heyspex 0.2.0 → 0.2.1

package/dist/cli/hs-workspace.mjs

@@ -5,11 +5,26 @@ var __esm = (fn, res) => function __init() {
   return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
 };
 
+// scripts/lib/heyspex-home.mjs
+import { homedir } from "node:os";
+function heyspexHome(env = process.env) {
+  const override = env?.HEYSPEX_HOME;
+  if (typeof override === "string" && override.trim().length > 0) {
+    return override.trim();
+  }
+  return homedir();
+}
+var init_heyspex_home = __esm({
+  "scripts/lib/heyspex-home.mjs"() {
+    "use strict";
+  }
+});
+
 // vendor/heyspex-mcp/credentials.mjs
 import { mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
-import os, { homedir } from "node:os";
+import os, { homedir as homedir2 } from "node:os";
 import { dirname as dirname2, join as join2, resolve } from "node:path";
-function credentialsFilePath(homeDir = homedir()) {
+function credentialsFilePath(homeDir = heyspexHome()) {
   return join2(homeDir, ".heyspex", "credentials.yaml");
 }
 function parseMcpToken(raw) {
@@ -122,14 +137,14 @@ function readLegacyConfigAccountId(read, homeDir) {
   const value = raw?.match(CONFIG_ACCOUNT_ID_RE)?.[1]?.trim() ?? "";
   return value || null;
 }
-function readBearer({ env = process.env, homeDir = homedir(), readFile: readFile2, accountId: accountId2 } = {}) {
+function readBearer({ env = process.env, homeDir = heyspexHome(), readFile: readFile2, accountId: accountId2 } = {}) {
   const read = readFile2 ?? ((p) => readFileSync(p, "utf8"));
   const credentialsText = readTextOrNull(read, credentialsFilePath(homeDir));
   const named = typeof accountId2 === "string" && accountId2.trim() ? accountId2.trim() : null;
   const legacyAccountId = named && parseCredentialsStore(credentialsText).schemaVersion === 1 ? readLegacyConfigAccountId(read, homeDir) : null;
   return resolveBearer({ envToken: env?.[MCP_TOKEN_ENV], credentialsText, accountId: named, legacyAccountId });
 }
-function readCurrentAccountId({ homeDir = homedir(), readFile: readFile2 } = {}) {
+function readCurrentAccountId({ homeDir = heyspexHome(), readFile: readFile2 } = {}) {
   const read = readFile2 ?? ((p) => readFileSync(p, "utf8"));
   const store = parseCredentialsStore(readTextOrNull(read, credentialsFilePath(homeDir)));
   if (store.schemaVersion === 2 && store.currentAccountId && store.currentAccountId !== LEGACY_ACCOUNT_ID) {
@@ -147,6 +162,7 @@ var MCP_TOKEN_ENV, MCP_TOKEN_LINE_RE, CREDENTIALS_SCHEMA_VERSION, LEGACY_ACCOUNT
 var init_credentials = __esm({
   "vendor/heyspex-mcp/credentials.mjs"() {
     "use strict";
+    init_heyspex_home();
     MCP_TOKEN_ENV = "HEYSPEX_MCP_TOKEN";
     MCP_TOKEN_LINE_RE = /^mcp_token:[ \t]*["']?([^"'\r\n#]+)/m;
     CREDENTIALS_SCHEMA_VERSION = 2;
@@ -158,11 +174,11 @@ var init_credentials = __esm({
 });
 
 // scripts/lib/dev-mode.mjs
-import { mkdirSync as mkdirSync3, readFileSync as readFileSync6, writeFileSync as writeFileSync3 } from "node:fs";
-import { homedir as homedir6 } from "node:os";
-import { join as join7 } from "node:path";
-function devModeFilePath(homeDir = homedir6()) {
-  return join7(homeDir, ".heyspex", DEV_MODE_FILENAME);
+import { mkdirSync as mkdirSync4, readFileSync as readFileSync7, writeFileSync as writeFileSync4 } from "node:fs";
+import { homedir as homedir7 } from "node:os";
+import { join as join8 } from "node:path";
+function devModeFilePath(homeDir = heyspexHome()) {
+  return join8(homeDir, ".heyspex", DEV_MODE_FILENAME);
 }
 function normalizeMode(raw) {
   const v = String(raw ?? "").trim().toLowerCase();
@@ -186,7 +202,7 @@ function deriveSemantics(mode, reliance) {
     vaultWriteMode: local ? "local" : "cloud"
   };
 }
-function readLocalDevModeRecord({ homeDir = homedir6(), readFile: readFile2 = defaultReadFile } = {}) {
+function readLocalDevModeRecord({ homeDir = heyspexHome(), readFile: readFile2 = defaultReadFile } = {}) {
   let raw;
   try {
     raw = readFile2(devModeFilePath(homeDir));
@@ -216,7 +232,7 @@ function readLocalDevModeRecord({ homeDir = homedir6(), readFile: readFile2 = de
 }
 function resolveDevMode({
   env = process.env,
-  homeDir = homedir6(),
+  homeDir = heyspexHome(),
   readFile: readFile2 = defaultReadFile,
   cloudSetting = void 0
 } = {}) {
@@ -279,11 +295,12 @@ var CLOUD_CONSOLE_URL, LOCAL_CONSOLE_URL, DEV_MODE_FILENAME, defaultReadFile;
 var init_dev_mode = __esm({
   "scripts/lib/dev-mode.mjs"() {
     "use strict";
+    init_heyspex_home();
     init_credentials();
     CLOUD_CONSOLE_URL = "https://app.heyspex.com";
     LOCAL_CONSOLE_URL = "http://localhost:3000";
     DEV_MODE_FILENAME = "dev-mode.json";
-    defaultReadFile = (p) => readFileSync6(p, "utf8");
+    defaultReadFile = (p) => readFileSync7(p, "utf8");
   }
 });
 
