "";
   try {
-    const me = await fetchWhoAmI(creds.apiUrl, await getAccessToken());
-    saveCredentials({ ...loadCredentials() ?? creds, workspaces: me.workspaces });
-    return me.workspaces;
+    latest = execSync4(`npm view ${"flyspace-cli"} version`, { encoding: "utf-8", stdio: "pipe", timeout: 1e4 }).trim();
   } catch {
-    console.log(`  ${DIM2}Couldn't reach the server; using the workspaces saved at login.${RESET2}`);
-    return creds.workspaces ?? [];
+    return true;
   }
+  if (!latest || !isOlderVersion(CLI_VERSION, latest)) return true;
+  bad(`flyspace ${CLI_VERSION} is out of date (latest ${latest})   ${DIM2}run: flyspace upgrade${RESET2}`);
+  return false;
 }
 function loginArgs(args) {
   const out = [];
@@ -1574,6 +1632,7 @@ async function runSetup(args) {
   console.log(`
 ${BOLD2}Flyspace Setup${RESET2}
 `);
+  checkLatestVersion();
   const existing = loadCredentials();
   let workspaces;
   if (existing) {
@@ -1583,7 +1642,10 @@ ${BOLD2}Flyspace Setup${RESET2}
     console.log(`    Device      ${existing.deviceName}`);
     console.log(`    Workspaces  ${workspaces.length ? workspaces.join(", ") : "(none)"}`);
     const others = listProfiles().filter((p) => p !== "default" && !workspaces.includes(p));
-    if (others.length) console.log(`    ${DIM2}Other local profiles (left alone): ${others.join(", ")}${RESET2}`);
+    if (others.length) {
+      console.log(`    ${DIM2}Not bound here, nothing runs for them: ${others.join(", ")}${RESET2}`);
+      console.log(`    ${DIM2}See: flyspace profiles   Clean up: flyspace profiles remove <name>${RESET2}`);
+    }
     console.log("");
     const keep = args.includes("--yes") || !process.stdin.isTTY ? true : await confirm2({ message: "Keep using this account and device?", default: true });
     if (!keep) {
@@ -1611,7 +1673,12 @@ ${BOLD2}Flyspace Setup${RESET2}
   }
   let hostRunning = false;
   if (args.includes("--start-host") && workspaces.length) {
-    if (!isHostServiceInstalled()) {
+    for (const slug of workspaces) {
+      if (!serviceBinaryMissing(profileServiceFile(slug))) continue;
+      await runWithProfile(slug, runInstall);
+      ok(`${slug} scheduler reinstalled on the new CLI path`);
+    }
+    if (!isHostServiceInstalled() || serviceBinaryMissing(hostServiceFile())) {
       hostRunning = await installHostService();
       if (hostRunning) ok(`Host running in the background   ${DIM2}logs: ${tilde2(paths.LOG_DIR)}/host.log${RESET2}`);
     } else {
@@ -1635,9 +1702,137 @@ ${BOLD2}Flyspace Setup${RESET2}
   if (!workspaces.length) process.exitCode = 1;
 }
 
+// src/commands/doctor.ts
+import { execFile } from "child_process";
+import { tmpdir } from "os";
+import { promisify } from "util";
+var execAsync = promisify(execFile);
+var exec = (cmd, args, opts) => {
+  const run3 = execAsync(cmd, args, opts);
+  run3.child.stdin?.end();
+  return run3;
+};
+var BOLD3 = "\x1B[1m";
+var DIM3 = "\x1B[2m";
+var GREEN3 = "\x1B[32m";
+var YELLOW3 = "\x1B[33m";
+var RESET3 = "\x1B[0m";
+var HELP3 = `
+  Usage: flyspace doctor
+
+  Checks this Host end to end: CLI version, server reachability, device login,
+  a live turn with each installed agent CLI, and the background services.
+  Exits non-zero when any check fails.
+`;
+var LOGIN_HINTS = {
+  claude: "claude auth login",
+  codex: "codex login"
+};
+var tilde3 = (p) => p.replace(process.env["HOME"] ?? "\0", "~");
+var failed = false;
+var ok2 = (msg) => console.log(`  ${GREEN3}\u2713${RESET3} ${msg}`);
+var bad2 = (msg, hint) => {
+  failed = true;
+  console.log(`  ${YELLOW3}\u2717${RESET3} ${msg}${hint ? `   ${DIM3}${hint}${RESET3}` : ""}`);
+};
+function errorLine(err) {
+  const e = err;
+  if (e.killed) return "timed out after 90s";
+  const lines = `${e.stdout ?? ""}
+${e.stderr ?? ""}`.split("\n").map((l) => l.trim()).filter(Boolean);
+  const last = (re) => [...lines].reverse().find((l) => re.test(l));
+  const line = last(/expired|unauthori[sz]ed|\b401\b|not logged in|authenticate/i) ?? last(/error|fail/i) ?? lines.at(-1) ?? e.message ?? "failed";
+  return line.length > 160 ? `${line.slice(0, 157)}...` : line;
+}
+async function probe(id) {
+  const env = { ...process.env };
+  const opts = { cwd: tmpdir(), timeout: 9e4, encoding: "utf-8" };
+  try {
+    if (id === "claude") {
+      const dir = pinnedClaudeConfigDir(process.env["CLAUDE_CONFIG_DIR"]);
+      if (dir) env["CLAUDE_CONFIG_DIR"] = dir;
+      else delete env["CLAUDE_CONFIG_DIR"];
+      await exec("claude", ["-p", "Reply with OK", "--model", "haiku", "--max-turns", "1"], { ...opts, env });
+    } else {
+      await exec("codex", ["exec", "--skip-git-repo-check", "-s", "read-only", "Reply with OK"], { ...opts, env });
+    }
+    return null;
+  } catch (err) {
+    return errorLine(err);
+  }
+}
+async function serverReachable() {
+  try {
+    const res = await fetch(`${apiUrl()}/api/health`, { signal: AbortSignal.timeout(1e4) });
+    return res.ok ? null : `HTTP ${res.status}`;
+  } catch (err) {
+    return err.cause ? String(err.cause) : err.message;
+  }
+}
+function checkService(name, installed, file, running, fix) {
+  if (!installed) bad2(`${name} not installed`, `run: ${fix}`);
+  else if (serviceBinaryMissing(file)) bad2(`${name} points at a CLI that no longer exists`, `run: ${fix}`);
+  else if (!running) bad2(`${name} not running`, `logs: ${tilde3(paths.LOG_DIR)}`);
+  else ok2(`${name} running`);
+}
+async function runDoctor(args) {
+  if (args.includes("-h") || args.includes("--help")) return void console.log(HELP3);
+  failed = false;
+  console.log(`
+${BOLD3}Flyspace Doctor${RESET3}
+`);
+  if (checkLatestVersion()) ok2(`flyspace ${CLI_VERSION || "(dev build)"}`);
+  else failed = true;
+  const serverError = await serverReachable();
+  if (serverError) bad2(`Can't reach ${apiUrl()}: ${serverError}`, "check the network or DNS");
+  else ok2(`Server ${apiUrl()} reachable`);
+  const creds = loadCredentials();
+  let workspaces = [];
+  if (!creds) {
+    bad2("This device is not logged in", "run: flyspace setup");
+  } else {
+    const bound = await boundWorkspaces();
+    workspaces = bound.workspaces;
+    ok2(`Logged in as ${creds.userEmail} (device ${creds.deviceName})`);
+    if (!bound.fresh) bad2("Couldn't refresh the device session; showing the workspaces saved at login");
+    if (workspaces.length) ok2(`Serving ${workspaces.join(", ")}`);
+    else bad2("Not serving any workspace", "a workspace admin has to add this Host");
+  }
+  const runners = detectRunners().filter((r) => r.installed);
+  if (!runners.length) bad2("Neither claude nor codex is installed", "npm install -g @anthropic-ai/claude-code");
+  const results = await Promise.all(runners.map((r) => probe(r.id)));
+  runners.forEach((r, i) => {
+    const error2 = results[i];
+    if (error2) bad2(`${r.id} can't run a turn: ${error2}`, `run: ${LOGIN_HINTS[r.id]}`);
+    else ok2(`${r.id} answered a test turn`);
+  });
+  if (workspaces.length) {
+    checkService(
+      "Host service",
+      isHostServiceInstalled(),
+      hostServiceFile(),
+      isHostServiceRunning(),
+      "flyspace setup --start-host"
+    );
+    for (const slug of workspaces) {
+      checkService(
+        `${slug} scheduler`,
+        isServiceInstalled(slug),
+        profileServiceFile(slug),
+        isServiceRunning(slug),
+        "flyspace setup --start-host"
+      );
+    }
+  }
+  console.log(failed ? "" : `
+  ${GREEN3}All good.${RESET3}
+`);
+  if (failed) process.exitCode = 1;
+}
+
 // src/commands/uninstall.ts
 import { existsSync as existsSync8, unlinkSync as unlinkSync2 } from "fs";
-import { execSync as execSync4 } from "child_process";
+import { execSync as execSync5 } from "child_process";
 import { basename as basename2, join as join8 } from "path";
 import { homedir as homedir4, platform as platform5 } from "os";
 function log2(msg) {
@@ -1651,7 +1846,7 @@ function warn2(msg) {
   console.log(`\x1B[33m!\x1B[0m ${msg}`);
 }
 function run2(cmd) {
-  execSync4(cmd, { encoding: "utf-8", stdio: "pipe" });
+  execSync5(cmd, { encoding: "utf-8", stdio: "pipe" });
 }
 async function runUninstall() {
   const os = platform5();
@@ -1698,8 +1893,82 @@ async function runUninstall() {
   console.log("\n  Config and data directories were NOT removed.");
 }
 
