threadnote 0.3.7 → 0.4.0

package/dist/threadnote.cjs

@@ -3489,9 +3489,14 @@ var USER_INSTRUCTIONS_START_MARKER = "<!-- BEGIN THREADNOTE USER INSTRUCTIONS --
 var USER_INSTRUCTIONS_END_MARKER = "<!-- END THREADNOTE USER INSTRUCTIONS -->";
 var USER_MANIFEST_NAME = "seed-manifest.yaml";
 var USER_AGENT_INSTRUCTION_TARGETS = [
-  { label: "codex user instructions", path: "~/.codex/AGENTS.md" },
-  { label: "claude user instructions", path: "~/.claude/CLAUDE.md" },
-  { label: "cursor user rule", path: "~/.cursor/rules/threadnote.md" }
+  { kind: "block", label: "codex user instructions", path: "~/.codex/AGENTS.md" },
+  { kind: "block", label: "claude user instructions", path: "~/.claude/CLAUDE.md" },
+  { kind: "block", label: "cursor user rule", path: "~/.cursor/rules/threadnote.md" },
+  {
+    kind: "file",
+    label: "copilot user instructions",
+    path: "~/.copilot/instructions/threadnote.instructions.md"
+  }
 ];
 var DEFAULT_SEED_PATTERNS = [
   "AGENTS.md",
@@ -3981,6 +3986,7 @@ function errorMessage(err) {
 }
 
 // src/mcp.ts
+var import_node_fs2 = require("node:fs");
 var import_promises2 = require("node:fs/promises");
 var import_node_path2 = require("node:path");
 var import_node_os2 = require("node:os");
@@ -4010,6 +4016,15 @@ async function runMcpInstall(config, agent, options) {
     });
     return;
   }
+  if (agent === "copilot") {
+    await runCopilotMcpInstall(config, name, {
+      apply,
+      bearerTokenEnvVar: options.bearerTokenEnvVar,
+      nativeHttp,
+      url
+    });
+    return;
+  }
   const command = buildMcpInstallCommand(config, agent, name, {
     bearerTokenEnvVar: options.bearerTokenEnvVar,
     nativeHttp,
@@ -4059,6 +4074,34 @@ async function runCursorMcpInstall(config, name, options) {
   await (0, import_promises2.writeFile)(path, nextContent, { encoding: "utf8", mode: 420 });
   console.log(currentContent === void 0 ? `Wrote Cursor MCP config: ${path}` : `Updated Cursor MCP config: ${path}`);
 }
+async function runCopilotMcpInstall(config, name, options) {
+  const path = copilotMcpConfigPath();
+  const serverConfig = buildCopilotMcpServerConfig(config, {
+    bearerTokenEnvVar: options.bearerTokenEnvVar,
+    nativeHttp: options.nativeHttp,
+    url: options.url
+  });
+  const currentContent = await readFileIfExists(path);
+  const nextContent = renderCopilotMcpConfig(currentContent, name, serverConfig);
+  if (!options.apply) {
+    console.log("Dry run. Re-run with --apply to modify GitHub Copilot MCP config.");
+    printCopilotMcpSnippet(config, name, {
+      bearerTokenEnvVar: options.bearerTokenEnvVar,
+      nativeHttp: options.nativeHttp,
+      url: options.url
+    });
+    return;
+  }
+  if (currentContent === nextContent) {
+    console.log(`Already configured: ${path}`);
+    return;
+  }
+  await ensureDirectory((0, import_node_path2.dirname)(path), false);
+  await (0, import_promises2.writeFile)(path, nextContent, { encoding: "utf8", mode: 420 });
+  console.log(
+    currentContent === void 0 ? `Wrote GitHub Copilot MCP config: ${path}` : `Updated GitHub Copilot MCP config: ${path}`
+  );
+}
 async function removeMcpConfigs(value, dryRun) {
   const clients = await resolveMcpClients(value, "remove");
   if (clients.length === 0) {
@@ -4070,6 +4113,10 @@ async function removeMcpConfigs(value, dryRun) {
       await removeCursorMcpConfig(OPENVIKING_MCP_NAME, dryRun);
       continue;
     }
+    if (client === "copilot") {
+      await removeCopilotMcpConfig(OPENVIKING_MCP_NAME, dryRun);
+      continue;
+    }
     const command = buildMcpRemoveCommand(client, OPENVIKING_MCP_NAME);
     await maybeRun(dryRun, command.executable, command.args, { allowFailure: true, cwd: command.cwd });
   }
@@ -4090,11 +4137,19 @@ async function removeMcpSnippets(config, dryRun) {
     "MCP snippet",
     dryRun
   );
+  await removePathIfExists(
+    (0, import_node_path2.join)(config.agentContextHome, "mcp", `${OPENVIKING_MCP_NAME}.copilot.json`),
+    "MCP snippet",
+    dryRun
+  );
 }
 function buildMcpInstallCommand(config, agent, name, options) {
   if (agent === "cursor") {
     throw new Error("Cursor MCP config is written directly to ~/.cursor/mcp.json.");
   }
+  if (agent === "copilot") {
+    throw new Error("GitHub Copilot MCP config is written directly to the VS Code user mcp.json file.");
+  }
   const claudeCwd = getInvocationCwd();
   const claudeScope = options.scope ?? "user";
   if (!options.nativeHttp) {
@@ -4139,6 +4194,9 @@ function buildMcpRemoveCommand(agent, name) {
   if (agent === "cursor") {
     throw new Error("Cursor MCP config is removed directly from ~/.cursor/mcp.json.");
   }
+  if (agent === "copilot") {
+    throw new Error("GitHub Copilot MCP config is removed directly from the VS Code user mcp.json file.");
+  }
   return agent === "codex" ? { executable: "codex", args: ["mcp", "remove", name] } : { executable: "claude", args: ["mcp", "remove", name], cwd: getInvocationCwd() };
 }
 function mcpEnvironment(config) {
@@ -4171,6 +4229,21 @@ function buildCursorMcpServerConfig(config, options) {
     env: mcpEnvironmentObject(config)
   };
 }
+function buildCopilotMcpServerConfig(config, options) {
+  if (options.nativeHttp) {
+    const server = { type: "http", url: options.url };
+    if (options.bearerTokenEnvVar) {
+      server.headers = { Authorization: `Bearer \${env:${options.bearerTokenEnvVar}}` };
+    }
+    return server;
+  }
+  return {
+    args: [mcpAdapterCommand()[0]],
+    command: "/usr/bin/env",
+    env: mcpEnvironmentObject(config),
+    type: "stdio"
+  };
+}
 function renderCursorMcpConfig(currentContent, name, serverConfig) {
   const parsed = currentContent === void 0 ? {} : parseJsonConfigObject(currentContent);
   if (parsed === void 0) {
@@ -4186,6 +4259,21 @@ function renderCursorMcpConfig(currentContent, name, serverConfig) {
   return `${JSON.stringify(nextConfig, null, 2)}
 `;
 }
+function renderCopilotMcpConfig(currentContent, name, serverConfig) {
+  const parsed = currentContent === void 0 ? {} : parseJsonConfigObject(currentContent);
+  if (parsed === void 0) {
+    throw new Error(`${copilotMcpConfigPath()} exists but is not a JSON object; not modifying it.`);
+  }
+  if (parsed.servers !== void 0 && !isJsonObject(parsed.servers)) {
+    throw new Error(`${copilotMcpConfigPath()} has a non-object servers field; not modifying it.`);
+  }
+  const nextConfig = { ...parsed };
+  const servers = isJsonObject(parsed.servers) ? { ...parsed.servers } : {};
+  servers[name] = serverConfig;
+  nextConfig.servers = servers;
+  return `${JSON.stringify(nextConfig, null, 2)}
+`;
+}
 async function removeCursorMcpConfig(name, dryRun) {
   const path = cursorMcpConfigPath();
   const currentContent = await readFileIfExists(path);
@@ -4215,11 +4303,44 @@ async function removeCursorMcpConfig(name, dryRun) {
   await (0, import_promises2.writeFile)(path, nextContent, { encoding: "utf8", mode: 420 });
   console.log(`Updated Cursor MCP config: ${path}`);
 }
+async function removeCopilotMcpConfig(name, dryRun) {
+  const path = copilotMcpConfigPath();
+  const currentContent = await readFileIfExists(path);
+  if (currentContent === void 0) {
+    console.log(`Already absent: ${path}`);
+    return;
+  }
+  const parsed = parseJsonConfigObject(currentContent);
+  if (parsed === void 0) {
+    console.log(`WARN ${path} exists but is not a JSON object; not modifying it.`);
+    return;
+  }
+  if (!isJsonObject(parsed.servers) || parsed.servers[name] === void 0) {
+    console.log(`No GitHub Copilot MCP config found: ${path}`);
+    return;
+  }
+  const nextConfig = { ...parsed };
+  const servers = { ...parsed.servers };
+  delete servers[name];
+  nextConfig.servers = servers;
+  const nextContent = `${JSON.stringify(nextConfig, null, 2)}
+`;
+  if (dryRun) {
+    console.log(`Would update GitHub Copilot MCP config: ${path}`);
+    return;
+  }
+  await (0, import_promises2.writeFile)(path, nextContent, { encoding: "utf8", mode: 420 });
+  console.log(`Updated GitHub Copilot MCP config: ${path}`);
+}
 function printMcpSnippet(config, agent, name, options) {
   if (agent === "cursor") {
     printCursorMcpSnippet(config, name, { nativeHttp: options.nativeHttp, url: options.url });
     return;
   }
+  if (agent === "copilot") {
+    printCopilotMcpSnippet(config, name, { nativeHttp: options.nativeHttp, url: options.url });
+    return;
+  }
   const snippetPath = (0, import_node_path2.join)(config.agentContextHome, "mcp", `${name}.${agent}.${agent === "codex" ? "toml" : "txt"}`);
   const command = buildMcpInstallCommand(config, agent, name, {
     nativeHttp: options.nativeHttp,
@@ -4239,14 +4360,37 @@ function printCursorMcpSnippet(config, name, options) {
 Snippet (${snippetPath}; merge into ${cursorMcpConfigPath()}):
 ${snippet2}`);
 }
+function printCopilotMcpSnippet(config, name, options) {
+  const snippetPath = (0, import_node_path2.join)(config.agentContextHome, "mcp", `${name}.copilot.json`);
+  const snippet2 = JSON.stringify({ servers: { [name]: buildCopilotMcpServerConfig(config, options) } }, null, 2);
+  console.log(`
+Snippet (${snippetPath}; merge into ${copilotMcpConfigPath()}):
+${snippet2}`);
+}
 function cursorMcpConfigPath() {
   return expandPath("~/.cursor/mcp.json");
 }
+function copilotMcpConfigPath() {
+  if (process.env.THREADNOTE_COPILOT_MCP_CONFIG) {
+    return expandPath(process.env.THREADNOTE_COPILOT_MCP_CONFIG);
+  }
+  if ((0, import_node_os2.platform)() === "darwin") {
+    const stablePath = expandPath("~/Library/Application Support/Code/User/mcp.json");
+    const insidersPath = expandPath("~/Library/Application Support/Code - Insiders/User/mcp.json");
+    return existsSyncDirectory((0, import_node_path2.dirname)(stablePath)) || !existsSyncDirectory((0, import_node_path2.dirname)(insidersPath)) ? stablePath : insidersPath;
+  }
+  if ((0, import_node_os2.platform)() === "win32") {
+    const appData = process.env.APPDATA;
+    return appData ? (0, import_node_path2.join)(appData, "Code", "User", "mcp.json") : expandPath("~/AppData/Roaming/Code/User/mcp.json");
+  }
+  const configHome = process.env.XDG_CONFIG_HOME ? expandPath(process.env.XDG_CONFIG_HOME) : expandPath("~/.config");
+  return (0, import_node_path2.join)(configHome, "Code", "User", "mcp.json");
+}
 function parseAgentClient(value) {
-  if (value === "codex" || value === "claude" || value === "cursor") {
+  if (value === "codex" || value === "claude" || value === "copilot" || value === "cursor") {
     return value;
   }
-  throw new Error(`Unsupported agent: ${value}. Expected codex, claude, or cursor.`);
+  throw new Error(`Unsupported agent: ${value}. Expected codex, claude, copilot, or cursor.`);
 }
 function parseClaudeMcpScope(value) {
   if (value === "local" || value === "project" || value === "user") {
@@ -4261,7 +4405,7 @@ async function resolveMcpClients(value, action) {
   }
   let requested;
   if (normalized === "available" || normalized === "all") {
-    requested = ["codex", "claude", "cursor"];
+    requested = ["codex", "claude", "cursor", "copilot"];
   } else {
     requested = normalized.split(",").map((part) => part.trim()).filter(Boolean).map(parseAgentClient);
   }
@@ -4277,6 +4421,16 @@ async function resolveMcpClients(value, action) {
       }
       continue;
     }
