@agentsky/sky 0.2.1 → 2.2.1

package/dist/index.js

@@ -1,32 +1,66 @@
 #!/usr/bin/env node
-import {
-  apiBase,
-  apiToken,
-  configPath,
-  currentUniverse,
-  loadConfig,
-  saveConfig
-} from "./chunk-NLEDGUN7.js";
 import {
   AGENT_TYPES,
+  REASONING_EFFORT_VALUES,
   capabilitiesSchema,
   customDataSchema,
-  customInstallSchema,
   external_exports,
-  mcpConfigInstall,
+  isEffortSupported,
+  mcpServersFromKept,
+  modelSubscriptionProviderFor,
+  reasoningEffortDocLine,
   skillRefSchema,
-  splitMcpServers
-} from "./chunk-L5LLCKZW.js";
-import "./chunk-MLKGABMK.js";
+  splitMcpServers,
+  supersededBy
+} from "./chunk-TMLNYYYY.js";
 
 // src/index.ts
-import { existsSync as existsSync4 } from "fs";
-import { basename as basename2, resolve as resolve3 } from "path";
+import { existsSync as existsSync4, writeFileSync as writeFileSync4 } from "fs";
+import { basename as basename3, resolve as resolve3 } from "path";
 import { createInterface as createInterface3 } from "readline";
 import { Command } from "commander";
 
+// src/config.ts
+import { mkdirSync, readFileSync, writeFileSync } from "fs";
+import { homedir } from "os";
+import { dirname, join } from "path";
+var DEFAULT_API_BASE = "https://api.agentsky.dev/v1";
+var DEFAULT_CONSOLE_BASE = "https://platform.agentsky.dev";
+function configPath() {
+  return join(process.env.SKY_CONFIG_DIR ?? join(homedir(), ".config", "sky"), "config.json");
+}
+function loadConfig() {
+  try {
+    return JSON.parse(readFileSync(configPath(), "utf8"));
+  } catch {
+    return {};
+  }
+}
+function saveConfig(config) {
+  const path = configPath();
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, `${JSON.stringify(config, null, 2)}
+`, { mode: 384 });
+}
+function apiBase() {
+  return (process.env.SKY_API_URL ?? loadConfig().apiBase ?? DEFAULT_API_BASE).replace(/\/$/, "");
+}
+function consoleBase() {
+  const configured = process.env.SKY_CONSOLE_URL ?? loadConfig().consoleBase;
+  if (configured) return configured.replace(/\/$/, "");
+  const api2 = apiBase();
+  if (api2 === DEFAULT_API_BASE) return DEFAULT_CONSOLE_BASE;
+  return api2.replace(/\/(?:api\/)?v1$/, "") || api2;
+}
+function apiToken() {
+  return process.env.SKY_API_TOKEN ?? loadConfig().token;
+}
+function currentUniverse() {
+  return process.env.SKY_UNIVERSE ?? loadConfig().currentUniverse;
+}
+
 // src/version.ts
-var CLI_VERSION = "0.2.1";
+var CLI_VERSION = "2.2.1";
 var USER_AGENT = `sky-cli/${CLI_VERSION} (${process.platform}; node/${process.versions.node})`;
 
 // src/api.ts
@@ -68,35 +102,69 @@ async function api(method, path, body, opts = {}) {
     headers: {
       "user-agent": USER_AGENT,
       ...opts.auth === false ? {} : authHeaders(),
-      ...body !== void 0 ? { "content-type": "application/json" } : {}
+      ...body !== void 0 ? { "content-type": "application/json" } : {},
+      ...opts.idempotencyKey ? { "idempotency-key": opts.idempotencyKey } : {}
     },
     body: body !== void 0 ? JSON.stringify(body) : void 0
   });
   if (!res.ok) await parseError(res);
   return await res.json();
 }
+async function postEvents(sessionId, events, idempotencyKey) {
+  const res = await fetch(`${apiBase()}/sessions/${encodeURIComponent(sessionId)}/events`, {
+    method: "POST",
+    headers: {
+      "user-agent": USER_AGENT,
+      ...authHeaders(),
+      "content-type": "application/json",
+      ...idempotencyKey ? { "idempotency-key": idempotencyKey } : {}
+    },
+    body: JSON.stringify({ events })
+  });
+  if (!res.ok) await parseError(res);
+  return await res.json();
+}
+async function uploadFile(bytes, filename, mediaType, expiresInSeconds) {
+  const form = new FormData();
+  form.append("file", new Blob([bytes], { type: mediaType }), filename);
+  if (expiresInSeconds) form.append("expires_in_seconds", String(expiresInSeconds));
+  const res = await fetch(`${apiBase()}/files`, {
+    method: "POST",
+    headers: { "user-agent": USER_AGENT, ...authHeaders() },
+    body: form
+  });
+  if (!res.ok) await parseError(res);
+  return await res.json();
+}
+async function downloadFile(fileId) {
+  const res = await fetch(`${apiBase()}/files/${encodeURIComponent(fileId)}/content`, {
+    headers: { "user-agent": USER_AGENT, ...authHeaders() }
+  });
+  if (!res.ok) await parseError(res);
+  return { bytes: new Uint8Array(await res.arrayBuffer()), mediaType: res.headers.get("content-type") ?? "application/octet-stream" };
+}
 async function resolveSessionRef(ref) {
   if (ref.startsWith("sess-")) return ref;
   const { agent: agent2 } = await api(
     "GET",
-    `/api/v1/agents/${encodeURIComponent(ref)}`
+    `/agents/${encodeURIComponent(ref)}`
   ).catch(async () => {
-    await api("GET", `/api/v1/sessions/${encodeURIComponent(ref)}`);
-    return { agent: { slug: ref, defaultSessionId: ref } };
+    await api("GET", `/sessions/${encodeURIComponent(ref)}`);
+    return { agent: { id: ref, defaultSessionId: ref } };
   });
   if (!agent2.defaultSessionId) {
     throw new ApiError(
       404,
       "no_sessions",
