runwork 0.15.1 → 0.16.0

package/dist/commands/sync.js

@@ -1,702 +0,0 @@
-import { Command } from 'commander';
-import { readFileSync, writeFileSync, existsSync } from 'fs';
-import { join } from 'path';
-import { homedir } from 'os';
-import { requireAuth } from '../auth/store.js';
-import { ApiClient } from '../api/client.js';
-import { getAdapterBySlug, detectAgents } from '../agents/detect.js';
-import { CodexAdapter } from '../agents/codex.js';
-import { RUNWORK_MCP_PREFIX, RUNWORK_WORKSPACE_MCP_NAME } from '../agents/types.js';
-import { buildExternalMcpEntries } from './mcp-entries.js';
-import { RUNWORK_AGENT_DEFAULTS, AGENT_DEFAULTS_SCHEMA_VERSION } from '../agents/default-config.js';
-import { resolveAgentDefaults } from '../agents/defaults-merge.js';
-import { collectTelemetryEvents, printTelemetryVerbose, summarizeTelemetryForDryRun, } from './sync-telemetry.js';
-import { generateIntroSkill, generateInstructionHint, buildAppSkillDescription } from '../agents/intro-skill.js';
-import { buildShareConversationSkill, buildSaveConversationSkill, BUILT_IN_SKILL_NAMES } from '../agents/conversation-skills.js';
-import { computeSyncPlan } from '../sync/change-detect.js';
-import { printSyncSummary, resolveConflict, resolveConflictNonInteractive } from '../sync/conflict-ui.js';
-import { executeSyncPlan } from '../sync/executor.js';
-import { getRegistryAgent, resolveToAbsolute, isConnectOnlyAgent } from '../agents/registry.js';
-function loadSetupState(filePath) {
-    if (!existsSync(filePath))
-        return null;
-    try {
-        return JSON.parse(readFileSync(filePath, 'utf-8'));
-    }
-    catch {
-        return null;
-    }
-}
-/**
- * Read local skill content from the first configured agent's skill directory.
- */
-function readLocalSkills(state) {
-    const results = [];
-    if (!state.skills || state.skills.length === 0)
-        return results;
-    for (const slug of state.configuredAgents) {
-        const def = getRegistryAgent(slug);
-        if (!def?.skillsPaths)
-            continue;
-        const useScope = state.scope === 'both' ? 'user' : state.scope;
-        const pathTemplate = useScope === 'project' ? def.skillsPaths.project : def.skillsPaths.global;
-        if (!pathTemplate)
-            continue;
-        const baseDir = resolveToAbsolute(pathTemplate, useScope === 'project' ? 'project' : 'global');
-        if (!baseDir)
-            continue;
-        for (const skillName of state.skills) {
-            // Try SKILL.md in subdirectory
-            const skillMdPath = join(baseDir, skillName, 'SKILL.md');
-            if (existsSync(skillMdPath)) {
-                results.push({ name: skillName, content: readFileSync(skillMdPath, 'utf-8') });
-                continue;
-            }
-            // Try flat file
-            const filename = skillName.toLowerCase().replace(/[^a-z0-9]+/g, '-');
-            const flatPath = join(baseDir, `${filename}.md`);
-            if (existsSync(flatPath)) {
-                results.push({ name: skillName, content: readFileSync(flatPath, 'utf-8') });
-            }
-        }
-        if (results.length > 0)
-            break;
-    }
-    return results;
-}
-/**
- * How long a detection result stays trusted before sync re-runs detection
- * on its own. Detection is cheap on macOS/Linux but pays a PowerShell
- * waterfall on Windows, so we cache for a day. Users who just installed
- * a new agent can shortcut the wait via `--redetect` (or the desktop's
- * "Rescan" button, which forwards the flag).
- */
-export const REDETECT_TTL_MS = 24 * 60 * 60 * 1000;
-/**
- * Decide whether to re-run installation detection for this sync. We always
- * re-detect on explicit user request, on first sync (no timestamp yet), when
- * setup ended up with zero agents (recovery), or after the TTL has lapsed.