+    if (client === "copilot") {
+      if (!await isCopilotAvailable()) {
+        console.log(`WARN VS Code/Copilot config not found; cannot ${action} copilot MCP config.`);
+        continue;
+      }
+      if (!clients.includes(client)) {
+        clients.push(client);
+      }
+      continue;
+    }
     if (!await findExecutable([client])) {
       console.log(`WARN ${client} command not found; cannot ${action} ${client} MCP config.`);
       continue;
@@ -4296,9 +4450,28 @@ async function isCursorAvailable() {
   }
   return (0, import_node_os2.platform)() === "darwin" && await exists("/Applications/Cursor.app");
 }
+async function isCopilotAvailable() {
+  if (process.env.THREADNOTE_COPILOT_MCP_CONFIG) {
+    return true;
+  }
+  if (await exists((0, import_node_path2.dirname)(copilotMcpConfigPath()))) {
+    return true;
+  }
+  if (await findExecutable(["code", "code-insiders"])) {
+    return true;
+  }
+  return (0, import_node_os2.platform)() === "darwin" && await exists("/Applications/Visual Studio Code.app");
+}
+function existsSyncDirectory(path) {
+  try {
+    return (0, import_node_fs2.statSync)(path).isDirectory();
+  } catch (_err) {
+    return false;
+  }
+}
 
 // src/runtime.ts
-var import_node_fs2 = require("node:fs");
+var import_node_fs3 = require("node:fs");
 var import_node_os3 = require("node:os");
 var import_node_path3 = require("node:path");
 function getRuntimeConfig(program2, manifestOverride) {
@@ -4320,7 +4493,7 @@ function getRuntimeConfig(program2, manifestOverride) {
 }
 function defaultManifestPath(agentContextHome) {
   const userManifest = (0, import_node_path3.join)(agentContextHome, USER_MANIFEST_NAME);
-  return (0, import_node_fs2.existsSync)(userManifest) ? userManifest : builtInExampleManifestPath();
+  return (0, import_node_fs3.existsSync)(userManifest) ? userManifest : builtInExampleManifestPath();
 }
 function builtInExampleManifestPath() {
   return (0, import_node_path3.join)(toolRoot(), "config", "seed-manifest.example.yaml");
@@ -7209,9 +7382,9 @@ async function runRead(config, uri, options) {
   const ov = await openVikingCliForMode(options.dryRun === true);
   const result = await maybeRun(options.dryRun === true, ov, withIdentity(config, ["read", uri]));
   if (result && result.stdout.includes("[Directory overview is not ready]") && (uri.endsWith("/.overview.md") || uri.endsWith("/.abstract.md"))) {
-    const parentUri = parentVikingUri(uri);
+    const parentUri2 = parentVikingUri(uri);
     console.log("\nThis is a generated summary placeholder. To read the underlying content, inspect leaf nodes:");
-    console.log(`  threadnote list ${parentUri} --all --recursive`);
+    console.log(`  threadnote list ${parentUri2} --all --recursive`);
   }
 }
 async function runList(config, uri, options) {
@@ -7554,6 +7727,7 @@ function exactMemoryScopes(config, includeArchived) {
     `${userBase}/handoffs/active`,
     `${userBase}/incidents/active`,
     `${userBase}/events`,
+    `${userBase}/shared`,
     `viking://agent/${uriSegment(config.agentId)}/memories`
   ];
   return includeArchived ? [...scopes, `${userBase}/durable/archived`, `${userBase}/handoffs/archived`, `${userBase}/incidents/archived`] : scopes;
@@ -8222,19 +8396,780 @@ function detectSecretMatches(content) {
   return matches;
 }
 
+// src/share.ts
+var import_promises6 = require("node:fs/promises");
+var import_node_os4 = require("node:os");
+var import_node_path6 = require("node:path");
+var TEAMS_FILE_VERSION = 1;
+var SHARED_SEGMENT = "shared";
+var SHAREABLE_MEMORY_KIND_DIRS = ["durable"];
+var DEFAULT_GIT_REMOTE_NAME = "origin";
+var SCRUBBER_PATTERNS = [
+  { name: "private key", regex: /-----BEGIN [A-Z ]*PRIVATE KEY-----/ },
+  { name: "API key (sk-...)", regex: /\bsk-[A-Za-z0-9_-]{16,}/ },
+  { name: "GitHub token", regex: /\bgh[pousr]_[A-Za-z0-9_]{16,}/ },
+  { name: "GitHub fine-grained PAT", regex: /\bgithub_pat_[A-Za-z0-9_]{20,}/ },
+  { name: "GitLab PAT", regex: /\bglpat-[A-Za-z0-9_-]{20,}/ },
+  { name: "bearer token", regex: /\bBearer\s+[A-Za-z0-9._~+/=-]{20,}/i },
+  // Matches bare JWTs (three base64url segments). May surface a JWE token in
+  // legitimate docs; if that becomes noisy we can switch to warn-only.
+  { name: "JWT", regex: /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/ },
+  { name: "AWS access key", regex: /\bAKIA[0-9A-Z]{16}\b/ },
+  // Slack tokens: xoxa/xoxb/xoxc (configuration)/xoxd (legacy user cookie)/
+  // xoxe (refresh)/xoxp/xoxr/xoxs, with optional -N- segment for the workspace tier.
+  { name: "Slack token", regex: /\bxox[abcdeprs](?:-\d-)?[A-Za-z0-9._-]{10,}/i }
+];
+async function runShareInit(config, remoteUrl, options) {
+  if (!remoteUrl.trim()) {
+    throw new Error("Provide a git remote URL for the shared memories repo.");
+  }
+  const dryRun = options.dryRun === true;
+  const teamName = normalizeTeamName(options.team);
+  const teamsFile = await readTeamsFile(config);
+  if (teamsFile.teams[teamName]) {
+    throw new Error(
+      `Team "${teamName}" is already configured (remote ${teamsFile.teams[teamName].remote}). Remove it first with: threadnote share remove --team ${teamName}`
+    );
+  }
+  const worktree = teamWorktreePath(config, teamName);
+  const gitdir = teamGitdirPath(config, teamName);
+  await assertWorktreeUsable(worktree);
+  if (await exists(gitdir)) {
+    throw new Error(`Gitdir already exists at ${gitdir}; remove it or pick a different team name.`);
+  }
+  await ensureDirectory((0, import_node_path6.dirname)(worktree), dryRun);
+  await ensureDirectory((0, import_node_path6.dirname)(gitdir), dryRun);
+  const git = await requiredExecutable("git");
+  await maybeRun(dryRun, git, ["clone", `--separate-git-dir=${gitdir}`, "--", remoteUrl, worktree]);
+  const newConfig = {
+    addedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    gitdir,
+    name: teamName,
+    remote: remoteUrl,
+    worktree
+  };
+  const updatedTeams = {
+    defaultTeam: shouldSetDefault(options, teamsFile) ? teamName : teamsFile.defaultTeam ?? teamName,
+    teams: { ...teamsFile.teams, [teamName]: newConfig },
+    version: TEAMS_FILE_VERSION
+  };
+  if (dryRun) {
+    console.log(`Would write teams file: ${teamsFilePath(config)}`);
+    console.log(`Would set ${teamName} as default? ${updatedTeams.defaultTeam === teamName}`);
+  } else {
+    await writeTeamsFile(config, updatedTeams);
+    console.log(`Configured shared team "${teamName}" -> ${portablePath(worktree)}`);
+  }
+  if (!dryRun) {
+    await ensureSharedGitignore(worktree, git, options.push !== false);
+    const ingested = await ingestWorktreeFiles(config, newConfig, "create");
+    console.log(`Ingested ${ingested} shared memory file(s) into OpenViking.`);
+  }
+}
+var SHARED_GITIGNORE_PATTERNS = ["**/.abstract.md", "**/.overview.md"];
+var SHARED_GITIGNORE_HEADER = "# Threadnote: ignore OpenViking-generated directory summaries.";
+async function ensureSharedGitignore(worktree, git, push) {
+  const gitignorePath = (0, import_node_path6.join)(worktree, ".gitignore");
+  const existing = await readFileIfExists(gitignorePath) ?? "";
+  const lines = existing.split("\n").map((line) => line.trim());
+  const missingPatterns = SHARED_GITIGNORE_PATTERNS.filter((pattern) => !lines.includes(pattern));
+  if (missingPatterns.length === 0) {
+    return;
+  }
+  const hasHeader = lines.includes(SHARED_GITIGNORE_HEADER);
+  const segments = [];
+  if (existing.length > 0 && !existing.endsWith("\n")) {
+    segments.push("\n");
+  }
+  if (existing.length > 0) {
+    segments.push("\n");
+  }
+  if (!hasHeader) {
+    segments.push(SHARED_GITIGNORE_HEADER, "\n");
+  }
+  segments.push(missingPatterns.join("\n"), "\n");
+  await (0, import_promises6.writeFile)(gitignorePath, `${existing}${segments.join("")}`, { encoding: "utf8" });
+  console.log(`Added ${missingPatterns.join(", ")} to ${portablePath(gitignorePath)}`);
+  await maybeRun(false, git, ["-C", worktree, "add", ".gitignore"]);
+  const commitResult = await runCommand(
+    git,
+    ["-C", worktree, "commit", "-m", "share: ignore OpenViking directory summaries"],
+    { allowFailure: true }
+  );
+  if (commitResult.exitCode !== 0) {
+    const detail = commitResult.stderr.trim() || commitResult.stdout.trim();
+    if (!/nothing to commit|no changes added/i.test(detail)) {
+      console.warn(
+        `.gitignore housekeeping commit was rejected (${detail || "unknown"}); it will be retried on the next share sync.`
+      );
+      return;
+    }
+  }
+  if (push) {
+    await maybeRun(false, git, ["-C", worktree, "push", DEFAULT_GIT_REMOTE_NAME], { allowFailure: true });
+  }
+}
+async function runShareStatus(config, options) {
+  const team = await resolveTeam(config, options.team);
+  const git = await requiredExecutable("git");
+  console.log(`Team: ${team.name}`);
+  console.log(`Remote: ${team.config.remote}`);
+  console.log(`Worktree: ${portablePath(team.config.worktree)}`);
+  console.log(`Gitdir: ${portablePath(team.config.gitdir)}`);
+  await maybeRun(options.dryRun === true, git, ["-C", team.config.worktree, "status", "--short", "--branch"]);
+  await maybeRun(options.dryRun === true, git, ["-C", team.config.worktree, "fetch", DEFAULT_GIT_REMOTE_NAME], {
+    allowFailure: true
+  });
+  const ahead = await gitOutput(team.config.worktree, ["rev-list", "--count", "@{u}..HEAD"], options.dryRun === true);
+  const behind = await gitOutput(team.config.worktree, ["rev-list", "--count", "HEAD..@{u}"], options.dryRun === true);
+  if (ahead !== void 0) {
+    console.log(`Ahead of upstream: ${ahead}`);
+  }
+  if (behind !== void 0) {
+    console.log(`Behind upstream: ${behind}`);
+  }
+}
+async function runShareSync(config, options) {
+  const team = await resolveTeam(config, options.team);
+  const dryRun = options.dryRun === true;
+  const git = await requiredExecutable("git");
+  const worktree = team.config.worktree;
+  if (!dryRun) {
+    await ensureSharedGitignore(worktree, git, false);
+  }
+  if (await hasUncommittedChanges(worktree)) {
+    if (options.autoCommit === false) {
+      throw new Error(
+        `Worktree ${worktree} has uncommitted changes. Commit them yourself or rerun without --no-auto-commit.`
+      );
+    }
+    const message = options.message ?? `share: sync ${(/* @__PURE__ */ new Date()).toISOString()}`;
+    await stageShareableChanges(dryRun, git, worktree);
+    await maybeRun(dryRun, git, ["-C", worktree, "commit", "-m", message], { allowFailure: true });
+  }
+  const beforeRev = await gitOutput(worktree, ["rev-parse", "HEAD"], dryRun);
+  await maybeRun(dryRun, git, ["-C", worktree, "fetch", DEFAULT_GIT_REMOTE_NAME]);
+  const pullResult = dryRun ? void 0 : await runCommand(git, ["-C", worktree, "pull", "--rebase", DEFAULT_GIT_REMOTE_NAME], { allowFailure: true });
+  if (dryRun) {
+    console.log(`Would run: ${formatShellCommand(git, ["-C", worktree, "pull", "--rebase", DEFAULT_GIT_REMOTE_NAME])}`);
+  } else if (pullResult && pullResult.exitCode !== 0) {
+    if (await exists((0, import_node_path6.join)(team.config.gitdir, "rebase-merge")) || await exists((0, import_node_path6.join)(team.config.gitdir, "rebase-apply"))) {
+      throw new Error(
+        `git pull --rebase reported conflicts in ${worktree}. The worktree is in a rebase-in-progress state.