@@ -352,7 +369,7 @@ var init_interfaces = __esm({
 });
 
 // spex-console/src/lib/db/schema/postgres.ts
-var edgeTypeEnum, validationSeverityEnum, outboxOpEnum, tsvector, specs, tags, edges, wikilinks, specLinks, aliases, validationIssues, indexMeta, frontmatterFields, eventOutbox, captureSessions, handoffContext, claimEventKindEnum, activeClaimStatusEnum, pendingReasonEnum, focusEventKindEnum, specEventKindEnum, focusPin, captureFocusPin, captureFocusSelection, focusSelection, focusSkips, activeClaims, claimWaiters, fileClaims, claimEvents, focusEvents, focusAreas, focusAreasEvents, specEvents, rateLimitBuckets, userVaults, milestoneSnapshots, modelRegistryEntries, launchIntentStatusEnum, launchIntents, companionRelayPresence, companionSettingsStore, consoleSettingsStore, wipLedger, wipLedgerArchive, gatherResults, agentSessions, usageEvents, streamEvents, jobStreams, resolutionStatusEnum, resolutionFocusPin, resolutionLedger, workspaces, vaults, accountSettings, vaultGrants, pendingVaultGrants, githubInstallations, fleetMachines, fleetTasks, fleetResults, userApiKeys, apiKeys, mcpSessions, pairingCodes, companionSessions, inviteRequests, notifications, webhookIngestions, specSettlements;
+var edgeTypeEnum, validationSeverityEnum, outboxOpEnum, tsvector, specs, tags, edges, wikilinks, specLinks, aliases, validationIssues, indexMeta, frontmatterFields, eventOutbox, captureSessions, handoffContext, claimEventKindEnum, activeClaimStatusEnum, pendingReasonEnum, focusEventKindEnum, specEventKindEnum, focusPin, captureFocusPin, captureFocusSelection, focusSelection, focusSkips, activeClaims, claimWaiters, fileClaims, claimEvents, focusEvents, focusAreas, focusAreasEvents, specEvents, rateLimitBuckets, userVaults, milestoneSnapshots, modelRegistryEntries, launchIntentStatusEnum, launchIntents, companionRelayPresence, companionSettingsStore, consoleSettingsStore, wipLedger, wipLedgerArchive, gatherResults, agentSessions, usageEvents, streamEvents, jobStreams, resolutionStatusEnum, resolutionFocusPin, resolutionLedger, workspaces, vaults, accountSettings, vaultGrants, pendingVaultGrants, githubInstallations, fleetMachines, fleetTasks, fleetResults, userApiKeys, apiKeys, mcpSessions, pairingCodes, companionSessions, inviteRequests, notifications, webhookIngestions, specSettlements, sessionBranchDeclarations;
 var init_postgres = __esm({
   "spex-console/src/lib/db/schema/postgres.ts"() {
     "use strict";
@@ -794,7 +811,13 @@ var init_postgres = __esm({
       "priority_change",
       "parent_change",
       "claim_acquired",
-      "claim_released"
+      "claim_released",
+      // Collaborator write audit (HS-FWB6, migration 0077).
+      "spec_created",
+      "spec_edited",
+      "spec_deleted",
+      "capture_written",
+      "wip_recorded"
     ]);
     focusPin = pgTable(
       "focus_pin",
@@ -1987,20 +2010,52 @@ var init_postgres = __esm({
         // `owner/name`
         branch: text("branch").notNull(),
         commitSha: text("commit_sha").notNull(),
-        settledAt: timestamp("settled_at", { withTimezone: true }).notNull().default(sql`now()`)
+        settledAt: timestamp("settled_at", { withTimezone: true }).notNull().default(sql`now()`),
+        // The pull request that carries this settlement
+        // ([[HS-9D25-CWPX-EPIC-branch-lifecycle-open-a-pull-request]]). NULL until
+        // the branch has gone quiet and a PR was opened or found; a write made
+        // after its PR merged stays NULL, which is what triggers the next PR.
+        pullRequestNumber: integer("pull_request_number"),
+        pullRequestUrl: text("pull_request_url")
       },
       (table) => [
         // "latest settlement for this spec" — the read path's only query.
-        index("spec_settlements_spec_settled_idx").on(table.specId, table.settledAt.desc())
+        index("spec_settlements_spec_settled_idx").on(table.specId, table.settledAt.desc()),
+        // The PR sweep's only query: branches with settlements not yet in a PR.
+        index("spec_settlements_unproposed_idx").on(table.vaultId, table.repo, table.branch).where(sql`${table.pullRequestNumber} IS NULL`)
+      ]
+    );
+    sessionBranchDeclarations = pgTable(
+      "session_branch_declarations",
+      {
+        id: integer("id").primaryKey().generatedAlwaysAsIdentity(),
+        vaultId: text("vault_id").notNull().default(DEFAULT_VAULT_ID),
+        actorKey: text("actor_key").notNull(),
+        sessionId: text("session_id").notNull(),
+        branch: text("branch").notNull(),
+        declaredAt: timestamp("declared_at", { withTimezone: true }).notNull().default(sql`now()`),
+        expiresAt: timestamp("expires_at", { withTimezone: true }).notNull()
+      },
+      (table) => [
+        uniqueIndex("session_branch_declarations_uq").on(
+          table.vaultId,
+          table.actorKey,
+          table.sessionId
+        ),
+        index("session_branch_declarations_lookup_idx").on(
+          table.vaultId,
+          table.actorKey,
+          table.declaredAt.desc()
+        )
       ]
     );
   }
 });
 
 // spex-console/bin/hs-workspace.ts
-import { readFileSync as readFileSync9 } from "node:fs";
+import { readFileSync as readFileSync10 } from "node:fs";
 import path3 from "node:path";
-import process3 from "node:process";
+import process4 from "node:process";
 import { createInterface as createInterface2 } from "node:readline/promises";
 