- */
-export function shouldRedetect(state, opts) {
-    if (opts.redetect)
-        return true;
-    if (state.configuredAgents.length === 0)
-        return true;
-    if (!state.lastDetectedAt)
-        return true;
-    const last = Date.parse(state.lastDetectedAt);
-    if (Number.isNaN(last))
-        return true;
-    return Date.now() - last > REDETECT_TTL_MS;
-}
-/**
- * Detect installed agents and merge any new slugs into `state.configuredAgents`.
- * Never removes agents — a transient PATH glitch shouldn't wipe the setup.
- * Returns the slugs that were newly added (for logging).
- */
-export async function refreshConfiguredAgents(state) {
-    const detected = await detectAgents();
-    const before = new Set(state.configuredAgents);
-    const added = [];
-    for (const adapter of detected) {
-        if (!before.has(adapter.slug)) {
-            state.configuredAgents.push(adapter.slug);
-            added.push(adapter.slug);
-        }
-    }
-    state.lastDetectedAt = new Date().toISOString();
-    return added;
-}
-export async function syncFromState(state, statePath, credentials, opts) {
-    const client = new ApiClient(credentials);
-    // Refresh workspace name/slug if missing or stale (e.g. setup ran before name was set)
-    if (!state.workspaceName || state.workspaceName === state.workspaceId || !state.workspaceSlug) {
-        try {
-            const workspaces = await client.listWorkspaces();
-            const ws = workspaces.find(w => w.id === state.workspaceId);
-            if (ws?.name)
-                state.workspaceName = ws.name;
-            if (ws?.slug)
-                state.workspaceSlug = ws.slug;
-        }
-        catch {
-            // Best-effort, keep existing values
-        }
-    }
-    console.log(`Syncing workspace: ${state.workspaceName || state.workspaceId}`);
-    // Refresh the configured-agents list when the cached detection is stale,
-    // empty, or the user explicitly asked. This is what catches "I just installed
-    // Claude Code on this machine" without needing the user to re-run setup.
-    if (shouldRedetect(state, opts)) {
-        console.log('  Detecting installed agents...');
-        const added = await refreshConfiguredAgents(state);
-        if (added.length > 0) {
-            console.log(`  Detected new agent${added.length > 1 ? 's' : ''}: ${added.join(', ')}`);
-        }
-    }
-    console.log('  Fetching workspace data...');
-    // Fetch latest data (includeContent=true gets all skill content in one request)
-    const [allSkills, mcpServers, externalSkills, registries, connectedIntegrations, resolvedMcpCredentials] = await Promise.all([
-        client.listWorkspaceSkills(state.workspaceId, true),
-        client.listMcpServers(state.workspaceId),
-        client.listExternalSkills(state.workspaceId),
-        client.getWorkspaceAll(state.workspaceId).catch(() => null),
-        client.listConnectedIntegrations(state.workspaceId)
-            .then(list => list.map(i => i.canonicalId ?? i.integrationId))
-            .catch(() => []),
-        // Decrypted auth headers for header-auth servers, scoped to this user.
-        // Tolerate older backends that lack the endpoint.
-        client.resolveMcpCredentials(state.workspaceId).catch(() => ({})),
-    ]);
-    const appCount = allSkills.filter(s => s.type === 'app').length;
-    const parts = [];
-    if (appCount > 0)
-        parts.push(`${appCount} app${appCount > 1 ? 's' : ''}`);
-    if (externalSkills.length > 0)
-        parts.push(`${externalSkills.length} skill${externalSkills.length > 1 ? 's' : ''}`);
-    if (mcpServers.length > 0)
-        parts.push(`${mcpServers.filter(s => s.enabled).length} MCP server${mcpServers.filter(s => s.enabled).length > 1 ? 's' : ''}`);
-    if (connectedIntegrations.length > 0)
-        parts.push(`${connectedIntegrations.length} integration${connectedIntegrations.length > 1 ? 's' : ''}`);
-    if (registries) {
-        if (registries.entities.length > 0)
-            parts.push(`${registries.entities.length} entit${registries.entities.length > 1 ? 'ies' : 'y'}`);
-        if (registries.workflows.length > 0)
-            parts.push(`${registries.workflows.length} workflow${registries.workflows.length > 1 ? 's' : ''}`);