+// src/commands/profiles-cmd.ts
+import { rmSync as rmSync3 } from "fs";
+var USAGE = `
+  Usage: flyspace profiles [list]
+         flyspace profiles remove <name>
+
+  list     Every local profile, whether this Host is bound to it, and the
+           state of its scheduler service.
+  remove   Unload a profile's scheduler and delete its local config. Only for
+           profiles this Host is not bound to; the Workspace itself, its
+           channel folders and its data directory are left alone.
+`;
+async function boundHere() {
+  const bound = await boundWorkspaces();
+  if (bound && !bound.fresh) console.log("  \x1B[2mCouldn't reach the server; using the workspaces saved at login.\x1B[0m");
+  return bound?.workspaces ?? null;
+}
+async function listCmd() {
+  const bound = await boundHere();
+  console.log("\n  Profiles:\n");
+  console.log(`    ${"NAME".padEnd(24)} ${"BOUND HERE".padEnd(12)} SCHEDULER`);
+  for (const profile of listProfiles()) {
+    const scheduler = !isServiceInstalled(profile) ? "\x1B[90mnot installed\x1B[0m" : isServiceRunning2(profile) ? "\x1B[32mrunning\x1B[0m" : "\x1B[90mstopped\x1B[0m";
+    const here = bound === null ? "-".padEnd(12) : bound.includes(profile) ? "yes".padEnd(12) : `\x1B[33m${"no".padEnd(12)}\x1B[0m`;
+    console.log(`    ${profile.padEnd(24)} ${here} ${scheduler}`);
+  }
+  const missing = (bound ?? []).filter((w) => !listProfiles().includes(w));
+  for (const w of missing) console.log(`    ${w.padEnd(24)} ${"yes".padEnd(12)} \x1B[33mno local profile yet\x1B[0m`);
+  if (bound?.length === 0) {
+    console.log("\n  This Host is not bound to any workspace, so no scheduler runs here. Run: flyspace setup");
+  }
+  if (bound && listProfiles().some((p) => p !== DEFAULT_PROFILE && !bound.includes(p))) {
+    console.log("\n  Profiles not bound here run nothing on this machine. Remove one with: flyspace profiles remove <name>");
+  }
+  console.log("");
+}
+async function removeCmd(name) {
+  if (!name) return void console.log(USAGE);
+  if (name === DEFAULT_PROFILE) {
+    console.error("  The default profile cannot be removed.");
+    process.exit(1);
+  }
+  if (!listProfiles().includes(name)) {
+    console.error(`  No local profile named "${name}".`);
+    process.exit(1);
+  }
+  const bound = await boundHere();
+  if (bound === null) {
+    console.error("  This machine has no device login, so it serves every workspace; removing a profile would be undone.");
+    process.exit(1);
+  }
+  if (bound.includes(name)) {
+    console.error(`  This Host is still bound to "${name}" on the server, so the Host would reinstall it within a minute.`);
+    console.error("  Unbinding a Host from a workspace is not available yet.");
+    process.exit(1);
+  }
+  const { configDir: configDir2, dataDir } = runWithProfile(name, () => ({ configDir: paths.CONFIG_DIR, dataDir: paths.DATA_DIR }));
+  if (isServiceInstalled(name)) await runWithProfile(name, runUninstall);
+  rmSync3(configDir2, { recursive: true, force: true });
+  console.log(`\x1B[32m+\x1B[0m Local config removed: ${configDir2}`);
+  console.log(`
+  Kept: ${dataDir} (sessions, logs) and any ~/Flyspace/${name}/ channel folders.`);
+  console.log(`  The workspace and its server-side records are unchanged; this only cleaned up this machine.
+`);
+}
+async function runProfiles(args = []) {
+  loadEnvFiles();
+  const [sub, name] = args;
+  if (sub === "remove" || sub === "rm") return removeCmd(name);
+  if (!sub || sub === "list" || sub === "ls") return listCmd();
+  console.log(USAGE);
+}
+
 // src/commands/upgrade.ts
-import { execSync as execSync5 } from "child_process";
+import { execSync as execSync6 } from "child_process";
+import { realpathSync } from "fs";
 function restartInstalledProfiles() {
   if (isHostServiceInstalled()) {
     console.log(restartHostService() ? "\nHost restarted." : "\nHost restart failed; run: flyspace setup --start-host --restart");
@@ -1719,19 +1988,29 @@ Restarting ${installed.length} instance(s)...`);
     }
   }
 }
+function npmInstallCommand() {
+  let prefix;
+  try {
+    const entry = realpathSync(process.argv[1] ?? "");
+    const at = entry.indexOf(`/lib/node_modules/${"flyspace-cli"}/`);
+    if (at > 0) prefix = entry.slice(0, at);
+  } catch {
+  }
+  return `npm install -g${prefix ? ` --prefix "${prefix}"` : ""} ${"flyspace-cli"}@latest`;
+}
 async function runUpgrade() {
-  const current = "0.1.6";
+  const current = "0.1.9";
   console.log(`Current version: ${current}`);
   console.log("Checking for updates...\n");
   try {
-    const latest = execSync5(`npm view ${"flyspace-cli"} version`, { encoding: "utf-8" }).trim();
+    const latest = execSync6(`npm view ${"flyspace-cli"} version`, { encoding: "utf-8" }).trim();
     if (latest === current) {
       console.log(`Already on the latest version (${current}).`);
       return;
     }
     console.log(`New version available: ${latest}`);
     console.log("Upgrading...\n");
-    execSync5(`npm install -g ${"flyspace-cli"}@latest`, { stdio: "inherit" });
+    execSync6(npmInstallCommand(), { stdio: "inherit" });
     console.log(`
 Upgraded from ${current} to ${latest}.`);
     restartInstalledProfiles();
@@ -1740,14 +2019,14 @@ Upgraded from ${current} to ${latest}.`);
   } catch (err) {
     console.error("Upgrade failed:", err.message);
     console.error(`
-You can upgrade manually with: npm install -g ${"flyspace-cli"}@latest`);
+You can upgrade manually with: ${npmInstallCommand()}`);
     process.exit(1);
   }
 }
 
 // src/commands/automation.ts
 import { WebClient } from "@slack/web-api";
-var USAGE = `
+var USAGE2 = `
   Usage: flyspace automation <subcommand> [options]
 
   Subcommands:
@@ -2085,14 +2364,14 @@ async function runAutomationCmd(args) {
       await handleRun(manager, args[1]);
       break;
     default:
-      console.log(USAGE);
+      console.log(USAGE2);
       break;
   }
 }
 
 // src/commands/usage.ts
 import { existsSync as existsSync9 } from "fs";
-var HELP3 = `
+var HELP4 = `
   Usage: flyspace usage [options]
 
   Show agent token usage and notional cost for this workspace.
@@ -2214,7 +2493,7 @@ function printExplanation(explained) {
 async function runUsage(args) {
   const parsed = parseArgs(args);
   if (parsed === "help") {
-    console.log(HELP3);
+    console.log(HELP4);
     return;
   }
   const { days, by, explain, json } = parsed;
@@ -2276,7 +2555,7 @@ function breakdown(store, by, days) {
 }
 
 // src/commands/stop.ts
-import { execSync as execSync6 } from "child_process";
+import { execSync as execSync7 } from "child_process";
 import { platform as platform6 } from "os";
 function log3(msg) {
   console.log(`
@@ -2295,7 +2574,7 @@ async function runStop() {
     const plist = plistPath(profile);
     log3("Stopping Flyspace service...");
     try {
-      execSync6(`launchctl unload "${plist}"`, { stdio: "pipe" });
+      execSync7(`launchctl unload "${plist}"`, { stdio: "pipe" });
       success3("Service stopped. Run `flyspace restart` to start again.");
     } catch {
       warn3("Service is not currently loaded.");
@@ -2303,7 +2582,7 @@ async function runStop() {
   } else if (os === "linux") {
     log3("Stopping Flyspace service...");
     try {
-      execSync6(`systemctl --user stop ${systemdUnitName(profile)}`, { stdio: "pipe" });
+      execSync7(`systemctl --user stop ${systemdUnitName(profile)}`, { stdio: "pipe" });
       success3("Service stopped. Run `flyspace restart` to start again.");
     } catch {
       warn3("Service is not currently running.");
@@ -2360,9 +2639,9 @@ async function runLogs(args) {
 
 // src/commands/slack.ts
 import { execFileSync as execFileSync4 } from "child_process";
-import { existsSync as existsSync27, readFileSync as readFileSync16, writeFileSync as writeFileSync10 } from "fs";
+import { existsSync as existsSync27, readFileSync as readFileSync17, writeFileSync as writeFileSync10 } from "fs";
 import { resolve as resolve7 } from "path";
-import { tmpdir as tmpdir3, homedir as homedir9 } from "os";
+import { tmpdir as tmpdir4, homedir as homedir9 } from "os";
 import { input, confirm as confirm3, select, checkbox } from "@inquirer/prompts";
 import { WebClient as WebClient3 } from "@slack/web-api";
 
@@ -3891,22 +4170,18 @@ async function deliverPasswordResetLink(email, redirectTo) {
 import { existsSync as existsSync26 } from "fs";
 import { createServer } from "net";
 import { join as join22 } from "path";
-import { Hono as Hono32 } from "hono";
+import { Hono as Hono33 } from "hono";
 import { serve } from "@hono/node-server";
 import { serveStatic } from "@hono/node-server/serve-static";
 
 // src/reconcile.ts
 import { existsSync as existsSync11, mkdirSync as mkdirSync6, writeFileSync as writeFileSync5 } from "fs";
-async function boundWorkspaces() {
-  const creds = loadCredentials();
-  if (!creds) return null;
-  try {
-    const me = await fetchWhoAmI(creds.apiUrl, await getAccessToken());
-    saveCredentials({ ...loadCredentials() ?? creds, workspaces: me.workspaces });
-    return me.workspaces;
-  } catch {
-    return creds.workspaces ?? [];
-  }
+async function boundWorkspaces2() {
+  return (await boundWorkspaces())?.workspaces ?? null;
+}
+async function servedWorkspaces2() {
+  const bound = await boundWorkspaces2();
+  return new Set(bound ?? [...(await listWorkspaces()).map((w) => w.slug), ...listProfiles()]);
 }
 async function reconcileProfile(profile) {
   return runWithProfile(profile, async () => {
@@ -3933,8 +4208,7 @@ async function reconcileProfile(profile) {
   });
 }
 async function reconcileAll() {
-  const bound = hasSupabaseCredentials() ? null : await boundWorkspaces();
-  const slugs = new Set(bound ?? [...(await listWorkspaces()).map((w) => w.slug), ...listProfiles()]);
+  const slugs = await servedWorkspaces2();
   const results = /* @__PURE__ */ new Map();
   for (const slug of slugs) {
     try {
@@ -3947,8 +4221,7 @@ async function reconcileAll() {
   return results;
 }
 async function ensureServices() {
-  const bound = await boundWorkspaces();
-  const slugs = new Set(bound ?? [...(await listWorkspaces()).map((w) => w.slug), ...listProfiles()]);
+  const slugs = await servedWorkspaces2();
   slugs.delete(DEFAULT_PROFILE);
   const installed = [];
   for (const slug of slugs) {
@@ -4097,10 +4370,10 @@ var requireDocsAccess = async (c, next) => {
 };
 
 // src/dashboard/api.ts
-import { Hono as Hono29 } from "hono";
+import { Hono as Hono30 } from "hono";
 
 // src/dashboard/public-share-routes.ts
-import { existsSync as existsSync12, readFileSync as readFileSync7, statSync as statSync3 } from "fs";
+import { existsSync as existsSync12, readFileSync as readFileSync8, statSync as statSync3 } from "fs";
 import { join as join12 } from "path";
 import { Hono as Hono3 } from "hono";
 import { GetObjectCommand } from "@aws-sdk/client-s3";
@@ -4241,15 +4514,15 @@ async function createDocShare(input2) {
   if (error2) throw new Error(`createDocShare(${input2.sourcePath}): ${error2.message}`);
   return rowToShare(data);
 }
-async function updateDocShareSnapshot(id, snapshot2, features) {
+async function updateDocShareSnapshot(id, snapshot3, features) {
   const { data, error: error2 } = await getSupabaseClient().from("doc_shares").update({
-    title: snapshot2.title,
-    content: snapshot2.content,
-    asset_keys: snapshot2.assetKeys,
+    title: snapshot3.title,
+    content: snapshot3.content,
+    asset_keys: snapshot3.assetKeys,
     // Re-detected with the snapshot: a re-publish can carry a rewritten
     // article, and one written in another language than last time is exactly
     // the case a stale value would get wrong.
-    source_lang: snapshot2.sourceLang,
+    source_lang: snapshot3.sourceLang,
     audio_enabled: features.audioEnabled,
     ask_enabled: features.askEnabled,
     social_enabled: features.socialEnabled,
@@ -4566,7 +4839,7 @@ function injectShareHead(html, head) {
 
 // src/dashboard/app-icon.ts
 import { createHash as createHash2 } from "crypto";
-import { readFileSync as readFileSync6 } from "fs";
+import { readFileSync as readFileSync7 } from "fs";
 import { join as join11 } from "path";
 import sharp from "sharp";
 var PLATE = "#0A0A0F";
@@ -4594,7 +4867,7 @@ function roundedPlate(size, fill = PLATE) {
 }
 async function renderBadge(box) {
   const transparent = { r: 0, g: 0, b: 0, alpha: 0 };
-  const raster = await sharp(readFileSync6(MARK_SVG_FILE)).resize(512, 512, { fit: "contain", background: transparent }).png().toBuffer();
+  const raster = await sharp(readFileSync7(MARK_SVG_FILE)).resize(512, 512, { fit: "contain", background: transparent }).png().toBuffer();
   return sharp(raster).trim().resize(box, box, { fit: "contain", background: transparent }).png().toBuffer();
 }
 async function sampleBackground(logo) {
@@ -4649,7 +4922,7 @@ async function renderAppIcon({
   if (hit) return hit;
   const out = logo && await composeIcon(logo, size, maskable, plain).catch(() => null) || // No workspace logo to lead with — the stock mark is still the best icon,
   // either on its usual dark plate or, for a favicon, trimmed and bare.
-  (transparent ? await renderBadge(size) : await sharp(readFileSync6(MARK_FILE)).resize(size, size, { fit: "cover" }).png().toBuffer());
+  (transparent ? await renderBadge(size) : await sharp(readFileSync7(MARK_FILE)).resize(size, size, { fit: "cover" }).png().toBuffer());
   cache3.set(key, out);
   return out;
 }
@@ -5867,7 +6140,7 @@ var shellCache = null;
 function readShell(path) {
   const { mtimeMs } = statSync3(path);
   if (shellCache?.mtimeMs === mtimeMs) return shellCache.html;
-  const html = readFileSync7(path, "utf8").replaceAll('"/assets/', `"${BUILD_PREFIX}/`);
+  const html = readFileSync8(path, "utf8").replaceAll('"/assets/', `"${BUILD_PREFIX}/`);
   shellCache = { mtimeMs, html };
   return html;
 }
@@ -5892,12 +6165,12 @@ function serveBuildFile(c, webDist, dir, name) {
   c.header("Content-Type", type);
   c.header("Cache-Control", "public, max-age=31536000, immutable");
   if (ext === ".css") {
-    return c.body(readFileSync7(path, "utf8").replaceAll("url(/fonts/", `url(${BUILD_PREFIX}/fonts/`));
+    return c.body(readFileSync8(path, "utf8").replaceAll("url(/fonts/", `url(${BUILD_PREFIX}/fonts/`));
   }
   if (ext === ".js") {
-    return c.body(readFileSync7(path, "utf8").replaceAll('"/assets/', `"${BUILD_PREFIX}/`));
+    return c.body(readFileSync8(path, "utf8").replaceAll('"/assets/', `"${BUILD_PREFIX}/`));
   }
-  return c.body(new Uint8Array(readFileSync7(path)));
+  return c.body(new Uint8Array(readFileSync8(path)));
 }
 var HTML_SHARE_CSP = "sandbox allow-scripts allow-forms allow-modals allow-popups allow-popups-to-escape-sandbox";
 function servePublishedHtml(c, share) {
@@ -6659,8 +6932,48 @@ function createAdminRouter() {
   return admin;
 }
 