 // spex-console/src/lib/cli/control-shared.ts
@@ -2025,17 +2080,19 @@ function shellQuote(p) {
 var HS_DISPATCHER_PREFIX = HS_DISPATCHER_PATH ? `node ${shellQuote(HS_DISPATCHER_PATH)}` : HS_BIN_NAME;
 
 // vendor/heyspex-mcp/console-fetch.mjs
+init_heyspex_home();
 init_credentials();
-import { readFileSync as readFileSync4 } from "node:fs";
-import { homedir as homedir4 } from "node:os";
-import { join as join5 } from "node:path";
+import { readFileSync as readFileSync5 } from "node:fs";
+import { homedir as homedir5 } from "node:os";
+import { join as join6 } from "node:path";
 
 // vendor/heyspex-mcp/session-owner.mjs
+init_heyspex_home();
 init_credentials();
 import { readFileSync as readFileSync2 } from "node:fs";
-import { homedir as homedir2 } from "node:os";
+import { homedir as homedir3 } from "node:os";
 import { join as join3 } from "node:path";
-function resolveSessionOwnerUncached({ env = process.env, homeDir = homedir2(), readFile: readFile2 } = {}) {
+function resolveSessionOwnerUncached({ env = process.env, homeDir = heyspexHome(), readFile: readFile2 } = {}) {
   const fromEnv = typeof env?.HS_ACCOUNT_ID === "string" ? env.HS_ACCOUNT_ID.trim() : "";
   if (fromEnv) return fromEnv;
   return readCurrentAccountId({ homeDir, readFile: readFile2 });
@@ -2065,10 +2122,41 @@ function isVaultLessEndpoint(method, path4) {
   });
 }
 
+// vendor/heyspex-mcp/write-outbox.mjs
+import {
+  readdirSync,
+  readFileSync as readFileSync3,
+  writeFileSync as writeFileSync2,
+  mkdirSync as mkdirSync2,
+  existsSync as existsSync2,
+  renameSync as renameSync2,
+  rmSync
+} from "node:fs";
+import { basename, join as join4, isAbsolute as isAbsolute2 } from "node:path";
+
+// scripts/lib/shared-path-helpers.mjs
+import { isAbsolute, resolve as resolve2, sep } from "node:path";
+function resolveCodeRoot({
+  explicit,
+  packageRoot,
+  vaultRoot,
+  env = process.env
+} = {}) {
+  const fromExplicit = typeof explicit === "string" ? explicit.trim() : "";
+  if (fromExplicit) return fromExplicit;
+  const fromEnv = typeof env?.HS_PKG_ROOT === "string" ? env.HS_PKG_ROOT.trim() : "";
+  if (fromEnv) return fromEnv;
+  const fromPackage = typeof packageRoot === "string" ? packageRoot.trim() : "";
+  if (fromPackage) return fromPackage;
+  const fromVault = typeof vaultRoot === "string" ? vaultRoot.trim() : "";
+  return fromVault;
+}
+
 // vendor/heyspex-mcp/vault-resolve.mjs
-import { existsSync as existsSync2, readFileSync as readFileSync3 } from "node:fs";
-import { homedir as homedir3, tmpdir } from "node:os";
-import { dirname as dirname3, join as join4, resolve as resolve2 } from "node:path";
+init_heyspex_home();
+import { existsSync as existsSync3, readFileSync as readFileSync4 } from "node:fs";
+import { homedir as homedir4, tmpdir } from "node:os";
+import { dirname as dirname3, join as join5, resolve as resolve3 } from "node:path";
 
 // vendor/heyspex-mcp/console-fetch.mjs
 var SCOPE_REFUSAL_CODES = Object.freeze(["VAULT_SCOPE_MISMATCH", "ACCOUNT_MISMATCH", "VAULT_NOT_REGISTERED"]);
@@ -2077,9 +2165,18 @@ var SCOPE_REFUSAL_CODES = Object.freeze(["VAULT_SCOPE_MISMATCH", "ACCOUNT_MISMAT
 init_credentials();
 
 // spex-console/src/lib/vault-registry/registry-file.ts
-import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync5, renameSync as renameSync2, writeFileSync as writeFileSync2 } from "node:fs";
-import { homedir as homedir5 } from "node:os";
-import { dirname as dirname4, join as join6, resolve as resolve3 } from "node:path";
+import { existsSync as existsSync4, mkdirSync as mkdirSync3, readFileSync as readFileSync6, renameSync as renameSync3, writeFileSync as writeFileSync3 } from "node:fs";
+import { dirname as dirname4, join as join7, resolve as resolve4 } from "node:path";
+
+// spex-console/src/lib/heyspex-home.ts
+import { homedir as homedir6 } from "node:os";
+function heyspexHome2(env = process.env) {
+  const override = env?.HEYSPEX_HOME;
+  if (typeof override === "string" && override.trim().length > 0) {
+    return override.trim();
+  }
+  return homedir6();
+}
 
 // spex-console/src/lib/vault-registry/types.ts
 var LEGACY_REGISTRY_ACCOUNT_ID = "legacy";
@@ -2096,10 +2193,10 @@ function emptyVaultRegistry() {
 