-      `agent ${agent2.slug} has no sessions \u2014 create one: sky session create ${agent2.slug}`
+      `agent ${agent2.id} has no sessions \u2014 create one: sky session create ${agent2.id}`
     );
   }
   return agent2.defaultSessionId;
 }
 async function* streamEvents(sessionId, signal) {
-  const { parseSseStream } = await import("./src-Y2XOFL3Z.js");
+  const { parseSseStream } = await import("./src-NNPV5GRJ.js");
   const res = await fetch(
-    `${apiBase()}/api/v1/sessions/${encodeURIComponent(sessionId)}/stream`,
+    `${apiBase()}/sessions/${encodeURIComponent(sessionId)}/stream`,
     {
       headers: { "user-agent": USER_AGENT, ...authHeaders(), accept: "text/event-stream" },
       signal
@@ -117,9 +185,128 @@ async function* streamEvents(sessionId, signal) {
   }
 }
 
+// src/files.ts
+import { readFileSync as readFileSync2 } from "fs";
+import { basename, extname } from "path";
+var MEDIA_TYPES = {
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".gif": "image/gif",
+  ".webp": "image/webp",
+  ".pdf": "application/pdf",
+  ".txt": "text/plain",
+  ".md": "text/markdown",
+  ".csv": "text/csv",
+  ".json": "application/json",
+  ".html": "text/html",
+  ".xml": "application/xml",
+  ".yaml": "application/yaml",
+  ".yml": "application/yaml"
+};
+function mediaTypeFor(path) {
+  return MEDIA_TYPES[extname(path).toLowerCase()] ?? "application/octet-stream";
+}
+async function uploadLocalFile(path, expiresInSeconds) {
+  const bytes = readFileSync2(path);
+  return uploadFile(new Uint8Array(bytes), basename(path), mediaTypeFor(path), expiresInSeconds);
+}
+function fileBlock(file) {
+  const source = { type: "file", file_id: file.id };
+  return file.mime_type.startsWith("image/") ? { type: "image", source } : { type: "document", source, title: file.filename };
+}
+function eventsFor(text, files2, system) {
+  const content = [];
+  if (text.trim()) content.push({ type: "text", text });
+  for (const file of files2) content.push(fileBlock(file));
+  if (content.length === 0) throw new Error("nothing to send: pass text, --file or --image");
+  const events = [{ type: "user.message", content }];
+  if (system?.trim()) events.push({ type: "system.message", content: [{ type: "text", text: system }] });
+  return events;
+}
+
+// src/goal.ts
+var CHECK_SEPARATOR = " :: ";
+function checkCriterion(value) {
+  const at = value.indexOf(CHECK_SEPARATOR);
+  const text = at === -1 ? "" : value.slice(0, at).trim();
+  const command = (at === -1 ? value : value.slice(at + CHECK_SEPARATOR.length)).trim();
+  if (!command) throw new Error(`--check needs a command: ${JSON.stringify(value)}`);
+  return { text: text || `\`${command}\` succeeds`, command };
+}
+function wholeNumber(flag, value, min) {
+  if (!/^\d+$/.test(value.trim())) throw new Error(`${flag} must be a whole number, got ${JSON.stringify(value)}`);
+  const parsed = Number(value.trim());
+  if (!Number.isSafeInteger(parsed) || parsed < min) throw new Error(`${flag} must be at least ${min}`);
+  return parsed;
+}
+function clearable(value) {
+  return value !== void 0;
+}
+function limitFields(opts) {
+  const body = {};
+  if (opts.maxIterations !== void 0) body.max_iterations = wholeNumber("--max-iterations", opts.maxIterations, 1);
+  if (clearable(opts.maxSpendCents)) {
+    body.max_spend = opts.maxSpendCents === "none" ? null : { amount: String(wholeNumber("--max-spend-cents", opts.maxSpendCents, 1)), currency: "USD" };
+  }
+  if (clearable(opts.maxTokens)) {
+    body.max_tokens = opts.maxTokens === "none" ? null : wholeNumber("--max-tokens", opts.maxTokens, 1);
+  }
+  if (clearable(opts.maxMinutes)) {
+    body.max_duration_minutes = opts.maxMinutes === "none" ? null : wholeNumber("--max-minutes", opts.maxMinutes, 1);
+  }
+  return body;
+}
+function criteriaFields(opts) {
+  const criteria = [...opts.criterion ?? [], ...(opts.check ?? []).map(checkCriterion)];
+  return criteria.length ? criteria : null;
+}
+function setGoalBody(objective, opts) {
+  const text = objective.trim();
+  if (!text) throw new Error("an objective is required");
+  const criteria = criteriaFields(opts);
+  return { objective: text, ...criteria ? { criteria } : {}, ...limitFields(opts) };
+}
+function editGoalBody(opts) {
+  const criteria = criteriaFields(opts);
+  const body = {
+    ...opts.objective !== void 0 ? { objective: opts.objective.trim() } : {},
+    ...criteria ? { criteria } : {},
+    ...limitFields(opts)
+  };
+  if (!Object.keys(body).length) throw new Error("nothing to change \u2014 pass --objective, --criterion, --check, or a limit");
+  return body;
+}
+function dollars(cents) {
+  return `$${(Number(cents) / 100).toFixed(2)}`;
+}
+function renderGoal(goal2) {
+  if (!goal2) return 'No goal. Set one: sky goal set <session> "<objective>"';
+  const lines = [];
+  const state = goal2.status === "stopped" && goal2.stop_reason ? `stopped (${goal2.stop_reason})` : goal2.status;
+  lines.push(`${goal2.id}  ${state}  iteration ${goal2.iteration}/${goal2.max_iterations}`);
+  lines.push(`objective: ${goal2.objective}`);