+// src/dashboard/agent-identities.ts
+var BOT_LABEL = "Workspace Agent";
+var BOT_DM_KEY = "claude";
+async function resolveAgentIdentities() {
+  const settings = loadDashboardSettings();
+  const { cwd: defaultCwd } = resolveChannelConfig("");
+  const main2 = [
+    {
+      name: BOT_DM_KEY,
+      label: BOT_LABEL,
+      kind: "main",
+      cwd: defaultCwd,
+      model: settings.agentProfiles?.[BOT_DM_KEY]?.model,
+      ...await loadBotIdentity()
+    }
+  ];
+  return Promise.all(
+    main2.map(async ({ cwd, ...agent }) => {
+      const dm = await ensureAgentDmChannel(agent.name, {
+        name: agent.displayName ?? agent.label,
+        cwd
+      });
+      return { ...agent, channelId: dm.id };
+    })
+  );
+}
+async function offlineAgentIdentities() {
+  const dm = findChannelByAgentName(BOT_DM_KEY);
+  if (!dm) return [];
+  return [
+    {
+      name: BOT_DM_KEY,
+      label: BOT_LABEL,
+      kind: "main",
+      channelId: dm.id,
+      ...await loadBotIdentity()
+    }
+  ];
+}
+
 // src/dashboard/host-api.ts
-import { existsSync as existsSync21, readFileSync as readFileSync11, statSync as statSync8 } from "fs";
+import { existsSync as existsSync21, readFileSync as readFileSync12, statSync as statSync8 } from "fs";
 import { join as join19 } from "path";
 import sharp3 from "sharp";
 
@@ -6899,8 +7212,8 @@ function createChannelWriteRouter() {
         (id, position) => supabase.from("channels").update({ position, updated_at: (/* @__PURE__ */ new Date()).toISOString() }).eq("id", id)
       )
     );
-    const failed = results.find((r) => r.error);
-    if (failed?.error) return c.json({ error: failed.error.message }, 500);
+    const failed2 = results.find((r) => r.error);
+    if (failed2?.error) return c.json({ error: failed2.error.message }, 500);
     await refreshChannelRegistry();
     return c.json({ ok: true });
   });
@@ -6958,10 +7271,10 @@ import {
   openSync,
   readSync,
   readdirSync as readdirSync4,
-  readFileSync as readFileSync10,
-  realpathSync,
+  readFileSync as readFileSync11,
+  realpathSync as realpathSync2,
   renameSync,
-  rmSync as rmSync4,
+  rmSync as rmSync5,
   statSync as statSync5,
   writeFileSync as writeFileSync7
 } from "fs";
@@ -7249,14 +7562,14 @@ async function readOrQueueDocAudio(input2) {
 }
 
 // src/dashboard/artifact-export.ts
-import { readFileSync as readFileSync9 } from "fs";
+import { readFileSync as readFileSync10 } from "fs";
 
 // src/dashboard/chat-agent.ts
 import { homedir as homedir7 } from "os";
 
 // src/mcp/config.ts
-import { mkdtempSync, rmSync as rmSync3, writeFileSync as writeFileSync6 } from "fs";
-import { tmpdir } from "os";
+import { mkdtempSync, rmSync as rmSync4, writeFileSync as writeFileSync6 } from "fs";
+import { tmpdir as tmpdir2 } from "os";
 import { join as join14 } from "path";
 
 // src/mcp/crypto.ts
@@ -7943,12 +8256,12 @@ async function buildMcpConfig(profile, connectionIds) {
   return { config, skipped };
 }
 function writeMcpConfigFile(config) {
-  const dir = mkdtempSync(join14(tmpdir(), "flyspace-mcp-"));
+  const dir = mkdtempSync(join14(tmpdir2(), "flyspace-mcp-"));
   const path = join14(dir, "mcp-config.json");
   writeFileSync6(path, JSON.stringify(config), { mode: 384 });
   return {
     path,
-    cleanup: () => rmSync3(dir, { recursive: true, force: true })
+    cleanup: () => rmSync4(dir, { recursive: true, force: true })
   };
 }
 async function withMcpConfig(profile, connectionIds, fn) {
@@ -7965,7 +8278,7 @@ async function withMcpConfig(profile, connectionIds, fn) {
 }
 
 // src/claude/agents.ts
-import { existsSync as existsSync15, readdirSync as readdirSync3, readFileSync as readFileSync8 } from "fs";
+import { existsSync as existsSync15, readdirSync as readdirSync3, readFileSync as readFileSync9 } from "fs";
 import { homedir as homedir6 } from "os";
 import { basename as basename4, join as join15 } from "path";
 import yaml from "js-yaml";
@@ -7980,7 +8293,7 @@ function expandHome(p) {
 function parseFrontmatter(file) {
   let content;
   try {
-    content = readFileSync8(file, "utf-8");
+    content = readFileSync9(file, "utf-8");
   } catch {
     return {};
   }
@@ -8026,16 +8339,241 @@ function readAgentPersona(configDir2, cwd, name) {
   const agent = listAgents(configDir2, cwd).find((a) => a.name === name);
   if (!agent) return void 0;
   try {
-    const content = readFileSync8(agent.path, "utf-8");
+    const content = readFileSync9(agent.path, "utf-8");
     return content.replace(/^---\r?\n[\s\S]*?\r?\n---\r?\n?/, "").trim();
   } catch {
     return void 0;
   }
 }
 
