threadnote 0.3.8 → 0.4.0

package/dist/threadnote.cjs

@@ -7382,9 +7382,9 @@ async function runRead(config, uri, options) {
   const ov = await openVikingCliForMode(options.dryRun === true);
   const result = await maybeRun(options.dryRun === true, ov, withIdentity(config, ["read", uri]));
   if (result && result.stdout.includes("[Directory overview is not ready]") && (uri.endsWith("/.overview.md") || uri.endsWith("/.abstract.md"))) {
-    const parentUri = parentVikingUri(uri);
+    const parentUri2 = parentVikingUri(uri);
     console.log("\nThis is a generated summary placeholder. To read the underlying content, inspect leaf nodes:");
-    console.log(`  threadnote list ${parentUri} --all --recursive`);
+    console.log(`  threadnote list ${parentUri2} --all --recursive`);
   }
 }
 async function runList(config, uri, options) {
@@ -7727,6 +7727,7 @@ function exactMemoryScopes(config, includeArchived) {
     `${userBase}/handoffs/active`,
     `${userBase}/incidents/active`,
     `${userBase}/events`,
+    `${userBase}/shared`,
     `viking://agent/${uriSegment(config.agentId)}/memories`
   ];
   return includeArchived ? [...scopes, `${userBase}/durable/archived`, `${userBase}/handoffs/archived`, `${userBase}/incidents/archived`] : scopes;
@@ -8395,19 +8396,780 @@ function detectSecretMatches(content) {
   return matches;
 }
 
+// src/share.ts
+var import_promises6 = require("node:fs/promises");
+var import_node_os4 = require("node:os");
+var import_node_path6 = require("node:path");
+var TEAMS_FILE_VERSION = 1;
+var SHARED_SEGMENT = "shared";
+var SHAREABLE_MEMORY_KIND_DIRS = ["durable"];
+var DEFAULT_GIT_REMOTE_NAME = "origin";
+var SCRUBBER_PATTERNS = [
+  { name: "private key", regex: /-----BEGIN [A-Z ]*PRIVATE KEY-----/ },
+  { name: "API key (sk-...)", regex: /\bsk-[A-Za-z0-9_-]{16,}/ },
+  { name: "GitHub token", regex: /\bgh[pousr]_[A-Za-z0-9_]{16,}/ },
+  { name: "GitHub fine-grained PAT", regex: /\bgithub_pat_[A-Za-z0-9_]{20,}/ },
+  { name: "GitLab PAT", regex: /\bglpat-[A-Za-z0-9_-]{20,}/ },
+  { name: "bearer token", regex: /\bBearer\s+[A-Za-z0-9._~+/=-]{20,}/i },
+  // Matches bare JWTs (three base64url segments). May surface a JWE token in
+  // legitimate docs; if that becomes noisy we can switch to warn-only.
+  { name: "JWT", regex: /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}/ },
+  { name: "AWS access key", regex: /\bAKIA[0-9A-Z]{16}\b/ },
+  // Slack tokens: xoxa/xoxb/xoxc (configuration)/xoxd (legacy user cookie)/
+  // xoxe (refresh)/xoxp/xoxr/xoxs, with optional -N- segment for the workspace tier.
+  { name: "Slack token", regex: /\bxox[abcdeprs](?:-\d-)?[A-Za-z0-9._-]{10,}/i }
+];
+async function runShareInit(config, remoteUrl, options) {
+  if (!remoteUrl.trim()) {
+    throw new Error("Provide a git remote URL for the shared memories repo.");
+  }
+  const dryRun = options.dryRun === true;
+  const teamName = normalizeTeamName(options.team);
+  const teamsFile = await readTeamsFile(config);
+  if (teamsFile.teams[teamName]) {
+    throw new Error(
+      `Team "${teamName}" is already configured (remote ${teamsFile.teams[teamName].remote}). Remove it first with: threadnote share remove --team ${teamName}`
+    );
+  }
+  const worktree = teamWorktreePath(config, teamName);
+  const gitdir = teamGitdirPath(config, teamName);
+  await assertWorktreeUsable(worktree);
+  if (await exists(gitdir)) {
+    throw new Error(`Gitdir already exists at ${gitdir}; remove it or pick a different team name.`);
+  }
+  await ensureDirectory((0, import_node_path6.dirname)(worktree), dryRun);
+  await ensureDirectory((0, import_node_path6.dirname)(gitdir), dryRun);
+  const git = await requiredExecutable("git");
+  await maybeRun(dryRun, git, ["clone", `--separate-git-dir=${gitdir}`, "--", remoteUrl, worktree]);
+  const newConfig = {
+    addedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    gitdir,
+    name: teamName,
+    remote: remoteUrl,
+    worktree
+  };
+  const updatedTeams = {
+    defaultTeam: shouldSetDefault(options, teamsFile) ? teamName : teamsFile.defaultTeam ?? teamName,
+    teams: { ...teamsFile.teams, [teamName]: newConfig },
+    version: TEAMS_FILE_VERSION
+  };
+  if (dryRun) {
+    console.log(`Would write teams file: ${teamsFilePath(config)}`);
+    console.log(`Would set ${teamName} as default? ${updatedTeams.defaultTeam === teamName}`);
+  } else {
+    await writeTeamsFile(config, updatedTeams);
+    console.log(`Configured shared team "${teamName}" -> ${portablePath(worktree)}`);
+  }
+  if (!dryRun) {
+    await ensureSharedGitignore(worktree, git, options.push !== false);
+    const ingested = await ingestWorktreeFiles(config, newConfig, "create");
+    console.log(`Ingested ${ingested} shared memory file(s) into OpenViking.`);
+  }
+}
+var SHARED_GITIGNORE_PATTERNS = ["**/.abstract.md", "**/.overview.md"];
+var SHARED_GITIGNORE_HEADER = "# Threadnote: ignore OpenViking-generated directory summaries.";
+async function ensureSharedGitignore(worktree, git, push) {
+  const gitignorePath = (0, import_node_path6.join)(worktree, ".gitignore");
+  const existing = await readFileIfExists(gitignorePath) ?? "";
+  const lines = existing.split("\n").map((line) => line.trim());
+  const missingPatterns = SHARED_GITIGNORE_PATTERNS.filter((pattern) => !lines.includes(pattern));
+  if (missingPatterns.length === 0) {
+    return;
+  }
+  const hasHeader = lines.includes(SHARED_GITIGNORE_HEADER);
+  const segments = [];
+  if (existing.length > 0 && !existing.endsWith("\n")) {
+    segments.push("\n");
+  }
+  if (existing.length > 0) {
+    segments.push("\n");
+  }
+  if (!hasHeader) {
+    segments.push(SHARED_GITIGNORE_HEADER, "\n");
+  }
+  segments.push(missingPatterns.join("\n"), "\n");
+  await (0, import_promises6.writeFile)(gitignorePath, `${existing}${segments.join("")}`, { encoding: "utf8" });
+  console.log(`Added ${missingPatterns.join(", ")} to ${portablePath(gitignorePath)}`);
+  await maybeRun(false, git, ["-C", worktree, "add", ".gitignore"]);
+  const commitResult = await runCommand(
+    git,
+    ["-C", worktree, "commit", "-m", "share: ignore OpenViking directory summaries"],
+    { allowFailure: true }
+  );
+  if (commitResult.exitCode !== 0) {
+    const detail = commitResult.stderr.trim() || commitResult.stdout.trim();
+    if (!/nothing to commit|no changes added/i.test(detail)) {
+      console.warn(
+        `.gitignore housekeeping commit was rejected (${detail || "unknown"}); it will be retried on the next share sync.`
+      );
+      return;
+    }
+  }
+  if (push) {
+    await maybeRun(false, git, ["-C", worktree, "push", DEFAULT_GIT_REMOTE_NAME], { allowFailure: true });
+  }
+}
+async function runShareStatus(config, options) {
+  const team = await resolveTeam(config, options.team);
+  const git = await requiredExecutable("git");
+  console.log(`Team: ${team.name}`);
+  console.log(`Remote: ${team.config.remote}`);
+  console.log(`Worktree: ${portablePath(team.config.worktree)}`);
+  console.log(`Gitdir: ${portablePath(team.config.gitdir)}`);
+  await maybeRun(options.dryRun === true, git, ["-C", team.config.worktree, "status", "--short", "--branch"]);
+  await maybeRun(options.dryRun === true, git, ["-C", team.config.worktree, "fetch", DEFAULT_GIT_REMOTE_NAME], {
+    allowFailure: true
+  });
+  const ahead = await gitOutput(team.config.worktree, ["rev-list", "--count", "@{u}..HEAD"], options.dryRun === true);
+  const behind = await gitOutput(team.config.worktree, ["rev-list", "--count", "HEAD..@{u}"], options.dryRun === true);
+  if (ahead !== void 0) {
+    console.log(`Ahead of upstream: ${ahead}`);
+  }
+  if (behind !== void 0) {
+    console.log(`Behind upstream: ${behind}`);