-        if (registries.agents.length > 0)
-            parts.push(`${registries.agents.length} agent${registries.agents.length > 1 ? 's' : ''}`);
-    }
-    if (parts.length > 0) {
-        console.log(`  Found: ${parts.join(', ')}`);
-    }
-    // Build MCP entries (pull-only)
-    const baseUrl = credentials.baseUrl || 'https://runwork.ai';
-    const mcpEntries = buildExternalMcpEntries(mcpServers, resolvedMcpCredentials);
-    mcpEntries.push({
-        name: RUNWORK_WORKSPACE_MCP_NAME,
-        url: `${baseUrl}/api/workspaces/${state.workspaceId}/mcp`,
-        transport: 'streamable-http',
-        headers: { Authorization: `Bearer ${credentials.apiKey}` },
-        description: 'Runwork workspace tools: query entities, trigger workflows, manage integrations, run agents, and access shared data across your team\'s apps.',
-    });
-    // Build remote skills list
-    const remoteSkills = [];
-    for (const s of externalSkills) {
-        remoteSkills.push({ name: s.name, content: s.content, source: 'external', remoteId: s.id });
-    }
-    for (const s of allSkills) {
-        if (s.type === 'app' && s.appId && s.content?.trim()) {
-            remoteSkills.push({ name: s.name, content: s.content, source: 'app', appId: s.appId });
-        }
-    }
-    // Read local skills for change detection
-    const localSkills = readLocalSkills(state);
-    // Built-in skills (shipped by the CLI from code) are CANONICAL: they
-    // are never pushed to the workspace and never pulled from it. The diff
-    // engine must not see them at all -- if it did, a workspace skill that
-    // happens to share a name (e.g. someone uploaded `share-conversation`
-    // manually) would either push the built-in upstream or pull the stale
-    // workspace copy on top, both wrong. Filter both sides before the diff.
-    const builtInNameSet = new Set(BUILT_IN_SKILL_NAMES);
-    const collidingRemote = remoteSkills.filter(s => builtInNameSet.has(s.name));
-    if (collidingRemote.length > 0) {
-        console.log(`\n  Warning: ${collidingRemote.length} workspace skill${collidingRemote.length === 1 ? '' : 's'} ` +
-            `shadow${collidingRemote.length === 1 ? 's' : ''} built-in CLI skill${collidingRemote.length === 1 ? '' : 's'}: ` +
-            `${collidingRemote.map(s => s.name).join(', ')}. The CLI built-in versions will be used locally; ` +
-            `the workspace copies are stale duplicates and can be safely deleted from the dashboard.`);
-    }
-    const localSkillsForDiff = localSkills.filter(s => !builtInNameSet.has(s.name));
-    const remoteSkillsForDiff = remoteSkills.filter(s => !builtInNameSet.has(s.name));
-    // Compute sync plan
-    const plan = computeSyncPlan({
-        storedHashes: state.skillHashes || {},
-        localSkills: localSkillsForDiff,
-        remoteSkills: remoteSkillsForDiff,
-    });
-    // In pull-only mode, move pushes and conflicts to skips
-    if (opts.pullOnly) {
-        plan.skips.push(...plan.pushes.map(p => ({ ...p, action: 'skip' })));
-        plan.pushes = [];
-        plan.skips.push(...plan.conflicts.map(c => ({ ...c, action: 'skip' })));
-        plan.conflicts = [];
-    }
-    // Display summary
-    const hasChanges = plan.pulls.length > 0 || plan.pushes.length > 0 || plan.conflicts.length > 0 || plan.deletions.length > 0;
-    if (hasChanges) {
-        printSyncSummary(plan);
-    }
-    else {
-        console.log('  All skills up to date.');
-    }
-    // Build adapters early so telemetry collection works in both dry-run and real paths
-    const adapters = [];
-    for (const slug of state.configuredAgents) {
-        const adapter = getAdapterBySlug(slug);
-        if (adapter)
-            adapters.push(adapter);
-    }
-    if (opts.dryRun) {
-        try {
-            const telemetry = await collectTelemetryEvents({
-                adapters,
-                state,
-                syncedSkillsCount: remoteSkills.length,
-                syncedMcpServersCount: mcpEntries.length,
-                teamInstructionsApplied: false,
-                agentConfigsApplied: 0,
-            });
-            if (opts.verbose) {
-                printTelemetryVerbose(telemetry);
-            }