+Resolve the conflicts in-place, run \`git -C ${worktree} rebase --continue\` (or --abort), then re-run \`threadnote share sync\`.`
+      );
+    }
+    throw new Error(
+      `git pull --rebase failed in ${worktree}: ${pullResult.stderr.trim() || pullResult.stdout.trim() || "unknown error"}`
+    );
+  }
+  const afterRev = await gitOutput(worktree, ["rev-parse", "HEAD"], dryRun);
+  if (!dryRun && beforeRev && afterRev && beforeRev !== afterRev) {
+    const changes = await listChangedFiles(worktree, beforeRev, afterRev);
+    await applyChangesToOpenViking(config, team.config, changes);
+    console.log(`Reindexed ${changes.length} file change(s) into OpenViking.`);
+  } else if (!dryRun) {
+    console.log("No upstream changes to reindex.");
+  }
+  if (options.push !== false) {
+    await maybeRun(dryRun, git, ["-C", worktree, "push", DEFAULT_GIT_REMOTE_NAME], { allowFailure: true });
+  }
+}
+async function stageShareableChanges(dryRun, git, worktree) {
+  const pathspecs = [":(top)README.md", ":(top).gitignore", ...SHAREABLE_MEMORY_KIND_DIRS.map((dir) => `:(top)${dir}`)];
+  await maybeRun(dryRun, git, ["-C", worktree, "add", "--", ...pathspecs], { allowFailure: true });
+}
+async function runSharePublish(config, sourceUri, options) {
+  assertVikingUri(sourceUri);
+  const team = await resolveTeam(config, options.team);
+  const dryRun = options.dryRun === true;
+  if (isInSharedNamespace(config, sourceUri)) {
+    throw new Error(`Memory ${sourceUri} is already in the shared namespace.`);
+  }
+  const ov = await openVikingCliForMode(dryRun);
+  const content = await readMemoryContent(config, ov, sourceUri, dryRun);
+  const blocker = scrubberBlocker(content);
+  if (blocker) {
+    throw new Error(`Refusing to publish ${sourceUri}: possible ${blocker}. Strip the sensitive value, then retry.`);
+  }
+  const targetUri = sharedUriFor(config, sourceUri, team.name);
+  if (!dryRun && await vikingResourceExists2(ov, config, targetUri)) {
+    throw new Error(
+      `Refusing to publish: ${targetUri} already exists in the shared namespace. Inspect it via threadnote read; if it should be replaced, forget the existing shared copy first.`
+    );
+  }
+  await ensureSharedDirectoryChain(config, ov, targetUri, dryRun);
+  await writeMemoryFile(config, ov, targetUri, content, "create", dryRun);
+  await removeWithRollback(config, ov, sourceUri, targetUri, team.config.worktree, dryRun, "publish");
+  const git = await requiredExecutable("git");
+  const worktree = team.config.worktree;
+  const relativePath = vikingUriToWorktreeRelative(config, targetUri, team.name);
+  const message = options.message ?? `share: publish ${relativePath}`;
+  await maybeRun(dryRun, git, ["-C", worktree, "add", "--", relativePath]);
+  await maybeRun(dryRun, git, ["-C", worktree, "commit", "-m", message], { allowFailure: true });
+  if (options.push !== false) {
+    const pushResult = dryRun ? void 0 : await runCommand(git, ["-C", worktree, "push", DEFAULT_GIT_REMOTE_NAME], { allowFailure: true });
+    if (dryRun) {
+      console.log(`Would run: ${formatShellCommand(git, ["-C", worktree, "push", DEFAULT_GIT_REMOTE_NAME])}`);
+    } else if (pushResult && pushResult.exitCode !== 0) {
+      const detail = pushResult.stderr.trim() || pushResult.stdout.trim() || "unknown error";
+      throw new Error(
+        `Memory was committed locally but git push failed: ${detail}
+Resolve the remote issue (auth, network, branch protection), then run: threadnote share sync`
+      );
+    }
+  }
+  console.log(`Published ${sourceUri} -> ${targetUri}`);
+}
+async function runShareUnpublish(config, sourceUri, options) {
+  assertVikingUri(sourceUri);
+  const team = await resolveTeam(config, options.team);
+  const dryRun = options.dryRun === true;
+  if (!isInTeamNamespace(config, sourceUri, team.name)) {
+    throw new Error(`Memory ${sourceUri} is not in team "${team.name}" shared namespace.`);
+  }
+  const ov = await openVikingCliForMode(dryRun);
+  const content = await readMemoryContent(config, ov, sourceUri, dryRun);
+  const targetUri = personalUriFor(config, sourceUri, team.name);
+  if (!dryRun && await vikingResourceExists2(ov, config, targetUri)) {
+    throw new Error(
+      `Refusing to unpublish: a personal memory already exists at ${targetUri}. Move or forget it first, then retry.`
+    );
+  }
+  await writeMemoryFile(config, ov, targetUri, content, "create", dryRun);
+  await removeWithRollback(config, ov, sourceUri, targetUri, team.config.worktree, dryRun, "unpublish");
+  const git = await requiredExecutable("git");
+  const worktree = team.config.worktree;
+  const relativePath = vikingUriToWorktreeRelative(config, sourceUri, team.name);
+  const message = options.message ?? `share: unpublish ${relativePath}`;
+  await maybeRun(dryRun, git, ["-C", worktree, "rm", relativePath], { allowFailure: true });
+  await maybeRun(dryRun, git, ["-C", worktree, "commit", "-m", message], { allowFailure: true });
+  if (options.push !== false) {
+    await maybeRun(dryRun, git, ["-C", worktree, "push", DEFAULT_GIT_REMOTE_NAME], { allowFailure: true });
+  }
+  console.log(`Unpublished ${sourceUri} -> ${targetUri}`);
+}
+async function runShareList(config, _options) {
+  const teams = await readTeamsFile(config);
+  const entries = Object.values(teams.teams);
+  if (entries.length === 0) {
+    console.log("No shared teams configured. Run: threadnote share init <remote-url>");
+    return;
+  }
+  for (const team of entries) {
+    const marker = team.name === teams.defaultTeam ? " (default)" : "";
+    console.log(`- ${team.name}${marker}`);
+    console.log(`    remote: ${team.remote}`);
+    console.log(`    worktree: ${portablePath(team.worktree)}`);
+    console.log(`    gitdir: ${portablePath(team.gitdir)}`);
+    console.log(`    added: ${team.addedAt}`);
+  }
+}
+async function runShareRemove(config, options) {
+  const team = await resolveTeam(config, options.team);
+  const dryRun = options.dryRun === true;
+  const teamsFile = await readTeamsFile(config);
+  const remaining = {};
+  for (const [name, value] of Object.entries(teamsFile.teams)) {
+    if (name !== team.name) {
+      remaining[name] = value;
+    }
+  }
+  const remainingNames = Object.keys(remaining);
+  const nextDefault = teamsFile.defaultTeam === team.name ? remainingNames[0] : teamsFile.defaultTeam;
+  const updated = { defaultTeam: nextDefault, teams: remaining, version: TEAMS_FILE_VERSION };
+  if (dryRun) {
+    console.log(`Would update teams file: ${teamsFilePath(config)}`);
+  } else {
+    await writeTeamsFile(config, updated);
+    console.log(`Removed team "${team.name}" from teams.json.`);
+  }
+  if (options.keepFiles !== true) {
+    await removePath(team.config.worktree, "shared worktree", dryRun);
+    await removePath(team.config.gitdir, "shared gitdir", dryRun);
+  } else {
+    console.log(`Keeping files at ${portablePath(team.config.worktree)} and ${portablePath(team.config.gitdir)}`);
+  }
+}
+function normalizeTeamName(input2) {
+  const candidate = (input2 ?? "default").trim();
+  if (!candidate) {
+    return "default";
+  }
+  if (!/^[a-z0-9][a-z0-9._-]*$/.test(candidate) || /^\.+$/.test(candidate)) {
+    throw new Error(
+      `Invalid team name "${input2}". Team names must start with a lowercase letter or digit and contain only [a-z0-9._-]. Single-dot or dot-only names are rejected so they don't collapse to the shared-root or parent directory.`
+    );
+  }
+  return candidate;
+}
+function teamsFilePath(config) {
+  return (0, import_node_path6.join)(config.agentContextHome, "share", "teams.json");
+}
+function teamWorktreePath(config, team) {
+  return (0, import_node_path6.join)(
+    config.agentContextHome,
+    "data",
+    "viking",
+    config.account,
+    "user",
+    uriSegment(config.user),
+    "memories",
+    SHARED_SEGMENT,
+    team
+  );
+}
+function teamGitdirPath(config, team) {
+  return (0, import_node_path6.join)(config.agentContextHome, "share", "teams", `${team}.gitdir`);
+}
+async function readTeamsFile(config) {
+  const path = teamsFilePath(config);
+  const raw = await readFileIfExists(path);
+  if (!raw) {
+    return { teams: {}, version: TEAMS_FILE_VERSION };
+  }
+  const parsed = parseJsonConfigObject(raw);
+  if (!parsed) {
+    throw new Error(`Could not parse teams file ${path}`);
+  }
+  if (typeof parsed.version === "number" && parsed.version > TEAMS_FILE_VERSION) {
+    throw new Error(
+      `Teams file ${path} was written with version ${parsed.version}; this Threadnote binary understands up to version ${TEAMS_FILE_VERSION}. Upgrade Threadnote (\`threadnote update\`) before continuing.`
+    );
+  }
+  const teams = {};
+  if (typeof parsed.teams === "object" && parsed.teams !== null && !Array.isArray(parsed.teams)) {
+    for (const [name, value] of Object.entries(parsed.teams)) {