+  }
+}
+async function runShareSync(config, options) {
+  const team = await resolveTeam(config, options.team);
+  const dryRun = options.dryRun === true;
+  const git = await requiredExecutable("git");
+  const worktree = team.config.worktree;
+  if (!dryRun) {
+    await ensureSharedGitignore(worktree, git, false);
+  }
+  if (await hasUncommittedChanges(worktree)) {
+    if (options.autoCommit === false) {
+      throw new Error(
+        `Worktree ${worktree} has uncommitted changes. Commit them yourself or rerun without --no-auto-commit.`
+      );
+    }
+    const message = options.message ?? `share: sync ${(/* @__PURE__ */ new Date()).toISOString()}`;
+    await stageShareableChanges(dryRun, git, worktree);
+    await maybeRun(dryRun, git, ["-C", worktree, "commit", "-m", message], { allowFailure: true });
+  }
+  const beforeRev = await gitOutput(worktree, ["rev-parse", "HEAD"], dryRun);
+  await maybeRun(dryRun, git, ["-C", worktree, "fetch", DEFAULT_GIT_REMOTE_NAME]);
+  const pullResult = dryRun ? void 0 : await runCommand(git, ["-C", worktree, "pull", "--rebase", DEFAULT_GIT_REMOTE_NAME], { allowFailure: true });
+  if (dryRun) {
+    console.log(`Would run: ${formatShellCommand(git, ["-C", worktree, "pull", "--rebase", DEFAULT_GIT_REMOTE_NAME])}`);
+  } else if (pullResult && pullResult.exitCode !== 0) {
+    if (await exists((0, import_node_path6.join)(team.config.gitdir, "rebase-merge")) || await exists((0, import_node_path6.join)(team.config.gitdir, "rebase-apply"))) {
+      throw new Error(
+        `git pull --rebase reported conflicts in ${worktree}. The worktree is in a rebase-in-progress state.
+Resolve the conflicts in-place, run \`git -C ${worktree} rebase --continue\` (or --abort), then re-run \`threadnote share sync\`.`
+      );
+    }
+    throw new Error(
+      `git pull --rebase failed in ${worktree}: ${pullResult.stderr.trim() || pullResult.stdout.trim() || "unknown error"}`
+    );
+  }
+  const afterRev = await gitOutput(worktree, ["rev-parse", "HEAD"], dryRun);
+  if (!dryRun && beforeRev && afterRev && beforeRev !== afterRev) {
+    const changes = await listChangedFiles(worktree, beforeRev, afterRev);
+    await applyChangesToOpenViking(config, team.config, changes);
+    console.log(`Reindexed ${changes.length} file change(s) into OpenViking.`);
+  } else if (!dryRun) {
+    console.log("No upstream changes to reindex.");
+  }
+  if (options.push !== false) {
+    await maybeRun(dryRun, git, ["-C", worktree, "push", DEFAULT_GIT_REMOTE_NAME], { allowFailure: true });
+  }
+}
+async function stageShareableChanges(dryRun, git, worktree) {
+  const pathspecs = [":(top)README.md", ":(top).gitignore", ...SHAREABLE_MEMORY_KIND_DIRS.map((dir) => `:(top)${dir}`)];
+  await maybeRun(dryRun, git, ["-C", worktree, "add", "--", ...pathspecs], { allowFailure: true });
+}
+async function runSharePublish(config, sourceUri, options) {
+  assertVikingUri(sourceUri);
+  const team = await resolveTeam(config, options.team);
+  const dryRun = options.dryRun === true;
+  if (isInSharedNamespace(config, sourceUri)) {
+    throw new Error(`Memory ${sourceUri} is already in the shared namespace.`);
+  }
+  const ov = await openVikingCliForMode(dryRun);
+  const content = await readMemoryContent(config, ov, sourceUri, dryRun);
+  const blocker = scrubberBlocker(content);
+  if (blocker) {
+    throw new Error(`Refusing to publish ${sourceUri}: possible ${blocker}. Strip the sensitive value, then retry.`);
+  }
+  const targetUri = sharedUriFor(config, sourceUri, team.name);
+  if (!dryRun && await vikingResourceExists2(ov, config, targetUri)) {
+    throw new Error(
+      `Refusing to publish: ${targetUri} already exists in the shared namespace. Inspect it via threadnote read; if it should be replaced, forget the existing shared copy first.`
+    );
+  }
+  await ensureSharedDirectoryChain(config, ov, targetUri, dryRun);
+  await writeMemoryFile(config, ov, targetUri, content, "create", dryRun);
+  await removeWithRollback(config, ov, sourceUri, targetUri, team.config.worktree, dryRun, "publish");
+  const git = await requiredExecutable("git");
+  const worktree = team.config.worktree;
+  const relativePath = vikingUriToWorktreeRelative(config, targetUri, team.name);
+  const message = options.message ?? `share: publish ${relativePath}`;
+  await maybeRun(dryRun, git, ["-C", worktree, "add", "--", relativePath]);
+  await maybeRun(dryRun, git, ["-C", worktree, "commit", "-m", message], { allowFailure: true });
+  if (options.push !== false) {
+    const pushResult = dryRun ? void 0 : await runCommand(git, ["-C", worktree, "push", DEFAULT_GIT_REMOTE_NAME], { allowFailure: true });
+    if (dryRun) {
+      console.log(`Would run: ${formatShellCommand(git, ["-C", worktree, "push", DEFAULT_GIT_REMOTE_NAME])}`);
+    } else if (pushResult && pushResult.exitCode !== 0) {
+      const detail = pushResult.stderr.trim() || pushResult.stdout.trim() || "unknown error";
+      throw new Error(
+        `Memory was committed locally but git push failed: ${detail}
+Resolve the remote issue (auth, network, branch protection), then run: threadnote share sync`
+      );
+    }
+  }
+  console.log(`Published ${sourceUri} -> ${targetUri}`);
+}
+async function runShareUnpublish(config, sourceUri, options) {
+  assertVikingUri(sourceUri);
+  const team = await resolveTeam(config, options.team);
+  const dryRun = options.dryRun === true;
+  if (!isInTeamNamespace(config, sourceUri, team.name)) {
+    throw new Error(`Memory ${sourceUri} is not in team "${team.name}" shared namespace.`);
+  }
+  const ov = await openVikingCliForMode(dryRun);
+  const content = await readMemoryContent(config, ov, sourceUri, dryRun);
+  const targetUri = personalUriFor(config, sourceUri, team.name);
+  if (!dryRun && await vikingResourceExists2(ov, config, targetUri)) {
+    throw new Error(
+      `Refusing to unpublish: a personal memory already exists at ${targetUri}. Move or forget it first, then retry.`
+    );
+  }
+  await writeMemoryFile(config, ov, targetUri, content, "create", dryRun);
+  await removeWithRollback(config, ov, sourceUri, targetUri, team.config.worktree, dryRun, "unpublish");
+  const git = await requiredExecutable("git");
+  const worktree = team.config.worktree;
+  const relativePath = vikingUriToWorktreeRelative(config, sourceUri, team.name);
+  const message = options.message ?? `share: unpublish ${relativePath}`;
+  await maybeRun(dryRun, git, ["-C", worktree, "rm", relativePath], { allowFailure: true });
+  await maybeRun(dryRun, git, ["-C", worktree, "commit", "-m", message], { allowFailure: true });
+  if (options.push !== false) {
+    await maybeRun(dryRun, git, ["-C", worktree, "push", DEFAULT_GIT_REMOTE_NAME], { allowFailure: true });
+  }
+  console.log(`Unpublished ${sourceUri} -> ${targetUri}`);
+}
+async function runShareList(config, _options) {
+  const teams = await readTeamsFile(config);
+  const entries = Object.values(teams.teams);
+  if (entries.length === 0) {
+    console.log("No shared teams configured. Run: threadnote share init <remote-url>");
+    return;
+  }
+  for (const team of entries) {
+    const marker = team.name === teams.defaultTeam ? " (default)" : "";
+    console.log(`- ${team.name}${marker}`);
+    console.log(`    remote: ${team.remote}`);
+    console.log(`    worktree: ${portablePath(team.worktree)}`);
+    console.log(`    gitdir: ${portablePath(team.gitdir)}`);
+    console.log(`    added: ${team.addedAt}`);
+  }
+}
+async function runShareRemove(config, options) {
+  const team = await resolveTeam(config, options.team);
+  const dryRun = options.dryRun === true;
+  const teamsFile = await readTeamsFile(config);