 // spex-console/src/lib/vault-registry/registry-file.ts
 function vaultRegistryDir(opts = {}) {
-  return opts.registryDir ?? join6(homedir5(), ".heyspex");
+  return opts.registryDir ?? join7(heyspexHome2(), ".heyspex");
 }
 function vaultRegistryFilePath(opts = {}) {
-  return join6(vaultRegistryDir(opts), "registry.json");
+  return join7(vaultRegistryDir(opts), "registry.json");
 }
 function isNonEmptyString(v) {
   return typeof v === "string" && v.trim().length > 0;
@@ -2200,9 +2297,9 @@ function parseVaultRegistryFile(json) {
 }
 function readRegistryJson(opts) {
   const filePath = vaultRegistryFilePath(opts);
-  if (!existsSync3(filePath)) return { kind: "missing" };
+  if (!existsSync4(filePath)) return { kind: "missing" };
   try {
-    const raw = readFileSync5(filePath, "utf8");
+    const raw = readFileSync6(filePath, "utf8");
     const json = JSON.parse(raw);
     if (registryFileSchemaOf(json) === null) return { kind: "unreadable" };
     return { kind: "ok", raw, json };
@@ -2256,14 +2353,14 @@ function underTestRunner() {
 }
 function samePathLoose(a, b) {
   const norm = (p) => {
-    const r = resolve3(p).replace(/[\\/]+$/, "");
+    const r = resolve4(p).replace(/[\\/]+$/, "");
     return process.platform === "win32" ? r.toLowerCase() : r;
   };
   return norm(a) === norm(b);
 }
 function assertNotRealHomeRegistryUnderTest(filePath) {
   if (!underTestRunner()) return;
-  if (samePathLoose(dirname4(filePath), join6(homedir5(), ".heyspex"))) {
+  if (samePathLoose(dirname4(filePath), join7(heyspexHome2(), ".heyspex"))) {
     throw new Error(
       `registry-file: refusing to write ${filePath} under a test runner \u2014 that is the real ~/.heyspex registry. Pass opts.registryDir (a temp dir).`
     );
@@ -2272,10 +2369,10 @@ function assertNotRealHomeRegistryUnderTest(filePath) {
 function writeVaultRegistry(registry, opts = {}) {
   const filePath = vaultRegistryFilePath(opts);
   assertNotRealHomeRegistryUnderTest(filePath);
-  mkdirSync2(dirname4(filePath), { recursive: true });
+  mkdirSync3(dirname4(filePath), { recursive: true });
   const tmpPath = `${filePath}.tmp`;
-  writeFileSync2(tmpPath, serializeVaultRegistry(registry), "utf8");
-  renameSync2(tmpPath, filePath);
+  writeFileSync3(tmpPath, serializeVaultRegistry(registry), "utf8");
+  renameSync3(tmpPath, filePath);
 }
 function isValidId(id) {
   if (!isNonEmptyString(id)) return false;
@@ -2463,10 +2560,11 @@ function withCloudScope(deps, accountId2, vaultId) {
 }
 
 // scripts/lib/console-url-resolver.mjs
+init_heyspex_home();
 init_dev_mode();
-import { readFileSync as readFileSync7 } from "node:fs";
-import { homedir as homedir7 } from "node:os";
-import { join as join8 } from "node:path";
+import { readFileSync as readFileSync8 } from "node:fs";
+import { homedir as homedir8 } from "node:os";
+import { join as join9 } from "node:path";
 var DEFAULT_CONSOLE_URL = LOCAL_CONSOLE_URL;
 function trimTrailingSlash(url) {
   return url.replace(/\/+$/, "");
@@ -2492,9 +2590,9 @@ function warnStaleLoopbackCredentialsOnce(credentialsUrl, derivedUrl, { log }) {
   } catch {
   }
 }
-function readCredentialsConsoleUrl({ homeDir = homedir7(), readFile: readFile2 = defaultReadFile2 } = {}) {
+function readCredentialsConsoleUrl({ homeDir = heyspexHome(), readFile: readFile2 = defaultReadFile2 } = {}) {
   try {
-    const raw = readFile2(join8(homeDir, ".heyspex", "credentials.yaml"));
+    const raw = readFile2(join9(homeDir, ".heyspex", "credentials.yaml"));
     const match = String(raw ?? "").match(/^console_url:\s*["']?([^"'\r\n#]+)/m);
     const value = match?.[1]?.trim();
     return value && value.length > 0 ? trimTrailingSlash(value) : null;
@@ -2503,12 +2601,12 @@ function readCredentialsConsoleUrl({ homeDir = homedir7(), readFile: readFile2 =
   }
 }
 function defaultReadFile2(p) {
-  return readFileSync7(p, "utf8");
+  return readFileSync8(p, "utf8");
 }
 function readDiscoveryFileConsoleUrl(repoRoot, { readDiscovery = defaultReadFile2 } = {}) {
   if (!repoRoot) return null;
   try {
-    const discovery = String(readDiscovery(join8(repoRoot, ".heyspex", "console-url")) ?? "").trim();
+    const discovery = String(readDiscovery(join9(repoRoot, ".heyspex", "console-url")) ?? "").trim();
     if (discovery.length > 0) return trimTrailingSlash(discovery);
   } catch {
   }
@@ -2536,7 +2634,7 @@ function resolveModeEnvelope({ env, homeDir }) {
 function resolveConsoleUrl({
   repoRoot,
   env = process.env,
-  homeDir = homedir7(),
+  homeDir = heyspexHome(),
   strict = false,
   devMode,
   log = (line) => process.stderr.write(line),
@@ -2601,35 +2699,15 @@ var HELP = [
 
 // spex-console/src/lib/cli/install-identity.ts
 import { spawnSync } from "node:child_process";
-import { existsSync as existsSync4 } from "node:fs";
-import { homedir as homedir9 } from "node:os";
-import { join as join9 } from "node:path";
+import { existsSync as existsSync5 } from "node:fs";
+import { join as join10 } from "node:path";
 import { createInterface } from "node:readline/promises";
-
-// scripts/lib/shared-path-helpers.mjs
-import { isAbsolute, resolve as resolve4, sep } from "node:path";
-function resolveCodeRoot({
-  explicit,
-  packageRoot,
-  vaultRoot,
-  env = process.env
-} = {}) {
-  const fromExplicit = typeof explicit === "string" ? explicit.trim() : "";
-  if (fromExplicit) return fromExplicit;
-  const fromEnv = typeof env?.HS_PKG_ROOT === "string" ? env.HS_PKG_ROOT.trim() : "";
-  if (fromEnv) return fromEnv;
-  const fromPackage = typeof packageRoot === "string" ? packageRoot.trim() : "";
-  if (fromPackage) return fromPackage;
-  const fromVault = typeof vaultRoot === "string" ? vaultRoot.trim() : "";
-  return fromVault;
-}
-
-// spex-console/src/lib/cli/install-identity.ts
 init_credentials();
 