+  const spend = goal2.max_spend ? `${dollars(goal2.consumed_spend.amount)} of ${dollars(goal2.max_spend.amount)}` : dollars(goal2.consumed_spend.amount);
+  const tokens = goal2.max_tokens === null ? `${goal2.consumed_tokens}` : `${goal2.consumed_tokens} of ${goal2.max_tokens}`;
+  lines.push(`spent: ${spend}   tokens: ${tokens}${goal2.deadline_at ? `   deadline: ${goal2.deadline_at}` : ""}`);
+  const verdicts = new Map((goal2.last_evaluation?.criteria ?? []).map((c) => [c.id, c]));
+  lines.push(`criteria${goal2.criteria_source === "derived" ? " (written from the objective)" : ""}:`);
+  for (const criterion of goal2.criteria) {
+    const verdict = verdicts.get(criterion.id);
+    const mark = verdict ? verdict.met ? "[x]" : "[ ]" : "[?]";
+    lines.push(`  ${mark} ${criterion.id} ${criterion.text}`);
+    if (criterion.command) lines.push(`        $ ${criterion.command}`);
+    if (verdict && !verdict.met && verdict.reason) lines.push(`        ${verdict.reason}`);
+  }
+  if (goal2.last_evaluation && goal2.last_evaluation.result !== "satisfied") {
+    lines.push(`last check (iteration ${goal2.last_evaluation.iteration}): ${goal2.last_evaluation.explanation}`);
+  }
+  return lines.join("\n");
+}
+
 // src/agent-file.ts
-import { existsSync, readFileSync, writeFileSync } from "fs";
-import { dirname, resolve } from "path";
+import { existsSync, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
+import { dirname as dirname2, resolve } from "path";
 import { parse as parseToml, stringify as stringifyToml } from "smol-toml";
 var fileInstructionSchema = external_exports.object({
   name: external_exports.string(),
@@ -128,41 +315,49 @@ var fileInstructionSchema = external_exports.object({
 });
 var agentFileSchema = external_exports.object({
   name: external_exports.string().min(1),
-  slug: external_exports.string().optional(),
+  id: external_exports.string().optional(),
   // stamped by launch/deploy; identifies the live agent
+  slug: external_exports.string().optional(),
+  // pre-RFC-0079 stamp; ignored (agents are id-addressed)
   description: external_exports.string().optional(),
   type: external_exports.enum(AGENT_TYPES).optional(),
   llm: external_exports.string().optional(),
+  reasoning_effort: external_exports.enum(REASONING_EFFORT_VALUES).optional(),
   capabilities: capabilitiesSchema.optional(),
   prompt: external_exports.string().optional(),
   prompt_file: external_exports.string().optional(),
   instructions: external_exports.array(fileInstructionSchema).optional(),
   skills: external_exports.array(skillRefSchema).optional(),
-  customInstalls: external_exports.array(customInstallSchema).optional(),
   customData: external_exports.array(customDataSchema).optional(),
   /** Advanced machine shape (create-only): 1|2|4|8 vCPUs, 256MB-step memory. */
   vcpus: external_exports.number().int().optional(),
   memory_mb: external_exports.number().int().optional()
 });
 function readAgentFile(path) {
-  const raw = readFileSync(path, "utf8");
+  const raw = readFileSync3(path, "utf8");
   const parsed = agentFileSchema.safeParse(parseToml(raw));
   if (!parsed.success) {
     const issue = parsed.error.issues[0];
     throw new Error(`${path}: ${issue?.path.join(".") ?? ""} ${issue?.message ?? "invalid"}`);
   }
   const file = parsed.data;
-  const base = dirname(resolve(path));
+  if (file.reasoning_effort && file.type && !isEffortSupported(file.type, file.reasoning_effort)) {
+    throw new Error(
+      `${path}: reasoning_effort '${file.reasoning_effort}' is not available for ${file.type} \u2014 ${reasoningEffortDocLine()}`
+    );
+  }
+  const base = dirname2(resolve(path));
   const inline = (ref, inlineContent) => {
     if (inlineContent !== void 0) return inlineContent;
     if (!ref) return void 0;
-    return readFileSync(resolve(base, ref), "utf8");
+    return readFileSync3(resolve(base, ref), "utf8");
   };
   const spec = {
     name: file.name,
     description: file.description,
     agentType: file.type,
     llm: file.llm,
+    reasoningEffort: file.reasoning_effort,
     displayName: file.name,
     capabilities: file.capabilities,
     prompt: inline(file.prompt_file, file.prompt),
@@ -172,26 +367,27 @@ function readAgentFile(path) {
       return { name: f.name, content };
     }),
     skills: file.skills,
-    customInstalls: file.customInstalls,
     customData: file.customData,
     vcpus: file.vcpus,
     memoryMb: file.memory_mb
   };
   return { file, spec };
 }
-function stampSlug(path, slug) {
-  const doc = parseToml(readFileSync(path, "utf8"));
-  doc.slug = slug;
-  writeFileSync(path, stringifyToml(doc));
+function stampId(path, id) {
+  const doc = parseToml(readFileSync3(path, "utf8"));
+  doc.id = id;
+  delete doc.slug;
+  writeFileSync2(path, stringifyToml(doc));
 }
 function scaffoldAgentFile(path, name) {
   if (existsSync(path)) throw new Error(`${path} already exists`);
-  writeFileSync(
+  writeFileSync2(
     path,
     `# agent.toml \u2014 everything the create wizard can set. Only \`name\` is required.