+  const remaining = {};
+  for (const [name, value] of Object.entries(teamsFile.teams)) {
+    if (name !== team.name) {
+      remaining[name] = value;
+    }
+  }
+  const remainingNames = Object.keys(remaining);
+  const nextDefault = teamsFile.defaultTeam === team.name ? remainingNames[0] : teamsFile.defaultTeam;
+  const updated = { defaultTeam: nextDefault, teams: remaining, version: TEAMS_FILE_VERSION };
+  if (dryRun) {
+    console.log(`Would update teams file: ${teamsFilePath(config)}`);
+  } else {
+    await writeTeamsFile(config, updated);
+    console.log(`Removed team "${team.name}" from teams.json.`);
+  }
+  if (options.keepFiles !== true) {
+    await removePath(team.config.worktree, "shared worktree", dryRun);
+    await removePath(team.config.gitdir, "shared gitdir", dryRun);
+  } else {
+    console.log(`Keeping files at ${portablePath(team.config.worktree)} and ${portablePath(team.config.gitdir)}`);
+  }
+}
+function normalizeTeamName(input2) {
+  const candidate = (input2 ?? "default").trim();
+  if (!candidate) {
+    return "default";
+  }
+  if (!/^[a-z0-9][a-z0-9._-]*$/.test(candidate) || /^\.+$/.test(candidate)) {
+    throw new Error(
+      `Invalid team name "${input2}". Team names must start with a lowercase letter or digit and contain only [a-z0-9._-]. Single-dot or dot-only names are rejected so they don't collapse to the shared-root or parent directory.`
+    );
+  }
+  return candidate;
+}
+function teamsFilePath(config) {
+  return (0, import_node_path6.join)(config.agentContextHome, "share", "teams.json");
+}
+function teamWorktreePath(config, team) {
+  return (0, import_node_path6.join)(
+    config.agentContextHome,
+    "data",
+    "viking",
+    config.account,
+    "user",
+    uriSegment(config.user),
+    "memories",
+    SHARED_SEGMENT,
+    team
+  );
+}
+function teamGitdirPath(config, team) {
+  return (0, import_node_path6.join)(config.agentContextHome, "share", "teams", `${team}.gitdir`);
+}
+async function readTeamsFile(config) {
+  const path = teamsFilePath(config);
+  const raw = await readFileIfExists(path);
+  if (!raw) {
+    return { teams: {}, version: TEAMS_FILE_VERSION };
+  }
+  const parsed = parseJsonConfigObject(raw);
+  if (!parsed) {
+    throw new Error(`Could not parse teams file ${path}`);
+  }
+  if (typeof parsed.version === "number" && parsed.version > TEAMS_FILE_VERSION) {
+    throw new Error(
+      `Teams file ${path} was written with version ${parsed.version}; this Threadnote binary understands up to version ${TEAMS_FILE_VERSION}. Upgrade Threadnote (\`threadnote update\`) before continuing.`
+    );
+  }
+  const teams = {};
+  if (typeof parsed.teams === "object" && parsed.teams !== null && !Array.isArray(parsed.teams)) {
+    for (const [name, value] of Object.entries(parsed.teams)) {
+      if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        console.warn(`Skipping non-object team entry "${name}" in ${path}.`);
+        continue;
+      }
+      const entry = value;
+      if (typeof entry.remote !== "string" || entry.remote.length === 0) {
+        console.warn(`Skipping team entry "${name}" in ${path}: missing or empty "remote" field.`);
+        continue;
+      }
+      teams[name] = {
+        addedAt: typeof entry.addedAt === "string" ? entry.addedAt : (/* @__PURE__ */ new Date(0)).toISOString(),
+        gitdir: typeof entry.gitdir === "string" ? entry.gitdir : teamGitdirPath(config, name),
+        name,
+        remote: entry.remote,
+        worktree: typeof entry.worktree === "string" ? entry.worktree : teamWorktreePath(config, name)
+      };
+    }
+  }
+  const defaultTeam = typeof parsed.defaultTeam === "string" ? parsed.defaultTeam : void 0;
+  return { defaultTeam, teams, version: TEAMS_FILE_VERSION };
+}
+async function writeTeamsFile(config, contents) {
+  const path = teamsFilePath(config);
+  await (0, import_promises6.mkdir)((0, import_node_path6.dirname)(path), { recursive: true });
+  const serializable = {
+    defaultTeam: contents.defaultTeam,
+    teams: contents.teams,
+    version: contents.version
+  };
+  await (0, import_promises6.writeFile)(path, `${JSON.stringify(serializable, void 0, 2)}
+`, { encoding: "utf8", mode: 384 });
+}
+async function resolveTeam(config, requested) {
+  const teamsFile = await readTeamsFile(config);
+  const entries = Object.entries(teamsFile.teams);
+  if (entries.length === 0) {
+    throw new Error("No shared teams configured. Run: threadnote share init <remote-url>");
+  }
+  const wantName = requested ? normalizeTeamName(requested) : teamsFile.defaultTeam ?? entries[0][0];
+  const found = teamsFile.teams[wantName];
+  if (!found) {
+    const known = entries.map(([name]) => name).join(", ");
+    throw new Error(`Team "${wantName}" is not configured. Known teams: ${known}`);
+  }
+  return { config: found, name: wantName };
+}
+function shouldSetDefault(options, existing) {
+  if (options.setDefault === true) {
+    return true;
+  }
+  return existing.defaultTeam === void 0;
+}
+async function assertWorktreeUsable(worktree) {
+  if (!await exists(worktree)) {
+    return;
+  }
+  if (!await isDirectory(worktree)) {
+    throw new Error(`Cannot use ${worktree} as a worktree: not a directory.`);
+  }
+  const entries = await (0, import_promises6.readdir)(worktree);
+  if (entries.length > 0) {
+    const preview = entries.slice(0, 5).join(", ");
+    const suffix = entries.length > 5 ? `, +${entries.length - 5} more` : "";
+    throw new Error(
+      `Worktree ${worktree} is not empty (contains: ${preview}${suffix}). Move or remove its contents, then retry threadnote share init.`
+    );
+  }
+}
+async function ingestWorktreeFiles(config, team, initialMode) {
+  const ov = await openVikingCliForMode(false);
+  const files = await walkMemoryFiles(team.worktree);
+  for (const file of files) {
+    const uri = workfileToVikingUri(config, team, file);
+    await ensureSharedDirectoryChain(config, ov, uri, false);
+    await ingestSingleFile(ov, config, uri, file, initialMode);
+  }
+  return files.length;
+}
+async function walkMemoryFiles(root) {
+  const out = [];
+  async function visit(path, depth) {
+    let entries;
+    try {
+      entries = await (0, import_promises6.readdir)(path, { withFileTypes: true });
+    } catch (err) {
+      console.warn(`Skipping ${path} during shared-tree walk: ${err instanceof Error ? err.message : String(err)}`);
+      return;
+    }
+    for (const entry of entries) {
+      if (entry.name === ".git") {
+        continue;
+      }
+      const full = (0, import_node_path6.join)(path, entry.name);
+      if (entry.isDirectory()) {
+        if (depth === 0 && !SHAREABLE_MEMORY_KIND_DIRS.includes(entry.name)) {
+          continue;
+        }
+        await visit(full, depth + 1);
+        continue;
+      }
+      if (!entry.isFile()) {
+        continue;
+      }
+      if (depth === 0) {
+        continue;
+      }
+      if (!entry.name.endsWith(".md")) {
+        continue;
+      }
+      out.push(full);
+    }
+  }
+  await visit(root, 0);
+  return out;
+}
+function workfileToVikingUri(config, team, filePath) {
+  const rel = (0, import_node_path6.relative)(team.worktree, filePath).split(import_node_path6.sep).join("/");
+  return `viking://user/${uriSegment(config.user)}/memories/${SHARED_SEGMENT}/${team.name}/${rel}`;
+}
+function isInSharedNamespace(config, uri) {
+  return uri.startsWith(`viking://user/${uriSegment(config.user)}/memories/${SHARED_SEGMENT}/`);
+}
+function isInTeamNamespace(config, uri, team) {
+  return uri.startsWith(`viking://user/${uriSegment(config.user)}/memories/${SHARED_SEGMENT}/${team}/`);
+}
+function sharedUriFor(config, personalUri, team) {