 // vendor/heyspex-mcp/whoami.mjs
+init_heyspex_home();
 init_credentials();
-import { homedir as homedir8 } from "node:os";
+import { homedir as homedir9 } from "node:os";
 var SESSION_PATH = "/api/mcp/session";
 async function probeCredentialIdentity({ consoleUrl, token, fetchImpl = fetch } = {}) {
   if (!token) return { kind: "no_credential" };
@@ -2724,6 +2802,10 @@ var HELP2 = [
   "Exit codes: 0 ok \xB7 1 usage \xB7 11 bad-arg \xB7 13 write-failed"
 ].join("\n");
 
+// spex-console/src/lib/cli/satellite.ts
+import { resolve as resolveNodePath } from "node:path";
+import process2 from "node:process";
+
 // spex-console/src/lib/cli/install-identity.ts
 var SWITCH_HINT = "Sign in as another account with `hs login --switch-account` (or create one with `hs login --create-account`).";
 var ATTACH_WORDING = {
@@ -2958,7 +3040,7 @@ async function gateWriteVerb(opts) {
   if (!opts.writeVerbs.has(opts.sub)) return null;
   return runIdentityGate(opts.io, opts.flags, `${opts.namespace} ${opts.sub}`, WRITE_WORDING);
 }
-function readConfiguredAccountId(env = process.env, homeDir = homedir9()) {
+function readConfiguredAccountId(env = process.env, homeDir = heyspexHome2()) {
   return resolveSessionOwnerUncached({ env, homeDir });
 }
 function isInteractiveTerminal() {
@@ -2966,7 +3048,7 @@ function isInteractiveTerminal() {
 }
 function defaultIdentityGateIo(opts) {
   const consoleUrl = opts.consoleUrl.trim().replace(/\/+$/, "");
-  const loginCli = [opts.platformRoot, resolveCodeRoot({})].filter((r) => Boolean(r && r.trim())).map((r) => join9(r, "vendor", "heyspex-mcp", "cli.mjs")).find((p) => existsSync4(p));
+  const loginCli = [opts.platformRoot, resolveCodeRoot({})].filter((r) => Boolean(r && r.trim())).map((r) => join10(r, "vendor", "heyspex-mcp", "cli.mjs")).find((p) => existsSync5(p));
   return {
     consoleUrl,
     interactive: opts.interactive ?? isInteractiveTerminal(),
@@ -3014,8 +3096,7 @@ function defaultIdentityGateIo(opts) {
 init_sql_orm_inert_cli_shim();
 
 // spex-console/src/lib/cli/vault-workspace-shared.ts
-import { readFileSync as readFileSync8 } from "node:fs";
-import os2 from "node:os";
+import { readFileSync as readFileSync9 } from "node:fs";
 
