flyspace-cli 0.1.7 → 0.1.10

package/dist/cli.js

@@ -52,6 +52,7 @@ import {
   expandPath,
   extractCategories,
   findChannel,
+  findChannelByAgentName,
   findChannelById,
   findSkillDetail,
   getAgentPaused,
@@ -106,6 +107,7 @@ import {
   mcpStrictConfigEnabled,
   mimetypeSizeLimit,
   modelLabel,
+  pinnedClaudeConfigDir,
   readSkillFile,
   recentRunsForWorkspace,
   refreshAutomationRegistry,
@@ -150,7 +152,7 @@ import {
   warnOnBrokenChannelCwds,
   workspaceSkillsDir,
   writeSkillFile
-} from "./chunk-BZYTXXF7.js";
+} from "./chunk-UYLVSUD6.js";
 import {
   firstReplyBody,
   getThread,
@@ -437,9 +439,23 @@ import { confirm as confirm2 } from "@inquirer/prompts";
 
 // src/service.ts
 import { execSync } from "child_process";
-import { existsSync as existsSync3 } from "fs";
-import { join as join2 } from "path";
+import { existsSync as existsSync3, readFileSync as readFileSync3, realpathSync } from "fs";
+import { basename, dirname as dirname2, join as join2 } from "path";
 import { homedir, platform } from "os";
+function flyspaceHome(entry = process.argv[1]) {
+  let cliPath;
+  try {
+    cliPath = realpathSync(entry ?? "");
+  } catch {
+    return void 0;
+  }
+  const at = cliPath.indexOf("/lib/node_modules/flyspace-cli/");
+  if (at <= 0) return void 0;
+  const npmPrefix = cliPath.slice(0, at);
+  if (basename(npmPrefix) !== "cli") return void 0;
+  const home = dirname2(npmPrefix);
+  return existsSync3(join2(home, "bin", "flyspace")) && existsSync3(join2(home, "node", "bin", "node")) ? home : void 0;
+}
 function serviceLabel(profile) {
   return profile === DEFAULT_PROFILE ? "ai.flyspace" : `ai.flyspace.${profile}`;
 }
@@ -466,6 +482,22 @@ function isServiceInstalled(profile) {
   if (platform() === "linux") return existsSync3(systemdUnitPath(profile));
   return false;
 }
+function serviceBinaryMissing(file) {
+  let text;
+  try {
+    text = readFileSync3(file, "utf-8");
+  } catch {
+    return false;
+  }
+  const bin = text.match(/<key>ProgramArguments<\/key>\s*<array>\s*<string>([^<]+)<\/string>/)?.[1] ?? text.match(/^ExecStart=(\S+)/m)?.[1];
+  return !!bin && !existsSync3(bin);
+}
+function profileServiceFile(profile) {
+  return platform() === "darwin" ? plistPath(profile) : systemdUnitPath(profile);
+}
+function hostServiceFile() {
+  return platform() === "darwin" ? hostPlistPath() : join2(homedir(), ".config", "systemd", "user", `${HOST_SYSTEMD_UNIT}.service`);
+}
 function restartService(profile) {
   const os = platform();
   if (os === "darwin") {
@@ -497,10 +529,7 @@ function hostPlistPath() {
   return join2(homedir(), "Library", "LaunchAgents", `${HOST_SERVICE_LABEL}.plist`);
 }
 function isHostServiceInstalled() {
-  if (platform() === "darwin") return existsSync3(hostPlistPath());
-  if (platform() === "linux") {
-    return existsSync3(join2(homedir(), ".config", "systemd", "user", `${HOST_SYSTEMD_UNIT}.service`));
-  }
+  if (platform() === "darwin" || platform() === "linux") return existsSync3(hostServiceFile());
   return false;
 }
 function restartHostService() {
@@ -518,11 +547,31 @@ function restartHostService() {
   }
   return false;
 }
+function serviceActive(label2, unit) {
+  try {
+    if (platform() === "darwin") {
+      const out = execSync(`launchctl print gui/${process.getuid?.()}/${label2}`, { encoding: "utf-8", stdio: "pipe" });
+      return /^\s*state = running$/m.test(out);
+    }
+    if (platform() === "linux") {
+      execSync(`systemctl --user is-active --quiet ${unit}`, { stdio: "pipe" });
+      return true;
+    }
+  } catch {
+  }
+  return false;
+}
+function isServiceRunning(profile) {
+  return serviceActive(serviceLabel(profile), systemdUnitName(profile));
+}
+function isHostServiceRunning() {
+  return serviceActive(HOST_SERVICE_LABEL, HOST_SYSTEMD_UNIT);
+}
 
 // src/commands/install.ts
-import { existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync3, unlinkSync } from "fs";
+import { existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync4, writeFileSync as writeFileSync3, unlinkSync } from "fs";
 import { execSync as execSync2 } from "child_process";
-import { dirname as dirname2, join as join3, resolve as resolve3 } from "path";
+import { dirname as dirname3, join as join3, resolve as resolve3 } from "path";
 import { homedir as homedir2, platform as platform2 } from "os";
 function log(msg) {
   console.log(`
@@ -543,12 +592,23 @@ function run(cmd, opts = {}) {
 function detectClaudeBinDir() {
   try {
     const claudePath = execSync2("which claude", { encoding: "utf-8", stdio: "pipe" }).trim();
-    return claudePath ? dirname2(claudePath) : void 0;
+    return claudePath ? dirname3(claudePath) : void 0;
   } catch {
     return void 0;
   }
 }
+function detectNodeBinDir() {
+  const home = flyspaceHome();
+  return home ? join3(home, "node", "bin") : dirname3(process.execPath);
+}
+function nodeShimDirs() {
+  return [join3(homedir2(), ".local", "share", "mise", "shims"), join3(homedir2(), ".asdf", "shims")].filter(
+    (d) => existsSync4(d)
+  );
+}
 function detectCustieBin() {
+  const home = flyspaceHome();
+  if (home) return join3(home, "bin", "flyspace");
   const argv1 = process.argv[1];
   if (argv1) {
     return resolve3(argv1);
@@ -562,7 +622,7 @@ function detectCustieBin() {
 function readEnvFile() {
   if (!existsSync4(paths.CONFIG_FILE)) return {};
   const vars = {};
-  for (const line of readFileSync3(paths.CONFIG_FILE, "utf-8").split("\n")) {
+  for (const line of readFileSync4(paths.CONFIG_FILE, "utf-8").split("\n")) {
     const trimmed = line.trim();
     if (!trimmed || trimmed.startsWith("#")) continue;
     const eq = trimmed.indexOf("=");
@@ -604,18 +664,15 @@ function hostSpec() {
 async function installMacOS(spec) {
   log("Setting up macOS LaunchAgent...");
   const custieBin = detectCustieBin();
-  const nodePath = process.execPath;
   const claudeBinDir = detectClaudeBinDir();
   const logDir = paths.LOG_DIR;
   mkdirSync2(logDir, { recursive: true });
   const envVars = spec.env;
   const homebrewBin = existsSync4("/opt/homebrew/bin") ? "/opt/homebrew/bin" : void 0;
-  const asdfShims = join3(homedir2(), ".asdf", "shims");
-  const asdfBin = existsSync4(asdfShims) ? asdfShims : void 0;
   const pathParts = [
-    dirname2(nodePath),
+    detectNodeBinDir(),
     claudeBinDir,
-    asdfBin,
+    ...nodeShimDirs(),
     homebrewBin,
     "/usr/local/bin",
     "/usr/bin",
@@ -657,7 +714,7 @@ ${Object.entries(envVars).map(([k, v]) => `    <key>${k}</key>
 </dict>
 </plist>`;
   const agentPlistPath = spec.plistPath;
-  mkdirSync2(dirname2(agentPlistPath), { recursive: true });
+  mkdirSync2(dirname3(agentPlistPath), { recursive: true });
   try {
     run(`launchctl unload "${agentPlistPath}"`, { silent: true });
   } catch {
@@ -675,15 +732,15 @@ ${Object.entries(envVars).map(([k, v]) => `    <key>${k}</key>
 async function installLinux(spec) {
   log("Setting up systemd user service...");
   const custieBin = detectCustieBin();
-  const nodePath = process.execPath;
   const claudeBinDir = detectClaudeBinDir();
   const logDir = paths.LOG_DIR;
   mkdirSync2(logDir, { recursive: true });
   const envLines = Object.entries(spec.env).map(([k, v]) => `Environment="${k}=${v}"`).join("\n");
   const linuxbrewBin = existsSync4("/home/linuxbrew/.linuxbrew/bin") ? "/home/linuxbrew/.linuxbrew/bin" : void 0;
   const pathParts = [
-    dirname2(nodePath),
+    detectNodeBinDir(),
     claudeBinDir,
+    ...nodeShimDirs(),
     linuxbrewBin,
     "/usr/local/bin",
     "/usr/bin",
@@ -757,7 +814,7 @@ function listProfiles() {
   }
   return profiles;
 }
-function isServiceRunning(profile) {
+function isServiceRunning2(profile) {
   try {
     if (platform3() === "darwin") {
       const out = execSync3("launchctl list", { encoding: "utf-8", stdio: "pipe" });
@@ -774,8 +831,8 @@ function isServiceRunning(profile) {
 
 // src/auth/device-auth.ts
 import { createPrivateKey, createPublicKey, generateKeyPairSync, sign } from "crypto";
-import { existsSync as existsSync6, mkdirSync as mkdirSync3, readFileSync as readFileSync4, rmSync as rmSync2, writeFileSync as writeFileSync4 } from "fs";
-import { dirname as dirname3, join as join5 } from "path";
+import { existsSync as existsSync6, mkdirSync as mkdirSync3, readFileSync as readFileSync5, rmSync as rmSync2, writeFileSync as writeFileSync4 } from "fs";
+import { dirname as dirname4, join as join5 } from "path";
 var DEFAULT_API_URL = "https://app.flyspace.ai";
 var EXPIRY_SKEW_MS = 6e4;
 var AuthApiError = class extends Error {
@@ -798,11 +855,11 @@ function ensureDeviceKey(path = deviceKeyPath()) {
   let created = false;
   if (!existsSync6(path)) {
     const { privateKey: privateKey2 } = generateKeyPairSync("ed25519");
-    mkdirSync3(dirname3(path), { recursive: true });
+    mkdirSync3(dirname4(path), { recursive: true });
     writeFileSync4(path, privateKey2.export({ type: "pkcs8", format: "pem" }), { mode: 384 });
     created = true;
   }
-  const privateKey = createPrivateKey(readFileSync4(path, "utf8"));
+  const privateKey = createPrivateKey(readFileSync5(path, "utf8"));
   const publicKeyBase64 = createPublicKey(privateKey).export({ type: "spki", format: "der" }).toString(
     "base64"
   );
@@ -811,13 +868,13 @@ function ensureDeviceKey(path = deviceKeyPath()) {
 function loadCredentials(path = credentialsPath()) {
   if (!existsSync6(path)) return null;
   try {
-    return JSON.parse(readFileSync4(path, "utf8"));
+    return JSON.parse(readFileSync5(path, "utf8"));
   } catch {
     return null;
   }
 }
 function saveCredentials(creds, path = credentialsPath()) {
-  mkdirSync3(dirname3(path), { recursive: true });
+  mkdirSync3(dirname4(path), { recursive: true });
   writeFileSync4(path, `${JSON.stringify(creds, null, 2)}
 `, { mode: 384 });
 }
@@ -957,12 +1014,12 @@ import {
   lstatSync,
   mkdirSync as mkdirSync4,
   readdirSync as readdirSync2,
-  readFileSync as readFileSync5,
+  readFileSync as readFileSync6,
   statSync as statSync2,
   symlinkSync
 } from "fs";
 import { homedir as homedir3 } from "os";
-import { basename, join as join6, resolve as resolve4 } from "path";
+import { basename as basename2, join as join6, resolve as resolve4 } from "path";
 var MAX_JSONL_HEAD_BYTES = 64 * 1024;
 var GIT_SCAN_ROOTS = ["Workspaces", "Projects", "code"];
 function flyspaceRoot() {
@@ -986,7 +1043,7 @@ function claudeLoggedIn() {
   if (process.env["ANTHROPIC_API_KEY"]) return true;
   if (existsSync7(join6(claudeDir(), ".credentials.json"))) return true;
   try {
-    const raw = JSON.parse(readFileSync5(join6(homedir3(), ".claude.json"), "utf-8"));
+    const raw = JSON.parse(readFileSync6(join6(homedir3(), ".claude.json"), "utf-8"));
     if (raw.oauthAccount) return true;
   } catch {
   }
@@ -1027,7 +1084,7 @@ function jsonlFiles(dir, depth) {
 function cwdFromTranscript(file) {
   let head;
   try {
-    head = readFileSync5(file, { encoding: "utf-8", flag: "r" }).slice(0, MAX_JSONL_HEAD_BYTES);
+    head = readFileSync6(file, { encoding: "utf-8", flag: "r" }).slice(0, MAX_JSONL_HEAD_BYTES);
   } catch {
     return null;
   }
@@ -1044,7 +1101,7 @@ function cwdFromTranscript(file) {
 }
 function codexTrustedPaths() {
   try {
-    const toml = readFileSync5(join6(codexDir(), "config.toml"), "utf-8");
+    const toml = readFileSync6(join6(codexDir(), "config.toml"), "utf-8");
     return [...toml.matchAll(/^\[projects\.(?:"([^"]+)"|'([^']+)')\]/gm)].map((m) => m[1] ?? m[2]);
   } catch {
     return [];
@@ -1111,7 +1168,7 @@ function scanOnboarding() {
     } else {
       byPath.set(path, {
         path,
-        name: basename(path),
+        name: basename2(path),
         sources: [source],
         lastUsed: mtime,
         sessions,
@@ -1514,7 +1571,7 @@ async function runAuthCmd(args) {
 }
 
 // src/version.ts
-var CLI_VERSION = true ? "0.1.7" : null;
+var CLI_VERSION = true ? "0.1.10" : null;
 function isOlderVersion(a, b) {
   const parse2 = (v) => v.replace(/^v/, "").split("-")[0].split(".").map(Number);
   const [pa, pb] = [parse2(a), parse2(b)];
@@ -1559,15 +1616,16 @@ async function servedWorkspaces() {
   return bound.workspaces;
 }
 function checkLatestVersion() {
-  if (!CLI_VERSION) return;
+  if (!CLI_VERSION) return true;
   let latest = "";
   try {
     latest = execSync4(`npm view ${"flyspace-cli"} version`, { encoding: "utf-8", stdio: "pipe", timeout: 1e4 }).trim();
   } catch {
-    return;
+    return true;
   }
-  if (!latest || !isOlderVersion(CLI_VERSION, latest)) return;
+  if (!latest || !isOlderVersion(CLI_VERSION, latest)) return true;
   bad(`flyspace ${CLI_VERSION} is out of date (latest ${latest})   ${DIM2}run: flyspace upgrade${RESET2}`);
+  return false;
 }
 function loginArgs(args) {
   const out = [];
@@ -1633,7 +1691,12 @@ ${BOLD2}Flyspace Setup${RESET2}
   }
   let hostRunning = false;
   if (args.includes("--start-host") && workspaces.length) {
-    if (!isHostServiceInstalled()) {
+    for (const slug of workspaces) {
+      if (!serviceBinaryMissing(profileServiceFile(slug))) continue;
+      await runWithProfile(slug, runInstall);
+      ok(`${slug} scheduler reinstalled on the new CLI path`);
+    }
+    if (!isHostServiceInstalled() || serviceBinaryMissing(hostServiceFile())) {
       hostRunning = await installHostService();
       if (hostRunning) ok(`Host running in the background   ${DIM2}logs: ${tilde2(paths.LOG_DIR)}/host.log${RESET2}`);
     } else {
@@ -1657,10 +1720,138 @@ ${BOLD2}Flyspace Setup${RESET2}
   if (!workspaces.length) process.exitCode = 1;
 }
 