+  const prefix = `viking://user/${uriSegment(config.user)}/memories/`;
+  if (!personalUri.startsWith(prefix)) {
+    throw new Error(`Refusing to publish memory outside the current user namespace: ${personalUri}`);
+  }
+  const rest = personalUri.slice(prefix.length);
+  return `${prefix}${SHARED_SEGMENT}/${team}/${rest}`;
+}
+function personalUriFor(config, sharedUri, team) {
+  const prefix = `viking://user/${uriSegment(config.user)}/memories/${SHARED_SEGMENT}/${team}/`;
+  if (!sharedUri.startsWith(prefix)) {
+    throw new Error(`Refusing to unpublish a URI outside team "${team}" shared namespace: ${sharedUri}`);
+  }
+  const rest = sharedUri.slice(prefix.length);
+  return `viking://user/${uriSegment(config.user)}/memories/${rest}`;
+}
+function vikingUriToWorktreeRelative(config, uri, team) {
+  const prefix = `viking://user/${uriSegment(config.user)}/memories/${SHARED_SEGMENT}/${team}/`;
+  if (!uri.startsWith(prefix)) {
+    throw new Error(`URI ${uri} is not inside team "${team}" shared subtree.`);
+  }
+  return uri.slice(prefix.length);
+}
+function scrubberBlocker(content) {
+  return SCRUBBER_PATTERNS.find((pattern) => pattern.regex.test(content))?.name;
+}
+async function readMemoryContent(config, ov, uri, dryRun) {
+  const args = withIdentity(config, ["read", uri]);
+  if (dryRun) {
+    console.log(`Would run: ${formatShellCommand(ov, args)}`);
+    return "<dry-run memory body>";
+  }
+  const result = await runCommand(ov, args);
+  if (!result.stdout.trim()) {
+    throw new Error(`Refusing to publish empty memory at ${uri}`);
+  }
+  return result.stdout;
+}
+async function ensureSharedDirectoryChain(config, ov, memoryUri, dryRun) {
+  const directoryUri = parentUri(memoryUri);
+  for (const uri of sharedDirectoryChain(config, directoryUri)) {
+    const args = withIdentity(config, ["stat", uri]);
+    if (dryRun) {
+      console.log(`Would run: ${formatShellCommand(ov, args)}`);
+      continue;
+    }
+    const statResult = await runCommand(ov, args, { allowFailure: true });
+    if (statResult.exitCode === 0) {
+      continue;
+    }
+    await maybeRun(false, ov, withIdentity(config, ["mkdir", uri, "--description", "Threadnote shared memories."]));
+  }
+}
+function parentUri(uri) {
+  const lastSlash = uri.lastIndexOf("/");
+  return lastSlash === -1 ? uri : uri.slice(0, lastSlash);
+}
+function sharedDirectoryChain(config, directoryUri) {
+  const prefix = `viking://user/${uriSegment(config.user)}/memories/${SHARED_SEGMENT}/`;
+  if (!directoryUri.startsWith(prefix)) {
+    return [directoryUri];
+  }
+  const parts = directoryUri.slice(prefix.length).split("/").filter(Boolean);
+  const chain = [];
+  for (let index = 1; index <= parts.length; index += 1) {
+    chain.push(`${prefix}${parts.slice(0, index).join("/")}`);
+  }
+  return chain;
+}
+async function writeMemoryFile(config, ov, uri, content, initialMode, dryRun) {
+  if (dryRun) {
+    const args = withIdentity(config, [
+      "write",
+      uri,
+      "--from-file",
+      "<staged temp file>",
+      "--mode",
+      initialMode,
+      "--wait",
+      "--timeout",
+      "120"
+    ]);
+    console.log(`Would run: ${formatShellCommand(ov, args)}`);
+    return;
+  }
+  const stagingDir = await (0, import_promises6.mkdtemp)((0, import_node_path6.join)((0, import_node_os4.tmpdir)(), "threadnote-share-"));
+  const tempPath = (0, import_node_path6.join)(stagingDir, "body.txt");
+  try {
+    await (0, import_promises6.writeFile)(tempPath, content, { encoding: "utf8", mode: 384 });
+    await writeOvFileWithRetry(config, ov, uri, tempPath, initialMode);
+  } finally {
+    await (0, import_promises6.rm)(stagingDir, { force: true, recursive: true });
+  }
+}
+async function writeOvFileWithRetry(config, ov, uri, fromFile, initialMode) {
+  const maxAttempts = 4;
+  const existedBeforeWrite = await vikingResourceExists2(ov, config, uri);
+  for (let attempt = 0; attempt < maxAttempts; attempt += 1) {
+    const existsNow = attempt === 0 ? existedBeforeWrite : await vikingResourceExists2(ov, config, uri);
+    const ourWriteLanded = existsNow && !existedBeforeWrite;
+    const mode = attempt === 0 ? initialMode : ourWriteLanded ? "replace" : initialMode;
+    const args = withIdentity(config, [
+      "write",
+      uri,
+      "--from-file",
+      fromFile,
+      "--mode",
+      mode,
+      "--wait",
+      "--timeout",
+      "120"
+    ]);
+    console.log(`${attempt === 0 ? "Running" : "Retrying"}: ${formatShellCommand(ov, args)}`);
+    const result = await runCommand(ov, args, { allowFailure: true });
+    if (result.exitCode === 0) {
+      if (result.stdout.trim()) {
+        console.log(result.stdout.trim());
+      }
+      if (result.stderr.trim()) {
+        console.error(result.stderr.trim());
+      }
+      return;
+    }
+    if (isTransientOvFailure(result.stderr, result.stdout) && await vikingResourceExists2(ov, config, uri) && !existedBeforeWrite) {
+      console.log("OpenViking accepted the write but returned an error before the wait completed; draining the queue.");
+      await waitForOvQueue(ov, config);
+      return;
+    }
+    if (!isTransientOvFailure(result.stderr, result.stdout) || attempt === maxAttempts - 1) {
+      throw new Error(`${formatShellCommand(ov, args)} failed: ${result.stderr || result.stdout}`);
+    }
+    await sleep(1e3 * (attempt + 1));
+  }
+}
+async function waitForOvQueue(ov, config) {
+  const result = await runCommand(ov, withIdentity(config, ["wait", "--timeout", "120"]), { allowFailure: true });
+  if (result.stdout.trim()) {
+    console.log(result.stdout.trim());
+  }
+  if (result.stderr.trim()) {
+    console.error(result.stderr.trim());
+  }
+}
+function isTransientOvFailure(stderr, stdout) {
+  const output2 = `${stderr}
+${stdout}`.toLowerCase();
+  return output2.includes("resource is busy") || output2.includes("resource is being processed") || output2.includes("network error") || output2.includes("error sending request") || output2.includes("http request failed") || output2.includes("connection refused") || output2.includes("connection reset") || output2.includes("timed out");
+}
+async function ingestSingleFile(ov, config, uri, filePath, initialMode) {
+  const content = await (0, import_promises6.readFile)(filePath, "utf8");
+  await writeMemoryFile(config, ov, uri, content, initialMode, false);
+}
+async function removeWithRollback(config, ov, sourceUri, rollbackUri, worktree, dryRun, label) {
+  try {
+    await removeMemoryUri(config, ov, sourceUri, dryRun);
+  } catch (sourceErr) {
+    if (dryRun) {
+      throw sourceErr;
+    }
+    console.error(
+      `Source removal failed during ${label}; rolling back ${rollbackUri} so the system is back to the pre-${label} state.`
+    );
+    try {
+      await removeMemoryUri(config, ov, rollbackUri, false);
+    } catch (rollbackErr) {
+      console.error(
+        `Rollback of ${rollbackUri} also failed. Manual cleanup needed via: threadnote forget ${rollbackUri}
+Rollback error: ${rollbackErr instanceof Error ? rollbackErr.message : String(rollbackErr)}`
+      );
+    }
+    await bestEffortRemoveWorktreeFile(rollbackUri, worktree, label);
+    throw sourceErr;
+  }
+}
+async function bestEffortRemoveWorktreeFile(rollbackUri, worktree, label) {
+  if (label !== "publish") {
+    return;
+  }
+  const prefix = "viking://";
+  if (!rollbackUri.startsWith(prefix)) {
+    return;
+  }
+  const parts = rollbackUri.slice(prefix.length).split("/");
+  const sharedIndex = parts.indexOf("shared");
+  if (sharedIndex === -1 || sharedIndex + 2 >= parts.length) {
+    return;
+  }
+  const relative3 = parts.slice(sharedIndex + 2).join("/");