 // spex-console/src/lib/cli/default-workspace.ts
 function defaultWorkspaceId(accountId2) {
@@ -3027,8 +3108,8 @@ function defaultWorkspaceId(accountId2) {
 function resolveConfiguredAccountId(opts = {}) {
   return resolveSessionOwnerUncached({
     env: opts.env ?? process.env,
-    homeDir: opts.homeDir ?? os2.homedir(),
-    readFile: opts.readFile ?? ((p) => readFileSync8(p, "utf-8"))
+    homeDir: opts.homeDir ?? heyspexHome2(),
+    readFile: opts.readFile ?? ((p) => readFileSync9(p, "utf-8"))
   });
 }
 var CLOUD_ACCOUNT_ID_REQUIRED_MESSAGE = "refusing -- no signed-in account (no HS_ACCOUNT_ID env var, and no account_id: in ~/.heyspex/config.yaml). Run `hs login` first; nothing was written.";
@@ -3036,7 +3117,11 @@ function resolveCloudAccountIdOrRefuse(opts = {}) {
   const accountId2 = resolveConfiguredAccountId(opts);
   return accountId2 ? { ok: true, accountId: accountId2 } : { ok: false, message: CLOUD_ACCOUNT_ID_REQUIRED_MESSAGE };
 }
+var VAULT_OWNED_BY_OTHER_ACCOUNT = "vault_owned_by_other_account";
 var WORKSPACE_OWNED_BY_OTHER_ACCOUNT = "workspace_owned_by_other_account";
+function workspaceNotOwnedByCallerMessage(id) {
+  return `workspace "${id}" belongs to another HeySpex account, so nothing was changed. Only the account that owns a workspace can rename, archive, restore or unregister it (\`hs login --switch-account\` to act as that account).`;
+}
 function workspaceOwnedByOtherAccountMessage(id) {
   return `workspace "${id}" belongs to another HeySpex account, so nothing was changed. Pick a different workspace id (e.g. \`--workspace <new-id>\`), or sign in as the account that owns it (\`hs login --switch-account\`). Transferring a workspace between accounts is not supported.`;
 }
@@ -3105,8 +3190,14 @@ async function mutateHttp(http, method, path4, body, landed) {
   const res = await cloudHttpRequest(http, method, path4, body);
   if (res.ok) return landed;
   if (res.status === 404) return "not_found";
+  if (res.status === 403 && isOwnedByOtherAccountCode(errorCodeOf(res.json))) {
+    return "owned_by_other_account";
+  }
   return cloudWriteFailure(http, res);
 }
+function isOwnedByOtherAccountCode(code) {
+  return code === VAULT_OWNED_BY_OTHER_ACCOUNT || code === WORKSPACE_OWNED_BY_OTHER_ACCOUNT;
+}
 function manageVerbPath(kind, id) {
   return `/api/${kind}/${encodeURIComponent(id)}`;
 }
@@ -3463,18 +3554,31 @@ async function listWorkspacesNeon(accountId2, deps = {}) {
       id: workspaces.id,
       displayName: workspaces.displayName,
       githubOrg: workspaces.githubOrg,
-      createdAt: workspaces.createdAt
+      createdAt: workspaces.createdAt,
+      archived: workspaces.archived
     }).from(workspaces).where(eq(workspaces.accountId, accountId2));
     return rows.map((r) => ({
       id: r.id,
       display_name: r.displayName,
       created_at: (r.createdAt instanceof Date ? r.createdAt : /* @__PURE__ */ new Date()).toISOString(),
+      // The flag `setWorkspaceArchivedNeon` writes; `list.ts` filters on it.
+      // On a cloud host this row IS the roster (no registry.json to carry the
+      // flag), so leaving it out made an archived workspace list forever.
+      archived: r.archived,
       ...r.githubOrg ? { github_org: r.githubOrg } : {}
     }));
   } catch {
     return null;
   }
 }
+async function classifyZeroRowWorkspaceWrite(db, id, accountId2) {
+  try {
+    const rows = await db.select({ accountId: workspaces.accountId }).from(workspaces).where(eq(workspaces.id, id)).limit(1);
+    return rows[0] && rows[0].accountId !== accountId2 ? "owned_by_other_account" : "not_found";
+  } catch {
+    return "not_found";
+  }
+}
 async function renameWorkspaceNeon(id, displayName, accountId2, deps = {}) {
   if (shouldUseCloudHttp(deps)) {
     return mutateHttp(
@@ -3489,7 +3593,7 @@ async function renameWorkspaceNeon(id, displayName, accountId2, deps = {}) {
   try {
     const db = deps.db ?? getPostgresDb();
     const rows = await db.update(workspaces).set({ displayName }).where(and(eq(workspaces.id, id), eq(workspaces.accountId, accountId2))).returning({ id: workspaces.id });
-    return rows.length > 0 ? "updated" : "not_found";
+    return rows.length > 0 ? "updated" : classifyZeroRowWorkspaceWrite(db, id, accountId2);
   } catch {
     return "unreachable";
   }
@@ -3508,7 +3612,7 @@ async function setWorkspaceArchivedNeon(id, archived, accountId2, deps = {}) {
   try {
     const db = deps.db ?? getPostgresDb();
     const rows = await db.update(workspaces).set({ archived }).where(and(eq(workspaces.id, id), eq(workspaces.accountId, accountId2))).returning({ id: workspaces.id });
-    return rows.length > 0 ? "updated" : "not_found";
+    return rows.length > 0 ? "updated" : classifyZeroRowWorkspaceWrite(db, id, accountId2);
   } catch {
     return "unreachable";
   }
@@ -3521,7 +3625,7 @@ async function deleteWorkspaceNeon(id, accountId2, deps = {}) {
   try {
     const db = deps.db ?? getPostgresDb();
     const rows = await db.delete(workspaces).where(and(eq(workspaces.id, id), eq(workspaces.accountId, accountId2))).returning({ id: workspaces.id });
-    return rows.length > 0 ? "deleted" : "not_found";
+    return rows.length > 0 ? "deleted" : classifyZeroRowWorkspaceWrite(db, id, accountId2);
   } catch {
     return "unreachable";
   }
@@ -3561,17 +3665,57 @@ async function repointActiveWorkspaceOnRemoval(accountId2, removedWorkspaceId, d
   return { repointed: true, newActiveId: candidate.id };
 }
 
+// spex-console/src/lib/vault-registry/side-effects.ts
+function isLocalRegistryHost() {
+  const override = process.env.HEYSPEX_VAULT_WRITE_MODE?.trim().toLowerCase();
+  if (override === "cloud") return false;
+  if (override === "local") return true;
+  return process.env.VERCEL !== "1";
+}
+function sideEffectErrorMessage(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+function runRegistrySideEffect(write) {
+  const step = "registry_json";
+  if (!isLocalRegistryHost()) return { step, ok: true, skipped: true };
+  try {
+    write();
+    return { step, ok: true };
+  } catch (err) {
+    const error = sideEffectErrorMessage(err);
+    console.error(`[vault-registry] post-write side step "${step}" failed: ${error}`);
+    return { step, ok: false, error };
+  }
+}
+function registryWritten(effect) {
+  return effect.ok && effect.skipped !== true;
+}
+
 // spex-console/src/lib/vault-registry/archive.ts
 function cloudWriteFailed(failure) {
   return { ok: false, code: "cloud_write_failed", message: failure.message };
 }
+function neonUnwritten(kind, id) {
+  return {
+    ok: false,
+    code: "neon_unwritten",
+    message: `${kind} "${id}" was not written to the cloud registry (database unreachable); nothing was changed. Retry once the console can reach its database.`
+  };
+}
 function workspaceNotFound(id) {
   return { ok: false, code: "workspace_not_found", message: `workspace "${id}" not found` };
 }
+function workspaceNotOwned(id) {
+  return {
+    ok: false,
+    code: WORKSPACE_OWNED_BY_OTHER_ACCOUNT,
+    message: workspaceNotOwnedByCallerMessage(id)
+  };
+}
 async function setWorkspaceArchivedState(input, archived, deps = {}) {
-  const registry = loadVaultRegistry(deps.registryOpts);
-  const existing = registry.workspaces.find((w) => w.id === input.id);
-  if (!existing) return workspaceNotFound(input.id);
+  const local = isLocalRegistryHost();
+  const existing = local ? loadVaultRegistry(deps.registryOpts).workspaces.find((w) => w.id === input.id) : void 0;
+  if (local && !existing) return workspaceNotFound(input.id);
   const neonResult = await setWorkspaceArchivedNeon(
     input.id,
     archived,
@@ -3579,21 +3723,23 @@ async function setWorkspaceArchivedState(input, archived, deps = {}) {
     deps.neon ?? {}
   );
   if (neonResult === "not_found") return workspaceNotFound(input.id);
+  if (neonResult === "owned_by_other_account") return workspaceNotOwned(input.id);
   if (isCloudWriteFailure(neonResult)) return cloudWriteFailed(neonResult);
+  if (neonResult === "unreachable" && !existing) return neonUnwritten("workspace", input.id);
   if (archived) {
     await repointActiveWorkspaceOnRemoval(input.accountId, input.id, {
       registryOpts: deps.registryOpts,
       accountPointer: { ...deps.neon, registryOpts: deps.registryOpts }
     });
   }
-  registerWorkspace({ ...existing, archived }, deps.registryOpts);
+  if (existing) registerWorkspace({ ...existing, archived }, deps.registryOpts);
   return {
     ok: true,
     workspace: {
       id: input.id,
       archived,
       neon_written: neonResult === "updated",
-      registry_written: true
+      registry_written: existing !== void 0
     }
   };
 }
@@ -3632,35 +3778,7 @@ function buildCloseNotDestroyConfirm(kind, verb, displayName) {
 }
 