+// src/commands/doctor.ts
+import { execFile } from "child_process";
+import { tmpdir } from "os";
+import { promisify } from "util";
+var execAsync = promisify(execFile);
+var exec = (cmd, args, opts) => {
+  const run3 = execAsync(cmd, args, opts);
+  run3.child.stdin?.end();
+  return run3;
+};
+var BOLD3 = "\x1B[1m";
+var DIM3 = "\x1B[2m";
+var GREEN3 = "\x1B[32m";
+var YELLOW3 = "\x1B[33m";
+var RESET3 = "\x1B[0m";
+var HELP3 = `
+  Usage: flyspace doctor
+
+  Checks this Host end to end: CLI version, server reachability, device login,
+  a live turn with each installed agent CLI, and the background services.
+  Exits non-zero when any check fails.
+`;
+var LOGIN_HINTS = {
+  claude: "claude auth login",
+  codex: "codex login"
+};
+var tilde3 = (p) => p.replace(process.env["HOME"] ?? "\0", "~");
+var failed = false;
+var ok2 = (msg) => console.log(`  ${GREEN3}\u2713${RESET3} ${msg}`);
+var bad2 = (msg, hint) => {
+  failed = true;
+  console.log(`  ${YELLOW3}\u2717${RESET3} ${msg}${hint ? `   ${DIM3}${hint}${RESET3}` : ""}`);
+};
+function errorLine(err) {
+  const e = err;
+  if (e.killed) return "timed out after 90s";
+  const lines = `${e.stdout ?? ""}
+${e.stderr ?? ""}`.split("\n").map((l) => l.trim()).filter(Boolean);
+  const last = (re) => [...lines].reverse().find((l) => re.test(l));
+  const line = last(/expired|unauthori[sz]ed|\b401\b|not logged in|authenticate/i) ?? last(/error|fail/i) ?? lines.at(-1) ?? e.message ?? "failed";
+  return line.length > 160 ? `${line.slice(0, 157)}...` : line;
+}
+async function probe(id) {
+  const env = { ...process.env };
+  const opts = { cwd: tmpdir(), timeout: 9e4, encoding: "utf-8" };
+  try {
+    if (id === "claude") {
+      const dir = pinnedClaudeConfigDir(process.env["CLAUDE_CONFIG_DIR"]);
+      if (dir) env["CLAUDE_CONFIG_DIR"] = dir;
+      else delete env["CLAUDE_CONFIG_DIR"];
+      await exec("claude", ["-p", "Reply with OK", "--model", "haiku", "--max-turns", "1"], { ...opts, env });
+    } else {
+      await exec("codex", ["exec", "--skip-git-repo-check", "-s", "read-only", "Reply with OK"], { ...opts, env });
+    }
+    return null;
+  } catch (err) {
+    return errorLine(err);
+  }
+}
+async function serverReachable() {
+  try {
+    const res = await fetch(`${apiUrl()}/api/health`, { signal: AbortSignal.timeout(1e4) });
+    return res.ok ? null : `HTTP ${res.status}`;
+  } catch (err) {
+    return err.cause ? String(err.cause) : err.message;
+  }
+}
+function checkService(name, installed, file, running, fix) {
+  if (!installed) bad2(`${name} not installed`, `run: ${fix}`);
+  else if (serviceBinaryMissing(file)) bad2(`${name} points at a CLI that no longer exists`, `run: ${fix}`);
+  else if (!running) bad2(`${name} not running`, `logs: ${tilde3(paths.LOG_DIR)}`);
+  else ok2(`${name} running`);
+}
+async function runDoctor(args) {
+  if (args.includes("-h") || args.includes("--help")) return void console.log(HELP3);
+  failed = false;
+  console.log(`
+${BOLD3}Flyspace Doctor${RESET3}
+`);
+  if (checkLatestVersion()) ok2(`flyspace ${CLI_VERSION || "(dev build)"}`);
+  else failed = true;
+  const serverError = await serverReachable();
+  if (serverError) bad2(`Can't reach ${apiUrl()}: ${serverError}`, "check the network or DNS");
+  else ok2(`Server ${apiUrl()} reachable`);
+  const creds = loadCredentials();
+  let workspaces = [];
+  if (!creds) {
+    bad2("This device is not logged in", "run: flyspace setup");
+  } else {
+    const bound = await boundWorkspaces();
+    workspaces = bound.workspaces;
+    ok2(`Logged in as ${creds.userEmail} (device ${creds.deviceName})`);
+    if (!bound.fresh) bad2("Couldn't refresh the device session; showing the workspaces saved at login");
+    if (workspaces.length) ok2(`Serving ${workspaces.join(", ")}`);
+    else bad2("Not serving any workspace", "a workspace admin has to add this Host");
+  }
+  const runners = detectRunners().filter((r) => r.installed);
+  if (!runners.length) bad2("Neither claude nor codex is installed", "npm install -g @anthropic-ai/claude-code");
+  const results = await Promise.all(runners.map((r) => probe(r.id)));
+  runners.forEach((r, i) => {
+    const error2 = results[i];
+    if (error2) bad2(`${r.id} can't run a turn: ${error2}`, `run: ${LOGIN_HINTS[r.id]}`);
+    else ok2(`${r.id} answered a test turn`);
+  });
+  if (workspaces.length) {
+    checkService(
+      "Host service",
+      isHostServiceInstalled(),
+      hostServiceFile(),
+      isHostServiceRunning(),
+      "flyspace setup --start-host"
+    );
+    for (const slug of workspaces) {
+      checkService(
+        `${slug} scheduler`,
+        isServiceInstalled(slug),
+        profileServiceFile(slug),
+        isServiceRunning(slug),
+        "flyspace setup --start-host"
+      );
+    }
+  }
+  console.log(failed ? "" : `
+  ${GREEN3}All good.${RESET3}
+`);
+  if (failed) process.exitCode = 1;
+}
+
 // src/commands/uninstall.ts
 import { existsSync as existsSync8, unlinkSync as unlinkSync2 } from "fs";
 import { execSync as execSync5 } from "child_process";
-import { basename as basename2, join as join8 } from "path";
+import { basename as basename3, join as join8 } from "path";
 import { homedir as homedir4, platform as platform5 } from "os";
 function log2(msg) {
   console.log(`
@@ -1689,7 +1880,7 @@ async function runUninstall() {
       }
       try {
         unlinkSync2(plist);
-        removed.push(basename2(plist));
+        removed.push(basename3(plist));
       } catch {
       }
     }
@@ -1722,7 +1913,6 @@ async function runUninstall() {
 
 // src/commands/profiles-cmd.ts
 import { rmSync as rmSync3 } from "fs";
-var OPERATOR_NOTE = "This machine is an operator Host (it has Supabase credentials), so it serves every workspace, bound or not.";
 var USAGE = `
   Usage: flyspace profiles [list]
          flyspace profiles remove <name>
@@ -1743,7 +1933,7 @@ async function listCmd() {
   console.log("\n  Profiles:\n");
   console.log(`    ${"NAME".padEnd(24)} ${"BOUND HERE".padEnd(12)} SCHEDULER`);
   for (const profile of listProfiles()) {
-    const scheduler = !isServiceInstalled(profile) ? "\x1B[90mnot installed\x1B[0m" : isServiceRunning(profile) ? "\x1B[32mrunning\x1B[0m" : "\x1B[90mstopped\x1B[0m";
+    const scheduler = !isServiceInstalled(profile) ? "\x1B[90mnot installed\x1B[0m" : isServiceRunning2(profile) ? "\x1B[32mrunning\x1B[0m" : "\x1B[90mstopped\x1B[0m";
     const here = bound === null ? "-".padEnd(12) : bound.includes(profile) ? "yes".padEnd(12) : `\x1B[33m${"no".padEnd(12)}\x1B[0m`;
     console.log(`    ${profile.padEnd(24)} ${here} ${scheduler}`);
   }
@@ -1752,10 +1942,7 @@ async function listCmd() {
   if (bound?.length === 0) {
     console.log("\n  This Host is not bound to any workspace, so no scheduler runs here. Run: flyspace setup");
   }
-  if (hasSupabaseCredentials()) {
-    console.log(`
-  ${OPERATOR_NOTE}`);
-  } else if (bound && listProfiles().some((p) => p !== DEFAULT_PROFILE && !bound.includes(p))) {
+  if (bound && listProfiles().some((p) => p !== DEFAULT_PROFILE && !bound.includes(p))) {
     console.log("\n  Profiles not bound here run nothing on this machine. Remove one with: flyspace profiles remove <name>");
   }
   console.log("");
@@ -1770,10 +1957,6 @@ async function removeCmd(name) {
     console.error(`  No local profile named "${name}".`);
     process.exit(1);
   }
-  if (hasSupabaseCredentials()) {
-    console.error(`  ${OPERATOR_NOTE} Removing a profile would stop that workspace's schedules.`);
-    process.exit(1);
-  }
   const bound = await boundHere();
   if (bound === null) {
     console.error("  This machine has no device login, so it serves every workspace; removing a profile would be undone.");
@@ -1803,6 +1986,8 @@ async function runProfiles(args = []) {
 
 // src/commands/upgrade.ts
 import { execSync as execSync6 } from "child_process";
+import { realpathSync as realpathSync2 } from "fs";
+import { join as join9 } from "path";
 function restartInstalledProfiles() {
   if (isHostServiceInstalled()) {
     console.log(restartHostService() ? "\nHost restarted." : "\nHost restart failed; run: flyspace setup --start-host --restart");
@@ -1822,19 +2007,34 @@ Restarting ${installed.length} instance(s)...`);
     }
   }
 }
+function npmInstallCommand() {
+  let prefix;
+  try {
+    const entry = realpathSync2(process.argv[1] ?? "");
+    const at = entry.indexOf(`/lib/node_modules/${"flyspace-cli"}/`);
+    if (at > 0) prefix = entry.slice(0, at);
+  } catch {
+  }
+  const global = `-g${prefix ? ` --prefix "${prefix}"` : ""}`;
+  return `npm install ${global} --ignore-scripts ${"flyspace-cli"}@latest && npm rebuild ${global} better-sqlite3`;
+}
+function npmEnv() {
+  const home = flyspaceHome();
+  return home ? { ...process.env, PATH: `${join9(home, "node", "bin")}:${process.env.PATH ?? ""}` } : process.env;
+}
 async function runUpgrade() {
-  const current = "0.1.7";
+  const current = "0.1.10";
   console.log(`Current version: ${current}`);
   console.log("Checking for updates...\n");
   try {
-    const latest = execSync6(`npm view ${"flyspace-cli"} version`, { encoding: "utf-8" }).trim();
+    const latest = execSync6(`npm view ${"flyspace-cli"} version`, { encoding: "utf-8", env: npmEnv() }).trim();
     if (latest === current) {
       console.log(`Already on the latest version (${current}).`);
       return;
     }
     console.log(`New version available: ${latest}`);
     console.log("Upgrading...\n");
-    execSync6(`npm install -g ${"flyspace-cli"}@latest`, { stdio: "inherit" });
+    execSync6(npmInstallCommand(), { stdio: "inherit", env: npmEnv() });
     console.log(`
 Upgraded from ${current} to ${latest}.`);
     restartInstalledProfiles();
@@ -1843,7 +2043,7 @@ Upgraded from ${current} to ${latest}.`);
   } catch (err) {
     console.error("Upgrade failed:", err.message);
     console.error(`
-You can upgrade manually with: npm install -g ${"flyspace-cli"}@latest`);
+You can upgrade manually with: ${npmInstallCommand()}`);
     process.exit(1);
   }
 }
@@ -2195,7 +2395,7 @@ async function runAutomationCmd(args) {
 
 // src/commands/usage.ts
 import { existsSync as existsSync9 } from "fs";
-var HELP3 = `
+var HELP4 = `
   Usage: flyspace usage [options]
 
   Show agent token usage and notional cost for this workspace.
@@ -2317,7 +2517,7 @@ function printExplanation(explained) {
 async function runUsage(args) {
   const parsed = parseArgs(args);
   if (parsed === "help") {
-    console.log(HELP3);
+    console.log(HELP4);
     return;
   }
   const { days, by, explain, json } = parsed;
@@ -2437,11 +2637,11 @@ async function runRestart() {
 // src/commands/logs.ts
 import { spawn as spawn4 } from "child_process";
 import { existsSync as existsSync10 } from "fs";
-import { join as join9 } from "path";
+import { join as join10 } from "path";
 async function runLogs(args) {
   const showErrors = args.includes("--error") || args.includes("-e");
   const filename = showErrors ? "custie-error.log" : "custie.log";
-  const logFile = join9(paths.LOG_DIR, filename);
+  const logFile = join10(paths.LOG_DIR, filename);
   if (!existsSync10(logFile)) {
     console.error(`Log file not found: ${logFile}`);
     console.error("Is the service installed? Run `flyspace install` first.");
@@ -2463,9 +2663,9 @@ async function runLogs(args) {
 
 // src/commands/slack.ts
 import { execFileSync as execFileSync4 } from "child_process";
-import { existsSync as existsSync27, readFileSync as readFileSync16, writeFileSync as writeFileSync10 } from "fs";
+import { existsSync as existsSync27, readFileSync as readFileSync17, writeFileSync as writeFileSync10 } from "fs";
 import { resolve as resolve7 } from "path";
-import { tmpdir as tmpdir3, homedir as homedir9 } from "os";
+import { tmpdir as tmpdir4, homedir as homedir9 } from "os";
 import { input, confirm as confirm3, select, checkbox } from "@inquirer/prompts";
 import { WebClient as WebClient3 } from "@slack/web-api";
 
@@ -2520,7 +2720,7 @@ async function emailForToken(token, type) {
 
 // src/dashboard/profile-config.ts
 import { homedir as homedir5 } from "os";
-import { join as join10 } from "path";
+import { join as join11 } from "path";
 