+// src/store/memory-store.ts
+var MEMORY_TYPES = ["preference", "decision", "fact", "reference"];
+var NAME_RE = /^[a-z0-9]+(-[a-z0-9]+)*$/;
+var DESCRIPTION_MAX = 200;
+var BODY_MAX = 4e3;
+var MEMORY_INDEX_MAX_CHARS = 8e3;
+function isMemoryType(value) {
+  return MEMORY_TYPES.includes(value);
+}
+function validateMemoryInput(input2) {
+  if (!NAME_RE.test(input2.name))
+    throw new Error("name must be a kebab-case slug, e.g. deploy-flow");
+  if (!isMemoryType(input2.type)) throw new Error(`type must be one of ${MEMORY_TYPES.join(", ")}`);
+  const description = input2.description.trim();
+  if (!description || description.includes("\n") || description.length > DESCRIPTION_MAX) {
+    throw new Error(`description must be one line of at most ${DESCRIPTION_MAX} characters`);
+  }
+  const body = input2.body.trim();
+  if (!body || body.length > BODY_MAX) {
+    throw new Error(`body must be 1 to ${BODY_MAX} characters`);
+  }
+}
+function rowToMemory(row) {
+  return {
+    id: row["id"],
+    channelId: row["channel_id"],
+    name: row["name"],
+    description: row["description"],
+    type: row["type"],
+    body: row["body"],
+    sourceThreadId: row["source_thread_id"] ?? null,
+    createdBy: row["created_by"],
+    createdAt: row["created_at"],
+    updatedAt: row["updated_at"]
+  };
+}
+async function listChannelMemories(channelId) {
+  const { data, error: error2 } = await getSupabaseClient().from("memories").select("*").eq("scope", "channel").eq("channel_id", channelId).order("updated_at", { ascending: false });
+  if (error2) throw new Error(`listChannelMemories(${channelId}): ${error2.message}`);
+  return (data ?? []).map(rowToMemory);
+}
+async function getChannelMemory(channelId, name) {
+  const { data, error: error2 } = await getSupabaseClient().from("memories").select("*").eq("scope", "channel").eq("channel_id", channelId).eq("name", name).maybeSingle();
+  if (error2) throw new Error(`getChannelMemory(${channelId}, ${name}): ${error2.message}`);
+  return data ? rowToMemory(data) : null;
+}
+async function saveChannelMemory(input2, actor) {
+  validateMemoryInput(input2);
+  const supabase = getSupabaseClient();
+  const existing = await getChannelMemory(input2.channelId, input2.name);
+  const fields = {
+    description: input2.description.trim(),
+    type: input2.type,
+    body: input2.body.trim(),
+    source_thread_id: input2.sourceThreadId ?? existing?.sourceThreadId ?? null,
+    created_by: input2.createdBy
+  };
+  if (existing && sameContent(existing, fields)) {
+    return { memory: existing, created: false, changed: false };
+  }
+  const { data, error: error2 } = existing ? await supabase.from("memories").update({ ...fields, updated_at: (/* @__PURE__ */ new Date()).toISOString() }).eq("id", existing.id).select("*").single() : await supabase.from("memories").insert({ ...fields, scope: "channel", channel_id: input2.channelId, name: input2.name }).select("*").single();
+  if (error2)
+    throw new Error(`saveChannelMemory(${input2.channelId}, ${input2.name}): ${error2.message}`);
+  const memory = rowToMemory(data);
+  await logMemoryEvent({
+    memory,
+    action: existing ? "update" : "create",
+    before: existing ? snapshot(existing) : null,
+    after: snapshot(memory),
+    actor,
+    threadId: input2.sourceThreadId ?? null
+  });
+  return { memory, created: !existing, changed: true };
+}
+async function updateChannelMemory(channelId, memoryId, patch, actor) {
+  const existing = (await listChannelMemories(channelId)).find((m) => m.id === memoryId);
+  if (!existing) return null;
+  const { memory } = await saveChannelMemory(
+    {
+      channelId,
+      name: existing.name,
+      description: patch.description ?? existing.description,
+      type: patch.type ?? existing.type,
+      body: patch.body ?? existing.body,
+      createdBy: existing.createdBy
+    },
+    actor
+  );
+  return memory;
+}
+async function searchChannelMemories(channelId, query) {
+  const words = query.replaceAll(/[,()*%\\]/g, " ").split(/\s+/).filter(Boolean);
+  if (!words.length) return [];
+  let request2 = getSupabaseClient().from("memories").select("*").eq("scope", "channel").eq("channel_id", channelId);
+  for (const word of words) {
+    request2 = request2.or(`name.ilike.*${word}*,description.ilike.*${word}*,body.ilike.*${word}*`);
+  }
+  const { data, error: error2 } = await request2.order("updated_at", { ascending: false }).limit(20);
+  if (error2) throw new Error(`searchChannelMemories(${channelId}): ${error2.message}`);
+  return (data ?? []).map(rowToMemory);
+}
+async function deleteChannelMemory(channelId, idOrName, actor, threadId) {
+  const { data, error: error2 } = await getSupabaseClient().from("memories").delete().eq("scope", "channel").eq("channel_id", channelId).eq(isUuid(idOrName) ? "id" : "name", idOrName).select("*");
+  if (error2) throw new Error(`deleteChannelMemory(${channelId}, ${idOrName}): ${error2.message}`);
+  const deleted = (data ?? []).map(rowToMemory);
+  for (const memory of deleted) {
+    await logMemoryEvent({
+      memory,
+      action: "delete",
+      before: snapshot(memory),
+      after: null,
+      actor,
+      threadId: threadId ?? null
+    });
+  }
+  return deleted.length > 0;
+}
+function snapshot(m) {
+  return {
+    description: m.description,
+    type: m.type,
+    body: m.body,
+    sourceThreadId: m.sourceThreadId,
+    createdBy: m.createdBy
+  };
+}
+function sameContent(m, other) {
+  return m.description === other.description && m.type === other.type && m.body === other.body;
+}
+async function logMemoryEvent(e) {
+  const { error: error2 } = await getSupabaseClient().from("memory_events").insert({
+    channel_id: e.memory.channelId,
+    memory_id: e.action === "delete" ? null : e.memory.id,
+    thread_id: e.threadId,
+    name: e.memory.name,
+    action: e.action,
+    before: e.before,
+    after: e.after,
+    actor: e.actor
+  });
+  if (error2) console.error(`[memory] event log failed for ${e.memory.name}:`, error2.message);
+}
+function rowToEvent(row) {
+  return {
+    id: row["id"],
+    channelId: row["channel_id"],
+    memoryId: row["memory_id"] ?? null,
+    threadId: row["thread_id"] ?? null,
+    name: row["name"],
+    action: row["action"],
+    before: row["before"] ?? null,
+    after: row["after"] ?? null,
+    actor: row["actor"],
+    createdAt: row["created_at"],
+    undoneAt: row["undone_at"] ?? null
+  };
+}
+async function listThreadMemoryEvents(channelId, threadId) {
+  const { data, error: error2 } = await getSupabaseClient().from("memory_events").select("*").eq("channel_id", channelId).eq("thread_id", threadId).order("created_at", { ascending: false }).limit(50);
+  if (error2) throw new Error(`listThreadMemoryEvents(${threadId}): ${error2.message}`);
+  return (data ?? []).map(rowToEvent);
+}
+async function undoMemoryEvent(channelId, eventId) {
+  const supabase = getSupabaseClient();
+  const { data, error: error2 } = await supabase.from("memory_events").select("*").eq("id", eventId).eq("channel_id", channelId).maybeSingle();
+  if (error2) throw new Error(`undoMemoryEvent(${eventId}): ${error2.message}`);
+  if (!data) return "not-found";
+  const event = rowToEvent(data);
+  if (event.undoneAt) return "already-undone";
+  const current = await getChannelMemory(channelId, event.name);
+  const unchangedSince = current && event.after ? sameContent(current, event.after) : !current && !event.after;
+  if (!unchangedSince) return "conflict";
+  const claimed = await supabase.from("memory_events").update({ undone_at: (/* @__PURE__ */ new Date()).toISOString() }).eq("id", eventId).is("undone_at", null).select("id");
+  if (claimed.error) throw new Error(`undoMemoryEvent(${eventId}): ${claimed.error.message}`);
+  if (!(claimed.data ?? []).length) return "already-undone";
+  const before = event.before;
+  const restore = before ? {
+    description: before.description,
+    type: before.type,
+    body: before.body,
+    source_thread_id: before.sourceThreadId,
+    created_by: before.createdBy
+  } : null;
+  const { error: writeError } = !restore ? await supabase.from("memories").delete().eq("id", current.id) : current ? await supabase.from("memories").update({ ...restore, updated_at: (/* @__PURE__ */ new Date()).toISOString() }).eq("id", current.id) : await supabase.from("memories").insert({ ...restore, scope: "channel", channel_id: channelId, name: event.name });
+  if (writeError) {
+    await supabase.from("memory_events").update({ undone_at: null }).eq("id", eventId);
+    throw new Error(`undoMemoryEvent(${eventId}): ${writeError.message}`);
+  }
+  return "undone";
+}
+function isUuid(value) {
+  return /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(value);
+}
+function formatMemoryPrompt(channelId, memories) {
+  const lines = [];
+  let used = 0;
+  let omitted = 0;
+  for (const m of memories) {
+    const line = `- \`${m.name}\` (${m.type}): ${m.description}`;
+    if (used + line.length > MEMORY_INDEX_MAX_CHARS) {
+      omitted++;
+      continue;
+    }
+    lines.push(line);
+    used += line.length + 1;
+  }
+  const index = lines.length ? lines.join("\n") + (omitted ? `
+- (${omitted} older memories not listed; find them with \`memory search\`)` : "") : "(none yet)";
+  return [
+    `## Channel memory`,
+    ``,
+    `This channel has a persistent memory shared by every thread in it and by every agent runner. Use it instead of any built-in memory directory of your own CLI.`,
+    ``,
+    `- Read a memory: \`flyspace memory get --channel ${channelId} <name>\``,
+    `- Search: \`flyspace memory search --channel ${channelId} <words>\``,
+    `- Save or overwrite: \`flyspace memory save --channel ${channelId} --name <kebab-slug> --type <${MEMORY_TYPES.join("|")}> --description "<one line>" --body "<text>" [--thread <thread-id>]\``,
+    `- Delete one that turned out wrong: \`flyspace memory delete --channel ${channelId} <name> [--thread <thread-id>]\``,
+    ``,
+    `Save when someone asks you to remember something, corrects you, or a decision is made that later threads will need. Save what is not derivable from the code, git history or docs: decisions and why, preferences, corrections, where external things live. Do not save one-off details of this conversation. Check the index first and update an existing memory rather than adding a near-duplicate. Write memories in English. Pass \`--thread\` with the thread id from the \`[context: ...]\` header, so the thread shows what changed and it can be undone there.`,
+    ``,
+    `Index:`,
+    index
+  ].join("\n");
+}
+
 // src/dashboard/rollover-summary.ts
 import { spawn as spawn5 } from "child_process";
-import { tmpdir as tmpdir2 } from "os";
+import { tmpdir as tmpdir3 } from "os";
 var HAIKU_MODEL = "haiku";
 var CJK_PATTERN = /[　-〿぀-ヿ㐀-䶿一-鿿豈-﫿＀-￯]/;
 function estimateTokens(text) {
@@ -8098,7 +8636,7 @@ function runHaikuPrint(input2, claudeConfigDir, claudeCodeOauthToken) {
       // A stateless rewrite touches no files — tmpdir keeps it that way and
       // avoids picking up an unrelated project's own CLAUDE.md/AGENTS.md,
       // unlike the channel's own cwd the main turn runs in.
-      cwd: tmpdir2(),
+      cwd: tmpdir3(),
       env,
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -8894,6 +9432,13 @@ var ChatAgent = class {
       thread.channel_id
     );
     if (docsAccess && docsAccess !== "write") channelConfig = { ...channelConfig, docsAccess };
+    if (docsAccess !== "none" && isUuid(thread.channel_id)) {
+      const memoryPrompt = await listChannelMemories(thread.channel_id).then((memories) => formatMemoryPrompt(thread.channel_id, memories)).catch((err) => {
+        console.error("[chat-agent] memory lookup failed:", err.message);
+        return void 0;
+      });
+      if (memoryPrompt) channelConfig = { ...channelConfig, memoryPrompt };
+    }
     const store = this.openSessionStore();
     try {
       const channelKey = `chat:${thread.channel_id}`;
@@ -9301,7 +9846,8 @@ ${msg.body}` : msg.body;
             signal,
             mcpConfigPath,
             ...usageContext ? { usageContext } : {},
-            ...channelConfig.docsAccess ? { docsAccess: channelConfig.docsAccess } : {}
+            ...channelConfig.docsAccess ? { docsAccess: channelConfig.docsAccess } : {},
+            ...channelConfig.memoryPrompt ? { memoryPrompt: channelConfig.memoryPrompt } : {}
           },
           channelConfig.claudeConfigDir,
           sessionId,
@@ -9338,6 +9884,7 @@ ${msg.body}` : msg.body;
               channelConfig.prompt,
               resolveSelectedOutputStyle(channelConfig.claudeConfigDir)?.body
             ),
+            channelConfig.memoryPrompt,
             docsAccessPromptNote(channelConfig.docsAccess)
           ].filter(Boolean).join("\n\n---\n\n"),
           // Codex has no per-tool deny list, so any restricted requester gets
@@ -9615,7 +10162,7 @@ async function exportDocAsArtifact(channelId, docPath) {
   );
   const abs = resolveDocPath(channelConfig.cwd, docPath);
   if (!abs) throw new Error(`doc not found: ${docPath}`);
-  const content = readFileSync9(abs, "utf8");
+  const content = readFileSync10(abs, "utf8");
   const title = extractTitle(abs, "md");
   const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
   const prompt = `Publish the document at \`${docPath}\` (already read below) as a Claude Artifact, then record the result as a stub file under this channel's \`docs/artifacts/\` folder (create the folder if it doesn't exist).
@@ -9894,12 +10441,12 @@ function readGitBranch(dir) {
   try {
     let gitDir = join17(dir, ".git");
     if (statSync5(gitDir).isFile()) {
-      const pointer = readFileSync10(gitDir, "utf8").trim();
+      const pointer = readFileSync11(gitDir, "utf8").trim();
       const match = pointer.match(/^gitdir:\s*(.+)$/);
       if (!match) return void 0;
       gitDir = resolve5(dir, match[1]);
     }
-    const head = readFileSync10(join17(gitDir, "HEAD"), "utf8").trim();
+    const head = readFileSync11(join17(gitDir, "HEAD"), "utf8").trim();
     const branchMatch = head.match(/^ref:\s*refs\/heads\/(.+)$/);
     if (branchMatch) return branchMatch[1];
     return /^[0-9a-f]{7,40}$/i.test(head) ? head.slice(0, 7) : void 0;
@@ -9926,8 +10473,8 @@ function listDocLevel(root, relDir = "", sort = "newest", showHidden = false) {
     const kind = entryKind(entry, abs);
     if (kind === "dir") {
       if (SKIP_DIRS.has(entry.name)) continue;
-      const probe2 = probeDir(abs, showHidden);
-      if (!probe2.hasDocs && probe2.hasOther) continue;
+      const probe3 = probeDir(abs, showHidden);
+      if (!probe3.hasDocs && probe3.hasOther) continue;
       const isRepo = existsSync17(join17(abs, ".git"));
       dirs.push({
         path,
@@ -10146,7 +10693,7 @@ function moveDocEntry(root, from, to) {
     return { status: "into-self" };
   }
   try {
-    if (realpathSync(finalAbs) !== realpathSync(absFrom)) return { status: "exists" };
+    if (realpathSync2(finalAbs) !== realpathSync2(absFrom)) return { status: "exists" };
   } catch {
   }
   renameSync(absFrom, finalAbs);
@@ -10164,7 +10711,7 @@ function deleteDocEntry(root, path) {
   }
   const isDir2 = stat.isDirectory();
   if (!isDir2 && !stat.isFile() && !stat.isSymbolicLink()) return { status: "not-found" };
-  rmSync4(abs, { recursive: isDir2 });
+  rmSync5(abs, { recursive: isDir2 });
   return {
     status: "ok",
     path: relative(root, abs).split(sep).join("/"),
@@ -10203,7 +10750,7 @@ function createDocsRouter() {
     }
     if (!stat.isFile()) return c.json({ error: "not found" }, 404);
     if (stat.size > MAX_RAW_BYTES) return c.json({ error: "file too large" }, 413);
-    const data = readFileSync10(resolved2.abs);
+    const data = readFileSync11(resolved2.abs);
     const headers = { "Content-Type": resolved2.contentType };
     if (download) {
       const filename = basename5(resolved2.abs).replace(/"/g, "");
@@ -10223,7 +10770,7 @@ function createDocsRouter() {
     }
     if (!stat.isFile()) return c.json({ error: "not found" }, 404);
     if (stat.size > MAX_RAW_BYTES) return c.json({ error: "file too large" }, 413);
-    return c.body(new Uint8Array(readFileSync10(abs)), 200, {
+    return c.body(new Uint8Array(readFileSync11(abs)), 200, {
       "Content-Type": "text/html; charset=utf-8",
       "Content-Security-Policy": HTML_SHARE_CSP,
       "X-Content-Type-Options": "nosniff",
@@ -10239,10 +10786,10 @@ function createDocsRouter() {
     const files = form.getAll("file").filter((f) => f instanceof File);
     if (files.length === 0) return c.json({ error: "missing file" }, 400);
     const uploaded = [];
-    const failed = [];
+    const failed2 = [];
     for (const file of files) {
       if (file.size > MAX_UPLOAD_BYTES) {
-        failed.push({
+        failed2.push({
           name: file.name,
           error: `larger than ${MAX_UPLOAD_BYTES / (1024 * 1024)}MB`
         });
@@ -10256,16 +10803,16 @@ function createDocsRouter() {
         case "no-dir":
           return c.json({ error: "folder not found" }, 404);
         case "bad-type":
-          failed.push({ name: file.name, error: "file type not allowed" });
+          failed2.push({ name: file.name, error: "file type not allowed" });
           break;
         case "too-large":
-          failed.push({ name: file.name, error: "file too large" });
+          failed2.push({ name: file.name, error: "file too large" });
           break;
         default:
-          failed.push({ name: file.name, error: "invalid filename" });
+          failed2.push({ name: file.name, error: "invalid filename" });
       }
     }
-    return c.json({ path: dir, uploaded, failed }, uploaded.length > 0 ? 201 : 400);
+    return c.json({ path: dir, uploaded, failed: failed2 }, uploaded.length > 0 ? 201 : 400);
   });
   app.post("/:id/docs/folder", async (c) => {
     const { cwd } = resolveChannelConfig(c.req.param("id"));
@@ -10408,7 +10955,7 @@ function createDocsRouter() {
       title: kind ? extractTitle(abs, kind) : basename5(abs),
       mtime: stat.mtime.toISOString(),
       tooLarge: tooLarge || void 0,
-      content: tooLarge ? "" : readFileSync10(abs, "utf8")
+      content: tooLarge ? "" : readFileSync11(abs, "utf8")
     });
   });
   app.put("/:id/docs/content", async (c) => {
@@ -10451,7 +10998,7 @@ function createDocsRouter() {
       channel,
       rel,
       title: extractTitle(abs, "md"),
-      content: readFileSync10(abs, "utf8")
+      content: readFileSync11(abs, "utf8")
     };
   };
   app.get("/:id/docs/translation/:lang", async (c) => {
@@ -10674,7 +11221,7 @@ function ownSkills(scope, dir) {
     return [{ scope, name, description, body, path, plugin: null, mtime }];
   });
 }
-function snapshot(scopes) {
+function snapshot2(scopes) {
   const wants = (scope) => !scopes || scopes.has(scope);
   const configDir2 = profileClaudeConfigDir();
   const rows = [];
@@ -10709,7 +11256,7 @@ async function pushSkillScopes(scopes) {
   if (!mirrorEnabled()) return;
   const workspace = getProfile();
   const supabase = getSupabaseClient();
-  const rows = snapshot(scopes ? new Set(scopes) : void 0);
+  const rows = snapshot2(scopes ? new Set(scopes) : void 0);
   let query = supabase.from("skill_files").select("scope, name, hash").eq("workspace", workspace);
   if (scopes) query = query.in("scope", scopes);
   const { data, error: error2 } = await query;
@@ -10989,32 +11536,6 @@ function registerMirroredSkillRoutes(api, agent) {
   mountSkillRoutes(api, "/channels/:id/skill-files", channelRef, backend);
 }
 