+  if (!relative3) {
+    return;
+  }
+  await (0, import_promises6.rm)((0, import_node_path6.join)(worktree, relative3), { force: true });
+}
+async function removeMemoryUri(config, ov, uri, dryRun) {
+  const args = withIdentity(config, ["rm", uri]);
+  if (dryRun) {
+    console.log(`Would run: ${formatShellCommand(ov, args)}`);
+    return;
+  }
+  const maxAttempts = 4;
+  for (let attempt = 0; attempt < maxAttempts; attempt += 1) {
+    const result = await runCommand(ov, args, { allowFailure: true });
+    if (result.exitCode === 0) {
+      if (result.stdout.trim()) {
+        console.log(result.stdout.trim());
+      }
+      return;
+    }
+    if (!isTransientOvFailure(result.stderr, result.stdout) || attempt === maxAttempts - 1) {
+      throw new Error(`${formatShellCommand(ov, args)} failed: ${result.stderr || result.stdout}`);
+    }
+    await sleep(1e3 * (attempt + 1));
+  }
+}
+async function vikingResourceExists2(ov, config, uri) {
+  const result = await runCommand(ov, withIdentity(config, ["stat", uri]), { allowFailure: true });
+  return result.exitCode === 0;
+}
+async function hasUncommittedChanges(worktree) {
+  const result = await runCommand("git", ["-C", worktree, "status", "--porcelain"], { allowFailure: true });
+  return result.stdout.trim().length > 0;
+}
+async function gitOutput(worktree, args, dryRun) {
+  if (dryRun) {
+    return void 0;
+  }
+  const result = await runCommand("git", ["-C", worktree, ...args], { allowFailure: true });
+  if (result.exitCode !== 0) {
+    return void 0;
+  }
+  return result.stdout.trim();
+}
+async function listChangedFiles(worktree, beforeRev, afterRev) {
+  const result = await runCommand("git", ["-C", worktree, "diff", "--name-status", "-z", `${beforeRev}..${afterRev}`], {
+    allowFailure: true
+  });
+  if (result.exitCode !== 0) {
+    return [];
+  }
+  const entries = result.stdout.split("\0").filter((part) => part.length > 0);
+  const changes = [];
+  for (let index = 0; index < entries.length; ) {
+    const raw = entries[index];
+    const head = raw.slice(0, 1);
+    if (head === "R" || head === "C") {
+      const oldRel = entries[index + 1];
+      const newRel = entries[index + 2];
+      if (oldRel && newRel) {
+        changes.push({ path: (0, import_node_path6.join)(worktree, oldRel), relativePath: oldRel, status: "removed" });
+        changes.push({ path: (0, import_node_path6.join)(worktree, newRel), relativePath: newRel, status: "added" });
+      }
+      index += 3;
+      continue;
+    }
+    const rel = entries[index + 1];
+    if (rel) {
+      const status = head === "A" ? "added" : head === "D" ? "removed" : "modified";
+      changes.push({ path: (0, import_node_path6.join)(worktree, rel), relativePath: rel, status });
+    }
+    index += 2;
+  }
+  return changes;
+}
+async function applyChangesToOpenViking(config, team, changes) {
+  const ov = await openVikingCliForMode(false);
+  for (const change of changes) {
+    if (!change.relativePath.endsWith(".md")) {
+      continue;
+    }
+    const firstSegment = change.relativePath.split("/")[0];
+    if (!SHAREABLE_MEMORY_KIND_DIRS.includes(firstSegment)) {
+      continue;
+    }
+    const uri = workfileToVikingUri(config, team, change.path);
+    if (change.status === "removed") {
+      await removeMemoryUri(config, ov, uri, false);
+      continue;
+    }
+    if (!await isFile(change.path)) {
+      continue;
+    }
+    if (change.status === "modified" && await vikingResourceExists2(ov, config, uri)) {
+      console.warn(
+        `share sync: overwriting local ${uri} with the upstream version (local edits to the shared subtree are not preserved across sync).`
+      );
+    }
+    await ensureSharedDirectoryChain(config, ov, uri, false);
+    const writeMode = change.status === "modified" ? "replace" : "create";
+    await ingestSingleFile(ov, config, uri, change.path, writeMode);
+  }
+}
+
 // src/lifecycle.ts
 var import_node_child_process2 = require("node:child_process");
 var import_node_fs5 = require("node:fs");
-var import_promises8 = require("node:fs/promises");
-var import_node_os5 = require("node:os");
-var import_node_path7 = require("node:path");
+var import_promises9 = require("node:fs/promises");
+var import_node_os6 = require("node:os");
+var import_node_path8 = require("node:path");
 
 // src/update.ts
 var import_node_fs4 = require("node:fs");
-var import_promises6 = require("node:fs/promises");
-var import_node_os4 = require("node:os");
-var import_node_path6 = require("node:path");
-var import_promises7 = require("node:readline/promises");
+var import_promises7 = require("node:fs/promises");
+var import_node_os5 = require("node:os");
+var import_node_path7 = require("node:path");
+var import_promises8 = require("node:readline/promises");
 var import_node_process = require("node:process");
 var NPM_PACKAGE_NAME = "threadnote";
 var DEFAULT_NPM_REGISTRY = "https://registry.npmjs.org/";
@@ -8555,7 +9317,7 @@ async function getUpdateInfo(config, options) {
   };
 }
 async function currentPackageVersion() {
-  const rawPackage = await (0, import_promises6.readFile)((0, import_node_path6.join)(toolRoot(), "package.json"), "utf8");
+  const rawPackage = await (0, import_promises7.readFile)((0, import_node_path7.join)(toolRoot(), "package.json"), "utf8");
   const parsed = JSON.parse(rawPackage);
   if (!isJsonObject(parsed) || typeof parsed.version !== "string") {
     throw new Error("Could not read current threadnote package version.");
@@ -8605,11 +9367,11 @@ async function readFreshCache(config, registry) {
 }
 async function writeUpdateCache(config, cache) {
   await ensureDirectory(config.agentContextHome, false);
-  await (0, import_promises6.writeFile)(updateCachePath(config), `${JSON.stringify(cache, null, 2)}
+  await (0, import_promises7.writeFile)(updateCachePath(config), `${JSON.stringify(cache, null, 2)}
 `, { encoding: "utf8", mode: 384 });
 }
 function updateCachePath(config) {
-  return (0, import_node_path6.join)(config.agentContextHome, "update-check.json");
+  return (0, import_node_path7.join)(config.agentContextHome, "update-check.json");
 }
 async function runApplicablePostUpdateMigrations(config, options) {
   const state = await readPostUpdateState(config);
@@ -8673,7 +9435,7 @@ async function applicablePostUpdateMigrations(config, options) {
   return applicable;
 }
 async function readPostUpdateMigrations() {
-  const raw = await readFileIfExists((0, import_node_path6.join)(toolRoot(), "config", POST_UPDATE_MIGRATIONS_FILE));
+  const raw = await readFileIfExists((0, import_node_path7.join)(toolRoot(), "config", POST_UPDATE_MIGRATIONS_FILE));
   if (!raw) {
     return [];
   }
@@ -8712,7 +9474,7 @@ function printPostUpdateMigration(migration) {
   }
 }
 async function confirmPostUpdateMigration(prompt) {
-  const readline = (0, import_promises7.createInterface)({ input: import_node_process.stdin, output: import_node_process.stdout });
+  const readline = (0, import_promises8.createInterface)({ input: import_node_process.stdin, output: import_node_process.stdout });
   try {
     const answer = (await readline.question(prompt)).trim().toLowerCase();
     return answer === "y" || answer === "yes";
@@ -8744,11 +9506,11 @@ async function readPostUpdateState(config) {
 }
 async function writePostUpdateState(config, state) {
   await ensureDirectory(config.agentContextHome, false);
-  await (0, import_promises6.writeFile)(postUpdateStatePath(config), `${JSON.stringify(state, null, 2)}
+  await (0, import_promises7.writeFile)(postUpdateStatePath(config), `${JSON.stringify(state, null, 2)}
 `, { encoding: "utf8", mode: 384 });
 }
 function postUpdateStatePath(config) {