 // src/dashboard/profile-config-cache.ts
 var cache = /* @__PURE__ */ new Map();
@@ -2539,7 +2739,7 @@ function profileEnv(key) {
 function profileClaudeConfigDir() {
   const config = cachedProfileConfig();
   if (!config) return process.env["CLAUDE_CONFIG_DIR"] || void 0;
-  return config.env["CLAUDE_CONFIG_DIR"]?.trim() || join10(homedir5(), ".claude");
+  return config.env["CLAUDE_CONFIG_DIR"]?.trim() || join11(homedir5(), ".claude");
 }
 function profileOauthToken() {
   const env = cachedProfileConfig()?.env ?? {};
@@ -3993,8 +4193,8 @@ async function deliverPasswordResetLink(email, redirectTo) {
 // src/dashboard/server.ts
 import { existsSync as existsSync26 } from "fs";
 import { createServer } from "net";
-import { join as join22 } from "path";
-import { Hono as Hono32 } from "hono";
+import { join as join23 } from "path";
+import { Hono as Hono33 } from "hono";
 import { serve } from "@hono/node-server";
 import { serveStatic } from "@hono/node-server/serve-static";
 
@@ -4003,6 +4203,10 @@ import { existsSync as existsSync11, mkdirSync as mkdirSync6, writeFileSync as w
 async function boundWorkspaces2() {
   return (await boundWorkspaces())?.workspaces ?? null;
 }
+async function servedWorkspaces2() {
+  const bound = await boundWorkspaces2();
+  return new Set(bound ?? [...(await listWorkspaces()).map((w) => w.slug), ...listProfiles()]);
+}
 async function reconcileProfile(profile) {
   return runWithProfile(profile, async () => {
     const log5 = [];
@@ -4028,8 +4232,7 @@ async function reconcileProfile(profile) {
   });
 }
 async function reconcileAll() {
-  const bound = hasSupabaseCredentials() ? null : await boundWorkspaces2();
-  const slugs = new Set(bound ?? [...(await listWorkspaces()).map((w) => w.slug), ...listProfiles()]);
+  const slugs = await servedWorkspaces2();
   const results = /* @__PURE__ */ new Map();
   for (const slug of slugs) {
     try {
@@ -4042,8 +4245,7 @@ async function reconcileAll() {
   return results;
 }
 async function ensureServices() {
-  const bound = await boundWorkspaces2();
-  const slugs = new Set(bound ?? [...(await listWorkspaces()).map((w) => w.slug), ...listProfiles()]);
+  const slugs = await servedWorkspaces2();
   slugs.delete(DEFAULT_PROFILE);
   const installed = [];
   for (const slug of slugs) {
@@ -4192,11 +4394,11 @@ var requireDocsAccess = async (c, next) => {
 };
 
 // src/dashboard/api.ts
-import { Hono as Hono29 } from "hono";
+import { Hono as Hono30 } from "hono";
 
 // src/dashboard/public-share-routes.ts
-import { existsSync as existsSync12, readFileSync as readFileSync7, statSync as statSync3 } from "fs";
-import { join as join12 } from "path";
+import { existsSync as existsSync12, readFileSync as readFileSync8, statSync as statSync3 } from "fs";
+import { join as join13 } from "path";
 import { Hono as Hono3 } from "hono";
 import { GetObjectCommand } from "@aws-sdk/client-s3";
 import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
@@ -4336,15 +4538,15 @@ async function createDocShare(input2) {
   if (error2) throw new Error(`createDocShare(${input2.sourcePath}): ${error2.message}`);
   return rowToShare(data);
 }
-async function updateDocShareSnapshot(id, snapshot2, features) {
+async function updateDocShareSnapshot(id, snapshot3, features) {
   const { data, error: error2 } = await getSupabaseClient().from("doc_shares").update({
-    title: snapshot2.title,
-    content: snapshot2.content,
-    asset_keys: snapshot2.assetKeys,
+    title: snapshot3.title,
+    content: snapshot3.content,
+    asset_keys: snapshot3.assetKeys,
     // Re-detected with the snapshot: a re-publish can carry a rewritten
     // article, and one written in another language than last time is exactly
     // the case a stale value would get wrong.
-    source_lang: snapshot2.sourceLang,
+    source_lang: snapshot3.sourceLang,
     audio_enabled: features.audioEnabled,
     ask_enabled: features.askEnabled,
     social_enabled: features.socialEnabled,
@@ -4661,12 +4863,12 @@ function injectShareHead(html, head) {
 
 // src/dashboard/app-icon.ts
 import { createHash as createHash2 } from "crypto";
-import { readFileSync as readFileSync6 } from "fs";
-import { join as join11 } from "path";
+import { readFileSync as readFileSync7 } from "fs";
+import { join as join12 } from "path";
 import sharp from "sharp";
 var PLATE = "#0A0A0F";
-var MARK_FILE = join11(paths.PACKAGE_ROOT, "web", "public", "icons", "icon-512.png");
-var MARK_SVG_FILE = join11(paths.PACKAGE_ROOT, "web", "public", "favicon.svg");
+var MARK_FILE = join12(paths.PACKAGE_ROOT, "web", "public", "icons", "icon-512.png");
+var MARK_SVG_FILE = join12(paths.PACKAGE_ROOT, "web", "public", "favicon.svg");
 var LAYOUT = {
   standard: { logo: 0.7, logoCx: 0.5, logoCy: 0.48, badge: 0.27, badgeCx: 0.22, badgeCy: 0.76 },
   maskable: { logo: 0.56, logoCx: 0.5, logoCy: 0.48, badge: 0.23, badgeCx: 0.33, badgeCy: 0.66 }
@@ -4689,7 +4891,7 @@ function roundedPlate(size, fill = PLATE) {
 }
 async function renderBadge(box) {
   const transparent = { r: 0, g: 0, b: 0, alpha: 0 };
-  const raster = await sharp(readFileSync6(MARK_SVG_FILE)).resize(512, 512, { fit: "contain", background: transparent }).png().toBuffer();
+  const raster = await sharp(readFileSync7(MARK_SVG_FILE)).resize(512, 512, { fit: "contain", background: transparent }).png().toBuffer();
   return sharp(raster).trim().resize(box, box, { fit: "contain", background: transparent }).png().toBuffer();
 }
 async function sampleBackground(logo) {
@@ -4744,7 +4946,7 @@ async function renderAppIcon({
   if (hit) return hit;
   const out = logo && await composeIcon(logo, size, maskable, plain).catch(() => null) || // No workspace logo to lead with — the stock mark is still the best icon,
   // either on its usual dark plate or, for a favicon, trimmed and bare.
-  (transparent ? await renderBadge(size) : await sharp(readFileSync6(MARK_FILE)).resize(size, size, { fit: "cover" }).png().toBuffer());
+  (transparent ? await renderBadge(size) : await sharp(readFileSync7(MARK_FILE)).resize(size, size, { fit: "cover" }).png().toBuffer());
   cache3.set(key, out);
   return out;
 }
@@ -5962,7 +6164,7 @@ var shellCache = null;
 function readShell(path) {
   const { mtimeMs } = statSync3(path);
   if (shellCache?.mtimeMs === mtimeMs) return shellCache.html;
-  const html = readFileSync7(path, "utf8").replaceAll('"/assets/', `"${BUILD_PREFIX}/`);
+  const html = readFileSync8(path, "utf8").replaceAll('"/assets/', `"${BUILD_PREFIX}/`);
   shellCache = { mtimeMs, html };
   return html;
 }
@@ -5982,17 +6184,17 @@ function serveBuildFile(c, webDist, dir, name) {
   if (!type || !/^[A-Za-z0-9._-]+$/.test(name) || name.includes("..")) {
     return c.text("not found", 404);
   }
-  const path = join12(webDist, dir, name);
+  const path = join13(webDist, dir, name);
   if (!existsSync12(path)) return c.text("not found", 404);
   c.header("Content-Type", type);
   c.header("Cache-Control", "public, max-age=31536000, immutable");
   if (ext === ".css") {
-    return c.body(readFileSync7(path, "utf8").replaceAll("url(/fonts/", `url(${BUILD_PREFIX}/fonts/`));
+    return c.body(readFileSync8(path, "utf8").replaceAll("url(/fonts/", `url(${BUILD_PREFIX}/fonts/`));
   }
   if (ext === ".js") {
-    return c.body(readFileSync7(path, "utf8").replaceAll('"/assets/', `"${BUILD_PREFIX}/`));
+    return c.body(readFileSync8(path, "utf8").replaceAll('"/assets/', `"${BUILD_PREFIX}/`));
   }
-  return c.body(new Uint8Array(readFileSync7(path)));
+  return c.body(new Uint8Array(readFileSync8(path)));
 }
 var HTML_SHARE_CSP = "sandbox allow-scripts allow-forms allow-modals allow-popups allow-popups-to-escape-sandbox";
 function servePublishedHtml(c, share) {
@@ -6128,7 +6330,7 @@ ${analytics}` : head);
     const requested = c.req.param("lang");
     const lang = canonicalLanguage(requested);
     if (!isTranslatableLanguage(lang)) return next();
-    const shell = join12(webDist, "index.html");
+    const shell = join13(webDist, "index.html");
     if (!existsSync12(shell)) return next();
     const share = await getDocShare(c.req.param("id"));
     if (!share) return next();
@@ -6164,7 +6366,7 @@ ${analytics}` : head);
     const share = await getDocShare(c.req.param("id"));
     if (!share) return next();
     if (share.kind === "html") return servePublishedHtml(c, share);
-    const shell = join12(webDist, "index.html");
+    const shell = join13(webDist, "index.html");
     if (!existsSync12(shell)) return next();
     return readerPage(
       c,
@@ -6754,9 +6956,49 @@ function createAdminRouter() {
   return admin;
 }
 
+// src/dashboard/agent-identities.ts
+var BOT_LABEL = "Workspace Agent";
+var BOT_DM_KEY = "claude";
+async function resolveAgentIdentities() {
+  const settings = loadDashboardSettings();
+  const { cwd: defaultCwd } = resolveChannelConfig("");
+  const main2 = [
+    {
+      name: BOT_DM_KEY,
+      label: BOT_LABEL,
+      kind: "main",
+      cwd: defaultCwd,
+      model: settings.agentProfiles?.[BOT_DM_KEY]?.model,
+      ...await loadBotIdentity()
+    }
+  ];
+  return Promise.all(
+    main2.map(async ({ cwd, ...agent }) => {
+      const dm = await ensureAgentDmChannel(agent.name, {
+        name: agent.displayName ?? agent.label,
+        cwd
+      });
+      return { ...agent, channelId: dm.id };
+    })
+  );
+}
+async function offlineAgentIdentities() {
+  const dm = findChannelByAgentName(BOT_DM_KEY);
+  if (!dm) return [];
+  return [
+    {
+      name: BOT_DM_KEY,
+      label: BOT_LABEL,
+      kind: "main",
+      channelId: dm.id,
+      ...await loadBotIdentity()
+    }
+  ];
+}
+
 // src/dashboard/host-api.ts
-import { existsSync as existsSync21, readFileSync as readFileSync11, statSync as statSync8 } from "fs";
-import { join as join19 } from "path";
+import { existsSync as existsSync21, readFileSync as readFileSync12, statSync as statSync8 } from "fs";
+import { join as join20 } from "path";
 import sharp3 from "sharp";
 
 // src/dashboard/channels-routes.ts
@@ -6792,6 +7034,11 @@ var featureFlags = {
     title: "Dictation",
     description: "A mic button in the message composer that turns speech into text as you talk. Each phrase uses speech-to-text.",
     stage: "dev"
+  },
+  "agent-memory": {
+    title: "Agent memory",
+    description: "Channel memory the agent reads every turn, saved by the agent and picked up from idle threads, with a Memory tab and an undo chip. While on, Claude's built-in auto memory is switched off so the two can be compared; turning this off keeps every memory.",
+    stage: "beta"
   }
 };
 var featureFlagIds = Object.keys(featureFlags);
@@ -6817,6 +7064,11 @@ async function listEnabledFeatureFlags(workspaceId) {
   if (error2) throw new Error(`listEnabledFeatureFlags(${workspaceId}): ${error2.message}`);
   return (data ?? []).map((r) => r.flag_id);
 }
+async function listEnabledFeatureFlagsBySlug(slug) {
+  const { data, error: error2 } = await getSupabaseClient().from("workspaces").select("id").eq("slug", slug).maybeSingle();
+  if (error2) throw new Error(`listEnabledFeatureFlagsBySlug(${slug}): ${error2.message}`);
+  return data ? listEnabledFeatureFlags(data.id) : [];
+}
 async function enableFeatureFlag(workspaceId, flagId, userId) {
   const { error: error2 } = await getSupabaseClient().from("feature_flags").upsert(
     { workspace_id: workspaceId, flag_id: flagId, enabled_by: userId },
@@ -6994,8 +7246,8 @@ function createChannelWriteRouter() {
         (id, position) => supabase.from("channels").update({ position, updated_at: (/* @__PURE__ */ new Date()).toISOString() }).eq("id", id)
       )
     );
-    const failed = results.find((r) => r.error);
-    if (failed?.error) return c.json({ error: failed.error.message }, 500);
+    const failed2 = results.find((r) => r.error);
+    if (failed2?.error) return c.json({ error: failed2.error.message }, 500);
     await refreshChannelRegistry();
     return c.json({ ok: true });
   });
@@ -7053,20 +7305,20 @@ import {
   openSync,
   readSync,
   readdirSync as readdirSync4,
-  readFileSync as readFileSync10,
-  realpathSync,
+  readFileSync as readFileSync11,
+  realpathSync as realpathSync3,
   renameSync,
   rmSync as rmSync5,
   statSync as statSync5,
   writeFileSync as writeFileSync7
 } from "fs";
-import { basename as basename5, dirname as dirname4, extname, join as join17, relative, resolve as resolve5, sep } from "path";
+import { basename as basename6, dirname as dirname5, extname, join as join18, relative, resolve as resolve5, sep } from "path";
 import { Hono as Hono10 } from "hono";
 import { streamSSE } from "hono/streaming";
 
 // src/dashboard/docs-watcher.ts
 import { existsSync as existsSync14, watch } from "fs";
-import { basename as basename3, join as join13 } from "path";
+import { basename as basename4, join as join14 } from "path";
 var DEBOUNCE_MS = 200;
 var MAX_PENDING = 200;
 var IGNORED_SEGMENTS = /* @__PURE__ */ new Set([
@@ -7102,12 +7354,12 @@ function flush(cwd) {
 function watchDocs(cwd, listener) {
   let entry = entries.get(cwd);
   if (!entry) {
-    const root = basename3(cwd);
+    const root = basename4(cwd);
     const watcher = watch(cwd, { recursive: true, persistent: false }, (_event, filename) => {
       const current = entries.get(cwd);
       if (!current || filename === null) return;
       const rel = filename.split("\\").join("/");
-      if (rel === root && !existsSync14(join13(cwd, rel))) return;
+      if (rel === root && !existsSync14(join14(cwd, rel))) return;
       if (isIgnoredDocPath(rel)) return;
       if (current.pending.size < MAX_PENDING) current.pending.add(rel);
       if (current.timer === null) current.timer = setTimeout(() => flush(cwd), DEBOUNCE_MS);
@@ -7344,15 +7596,15 @@ async function readOrQueueDocAudio(input2) {
 }
 