-// src/dashboard/agent-identities.ts
-var BOT_DM_KEY = "claude";
-async function resolveAgentIdentities() {
-  const settings = loadDashboardSettings();
-  const { cwd: defaultCwd } = resolveChannelConfig("");
-  const main2 = [
-    {
-      name: BOT_DM_KEY,
-      label: "Workspace Agent",
-      kind: "main",
-      cwd: defaultCwd,
-      model: settings.agentProfiles?.[BOT_DM_KEY]?.model,
-      ...await loadBotIdentity()
-    }
-  ];
-  return Promise.all(
-    main2.map(async ({ cwd, ...agent }) => {
-      const dm = await ensureAgentDmChannel(agent.name, {
-        name: agent.displayName ?? agent.label,
-        cwd
-      });
-      return { ...agent, channelId: dm.id };
-    })
-  );
-}
-
 // src/dashboard/providers.ts
 import { execFileSync as execFileSync2 } from "child_process";
 import { existsSync as existsSync20 } from "fs";
@@ -11048,7 +11569,7 @@ function claudeAuthAvailable() {
     return false;
   }
 }
-function probe(runner) {
+function probe2(runner) {
   const label2 = PROVIDER_LABELS[runner];
   const bin = runner === "codex" ? "codex" : "claude";
   if (!binaryOnPath(bin)) {
@@ -11069,7 +11590,7 @@ function providerStatuses() {
   const key = getProfile();
   const hit = cache6.get(key);
   if (hit && Date.now() - hit.at < TTL_MS2) return hit.statuses;
-  const statuses = ["claude", "codex"].map(probe);
+  const statuses = ["claude", "codex"].map(probe2);
   cache6.set(key, { at: Date.now(), statuses });
   return statuses;
 }
@@ -11192,7 +11713,7 @@ function registerHostRoutes(api) {
 }
 function tailFile(file, limit) {
   if (!existsSync21(file)) return [];
-  const lines = readFileSync11(file, "utf-8").split("\n");
+  const lines = readFileSync12(file, "utf-8").split("\n");
   if (lines.at(-1) === "") lines.pop();
   return lines.slice(-limit);
 }
@@ -11304,8 +11825,8 @@ function createCategoryWriteRouter() {
         (id, position) => supabase.from("categories").update({ position, updated_at: (/* @__PURE__ */ new Date()).toISOString() }).eq("id", id).eq("profile", getProfile())
       )
     );
-    const failed = results.find((r) => r.error);
-    if (failed?.error) return c.json({ error: failed.error.message }, 500);
+    const failed2 = results.find((r) => r.error);
+    if (failed2?.error) return c.json({ error: failed2.error.message }, 500);
     return c.json({ ok: true });
   });
   app.put("/:id", async (c) => {
@@ -14259,8 +14780,80 @@ function createChannelMembersRouter() {
   return router;
 }
 
-// src/dashboard/onboarding-routes.ts
+// src/dashboard/memories-routes.ts
 import { Hono as Hono27 } from "hono";
+var requireChannelVisible = async (c, next) => {
+  const channel = findChannel(c.req.param("id"));
+  if (!channel || !canSeeChannel(channel, c.get("auth"))) {
+    return c.json({ error: "channel not found" }, 404);
+  }
+  c.set("memoryChannelId", channel.id);
+  await next();
+};
+function createMemoriesRouter() {
+  const router = new Hono27();
+  for (const path of [
+    "/:id/memories",
+    "/:id/memories/*",
+    "/:id/memory-events",
+    "/:id/memory-events/*"
+  ]) {
+    router.use(path, requireChannelVisible, requireDocsAccess);
+  }
+  router.get("/:id/memories", async (c) => {
+    return c.json({ memories: await listChannelMemories(c.get("memoryChannelId")) });
+  });
+  router.patch("/:id/memories/:memoryId", async (c) => {
+    const memoryId = c.req.param("memoryId");
+    if (!isUuid(memoryId)) return c.json({ error: "invalid memory id" }, 400);
+    const body = await c.req.json().catch(() => ({}));
+    const patch = {};
+    if (typeof body["description"] === "string") patch.description = body["description"];
+    if (typeof body["body"] === "string") patch.body = body["body"];
+    const type = body["type"];
+    if (type !== void 0) {
+      if (!isMemoryType(type)) return c.json({ error: "invalid type" }, 400);
+      patch.type = type;
+    }
+    try {
+      const memory = await updateChannelMemory(c.get("memoryChannelId"), memoryId, patch, "user");
+      if (!memory) return c.json({ error: "memory not found" }, 404);
+      return c.json({ memory });
+    } catch (err) {
+      return c.json({ error: err.message }, 400);
+    }
+  });
+  router.delete("/:id/memories/:memoryId", async (c) => {
+    const memoryId = c.req.param("memoryId");
+    if (!isUuid(memoryId)) return c.json({ error: "invalid memory id" }, 400);
+    const deleted = await deleteChannelMemory(c.get("memoryChannelId"), memoryId, "user");
+    if (!deleted) return c.json({ error: "memory not found" }, 404);
+    return c.json({ ok: true });
+  });
+  router.get("/:id/memory-events", async (c) => {
+    const threadId = c.req.query("thread") ?? "";
+    if (!isUuid(threadId)) return c.json({ error: "thread query parameter required" }, 400);
+    return c.json({ events: await listThreadMemoryEvents(c.get("memoryChannelId"), threadId) });
+  });
+  router.post("/:id/memory-events/:eventId/undo", async (c) => {
+    const eventId = c.req.param("eventId");
+    if (!isUuid(eventId)) return c.json({ error: "invalid event id" }, 400);
+    const result = await undoMemoryEvent(c.get("memoryChannelId"), eventId);
+    if (result === "not-found") return c.json({ error: "event not found" }, 404);
+    if (result === "already-undone") return c.json({ error: "already undone" }, 409);
+    if (result === "conflict") {
+      return c.json(
+        { error: "The memory has changed since, so this can no longer be undone." },
+        409
+      );
+    }
+    return c.json({ ok: true });
+  });
+  return router;
+}
+
+// src/dashboard/onboarding-routes.ts
+import { Hono as Hono28 } from "hono";
 
 // src/dashboard/unique-channel-name.ts
 function uniqueChannelName(raw, taken) {
@@ -14349,7 +14942,7 @@ async function buildGreeting(input2) {
 // src/dashboard/onboarding-routes.ts
 var MAX_FOLDERS = 20;
 function createOnboardingRouter(agent) {
-  const app = new Hono27();
+  const app = new Hono28();
   app.get("/scan", async (c) => {
     const ctx = await resolveAuthContext(c);
     if (ctx?.role !== "admin") return c.json({ error: "admin access required" }, 403);
@@ -14594,6 +15187,7 @@ function registerDataRoutes(api, agent = {}) {
   api.route("/channels", createDocShareWriteRouter(agent));
   api.route("/onboarding", createOnboardingRouter(agent));
   api.route("/channels", createChannelMembersRouter());
+  api.route("/channels", createMemoriesRouter());
   api.route("/docs", createDocShareListRouter());
   api.get("/users", (c) => c.json({ users: listActiveUsers() }));
   api.route("/categories", createCategoryWriteRouter());
@@ -14844,17 +15438,17 @@ function registerDataRoutes(api, agent = {}) {
 // src/dashboard/device-auth-routes.ts
 import { verify } from "crypto";
 import { getConnInfo } from "@hono/node-server/conninfo";
-import { Hono as Hono28 } from "hono";
+import { Hono as Hono29 } from "hono";
 
 // src/dashboard/agent-bridge.ts
 import { randomBytes as randomBytes8, randomUUID as randomUUID4, sign as signRaw, timingSafeEqual as timingSafeEqual2, verify as verifyRaw } from "crypto";
-import { existsSync as existsSync25, readFileSync as readFileSync15 } from "fs";
+import { existsSync as existsSync25, readFileSync as readFileSync16 } from "fs";
 import dotenv from "dotenv";
 import { WebSocket, WebSocketServer } from "ws";
 