-            else {
-                console.log(`\n  ${summarizeTelemetryForDryRun(telemetry)}`);
-            }
-        }
-        catch {
-            // Telemetry preview is best-effort
-        }
-        return;
-    }
-    // Resolve conflicts
-    const resolvedConflicts = new Map();
-    for (const conflict of plan.conflicts) {
-        if (opts.yes || !process.stdout.isTTY) {
-            const nonInteractiveResolution = resolveConflictNonInteractive(opts.prefer || 'remote');
-            if (nonInteractiveResolution !== 'skip') {
-                resolvedConflicts.set(conflict.name, nonInteractiveResolution);
-            }
-        }
-        else {
-            const resolution = await resolveConflict(conflict);
-            if (resolution !== 'skip') {
-                resolvedConflicts.set(conflict.name, resolution);
-            }
-        }
-    }
-    const scopes = state.scope === 'both' ? ['project', 'user'] : [state.scope];
-    if (adapters.length > 0) {
-        console.log(`  Syncing to: ${adapters.map(a => a.name).join(', ')}`);
-    }
-    // Execute skill sync plan
-    const newHashes = await executeSyncPlan(plan, resolvedConflicts, {
-        client,
-        workspaceId: state.workspaceId,
-        adapters,
-        scopes,
-        hasMcp: mcpEntries.length > 0,
-    });
-    // Write intro skill, MCP configs, instruction hints (pull-only)
-    const introSkill = generateIntroSkill({
-        workspaceName: state.workspaceName || state.workspaceId,
-        workspaceId: state.workspaceId,
-        workspaceSlug: state.workspaceSlug,
-        registries,
-        connectedIntegrations,
-        mcpServerCount: mcpEntries.length,
-        skillCount: remoteSkills.length,
-        mcpServerNames: mcpEntries.map(e => e.name.replace(RUNWORK_MCP_PREFIX, '')),
-        skillNames: remoteSkills.map(s => s.name),
-    });
-    const instructionHint = generateInstructionHint({
-        workspaceName: state.workspaceName || state.workspaceId,
-        workspaceId: state.workspaceId,
-        workspaceSlug: state.workspaceSlug,
-        registries,
-        connectedIntegrations,
-        appCount: allSkills.filter(s => s.type === 'app').length,
-        skillCount: remoteSkills.length,
-        mcpServerCount: mcpEntries.length,
-        persona: state.persona,
-    });
-    // For project scope: determine which app skill to include (only current app's skill)
-    let projectAppSkillFilter = null;
-    if (existsSync('.runwork.json')) {
-        try {
-            const config = JSON.parse(readFileSync('.runwork.json', 'utf-8'));
-            if (config.appName) {
-                projectAppSkillFilter = config.appName.toLowerCase().replace(/[^a-z0-9]+/g, '-');
-            }
-        }
-        catch { /* ignore */ }
-    }
-    // Built-in skills shipped by the CLI on every sync. Named upfront so we can
-    // surface them by name in the per-adapter sync log -- helps users (and
-    // their agents) confirm that /runwork, /share-conversation, etc. landed.
-    const builtInSkills = [
-        introSkill,
-        buildShareConversationSkill(),
-        buildSaveConversationSkill(),
-    ];
-    const builtInNames = builtInSkills.map(s => s.name);
-    // Counters surfaced at the end of the sync as a one-line summary so the
-    // user can see at a glance how much actually got written this run.
-    const summary = {
-        adaptersProcessed: 0,
-        adaptersFailed: 0,
-        skillWrites: 0,
-        skillFilesWritten: 0,
-        mcpServerWrites: 0,
-        instructionHintWrites: 0,
-        hookInstallCalls: 0,
-    };
-    for (const adapter of adapters) {
-        // Connect-only agents (e.g. ChatGPT) have no local files to write; the
-        // connector lives in the user's account. Skip all local-write phases.
-        if (isConnectOnlyAgent(getRegistryAgent(adapter.slug))) {
-            console.log(`  [${adapter.name}] Connect-only agent: no local files to sync`);
-            summary.adaptersProcessed++;
-            continue;
-        }
-        let adapterFailedAnyScope = false;
-        for (const scope of scopes) {
-            try {
-                // Write skills: for project scope, filter to only the current app's skill.