 // src/dashboard/artifact-export.ts
-import { readFileSync as readFileSync9 } from "fs";
+import { readFileSync as readFileSync10 } from "fs";
 
 // src/dashboard/chat-agent.ts
 import { homedir as homedir7 } from "os";
 
 // src/mcp/config.ts
 import { mkdtempSync, rmSync as rmSync4, writeFileSync as writeFileSync6 } from "fs";
-import { tmpdir } from "os";
-import { join as join14 } from "path";
+import { tmpdir as tmpdir2 } from "os";
+import { join as join15 } from "path";
 
 // src/mcp/crypto.ts
 import { createCipheriv, createDecipheriv, randomBytes as randomBytes3, timingSafeEqual } from "crypto";
@@ -8038,8 +8290,8 @@ async function buildMcpConfig(profile, connectionIds) {
   return { config, skipped };
 }
 function writeMcpConfigFile(config) {
-  const dir = mkdtempSync(join14(tmpdir(), "flyspace-mcp-"));
-  const path = join14(dir, "mcp-config.json");
+  const dir = mkdtempSync(join15(tmpdir2(), "flyspace-mcp-"));
+  const path = join15(dir, "mcp-config.json");
   writeFileSync6(path, JSON.stringify(config), { mode: 384 });
   return {
     path,
@@ -8060,22 +8312,22 @@ async function withMcpConfig(profile, connectionIds, fn) {
 }
 
 // src/claude/agents.ts
-import { existsSync as existsSync15, readdirSync as readdirSync3, readFileSync as readFileSync8 } from "fs";
+import { existsSync as existsSync15, readdirSync as readdirSync3, readFileSync as readFileSync9 } from "fs";
 import { homedir as homedir6 } from "os";
-import { basename as basename4, join as join15 } from "path";
+import { basename as basename5, join as join16 } from "path";
 import yaml from "js-yaml";
 function defaultConfigDir() {
-  return join15(homedir6(), ".claude");
+  return join16(homedir6(), ".claude");
 }
 function expandHome(p) {
   if (p === "~") return homedir6();
-  if (p.startsWith("~/")) return join15(homedir6(), p.slice(2));
+  if (p.startsWith("~/")) return join16(homedir6(), p.slice(2));
   return p;
 }
 function parseFrontmatter(file) {
   let content;
   try {
-    content = readFileSync8(file, "utf-8");
+    content = readFileSync9(file, "utf-8");
   } catch {
     return {};
   }
@@ -8099,17 +8351,17 @@ function collectFrom(root, source) {
     return [];
   }
   return entries2.map((file) => {
-    const path = join15(root, file);
+    const path = join16(root, file);
     const fm = parseFrontmatter(path);
-    const name = fm.name?.trim() || basename4(file, ".md");
+    const name = fm.name?.trim() || basename5(file, ".md");
     return { name, description: (fm.description ?? "").trim(), source, path };
   });
 }
 function listAgents(configDir2, cwd) {
   const base = configDir2 ? expandHome(configDir2) : defaultConfigDir();
   const collected = [
-    ...collectFrom(join15(cwd, ".claude", "agents"), "project"),
-    ...collectFrom(join15(base, "agents"), "user")
+    ...collectFrom(join16(cwd, ".claude", "agents"), "project"),
+    ...collectFrom(join16(base, "agents"), "user")
   ];
   const byName = /* @__PURE__ */ new Map();
   for (const agent of collected) {
@@ -8121,16 +8373,241 @@ function readAgentPersona(configDir2, cwd, name) {
   const agent = listAgents(configDir2, cwd).find((a) => a.name === name);
   if (!agent) return void 0;
   try {
-    const content = readFileSync8(agent.path, "utf-8");
+    const content = readFileSync9(agent.path, "utf-8");
     return content.replace(/^---\r?\n[\s\S]*?\r?\n---\r?\n?/, "").trim();
   } catch {
     return void 0;
   }
 }
 
+// src/store/memory-store.ts
+var MEMORY_TYPES = ["preference", "decision", "fact", "reference"];
+var NAME_RE = /^[a-z0-9]+(-[a-z0-9]+)*$/;
+var DESCRIPTION_MAX = 200;
+var BODY_MAX = 4e3;
+var MEMORY_INDEX_MAX_CHARS = 8e3;
+function isMemoryType(value) {
+  return MEMORY_TYPES.includes(value);
+}
+function validateMemoryInput(input2) {
+  if (!NAME_RE.test(input2.name))
+    throw new Error("name must be a kebab-case slug, e.g. deploy-flow");
+  if (!isMemoryType(input2.type)) throw new Error(`type must be one of ${MEMORY_TYPES.join(", ")}`);
+  const description = input2.description.trim();
+  if (!description || description.includes("\n") || description.length > DESCRIPTION_MAX) {
+    throw new Error(`description must be one line of at most ${DESCRIPTION_MAX} characters`);
+  }
+  const body = input2.body.trim();
+  if (!body || body.length > BODY_MAX) {
+    throw new Error(`body must be 1 to ${BODY_MAX} characters`);
+  }
+}
+function rowToMemory(row) {
+  return {
+    id: row["id"],
+    channelId: row["channel_id"],
+    name: row["name"],
+    description: row["description"],
+    type: row["type"],
+    body: row["body"],
+    sourceThreadId: row["source_thread_id"] ?? null,
+    createdBy: row["created_by"],
+    createdAt: row["created_at"],
+    updatedAt: row["updated_at"]
+  };
+}
+async function listChannelMemories(channelId) {
+  const { data, error: error2 } = await getSupabaseClient().from("memories").select("*").eq("scope", "channel").eq("channel_id", channelId).order("updated_at", { ascending: false });
+  if (error2) throw new Error(`listChannelMemories(${channelId}): ${error2.message}`);
+  return (data ?? []).map(rowToMemory);
+}
+async function getChannelMemory(channelId, name) {
+  const { data, error: error2 } = await getSupabaseClient().from("memories").select("*").eq("scope", "channel").eq("channel_id", channelId).eq("name", name).maybeSingle();
+  if (error2) throw new Error(`getChannelMemory(${channelId}, ${name}): ${error2.message}`);
+  return data ? rowToMemory(data) : null;
+}
+async function saveChannelMemory(input2, actor) {
+  validateMemoryInput(input2);
+  const supabase = getSupabaseClient();
+  const existing = await getChannelMemory(input2.channelId, input2.name);
+  const fields = {
+    description: input2.description.trim(),
+    type: input2.type,
+    body: input2.body.trim(),
+    source_thread_id: input2.sourceThreadId ?? existing?.sourceThreadId ?? null,
+    created_by: input2.createdBy
+  };
+  if (existing && sameContent(existing, fields)) {
+    return { memory: existing, created: false, changed: false };
+  }
+  const { data, error: error2 } = existing ? await supabase.from("memories").update({ ...fields, updated_at: (/* @__PURE__ */ new Date()).toISOString() }).eq("id", existing.id).select("*").single() : await supabase.from("memories").insert({ ...fields, scope: "channel", channel_id: input2.channelId, name: input2.name }).select("*").single();
+  if (error2)
+    throw new Error(`saveChannelMemory(${input2.channelId}, ${input2.name}): ${error2.message}`);
+  const memory = rowToMemory(data);
+  await logMemoryEvent({
+    memory,
+    action: existing ? "update" : "create",
+    before: existing ? snapshot(existing) : null,
+    after: snapshot(memory),
+    actor,
+    threadId: input2.sourceThreadId ?? null
+  });
+  return { memory, created: !existing, changed: true };
+}
+async function updateChannelMemory(channelId, memoryId, patch, actor) {
+  const existing = (await listChannelMemories(channelId)).find((m) => m.id === memoryId);
+  if (!existing) return null;
+  const { memory } = await saveChannelMemory(
+    {
+      channelId,
+      name: existing.name,
+      description: patch.description ?? existing.description,
+      type: patch.type ?? existing.type,
+      body: patch.body ?? existing.body,
+      createdBy: existing.createdBy
+    },
+    actor
+  );
+  return memory;
+}
+async function searchChannelMemories(channelId, query) {
+  const words = query.replaceAll(/[,()*%\\]/g, " ").split(/\s+/).filter(Boolean);
+  if (!words.length) return [];
+  let request2 = getSupabaseClient().from("memories").select("*").eq("scope", "channel").eq("channel_id", channelId);
+  for (const word of words) {
+    request2 = request2.or(`name.ilike.*${word}*,description.ilike.*${word}*,body.ilike.*${word}*`);
+  }
+  const { data, error: error2 } = await request2.order("updated_at", { ascending: false }).limit(20);
+  if (error2) throw new Error(`searchChannelMemories(${channelId}): ${error2.message}`);
+  return (data ?? []).map(rowToMemory);
+}
+async function deleteChannelMemory(channelId, idOrName, actor, threadId) {
+  const { data, error: error2 } = await getSupabaseClient().from("memories").delete().eq("scope", "channel").eq("channel_id", channelId).eq(isUuid(idOrName) ? "id" : "name", idOrName).select("*");
+  if (error2) throw new Error(`deleteChannelMemory(${channelId}, ${idOrName}): ${error2.message}`);
+  const deleted = (data ?? []).map(rowToMemory);
+  for (const memory of deleted) {
+    await logMemoryEvent({
+      memory,
+      action: "delete",
+      before: snapshot(memory),
+      after: null,
+      actor,
+      threadId: threadId ?? null
+    });
+  }
+  return deleted.length > 0;
+}
+function snapshot(m) {
+  return {
+    description: m.description,
+    type: m.type,
+    body: m.body,
+    sourceThreadId: m.sourceThreadId,
+    createdBy: m.createdBy
+  };
+}
+function sameContent(m, other) {
+  return m.description === other.description && m.type === other.type && m.body === other.body;
+}
+async function logMemoryEvent(e) {
+  const { error: error2 } = await getSupabaseClient().from("memory_events").insert({
+    channel_id: e.memory.channelId,
+    memory_id: e.action === "delete" ? null : e.memory.id,
+    thread_id: e.threadId,
+    name: e.memory.name,
+    action: e.action,
+    before: e.before,
+    after: e.after,
+    actor: e.actor
+  });
+  if (error2) console.error(`[memory] event log failed for ${e.memory.name}:`, error2.message);
+}
+function rowToEvent(row) {
+  return {
+    id: row["id"],
+    channelId: row["channel_id"],
+    memoryId: row["memory_id"] ?? null,
+    threadId: row["thread_id"] ?? null,
+    name: row["name"],
+    action: row["action"],
+    before: row["before"] ?? null,
+    after: row["after"] ?? null,
+    actor: row["actor"],
+    createdAt: row["created_at"],
+    undoneAt: row["undone_at"] ?? null
+  };
+}
+async function listThreadMemoryEvents(channelId, threadId) {
+  const { data, error: error2 } = await getSupabaseClient().from("memory_events").select("*").eq("channel_id", channelId).eq("thread_id", threadId).order("created_at", { ascending: false }).limit(50);
+  if (error2) throw new Error(`listThreadMemoryEvents(${threadId}): ${error2.message}`);
+  return (data ?? []).map(rowToEvent);
+}
+async function undoMemoryEvent(channelId, eventId) {
+  const supabase = getSupabaseClient();
+  const { data, error: error2 } = await supabase.from("memory_events").select("*").eq("id", eventId).eq("channel_id", channelId).maybeSingle();
+  if (error2) throw new Error(`undoMemoryEvent(${eventId}): ${error2.message}`);
+  if (!data) return "not-found";
+  const event = rowToEvent(data);
+  if (event.undoneAt) return "already-undone";
+  const current = await getChannelMemory(channelId, event.name);
+  const unchangedSince = current && event.after ? sameContent(current, event.after) : !current && !event.after;
+  if (!unchangedSince) return "conflict";
+  const claimed = await supabase.from("memory_events").update({ undone_at: (/* @__PURE__ */ new Date()).toISOString() }).eq("id", eventId).is("undone_at", null).select("id");
+  if (claimed.error) throw new Error(`undoMemoryEvent(${eventId}): ${claimed.error.message}`);
+  if (!(claimed.data ?? []).length) return "already-undone";
+  const before = event.before;
+  const restore = before ? {
+    description: before.description,
+    type: before.type,
+    body: before.body,
+    source_thread_id: before.sourceThreadId,
+    created_by: before.createdBy
+  } : null;
+  const { error: writeError } = !restore ? await supabase.from("memories").delete().eq("id", current.id) : current ? await supabase.from("memories").update({ ...restore, updated_at: (/* @__PURE__ */ new Date()).toISOString() }).eq("id", current.id) : await supabase.from("memories").insert({ ...restore, scope: "channel", channel_id: channelId, name: event.name });
+  if (writeError) {
+    await supabase.from("memory_events").update({ undone_at: null }).eq("id", eventId);
+    throw new Error(`undoMemoryEvent(${eventId}): ${writeError.message}`);
+  }
+  return "undone";
+}
+function isUuid(value) {
+  return /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(value);
+}
+function formatMemoryPrompt(channelId, memories) {
+  const lines = [];
+  let used = 0;
+  let omitted = 0;
+  for (const m of memories) {
+    const line = `- \`${m.name}\` (${m.type}): ${m.description}`;
+    if (used + line.length > MEMORY_INDEX_MAX_CHARS) {
+      omitted++;
+      continue;
+    }
+    lines.push(line);
+    used += line.length + 1;
+  }
+  const index = lines.length ? lines.join("\n") + (omitted ? `
+- (${omitted} older memories not listed; find them with \`memory search\`)` : "") : "(none yet)";
+  return [
+    `## Channel memory`,
+    ``,
+    `This channel has a persistent memory shared by every thread in it and by every agent runner. Use it instead of any built-in memory directory of your own CLI.`,
+    ``,
+    `- Read a memory: \`flyspace memory get --channel ${channelId} <name>\``,
+    `- Search: \`flyspace memory search --channel ${channelId} <words>\``,
+    `- Save or overwrite: \`flyspace memory save --channel ${channelId} --name <kebab-slug> --type <${MEMORY_TYPES.join("|")}> --description "<one line>" --body "<text>" [--thread <thread-id>]\``,
+    `- Delete one that turned out wrong: \`flyspace memory delete --channel ${channelId} <name> [--thread <thread-id>]\``,
+    ``,
+    `Save when someone asks you to remember something, corrects you, or a decision is made that later threads will need. Save what is not derivable from the code, git history or docs: decisions and why, preferences, corrections, where external things live. Do not save one-off details of this conversation. Check the index first and update an existing memory rather than adding a near-duplicate. Write memories in English. Pass \`--thread\` with the thread id from the \`[context: ...]\` header, so the thread shows what changed and it can be undone there.`,
+    ``,
+    `Index:`,
+    index
+  ].join("\n");
+}
+
 // src/dashboard/rollover-summary.ts
 import { spawn as spawn5 } from "child_process";
-import { tmpdir as tmpdir2 } from "os";
+import { tmpdir as tmpdir3 } from "os";
 var HAIKU_MODEL = "haiku";
 var CJK_PATTERN = /[　-〿぀-ヿ㐀-䶿一-鿿豈-﫿＀-￯]/;
 function estimateTokens(text) {
@@ -8193,7 +8670,7 @@ function runHaikuPrint(input2, claudeConfigDir, claudeCodeOauthToken) {
       // A stateless rewrite touches no files — tmpdir keeps it that way and
       // avoids picking up an unrelated project's own CLAUDE.md/AGENTS.md,
       // unlike the channel's own cwd the main turn runs in.
-      cwd: tmpdir2(),
+      cwd: tmpdir3(),
       env,
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -8396,7 +8873,7 @@ ${recent.map((m) => `${m.author}: ${m.body}`).join("\n")}`;
 