 // src/dashboard/host-identity.ts
 import { createPrivateKey as createPrivateKey2, createPublicKey as createPublicKey2, generateKeyPairSync as generateKeyPairSync2 } from "crypto";
-import { existsSync as existsSync24, mkdirSync as mkdirSync9, readFileSync as readFileSync12, writeFileSync as writeFileSync8 } from "fs";
+import { existsSync as existsSync24, mkdirSync as mkdirSync9, readFileSync as readFileSync13, writeFileSync as writeFileSync8 } from "fs";
 import { dirname as dirname6, join as join20 } from "path";
 function hostPrivateKeyPath() {
   return process.env["FLYSPACE_HOST_KEY_PATH"] || join20(paths.BASE_CONFIG_DIR, "host.key");
@@ -14865,7 +15459,7 @@ function loadHostPrivateKey(path = hostPrivateKeyPath()) {
       `No Host identity at ${path}. Run \`pnpm run generate-host-key\` on this machine, then set FLYSPACE_HOST_PUBLIC_KEY on the Data process to the printed public key.`
     );
   }
-  return createPrivateKey2(readFileSync12(path, "utf8"));
+  return createPrivateKey2(readFileSync13(path, "utf8"));
 }
 function loadHostPublicKey() {
   const b64 = process.env["FLYSPACE_HOST_PUBLIC_KEY"];
@@ -14881,7 +15475,7 @@ function loadHostPublicKey() {
 // src/dashboard/host-lock.ts
 import { execFileSync as execFileSync3 } from "child_process";
 import { randomBytes as randomBytes5 } from "crypto";
-import { mkdirSync as mkdirSync10, readFileSync as readFileSync13, rmSync as rmSync5, writeFileSync as writeFileSync9 } from "fs";
+import { mkdirSync as mkdirSync10, readFileSync as readFileSync14, rmSync as rmSync6, writeFileSync as writeFileSync9 } from "fs";
 import { join as join21 } from "path";
 function hostLockPath() {
   return join21(paths.BASE_DATA_DIR, "host.lock");
@@ -14899,7 +15493,7 @@ function isLiveFlyspace(pid) {
 }
 function readLockPid(path) {
   try {
-    const pid = Number(JSON.parse(readFileSync13(path, "utf8")).pid);
+    const pid = Number(JSON.parse(readFileSync14(path, "utf8")).pid);
     return Number.isInteger(pid) && pid > 0 ? pid : null;
   } catch {
     return null;
@@ -14917,7 +15511,7 @@ function acquireHostLock() {
     try {
       writeFileSync9(path, body, { flag: "wx", mode: 384 });
       const release2 = () => {
-        if (readLockPid(path) === process.pid) rmSync5(path, { force: true });
+        if (readLockPid(path) === process.pid) rmSync6(path, { force: true });
       };
       process.once("exit", release2);
       return release2;
@@ -14931,7 +15525,7 @@ function acquireHostLock() {
           `Another Flyspace Host is already running on this machine (pid ${holder}). Stop it first, or check for a second CLI install (\`which -a flyspace\`). Two Hosts overwrite each other's skill mirror.`
         );
       }
-      rmSync5(path, { force: true });
+      rmSync6(path, { force: true });
     }
   }
   throw new Error(`Could not take the Host lock at ${path}`);
@@ -14940,13 +15534,13 @@ function publishHostEndpoint(port) {
   const path = hostLockPath();
   if (readLockPid(path) !== process.pid) return null;
   const token = randomBytes5(32).toString("hex");
-  const lock = JSON.parse(readFileSync13(path, "utf8"));
+  const lock = JSON.parse(readFileSync14(path, "utf8"));
   writeFileSync9(path, JSON.stringify({ ...lock, port, token }), { mode: 384 });
   return token;
 }
 function readHostEndpoint() {
   try {
-    const { pid, port, token } = JSON.parse(readFileSync13(hostLockPath(), "utf8"));
+    const { pid, port, token } = JSON.parse(readFileSync14(hostLockPath(), "utf8"));
     if (pid === process.pid || !Number.isInteger(port) || typeof token !== "string") return null;
     return { port, token };
   } catch {
@@ -15149,16 +15743,35 @@ async function listWorkspaceDevices(workspaceId) {
   if (error2) fail("listWorkspaceDevices", error2);
   return (data ?? []).map((r) => toDevice(r.devices)).sort((a, b) => b.createdAt.localeCompare(a.createdAt));
 }
+async function touchDevice(deviceId) {
+  const { error: error2 } = await getSupabaseClient().from("devices").update({ last_seen_at: (/* @__PURE__ */ new Date()).toISOString() }).eq("id", deviceId);
+  if (error2) fail("touchDevice", error2);
+}
+var STALE_HOST_MS = 14 * 24 * 60 * 6e4;
+var isStale = (lastSeenAt) => !!lastSeenAt && Date.now() - Date.parse(lastSeenAt) > STALE_HOST_MS;
 async function listWorkspaceHosts(workspaceIds, exceptPublicKey) {
   const hosts2 = /* @__PURE__ */ new Map();
   if (!workspaceIds.length) return hosts2;
-  const { data, error: error2 } = await getSupabaseClient().from("device_workspaces").select("workspace_id, devices!inner(name, public_key, revoked_at)").in("workspace_id", workspaceIds).is("devices.revoked_at", null);
+  const { data, error: error2 } = await getSupabaseClient().from("device_workspaces").select("workspace_id, devices!inner(name, public_key, revoked_at, last_seen_at)").in("workspace_id", workspaceIds).is("devices.revoked_at", null);
   if (error2) fail("listWorkspaceHosts", error2);
   for (const r of data ?? []) {
-    if (r.devices.public_key !== exceptPublicKey) hosts2.set(r.workspace_id, r.devices.name);
+    if (r.devices.public_key !== exceptPublicKey && !isStale(r.devices.last_seen_at)) {
+      hosts2.set(r.workspace_id, r.devices.name);
+    }
   }
   return hosts2;
 }
+async function releaseStaleHosts(workspaceIds, exceptPublicKey) {
+  if (!workspaceIds.length) return;
+  const db = getSupabaseClient();
+  const { data, error: error2 } = await db.from("device_workspaces").select("device_id, workspace_id, devices!inner(public_key, last_seen_at)").in("workspace_id", workspaceIds);
+  if (error2) fail("releaseStaleHosts", error2);
+  for (const r of data ?? []) {
+    if (r.devices.public_key === exceptPublicKey || !isStale(r.devices.last_seen_at)) continue;
+    const { error: delError } = await db.from("device_workspaces").delete().eq("device_id", r.device_id).eq("workspace_id", r.workspace_id);
+    if (delError) fail("releaseStaleHosts", delError);
+  }
+}
 async function userEmail(userId) {
   const { data, error: error2 } = await getSupabaseClient().auth.admin.getUserById(userId);
   if (error2) return null;
@@ -15167,7 +15780,7 @@ async function userEmail(userId) {
 
 // src/dashboard/doc-share-publisher.ts
 import { randomBytes as randomBytes7 } from "crypto";
-import { readFileSync as readFileSync14, statSync as statSync9 } from "fs";
+import { readFileSync as readFileSync15, statSync as statSync9 } from "fs";
 import { extname as extname2, posix } from "path";
 import { CopyObjectCommand, PutObjectCommand as PutObjectCommand5 } from "@aws-sdk/client-s3";
 
@@ -15354,7 +15967,7 @@ async function buildSnapshot(cwd, sourcePath, shareId) {
   }
   if (!stat.isFile()) return { status: "not-found" };
   if (stat.size > MAX_CONTENT_BYTES2) return { status: "too-large" };
-  const source = readFileSync14(abs, "utf8");
+  const source = readFileSync15(abs, "utf8");
   const title = extractTitle(abs, kind === "markdown" ? "md" : kind);
   if (kind === "excalidraw") {
     try {
@@ -15434,7 +16047,7 @@ async function buildSnapshot(cwd, sourcePath, shareId) {
       let text = null;
       try {
         const size = statSync9(docAbs).size;
-        if (size <= budget) text = readFileSync14(docAbs, "utf8");
+        if (size <= budget) text = readFileSync15(docAbs, "utf8");
       } catch {
         continue;
       }
@@ -15451,7 +16064,7 @@ async function buildSnapshot(cwd, sourcePath, shareId) {
     let body;
     try {
       if (statSync9(resolved2.abs).size > MAX_ASSET_BYTES) continue;
-      body = readFileSync14(resolved2.abs);
+      body = readFileSync15(resolved2.abs);
     } catch {
       continue;
     }
@@ -15493,7 +16106,7 @@ async function publishDocShare(input2) {
     ...HTML_FEATURES,
     brandingEnabled: resolveFeatures(input2.features, existing).brandingEnabled
   } : html ? HTML_FEATURES : resolveFeatures(input2.features, existing);
-  const snapshot2 = {
+  const snapshot3 = {
     ...built,
     sourceLang: html ? null : await detectSourceLanguage(built.title, built.content)
   };
@@ -15503,8 +16116,8 @@ async function publishDocShare(input2) {
       const renamed = await setDocShareSlug(existing.id, slug);
       if (!renamed) return { status: "not-found" };
     }
-    const share2 = await updateDocShareSnapshot(existing.id, snapshot2, features);
-    const stale = existing.assetKeys.filter((key) => !snapshot2.assetKeys.includes(key));
+    const share2 = await updateDocShareSnapshot(existing.id, snapshot3, features);
+    const stale = existing.assetKeys.filter((key) => !snapshot3.assetKeys.includes(key));
     await deleteShareAssets(stale);
     if (!features.audioEnabled && existing.audioEnabled) await dropShareAudio(existing);
     void queueShareAudio(share2);
@@ -15518,7 +16131,7 @@ async function publishDocShare(input2) {
     channelId: input2.channelId,
     sourcePath: input2.sourcePath,
     createdBy: input2.createdBy,
-    ...snapshot2,
+    ...snapshot3,
     ...features
   });
   void queueShareAudio(share);
@@ -15633,8 +16246,8 @@ async function proxyHostDb(workspaces, req, forward, assigned = workspaces ?? []
     const scope = table === "skill_files" && isWrite ? assigned : workspaces;
     if (scope.length === 0) return deny(`This Host is not the assigned Host for any workspace it may write ${table} to.`);
     if (method === "POST") {
-      const ok2 = rows.length > 0 && rows.every((r) => typeof r[slugColumn] === "string" && scope.includes(r[slugColumn]));
-      if (!ok2) return deny(`Every ${table} row must belong to a workspace this Host is assigned.`);
+      const ok3 = rows.length > 0 && rows.every((r) => typeof r[slugColumn] === "string" && scope.includes(r[slugColumn]));
+      if (!ok3) return deny(`Every ${table} row must belong to a workspace this Host is assigned.`);
     }
     if (method === "PATCH") {
       const patch = bodyRows(req.body);
@@ -15648,8 +16261,8 @@ async function proxyHostDb(workspaces, req, forward, assigned = workspaces ?? []
     if (!channelIds) return deny("Could not resolve the device workspaces.", 502);
     if (table === "threads") {
       if (method === "POST") {
-        const ok2 = rows.length > 0 && rows.every((r) => typeof r["channel_id"] === "string" && channelIds.includes(r["channel_id"]));
-        if (!ok2) return deny("A thread must belong to a channel of the device workspaces.");
+        const ok3 = rows.length > 0 && rows.every((r) => typeof r["channel_id"] === "string" && channelIds.includes(r["channel_id"]));
+        if (!ok3) return deny("A thread must belong to a channel of the device workspaces.");
       }
       if (method === "PATCH") {
         const patch = bodyRows(req.body);
@@ -15828,7 +16441,7 @@ function localAgentCallbacks(chatAgent) {
     regenerateAgentRun: (threadId) => chatAgent.regenerate(threadId),
     listAgentRuns: () => chatAgent.runningThreadIds(),
     listMissingCwds: () => auditChannelCwds().map((ch) => ch.id),
-    listRunningProfiles: () => listProfiles().filter(isServiceRunning),
+    listRunningProfiles: () => listProfiles().filter(isServiceRunning2),
     getAgentIdentities: () => resolveAgentIdentities(),
     publishDocShare: (input2) => publishDocShare(input2),
     listChannelSkills: (args) => listSkills(args.claudeConfigDir, args.cwd),
@@ -15845,14 +16458,14 @@ function localAgentCallbacks(chatAgent) {
 }
 var HOST_CONFIG_PUSH_INTERVAL_MS = 6e4;
 function buildHostConfigSnapshot() {
-  const snapshot2 = {};
+  const snapshot3 = {};
   for (const profile of listProfiles()) {
-    snapshot2[profile] = runWithProfile(profile, () => ({
-      env: existsSync25(paths.CONFIG_FILE) ? dotenv.parse(readFileSync15(paths.CONFIG_FILE, "utf-8")) : {},
+    snapshot3[profile] = runWithProfile(profile, () => ({
+      env: existsSync25(paths.CONFIG_FILE) ? dotenv.parse(readFileSync16(paths.CONFIG_FILE, "utf-8")) : {},
       agentModel: loadDashboardSettings().agent
     }));
   }
-  return snapshot2;
+  return snapshot3;
 }
 function startLocalProfileConfigHydration() {
   setProfileConfigCache(buildHostConfigSnapshot());
@@ -15941,9 +16554,21 @@ async function revalidateDeviceScopes() {
       continue;
     }
     const workspaces = (await listDeviceWorkspaces(device)).map((w) => w.slug);
-    for (const scope of hosts.values()) if (scope.deviceId === deviceId) scope.workspaces = workspaces;
+    for (const [ws, scope] of hosts) {
+      if (scope.deviceId !== deviceId) continue;
+      const changed = (scope.workspaces ?? []).join() !== workspaces.join();
+      scope.workspaces = workspaces;
+      if (changed) send(ws, { type: "workspaces", workspaces });
+    }
+    if (!device.lastSeenAt || Date.now() - Date.parse(device.lastSeenAt) > LAST_SEEN_RESOLUTION_MS) {
+      await touchDevice(deviceId);
+    }
   }
 }
+var LAST_SEEN_RESOLUTION_MS = 60 * 6e4;
+function minCliVersion() {
+  return process.env["FLYSPACE_MIN_CLI_VERSION"]?.trim() || null;
+}
 function attachHostSocket(server) {
   const wss = new WebSocketServer({ server, path: HOST_SOCKET_PATH });
   const legacyPublicKey = loadHostPublicKey();
@@ -15984,10 +16609,19 @@ function attachHostSocket(server) {
             ws.close(1008, "bad signature");
             return;
           }
+          const min = minCliVersion();
+          if (min && msg.cliVersion && isOlderVersion(msg.cliVersion, min)) {
+            console.error(`[host-socket] rejecting Host on CLI ${msg.cliVersion} (minimum ${min})`);
+            send(ws, { type: "auth-failed", reason: "cli too old", minCliVersion: min });
+            ws.close(1008, "cli too old");
+            return;
+          }
           supersedeSameIdentity(scope2, ws);
           lastAuthFailure = null;
           addHost(ws, scope2);
-          send(ws, { type: "auth-ok" });
+          send(ws, scope2.workspaces ? { type: "auth-ok", workspaces: scope2.workspaces } : { type: "auth-ok" });
+          if (scope2.deviceId) void touchDevice(scope2.deviceId).catch(() => {
+          });
           console.log(`[host-socket] Host authenticated (authPath: ${scope2.authPath})`);
           if (scope2.workspaces) void markAgentConnected(scope2.workspaces);
         })();
@@ -16073,7 +16707,8 @@ function remoteAgentCallbacks() {
     // Host connected, showing nobody as running is a reasonable default
     // rather than a false claim of certainty either way.
     listRunningProfiles: async () => await callHost("listRunningProfiles", []) ?? [],
-    getAgentIdentities: async () => await callHost("getAgentIdentities", []) ?? [],
+    // `null` (no Host) falls back to `offlineAgentIdentities` in api.ts.
+    getAgentIdentities: () => callHost("getAgentIdentities", []),
     // Reading the doc and copying its assets can only happen where the
     // channel's real folder is, so this always goes to the Host. `null` (no
     // Host connected) surfaces as `host-unavailable` — see
@@ -16110,7 +16745,7 @@ function remoteAgentCallbacks() {
 }
 var RECONNECT_BASE_MS = 1e3;
 var RECONNECT_MAX_MS = 3e4;
-function connectHostSocket(url, callbacks, onAuthenticated) {
+function connectHostSocket(url, callbacks, onAuthenticated, onWorkspaces) {
   const credentials = loadCredentials();
   const deviceId = credentials?.deviceId;
   const privateKey = deviceId ? ensureDeviceKey().privateKey : loadHostPrivateKey();
@@ -16142,11 +16777,23 @@ function connectHostSocket(url, callbacks, onAuthenticated) {
       if (!msg) return;
       if (msg.type === "challenge") {
         const signature = signRaw(null, Buffer.from(msg.nonce, "base64"), privateKey).toString("base64");
-        send(ws, deviceId ? { type: "auth", signature, deviceId } : { type: "auth", signature });
+        const version = CLI_VERSION ? { cliVersion: CLI_VERSION } : {};
+        send(ws, deviceId ? { type: "auth", signature, deviceId, ...version } : { type: "auth", signature, ...version });
         return;
       }
       if (msg.type === "auth-failed") {
         console.error(`[host-socket] auth rejected: ${msg.reason}`);
+        if (msg.minCliVersion) {
+          console.error(
+            `[host-socket] This Host runs flyspace ${CLI_VERSION} but the Workspace needs ${msg.minCliVersion} or later.
+  Upgrade, then restart the Host:  flyspace upgrade`
+          );
+          stopped = true;
+        }
+        return;
+      }
+      if (msg.type === "workspaces") {
+        onWorkspaces?.(msg.workspaces);
         return;
       }
       if (msg.type === "auth-ok") {
@@ -16158,6 +16805,7 @@ function connectHostSocket(url, callbacks, onAuthenticated) {
           send(ws, { type: "host-config", configs: buildHostConfigSnapshot() });
         }, HOST_CONFIG_PUSH_INTERVAL_MS);
         onAuthenticated?.();
+        if (msg.workspaces) onWorkspaces?.(msg.workspaces);
         return;
       }
       if (msg.type === "db-result") {
@@ -16344,7 +16992,7 @@ async function boundWorkspaceIds(publicKey, userId) {
   return new Set(existing ? (await listDeviceWorkspaces(existing)).map((w) => w.id) : []);
 }
 function createDeviceAuthRouter() {
-  const app = new Hono28();
+  const app = new Hono29();
   app.post("/code", async (c) => {
     const body = await readBody(c);
     const publicKey = typeof body["public_key"] === "string" ? body["public_key"] : "";
@@ -16407,8 +17055,8 @@ function createDeviceAuthRouter() {
     if (!device || device.revokedAt || !nonce || !signature) return c.json({ error: "invalid_grant" }, 401);
     if (!await consumeChallenge(device.id, nonce)) return c.json({ error: "invalid_grant" }, 401);
     const key = parseEd25519PublicKey(device.publicKey);
-    const ok2 = key && verify(null, Buffer.from(nonce), key, Buffer.from(signature, "base64"));
-    if (!ok2) return c.json({ error: "invalid_grant" }, 401);
+    const ok3 = key && verify(null, Buffer.from(nonce), key, Buffer.from(signature, "base64"));
+    if (!ok3) return c.json({ error: "invalid_grant" }, 401);
     const { token, expiresInS } = await issueAccessToken(device.id);
     return c.json({ access_token: token, token_type: "Bearer", expires_in: expiresInS });
   });
@@ -16500,6 +17148,7 @@ function createDeviceAuthRouter() {
     if (!decided) {
       return c.json({ error: "That code was already used." }, 409);
     }
+    await releaseStaleHosts(workspaceIds, pending3.publicKey);
     return c.json({ ok: true });
   });
   return app;
@@ -16507,7 +17156,7 @@ function createDeviceAuthRouter() {
 