+      if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        console.warn(`Skipping non-object team entry "${name}" in ${path}.`);
+        continue;
+      }
+      const entry = value;
+      if (typeof entry.remote !== "string" || entry.remote.length === 0) {
+        console.warn(`Skipping team entry "${name}" in ${path}: missing or empty "remote" field.`);
+        continue;
+      }
+      teams[name] = {
+        addedAt: typeof entry.addedAt === "string" ? entry.addedAt : (/* @__PURE__ */ new Date(0)).toISOString(),
+        gitdir: typeof entry.gitdir === "string" ? entry.gitdir : teamGitdirPath(config, name),
+        name,
+        remote: entry.remote,
+        worktree: typeof entry.worktree === "string" ? entry.worktree : teamWorktreePath(config, name)
+      };
+    }
+  }
+  const defaultTeam = typeof parsed.defaultTeam === "string" ? parsed.defaultTeam : void 0;
+  return { defaultTeam, teams, version: TEAMS_FILE_VERSION };
+}
+async function writeTeamsFile(config, contents) {
+  const path = teamsFilePath(config);
+  await (0, import_promises6.mkdir)((0, import_node_path6.dirname)(path), { recursive: true });
+  const serializable = {
+    defaultTeam: contents.defaultTeam,
+    teams: contents.teams,
+    version: contents.version
+  };
+  await (0, import_promises6.writeFile)(path, `${JSON.stringify(serializable, void 0, 2)}
+`, { encoding: "utf8", mode: 384 });
+}
+async function resolveTeam(config, requested) {
+  const teamsFile = await readTeamsFile(config);
+  const entries = Object.entries(teamsFile.teams);
+  if (entries.length === 0) {
+    throw new Error("No shared teams configured. Run: threadnote share init <remote-url>");
+  }
+  const wantName = requested ? normalizeTeamName(requested) : teamsFile.defaultTeam ?? entries[0][0];
+  const found = teamsFile.teams[wantName];
+  if (!found) {
+    const known = entries.map(([name]) => name).join(", ");
+    throw new Error(`Team "${wantName}" is not configured. Known teams: ${known}`);
+  }
+  return { config: found, name: wantName };
+}
+function shouldSetDefault(options, existing) {
+  if (options.setDefault === true) {
+    return true;
+  }
+  return existing.defaultTeam === void 0;
+}
+async function assertWorktreeUsable(worktree) {
+  if (!await exists(worktree)) {
+    return;
+  }
+  if (!await isDirectory(worktree)) {
+    throw new Error(`Cannot use ${worktree} as a worktree: not a directory.`);
+  }
+  const entries = await (0, import_promises6.readdir)(worktree);
+  if (entries.length > 0) {
+    const preview = entries.slice(0, 5).join(", ");
+    const suffix = entries.length > 5 ? `, +${entries.length - 5} more` : "";
+    throw new Error(
+      `Worktree ${worktree} is not empty (contains: ${preview}${suffix}). Move or remove its contents, then retry threadnote share init.`
+    );
+  }
+}
+async function ingestWorktreeFiles(config, team, initialMode) {
+  const ov = await openVikingCliForMode(false);
+  const files = await walkMemoryFiles(team.worktree);
+  for (const file of files) {
+    const uri = workfileToVikingUri(config, team, file);
+    await ensureSharedDirectoryChain(config, ov, uri, false);
+    await ingestSingleFile(ov, config, uri, file, initialMode);
+  }
+  return files.length;
+}
+async function walkMemoryFiles(root) {
+  const out = [];
+  async function visit(path, depth) {
+    let entries;
+    try {
+      entries = await (0, import_promises6.readdir)(path, { withFileTypes: true });
+    } catch (err) {
+      console.warn(`Skipping ${path} during shared-tree walk: ${err instanceof Error ? err.message : String(err)}`);
+      return;
+    }
+    for (const entry of entries) {
+      if (entry.name === ".git") {
+        continue;
+      }
+      const full = (0, import_node_path6.join)(path, entry.name);
+      if (entry.isDirectory()) {
+        if (depth === 0 && !SHAREABLE_MEMORY_KIND_DIRS.includes(entry.name)) {
+          continue;
+        }
+        await visit(full, depth + 1);
+        continue;
+      }
+      if (!entry.isFile()) {
+        continue;
+      }
+      if (depth === 0) {
+        continue;
+      }
+      if (!entry.name.endsWith(".md")) {
+        continue;
+      }
+      out.push(full);
+    }
+  }
+  await visit(root, 0);
+  return out;
+}
+function workfileToVikingUri(config, team, filePath) {
+  const rel = (0, import_node_path6.relative)(team.worktree, filePath).split(import_node_path6.sep).join("/");
+  return `viking://user/${uriSegment(config.user)}/memories/${SHARED_SEGMENT}/${team.name}/${rel}`;
+}
+function isInSharedNamespace(config, uri) {
+  return uri.startsWith(`viking://user/${uriSegment(config.user)}/memories/${SHARED_SEGMENT}/`);
+}
+function isInTeamNamespace(config, uri, team) {
+  return uri.startsWith(`viking://user/${uriSegment(config.user)}/memories/${SHARED_SEGMENT}/${team}/`);
+}
+function sharedUriFor(config, personalUri, team) {
+  const prefix = `viking://user/${uriSegment(config.user)}/memories/`;
+  if (!personalUri.startsWith(prefix)) {
+    throw new Error(`Refusing to publish memory outside the current user namespace: ${personalUri}`);
+  }
+  const rest = personalUri.slice(prefix.length);
+  return `${prefix}${SHARED_SEGMENT}/${team}/${rest}`;
+}
+function personalUriFor(config, sharedUri, team) {
+  const prefix = `viking://user/${uriSegment(config.user)}/memories/${SHARED_SEGMENT}/${team}/`;
+  if (!sharedUri.startsWith(prefix)) {
+    throw new Error(`Refusing to unpublish a URI outside team "${team}" shared namespace: ${sharedUri}`);
+  }
+  const rest = sharedUri.slice(prefix.length);
+  return `viking://user/${uriSegment(config.user)}/memories/${rest}`;
+}
+function vikingUriToWorktreeRelative(config, uri, team) {
+  const prefix = `viking://user/${uriSegment(config.user)}/memories/${SHARED_SEGMENT}/${team}/`;
+  if (!uri.startsWith(prefix)) {
+    throw new Error(`URI ${uri} is not inside team "${team}" shared subtree.`);
+  }
+  return uri.slice(prefix.length);
+}
+function scrubberBlocker(content) {
+  return SCRUBBER_PATTERNS.find((pattern) => pattern.regex.test(content))?.name;
+}
+async function readMemoryContent(config, ov, uri, dryRun) {
+  const args = withIdentity(config, ["read", uri]);
+  if (dryRun) {
+    console.log(`Would run: ${formatShellCommand(ov, args)}`);
+    return "<dry-run memory body>";
+  }
+  const result = await runCommand(ov, args);
+  if (!result.stdout.trim()) {
+    throw new Error(`Refusing to publish empty memory at ${uri}`);
+  }
+  return result.stdout;
+}
+async function ensureSharedDirectoryChain(config, ov, memoryUri, dryRun) {
+  const directoryUri = parentUri(memoryUri);
+  for (const uri of sharedDirectoryChain(config, directoryUri)) {
+    const args = withIdentity(config, ["stat", uri]);
+    if (dryRun) {
+      console.log(`Would run: ${formatShellCommand(ov, args)}`);
+      continue;
+    }
+    const statResult = await runCommand(ov, args, { allowFailure: true });
+    if (statResult.exitCode === 0) {
+      continue;
+    }
+    await maybeRun(false, ov, withIdentity(config, ["mkdir", uri, "--description", "Threadnote shared memories."]));
+  }
+}
+function parentUri(uri) {
+  const lastSlash = uri.lastIndexOf("/");
+  return lastSlash === -1 ? uri : uri.slice(0, lastSlash);
+}
+function sharedDirectoryChain(config, directoryUri) {
+  const prefix = `viking://user/${uriSegment(config.user)}/memories/${SHARED_SEGMENT}/`;
+  if (!directoryUri.startsWith(prefix)) {
+    return [directoryUri];
+  }
+  const parts = directoryUri.slice(prefix.length).split("/").filter(Boolean);
+  const chain = [];
+  for (let index = 1; index <= parts.length; index += 1) {
+    chain.push(`${prefix}${parts.slice(0, index).join("/")}`);
+  }
+  return chain;
+}
+async function writeMemoryFile(config, ov, uri, content, initialMode, dryRun) {
+  if (dryRun) {
+    const args = withIdentity(config, [
+      "write",
+      uri,
+      "--from-file",
+      "<staged temp file>",
+      "--mode",
+      initialMode,
+      "--wait",
+      "--timeout",
+      "120"
+    ]);
+    console.log(`Would run: ${formatShellCommand(ov, args)}`);
+    return;
+  }
+  const stagingDir = await (0, import_promises6.mkdtemp)((0, import_node_path6.join)((0, import_node_os4.tmpdir)(), "threadnote-share-"));
+  const tempPath = (0, import_node_path6.join)(stagingDir, "body.txt");
+  try {
+    await (0, import_promises6.writeFile)(tempPath, content, { encoding: "utf8", mode: 384 });
+    await writeOvFileWithRetry(config, ov, uri, tempPath, initialMode);
+  } finally {
+    await (0, import_promises6.rm)(stagingDir, { force: true, recursive: true });
+  }
+}
+async function writeOvFileWithRetry(config, ov, uri, fromFile, initialMode) {
+  const maxAttempts = 4;
+  const existedBeforeWrite = await vikingResourceExists2(ov, config, uri);
+  for (let attempt = 0; attempt < maxAttempts; attempt += 1) {
+    const existsNow = attempt === 0 ? existedBeforeWrite : await vikingResourceExists2(ov, config, uri);
+    const ourWriteLanded = existsNow && !existedBeforeWrite;