 name = "${name}"
-# type = "hermes"              # hermes | claude_code | codex | openclaw
-# llm = "deepseek-v4-flash"    # must be compatible with type
+# type = "hermes"              # hermes | claude_code | codex | openclaw | pi | dsh | kimi_code | opencode
+# llm = "deepseek-flash"       # must be compatible with type
+# reasoning_effort = "high"    # per harness \u2014 ${reasoningEffortDocLine()}
 # capabilities = []
 
 prompt = """
@@ -203,18 +399,18 @@ You are ${name}, a helpful long-lived agent.
 
 // src/clone.ts
 import { spawn } from "child_process";
-import { existsSync as existsSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
-import { homedir } from "os";
-import { basename, join } from "path";
+import { existsSync as existsSync2, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "fs";
+import { homedir as homedir2 } from "os";
+import { basename as basename2, join as join2 } from "path";
 import { createInterface } from "readline";
 var PROMPT_CAP = 1e5;
 var HARNESSES = ["claude_code", "codex", "openclaw"];
 function claudeConfigRoot() {
-  return process.env.CLAUDE_CONFIG_DIR ?? join(homedir(), ".claude");
+  return process.env.CLAUDE_CONFIG_DIR ?? join2(homedir2(), ".claude");
 }
 function readIfExists(path) {
   try {
-    return readFileSync2(path, "utf8");
+    return readFileSync4(path, "utf8");
   } catch {
     return void 0;
   }
@@ -230,9 +426,9 @@ function readJson(path) {
 }
 function claudeModel(configRoot) {
   const candidates = [
-    join(process.cwd(), ".claude", "settings.local.json"),
-    join(process.cwd(), ".claude", "settings.json"),
-    join(configRoot, "settings.json")
+    join2(process.cwd(), ".claude", "settings.local.json"),
+    join2(process.cwd(), ".claude", "settings.json"),
+    join2(configRoot, "settings.json")
   ];
   for (const path of candidates) {
     const model = readJson(path)?.model;
@@ -242,11 +438,11 @@ function claudeModel(configRoot) {
 }
 function claudeMcpServers() {
   const merged = {};
-  const userConfig = readJson(join(homedir(), ".claude.json"));
+  const userConfig = readJson(join2(homedir2(), ".claude.json"));
   Object.assign(merged, userConfig?.mcpServers ?? {});
   Object.assign(merged, userConfig?.projects?.[process.cwd()]?.mcpServers ?? {});
   const projectConfig = readJson(
-    join(process.cwd(), ".mcp.json")
+    join2(process.cwd(), ".mcp.json")
   );
   Object.assign(merged, projectConfig?.mcpServers ?? {});
   return merged;
@@ -263,13 +459,13 @@ function readClaudeCode() {
   const configRoot = claudeConfigRoot();
   const parts = [];
   const sources = [];
-  const global = readIfExists(join(configRoot, "CLAUDE.md"));
+  const global = readIfExists(join2(configRoot, "CLAUDE.md"));
   if (global?.trim()) {
     parts.push({ label: "Global CLAUDE.md", content: global });
     sources.push("global CLAUDE.md");
   }
   for (const name of ["CLAUDE.md", "AGENTS.md"]) {
-    const project = readIfExists(join(process.cwd(), name));
+    const project = readIfExists(join2(process.cwd(), name));
     if (project?.trim()) {
       parts.push({ label: `Project ${name}`, content: project });
       sources.push(`project ${name}`);
@@ -297,8 +493,8 @@ function detectHarness(explicit) {
     return explicit;
   }
   if (existsSync2(claudeConfigRoot())) return "claude_code";
-  if (existsSync2(join(homedir(), ".codex"))) return "codex";
-  if (existsSync2(join(homedir(), ".openclaw"))) return "openclaw";
+  if (existsSync2(join2(homedir2(), ".codex"))) return "codex";
+  if (existsSync2(join2(homedir2(), ".openclaw"))) return "openclaw";
   throw new Error(
     "no local harness found (~/.claude, ~/.codex, ~/.openclaw) \u2014 pass --harness to override"
   );
@@ -310,14 +506,14 @@ function readLocal(harness) {
   );
 }
 function linkPath(configRoot) {
-  return join(configRoot, "agentsky-link.json");
+  return join2(configRoot, "agentsky-link.json");
 }
 function readLink(configRoot) {
   const link = readJson(linkPath(configRoot));
-  return link?.agentSlug ? link : void 0;
+  return link?.agentId ? link : void 0;
 }
 function writeLink(configRoot, link) {
-  writeFileSync2(linkPath(configRoot), `${JSON.stringify(link, null, 2)}
+  writeFileSync3(linkPath(configRoot), `${JSON.stringify(link, null, 2)}
 `);
 }
 function confirm(question) {
@@ -346,7 +542,7 @@ async function createClone(local, opts) {
     `model ${local.model ?? "(harness default)"}`,
     `${keptNames.length} MCP server${keptNames.length === 1 ? "" : "s"}${keptNames.length ? ` (${keptNames.join(", ")})` : ""}`
   ].join(" \xB7 ");
-  console.log(`Detected ${local.harness} at ${local.configRoot} (project ${basename(process.cwd())})`);
+  console.log(`Detected ${local.harness} at ${local.configRoot} (project ${basename2(process.cwd())})`);
   console.log(`Will clone: ${summary}`);
   if (local.truncated) console.log("  note: instructions exceeded 100k chars and were truncated");
   if (local.droppedServers.length) {
@@ -362,41 +558,48 @@ async function createClone(local, opts) {
     console.log("Aborted \u2014 nothing sent.");
     return;
   }