 // spex-console/src/lib/vault-registry/list.ts
-import { existsSync as existsSync5 } from "node:fs";
-
-// spex-console/src/lib/vault-registry/side-effects.ts
-function isLocalRegistryHost() {
-  const override = process.env.HEYSPEX_VAULT_WRITE_MODE?.trim().toLowerCase();
-  if (override === "cloud") return false;
-  if (override === "local") return true;
-  return process.env.VERCEL !== "1";
-}
-function sideEffectErrorMessage(err) {
-  return err instanceof Error ? err.message : String(err);
-}
-function runRegistrySideEffect(write) {
-  const step = "registry_json";
-  if (!isLocalRegistryHost()) return { step, ok: true, skipped: true };
-  try {
-    write();
-    return { step, ok: true };
-  } catch (err) {
-    const error = sideEffectErrorMessage(err);
-    console.error(`[vault-registry] post-write side step "${step}" failed: ${error}`);
-    return { step, ok: false, error };
-  }
-}
-function registryWritten(effect) {
-  return effect.ok && effect.skipped !== true;
-}
-
-// spex-console/src/lib/vault-registry/list.ts
+import { existsSync as existsSync6 } from "node:fs";
 function pointerDeps2(deps) {
   return deps.accountPointer ?? { registryOpts: deps.registryOpts };
 }
@@ -3902,6 +4020,25 @@ var MAX_DISPLAY_NAME_LEN2 = 60;
 function notFound(id) {
   return { ok: false, code: "workspace_not_found", message: `workspace "${id}" not found` };
 }
+function notOwned(id) {
+  return {
+    ok: false,
+    code: WORKSPACE_OWNED_BY_OTHER_ACCOUNT,
+    message: workspaceNotOwnedByCallerMessage(id)
+  };
+}
+function neonUnwritten2(id) {
+  return {
+    ok: false,
+    code: "neon_unwritten",
+    message: `workspace "${id}" was not written to the cloud registry (database unreachable); nothing was changed. Retry once the console can reach its database.`
+  };
+}
+function localRow(id, registryOpts) {
+  const local = isLocalRegistryHost();
+  const existing = local ? loadVaultRegistry(registryOpts).workspaces.find((w) => w.id === id) : void 0;
+  return { local, existing };
+}
 function cloudWriteFailed2(failure) {
   return { ok: false, code: "cloud_write_failed", message: failure.message };
 }
@@ -3914,9 +4051,8 @@ async function renameWorkspace(input, deps = {}) {
       message: `display name must be 1-${MAX_DISPLAY_NAME_LEN2} characters (trimmed)`
     };
   }
-  const registry = loadVaultRegistry(deps.registryOpts);
-  const existing = registry.workspaces.find((w) => w.id === input.id);
-  if (!existing) return notFound(input.id);
+  const { local, existing } = localRow(input.id, deps.registryOpts);
+  if (local && !existing) return notFound(input.id);
   const neonResult = await renameWorkspaceNeon(
     input.id,
     trimmedName,
@@ -3924,42 +4060,41 @@ async function renameWorkspace(input, deps = {}) {
     deps.neon ?? {}
   );
   if (neonResult === "not_found") return notFound(input.id);
+  if (neonResult === "owned_by_other_account") return notOwned(input.id);
   if (isCloudWriteFailure(neonResult)) return cloudWriteFailed2(neonResult);
-  registerWorkspace(
-    {
-      ...existing,
-      display_name: trimmedName
-    },
-    deps.registryOpts
-  );
+  if (neonResult === "unreachable" && !existing) return neonUnwritten2(input.id);
+  if (existing) {
+    registerWorkspace({ ...existing, display_name: trimmedName }, deps.registryOpts);
+  }
   return {
     ok: true,
     workspace: {
       id: input.id,
       display_name: trimmedName,
       neon_written: neonResult === "updated",
-      registry_written: true
+      registry_written: existing !== void 0
     }
   };
 }
 async function unregisterWorkspace(input, deps = {}) {
-  const registry = loadVaultRegistry(deps.registryOpts);
-  const existing = registry.workspaces.find((w) => w.id === input.id);
-  if (!existing) return notFound(input.id);
+  const { local, existing } = localRow(input.id, deps.registryOpts);
+  if (local && !existing) return notFound(input.id);
   const neonResult = await deleteWorkspaceNeon(input.id, input.accountId, deps.neon ?? {});
   if (neonResult === "not_found") return notFound(input.id);
+  if (neonResult === "owned_by_other_account") return notOwned(input.id);
   if (isCloudWriteFailure(neonResult)) return cloudWriteFailed2(neonResult);
+  if (neonResult === "unreachable" && !existing) return neonUnwritten2(input.id);
   await repointActiveWorkspaceOnRemoval(input.accountId, input.id, {
     registryOpts: deps.registryOpts,
     accountPointer: { ...deps.neon, registryOpts: deps.registryOpts }
   });
-  removeWorkspace(input.id, deps.registryOpts);
+  if (existing) removeWorkspace(input.id, deps.registryOpts);
   return {
     ok: true,
     workspace: {
       id: input.id,
       neon_written: neonResult === "deleted",
-      registry_written: true
+      registry_written: existing !== void 0
     }
   };
 }
@@ -4632,7 +4767,10 @@ async function activeWorkspaceSelection(deps, effectiveAccountId = accountId(dep
 }
 function statusForWorkspaceManageError(code) {
   if (code === "workspace_not_found" || code === "vault_not_found") return EXIT.NOT_FOUND;
-  if (code === "cloud_write_failed") return EXIT.CLOUD_WRITE_FAILED;
+  if (code === "workspace_owned_by_other_account" || code === "vault_owned_by_other_account") {
+    return EXIT.CONFLICT;
+  }
+  if (code === "cloud_write_failed" || code === "neon_unwritten") return EXIT.CLOUD_WRITE_FAILED;
   return EXIT.INVALID_ARG;
 }
 async function runRename(args, deps) {
@@ -4827,7 +4965,7 @@ var HELP3 = [
 ].join("\n");
 