 // src/dashboard/api.ts
 function createApiRouter(agent = {}, mode = "all") {
-  const api = new Hono29();
+  const api = new Hono30();
   api.use("*", async (c, next) => {
     const known = await listKnownWorkspaces();
     const fromHost = profileFromHost(trustedHost(c), known);
@@ -16554,7 +17203,7 @@ function createApiRouter(agent = {}, mode = "all") {
   if (mode === "data") {
     api.get(
       "/settings/agents",
-      async (c) => c.json({ agents: await agent.getAgentIdentities?.() ?? [] })
+      async (c) => c.json({ agents: await agent.getAgentIdentities?.() ?? await offlineAgentIdentities() })
     );
     api.get("/channels/:id/skills", async (c) => {
       const { cwd, claudeConfigDir } = resolveChannelConfig(c.req.param("id"));
@@ -16618,7 +17267,7 @@ function createApiRouter(agent = {}, mode = "all") {
 }
 
 // src/dashboard/app-icon-routes.ts
-import { Hono as Hono30 } from "hono";
+import { Hono as Hono31 } from "hono";
 var NEUTRAL_MANIFEST = {
   id: "/",
   name: "Flyspace",
@@ -16656,7 +17305,7 @@ async function withResolvedProfile2(c, next) {
   return profile ? runWithProfile(profile, () => next()) : next();
 }
 function createAppIconRouter() {
-  const app = new Hono30();
+  const app = new Hono31();
   app.get("/manifest.json", withResolvedProfile2, async (c) => {
     if (!await resolvedProfileHost(c)) return c.json(NEUTRAL_MANIFEST);
     const profile = getProfile();
@@ -16696,7 +17345,7 @@ function pngResponse(c, png) {
 }
 
 // src/dashboard/stripe-routes.ts
-import { Hono as Hono31 } from "hono";
+import { Hono as Hono32 } from "hono";
 function planStatusFor(status) {
   const known = ["trialing", "active", "paused", "canceled"];
   return known.includes(status) ? status : null;
@@ -16739,7 +17388,7 @@ async function handleCardAdded(session) {
   }
 }
 function createStripeWebhookRouter() {
-  const stripeRouter = new Hono31();
+  const stripeRouter = new Hono32();
   stripeRouter.post("/webhook", async (c) => {
     const secret = process.env["STRIPE_WEBHOOK_SECRET"];
     const signature = c.req.header("stripe-signature");
@@ -16855,10 +17504,10 @@ var DEFAULT_DASHBOARD_HOST = "127.0.0.1";
 async function findFreePort(start, host = DEFAULT_DASHBOARD_HOST, attempts = 50) {
   for (let port = start; port < start + attempts; port++) {
     const free = await new Promise((resolve8) => {
-      const probe2 = createServer();
-      probe2.once("error", () => resolve8(false));
-      probe2.once("listening", () => probe2.close(() => resolve8(true)));
-      probe2.listen(port, host);
+      const probe3 = createServer();
+      probe3.once("error", () => resolve8(false));
+      probe3.once("listening", () => probe3.close(() => resolve8(true)));
+      probe3.listen(port, host);
     });
     if (free) return port;
   }
@@ -16872,7 +17521,7 @@ async function startDashboardServer(preferredPort = DEFAULT_DASHBOARD_PORT, host
   const bootCallbacks = new Proxy({}, {
     get: (_t, prop) => lateCallbacks?.[prop]
   });
-  const earlyHostSocket = mode === "host" && !hasSupabaseCredentials() && loadCredentials() ? (setSupabaseClient(createHostDbClient()), connectHostSocket(dataSocketUrl(), bootCallbacks, () => onHostConnected?.())) : void 0;
+  const earlyHostSocket = mode === "host" && !hasSupabaseCredentials() && loadCredentials() ? (setSupabaseClient(createHostDbClient()), connectHostSocket(dataSocketUrl(), bootCallbacks, () => onHostConnected?.(), onBindingsChanged)) : void 0;
   if (servesHost) {
     await reconcileAll().catch(
       (err) => console.error("[dashboard] reconcileAll failed:", err.message)
@@ -16899,7 +17548,7 @@ async function startDashboardServer(preferredPort = DEFAULT_DASHBOARD_PORT, host
   const mirrorsSkills = mode === "host" || process.env["FLYSPACE_SKILL_SYNC"] === "1";
   const stopSkillSync = mirrorsSkills ? installSkillSync(listProfiles()) : () => {
   };
-  const app = new Hono32();
+  const app = new Hono33();
   app.use("*", async (c, next) => {
     await next();
     if (c.req.path.startsWith("/assets/")) {
@@ -16947,7 +17596,7 @@ The JSON API is live under /api.` : "This install has no bundled Workspace UI.\n
   if (mode === "host") relayToken = publishHostEndpoint(port);
   if (mode === "data") attachHostSocket(server);
   const stopHostStatusBroadcast = mode === "data" ? startHostStatusBroadcast() : void 0;
-  const hostSocketClient = earlyHostSocket ?? (mode === "host" && chatAgent ? connectHostSocket(dataSocketUrl(), localAgentCallbacks(chatAgent), () => onHostConnected?.()) : void 0);
+  const hostSocketClient = earlyHostSocket ?? (mode === "host" && chatAgent ? connectHostSocket(dataSocketUrl(), localAgentCallbacks(chatAgent), () => onHostConnected?.(), onBindingsChanged) : void 0);
   const stopPushWatcher = earlyHostSocket ? () => {
   } : startPushWatcher();
   const displayHost = host === "0.0.0.0" || host === "::" ? "127.0.0.1" : host;
@@ -16968,6 +17617,13 @@ The JSON API is live under /api.` : "This install has no bundled Workspace UI.\n
     }
   };
 }
+function onBindingsChanged(workspaces) {
+  const creds = loadCredentials();
+  if (!creds || (creds.workspaces ?? []).join() === workspaces.join()) return;
+  saveCredentials({ ...creds, workspaces });
+  console.log(`[dashboard] now serving: ${workspaces.join(", ") || "(none)"}`);
+  void reconcileAll().then(() => ensureServices()).catch((err) => console.error("[dashboard] applying new bindings failed:", err.message));
+}
 var SERVICE_CHECK_MS = 6e4;
 function watchServices() {
   const tick = () => void ensureServices().then((slugs) => slugs.length && console.log(`[dashboard] installed scheduler service for: ${slugs.join(", ")}`)).catch((err) => console.error("[dashboard] ensureServices failed:", err.message));
@@ -17177,7 +17833,7 @@ Done. ${totalThreads} threads, ${totalReplies} messages upserted.`);
 }
 
 // src/commands/slack.ts
-var USAGE2 = `
+var USAGE3 = `
   Usage: flyspace slack <subcommand> [options]
 