-  const installs = keptNames.length ? [mcpConfigInstall(local.keptServers)] : [];
+  const { servers: mcpServers, skipped } = mcpServersFromKept(local.keptServers);
+  if (skipped.length) {
+    console.log(`  note: local (stdio) MCP servers have no cloud equivalent and were skipped: ${skipped.join(", ")}`);
+  }
   const body = {
     agentType: local.harness,
     ...local.model ? { llm: local.model } : {},
     ...local.prompt ? { prompt: local.prompt } : {},
-    ...installs.length ? { customInstalls: installs } : {}
+    ...mcpServers.length ? { mcpServers } : {}
   };
   let sentLlm = local.model ?? null;
   let created;
   try {
-    ({ agent: created } = await api("POST", "/api/v1/agents", body));
+    ({ agent: created } = await api("POST", "/agents", body));
   } catch (error) {
     if (error instanceof ApiError && error.status === 422 && local.model) {
-      console.log(`  note: ${local.model} isn't available for ${local.harness} \u2014 using the harness default`);
-      sentLlm = null;
-      ({ agent: created } = await api("POST", "/api/v1/agents", {
+      const successor = supersededBy(local.model);
+      console.log(
+        successor ? `  note: ${local.model} is superseded \u2014 using ${successor}` : `  note: ${local.model} isn't available for ${local.harness} \u2014 using the harness default`
+      );
+      sentLlm = successor;
+      ({ agent: created } = await api("POST", "/agents", {
         ...body,
-        llm: void 0
+        llm: successor ?? void 0
       }));
     } else {
       throw error;
     }
   }
-  await api("POST", "/api/v1/sessions", { agent: created.slug });
+  console.log("Starting its runtime\u2026");
+  await api("POST", "/sessions", { agent: created.id });
   const now = (/* @__PURE__ */ new Date()).toISOString();
   writeLink(local.configRoot, {
     baseUrl: apiBase(),
-    agentSlug: created.slug,
+    agentId: created.id,
     clonedAt: now,
     lastSyncedAt: now,
     llm: sentLlm,
     mcpServers: keptNames
   });
-  const url = `${apiBase()}/agents/${created.slug}`;
-  console.log(`Cloned \u2192 ${created.slug}  ${url}`);
+  const url = `${apiBase()}/agents/${created.id}`;
+  console.log(`Cloned \u2192 ${created.id}  ${url}`);
   console.log(
     `Linked this machine (${linkPath(local.configRoot)}). Push prompt changes anytime by running \`sky clone\` again.`
   );
@@ -405,11 +608,11 @@ async function createClone(local, opts) {
 async function syncClone(local, link, opts) {
   const since = link.lastSyncedAt ?? link.clonedAt;
   console.log(
-    `Syncing ${link.agentSlug} from ${local.configRoot} (last synced ${since ? new Date(since).toLocaleDateString() : "never"})`
+    `Syncing ${link.agentId} from ${local.configRoot} (last synced ${since ? new Date(since).toLocaleDateString() : "never"})`
   );
   if (opts.dryRun) {
     console.log(
-      `  would push prompt (${kb(local.prompt)}) to ${link.agentSlug}. Dry run \u2014 nothing sent.`
+      `  would push prompt (${kb(local.prompt)}) to ${link.agentId}. Dry run \u2014 nothing sent.`
     );
     return;
   }
@@ -417,24 +620,24 @@ async function syncClone(local, link, opts) {
   try {
     ({ agent: agent2 } = await api(
       "GET",
-      `/api/v1/agents/${encodeURIComponent(link.agentSlug)}`
+      `/agents/${encodeURIComponent(link.agentId)}`
     ));
   } catch (error) {
     if (error instanceof ApiError && error.status === 404) {
       throw new Error(
-        `linked agent ${link.agentSlug} no longer exists \u2014 run \`sky clone --new\` to launch a fresh one`
+        `linked agent ${link.agentId} no longer exists \u2014 run \`sky clone --new\` to launch a fresh one`
       );
     }
     throw error;
   }
   if (agent2.agentType !== local.harness) {
     throw new Error(
-      `linked agent ${link.agentSlug} is ${agent2.agentType}, this machine runs ${local.harness} \u2014 run \`sky clone --new\` to launch a fresh agent`
+      `linked agent ${link.agentId} is ${agent2.agentType}, this machine runs ${local.harness} \u2014 run \`sky clone --new\` to launch a fresh agent`
     );
   }
   const result = await api(
     "PUT",
-    `/api/v1/agents/${encodeURIComponent(link.agentSlug)}/prompt`,
+    `/agents/${encodeURIComponent(link.agentId)}/prompt`,
     { prompt: local.prompt }
   );
   console.log(
@@ -462,8 +665,8 @@ async function syncClone(local, link, opts) {
     );
   }
   writeLink(local.configRoot, { ...link, lastSyncedAt: (/* @__PURE__ */ new Date()).toISOString() });
-  console.log(`Synced ${link.agentSlug}.`);
-  if (opts.open) openBrowser(`${apiBase()}/agents/${link.agentSlug}`);
+  console.log(`Synced ${link.agentId}.`);
+  if (opts.open) openBrowser(`${apiBase()}/agents/${link.agentId}`);
 }
 async function clone(opts) {
   const harness = detectHarness(opts.harness);
@@ -526,7 +729,7 @@ async function browserLogin(verifier, challenge) {
     server.listen(0, "127.0.0.1", () => {
       const address = server.address();
       const port = typeof address === "object" && address ? address.port : 0;