+    const mode = attempt === 0 ? initialMode : ourWriteLanded ? "replace" : initialMode;
+    const args = withIdentity(config, [
+      "write",
+      uri,
+      "--from-file",
+      fromFile,
+      "--mode",
+      mode,
+      "--wait",
+      "--timeout",
+      "120"
+    ]);
+    console.log(`${attempt === 0 ? "Running" : "Retrying"}: ${formatShellCommand(ov, args)}`);
+    const result = await runCommand(ov, args, { allowFailure: true });
+    if (result.exitCode === 0) {
+      if (result.stdout.trim()) {
+        console.log(result.stdout.trim());
+      }
+      if (result.stderr.trim()) {
+        console.error(result.stderr.trim());
+      }
+      return;
+    }
+    if (isTransientOvFailure(result.stderr, result.stdout) && await vikingResourceExists2(ov, config, uri) && !existedBeforeWrite) {
+      console.log("OpenViking accepted the write but returned an error before the wait completed; draining the queue.");
+      await waitForOvQueue(ov, config);
+      return;
+    }
+    if (!isTransientOvFailure(result.stderr, result.stdout) || attempt === maxAttempts - 1) {
+      throw new Error(`${formatShellCommand(ov, args)} failed: ${result.stderr || result.stdout}`);
+    }
+    await sleep(1e3 * (attempt + 1));
+  }
+}
+async function waitForOvQueue(ov, config) {
+  const result = await runCommand(ov, withIdentity(config, ["wait", "--timeout", "120"]), { allowFailure: true });
+  if (result.stdout.trim()) {
+    console.log(result.stdout.trim());
+  }
+  if (result.stderr.trim()) {
+    console.error(result.stderr.trim());
+  }
+}
+function isTransientOvFailure(stderr, stdout) {
+  const output2 = `${stderr}
+${stdout}`.toLowerCase();
+  return output2.includes("resource is busy") || output2.includes("resource is being processed") || output2.includes("network error") || output2.includes("error sending request") || output2.includes("http request failed") || output2.includes("connection refused") || output2.includes("connection reset") || output2.includes("timed out");
+}
+async function ingestSingleFile(ov, config, uri, filePath, initialMode) {
+  const content = await (0, import_promises6.readFile)(filePath, "utf8");
+  await writeMemoryFile(config, ov, uri, content, initialMode, false);
+}
+async function removeWithRollback(config, ov, sourceUri, rollbackUri, worktree, dryRun, label) {
+  try {
+    await removeMemoryUri(config, ov, sourceUri, dryRun);
+  } catch (sourceErr) {
+    if (dryRun) {
+      throw sourceErr;
+    }
+    console.error(
+      `Source removal failed during ${label}; rolling back ${rollbackUri} so the system is back to the pre-${label} state.`
+    );
+    try {
+      await removeMemoryUri(config, ov, rollbackUri, false);
+    } catch (rollbackErr) {
+      console.error(
+        `Rollback of ${rollbackUri} also failed. Manual cleanup needed via: threadnote forget ${rollbackUri}
+Rollback error: ${rollbackErr instanceof Error ? rollbackErr.message : String(rollbackErr)}`
+      );
+    }
+    await bestEffortRemoveWorktreeFile(rollbackUri, worktree, label);
+    throw sourceErr;
+  }
+}
+async function bestEffortRemoveWorktreeFile(rollbackUri, worktree, label) {
+  if (label !== "publish") {
+    return;
+  }
+  const prefix = "viking://";
+  if (!rollbackUri.startsWith(prefix)) {
+    return;
+  }
+  const parts = rollbackUri.slice(prefix.length).split("/");
+  const sharedIndex = parts.indexOf("shared");
+  if (sharedIndex === -1 || sharedIndex + 2 >= parts.length) {
+    return;
+  }
+  const relative3 = parts.slice(sharedIndex + 2).join("/");
+  if (!relative3) {
+    return;
+  }
+  await (0, import_promises6.rm)((0, import_node_path6.join)(worktree, relative3), { force: true });
+}
+async function removeMemoryUri(config, ov, uri, dryRun) {
+  const args = withIdentity(config, ["rm", uri]);
+  if (dryRun) {
+    console.log(`Would run: ${formatShellCommand(ov, args)}`);
+    return;
+  }
+  const maxAttempts = 4;
+  for (let attempt = 0; attempt < maxAttempts; attempt += 1) {
+    const result = await runCommand(ov, args, { allowFailure: true });
+    if (result.exitCode === 0) {
+      if (result.stdout.trim()) {
+        console.log(result.stdout.trim());
+      }
+      return;
+    }
+    if (!isTransientOvFailure(result.stderr, result.stdout) || attempt === maxAttempts - 1) {
+      throw new Error(`${formatShellCommand(ov, args)} failed: ${result.stderr || result.stdout}`);
+    }
+    await sleep(1e3 * (attempt + 1));
+  }
+}
+async function vikingResourceExists2(ov, config, uri) {
+  const result = await runCommand(ov, withIdentity(config, ["stat", uri]), { allowFailure: true });
+  return result.exitCode === 0;
+}
+async function hasUncommittedChanges(worktree) {
+  const result = await runCommand("git", ["-C", worktree, "status", "--porcelain"], { allowFailure: true });
+  return result.stdout.trim().length > 0;
+}
+async function gitOutput(worktree, args, dryRun) {
+  if (dryRun) {
+    return void 0;
+  }
+  const result = await runCommand("git", ["-C", worktree, ...args], { allowFailure: true });
+  if (result.exitCode !== 0) {
+    return void 0;
+  }
+  return result.stdout.trim();
+}
+async function listChangedFiles(worktree, beforeRev, afterRev) {
+  const result = await runCommand("git", ["-C", worktree, "diff", "--name-status", "-z", `${beforeRev}..${afterRev}`], {
+    allowFailure: true
+  });
+  if (result.exitCode !== 0) {
+    return [];
+  }
+  const entries = result.stdout.split("\0").filter((part) => part.length > 0);
+  const changes = [];
+  for (let index = 0; index < entries.length; ) {
+    const raw = entries[index];
+    const head = raw.slice(0, 1);
+    if (head === "R" || head === "C") {
+      const oldRel = entries[index + 1];
+      const newRel = entries[index + 2];
+      if (oldRel && newRel) {
+        changes.push({ path: (0, import_node_path6.join)(worktree, oldRel), relativePath: oldRel, status: "removed" });
+        changes.push({ path: (0, import_node_path6.join)(worktree, newRel), relativePath: newRel, status: "added" });
+      }
+      index += 3;
+      continue;
+    }
+    const rel = entries[index + 1];
+    if (rel) {
+      const status = head === "A" ? "added" : head === "D" ? "removed" : "modified";
+      changes.push({ path: (0, import_node_path6.join)(worktree, rel), relativePath: rel, status });
+    }
+    index += 2;
+  }
+  return changes;
+}
+async function applyChangesToOpenViking(config, team, changes) {
+  const ov = await openVikingCliForMode(false);
+  for (const change of changes) {
+    if (!change.relativePath.endsWith(".md")) {
+      continue;
+    }
+    const firstSegment = change.relativePath.split("/")[0];
+    if (!SHAREABLE_MEMORY_KIND_DIRS.includes(firstSegment)) {
+      continue;
+    }
+    const uri = workfileToVikingUri(config, team, change.path);
+    if (change.status === "removed") {
+      await removeMemoryUri(config, ov, uri, false);
+      continue;
+    }
+    if (!await isFile(change.path)) {
+      continue;
+    }
+    if (change.status === "modified" && await vikingResourceExists2(ov, config, uri)) {
+      console.warn(
+        `share sync: overwriting local ${uri} with the upstream version (local edits to the shared subtree are not preserved across sync).`
+      );
+    }
+    await ensureSharedDirectoryChain(config, ov, uri, false);
+    const writeMode = change.status === "modified" ? "replace" : "create";
+    await ingestSingleFile(ov, config, uri, change.path, writeMode);
+  }
+}
+
 // src/lifecycle.ts
 var import_node_child_process2 = require("node:child_process");
+var import_node_fs5 = require("node:fs");
+var import_promises9 = require("node:fs/promises");
+var import_node_os6 = require("node:os");
+var import_node_path8 = require("node:path");
+
+// src/update.ts
 var import_node_fs4 = require("node:fs");
-var import_promises8 = require("node:fs/promises");
+var import_promises7 = require("node:fs/promises");
 var import_node_os5 = require("node:os");
 var import_node_path7 = require("node:path");
-
-// src/update.ts
-var import_node_fs3 = require("node:fs");
-var import_promises6 = require("node:fs/promises");
-var import_node_os4 = require("node:os");
-var import_node_path6 = require("node:path");
-var import_promises7 = require("node:readline/promises");
+var import_promises8 = require("node:readline/promises");
 var import_node_process = require("node:process");
 var NPM_PACKAGE_NAME = "threadnote";
 var DEFAULT_NPM_REGISTRY = "https://registry.npmjs.org/";
@@ -8321,7 +9256,9 @@ async function runUpdate(config, options) {
   } else {
     console.log("Skipping post-update migration prompts because --no-post-update was provided.");
   }
-  console.log("Update complete. Restart Cursor, Codex, Claude, or open a fresh agent session so MCP tools reload.");
+  console.log(
+    "Update complete. Restart Cursor, Copilot, Codex, Claude, or open a fresh agent session so MCP tools reload."