 // src/dashboard/attachment-downloader.ts
 import { writeFile } from "fs/promises";
-import { join as join16 } from "path";
+import { join as join17 } from "path";
 import { GetObjectCommand as GetObjectCommand4 } from "@aws-sdk/client-s3";
 var debug = process.env["DEBUG"] === "true";
 var ATTACHMENT_LINK = /\]\(\/api\/attachments\/([^)?\s]+)(?:\?[^)\s]*)?\)/g;
@@ -8443,7 +8920,7 @@ async function downloadOne(key) {
     if (bytes.length > sizeLimit) {
       return { kind: "skip", skipped: { name, mimetype, reason: "too_large" } };
     }
-    const localPath = join16(paths.UPLOADS_DIR, lastSegment);
+    const localPath = join17(paths.UPLOADS_DIR, lastSegment);
     await writeFile(localPath, bytes);
     if (debug)
       console.log(`[attachment-downloader] saved ${key} -> ${localPath} (${bytes.length} bytes)`);
@@ -8989,6 +9466,18 @@ var ChatAgent = class {
       thread.channel_id
     );
     if (docsAccess && docsAccess !== "write") channelConfig = { ...channelConfig, docsAccess };
+    const agentMemory = await listEnabledFeatureFlagsBySlug(owningProfile).then((ids) => resolveFeatureFlags(ids, false)["agent-memory"]).catch((err) => {
+      console.error("[chat-agent] feature flag lookup failed:", err.message);
+      return false;
+    });
+    if (agentMemory) channelConfig = { ...channelConfig, disableAutoMemory: true };
+    if (agentMemory && docsAccess !== "none" && isUuid(thread.channel_id)) {
+      const memoryPrompt = await listChannelMemories(thread.channel_id).then((memories) => formatMemoryPrompt(thread.channel_id, memories)).catch((err) => {
+        console.error("[chat-agent] memory lookup failed:", err.message);
+        return void 0;
+      });
+      if (memoryPrompt) channelConfig = { ...channelConfig, memoryPrompt };
+    }
     const store = this.openSessionStore();
     try {
       const channelKey = `chat:${thread.channel_id}`;
@@ -9396,7 +9885,9 @@ ${msg.body}` : msg.body;
             signal,
             mcpConfigPath,
             ...usageContext ? { usageContext } : {},
-            ...channelConfig.docsAccess ? { docsAccess: channelConfig.docsAccess } : {}
+            ...channelConfig.docsAccess ? { docsAccess: channelConfig.docsAccess } : {},
+            ...channelConfig.memoryPrompt ? { memoryPrompt: channelConfig.memoryPrompt } : {},
+            ...channelConfig.disableAutoMemory ? { disableAutoMemory: true } : {}
           },
           channelConfig.claudeConfigDir,
           sessionId,
@@ -9433,6 +9924,7 @@ ${msg.body}` : msg.body;
               channelConfig.prompt,
               resolveSelectedOutputStyle(channelConfig.claudeConfigDir)?.body
             ),
+            channelConfig.memoryPrompt,
             docsAccessPromptNote(channelConfig.docsAccess)
           ].filter(Boolean).join("\n\n---\n\n"),
           // Codex has no per-tool deny list, so any restricted requester gets
@@ -9710,7 +10202,7 @@ async function exportDocAsArtifact(channelId, docPath) {
   );
   const abs = resolveDocPath(channelConfig.cwd, docPath);
   if (!abs) throw new Error(`doc not found: ${docPath}`);
-  const content = readFileSync9(abs, "utf8");
+  const content = readFileSync10(abs, "utf8");
   const title = extractTitle(abs, "md");
   const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
   const prompt = `Publish the document at \`${docPath}\` (already read below) as a Claude Artifact, then record the result as a stub file under this channel's \`docs/artifacts/\` folder (create the folder if it doesn't exist).
@@ -9925,9 +10417,9 @@ function readHead(absPath) {
   }
 }
 function extractTitle(absPath, kind) {
-  if (kind === "url" || kind === "excalidraw") return basename5(absPath);
+  if (kind === "url" || kind === "excalidraw") return basename6(absPath);
   const head = readHead(absPath);
-  if (!head) return basename5(absPath);
+  if (!head) return basename6(absPath);
   if (kind === "md") {
     const m = head.match(/^#{1,3}\s+(.+?)\s*$/m);
     if (m) return m[1].replace(/[*_`]/g, "").trim();
@@ -9935,7 +10427,7 @@ function extractTitle(absPath, kind) {
     const t = head.match(/<title[^>]*>([^<]+)<\/title>/i) ?? head.match(/<h1[^>]*>([^<]+)<\/h1>/i);
     if (t) return t[1].trim();
   }
-  return basename5(absPath);
+  return basename6(absPath);
 }
 function resolveDirPath(root, rel) {
   if (rel.includes("\0")) return null;
@@ -9967,7 +10459,7 @@ function probeDir(absDir, showHidden) {
         return false;
       }
       if (!showHidden && entry.name.startsWith(".")) continue;
-      const abs = join17(dir, entry.name);
+      const abs = join18(dir, entry.name);
       const kind = entryKind(entry, abs);
       if (kind === "dir") {
         if (SKIP_DIRS.has(entry.name)) hasOther = true;
@@ -9987,14 +10479,14 @@ function probeDir(absDir, showHidden) {
 }
 function readGitBranch(dir) {
   try {
-    let gitDir = join17(dir, ".git");
+    let gitDir = join18(dir, ".git");
     if (statSync5(gitDir).isFile()) {
-      const pointer = readFileSync10(gitDir, "utf8").trim();
+      const pointer = readFileSync11(gitDir, "utf8").trim();
       const match = pointer.match(/^gitdir:\s*(.+)$/);
       if (!match) return void 0;
       gitDir = resolve5(dir, match[1]);
     }
-    const head = readFileSync10(join17(gitDir, "HEAD"), "utf8").trim();
+    const head = readFileSync11(join18(gitDir, "HEAD"), "utf8").trim();
     const branchMatch = head.match(/^ref:\s*refs\/heads\/(.+)$/);
     if (branchMatch) return branchMatch[1];
     return /^[0-9a-f]{7,40}$/i.test(head) ? head.slice(0, 7) : void 0;
@@ -10016,14 +10508,14 @@ function listDocLevel(root, relDir = "", sort = "newest", showHidden = false) {
   for (const entry of entries2) {
     if (dirs.length + docs.length >= MAX_ENTRIES) break;
     if (!showHidden && entry.name.startsWith(".")) continue;
-    const abs = join17(absDir, entry.name);
+    const abs = join18(absDir, entry.name);
     const path = relative(root, abs).split(sep).join("/");
     const kind = entryKind(entry, abs);
     if (kind === "dir") {
       if (SKIP_DIRS.has(entry.name)) continue;
-      const probe2 = probeDir(abs, showHidden);
-      if (!probe2.hasDocs && probe2.hasOther) continue;
-      const isRepo = existsSync17(join17(abs, ".git"));
+      const probe3 = probeDir(abs, showHidden);
+      if (!probe3.hasDocs && probe3.hasOther) continue;
+      const isRepo = existsSync17(join18(abs, ".git"));
       dirs.push({
         path,
         name: entry.name,
@@ -10059,7 +10551,7 @@ function flatDocs(root, {
     for (const entry of entries2) {
       if (hits.length >= MAX_FLAT_DOCS) return;
       if (!showHidden && entry.name.startsWith(".")) continue;
-      const abs = join17(dir, entry.name);
+      const abs = join18(dir, entry.name);
       const kind = entryKind(entry, abs);
       if (kind === "dir") {
         if (!SKIP_DIRS.has(entry.name)) walk(abs, depth + 1);
@@ -10123,7 +10615,7 @@ function resolveDownloadPath(root, rel) {
   if (!rel || rel.includes("\0")) return null;
   const abs = resolve5(root, rel);
   if (abs !== root && !abs.startsWith(root + sep)) return null;
-  if (!isListableFile(basename5(abs))) return null;
+  if (!isListableFile(basename6(abs))) return null;
   const contentType = MEDIA_EXTENSIONS[extname(abs).toLowerCase()] ?? "application/octet-stream";
   return { abs, contentType };
 }
@@ -10139,7 +10631,7 @@ function uniqueName(absDir, name) {
   let candidate = name;
   for (let n = 1; n < 1e3; n++) {
     try {
-      statSync5(join17(absDir, candidate));
+      statSync5(join18(absDir, candidate));
     } catch {
       return candidate;
     }
@@ -10161,7 +10653,7 @@ function saveUploadedFile(root, relDir, name, data) {
   if (!(ext in DOC_EXTENSIONS) && !ASSET_LIST_EXTENSIONS.has(ext)) return { status: "bad-type" };
   if (data.byteLength > MAX_UPLOAD_BYTES) return { status: "too-large" };
   const final = uniqueName(absDir, safe);
-  const abs = join17(absDir, final);
+  const abs = join18(absDir, final);
   writeFileSync7(abs, data);
   return { status: "ok", path: relative(root, abs).split(sep).join("/"), name: final };
 }
@@ -10175,7 +10667,7 @@ function createDocFolder(root, relDir, name) {
   }
   const safe = sanitizeUploadName(name);
   if (!safe) return { status: "bad-name" };
-  const abs = join17(absDir, safe);
+  const abs = join18(absDir, safe);
   try {
     statSync5(abs);
     return { status: "exists" };
@@ -10198,7 +10690,7 @@ function createDocFile(root, relDir, name, content) {
   if (!(ext in DOC_EXTENSIONS) && !(ext in CODE_EXTENSIONS)) return { status: "bad-name" };
   if (SKIP_FILES.has(safe)) return { status: "bad-name" };
   if (Buffer.byteLength(content, "utf8") > MAX_CONTENT_BYTES) return { status: "too-large" };
-  const abs = join17(absDir, safe);
+  const abs = join18(absDir, safe);
   try {
     writeFileSync7(abs, content, { encoding: "utf8", flag: "wx" });
   } catch (err) {
@@ -10221,7 +10713,7 @@ function moveDocEntry(root, from, to) {
   if (!isDir2 && !stat.isFile()) return { status: "not-found" };
   const absTo = resolve5(root, to);
   if (!absTo.startsWith(root + sep)) return { status: "bad-target" };
-  const name = sanitizeUploadName(basename5(absTo));
+  const name = sanitizeUploadName(basename6(absTo));
   if (!name) return { status: "bad-target" };
   if (!isDir2) {
     const ext = extname(name).toLowerCase();
@@ -10229,19 +10721,19 @@ function moveDocEntry(root, from, to) {
       return { status: "bad-target" };
     }
   }
-  const absToDir = dirname4(absTo);
+  const absToDir = dirname5(absTo);
   if (resolveDirPath(root, relative(root, absToDir)) === null) return { status: "bad-target" };
   try {
     if (!statSync5(absToDir).isDirectory()) return { status: "bad-target" };
   } catch {
     return { status: "bad-target" };
   }
-  const finalAbs = join17(absToDir, name);
+  const finalAbs = join18(absToDir, name);
   if (isDir2 && (finalAbs === absFrom || finalAbs.startsWith(absFrom + sep))) {
     return { status: "into-self" };
   }
   try {
-    if (realpathSync(finalAbs) !== realpathSync(absFrom)) return { status: "exists" };
+    if (realpathSync3(finalAbs) !== realpathSync3(absFrom)) return { status: "exists" };
   } catch {
   }
   renameSync(absFrom, finalAbs);
@@ -10298,10 +10790,10 @@ function createDocsRouter() {
     }
     if (!stat.isFile()) return c.json({ error: "not found" }, 404);
     if (stat.size > MAX_RAW_BYTES) return c.json({ error: "file too large" }, 413);
-    const data = readFileSync10(resolved2.abs);
+    const data = readFileSync11(resolved2.abs);
     const headers = { "Content-Type": resolved2.contentType };
     if (download) {
-      const filename = basename5(resolved2.abs).replace(/"/g, "");
+      const filename = basename6(resolved2.abs).replace(/"/g, "");
       headers["Content-Disposition"] = `attachment; filename="${filename}"`;
     }
     return c.body(new Uint8Array(data), 200, headers);
@@ -10318,7 +10810,7 @@ function createDocsRouter() {
     }
     if (!stat.isFile()) return c.json({ error: "not found" }, 404);
     if (stat.size > MAX_RAW_BYTES) return c.json({ error: "file too large" }, 413);
-    return c.body(new Uint8Array(readFileSync10(abs)), 200, {
+    return c.body(new Uint8Array(readFileSync11(abs)), 200, {
       "Content-Type": "text/html; charset=utf-8",
       "Content-Security-Policy": HTML_SHARE_CSP,
       "X-Content-Type-Options": "nosniff",
@@ -10334,10 +10826,10 @@ function createDocsRouter() {
     const files = form.getAll("file").filter((f) => f instanceof File);
     if (files.length === 0) return c.json({ error: "missing file" }, 400);
     const uploaded = [];
-    const failed = [];
+    const failed2 = [];
     for (const file of files) {
       if (file.size > MAX_UPLOAD_BYTES) {
-        failed.push({
+        failed2.push({
           name: file.name,
           error: `larger than ${MAX_UPLOAD_BYTES / (1024 * 1024)}MB`
         });
@@ -10351,16 +10843,16 @@ function createDocsRouter() {
         case "no-dir":
           return c.json({ error: "folder not found" }, 404);
         case "bad-type":
-          failed.push({ name: file.name, error: "file type not allowed" });
+          failed2.push({ name: file.name, error: "file type not allowed" });
           break;
         case "too-large":
-          failed.push({ name: file.name, error: "file too large" });
+          failed2.push({ name: file.name, error: "file too large" });
           break;
         default:
-          failed.push({ name: file.name, error: "invalid filename" });
+          failed2.push({ name: file.name, error: "invalid filename" });
       }
     }
-    return c.json({ path: dir, uploaded, failed }, uploaded.length > 0 ? 201 : 400);
+    return c.json({ path: dir, uploaded, failed: failed2 }, uploaded.length > 0 ? 201 : 400);
   });
   app.post("/:id/docs/folder", async (c) => {
     const { cwd } = resolveChannelConfig(c.req.param("id"));
@@ -10500,10 +10992,10 @@ function createDocsRouter() {
       // by; only docs get a parsed title.
       kind: kind ?? "code",
       lang: kind ? void 0 : CODE_EXTENSIONS[ext],
-      title: kind ? extractTitle(abs, kind) : basename5(abs),
+      title: kind ? extractTitle(abs, kind) : basename6(abs),
       mtime: stat.mtime.toISOString(),
       tooLarge: tooLarge || void 0,
-      content: tooLarge ? "" : readFileSync10(abs, "utf8")
+      content: tooLarge ? "" : readFileSync11(abs, "utf8")
     });
   });
   app.put("/:id/docs/content", async (c) => {
@@ -10546,7 +11038,7 @@ function createDocsRouter() {
       channel,
       rel,
       title: extractTitle(abs, "md"),
-      content: readFileSync10(abs, "utf8")
+      content: readFileSync11(abs, "utf8")
     };
   };
   app.get("/:id/docs/translation/:lang", async (c) => {
@@ -10743,7 +11235,7 @@ function relay(agent, pathOf) {
 