   Subcommands:
@@ -17362,7 +18018,7 @@ async function threadReplies(client2, nameOrId, ts2) {
 async function postMessage(client2, args) {
   const channelArg = getArg2(args, "--channel");
   const textFilePath = getArg2(args, "--text-file");
-  const text = textFilePath ? readFileSync16(textFilePath, "utf8") : getArg2(args, "--text");
+  const text = textFilePath ? readFileSync17(textFilePath, "utf8") : getArg2(args, "--text");
   const threadTs = getArg2(args, "--thread");
   const markdown = args.includes("--markdown");
   const broadcast = args.includes("--broadcast") && Boolean(threadTs);
@@ -17517,7 +18173,7 @@ async function ensureClaudeCodeReady() {
 }
 function getManifestYaml(botName) {
   const manifestPath = resolve7(paths.PACKAGE_ROOT, "slack-app-manifest.yml");
-  const raw = readFileSync16(manifestPath, "utf-8");
+  const raw = readFileSync17(manifestPath, "utf-8");
   return raw.replace(/name: Custie/g, `name: ${botName}`);
 }
 async function stepPersonalise() {
@@ -17730,7 +18386,7 @@ async function stepBrowserTokens(botName) {
     })
   ));
   const DEBUG = process.argv.includes("--debug");
-  const USER_DATA_DIR = resolve7(tmpdir3(), "custie-playwright-profile");
+  const USER_DATA_DIR = resolve7(tmpdir4(), "custie-playwright-profile");
   let context;
   try {
     log4("Opening browser \u2014 a Slack login page will appear.\n");
@@ -17951,7 +18607,7 @@ function copyDefaultPrompt(botName) {
   if (!existsSync27(paths.PROMPT_FILE)) {
     const defaultPrompt = resolve7(paths.PACKAGE_ROOT, "system.default.md");
     if (existsSync27(defaultPrompt)) {
-      const content = readFileSync16(defaultPrompt, "utf-8").replace(/\{\{botName\}\}/g, botName);
+      const content = readFileSync17(defaultPrompt, "utf-8").replace(/\{\{botName\}\}/g, botName);
       writeFileSync10(paths.PROMPT_FILE, content);
       success4(`Default prompt copied to ${paths.PROMPT_FILE}`);
     }
@@ -18112,13 +18768,13 @@ async function runSlackCmd(args) {
       break;
     }
     default:
-      console.log(USAGE2);
+      console.log(USAGE3);
       break;
   }
 }
 
 // src/commands/chat.ts
-var USAGE3 = `
+var USAGE4 = `
   Usage: flyspace chat <subcommand> [options]
 
   Subcommands:
@@ -18264,17 +18920,131 @@ async function runChatCmd(args) {
     case "-h":
     case "--help":
     case void 0:
-      console.log(USAGE3);
+      console.log(USAGE4);
       break;
     default:
       console.error(`Unknown subcommand: ${subcommand}`);
-      console.log(USAGE3);
+      console.log(USAGE4);
+      process.exit(1);
+  }
+}
+
+// src/commands/memory.ts
+import { readFileSync as readFileSync18 } from "fs";
+var USAGE5 = `
+  Usage: flyspace memory <subcommand> --channel <name-or-id> [options]
+
+  A channel's persistent agent memory (docs/features/workspace-memory.md).
+
+  Subcommands:
+    list                                 Every memory in the channel (index form)
+    get <name>                           One memory in full
+    search <words...>                    Memories whose name, description or body match
+    save --name <slug> --type <type>     Create, or overwrite the memory with that name
+      --description <one line>
+      --body <text | ->                  "-" reads the body from stdin
+      [--thread <id>]                    The thread the memory came from
+    delete <name-or-id> [--thread <id>]  Delete one memory
+
+  Types: ${MEMORY_TYPES.join(", ")}
+`;
+function getArg4(args, flag) {
+  const idx = args.indexOf(flag);
+  return idx !== -1 && idx + 1 < args.length ? args[idx + 1] : void 0;
+}
+function positionals(args) {
+  const out = [];
+  for (let i = 0; i < args.length; i++) {
+    if (args[i].startsWith("--")) i++;
+    else out.push(args[i]);
+  }
+  return out;
+}
+function indexLine(m) {
+  return `${m.name}  (${m.type}, ${m.updatedAt.slice(0, 10)})  ${m.description}`;
+}
+async function runMemoryCmd(args) {
+  loadEnvFiles();
+  const subcommand = args[0];
+  const rest = args.slice(1);
+  if (!subcommand || subcommand === "-h" || subcommand === "--help") {
+    console.log(USAGE5);
+    return;
+  }
+  const channelArg = getArg4(rest, "--channel");
+  if (!channelArg) throw new Error("--channel <name-or-id> is required");
+  const channel = await resolveChannel(channelArg, getArg4(rest, "--profile-name"));
+  const words = positionals(rest);
+  switch (subcommand) {
+    case "list": {
+      const memories = await listChannelMemories(channel.id);
+      console.log(memories.length ? memories.map(indexLine).join("\n") : "No memories yet.");
+      break;
+    }
+    case "get": {
+      const name = words[0];
+      if (!name) throw new Error("Usage: flyspace memory get --channel <c> <name>");
+      const memory = await getChannelMemory(channel.id, name);
+      if (!memory) throw new Error(`No memory named ${name} in ${channel.name}.`);
+      console.log(`# ${memory.name} (${memory.type})
+
+${memory.description}
+
+${memory.body}`);
+      break;
+    }
+    case "search": {
+      if (!words.length) throw new Error("Usage: flyspace memory search --channel <c> <words...>");
+      const hits = await searchChannelMemories(channel.id, words.join(" "));
+      console.log(hits.length ? hits.map(indexLine).join("\n") : "No matching memories.");
+      break;
+    }
+    case "save": {
+      const name = getArg4(rest, "--name");
+      const type = getArg4(rest, "--type");
+      const description = getArg4(rest, "--description");
+      const bodyArg = getArg4(rest, "--body");
+      if (!name || !type || !description || bodyArg === void 0) {
+        throw new Error(
+          "Usage: flyspace memory save --channel <c> --name <slug> --type <type> --description <one line> --body <text | -> [--thread <id>]"
+        );
+      }
+      if (!isMemoryType(type)) throw new Error(`--type must be one of ${MEMORY_TYPES.join(", ")}`);
+      const body = bodyArg === "-" ? readFileSync18(0, "utf-8") : bodyArg;
+      const thread = getArg4(rest, "--thread");
+      const { created, changed } = await saveChannelMemory(
+        {
+          channelId: channel.id,
+          name,
+          type,
+          description,
+          body,
+          createdBy: "agent",
+          ...thread ? { sourceThreadId: thread } : {}
+        },
+        "agent"
+      );
+      const verb = created ? "Saved" : changed ? "Updated" : "Unchanged:";
+      console.log(`${verb} memory ${name} in ${channel.name}.`);
+      break;
+    }
+    case "delete": {
+      const ref = words[0];
+      if (!ref) throw new Error("Usage: flyspace memory delete --channel <c> <name-or-id>");
+      const deleted = await deleteChannelMemory(channel.id, ref, "agent", getArg4(rest, "--thread"));
+      if (!deleted) throw new Error(`No memory ${ref} in ${channel.name}.`);
+      console.log(`Deleted memory ${ref}.`);
+      break;
+    }
+    default:
+      console.error(`Unknown subcommand: ${subcommand}`);
+      console.log(USAGE5);
       process.exit(1);
   }
 }
 
 // src/commands/mcp.ts
-var USAGE4 = `
+var USAGE6 = `
 Usage: flyspace mcp <server>
 
   Run one of Flyspace's own MCP servers on stdio. Spawned by the agent runtime
@@ -18291,7 +19061,7 @@ Usage: flyspace mcp <server>
 async function runMcpCmd(args) {
   const server = args[0];
   if (!server || server === "-h" || server === "--help") {
-    console.log(USAGE4.trim());
+    console.log(USAGE6.trim());
     return;
   }
   restoreStdout();
@@ -18304,7 +19074,7 @@ async function runMcpCmd(args) {
     }
     default:
       console.error(`Unknown MCP server: ${server}`);
-      console.error(USAGE4.trim());
+      console.error(USAGE6.trim());
       process.exit(1);
   }
 }
@@ -18380,7 +19150,7 @@ async function runDashboard(args) {
 
 // src/commands/workspace.ts
 import { existsSync as existsSync29, mkdirSync as mkdirSync11, writeFileSync as writeFileSync11 } from "fs";
-var USAGE5 = `
+var USAGE7 = `
   Usage: flyspace workspace <subcommand> [options]
 
   Subcommands:
@@ -18397,7 +19167,7 @@ var USAGE5 = `
     --no-invite               Never send an invite email. Fails if the admin
                               has no existing account.
 `;
-function getArg4(args, flag) {
+function getArg5(args, flag) {
   const idx = args.indexOf(flag);
   return idx !== -1 && idx + 1 < args.length ? args[idx + 1] : void 0;
 }
@@ -18459,7 +19229,7 @@ async function bindThisHost(workspaceId) {
     return;
   }
   await bindDeviceWorkspace(device.id, workspaceId, device.userId);
-  console.log(`  bound to Host "${device.name}" (restart it to pick up the new workspace)`);
+  console.log(`  bound to Host "${device.name}" (a running Host picks it up within a minute)`);
 }
 function provisionLocal(botName) {
   ensureDirs();
@@ -18493,10 +19263,10 @@ async function provisionChannels(specs) {
 async function handleCreate(args) {
   const slug = args[0];
   if (!slug || slug.startsWith("-")) fail2("Usage: flyspace workspace create <slug> --admin-email <email>");
-  const adminEmail = getArg4(args, "--admin-email");
+  const adminEmail = getArg5(args, "--admin-email");
   if (!adminEmail?.includes("@")) fail2("--admin-email is required and must be an email address");
-  const botName = getArg4(args, "--bot-name") ?? slug;
-  const baseDomain = getArg4(args, "--base-domain") ?? "flyspace.ai";
+  const botName = getArg5(args, "--bot-name") ?? slug;
+  const baseDomain = getArg5(args, "--base-domain") ?? "flyspace.ai";
   const allowInvite = !args.includes("--no-invite");
   const channels = getAllArgs(args, "--channel").map(parseChannelSpec);
   loadEnvFiles();
@@ -18519,13 +19289,13 @@ async function runWorkspaceCmd(args) {
       await handleCreate(args.slice(1));
       break;
     default:
-      console.log(USAGE5);
+      console.log(USAGE7);
       process.exit(args[0] ? 1 : 0);
   }
 }
 
 // src/commands/reconcile.ts
-var USAGE6 = `
+var USAGE8 = `
   Usage: flyspace reconcile [<workspace> | --all]
 
   Repair a workspace's local filesystem state (profile dir, config.env,
@@ -18545,7 +19315,7 @@ function printLog(name, log5) {
 }
 async function runReconcileCmd(args) {
   if (args.includes("-h") || args.includes("--help")) {
-    console.log(USAGE6);
+    console.log(USAGE8);
     return;
   }
   loadEnvFiles();
@@ -18561,12 +19331,13 @@ async function runReconcileCmd(args) {
 
 // src/cli.ts
 var XERO_USAGE = false ? "    xero         Connect to Xero and expose it as an MCP server\n" : "";
-var USAGE7 = `
+var USAGE9 = `
   Usage: flyspace <command> [options]
 
   Commands:
     setup        Set up this machine as a Host (login, agent CLIs, ~/Flyspace)
     auth         Log in, check status, or log out this device
+    doctor       Check this Host end to end (login, agent CLIs, services)
     start        Start the agent host (Slack only if configured)
     install      Install as a system service (launchd / systemd)
     uninstall    Remove the system service
@@ -18580,7 +19351,8 @@ var USAGE7 = `
     usage        Show agent token usage and cost for this workspace
     slack        Query Slack (channels, users, post messages)
     chat         Inspect dashboard chat channels and move threads between them
-    profiles     List instances and their service status
+    memory       Read and write a channel's persistent agent memory
+    profiles     List local profiles (bound here? scheduler?) or remove one
     workspace    Provision a workspace (Supabase rows + local profile dirs)
     reconcile    Repair a workspace's local files against Supabase
 ${XERO_USAGE}    dashboard    Start the read-only management dashboard (web UI)
@@ -18620,6 +19392,9 @@ async function main() {
     case "auth":
       await runAuthCmd(args.slice(1));
       break;
+    case "doctor":
+      await runDoctor(args.slice(1));
+      break;
     case "start":
       await runStart();
       break;
@@ -18668,8 +19443,12 @@ async function main() {
     case "chat":
       await runChatCmd(args.slice(1));
       break;
+    case "memory":
+      await runMemoryCmd(args.slice(1));
+      break;
+    case "profile":
     case "profiles":
-      await runProfiles();
+      await runProfiles(args.slice(1));
       break;
     case "dashboard":
       await runDashboard(args.slice(1));
@@ -18679,12 +19458,12 @@ async function main() {
       break;
     case "-v":
     case "--version":
-      printRaw("0.1.6");
+      printRaw("0.1.9");
       break;
     case "-h":
     case "--help":
     case void 0:
-      printRaw(USAGE7);
+      printRaw(USAGE9);
       break;
     case "xero":
       if (false) {
@@ -18695,7 +19474,7 @@ async function main() {
     // falls through
     default:
       printRaw(`Unknown command: ${command}`);
-      printRaw(USAGE7);
+      printRaw(USAGE9);
       process.exit(1);
   }
 }