+  );
 }
 async function runPostUpdate(config, options) {
   if (!options.fromVersion || !options.toVersion) {
@@ -8380,7 +9317,7 @@ async function getUpdateInfo(config, options) {
   };
 }
 async function currentPackageVersion() {
-  const rawPackage = await (0, import_promises6.readFile)((0, import_node_path6.join)(toolRoot(), "package.json"), "utf8");
+  const rawPackage = await (0, import_promises7.readFile)((0, import_node_path7.join)(toolRoot(), "package.json"), "utf8");
   const parsed = JSON.parse(rawPackage);
   if (!isJsonObject(parsed) || typeof parsed.version !== "string") {
     throw new Error("Could not read current threadnote package version.");
@@ -8430,11 +9367,11 @@ async function readFreshCache(config, registry) {
 }
 async function writeUpdateCache(config, cache) {
   await ensureDirectory(config.agentContextHome, false);
-  await (0, import_promises6.writeFile)(updateCachePath(config), `${JSON.stringify(cache, null, 2)}
+  await (0, import_promises7.writeFile)(updateCachePath(config), `${JSON.stringify(cache, null, 2)}
 `, { encoding: "utf8", mode: 384 });
 }
 function updateCachePath(config) {
-  return (0, import_node_path6.join)(config.agentContextHome, "update-check.json");
+  return (0, import_node_path7.join)(config.agentContextHome, "update-check.json");
 }
 async function runApplicablePostUpdateMigrations(config, options) {
   const state = await readPostUpdateState(config);
@@ -8498,7 +9435,7 @@ async function applicablePostUpdateMigrations(config, options) {
   return applicable;
 }
 async function readPostUpdateMigrations() {
-  const raw = await readFileIfExists((0, import_node_path6.join)(toolRoot(), "config", POST_UPDATE_MIGRATIONS_FILE));
+  const raw = await readFileIfExists((0, import_node_path7.join)(toolRoot(), "config", POST_UPDATE_MIGRATIONS_FILE));
   if (!raw) {
     return [];
   }
@@ -8537,7 +9474,7 @@ function printPostUpdateMigration(migration) {
   }
 }
 async function confirmPostUpdateMigration(prompt) {
-  const readline = (0, import_promises7.createInterface)({ input: import_node_process.stdin, output: import_node_process.stdout });
+  const readline = (0, import_promises8.createInterface)({ input: import_node_process.stdin, output: import_node_process.stdout });
   try {
     const answer = (await readline.question(prompt)).trim().toLowerCase();
     return answer === "y" || answer === "yes";
@@ -8569,11 +9506,11 @@ async function readPostUpdateState(config) {
 }
 async function writePostUpdateState(config, state) {
   await ensureDirectory(config.agentContextHome, false);
-  await (0, import_promises6.writeFile)(postUpdateStatePath(config), `${JSON.stringify(state, null, 2)}
+  await (0, import_promises7.writeFile)(postUpdateStatePath(config), `${JSON.stringify(state, null, 2)}
 `, { encoding: "utf8", mode: 384 });
 }
 function postUpdateStatePath(config) {
-  return (0, import_node_path6.join)(config.agentContextHome, POST_UPDATE_STATE_FILE);
+  return (0, import_node_path7.join)(config.agentContextHome, POST_UPDATE_STATE_FILE);
 }
 async function resolveUpdateRuntime(runtime) {
   if (runtime !== "auto") {
@@ -8603,18 +9540,18 @@ async function runtimeThreadnoteBin(runtime) {
   if (runtime === "npm") {
     const result = await runCommand("npm", ["prefix", "--global"], { allowFailure: true });
     const prefix = result.stdout.trim();
-    return prefix ? (0, import_node_path6.join)(prefix, "bin", NPM_PACKAGE_NAME) : void 0;
+    return prefix ? (0, import_node_path7.join)(prefix, "bin", NPM_PACKAGE_NAME) : void 0;
   }
   if (runtime === "bun") {
     const result = await runCommand("bun", ["pm", "bin", "-g"], { allowFailure: true });
     const binDir = result.stdout.trim();
-    return binDir ? (0, import_node_path6.join)(binDir, NPM_PACKAGE_NAME) : void 0;
+    return binDir ? (0, import_node_path7.join)(binDir, NPM_PACKAGE_NAME) : void 0;
   }
-  return (0, import_node_path6.join)(process.env.DENO_INSTALL ?? (0, import_node_path6.join)((0, import_node_os4.homedir)(), ".deno"), "bin", NPM_PACKAGE_NAME);
+  return (0, import_node_path7.join)(process.env.DENO_INSTALL ?? (0, import_node_path7.join)((0, import_node_os5.homedir)(), ".deno"), "bin", NPM_PACKAGE_NAME);
 }
 async function isExecutable(path) {
   try {
-    await (0, import_promises6.access)(path, import_node_fs3.constants.X_OK);
+    await (0, import_promises7.access)(path, import_node_fs4.constants.X_OK);
     return true;
   } catch (_err) {
     return false;
@@ -8692,7 +9629,7 @@ function safeVersionNumber(value) {
 async function runDoctor(config, options) {
   const checks = [];
   checks.push({ name: "mode", status: "ok", detail: options.dryRun ? "dry run; no writes" : "read-only checks" });
-  checks.push({ name: "platform", status: (0, import_node_os5.platform)() === "darwin" ? "ok" : "warn", detail: (0, import_node_os5.platform)() });
+  checks.push({ name: "platform", status: (0, import_node_os6.platform)() === "darwin" ? "ok" : "warn", detail: (0, import_node_os6.platform)() });
   checks.push(await commandCheck("node", ["--version"]));
   checks.push(await commandCheck("python3", ["--version"]));
   checks.push(await commandCheck("openviking-server", ["--help"]));
@@ -8705,9 +9642,9 @@ async function runDoctor(config, options) {
   checks.push(await commandShimCheck());
   checks.push(...await userAgentInstructionsChecks());
   checks.push(await manifestCheck(config.manifestPath));
-  checks.push(await fileCheck((0, import_node_path7.join)(toolRoot(), ".threadnoteignore"), "ignore file"));
-  checks.push(await fileCheck((0, import_node_path7.join)(toolRoot(), "config", "ov.conf.template.json"), "server config template"));
-  checks.push(await fileCheck((0, import_node_path7.join)(toolRoot(), "config", "ovcli.conf.template.json"), "cli config template"));
+  checks.push(await fileCheck((0, import_node_path8.join)(toolRoot(), ".threadnoteignore"), "ignore file"));
+  checks.push(await fileCheck((0, import_node_path8.join)(toolRoot(), "config", "ov.conf.template.json"), "server config template"));
+  checks.push(await fileCheck((0, import_node_path8.join)(toolRoot(), "config", "ovcli.conf.template.json"), "cli config template"));
   checks.push(await healthCheck(config));
   for (const check of checks) {
     console.log(`${formatStatus(check.status)} ${check.name}: ${check.detail}`);
@@ -8724,9 +9661,9 @@ async function runInstall(config, options) {
   const repairInvalidConfigs = options.repairInvalidConfigs === true;
   const dryRun = options.dryRun === true;
   await ensureDirectory(config.agentContextHome, dryRun);
-  await ensureDirectory((0, import_node_path7.join)(config.agentContextHome, "logs"), dryRun);
-  await ensureDirectory((0, import_node_path7.join)(config.agentContextHome, "redacted"), dryRun);
-  await ensureDirectory((0, import_node_path7.join)(config.agentContextHome, "mcp"), dryRun);
+  await ensureDirectory((0, import_node_path8.join)(config.agentContextHome, "logs"), dryRun);
+  await ensureDirectory((0, import_node_path8.join)(config.agentContextHome, "redacted"), dryRun);
+  await ensureDirectory((0, import_node_path8.join)(config.agentContextHome, "mcp"), dryRun);
   await installCommandShim(dryRun);
   await installUserAgentInstructions(dryRun);
   const serverPath = await findExecutable([OPENVIKING_SERVER_COMMAND]);
@@ -8752,17 +9689,17 @@ async function runInstall(config, options) {
   }
   await writeTemplateIfMissing({
     config,
-    destinationPath: (0, import_node_path7.join)(config.agentContextHome, "ov.conf"),
+    destinationPath: (0, import_node_path8.join)(config.agentContextHome, "ov.conf"),
     dryRun,
     shouldRepair: (content) => shouldRepairOpenVikingConfig(content, config) || repairInvalidConfigs && parseJsonConfigObject(content) === void 0,
-    templatePath: (0, import_node_path7.join)(toolRoot(), "config", "ov.conf.template.json")
+    templatePath: (0, import_node_path8.join)(toolRoot(), "config", "ov.conf.template.json")
   });
   await writeTemplateIfMissing({
     config,
-    destinationPath: (0, import_node_path7.join)(config.agentContextHome, "ovcli.conf"),
+    destinationPath: (0, import_node_path8.join)(config.agentContextHome, "ovcli.conf"),
     dryRun,
     shouldRepair: (content) => shouldRepairLegacyOvCliConfig(content) || repairInvalidConfigs && parseJsonConfigObject(content) === void 0,
-    templatePath: (0, import_node_path7.join)(toolRoot(), "config", "ovcli.conf.template.json")
+    templatePath: (0, import_node_path8.join)(toolRoot(), "config", "ovcli.conf.template.json")
   });
   if (options.start !== false) {
     const healthy = await repairServerHealth(config, dryRun);
@@ -8812,7 +9749,7 @@ async function runUninstall(config, options) {
   }
   console.log("Uninstalling local Threadnote setup.");
   await runStop(config, { dryRun });
-  await removePathIfExists((0, import_node_path7.join)(config.agentContextHome, "openviking-server.pid"), "pid file", dryRun);
+  await removePathIfExists((0, import_node_path8.join)(config.agentContextHome, "openviking-server.pid"), "pid file", dryRun);
   await removeLaunchAgent(dryRun);
   await removeMcpConfigs(options.mcp ?? "available", dryRun);
   await removeMcpSnippets(config, dryRun);
@@ -8866,16 +9803,16 @@ async function repairManifest(config, dryRun) {
     console.log(output2.trimEnd());
     return;
   }
-  await ensureDirectory((0, import_node_path7.dirname)(config.manifestPath), false);
+  await ensureDirectory((0, import_node_path8.dirname)(config.manifestPath), false);
   const currentContent = await readFileIfExists(config.manifestPath);
   if (currentContent !== void 0) {
     const backupPath = `${config.manifestPath}.legacy-${safeTimestamp()}`;
-    await (0, import_promises8.writeFile)(backupPath, currentContent, { encoding: "utf8", mode: 384 });
-    await (0, import_promises8.chmod)(backupPath, 384);
+    await (0, import_promises9.writeFile)(backupPath, currentContent, { encoding: "utf8", mode: 384 });
+    await (0, import_promises9.chmod)(backupPath, 384);
     console.log(`Backup: ${backupPath}`);
   }
-  await (0, import_promises8.writeFile)(config.manifestPath, output2, { encoding: "utf8", mode: 384 });
-  await (0, import_promises8.chmod)(config.manifestPath, 384);
+  await (0, import_promises9.writeFile)(config.manifestPath, output2, { encoding: "utf8", mode: 384 });
+  await (0, import_promises9.chmod)(config.manifestPath, 384);
   console.log(`Wrote replacement manifest: ${config.manifestPath}`);
 }
 async function repairServerHealth(config, dryRun) {
@@ -8916,16 +9853,16 @@ async function runStart(config, options) {
     );
   }
   const logPath = openVikingLogPath(config);
-  await ensureDirectory((0, import_node_path7.dirname)(logPath), false);
+  await ensureDirectory((0, import_node_path8.dirname)(logPath), false);
   if (options.foreground === true) {
     const result = await runInteractive(server, args);
     process.exitCode = result;
     return;
   }
-  const logFd = (0, import_node_fs4.openSync)(logPath, "a");
+  const logFd = (0, import_node_fs5.openSync)(logPath, "a");
   const child = spawnDetachedServerWithLog(server, args, logFd);
   child.unref();
-  await (0, import_promises8.writeFile)((0, import_node_path7.join)(config.agentContextHome, "openviking-server.pid"), `${child.pid}
+  await (0, import_promises9.writeFile)((0, import_node_path8.join)(config.agentContextHome, "openviking-server.pid"), `${child.pid}
 `, "utf8");
   const health = await waitForOpenVikingHealth(config, START_HEALTH_TIMEOUT_MS);
   if (health) {
@@ -8940,7 +9877,7 @@ function spawnDetachedServerWithLog(server, args, logFd) {
   try {
     return spawnDetachedServer(server, args, logFd);
   } finally {
-    (0, import_node_fs4.closeSync)(logFd);
+    (0, import_node_fs5.closeSync)(logFd);
   }
 }
 function spawnDetachedServer(server, args, logFd) {
@@ -8951,14 +9888,14 @@ function spawnDetachedServer(server, args, logFd) {
 }
 async function runStop(config, options) {
   const launchAgentPath = expandPath(`~/Library/LaunchAgents/${LAUNCHD_LABEL}.plist`);
-  if ((0, import_node_os5.platform)() === "darwin") {
+  if ((0, import_node_os6.platform)() === "darwin") {
     if (options.dryRun === true || await exists(launchAgentPath)) {
       await maybeRun(options.dryRun === true, "launchctl", ["unload", launchAgentPath], { allowFailure: true });
     } else {
       console.log(`No LaunchAgent found: ${launchAgentPath}`);
     }
   }
-  const pidPath = (0, import_node_path7.join)(config.agentContextHome, "openviking-server.pid");
+  const pidPath = (0, import_node_path8.join)(config.agentContextHome, "openviking-server.pid");