-      const authorizeUrl = `${apiBase()}/cli/authorize?state=${state}&port=${port}&challenge=${encodeURIComponent(challenge)}&scopes=read,write`;
+      const authorizeUrl = `${consoleBase()}/cli/authorize?state=${state}&port=${port}&challenge=${encodeURIComponent(challenge)}&scopes=read,write`;
       console.log("Opening your browser to authorize this machine\u2026");
       console.log(`If it doesn't open, visit:
   ${authorizeUrl}`);
@@ -539,14 +742,14 @@ async function browserLogin(verifier, challenge) {
   });
   return api(
     "POST",
-    "/api/v1/cli/token-exchange",
+    "/cli/token-exchange",
     { code, verifier, clientName: `cli ${hostname()}` },
     { auth: false }
   );
 }
 async function headlessLogin(verifier, challenge) {
   const request = b64url(randomBytes(24));
-  const authorizeUrl = `${apiBase()}/cli/authorize?request=${request}&challenge=${encodeURIComponent(challenge)}&scopes=read,write`;
+  const authorizeUrl = `${consoleBase()}/cli/authorize?request=${request}&challenge=${encodeURIComponent(challenge)}&scopes=read,write`;
   console.log(`Visit this URL on any device to authorize:
   ${authorizeUrl}
 `);
@@ -555,7 +758,7 @@ async function headlessLogin(verifier, challenge) {
   while (Date.now() < deadline) {
     await new Promise((r) => setTimeout(r, 3e3));
     const res = await fetch(
-      `${apiBase()}/api/v1/cli/poll?request=${request}&verifier=${encodeURIComponent(verifier)}&clientName=${encodeURIComponent(`cli ${hostname()}`)}`,
+      `${apiBase()}/cli/poll?request=${request}&verifier=${encodeURIComponent(verifier)}&clientName=${encodeURIComponent(`cli ${hostname()}`)}`,
       { headers: { "user-agent": USER_AGENT } }
     );
     if (!res.ok) {
@@ -575,7 +778,6 @@ async function headlessLogin(verifier, challenge) {
 // src/render.ts
 var dim = (s) => `\x1B[2m${s}\x1B[0m`;
 var red = (s) => `\x1B[31m${s}\x1B[0m`;
-var cyan = (s) => `\x1B[36m${s}\x1B[0m`;
 function clip(value, max = 120) {
   const text = typeof value === "string" ? value : JSON.stringify(value);
   return text.length > max ? `${text.slice(0, max)}\u2026` : text;
@@ -598,18 +800,18 @@ function renderEvent(event, data) {
     case "agent.status":
       console.log(dim(`\u2026 ${String(part?.level ?? "")} ${String(part?.text ?? "")}`.trim()));
       break;
-    case "user.message": {
-      const channel = String(data.channel ?? "");
-      if (channel && channel !== "api") {
-        console.log(cyan(`[${channel}] ${clip(data.text ?? "")}`));
-      }
+    case "user.interrupt":
+      console.log(dim("\u23F9 interrupting"));
       break;
-    }
-    case "turn.interrupted":
-      console.log(dim("\u23F9 turn interrupted"));
+    case "session.error": {
+      const error = data.error;
+      const message = String(error?.message ?? error?.type ?? "unknown");
+      if (error?.retry_status === "retrying") console.error(dim(`retrying: ${message}`));
+      else console.error(red(`error: ${message}`));
       break;
-    case "error":
-      console.error(red(`error: ${String(data.message ?? data.code ?? "unknown")}`));
+    }
+    case "session.status_terminated":
+      console.log(dim("session terminated"));
       break;
     default:
       break;
@@ -618,9 +820,9 @@ function renderEvent(event, data) {
 
 // src/subscriptions.ts
 import { spawn as spawn3 } from "child_process";
-import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
-import { homedir as homedir2 } from "os";
-import { join as join2 } from "path";
+import { existsSync as existsSync3, readFileSync as readFileSync5 } from "fs";
+import { homedir as homedir3 } from "os";
+import { join as join3 } from "path";
 import { createInterface as createInterface2 } from "readline";
 var ALIASES = {
   claude: "anthropic",
@@ -678,7 +880,7 @@ function mintClaudeToken() {
 async function put(provider, credential) {
   const { modelSubscription } = await api(
     "PUT",
-    `/api/v1/model-subscriptions/${provider}`,
+    `/model-subscriptions/${provider}`,
     { credential }
   );
   return modelSubscription;
@@ -698,12 +900,12 @@ async function connectClaude() {
   console.log(`Connected Claude subscription${expiry}. Powers new eligible agents.`);
 }
 async function connectChatgpt(opts) {
-  const codexHome = process.env.CODEX_HOME || join2(homedir2(), ".codex");
-  const path = join2(codexHome, "auth.json");
+  const codexHome = process.env.CODEX_HOME || join3(homedir3(), ".codex");
+  const path = join3(codexHome, "auth.json");
   if (!existsSync3(path)) {
     throw new ApiError(404, "no_codex_auth", `no ${path} \u2014 run \`codex login\` first`);
   }
-  const raw = readFileSync3(path, "utf8");
+  const raw = readFileSync5(path, "utf8");
   let accountId;
   try {
     const parsed = JSON.parse(raw);
@@ -725,7 +927,7 @@ async function connectChatgpt(opts) {
 async function listSubscriptions() {
   const { modelSubscriptions } = await api(
     "GET",
-    "/api/v1/model-subscriptions"
+    "/model-subscriptions"
   );
   if (modelSubscriptions.length === 0) {
     console.log("No model subscriptions connected. Try `sky auth connect claude` or `sky auth connect chatgpt`.");