-                // When MCP servers are configured for this adapter, skip app-sourced skills
-                // since the MCP server already exposes them as skill_* tools. Writing both
-                // causes duplicate entries in the agent's skill listing.
-                if (adapter.supportsSkills()) {
-                    const skipAppSkills = adapter.mcpProvidesSkills && mcpEntries.length > 0;
-                    const scopeSkills = remoteSkills.filter(s => {
-                        // Built-in CLI skills are written from the canonical built-in array
-                        // below; a workspace skill with the same name is a shadow that
-                        // would overwrite the built-in if we let it through. Skip it.
-                        if (builtInNameSet.has(s.name))
-                            return false;
-                        // App-sourced skills are already available via MCP skill_* tools
-                        if (skipAppSkills && s.source === 'app')
-                            return false;
-                        if (scope === 'project' && s.source === 'app' && projectAppSkillFilter) {
-                            const filename = s.name.toLowerCase().replace(/[^a-z0-9]+/g, '-');
-                            return filename === projectAppSkillFilter;
-                        }
-                        return true;
-                    });
-                    const workspaceSkillFiles = scopeSkills.map(s => ({
-                        name: s.name,
-                        filename: s.name.toLowerCase().replace(/[^a-z0-9]+/g, '-'),
-                        content: s.content,
-                        description: s.source === 'app'
-                            ? (buildAppSkillDescription(s.name, registries) || `${s.name} - Runwork workspace application`)
-                            : `${s.name} - Runwork workspace skill`,
-                    }));
-                    const allSkillFiles = [...builtInSkills, ...workspaceSkillFiles];
-                    await adapter.writeSkills(allSkillFiles, scope);
-                    summary.skillWrites++;
-                    summary.skillFilesWritten += allSkillFiles.length;
-                    console.log(`  [${adapter.name}] Wrote ${allSkillFiles.length} skills (${scope}): ` +
-                        `${builtInSkills.length} built-in [${builtInNames.join(', ')}], ` +
-                        `${workspaceSkillFiles.length} workspace`);
-                }
-                else {
-                    console.log(`  [${adapter.name}] Skipped skills (${scope}): adapter does not support skills`);
-                }
-                // Write MCP configs
-                if (adapter.supportsMcpScope(scope) && mcpEntries.length > 0) {
-                    await adapter.writeMcpServers(mcpEntries, scope);
-                    summary.mcpServerWrites++;
-                    console.log(`  [${adapter.name}] Updated ${mcpEntries.length} MCP server${mcpEntries.length > 1 ? 's' : ''} (${scope})`);
-                }
-                else if (mcpEntries.length === 0) {
-                    console.log(`  [${adapter.name}] Skipped MCP servers (${scope}): no workspace MCP servers configured`);
-                }
-                else if (!adapter.supportsMcpScope(scope)) {
-                    console.log(`  [${adapter.name}] Skipped MCP servers (${scope}): adapter does not support MCP at this scope`);
-                }
-                // Write instruction hint
-                await adapter.writeInstructionHint(instructionHint, scope);
-                summary.instructionHintWrites++;
-                console.log(`  [${adapter.name}] Updated instruction hints (${scope})`);
-                // Install built-in hooks (Claude Code's SessionStart, etc.). Called
-                // after writeSkills so the plugin tree already exists. Skipped by
-                // adapters that don't implement it.
-                if (adapter.writeBuiltInHooks) {
-                    await adapter.writeBuiltInHooks(scope);
-                    summary.hookInstallCalls++;
-                }
-            }
-            catch (err) {
-                adapterFailedAnyScope = true;
-                console.warn(`  [${adapter.name}] Failed (${scope}): ${err instanceof Error ? err.message : err}`);
-            }
-        }
-        summary.adaptersProcessed++;
-        if (adapterFailedAnyScope)
-            summary.adaptersFailed++;
-    }
-    // Pull team config from server. A failure here must not stop the
-    // unified user-scope write below, which applies network and minimum-permission
-    // floors regardless of whether team config was fetched.
-    let teamInstructionsApplied = false;
-    let agentConfigsApplied = 0;
-    let teamInstructions;
-    let agentConfigs;
-    try {
-        const onboardingConfig = await client.getOnboardingConfig(state.workspaceId);
-        teamInstructions = onboardingConfig?.config?.teamInstructions ?? undefined;
-        agentConfigs = onboardingConfig?.config?.agentConfigs ?? undefined;
-    }
-    catch {
-        // Team config pull is non-fatal — proceed with no team-managed overrides.