-  return (0, import_node_path6.join)(config.agentContextHome, POST_UPDATE_STATE_FILE);
+  return (0, import_node_path7.join)(config.agentContextHome, POST_UPDATE_STATE_FILE);
 }
 async function resolveUpdateRuntime(runtime) {
   if (runtime !== "auto") {
@@ -8778,18 +9540,18 @@ async function runtimeThreadnoteBin(runtime) {
   if (runtime === "npm") {
     const result = await runCommand("npm", ["prefix", "--global"], { allowFailure: true });
     const prefix = result.stdout.trim();
-    return prefix ? (0, import_node_path6.join)(prefix, "bin", NPM_PACKAGE_NAME) : void 0;
+    return prefix ? (0, import_node_path7.join)(prefix, "bin", NPM_PACKAGE_NAME) : void 0;
   }
   if (runtime === "bun") {
     const result = await runCommand("bun", ["pm", "bin", "-g"], { allowFailure: true });
     const binDir = result.stdout.trim();
-    return binDir ? (0, import_node_path6.join)(binDir, NPM_PACKAGE_NAME) : void 0;
+    return binDir ? (0, import_node_path7.join)(binDir, NPM_PACKAGE_NAME) : void 0;
   }
-  return (0, import_node_path6.join)(process.env.DENO_INSTALL ?? (0, import_node_path6.join)((0, import_node_os4.homedir)(), ".deno"), "bin", NPM_PACKAGE_NAME);
+  return (0, import_node_path7.join)(process.env.DENO_INSTALL ?? (0, import_node_path7.join)((0, import_node_os5.homedir)(), ".deno"), "bin", NPM_PACKAGE_NAME);
 }
 async function isExecutable(path) {
   try {
-    await (0, import_promises6.access)(path, import_node_fs4.constants.X_OK);
+    await (0, import_promises7.access)(path, import_node_fs4.constants.X_OK);
     return true;
   } catch (_err) {
     return false;
@@ -8867,7 +9629,7 @@ function safeVersionNumber(value) {
 async function runDoctor(config, options) {
   const checks = [];
   checks.push({ name: "mode", status: "ok", detail: options.dryRun ? "dry run; no writes" : "read-only checks" });
-  checks.push({ name: "platform", status: (0, import_node_os5.platform)() === "darwin" ? "ok" : "warn", detail: (0, import_node_os5.platform)() });
+  checks.push({ name: "platform", status: (0, import_node_os6.platform)() === "darwin" ? "ok" : "warn", detail: (0, import_node_os6.platform)() });
   checks.push(await commandCheck("node", ["--version"]));
   checks.push(await commandCheck("python3", ["--version"]));
   checks.push(await commandCheck("openviking-server", ["--help"]));
@@ -8880,9 +9642,9 @@ async function runDoctor(config, options) {
   checks.push(await commandShimCheck());
   checks.push(...await userAgentInstructionsChecks());
   checks.push(await manifestCheck(config.manifestPath));
-  checks.push(await fileCheck((0, import_node_path7.join)(toolRoot(), ".threadnoteignore"), "ignore file"));
-  checks.push(await fileCheck((0, import_node_path7.join)(toolRoot(), "config", "ov.conf.template.json"), "server config template"));
-  checks.push(await fileCheck((0, import_node_path7.join)(toolRoot(), "config", "ovcli.conf.template.json"), "cli config template"));
+  checks.push(await fileCheck((0, import_node_path8.join)(toolRoot(), ".threadnoteignore"), "ignore file"));
+  checks.push(await fileCheck((0, import_node_path8.join)(toolRoot(), "config", "ov.conf.template.json"), "server config template"));
+  checks.push(await fileCheck((0, import_node_path8.join)(toolRoot(), "config", "ovcli.conf.template.json"), "cli config template"));
   checks.push(await healthCheck(config));
   for (const check of checks) {
     console.log(`${formatStatus(check.status)} ${check.name}: ${check.detail}`);
@@ -8899,9 +9661,9 @@ async function runInstall(config, options) {
   const repairInvalidConfigs = options.repairInvalidConfigs === true;
   const dryRun = options.dryRun === true;
   await ensureDirectory(config.agentContextHome, dryRun);
-  await ensureDirectory((0, import_node_path7.join)(config.agentContextHome, "logs"), dryRun);
-  await ensureDirectory((0, import_node_path7.join)(config.agentContextHome, "redacted"), dryRun);
-  await ensureDirectory((0, import_node_path7.join)(config.agentContextHome, "mcp"), dryRun);
+  await ensureDirectory((0, import_node_path8.join)(config.agentContextHome, "logs"), dryRun);
+  await ensureDirectory((0, import_node_path8.join)(config.agentContextHome, "redacted"), dryRun);
+  await ensureDirectory((0, import_node_path8.join)(config.agentContextHome, "mcp"), dryRun);
   await installCommandShim(dryRun);
   await installUserAgentInstructions(dryRun);
   const serverPath = await findExecutable([OPENVIKING_SERVER_COMMAND]);
@@ -8927,17 +9689,17 @@ async function runInstall(config, options) {
   }
   await writeTemplateIfMissing({
     config,
-    destinationPath: (0, import_node_path7.join)(config.agentContextHome, "ov.conf"),
+    destinationPath: (0, import_node_path8.join)(config.agentContextHome, "ov.conf"),
     dryRun,
     shouldRepair: (content) => shouldRepairOpenVikingConfig(content, config) || repairInvalidConfigs && parseJsonConfigObject(content) === void 0,
-    templatePath: (0, import_node_path7.join)(toolRoot(), "config", "ov.conf.template.json")
+    templatePath: (0, import_node_path8.join)(toolRoot(), "config", "ov.conf.template.json")
   });
   await writeTemplateIfMissing({
     config,
-    destinationPath: (0, import_node_path7.join)(config.agentContextHome, "ovcli.conf"),
+    destinationPath: (0, import_node_path8.join)(config.agentContextHome, "ovcli.conf"),
     dryRun,
     shouldRepair: (content) => shouldRepairLegacyOvCliConfig(content) || repairInvalidConfigs && parseJsonConfigObject(content) === void 0,
-    templatePath: (0, import_node_path7.join)(toolRoot(), "config", "ovcli.conf.template.json")
+    templatePath: (0, import_node_path8.join)(toolRoot(), "config", "ovcli.conf.template.json")
   });
   if (options.start !== false) {
     const healthy = await repairServerHealth(config, dryRun);
@@ -8987,7 +9749,7 @@ async function runUninstall(config, options) {
   }
   console.log("Uninstalling local Threadnote setup.");
   await runStop(config, { dryRun });
-  await removePathIfExists((0, import_node_path7.join)(config.agentContextHome, "openviking-server.pid"), "pid file", dryRun);
+  await removePathIfExists((0, import_node_path8.join)(config.agentContextHome, "openviking-server.pid"), "pid file", dryRun);
   await removeLaunchAgent(dryRun);
   await removeMcpConfigs(options.mcp ?? "available", dryRun);
   await removeMcpSnippets(config, dryRun);
@@ -9041,16 +9803,16 @@ async function repairManifest(config, dryRun) {
     console.log(output2.trimEnd());
     return;
   }
-  await ensureDirectory((0, import_node_path7.dirname)(config.manifestPath), false);
+  await ensureDirectory((0, import_node_path8.dirname)(config.manifestPath), false);
   const currentContent = await readFileIfExists(config.manifestPath);
   if (currentContent !== void 0) {
     const backupPath = `${config.manifestPath}.legacy-${safeTimestamp()}`;
-    await (0, import_promises8.writeFile)(backupPath, currentContent, { encoding: "utf8", mode: 384 });
-    await (0, import_promises8.chmod)(backupPath, 384);
+    await (0, import_promises9.writeFile)(backupPath, currentContent, { encoding: "utf8", mode: 384 });
+    await (0, import_promises9.chmod)(backupPath, 384);
     console.log(`Backup: ${backupPath}`);
   }
-  await (0, import_promises8.writeFile)(config.manifestPath, output2, { encoding: "utf8", mode: 384 });
-  await (0, import_promises8.chmod)(config.manifestPath, 384);
+  await (0, import_promises9.writeFile)(config.manifestPath, output2, { encoding: "utf8", mode: 384 });
+  await (0, import_promises9.chmod)(config.manifestPath, 384);
   console.log(`Wrote replacement manifest: ${config.manifestPath}`);
 }
 async function repairServerHealth(config, dryRun) {
@@ -9091,7 +9853,7 @@ async function runStart(config, options) {