@@ -741,7 +943,7 @@ async function listSubscriptions() {
       s.useForNewAgents ? "used for new agents" : "not used for new agents"
     ].filter(Boolean);
     console.log(bits.join(" \xB7 "));
-    for (const a of s.agents) console.log(`    ${a.slug ?? a.id} \u2014 ${a.name}`);
+    for (const a of s.agents) console.log(`    ${a.agentId ?? a.id} \u2014 ${a.name}`);
   }
 }
 async function disconnect(name, opts) {
@@ -756,18 +958,25 @@ async function disconnect(name, opts) {
   }
   const { affectedAgents } = await api(
     "DELETE",
-    `/api/v1/model-subscriptions/${provider}`
+    `/model-subscriptions/${provider}`
   );
   console.log(`Disconnected ${label}.`);
   if (affectedAgents.length > 0) {
     console.log(
-      `${affectedAgents.length} agent${affectedAgents.length === 1 ? "" : "s"} still point at it and will fail: ` + affectedAgents.map((a) => a.slug ?? a.id).join(", ")
+      `${affectedAgents.length} agent${affectedAgents.length === 1 ? "" : "s"} still point at it and will fail: ` + affectedAgents.map((a) => a.agentId ?? a.id).join(", ")
     );
     console.log("Switch them to Platform in each agent's Configure tab (or reconnect).");
   }
 }
 
 // src/index.ts
+function printModelBilling(session2) {
+  if (session2.modelBilling !== "account") return;
+  const provider = modelSubscriptionProviderFor(session2.agentType, session2.llm);
+  if (!provider) return;
+  const label = provider === "anthropic" ? "your Claude subscription" : "your ChatGPT plan";
+  console.log(`Model billing: ${label} \u2014 $0 model usage`);
+}
 var program = new Command();
 program.name("sky").description("Launch and talk to long-lived agents \u2014 agentsky.dev").version(CLI_VERSION);
 function fail(error) {
@@ -778,15 +987,15 @@ function fail(error) {
 var run = (fn) => (...args) => fn(...args).catch(fail);
 var auth = program.command("auth").description("login, logout, whoami, model subscriptions");
 auth.command("login").description("authorize this machine via the browser").option("--no-browser", "print a URL and poll instead of opening a browser").action(run(async (opts) => login({ noBrowser: opts.browser === false })));
-auth.command("logout").description("forget the stored token (revoke it in Settings \u2192 API tokens)").action(
+auth.command("logout").description("forget the stored token (revoke it in Developer \u2192 API keys)").action(
   run(async () => {
     saveConfig({ ...loadConfig(), token: void 0, email: void 0 });
-    console.log(`Logged out. (Token revocation: Settings \u2192 API tokens.)`);
+    console.log(`Logged out. (Token revocation: Developer \u2192 API keys.)`);
   })
 );
 auth.command("whoami").description("who the current token acts as").action(
   run(async () => {
-    const who = await api("GET", "/api/v1/whoami");
+    const who = await api("GET", "/whoami");
     console.log(
       `${who.user.email ?? "unknown"} \xB7 universe ${who.universe.slug}${who.universe.isPersonal ? " (personal)" : ""} \xB7 scopes ${who.scopes.join(",")}`
     );
@@ -804,7 +1013,7 @@ auth.command("disconnect <provider>").description("disconnect a model subscripti
 var universe = program.command("universe").description("grouping boundary for agents");
 universe.command("list").action(
   run(async () => {
-    const { universes } = await api("GET", "/api/v1/universes");
+    const { universes } = await api("GET", "/universes");
     const current = currentUniverse();
     for (const u of universes) {
       const marker = u.slug === current || !current && u.isPersonal ? "*" : " ";
@@ -814,13 +1023,13 @@ universe.command("list").action(
 );
 universe.command("create <slug>").action(
   run(async (slug) => {
-    const created = await api("POST", "/api/v1/universes", { slug });
+    const created = await api("POST", "/universes", { slug });
     console.log(`Created universe ${created.universe.slug}`);
   })
 );
 universe.command("switch <slug>").action(
   run(async (slug) => {
-    await api("GET", `/api/v1/universes/${encodeURIComponent(slug)}`);
+    await api("GET", `/universes/${encodeURIComponent(slug)}`);
     saveConfig({ ...loadConfig(), currentUniverse: slug });
     console.log(`Switched to ${slug}`);
   })
@@ -828,7 +1037,7 @@ universe.command("switch <slug>").action(
 universe.command("show").action(
   run(async () => {
     const slug = currentUniverse();
-    const path = slug ? `/api/v1/universes/${encodeURIComponent(slug)}` : "/api/v1/whoami";
+    const path = slug ? `/universes/${encodeURIComponent(slug)}` : "/whoami";
     if (slug) {
       const { universe: u } = await api("GET", path);
       console.log(`${u.slug} \u2014 ${u.name} \xB7 ${u.agents} agents \xB7 ${u.members} members`);
@@ -839,22 +1048,37 @@ universe.command("show").action(
   })
 );
 var agent = program.command("agent").description("agent specs: create, inspect, talk (via the default session)");
-agent.command("create").description("create an agent spec \u2014 no runtime; `sky session create` starts one").option("--type <type>", "hermes | claude_code | codex | openclaw").option("--llm <llm>", "model id (defaults per type)").option("--name <name>", "agent name").option("-f, --file <path>", "create from an agent.toml").action(