 // src/dashboard/skills-routes.ts
 import { existsSync as existsSync19, statSync as statSync7 } from "fs";
-import { dirname as dirname5 } from "path";
+import { dirname as dirname6 } from "path";
 import { Hono as Hono12 } from "hono";
 
 // src/dashboard/skill-mirror.ts
@@ -10769,7 +11261,7 @@ function ownSkills(scope, dir) {
     return [{ scope, name, description, body, path, plugin: null, mtime }];
   });
 }
-function snapshot(scopes) {
+function snapshot2(scopes) {
   const wants = (scope) => !scopes || scopes.has(scope);
   const configDir2 = profileClaudeConfigDir();
   const rows = [];
@@ -10804,7 +11296,7 @@ async function pushSkillScopes(scopes) {
   if (!mirrorEnabled()) return;
   const workspace = getProfile();
   const supabase = getSupabaseClient();
-  const rows = snapshot(scopes ? new Set(scopes) : void 0);
+  const rows = snapshot2(scopes ? new Set(scopes) : void 0);
   let query = supabase.from("skill_files").select("scope, name, hash").eq("workspace", workspace);
   if (scopes) query = query.in("scope", scopes);
   const { data, error: error2 } = await query;
@@ -10868,7 +11360,7 @@ function workspaceScope() {
   return {
     dir: workspaceSkillsDir(claudeConfigDir),
     // `~/.claude` itself, which exists wherever the CLI has ever run.
-    root: dirname5(workspaceSkillsDir(claudeConfigDir)),
+    root: dirname6(workspaceSkillsDir(claudeConfigDir)),
     cwd,
     claudeConfigDir,
     // Only plugin skills. Project skills belong to a specific channel's cwd, so
@@ -10998,7 +11490,7 @@ function mirrorBackend(agent) {
         }
       }
       return {
-        dir: own[0] ? dirname5(dirname5(own[0].path)) : "",
+        dir: own[0] ? dirname6(dirname6(own[0].path)) : "",
         skills: own.map(({ name, description, mtime }) => ({ name, description, mtime })),
         inherited: inherited.sort(byName)
       };
@@ -11084,37 +11576,11 @@ function registerMirroredSkillRoutes(api, agent) {
   mountSkillRoutes(api, "/channels/:id/skill-files", channelRef, backend);
 }
 
-// src/dashboard/agent-identities.ts
-var BOT_DM_KEY = "claude";
-async function resolveAgentIdentities() {
-  const settings = loadDashboardSettings();
-  const { cwd: defaultCwd } = resolveChannelConfig("");
-  const main2 = [
-    {
-      name: BOT_DM_KEY,
-      label: "Workspace Agent",
-      kind: "main",
-      cwd: defaultCwd,
-      model: settings.agentProfiles?.[BOT_DM_KEY]?.model,
-      ...await loadBotIdentity()
-    }
-  ];
-  return Promise.all(
-    main2.map(async ({ cwd, ...agent }) => {
-      const dm = await ensureAgentDmChannel(agent.name, {
-        name: agent.displayName ?? agent.label,
-        cwd
-      });
-      return { ...agent, channelId: dm.id };
-    })
-  );
-}
-
 // src/dashboard/providers.ts
 import { execFileSync as execFileSync2 } from "child_process";
 import { existsSync as existsSync20 } from "fs";
 import { homedir as homedir8 } from "os";
-import { join as join18, resolve as resolve6 } from "path";
+import { join as join19, resolve as resolve6 } from "path";
 var PROVIDER_LABELS = {
   claude: "Claude Code",
   codex: "Codex"
@@ -11132,7 +11598,7 @@ function binaryOnPath(bin) {
 function claudeAuthAvailable() {
   if (profileEnv("CLAUDE_CODE_OAUTH_TOKEN")?.trim()) return true;
   const configDir2 = profileClaudeConfigDir() || resolve6(homedir8(), ".claude");
-  if (existsSync20(join18(configDir2, ".credentials.json"))) return true;
+  if (existsSync20(join19(configDir2, ".credentials.json"))) return true;
   if (process.platform !== "darwin") return false;
   try {
     execFileSync2("security", ["find-generic-password", "-s", "Claude Code-credentials"], {
@@ -11143,7 +11609,7 @@ function claudeAuthAvailable() {
     return false;
   }
 }
-function probe(runner) {
+function probe2(runner) {
   const label2 = PROVIDER_LABELS[runner];
   const bin = runner === "codex" ? "codex" : "claude";
   if (!binaryOnPath(bin)) {
@@ -11164,7 +11630,7 @@ function providerStatuses() {
   const key = getProfile();
   const hit = cache6.get(key);
   if (hit && Date.now() - hit.at < TTL_MS2) return hit.statuses;
-  const statuses = ["claude", "codex"].map(probe);
+  const statuses = ["claude", "codex"].map(probe2);
   cache6.set(key, { at: Date.now(), statuses });
   return statuses;
 }
@@ -11275,7 +11741,7 @@ function registerHostRoutes(api) {
     const errors = c.req.query("error") === "true" || c.req.query("error") === "1";
     const limit = Math.min(Number(c.req.query("limit")) || 200, 2e3);
     const filename = errors ? "custie-error.log" : "custie.log";
-    const file = join19(paths.LOG_DIR, filename);
+    const file = join20(paths.LOG_DIR, filename);
     const exists = existsSync21(file);
     return c.json({
       file,
@@ -11287,7 +11753,7 @@ function registerHostRoutes(api) {
 }
 function tailFile(file, limit) {
   if (!existsSync21(file)) return [];
-  const lines = readFileSync11(file, "utf-8").split("\n");
+  const lines = readFileSync12(file, "utf-8").split("\n");
   if (lines.at(-1) === "") lines.pop();
   return lines.slice(-limit);
 }
@@ -11399,8 +11865,8 @@ function createCategoryWriteRouter() {
         (id, position) => supabase.from("categories").update({ position, updated_at: (/* @__PURE__ */ new Date()).toISOString() }).eq("id", id).eq("profile", getProfile())
       )
     );
-    const failed = results.find((r) => r.error);
-    if (failed?.error) return c.json({ error: failed.error.message }, 500);
+    const failed2 = results.find((r) => r.error);
+    if (failed2?.error) return c.json({ error: failed2.error.message }, 500);
     return c.json({ ok: true });
   });
   app.put("/:id", async (c) => {
@@ -14354,8 +14820,86 @@ function createChannelMembersRouter() {
   return router;
 }
 
-// src/dashboard/onboarding-routes.ts
+// src/dashboard/memories-routes.ts
 import { Hono as Hono27 } from "hono";
+var requireChannelVisible = async (c, next) => {
+  const channel = findChannel(c.req.param("id"));
+  if (!channel || !canSeeChannel(channel, c.get("auth"))) {
+    return c.json({ error: "channel not found" }, 404);
+  }
+  c.set("memoryChannelId", channel.id);
+  await next();
+};
+var requireAgentMemory = async (c, next) => {
+  if (!await isFeatureEnabled(c, "agent-memory")) {
+    return c.json({ error: "feature not enabled" }, 403);
+  }
+  await next();
+};
+function createMemoriesRouter() {
+  const router = new Hono27();
+  for (const path of [
+    "/:id/memories",
+    "/:id/memories/*",
+    "/:id/memory-events",
+    "/:id/memory-events/*"
+  ]) {
+    router.use(path, requireAgentMemory, requireChannelVisible, requireDocsAccess);
+  }
+  router.get("/:id/memories", async (c) => {
+    return c.json({ memories: await listChannelMemories(c.get("memoryChannelId")) });
+  });
+  router.patch("/:id/memories/:memoryId", async (c) => {
+    const memoryId = c.req.param("memoryId");
+    if (!isUuid(memoryId)) return c.json({ error: "invalid memory id" }, 400);
+    const body = await c.req.json().catch(() => ({}));
+    const patch = {};
+    if (typeof body["description"] === "string") patch.description = body["description"];
+    if (typeof body["body"] === "string") patch.body = body["body"];
+    const type = body["type"];
+    if (type !== void 0) {
+      if (!isMemoryType(type)) return c.json({ error: "invalid type" }, 400);
+      patch.type = type;
+    }
+    try {
+      const memory = await updateChannelMemory(c.get("memoryChannelId"), memoryId, patch, "user");
+      if (!memory) return c.json({ error: "memory not found" }, 404);
+      return c.json({ memory });
+    } catch (err) {
+      return c.json({ error: err.message }, 400);
+    }
+  });
+  router.delete("/:id/memories/:memoryId", async (c) => {
+    const memoryId = c.req.param("memoryId");
+    if (!isUuid(memoryId)) return c.json({ error: "invalid memory id" }, 400);
+    const deleted = await deleteChannelMemory(c.get("memoryChannelId"), memoryId, "user");
+    if (!deleted) return c.json({ error: "memory not found" }, 404);
+    return c.json({ ok: true });
+  });
+  router.get("/:id/memory-events", async (c) => {
+    const threadId = c.req.query("thread") ?? "";
+    if (!isUuid(threadId)) return c.json({ error: "thread query parameter required" }, 400);
+    return c.json({ events: await listThreadMemoryEvents(c.get("memoryChannelId"), threadId) });
+  });
+  router.post("/:id/memory-events/:eventId/undo", async (c) => {
+    const eventId = c.req.param("eventId");
+    if (!isUuid(eventId)) return c.json({ error: "invalid event id" }, 400);
+    const result = await undoMemoryEvent(c.get("memoryChannelId"), eventId);
+    if (result === "not-found") return c.json({ error: "event not found" }, 404);
+    if (result === "already-undone") return c.json({ error: "already undone" }, 409);
+    if (result === "conflict") {
+      return c.json(
+        { error: "The memory has changed since, so this can no longer be undone." },
+        409
+      );
+    }
+    return c.json({ ok: true });
+  });
+  return router;
+}
+
+// src/dashboard/onboarding-routes.ts
+import { Hono as Hono28 } from "hono";
 
 // src/dashboard/unique-channel-name.ts
 function uniqueChannelName(raw, taken) {
@@ -14444,7 +14988,7 @@ async function buildGreeting(input2) {
 // src/dashboard/onboarding-routes.ts
 var MAX_FOLDERS = 20;
 function createOnboardingRouter(agent) {
-  const app = new Hono27();
+  const app = new Hono28();
   app.get("/scan", async (c) => {
     const ctx = await resolveAuthContext(c);
     if (ctx?.role !== "admin") return c.json({ error: "admin access required" }, 403);
@@ -14689,6 +15233,7 @@ function registerDataRoutes(api, agent = {}) {
   api.route("/channels", createDocShareWriteRouter(agent));
   api.route("/onboarding", createOnboardingRouter(agent));
   api.route("/channels", createChannelMembersRouter());
+  api.route("/channels", createMemoriesRouter());
   api.route("/docs", createDocShareListRouter());
   api.get("/users", (c) => c.json({ users: listActiveUsers() }));
   api.route("/categories", createCategoryWriteRouter());
@@ -14939,20 +15484,20 @@ function registerDataRoutes(api, agent = {}) {
 // src/dashboard/device-auth-routes.ts
 import { verify } from "crypto";
 import { getConnInfo } from "@hono/node-server/conninfo";
-import { Hono as Hono28 } from "hono";
+import { Hono as Hono29 } from "hono";
 
 // src/dashboard/agent-bridge.ts
 import { randomBytes as randomBytes8, randomUUID as randomUUID4, sign as signRaw, timingSafeEqual as timingSafeEqual2, verify as verifyRaw } from "crypto";
-import { existsSync as existsSync25, readFileSync as readFileSync15 } from "fs";
+import { existsSync as existsSync25, readFileSync as readFileSync16 } from "fs";
 import dotenv from "dotenv";
 import { WebSocket, WebSocketServer } from "ws";
 
 // src/dashboard/host-identity.ts
 import { createPrivateKey as createPrivateKey2, createPublicKey as createPublicKey2, generateKeyPairSync as generateKeyPairSync2 } from "crypto";
-import { existsSync as existsSync24, mkdirSync as mkdirSync9, readFileSync as readFileSync12, writeFileSync as writeFileSync8 } from "fs";
-import { dirname as dirname6, join as join20 } from "path";
+import { existsSync as existsSync24, mkdirSync as mkdirSync9, readFileSync as readFileSync13, writeFileSync as writeFileSync8 } from "fs";
+import { dirname as dirname7, join as join21 } from "path";
 function hostPrivateKeyPath() {
-  return process.env["FLYSPACE_HOST_KEY_PATH"] || join20(paths.BASE_CONFIG_DIR, "host.key");
+  return process.env["FLYSPACE_HOST_KEY_PATH"] || join21(paths.BASE_CONFIG_DIR, "host.key");
 }
 function loadHostPrivateKey(path = hostPrivateKeyPath()) {
   if (!existsSync24(path)) {
@@ -14960,7 +15505,7 @@ function loadHostPrivateKey(path = hostPrivateKeyPath()) {
       `No Host identity at ${path}. Run \`pnpm run generate-host-key\` on this machine, then set FLYSPACE_HOST_PUBLIC_KEY on the Data process to the printed public key.`
     );
   }
-  return createPrivateKey2(readFileSync12(path, "utf8"));
+  return createPrivateKey2(readFileSync13(path, "utf8"));
 }
 function loadHostPublicKey() {
   const b64 = process.env["FLYSPACE_HOST_PUBLIC_KEY"];
@@ -14976,10 +15521,10 @@ function loadHostPublicKey() {
 // src/dashboard/host-lock.ts
 import { execFileSync as execFileSync3 } from "child_process";
 import { randomBytes as randomBytes5 } from "crypto";
-import { mkdirSync as mkdirSync10, readFileSync as readFileSync13, rmSync as rmSync6, writeFileSync as writeFileSync9 } from "fs";
-import { join as join21 } from "path";
+import { mkdirSync as mkdirSync10, readFileSync as readFileSync14, rmSync as rmSync6, writeFileSync as writeFileSync9 } from "fs";
+import { join as join22 } from "path";
 function hostLockPath() {
-  return join21(paths.BASE_DATA_DIR, "host.lock");
+  return join22(paths.BASE_DATA_DIR, "host.lock");
 }
 function isLiveFlyspace(pid) {
   try {
@@ -14994,7 +15539,7 @@ function isLiveFlyspace(pid) {
 }
 function readLockPid(path) {
   try {
-    const pid = Number(JSON.parse(readFileSync13(path, "utf8")).pid);
+    const pid = Number(JSON.parse(readFileSync14(path, "utf8")).pid);
     return Number.isInteger(pid) && pid > 0 ? pid : null;
   } catch {
     return null;
@@ -15035,13 +15580,13 @@ function publishHostEndpoint(port) {
   const path = hostLockPath();
   if (readLockPid(path) !== process.pid) return null;
   const token = randomBytes5(32).toString("hex");
-  const lock = JSON.parse(readFileSync13(path, "utf8"));
+  const lock = JSON.parse(readFileSync14(path, "utf8"));
   writeFileSync9(path, JSON.stringify({ ...lock, port, token }), { mode: 384 });
   return token;
 }
 function readHostEndpoint() {
   try {
-    const { pid, port, token } = JSON.parse(readFileSync13(hostLockPath(), "utf8"));
+    const { pid, port, token } = JSON.parse(readFileSync14(hostLockPath(), "utf8"));
     if (pid === process.pid || !Number.isInteger(port) || typeof token !== "string") return null;
     return { port, token };
   } catch {
@@ -15281,7 +15826,7 @@ async function userEmail(userId) {
 