     );
   }
   const logPath = openVikingLogPath(config);
-  await ensureDirectory((0, import_node_path7.dirname)(logPath), false);
+  await ensureDirectory((0, import_node_path8.dirname)(logPath), false);
   if (options.foreground === true) {
     const result = await runInteractive(server, args);
     process.exitCode = result;
@@ -9100,7 +9862,7 @@ async function runStart(config, options) {
   const logFd = (0, import_node_fs5.openSync)(logPath, "a");
   const child = spawnDetachedServerWithLog(server, args, logFd);
   child.unref();
-  await (0, import_promises8.writeFile)((0, import_node_path7.join)(config.agentContextHome, "openviking-server.pid"), `${child.pid}
+  await (0, import_promises9.writeFile)((0, import_node_path8.join)(config.agentContextHome, "openviking-server.pid"), `${child.pid}
 `, "utf8");
   const health = await waitForOpenVikingHealth(config, START_HEALTH_TIMEOUT_MS);
   if (health) {
@@ -9126,14 +9888,14 @@ function spawnDetachedServer(server, args, logFd) {
 }
 async function runStop(config, options) {
   const launchAgentPath = expandPath(`~/Library/LaunchAgents/${LAUNCHD_LABEL}.plist`);
-  if ((0, import_node_os5.platform)() === "darwin") {
+  if ((0, import_node_os6.platform)() === "darwin") {
     if (options.dryRun === true || await exists(launchAgentPath)) {
       await maybeRun(options.dryRun === true, "launchctl", ["unload", launchAgentPath], { allowFailure: true });
     } else {
       console.log(`No LaunchAgent found: ${launchAgentPath}`);
     }
   }
-  const pidPath = (0, import_node_path7.join)(config.agentContextHome, "openviking-server.pid");
+  const pidPath = (0, import_node_path8.join)(config.agentContextHome, "openviking-server.pid");
   const pidText = await readFileIfExists(pidPath);
   if (!pidText) {
     console.log("No pid file found for detached OpenViking server.");
@@ -9229,7 +9991,7 @@ async function pythonSystemCertificatesCheck() {
   };
 }
 async function commandShimCheck() {
-  const shimPath = (0, import_node_path7.join)(expandPath(process.env.THREADNOTE_BIN_DIR ?? "~/.local/bin"), "threadnote");
+  const shimPath = (0, import_node_path8.join)(expandPath(process.env.THREADNOTE_BIN_DIR ?? "~/.local/bin"), "threadnote");
   const content = await readFileIfExists(shimPath);
   if (content === void 0) {
     return { name: "threadnote shim", status: "warn", detail: `${shimPath} missing; repair will create it` };
@@ -9295,11 +10057,11 @@ async function hasPythonModule(serverPath, moduleName) {
 async function siblingPythonForExecutable(executablePath) {
   let resolvedPath;
   try {
-    resolvedPath = await (0, import_promises8.realpath)(executablePath);
+    resolvedPath = await (0, import_promises9.realpath)(executablePath);
   } catch (_err) {
     return void 0;
   }
-  const pythonPath = (0, import_node_path7.join)((0, import_node_path7.dirname)(resolvedPath), "python");
+  const pythonPath = (0, import_node_path8.join)((0, import_node_path8.dirname)(resolvedPath), "python");
   return await exists(pythonPath) ? pythonPath : void 0;
 }
 async function manifestCheck(path) {
@@ -9421,38 +10183,38 @@ function printInstallNextSteps(options) {
 }
 async function writeTemplateIfMissing(options) {
   if (await exists(options.destinationPath)) {
-    const currentContent = await (0, import_promises8.readFile)(options.destinationPath, "utf8");
+    const currentContent = await (0, import_promises9.readFile)(options.destinationPath, "utf8");
     if (options.shouldRepair?.(currentContent) !== true) {
       console.log(`Already exists: ${options.destinationPath}`);
       return;
     }
-    const rendered2 = renderTemplate(await (0, import_promises8.readFile)(options.templatePath, "utf8"), options.config);
+    const rendered2 = renderTemplate(await (0, import_promises9.readFile)(options.templatePath, "utf8"), options.config);
     if (options.dryRun) {
       console.log(`Would repair generated config: ${options.destinationPath}`);
       return;
     }
     const backupPath = `${options.destinationPath}.legacy-${safeTimestamp()}`;
-    await (0, import_promises8.writeFile)(backupPath, currentContent, { encoding: "utf8", mode: 384 });
-    await (0, import_promises8.chmod)(backupPath, 384);
-    await (0, import_promises8.writeFile)(options.destinationPath, rendered2, { encoding: "utf8", mode: 384 });
-    await (0, import_promises8.chmod)(options.destinationPath, 384);
+    await (0, import_promises9.writeFile)(backupPath, currentContent, { encoding: "utf8", mode: 384 });
+    await (0, import_promises9.chmod)(backupPath, 384);
+    await (0, import_promises9.writeFile)(options.destinationPath, rendered2, { encoding: "utf8", mode: 384 });
+    await (0, import_promises9.chmod)(options.destinationPath, 384);
     console.log(`Repaired generated config: ${options.destinationPath}`);
     console.log(`Backup: ${backupPath}`);
     return;
   }
-  const rendered = renderTemplate(await (0, import_promises8.readFile)(options.templatePath, "utf8"), options.config);
+  const rendered = renderTemplate(await (0, import_promises9.readFile)(options.templatePath, "utf8"), options.config);
   if (options.dryRun) {
     console.log(`Would write ${options.destinationPath}`);
     return;
   }
-  await ensureDirectory((0, import_node_path7.dirname)(options.destinationPath), false);
-  await (0, import_promises8.writeFile)(options.destinationPath, rendered, { encoding: "utf8", mode: 384 });
-  await (0, import_promises8.chmod)(options.destinationPath, 384);
+  await ensureDirectory((0, import_node_path8.dirname)(options.destinationPath), false);
+  await (0, import_promises9.writeFile)(options.destinationPath, rendered, { encoding: "utf8", mode: 384 });
+  await (0, import_promises9.chmod)(options.destinationPath, 384);
   console.log(`Wrote ${options.destinationPath}`);
 }
 async function installCommandShim(dryRun) {
   const binDir = expandPath(process.env.THREADNOTE_BIN_DIR ?? "~/.local/bin");
-  const shimPath = (0, import_node_path7.join)(binDir, "threadnote");
+  const shimPath = (0, import_node_path8.join)(binDir, "threadnote");
   const existingContent = await readFileIfExists(shimPath);
   if (existingContent && !isManagedCommandShim(existingContent)) {
     console.log(`WARN not overwriting existing command shim: ${shimPath}`);
@@ -9468,12 +10230,12 @@ async function installCommandShim(dryRun) {
     return;
   }
   await ensureDirectory(binDir, false);
-  await (0, import_promises8.writeFile)(shimPath, content, { encoding: "utf8", mode: 493 });
-  await (0, import_promises8.chmod)(shimPath, 493);
+  await (0, import_promises9.writeFile)(shimPath, content, { encoding: "utf8", mode: 493 });
+  await (0, import_promises9.chmod)(shimPath, 493);
   console.log(`Wrote command shim: ${shimPath}`);
 }
 async function removeCommandShim(dryRun) {
-  const shimPath = (0, import_node_path7.join)(expandPath(process.env.THREADNOTE_BIN_DIR ?? "~/.local/bin"), "threadnote");
+  const shimPath = (0, import_node_path8.join)(expandPath(process.env.THREADNOTE_BIN_DIR ?? "~/.local/bin"), "threadnote");
   const content = await readFileIfExists(shimPath);
   if (content === void 0) {
     console.log(`Already absent: ${shimPath}`);
@@ -9507,8 +10269,8 @@ async function installUserAgentInstructions(dryRun) {
       console.log(currentContent === void 0 ? `Would write ${targetPath}` : `Would update ${targetPath}`);
       continue;
     }
-    await ensureDirectory((0, import_node_path7.dirname)(targetPath), false);
-    await (0, import_promises8.writeFile)(targetPath, nextContent, { encoding: "utf8", mode: 420 });
+    await ensureDirectory((0, import_node_path8.dirname)(targetPath), false);