   const pidText = await readFileIfExists(pidPath);
   if (!pidText) {
     console.log("No pid file found for detached OpenViking server.");
@@ -9054,7 +9991,7 @@ async function pythonSystemCertificatesCheck() {
   };
 }
 async function commandShimCheck() {
-  const shimPath = (0, import_node_path7.join)(expandPath(process.env.THREADNOTE_BIN_DIR ?? "~/.local/bin"), "threadnote");
+  const shimPath = (0, import_node_path8.join)(expandPath(process.env.THREADNOTE_BIN_DIR ?? "~/.local/bin"), "threadnote");
   const content = await readFileIfExists(shimPath);
   if (content === void 0) {
     return { name: "threadnote shim", status: "warn", detail: `${shimPath} missing; repair will create it` };
@@ -9076,9 +10013,9 @@ async function commandShimCheck() {
   return { name: "threadnote shim", status: "ok", detail: shimPath };
 }
 async function userAgentInstructionsChecks() {
-  const expectedBlock = await renderUserAgentInstructionsBlock();
   return Promise.all(
     USER_AGENT_INSTRUCTION_TARGETS.map(async (target) => {
+      const expectedInstructions = await renderUserAgentInstructions(target);
       const targetPath = expandPath(target.path);
       const content = await readFileIfExists(targetPath);
       if (content === void 0) {
@@ -9092,7 +10029,7 @@ async function userAgentInstructionsChecks() {
           detail: `${targetPath} missing threadnote block; install will add it`
         };
       }
-      if (existingBlock !== expectedBlock) {
+      if (target.kind === "file" && content !== expectedInstructions || target.kind === "block" && existingBlock !== expectedInstructions) {
         return {
           name: target.label,
           status: "warn",
@@ -9120,11 +10057,11 @@ async function hasPythonModule(serverPath, moduleName) {
 async function siblingPythonForExecutable(executablePath) {
   let resolvedPath;
   try {
-    resolvedPath = await (0, import_promises8.realpath)(executablePath);
+    resolvedPath = await (0, import_promises9.realpath)(executablePath);
   } catch (_err) {
     return void 0;
   }
-  const pythonPath = (0, import_node_path7.join)((0, import_node_path7.dirname)(resolvedPath), "python");
+  const pythonPath = (0, import_node_path8.join)((0, import_node_path8.dirname)(resolvedPath), "python");
   return await exists(pythonPath) ? pythonPath : void 0;
 }
 async function manifestCheck(path) {
@@ -9246,38 +10183,38 @@ function printInstallNextSteps(options) {
 }
 async function writeTemplateIfMissing(options) {
   if (await exists(options.destinationPath)) {
-    const currentContent = await (0, import_promises8.readFile)(options.destinationPath, "utf8");
+    const currentContent = await (0, import_promises9.readFile)(options.destinationPath, "utf8");
     if (options.shouldRepair?.(currentContent) !== true) {
       console.log(`Already exists: ${options.destinationPath}`);
       return;
     }
-    const rendered2 = renderTemplate(await (0, import_promises8.readFile)(options.templatePath, "utf8"), options.config);
+    const rendered2 = renderTemplate(await (0, import_promises9.readFile)(options.templatePath, "utf8"), options.config);
     if (options.dryRun) {
       console.log(`Would repair generated config: ${options.destinationPath}`);
       return;
     }
     const backupPath = `${options.destinationPath}.legacy-${safeTimestamp()}`;
-    await (0, import_promises8.writeFile)(backupPath, currentContent, { encoding: "utf8", mode: 384 });
-    await (0, import_promises8.chmod)(backupPath, 384);
-    await (0, import_promises8.writeFile)(options.destinationPath, rendered2, { encoding: "utf8", mode: 384 });
-    await (0, import_promises8.chmod)(options.destinationPath, 384);
+    await (0, import_promises9.writeFile)(backupPath, currentContent, { encoding: "utf8", mode: 384 });
+    await (0, import_promises9.chmod)(backupPath, 384);
+    await (0, import_promises9.writeFile)(options.destinationPath, rendered2, { encoding: "utf8", mode: 384 });
+    await (0, import_promises9.chmod)(options.destinationPath, 384);
     console.log(`Repaired generated config: ${options.destinationPath}`);
     console.log(`Backup: ${backupPath}`);
     return;
   }
-  const rendered = renderTemplate(await (0, import_promises8.readFile)(options.templatePath, "utf8"), options.config);
+  const rendered = renderTemplate(await (0, import_promises9.readFile)(options.templatePath, "utf8"), options.config);
   if (options.dryRun) {
     console.log(`Would write ${options.destinationPath}`);
     return;
   }
-  await ensureDirectory((0, import_node_path7.dirname)(options.destinationPath), false);
-  await (0, import_promises8.writeFile)(options.destinationPath, rendered, { encoding: "utf8", mode: 384 });
-  await (0, import_promises8.chmod)(options.destinationPath, 384);
+  await ensureDirectory((0, import_node_path8.dirname)(options.destinationPath), false);
+  await (0, import_promises9.writeFile)(options.destinationPath, rendered, { encoding: "utf8", mode: 384 });
+  await (0, import_promises9.chmod)(options.destinationPath, 384);
   console.log(`Wrote ${options.destinationPath}`);
 }
 async function installCommandShim(dryRun) {
   const binDir = expandPath(process.env.THREADNOTE_BIN_DIR ?? "~/.local/bin");
-  const shimPath = (0, import_node_path7.join)(binDir, "threadnote");
+  const shimPath = (0, import_node_path8.join)(binDir, "threadnote");
   const existingContent = await readFileIfExists(shimPath);
   if (existingContent && !isManagedCommandShim(existingContent)) {
     console.log(`WARN not overwriting existing command shim: ${shimPath}`);
@@ -9293,12 +10230,12 @@ async function installCommandShim(dryRun) {
     return;
   }
   await ensureDirectory(binDir, false);
-  await (0, import_promises8.writeFile)(shimPath, content, { encoding: "utf8", mode: 493 });
-  await (0, import_promises8.chmod)(shimPath, 493);
+  await (0, import_promises9.writeFile)(shimPath, content, { encoding: "utf8", mode: 493 });
+  await (0, import_promises9.chmod)(shimPath, 493);
   console.log(`Wrote command shim: ${shimPath}`);
 }
 async function removeCommandShim(dryRun) {
-  const shimPath = (0, import_node_path7.join)(expandPath(process.env.THREADNOTE_BIN_DIR ?? "~/.local/bin"), "threadnote");
+  const shimPath = (0, import_node_path8.join)(expandPath(process.env.THREADNOTE_BIN_DIR ?? "~/.local/bin"), "threadnote");
   const content = await readFileIfExists(shimPath);
   if (content === void 0) {
     console.log(`Already absent: ${shimPath}`);
@@ -9311,11 +10248,15 @@ async function removeCommandShim(dryRun) {
   await removePath(shimPath, "command shim", dryRun);
 }
 async function installUserAgentInstructions(dryRun) {
-  const block = await renderUserAgentInstructionsBlock();
   for (const target of USER_AGENT_INSTRUCTION_TARGETS) {
+    const instructions = await renderUserAgentInstructions(target);
     const targetPath = expandPath(target.path);
     const currentContent = await readFileIfExists(targetPath);
-    const nextContent = upsertManagedBlock(currentContent ?? "", block);
+    if (target.kind === "file" && currentContent !== void 0 && extractManagedBlock(currentContent) === void 0) {
+      console.log(`WARN ${targetPath} is not managed by threadnote; not modifying it`);
+      continue;
+    }
+    const nextContent = target.kind === "file" ? instructions : upsertManagedBlock(currentContent ?? "", instructions);
     if (nextContent === void 0) {
       console.log(`WARN ${targetPath} has partial threadnote markers; not modifying it`);
       continue;
@@ -9328,8 +10269,8 @@ async function installUserAgentInstructions(dryRun) {
       console.log(currentContent === void 0 ? `Would write ${targetPath}` : `Would update ${targetPath}`);
       continue;
     }
-    await ensureDirectory((0, import_node_path7.dirname)(targetPath), false);
-    await (0, import_promises8.writeFile)(targetPath, nextContent, { encoding: "utf8", mode: 420 });
+    await ensureDirectory((0, import_node_path8.dirname)(targetPath), false);
+    await (0, import_promises9.writeFile)(targetPath, nextContent, { encoding: "utf8", mode: 420 });
     console.log(currentContent === void 0 ? `Wrote ${targetPath}` : `Updated ${targetPath}`);
   }
 }
@@ -9341,6 +10282,14 @@ async function removeUserAgentInstructions(dryRun) {
       console.log(`Already absent: ${targetPath}`);
       continue;
     }
+    if (target.kind === "file") {
+      if (extractManagedBlock(currentContent) === void 0) {
+        console.log(`WARN ${targetPath} is not managed by threadnote; not removing it`);
+        continue;
+      }
+      await removePath(targetPath, target.label, dryRun);
+      continue;
+    }
     const nextContent = removeManagedBlock(currentContent);
     if (nextContent === void 0) {
       console.log(`WARN ${targetPath} has partial threadnote markers; not modifying it`);
@@ -9358,12 +10307,27 @@ async function removeUserAgentInstructions(dryRun) {
       console.log(`Would update ${targetPath}`);
       continue;
     }
-    await (0, import_promises8.writeFile)(targetPath, nextContent, { encoding: "utf8", mode: 420 });
+    await (0, import_promises9.writeFile)(targetPath, nextContent, { encoding: "utf8", mode: 420 });
     console.log(`Updated ${targetPath}`);
   }
 }
+async function renderUserAgentInstructions(target) {
+  const block = await renderUserAgentInstructionsBlock();
+  if (target.kind === "block") {
+    return block;
+  }
+  return [
+    "---",
+    "name: Threadnote",
+    "description: Shared local context and handoffs through Threadnote",
+    'applyTo: "**"',
+    "---",
+    "",
+    block
+  ].join("\n");
+}
 async function renderUserAgentInstructionsBlock() {
-  const instructions = (await (0, import_promises8.readFile)((0, import_node_path7.join)(toolRoot(), "docs", "agent-instructions.md"), "utf8")).trim();
+  const instructions = (await (0, import_promises9.readFile)((0, import_node_path8.join)(toolRoot(), "docs", "agent-instructions.md"), "utf8")).trim();
   return `${USER_INSTRUCTIONS_START_MARKER}
 ${instructions}
 ${USER_INSTRUCTIONS_END_MARKER}`;
@@ -9438,12 +10402,12 @@ function isManagedCommandShim(content) {
   return content.includes(SHIM_MARKER);
 }
 async function installLaunchAgent(config, dryRun) {
-  if ((0, import_node_os5.platform)() !== "darwin") {
+  if ((0, import_node_os6.platform)() !== "darwin") {
     throw new Error("launchd autostart is only supported on macOS.");
   }
-  const source = (0, import_node_path7.join)(toolRoot(), "config", "launchd", `${LAUNCHD_LABEL}.plist.template`);
+  const source = (0, import_node_path8.join)(toolRoot(), "config", "launchd", `${LAUNCHD_LABEL}.plist.template`);
   const destination = expandPath(`~/Library/LaunchAgents/${LAUNCHD_LABEL}.plist`);
-  const rendered = renderTemplate(await (0, import_promises8.readFile)(source, "utf8"), config);
+  const rendered = renderTemplate(await (0, import_promises9.readFile)(source, "utf8"), config);
   if (dryRun) {
     console.log(`Would write ${destination}`);
     console.log(`Would run: launchctl unload ${destination}`);
@@ -9451,9 +10415,9 @@ async function installLaunchAgent(config, dryRun) {
     console.log(`Would run: launchctl start ${LAUNCHD_LABEL}`);
     return;
   }
-  await ensureDirectory((0, import_node_path7.dirname)(destination), false);
-  await ensureDirectory((0, import_node_path7.dirname)(openVikingLogPath(config)), false);
-  await (0, import_promises8.writeFile)(destination, rendered, "utf8");
+  await ensureDirectory((0, import_node_path8.dirname)(destination), false);
+  await ensureDirectory((0, import_node_path8.dirname)(openVikingLogPath(config)), false);
+  await (0, import_promises9.writeFile)(destination, rendered, "utf8");
   await maybeRun(false, "launchctl", ["unload", destination], { allowFailure: true });
   await maybeRun(false, "launchctl", ["load", destination]);
   await maybeRun(false, "launchctl", ["start", LAUNCHD_LABEL]);
@@ -9516,7 +10480,7 @@ function isGeneratedLocalPilotConfig(parsed, config) {
   if (typeof parsed.default_user !== "string") {
     return false;
   }
-  if (!isJsonObject(parsed.storage) || parsed.storage.workspace !== (0, import_node_path7.join)(config.agentContextHome, "data")) {
+  if (!isJsonObject(parsed.storage) || parsed.storage.workspace !== (0, import_node_path8.join)(config.agentContextHome, "data")) {
     return false;
   }
   return isJsonObject(parsed.server) && parsed.server.host === config.host && String(parsed.server.port) === String(config.port);
@@ -9557,7 +10521,7 @@ async function main() {
   });