-    }
-    // Write team instructions and/or per-agent extra instructions.
-    for (const adapter of adapters) {
-        if (isConnectOnlyAgent(getRegistryAgent(adapter.slug)))
-            continue;
-        if (!adapter.writeTeamInstructions)
-            continue;
-        const agentExtra = agentConfigs?.[adapter.slug]?.extraInstructions;
-        const parts = [teamInstructions, agentExtra].filter(Boolean);
-        if (parts.length === 0)
-            continue;
-        const fullInstructions = parts.join('\n\n');
-        for (const scope of scopes) {
-            try {
-                await adapter.writeTeamInstructions(fullInstructions, scope);
-                teamInstructionsApplied = true;
-                console.log(`  [${adapter.name}] Updated team instructions (${scope})`);
-            }
-            catch {
-                // Best-effort per adapter/scope
-            }
-        }
-    }
-    // Apply per-agent project-scope config (team overrides only).
-    // User scope is handled below in the unified defaults+network+minimum block.
-    if (agentConfigs) {
-        for (const adapter of adapters) {
-            if (isConnectOnlyAgent(getRegistryAgent(adapter.slug)))
-                continue;
-            const agentConfig = agentConfigs[adapter.slug];
-            if (!agentConfig || !adapter.writeAgentConfig)
-                continue;
-            const { extraInstructions: _, ...configWithoutInstructions } = agentConfig;
-            if (Object.keys(configWithoutInstructions).length === 0)
-                continue;
-            for (const scope of scopes) {
-                if (scope === 'user')
-                    continue; // handled in unified block below
-                try {
-                    await adapter.writeAgentConfig(configWithoutInstructions, scope);
-                    agentConfigsApplied++;
-                    const configKeys = Object.keys(configWithoutInstructions).join(', ');
-                    console.log(`  [${adapter.name}] Updated agent config: ${configKeys} (${scope})`);
-                }
-                catch {
-                    // Best-effort per adapter/scope
-                }
-            }
-        }
-    }
-    // Unified user-scope write: merge baked defaults with team config, network
-    // allowlist, and minimum permissions into a single writeAgentConfig call
-    // per adapter. The merge layer tracks injected defaults in state.agentDefaults
-    // so user-removed entries become sticky opt-outs.
-    if (scopes.includes('user')) {
-        const networkDomains = ['runwork.ai', '*.runwork.ai'];
-        try {
-            const baseHost = new URL(baseUrl).hostname;
-            if (baseHost !== 'runwork.ai' && !baseHost.endsWith('.runwork.ai')) {
-                networkDomains.push(baseHost, `*.${baseHost}`);
-            }
-        }
-        catch { /* use defaults */ }
-        // Order arrays list each agent's valid values from most restrictive to most
-        // permissive. The floor logic upgrades anything strictly below `minimum`,
-        // including unknown values (-1 < minimumIdx). That makes it critical to
-        // include the agent's most-permissive option in `order` — otherwise a user
-        // who explicitly set, say, `sandbox_mode = "danger-full-access"` gets
-        // silently downgraded to `workspace-write`.
-        const minimumPermissions = [
-            { field: 'approval_policy', order: ['untrusted', 'on-request', 'on-failure', 'never'], minimum: 'on-request' },
-            { field: 'sandbox_mode', order: ['read-only', 'workspace-write', 'danger-full-access'], minimum: 'workspace-write' },
-        ];
-        // agentDefaults lifecycle: full `runwork uninstall` deletes ~/.runwork
-        // (state and all per-agent defaults state with it). Re-running `runwork
-        // setup` overwrites setup.json without agentDefaults so every remaining
-        // tool bootstraps fresh on the next sync. refreshConfiguredAgents only
-        // adds slugs (never removes), so we don't need orphan-entry pruning here.
-        if (!state.agentDefaults)
-            state.agentDefaults = {};
-        for (const adapter of adapters) {
-            if (isConnectOnlyAgent(getRegistryAgent(adapter.slug)))
-                continue;
-            if (!adapter.writeAgentConfig)
-                continue;
-            const slug = adapter.slug;
-            const baked = RUNWORK_AGENT_DEFAULTS[slug];
-            const agentState = state.agentDefaults[slug];
-            const team = agentConfigs?.[slug];
-            // onDisk = undefined signals "removal detection is not possible" — used for
-            // markerless adapters (Cursor) and for any adapter without readManagedBlock.