 // src/dashboard/doc-share-publisher.ts
 import { randomBytes as randomBytes7 } from "crypto";
-import { readFileSync as readFileSync14, statSync as statSync9 } from "fs";
+import { readFileSync as readFileSync15, statSync as statSync9 } from "fs";
 import { extname as extname2, posix } from "path";
 import { CopyObjectCommand, PutObjectCommand as PutObjectCommand5 } from "@aws-sdk/client-s3";
 
@@ -15468,7 +16013,7 @@ async function buildSnapshot(cwd, sourcePath, shareId) {
   }
   if (!stat.isFile()) return { status: "not-found" };
   if (stat.size > MAX_CONTENT_BYTES2) return { status: "too-large" };
-  const source = readFileSync14(abs, "utf8");
+  const source = readFileSync15(abs, "utf8");
   const title = extractTitle(abs, kind === "markdown" ? "md" : kind);
   if (kind === "excalidraw") {
     try {
@@ -15548,7 +16093,7 @@ async function buildSnapshot(cwd, sourcePath, shareId) {
       let text = null;
       try {
         const size = statSync9(docAbs).size;
-        if (size <= budget) text = readFileSync14(docAbs, "utf8");
+        if (size <= budget) text = readFileSync15(docAbs, "utf8");
       } catch {
         continue;
       }
@@ -15565,7 +16110,7 @@ async function buildSnapshot(cwd, sourcePath, shareId) {
     let body;
     try {
       if (statSync9(resolved2.abs).size > MAX_ASSET_BYTES) continue;
-      body = readFileSync14(resolved2.abs);
+      body = readFileSync15(resolved2.abs);
     } catch {
       continue;
     }
@@ -15607,7 +16152,7 @@ async function publishDocShare(input2) {
     ...HTML_FEATURES,
     brandingEnabled: resolveFeatures(input2.features, existing).brandingEnabled
   } : html ? HTML_FEATURES : resolveFeatures(input2.features, existing);
-  const snapshot2 = {
+  const snapshot3 = {
     ...built,
     sourceLang: html ? null : await detectSourceLanguage(built.title, built.content)
   };
@@ -15617,8 +16162,8 @@ async function publishDocShare(input2) {
       const renamed = await setDocShareSlug(existing.id, slug);
       if (!renamed) return { status: "not-found" };
     }
-    const share2 = await updateDocShareSnapshot(existing.id, snapshot2, features);
-    const stale = existing.assetKeys.filter((key) => !snapshot2.assetKeys.includes(key));
+    const share2 = await updateDocShareSnapshot(existing.id, snapshot3, features);
+    const stale = existing.assetKeys.filter((key) => !snapshot3.assetKeys.includes(key));
     await deleteShareAssets(stale);
     if (!features.audioEnabled && existing.audioEnabled) await dropShareAudio(existing);
     void queueShareAudio(share2);
@@ -15632,7 +16177,7 @@ async function publishDocShare(input2) {
     channelId: input2.channelId,
     sourcePath: input2.sourcePath,
     createdBy: input2.createdBy,
-    ...snapshot2,
+    ...snapshot3,
     ...features
   });
   void queueShareAudio(share);
@@ -15747,8 +16292,8 @@ async function proxyHostDb(workspaces, req, forward, assigned = workspaces ?? []
     const scope = table === "skill_files" && isWrite ? assigned : workspaces;
     if (scope.length === 0) return deny(`This Host is not the assigned Host for any workspace it may write ${table} to.`);
     if (method === "POST") {
-      const ok2 = rows.length > 0 && rows.every((r) => typeof r[slugColumn] === "string" && scope.includes(r[slugColumn]));
-      if (!ok2) return deny(`Every ${table} row must belong to a workspace this Host is assigned.`);
+      const ok3 = rows.length > 0 && rows.every((r) => typeof r[slugColumn] === "string" && scope.includes(r[slugColumn]));
+      if (!ok3) return deny(`Every ${table} row must belong to a workspace this Host is assigned.`);
     }
     if (method === "PATCH") {
       const patch = bodyRows(req.body);
@@ -15762,8 +16307,8 @@ async function proxyHostDb(workspaces, req, forward, assigned = workspaces ?? []
     if (!channelIds) return deny("Could not resolve the device workspaces.", 502);
     if (table === "threads") {
       if (method === "POST") {
-        const ok2 = rows.length > 0 && rows.every((r) => typeof r["channel_id"] === "string" && channelIds.includes(r["channel_id"]));
-        if (!ok2) return deny("A thread must belong to a channel of the device workspaces.");
+        const ok3 = rows.length > 0 && rows.every((r) => typeof r["channel_id"] === "string" && channelIds.includes(r["channel_id"]));
+        if (!ok3) return deny("A thread must belong to a channel of the device workspaces.");
       }
       if (method === "PATCH") {
         const patch = bodyRows(req.body);
@@ -15942,7 +16487,7 @@ function localAgentCallbacks(chatAgent) {
     regenerateAgentRun: (threadId) => chatAgent.regenerate(threadId),
     listAgentRuns: () => chatAgent.runningThreadIds(),
     listMissingCwds: () => auditChannelCwds().map((ch) => ch.id),
-    listRunningProfiles: () => listProfiles().filter(isServiceRunning),
+    listRunningProfiles: () => listProfiles().filter(isServiceRunning2),
     getAgentIdentities: () => resolveAgentIdentities(),
     publishDocShare: (input2) => publishDocShare(input2),
     listChannelSkills: (args) => listSkills(args.claudeConfigDir, args.cwd),
@@ -15959,14 +16504,14 @@ function localAgentCallbacks(chatAgent) {
 }
 var HOST_CONFIG_PUSH_INTERVAL_MS = 6e4;
 function buildHostConfigSnapshot() {
-  const snapshot2 = {};
+  const snapshot3 = {};
   for (const profile of listProfiles()) {
-    snapshot2[profile] = runWithProfile(profile, () => ({
-      env: existsSync25(paths.CONFIG_FILE) ? dotenv.parse(readFileSync15(paths.CONFIG_FILE, "utf-8")) : {},
+    snapshot3[profile] = runWithProfile(profile, () => ({
+      env: existsSync25(paths.CONFIG_FILE) ? dotenv.parse(readFileSync16(paths.CONFIG_FILE, "utf-8")) : {},
       agentModel: loadDashboardSettings().agent
     }));
   }
-  return snapshot2;
+  return snapshot3;
 }
 function startLocalProfileConfigHydration() {
   setProfileConfigCache(buildHostConfigSnapshot());
@@ -16208,7 +16753,8 @@ function remoteAgentCallbacks() {
     // Host connected, showing nobody as running is a reasonable default
     // rather than a false claim of certainty either way.
     listRunningProfiles: async () => await callHost("listRunningProfiles", []) ?? [],
-    getAgentIdentities: async () => await callHost("getAgentIdentities", []) ?? [],
+    // `null` (no Host) falls back to `offlineAgentIdentities` in api.ts.
+    getAgentIdentities: () => callHost("getAgentIdentities", []),
     // Reading the doc and copying its assets can only happen where the
     // channel's real folder is, so this always goes to the Host. `null` (no
     // Host connected) surfaces as `host-unavailable` — see
@@ -16492,7 +17038,7 @@ async function boundWorkspaceIds(publicKey, userId) {
   return new Set(existing ? (await listDeviceWorkspaces(existing)).map((w) => w.id) : []);
 }
 function createDeviceAuthRouter() {
-  const app = new Hono28();
+  const app = new Hono29();
   app.post("/code", async (c) => {
     const body = await readBody(c);
     const publicKey = typeof body["public_key"] === "string" ? body["public_key"] : "";
@@ -16555,8 +17101,8 @@ function createDeviceAuthRouter() {
     if (!device || device.revokedAt || !nonce || !signature) return c.json({ error: "invalid_grant" }, 401);
     if (!await consumeChallenge(device.id, nonce)) return c.json({ error: "invalid_grant" }, 401);
     const key = parseEd25519PublicKey(device.publicKey);
-    const ok2 = key && verify(null, Buffer.from(nonce), key, Buffer.from(signature, "base64"));
-    if (!ok2) return c.json({ error: "invalid_grant" }, 401);
+    const ok3 = key && verify(null, Buffer.from(nonce), key, Buffer.from(signature, "base64"));
+    if (!ok3) return c.json({ error: "invalid_grant" }, 401);
     const { token, expiresInS } = await issueAccessToken(device.id);
     return c.json({ access_token: token, token_type: "Bearer", expires_in: expiresInS });
   });
@@ -16656,7 +17202,7 @@ function createDeviceAuthRouter() {
 
 // src/dashboard/api.ts
 function createApiRouter(agent = {}, mode = "all") {
-  const api = new Hono29();
+  const api = new Hono30();
   api.use("*", async (c, next) => {
     const known = await listKnownWorkspaces();
     const fromHost = profileFromHost(trustedHost(c), known);
@@ -16703,7 +17249,7 @@ function createApiRouter(agent = {}, mode = "all") {
   if (mode === "data") {
     api.get(
       "/settings/agents",
-      async (c) => c.json({ agents: await agent.getAgentIdentities?.() ?? [] })
+      async (c) => c.json({ agents: await agent.getAgentIdentities?.() ?? await offlineAgentIdentities() })
     );
     api.get("/channels/:id/skills", async (c) => {
       const { cwd, claudeConfigDir } = resolveChannelConfig(c.req.param("id"));
@@ -16767,7 +17313,7 @@ function createApiRouter(agent = {}, mode = "all") {
 }
 
 // src/dashboard/app-icon-routes.ts
-import { Hono as Hono30 } from "hono";
+import { Hono as Hono31 } from "hono";
 var NEUTRAL_MANIFEST = {
   id: "/",
   name: "Flyspace",
@@ -16805,7 +17351,7 @@ async function withResolvedProfile2(c, next) {
   return profile ? runWithProfile(profile, () => next()) : next();
 }
 function createAppIconRouter() {
-  const app = new Hono30();
+  const app = new Hono31();
   app.get("/manifest.json", withResolvedProfile2, async (c) => {
     if (!await resolvedProfileHost(c)) return c.json(NEUTRAL_MANIFEST);
     const profile = getProfile();
@@ -16845,7 +17391,7 @@ function pngResponse(c, png) {
 }
 
 // src/dashboard/stripe-routes.ts
-import { Hono as Hono31 } from "hono";
+import { Hono as Hono32 } from "hono";
 function planStatusFor(status) {
   const known = ["trialing", "active", "paused", "canceled"];
   return known.includes(status) ? status : null;
@@ -16888,7 +17434,7 @@ async function handleCardAdded(session) {
   }
 }
 function createStripeWebhookRouter() {
-  const stripeRouter = new Hono31();
+  const stripeRouter = new Hono32();
   stripeRouter.post("/webhook", async (c) => {
     const secret = process.env["STRIPE_WEBHOOK_SECRET"];
     const signature = c.req.header("stripe-signature");
@@ -16999,15 +17545,15 @@ function startHostStatusBroadcast() {
 
 // src/dashboard/server.ts
 var DEFAULT_DASHBOARD_PORT = 4747;
-var WEB_DIST = join22(paths.PACKAGE_ROOT, "web", "dist");
+var WEB_DIST = join23(paths.PACKAGE_ROOT, "web", "dist");
 var DEFAULT_DASHBOARD_HOST = "127.0.0.1";
 async function findFreePort(start, host = DEFAULT_DASHBOARD_HOST, attempts = 50) {
   for (let port = start; port < start + attempts; port++) {
     const free = await new Promise((resolve8) => {
-      const probe2 = createServer();
-      probe2.once("error", () => resolve8(false));
-      probe2.once("listening", () => probe2.close(() => resolve8(true)));
-      probe2.listen(port, host);
+      const probe3 = createServer();
+      probe3.once("error", () => resolve8(false));
+      probe3.once("listening", () => probe3.close(() => resolve8(true)));
+      probe3.listen(port, host);
     });
     if (free) return port;
   }
@@ -17048,7 +17594,7 @@ async function startDashboardServer(preferredPort = DEFAULT_DASHBOARD_PORT, host
   const mirrorsSkills = mode === "host" || process.env["FLYSPACE_SKILL_SYNC"] === "1";
   const stopSkillSync = mirrorsSkills ? installSkillSync(listProfiles()) : () => {
   };
-  const app = new Hono32();
+  const app = new Hono33();
   app.use("*", async (c, next) => {
     await next();
     if (c.req.path.startsWith("/assets/")) {
@@ -17073,14 +17619,14 @@ async function startDashboardServer(preferredPort = DEFAULT_DASHBOARD_PORT, host
   } else {
     app.route("/share", createPublicShareAssetRouter(WEB_DIST));
     app.route("/", createAppIconRouter());
-    if (existsSync26(WEB_DIST) || existsSync26(join22(paths.PACKAGE_ROOT, "web", "package.json"))) {
+    if (existsSync26(WEB_DIST) || existsSync26(join23(paths.PACKAGE_ROOT, "web", "package.json"))) {
       app.use("/*", serveStatic({ root: WEB_DIST }));
     }
     app.get("/assets/*", (c) => c.text("stale asset \u2014 reload for the current build", 404));
-    const spaFallback = serveStatic({ path: join22(WEB_DIST, "index.html") });
+    const spaFallback = serveStatic({ path: join23(WEB_DIST, "index.html") });
     app.get("*", async (c, next) => {
-      if (!existsSync26(join22(WEB_DIST, "index.html"))) {
-        const isCheckout = existsSync26(join22(paths.PACKAGE_ROOT, "web", "package.json"));
+      if (!existsSync26(join23(WEB_DIST, "index.html"))) {
+        const isCheckout = existsSync26(join23(paths.PACKAGE_ROOT, "web", "package.json"));
         return c.text(
           isCheckout ? `Workspace UI build missing (${WEB_DIST}).
 Run \`pnpm --dir web build\` (or \`pnpm --dir web dev\`).
@@ -17135,7 +17681,7 @@ function watchServices() {
 