   program2.command("repair").description("Repair local OpenViking install, config files, server health, shim, manifest, and MCP config").option("--dry-run", "Print the repair actions without making changes").option(
     "--mcp <clients>",
-    "MCP clients to repair: available, all, none, codex, claude, cursor, or comma-separated list",
+    "MCP clients to repair: available, all, none, codex, claude, cursor, copilot, or comma-separated list",
     "available"
   ).option("--no-start", "Do not start OpenViking if health is failing").option("--no-post-update", "Skip post-update migration prompts after repair").option("--package-manager <manager>", "uv, pipx, or pip", parsePackageManager).action(async (options) => {
     const config = getRuntimeConfig(program2);
@@ -9574,7 +10538,7 @@ async function main() {
   });
   program2.command("uninstall").description("Remove Threadnote setup and optionally erase local memories").option("--dry-run", "Print uninstall actions without making changes").option(
     "--mcp <clients>",
-    "MCP clients to remove: available, all, none, codex, claude, cursor, or comma-separated list",
+    "MCP clients to remove: available, all, none, codex, claude, cursor, copilot, or comma-separated list",
     "available"
   ).option("--preserve-memories", "Preserve THREADNOTE_HOME and OpenViking memories (default)").option("--erase-memories", "Delete THREADNOTE_HOME, including all OpenViking memories").action(async (options) => {
     await runUninstall(getRuntimeConfig(program2), options);
@@ -9588,10 +10552,10 @@ async function main() {
   program2.command("seed-skills").description("Seed Codex, Claude, and repo-local SKILL.md files as a searchable catalog").option("--dry-run", "Print skill files and ov commands without importing").option("--manifest <path>", "Manifest path for repo-local skill discovery").option("--native", "Use native OpenViking skill ingestion; requires a working VLM config").action(async (options) => {
     await runSeedSkills(getRuntimeConfig(program2, options.manifest), options);
   });
-  program2.command("mcp-install").description("Install OpenViking MCP config for a supported agent").argument("<agent>", "codex, claude, or cursor").option("--apply", "Actually modify the selected agent config").option("--name <name>", "MCP server name", OPENVIKING_MCP_NAME).option("--native-http", "Install OpenViking native HTTP MCP endpoint instead of the local stdio adapter").option("--scope <scope>", "Claude MCP config scope: user, local, or project", parseClaudeMcpScope, "user").option("--url <url>", "OpenViking native HTTP MCP URL").option("--bearer-token-env-var <name>", "Environment variable containing the local API key").action(async (agent, options) => {
+  program2.command("mcp-install").description("Install OpenViking MCP config for a supported agent").argument("<agent>", "codex, claude, cursor, or copilot").option("--apply", "Actually modify the selected agent config").option("--name <name>", "MCP server name", OPENVIKING_MCP_NAME).option("--native-http", "Install OpenViking native HTTP MCP endpoint instead of the local stdio adapter").option("--scope <scope>", "Claude MCP config scope: user, local, or project", parseClaudeMcpScope, "user").option("--url <url>", "OpenViking native HTTP MCP URL").option("--bearer-token-env-var <name>", "Environment variable containing the local API key").action(async (agent, options) => {
     await runMcpInstall(getRuntimeConfig(program2), parseAgentClient(agent), options);
   });
-  program2.command("remember").description("Store a durable engineering memory in OpenViking").option("--dry-run", "Print memory and ov command without storing").option("--kind <kind>", "durable, handoff, incident, preference, or smoke", parseMemoryKind, "durable").option("--project <name>", "Project/repo/topic namespace for lifecycle-aware storage").option("--replace <uri>", "Supersede an existing viking:// memory after the new memory is stored").option("--source-agent-client <name>", "codex, claude, cursor, gemini, or another client name", "codex").option("--status <status>", "active, archived, or superseded", parseMemoryStatus, "active").option("--stdin", "Read memory text from stdin").option("--text <text>", "Memory text to store").option("--topic <name>", "Stable topic name; active memories with the same project/topic update one file").action(async (options) => {
+  program2.command("remember").description("Store a durable engineering memory in OpenViking").option("--dry-run", "Print memory and ov command without storing").option("--kind <kind>", "durable, handoff, incident, preference, or smoke", parseMemoryKind, "durable").option("--project <name>", "Project/repo/topic namespace for lifecycle-aware storage").option("--replace <uri>", "Supersede an existing viking:// memory after the new memory is stored").option("--source-agent-client <name>", "codex, claude, cursor, copilot, or another client name", "codex").option("--status <status>", "active, archived, or superseded", parseMemoryStatus, "active").option("--stdin", "Read memory text from stdin").option("--text <text>", "Memory text to store").option("--topic <name>", "Stable topic name; active memories with the same project/topic update one file").action(async (options) => {
     await runRemember(getRuntimeConfig(program2), options);
   });
   program2.command("migrate-memories").description("Migrate legacy session-only Threadnote memories into durable memory files").option("--all-accounts", "Scan all local OpenViking accounts under THREADNOTE_HOME").option("--dry-run", "Print migration actions without writing memories").option("--limit <count>", "Maximum number of memories to migrate").option(
@@ -9614,7 +10578,7 @@ async function main() {
   program2.command("list").alias("ls").description("List a viking:// directory").argument("[uri]", "viking:// URI to list", "viking://").option("-a, --all", "Show hidden files such as .abstract.md and .overview.md").option("--dry-run", "Print ov command without listing").option("-n, --node-limit <count>", "Maximum number of nodes to list").option("-r, --recursive", "List subdirectories recursively").option("-s, --simple", "Print only paths").action(async (uri, options) => {
     await runList(getRuntimeConfig(program2), uri, options);
   });
-  program2.command("handoff").description("Capture current repo state as a durable cross-agent handoff memory").option("--blockers <text>", "Known blockers").option("--dry-run", "Print handoff without storing").option("--next-step <text>", "Suggested next step").option("--project <name>", "Project/repo namespace; defaults to current repo basename").option("--replace <uri>", "Supersede an existing viking:// memory after the new handoff is stored").option("--source-agent-client <name>", "codex, claude, cursor, gemini, or another client name", "codex").option("--task <text>", "Current task summary").option("--tests <text>", "Tests or checks run").option("--topic <name>", "Stable topic name; active handoffs with the same project/topic update one file").action(async (options) => {
+  program2.command("handoff").description("Capture current repo state as a durable cross-agent handoff memory").option("--blockers <text>", "Known blockers").option("--dry-run", "Print handoff without storing").option("--next-step <text>", "Suggested next step").option("--project <name>", "Project/repo namespace; defaults to current repo basename").option("--replace <uri>", "Supersede an existing viking:// memory after the new handoff is stored").option("--source-agent-client <name>", "codex, claude, cursor, copilot, or another client name", "codex").option("--task <text>", "Current task summary").option("--tests <text>", "Tests or checks run").option("--topic <name>", "Stable topic name; active handoffs with the same project/topic update one file").action(async (options) => {
     await runHandoff(getRuntimeConfig(program2), options);
   });
   program2.command("archive").description("Move a memory into the archived lifecycle tree, then remove the original after the archive is stored").argument("<uri>", "viking:// memory URI to archive").option("--dry-run", "Print archive content and ov commands without changing anything").option("--kind <kind>", "durable, handoff, incident, preference, or smoke", parseMemoryKind).option("--project <name>", "Override inferred project/repo namespace").option("--topic <name>", "Override inferred topic").action(async (uri, options) => {
@@ -9623,6 +10587,31 @@ async function main() {
   program2.command("forget").description("Remove a viking:// URI from local OpenViking context").argument("<uri>", "viking:// URI to remove").option("--dry-run", "Print ov command without deleting").action(async (uri, options) => {
     await runForget(getRuntimeConfig(program2), uri, options);
   });
+  const share = program2.command("share").description("Share durable memories with teammates through a git-backed repository");
+  share.command("init").description("Configure a shared memories repo for a team (clones the remote into the local memory tree)").argument("<remote-url>", "git remote URL of the shared memories repo").option("--team <name>", 'Team name; defaults to "default"').option("--set-default", "Mark this team as the default for future share commands").option(
+    "--no-push",
+    "Do not push the auto-generated .gitignore housekeeping commit. Does not affect future publishes."
+  ).option("--dry-run", "Print actions without running them").action(async (remoteUrl, options) => {
+    await runShareInit(getRuntimeConfig(program2), remoteUrl, options);
+  });
+  share.command("status").description("Show git status and ahead/behind counts for a shared team").option("--team <name>", "Team name; defaults to the configured default team").option("--dry-run", "Print git commands without running them").action(async (options) => {
+    await runShareStatus(getRuntimeConfig(program2), options);
+  });
+  share.command("sync").description("Pull, reindex, and push the shared memories repo for a team").option("--team <name>", "Team name; defaults to the configured default team").option("--message <text>", "Commit message when auto-committing local edits").option("--no-auto-commit", "Refuse to sync if there are uncommitted local changes").option("--no-push", "Skip the push step after pulling and reindexing").option("--dry-run", "Print actions without running them").action(async (options) => {
+    await runShareSync(getRuntimeConfig(program2), options);
+  });
+  share.command("publish").description("Move a personal memory into the shared team namespace, commit and push").argument("<viking-uri>", "viking:// memory URI to publish").option("--team <name>", "Team name; defaults to the configured default team").option("--message <text>", "Commit message override").option("--no-push", "Skip the push step").option("--dry-run", "Print actions without running them").action(async (uri, options) => {
+    await runSharePublish(getRuntimeConfig(program2), uri, options);
+  });
+  share.command("unpublish").description("Pull a shared memory back into the personal namespace, commit removal and push").argument("<viking-uri>", "viking:// memory URI inside a team shared subtree").option("--team <name>", "Team name; defaults to the configured default team").option("--message <text>", "Commit message override").option("--no-push", "Skip the push step").option("--dry-run", "Print actions without running them").action(async (uri, options) => {
+    await runShareUnpublish(getRuntimeConfig(program2), uri, options);
+  });
+  share.command("list").description("List configured shared teams").option("--dry-run", "Print without side effects (no-op for list)").action(async (options) => {
+    await runShareList(getRuntimeConfig(program2), options);
+  });
+  share.command("remove").description("Forget a configured team and optionally delete its worktree/gitdir").option("--team <name>", "Team name; defaults to the configured default team").option("--keep-files", "Keep the worktree and gitdir on disk; only forget the team entry").option("--dry-run", "Print actions without running them").action(async (options) => {
+    await runShareRemove(getRuntimeConfig(program2), options);
+  });
   program2.command("export-pack").description("Export local OpenViking context to an .ovpack").option("--dry-run", "Print ov command without exporting").option("--path <path>", "Output .ovpack path").option("--uri <uri>", "Source viking:// URI to export", "viking://").action(async (options) => {
     await runExportPack(getRuntimeConfig(program2), options);
   });