 // spex-console/bin/run-entry.ts
-import process2 from "node:process";
+import process3 from "node:process";
 var BinExit = class extends Error {
   code;
   constructor(code) {
@@ -4843,13 +4981,13 @@ function runEntry(name, main2, options = {}) {
       await main2();
     } catch (err) {
       if (err instanceof BinExit) {
-        process2.exitCode = err.code;
+        process3.exitCode = err.code;
         return;
       }
       const message2 = err instanceof Error ? err.message : String(err);
-      process2.stderr.write(`${name}: ${unhandledLabel}: ${message2}
+      process3.stderr.write(`${name}: ${unhandledLabel}: ${message2}
 `);
-      process2.exitCode = fallbackCode;
+      process3.exitCode = fallbackCode;
     }
   })();
 }
@@ -4857,15 +4995,15 @@ function runEntry(name, main2, options = {}) {
 // spex-console/bin/hs-workspace.ts
 function readFile(p) {
   try {
-    return readFileSync9(p, "utf8");
+    return readFileSync10(p, "utf8");
   } catch {
     return null;
   }
 }
-var INTERACTIVE = process3.stdin.isTTY === true;
+var INTERACTIVE = process4.stdin.isTTY === true;
 async function confirm(question) {
   if (!INTERACTIVE) return false;
-  const rl = createInterface2({ input: process3.stdin, output: process3.stdout });
+  const rl = createInterface2({ input: process4.stdin, output: process4.stdout });
   try {
     const answer = (await rl.question(question)).trim().toLowerCase();
     return answer === "y" || answer === "yes" || answer === "proceed";
@@ -4874,41 +5012,41 @@ async function confirm(question) {
   }
 }
 async function main() {
-  const identityArgv = extractWriteIdentityFlags(process3.argv.slice(3));
+  const identityArgv = extractWriteIdentityFlags(process4.argv.slice(3));
   if (identityArgv.error) {
-    process3.stderr.write(`hs workspace: ${identityArgv.error}
+    process4.stderr.write(`hs workspace: ${identityArgv.error}
 `);
-    process3.exitCode = EXIT.INVALID_ARG;
+    process4.exitCode = EXIT.INVALID_ARG;
     return;
   }
   const parsed = parseWorkspaceArgs(identityArgv.rest);
   if (parsed.help) {
-    process3.stdout.write(`${HELP3}
+    process4.stdout.write(`${HELP3}
 `);
-    process3.exitCode = EXIT.OK;
+    process4.exitCode = EXIT.OK;
     return;
   }
   if (parsed.error) {
-    process3.stderr.write(`hs workspace: ${parsed.error.message}
+    process4.stderr.write(`hs workspace: ${parsed.error.message}
 `);
-    process3.exitCode = parsed.error.code;
+    process4.exitCode = parsed.error.code;
     return;
   }
-  const vaultRoot = process3.env.HS_VAULT_ROOT ? path3.resolve(process3.env.HS_VAULT_ROOT) : process3.cwd();
+  const vaultRoot = process4.env.HS_VAULT_ROOT ? path3.resolve(process4.env.HS_VAULT_ROOT) : process4.cwd();
   const consoleUrl = resolveSpexConsoleUrl(vaultRoot, readFile);
   const gate = await gateWriteVerb({
     namespace: "hs workspace",
     sub: parsed.args.sub,
     writeVerbs: WORKSPACE_WRITE_VERBS,
     flags: identityArgv.flags,
-    io: defaultIdentityGateIo({ consoleUrl, platformRoot: path3.resolve(process3.cwd(), "..") })
+    io: defaultIdentityGateIo({ consoleUrl, platformRoot: path3.resolve(process4.cwd(), "..") })
   });
   if (gate && !gate.ok) {
-    process3.stderr.write(
+    process4.stderr.write(
       `${parsed.args.json ? JSON.stringify(gate.result.payload) : gate.result.message}
 `
     );
-    process3.exitCode = gate.result.code;
+    process4.exitCode = gate.result.code;
     return;
   }
   const result = await runWorkspace(parsed.args, {
@@ -4916,9 +5054,9 @@ async function main() {
     confirm,
     neon: { http: { fetchImpl: fetch, consoleUrl, token: readPairedToken() } }
   });
-  const sink = result.isError ? process3.stderr : process3.stdout;
+  const sink = result.isError ? process4.stderr : process4.stdout;
   sink.write(`${parsed.args.json ? JSON.stringify(result.payload) : result.message}
 `);
-  process3.exitCode = result.code;
+  process4.exitCode = result.code;
 }
 runEntry("hs workspace", main, { fallbackCode: EXIT.WRITE_FAILED });