-            // The resolver treats undefined differently from an empty array: it skips
-            // opt-out fabrication entirely and trusts the baseline mechanism in the
-            // adapter to preserve user edits via subtraction.
-            let onDisk;
-            if (baked && adapter.readManagedBlock) {
-                try {
-                    onDisk = await adapter.readManagedBlock('user');
-                }
-                catch {
-                    onDisk = undefined;
-                }
-            }
-            const resolved = resolveAgentDefaults({
-                baked,
-                state: agentState,
-                onDisk,
-                team: team?.permissionRules,
-            });
-            const mergedConfig = {
-                modelPreference: team?.modelPreference,
-                permissionRules: (resolved.managedAllow.length || resolved.managedDeny.length || team?.permissionRules?.defaultMode)
-                    ? {
-                        ...(resolved.managedAllow.length ? { allow: resolved.managedAllow } : {}),
-                        ...(resolved.managedDeny.length ? { deny: resolved.managedDeny } : {}),
-                        ...(team?.permissionRules?.defaultMode ? { defaultMode: team.permissionRules.defaultMode } : {}),
-                    }
-                    : undefined,
-                networkAllowlist: networkDomains,
-                minimumPermissions,
-            };
-            try {
-                const baseline = agentState?.lastInjected;
-                await adapter.writeAgentConfig(mergedConfig, 'user', baseline);
-                if (baked) {
-                    const nextState = {
-                        lastInjected: {
-                            allow: resolved.applicableAllow,
-                            deny: resolved.applicableDeny,
-                        },
-                        userOptOuts: {
-                            allow: resolved.newOptOutsAllow,
-                            deny: resolved.newOptOutsDeny,
-                        },
-                    };
-                    state.agentDefaults[slug] = nextState;
-                    // Diagnostic log line (per "invisible / sync log only" policy)
-                    if (resolved.bootstrapped) {
-                        console.log(`  [${adapter.name}] Bootstrapped default-rule tracking (defaults apply on next sync)`);
-                    }
-                    else if (resolved.applicableAllow.length || resolved.applicableDeny.length || resolved.removalsThisSync.allow || resolved.removalsThisSync.deny) {
-                        const totalRemovals = resolved.removalsThisSync.allow + resolved.removalsThisSync.deny;
-                        const removalNote = totalRemovals > 0
-                            ? ` (${totalRemovals} new opt-out${totalRemovals > 1 ? 's' : ''} honored)`
-                            : '';
-                        console.log(`  [${adapter.name}] Applied defaults: ${resolved.applicableAllow.length} allow, ${resolved.applicableDeny.length} deny${removalNote}`);
-                    }
-                }
-                if (team)
-                    agentConfigsApplied++;
-            }
-            catch {
-                // Best-effort per adapter
-            }
-        }
-        state.agentDefaultsVersion = AGENT_DEFAULTS_SCHEMA_VERSION;
-    }
-    // Register ~/.runwork as a project in the Codex desktop app (best-effort).
-    // Only attempts when Codex adapter is configured and the desktop app is closed.