 // src/slack/image-uploader.ts
 import { readFile } from "fs/promises";
-import { basename as basename6 } from "path";
+import { basename as basename7 } from "path";
 import sharp6 from "sharp";
 var MAX_WIDTH = 800;
 async function uploadImage(client2, { channel, filePath, threadTs, text }) {
@@ -17144,7 +17690,7 @@ async function uploadImage(client2, { channel, filePath, threadTs, text }) {
   const base = {
     channel_id: channel,
     file: resized,
-    filename: basename6(filePath),
+    filename: basename7(filePath),
     ...text ? { initial_comment: text } : {}
   };
   const result = await client2.filesUploadV2(threadTs ? { ...base, thread_ts: threadTs } : base);
@@ -17518,7 +18064,7 @@ async function threadReplies(client2, nameOrId, ts2) {
 async function postMessage(client2, args) {
   const channelArg = getArg2(args, "--channel");
   const textFilePath = getArg2(args, "--text-file");
-  const text = textFilePath ? readFileSync16(textFilePath, "utf8") : getArg2(args, "--text");
+  const text = textFilePath ? readFileSync17(textFilePath, "utf8") : getArg2(args, "--text");
   const threadTs = getArg2(args, "--thread");
   const markdown = args.includes("--markdown");
   const broadcast = args.includes("--broadcast") && Boolean(threadTs);
@@ -17673,7 +18219,7 @@ async function ensureClaudeCodeReady() {
 }
 function getManifestYaml(botName) {
   const manifestPath = resolve7(paths.PACKAGE_ROOT, "slack-app-manifest.yml");
-  const raw = readFileSync16(manifestPath, "utf-8");
+  const raw = readFileSync17(manifestPath, "utf-8");
   return raw.replace(/name: Custie/g, `name: ${botName}`);
 }
 async function stepPersonalise() {
@@ -17886,7 +18432,7 @@ async function stepBrowserTokens(botName) {
     })
   ));
   const DEBUG = process.argv.includes("--debug");
-  const USER_DATA_DIR = resolve7(tmpdir3(), "custie-playwright-profile");
+  const USER_DATA_DIR = resolve7(tmpdir4(), "custie-playwright-profile");
   let context;
   try {
     log4("Opening browser \u2014 a Slack login page will appear.\n");
@@ -18107,7 +18653,7 @@ function copyDefaultPrompt(botName) {
   if (!existsSync27(paths.PROMPT_FILE)) {
     const defaultPrompt = resolve7(paths.PACKAGE_ROOT, "system.default.md");
     if (existsSync27(defaultPrompt)) {
-      const content = readFileSync16(defaultPrompt, "utf-8").replace(/\{\{botName\}\}/g, botName);
+      const content = readFileSync17(defaultPrompt, "utf-8").replace(/\{\{botName\}\}/g, botName);
       writeFileSync10(paths.PROMPT_FILE, content);
       success4(`Default prompt copied to ${paths.PROMPT_FILE}`);
     }
@@ -18429,8 +18975,122 @@ async function runChatCmd(args) {
   }
 }
 
-// src/commands/mcp.ts
+// src/commands/memory.ts
+import { readFileSync as readFileSync18 } from "fs";
 var USAGE5 = `
+  Usage: flyspace memory <subcommand> --channel <name-or-id> [options]
+
+  A channel's persistent agent memory (docs/features/workspace-memory.md).
+
+  Subcommands:
+    list                                 Every memory in the channel (index form)
+    get <name>                           One memory in full
+    search <words...>                    Memories whose name, description or body match
+    save --name <slug> --type <type>     Create, or overwrite the memory with that name
+      --description <one line>
+      --body <text | ->                  "-" reads the body from stdin
+      [--thread <id>]                    The thread the memory came from
+    delete <name-or-id> [--thread <id>]  Delete one memory
+
+  Types: ${MEMORY_TYPES.join(", ")}
+`;
+function getArg4(args, flag) {
+  const idx = args.indexOf(flag);
+  return idx !== -1 && idx + 1 < args.length ? args[idx + 1] : void 0;
+}
+function positionals(args) {
+  const out = [];
+  for (let i = 0; i < args.length; i++) {
+    if (args[i].startsWith("--")) i++;
+    else out.push(args[i]);
+  }
+  return out;
+}
+function indexLine(m) {
+  return `${m.name}  (${m.type}, ${m.updatedAt.slice(0, 10)})  ${m.description}`;
+}
+async function runMemoryCmd(args) {
+  loadEnvFiles();
+  const subcommand = args[0];
+  const rest = args.slice(1);
+  if (!subcommand || subcommand === "-h" || subcommand === "--help") {
+    console.log(USAGE5);
+    return;
+  }
+  const channelArg = getArg4(rest, "--channel");
+  if (!channelArg) throw new Error("--channel <name-or-id> is required");
+  const channel = await resolveChannel(channelArg, getArg4(rest, "--profile-name"));
+  const words = positionals(rest);
+  switch (subcommand) {
+    case "list": {
+      const memories = await listChannelMemories(channel.id);
+      console.log(memories.length ? memories.map(indexLine).join("\n") : "No memories yet.");
+      break;
+    }
+    case "get": {
+      const name = words[0];
+      if (!name) throw new Error("Usage: flyspace memory get --channel <c> <name>");
+      const memory = await getChannelMemory(channel.id, name);
+      if (!memory) throw new Error(`No memory named ${name} in ${channel.name}.`);
+      console.log(`# ${memory.name} (${memory.type})
+
+${memory.description}
+
+${memory.body}`);
+      break;
+    }
+    case "search": {
+      if (!words.length) throw new Error("Usage: flyspace memory search --channel <c> <words...>");
+      const hits = await searchChannelMemories(channel.id, words.join(" "));
+      console.log(hits.length ? hits.map(indexLine).join("\n") : "No matching memories.");
+      break;
+    }
+    case "save": {
+      const name = getArg4(rest, "--name");
+      const type = getArg4(rest, "--type");
+      const description = getArg4(rest, "--description");
+      const bodyArg = getArg4(rest, "--body");
+      if (!name || !type || !description || bodyArg === void 0) {
+        throw new Error(
+          "Usage: flyspace memory save --channel <c> --name <slug> --type <type> --description <one line> --body <text | -> [--thread <id>]"
+        );
+      }
+      if (!isMemoryType(type)) throw new Error(`--type must be one of ${MEMORY_TYPES.join(", ")}`);
+      const body = bodyArg === "-" ? readFileSync18(0, "utf-8") : bodyArg;
+      const thread = getArg4(rest, "--thread");
+      const { created, changed } = await saveChannelMemory(
+        {
+          channelId: channel.id,
+          name,
+          type,
+          description,
+          body,
+          createdBy: "agent",
+          ...thread ? { sourceThreadId: thread } : {}
+        },
+        "agent"
+      );
+      const verb = created ? "Saved" : changed ? "Updated" : "Unchanged:";
+      console.log(`${verb} memory ${name} in ${channel.name}.`);
+      break;
+    }
+    case "delete": {
+      const ref = words[0];
+      if (!ref) throw new Error("Usage: flyspace memory delete --channel <c> <name-or-id>");
+      const deleted = await deleteChannelMemory(channel.id, ref, "agent", getArg4(rest, "--thread"));
+      if (!deleted) throw new Error(`No memory ${ref} in ${channel.name}.`);
+      console.log(`Deleted memory ${ref}.`);
+      break;
+    }
+    default:
+      console.error(`Unknown subcommand: ${subcommand}`);
+      console.log(USAGE5);
+      process.exit(1);
+  }
+}
+
+// src/commands/mcp.ts
+var USAGE6 = `
 Usage: flyspace mcp <server>
 
   Run one of Flyspace's own MCP servers on stdio. Spawned by the agent runtime
@@ -18447,7 +19107,7 @@ Usage: flyspace mcp <server>
 async function runMcpCmd(args) {
   const server = args[0];
   if (!server || server === "-h" || server === "--help") {
-    console.log(USAGE5.trim());
+    console.log(USAGE6.trim());
     return;
   }
   restoreStdout();
@@ -18460,7 +19120,7 @@ async function runMcpCmd(args) {
     }
     default:
       console.error(`Unknown MCP server: ${server}`);
-      console.error(USAGE5.trim());
+      console.error(USAGE6.trim());
       process.exit(1);
   }
 }
@@ -18469,7 +19129,7 @@ async function runMcpCmd(args) {
 import { spawn as spawn6, spawnSync } from "child_process";
 import { existsSync as existsSync28 } from "fs";
 import { platform as platform7 } from "os";
-import { join as join23 } from "path";
+import { join as join24 } from "path";
 function flagValue(args, name) {
   const eq = args.find((a) => a.startsWith(`--${name}=`));
   if (eq) return eq.slice(`--${name}=`.length);
@@ -18484,8 +19144,8 @@ function openBrowser2(url) {
   }
 }
 function ensureWebBuild() {
-  if (existsSync28(join23(paths.PACKAGE_ROOT, "web", "dist", "index.html"))) return;
-  if (!existsSync28(join23(paths.PACKAGE_ROOT, "web", "package.json"))) return;
+  if (existsSync28(join24(paths.PACKAGE_ROOT, "web", "dist", "index.html"))) return;
+  if (!existsSync28(join24(paths.PACKAGE_ROOT, "web", "package.json"))) return;
   console.log("  web/dist missing \u2014 building the dashboard UI (pnpm --dir web build)...");
   const result = spawnSync("pnpm", ["--dir", "web", "build"], {
     cwd: paths.PACKAGE_ROOT,
@@ -18536,7 +19196,7 @@ async function runDashboard(args) {
 
 // src/commands/workspace.ts
 import { existsSync as existsSync29, mkdirSync as mkdirSync11, writeFileSync as writeFileSync11 } from "fs";
-var USAGE6 = `
+var USAGE7 = `
   Usage: flyspace workspace <subcommand> [options]
 
   Subcommands:
@@ -18553,7 +19213,7 @@ var USAGE6 = `
     --no-invite               Never send an invite email. Fails if the admin
                               has no existing account.
 `;
-function getArg4(args, flag) {
+function getArg5(args, flag) {
   const idx = args.indexOf(flag);
   return idx !== -1 && idx + 1 < args.length ? args[idx + 1] : void 0;
 }
@@ -18649,10 +19309,10 @@ async function provisionChannels(specs) {
 async function handleCreate(args) {
   const slug = args[0];
   if (!slug || slug.startsWith("-")) fail2("Usage: flyspace workspace create <slug> --admin-email <email>");
-  const adminEmail = getArg4(args, "--admin-email");
+  const adminEmail = getArg5(args, "--admin-email");
   if (!adminEmail?.includes("@")) fail2("--admin-email is required and must be an email address");
-  const botName = getArg4(args, "--bot-name") ?? slug;
-  const baseDomain = getArg4(args, "--base-domain") ?? "flyspace.ai";
+  const botName = getArg5(args, "--bot-name") ?? slug;
+  const baseDomain = getArg5(args, "--base-domain") ?? "flyspace.ai";
   const allowInvite = !args.includes("--no-invite");
   const channels = getAllArgs(args, "--channel").map(parseChannelSpec);
   loadEnvFiles();
@@ -18675,13 +19335,13 @@ async function runWorkspaceCmd(args) {
       await handleCreate(args.slice(1));
       break;
     default:
-      console.log(USAGE6);
+      console.log(USAGE7);
       process.exit(args[0] ? 1 : 0);
   }
 }
 
 // src/commands/reconcile.ts
-var USAGE7 = `
+var USAGE8 = `
   Usage: flyspace reconcile [<workspace> | --all]
 
   Repair a workspace's local filesystem state (profile dir, config.env,
@@ -18701,7 +19361,7 @@ function printLog(name, log5) {
 }
 async function runReconcileCmd(args) {
   if (args.includes("-h") || args.includes("--help")) {
-    console.log(USAGE7);
+    console.log(USAGE8);
     return;
   }
   loadEnvFiles();
@@ -18717,12 +19377,13 @@ async function runReconcileCmd(args) {
 
 // src/cli.ts
 var XERO_USAGE = false ? "    xero         Connect to Xero and expose it as an MCP server\n" : "";
-var USAGE8 = `
+var USAGE9 = `
   Usage: flyspace <command> [options]
 
   Commands:
     setup        Set up this machine as a Host (login, agent CLIs, ~/Flyspace)
     auth         Log in, check status, or log out this device
+    doctor       Check this Host end to end (login, agent CLIs, services)
     start        Start the agent host (Slack only if configured)
     install      Install as a system service (launchd / systemd)
     uninstall    Remove the system service
@@ -18736,6 +19397,7 @@ var USAGE8 = `
     usage        Show agent token usage and cost for this workspace
     slack        Query Slack (channels, users, post messages)
     chat         Inspect dashboard chat channels and move threads between them
+    memory       Read and write a channel's persistent agent memory
     profiles     List local profiles (bound here? scheduler?) or remove one
     workspace    Provision a workspace (Supabase rows + local profile dirs)
     reconcile    Repair a workspace's local files against Supabase
@@ -18776,6 +19438,9 @@ async function main() {
     case "auth":
       await runAuthCmd(args.slice(1));
       break;
+    case "doctor":
+      await runDoctor(args.slice(1));
+      break;
     case "start":
       await runStart();
       break;
@@ -18824,6 +19489,9 @@ async function main() {
     case "chat":
       await runChatCmd(args.slice(1));
       break;
+    case "memory":
+      await runMemoryCmd(args.slice(1));
+      break;
     case "profile":
     case "profiles":
       await runProfiles(args.slice(1));
@@ -18836,12 +19504,12 @@ async function main() {
       break;
     case "-v":
     case "--version":
-      printRaw("0.1.7");
+      printRaw("0.1.10");
       break;
     case "-h":
     case "--help":
     case void 0:
-      printRaw(USAGE8);
+      printRaw(USAGE9);
       break;
     case "xero":
       if (false) {
@@ -18852,7 +19520,7 @@ async function main() {
     // falls through
     default:
       printRaw(`Unknown command: ${command}`);
-      printRaw(USAGE8);
+      printRaw(USAGE9);
       process.exit(1);
   }
 }