+    await (0, import_promises9.writeFile)(targetPath, nextContent, { encoding: "utf8", mode: 420 });
     console.log(currentContent === void 0 ? `Wrote ${targetPath}` : `Updated ${targetPath}`);
   }
 }
@@ -9545,7 +10307,7 @@ async function removeUserAgentInstructions(dryRun) {
       console.log(`Would update ${targetPath}`);
       continue;
     }
-    await (0, import_promises8.writeFile)(targetPath, nextContent, { encoding: "utf8", mode: 420 });
+    await (0, import_promises9.writeFile)(targetPath, nextContent, { encoding: "utf8", mode: 420 });
     console.log(`Updated ${targetPath}`);
   }
 }
@@ -9565,7 +10327,7 @@ async function renderUserAgentInstructions(target) {
   ].join("\n");
 }
 async function renderUserAgentInstructionsBlock() {
-  const instructions = (await (0, import_promises8.readFile)((0, import_node_path7.join)(toolRoot(), "docs", "agent-instructions.md"), "utf8")).trim();
+  const instructions = (await (0, import_promises9.readFile)((0, import_node_path8.join)(toolRoot(), "docs", "agent-instructions.md"), "utf8")).trim();
   return `${USER_INSTRUCTIONS_START_MARKER}
 ${instructions}
 ${USER_INSTRUCTIONS_END_MARKER}`;
@@ -9640,12 +10402,12 @@ function isManagedCommandShim(content) {
   return content.includes(SHIM_MARKER);
 }
 async function installLaunchAgent(config, dryRun) {
-  if ((0, import_node_os5.platform)() !== "darwin") {
+  if ((0, import_node_os6.platform)() !== "darwin") {
     throw new Error("launchd autostart is only supported on macOS.");
   }
-  const source = (0, import_node_path7.join)(toolRoot(), "config", "launchd", `${LAUNCHD_LABEL}.plist.template`);
+  const source = (0, import_node_path8.join)(toolRoot(), "config", "launchd", `${LAUNCHD_LABEL}.plist.template`);
   const destination = expandPath(`~/Library/LaunchAgents/${LAUNCHD_LABEL}.plist`);
-  const rendered = renderTemplate(await (0, import_promises8.readFile)(source, "utf8"), config);
+  const rendered = renderTemplate(await (0, import_promises9.readFile)(source, "utf8"), config);
   if (dryRun) {
     console.log(`Would write ${destination}`);
     console.log(`Would run: launchctl unload ${destination}`);
@@ -9653,9 +10415,9 @@ async function installLaunchAgent(config, dryRun) {
     console.log(`Would run: launchctl start ${LAUNCHD_LABEL}`);
     return;
   }
-  await ensureDirectory((0, import_node_path7.dirname)(destination), false);
-  await ensureDirectory((0, import_node_path7.dirname)(openVikingLogPath(config)), false);
-  await (0, import_promises8.writeFile)(destination, rendered, "utf8");
+  await ensureDirectory((0, import_node_path8.dirname)(destination), false);
+  await ensureDirectory((0, import_node_path8.dirname)(openVikingLogPath(config)), false);
+  await (0, import_promises9.writeFile)(destination, rendered, "utf8");
   await maybeRun(false, "launchctl", ["unload", destination], { allowFailure: true });
   await maybeRun(false, "launchctl", ["load", destination]);
   await maybeRun(false, "launchctl", ["start", LAUNCHD_LABEL]);
@@ -9718,7 +10480,7 @@ function isGeneratedLocalPilotConfig(parsed, config) {
   if (typeof parsed.default_user !== "string") {
     return false;
   }
-  if (!isJsonObject(parsed.storage) || parsed.storage.workspace !== (0, import_node_path7.join)(config.agentContextHome, "data")) {
+  if (!isJsonObject(parsed.storage) || parsed.storage.workspace !== (0, import_node_path8.join)(config.agentContextHome, "data")) {
     return false;
   }
   return isJsonObject(parsed.server) && parsed.server.host === config.host && String(parsed.server.port) === String(config.port);
@@ -9825,6 +10587,31 @@ async function main() {
   program2.command("forget").description("Remove a viking:// URI from local OpenViking context").argument("<uri>", "viking:// URI to remove").option("--dry-run", "Print ov command without deleting").action(async (uri, options) => {
     await runForget(getRuntimeConfig(program2), uri, options);
   });
+  const share = program2.command("share").description("Share durable memories with teammates through a git-backed repository");
+  share.command("init").description("Configure a shared memories repo for a team (clones the remote into the local memory tree)").argument("<remote-url>", "git remote URL of the shared memories repo").option("--team <name>", 'Team name; defaults to "default"').option("--set-default", "Mark this team as the default for future share commands").option(
+    "--no-push",
+    "Do not push the auto-generated .gitignore housekeeping commit. Does not affect future publishes."
+  ).option("--dry-run", "Print actions without running them").action(async (remoteUrl, options) => {
+    await runShareInit(getRuntimeConfig(program2), remoteUrl, options);
+  });
+  share.command("status").description("Show git status and ahead/behind counts for a shared team").option("--team <name>", "Team name; defaults to the configured default team").option("--dry-run", "Print git commands without running them").action(async (options) => {
+    await runShareStatus(getRuntimeConfig(program2), options);
+  });
+  share.command("sync").description("Pull, reindex, and push the shared memories repo for a team").option("--team <name>", "Team name; defaults to the configured default team").option("--message <text>", "Commit message when auto-committing local edits").option("--no-auto-commit", "Refuse to sync if there are uncommitted local changes").option("--no-push", "Skip the push step after pulling and reindexing").option("--dry-run", "Print actions without running them").action(async (options) => {
+    await runShareSync(getRuntimeConfig(program2), options);
+  });
+  share.command("publish").description("Move a personal memory into the shared team namespace, commit and push").argument("<viking-uri>", "viking:// memory URI to publish").option("--team <name>", "Team name; defaults to the configured default team").option("--message <text>", "Commit message override").option("--no-push", "Skip the push step").option("--dry-run", "Print actions without running them").action(async (uri, options) => {
+    await runSharePublish(getRuntimeConfig(program2), uri, options);
+  });
+  share.command("unpublish").description("Pull a shared memory back into the personal namespace, commit removal and push").argument("<viking-uri>", "viking:// memory URI inside a team shared subtree").option("--team <name>", "Team name; defaults to the configured default team").option("--message <text>", "Commit message override").option("--no-push", "Skip the push step").option("--dry-run", "Print actions without running them").action(async (uri, options) => {
+    await runShareUnpublish(getRuntimeConfig(program2), uri, options);
+  });
+  share.command("list").description("List configured shared teams").option("--dry-run", "Print without side effects (no-op for list)").action(async (options) => {
+    await runShareList(getRuntimeConfig(program2), options);
+  });
+  share.command("remove").description("Forget a configured team and optionally delete its worktree/gitdir").option("--team <name>", "Team name; defaults to the configured default team").option("--keep-files", "Keep the worktree and gitdir on disk; only forget the team entry").option("--dry-run", "Print actions without running them").action(async (options) => {
+    await runShareRemove(getRuntimeConfig(program2), options);
+  });
   program2.command("export-pack").description("Export local OpenViking context to an .ovpack").option("--dry-run", "Print ov command without exporting").option("--path <path>", "Output .ovpack path").option("--uri <uri>", "Source viking:// URI to export", "viking://").action(async (options) => {
     await runExportPack(getRuntimeConfig(program2), options);
   });