-    for (const adapter of adapters) {
-        if (adapter instanceof CodexAdapter) {
-            const runworkDir = join(homedir(), '.runwork');
-            const result = adapter.registerDesktopWorkspace(runworkDir, 'Runwork');
-            if (result === 'written') {
-                console.log(`  [${adapter.name}] Registered workspace in Codex desktop app`);
-            }
-            // 'app_running' and 'already_registered' are silently skipped
-            break;
-        }
-    }
-    // Update state
-    state.lastSyncAt = new Date().toISOString();
-    state.mcpServers = mcpEntries.map(e => e.name);
-    state.skills = remoteSkills.map(s => s.name);
-    state.skillFilenames = [
-        'runwork', // intro skill is always synced
-        ...remoteSkills.map(s => s.name.toLowerCase().replace(/[^a-z0-9]+/g, '-')),
-    ];
-    // Merge hashes: keep existing for skips, update for everything else
-    const mergedHashes = { ...(state.skillHashes || {}) };
-    for (const [name, hash] of Object.entries(newHashes)) {
-        mergedHashes[name] = hash;
-    }
-    // Remove deleted skills
-    for (const del of plan.deletions) {
-        delete mergedHashes[del.name];
-    }
-    state.skillHashes = mergedHashes;
-    writeFileSync(statePath, JSON.stringify(state, null, 2));
-    // Report telemetry (non-fatal)
-    try {
-        const telemetry = await collectTelemetryEvents({
-            adapters,
-            state,
-            syncedSkillsCount: remoteSkills.length,
-            syncedMcpServersCount: mcpEntries.length,
-            teamInstructionsApplied,
-            agentConfigsApplied,
-        });
-        if (opts.verbose)
-            printTelemetryVerbose(telemetry);
-        await client.reportTelemetry(state.workspaceId, telemetry.events);
-        if (telemetry.healthReported)
-            state.lastHealthReportAt = new Date().toISOString();
-        state.reportedAgentSlugs = [
-            ...new Set([...(state.reportedAgentSlugs ?? []), ...telemetry.newlyReportedAgents]),
-        ];
-        writeFileSync(statePath, JSON.stringify(state, null, 2));
-    }
-    catch {
-        // Telemetry failures are non-fatal
-    }
-    // One-line summary so the user (and any agent reading sync output) can
-    // see at a glance what got written this run, without scrolling the whole
-    // per-adapter log.
-    const summaryParts = [];
-    summaryParts.push(`${summary.adaptersProcessed} adapter${summary.adaptersProcessed === 1 ? '' : 's'}`);
-    if (summary.adaptersFailed > 0)
-        summaryParts.push(`${summary.adaptersFailed} failed`);
-    summaryParts.push(`${summary.skillWrites} skill write${summary.skillWrites === 1 ? '' : 's'} (${summary.skillFilesWritten} files)`);
-    if (summary.mcpServerWrites > 0)
-        summaryParts.push(`${summary.mcpServerWrites} MCP config write${summary.mcpServerWrites === 1 ? '' : 's'}`);
-    if (summary.hookInstallCalls > 0)
-        summaryParts.push(`${summary.hookInstallCalls} hook install${summary.hookInstallCalls === 1 ? '' : 's'}`);
-    summaryParts.push(`${summary.instructionHintWrites} instruction hint write${summary.instructionHintWrites === 1 ? '' : 's'}`);
-    console.log(`\n  Summary: ${summaryParts.join(', ')}.`);
-}
-export const syncCommand = new Command('sync')
-    .description('Sync skills bidirectionally and refresh MCP configs from workspace')
-    .option('--dry-run', 'Show what would change without doing anything (includes telemetry preview)')
-    .option('-v, --verbose', 'Print per-adapter stats and the telemetry envelope')
-    .option('--pull-only', 'Only pull remote changes, never push local edits')
-    .option('--prefer <side>', 'Auto-resolve conflicts: "local" or "remote" (implies --yes)')
-    .option('-y, --yes', 'Non-interactive mode (default: prefer remote for conflicts)')
-    .option('--redetect', 'Force agent-installation re-detection (picks up agents installed since last setup)')
-    .action(async (opts) => {
-    const credentials = requireAuth();
-    const syncOpts = {
-        dryRun: !!opts.dryRun,
-        pullOnly: !!opts.pullOnly,
-        yes: !!opts.yes || !!opts.prefer,
-        prefer: opts.prefer,
-        verbose: !!opts.verbose,
-        redetect: !!opts.redetect,
-    };
-    const projectStatePath = join(process.cwd(), '.runwork', 'setup.json');
-    const userStatePath = join(homedir(), '.runwork', 'setup.json');
-    const projectState = loadSetupState(projectStatePath);
-    const userState = loadSetupState(userStatePath);
-    if (!projectState && !userState) {
-        console.error('No setup state found. Run `runwork setup` first.');
-        process.exit(1);
-    }
-    if (projectState) {
-        await syncFromState(projectState, projectStatePath, credentials, syncOpts);
-    }
-    if (userState) {
-        await syncFromState(userState, userStatePath, credentials, syncOpts);
-    }
-    if (!syncOpts.dryRun) {
-        console.log('\nSync complete.');
-    }
-});