-  run(async (opts) => {
-    const spec = opts.file ? readAgentFile(opts.file).spec : {
-      name: opts.name ?? "My agent",
-      agentType: opts.type,
-      llm: opts.llm,
-      displayName: opts.name
-    };
-    const { agent: created } = await api("POST", "/api/v1/agents", spec);
-    console.log(`Created ${created.slug} (${created.agentType} \xB7 ${created.llm}) \u2014 spec only.`);
-    console.log(`Start it:  sky session create ${created.slug}`);
-  })
+agent.command("create").description("create an agent spec \u2014 no runtime; `sky session create` starts one").option("--type <type>", "hermes | claude_code | codex | openclaw | pi | dsh | kimi_code | opencode").option("--llm <llm>", "model id (defaults per type)").option(
+  "--reasoning-effort <level>",
+  `harness-native reasoning effort (default: the harness's own) \u2014 ${reasoningEffortDocLine()}`
+).option("--name <name>", "agent name").option(
+  "--capability <id>",
+  "grant a built-in capability (repeatable; ids at /docs/capabilities; none by default)",
+  (id, all) => [...all, id],
+  []
+).option("-f, --file <path>", "create from an agent.toml").action(
+  run(
+    async (opts) => {
+      const spec = opts.file ? readAgentFile(opts.file).spec : {
+        name: opts.name ?? "My agent",
+        agentType: opts.type,
+        llm: opts.llm,
+        reasoningEffort: opts.reasoningEffort,
+        displayName: opts.name,
+        ...opts.capability.length ? { capabilities: opts.capability } : {}
+      };
+      const { agent: created } = await api("POST", "/agents", spec);
+      console.log(`Created ${created.id} (${created.agentType} \xB7 ${created.llm}) \u2014 spec only.`);
+      console.log(
+        created.capabilities.length ? `Capabilities: ${created.capabilities.join(", ")}` : "Capabilities: none (grant with --capability <id> or PATCH capabilities)"
+      );
+      console.log(`Start it:  sky session create ${created.id}`);
+    }
+  )
 );
 agent.command("list").action(
   run(async () => {
-    const { agents } = await api("GET", "/api/v1/agents");
+    const { agents } = await api("GET", "/agents");
     if (!agents.length) {
       console.log("No agents yet. `sky launch` or `sky agent create` to get one.");
       return;
@@ -862,16 +1086,17 @@ agent.command("list").action(
     for (const a of agents) {
       const state = a.archived ? "archived" : `${a.sessionCount} session${a.sessionCount === 1 ? "" : "s"}`;
       console.log(
-        `${a.slug.padEnd(24)} ${a.displayName.padEnd(20)} ${a.agentType}/${a.llm} ${state}`
+        `${a.id.padEnd(32)} ${a.displayName.padEnd(20)} ${a.agentType}/${a.llm} ${state}`
       );
     }
   })
 );
-agent.command("show <slug>").action(
-  run(async (slug) => {
-    const { agent: a } = await api("GET", `/api/v1/agents/${encodeURIComponent(slug)}`);
-    console.log(`${a.slug} \u2014 ${a.displayName}${a.archived ? " (archived)" : ""}`);
+agent.command("show <id>").action(
+  run(async (id) => {
+    const { agent: a } = await api("GET", `/agents/${encodeURIComponent(id)}`);
+    console.log(`${a.id} \u2014 ${a.displayName}${a.archived ? " (archived)" : ""}`);
     console.log(`  type      ${a.agentType} \xB7 ${a.llm}`);
+    if (a.reasoningEffort) console.log(`  effort    ${a.reasoningEffort}`);
     console.log(`  version   ${a.version}`);
     console.log(`  sessions  ${a.sessionCount}`);
     console.log(`  universe  ${a.universe}`);
@@ -879,42 +1104,72 @@ agent.command("show <slug>").action(
     if (a.prompt) console.log(`  prompt    ${a.prompt.split("\n")[0]?.slice(0, 80)}\u2026`);
   })
 );
-agent.command("archive <slug>").description("retire the spec \u2014 read-only, running sessions unaffected (admin scope)").action(
-  run(async (slug) => {
-    await api("POST", `/api/v1/agents/${encodeURIComponent(slug)}/archive`);
-    console.log(`Archived ${slug} \u2014 sessions keep running; new sessions are rejected.`);
+agent.command("archive <id>").description("retire the spec \u2014 read-only, running sessions unaffected (admin scope)").action(
+  run(async (id) => {
+    await api("POST", `/agents/${encodeURIComponent(id)}/archive`);
+    console.log(`Archived ${id} \u2014 sessions keep running; new sessions are rejected.`);
   })
 );
-agent.command("destroy <slug>").description("delete the spec; requires all sessions destroyed first (admin scope)").action(
-  run(async (slug) => {
-    await api("DELETE", `/api/v1/agents/${encodeURIComponent(slug)}`);
-    console.log(`Destroyed ${slug}`);
+agent.command("destroy <id>").description("delete the spec; requires all sessions deleted first (admin scope)").action(
+  run(async (id) => {
+    await api("DELETE", `/agents/${encodeURIComponent(id)}`);
+    console.log(`Destroyed ${id}`);
   })
 );
-agent.command("message <slug> <text>").description("send one message to the default session and stream the turn until idle").option("--detach", "don't follow the stream; exit after the 202").action(
+agent.command("message <id> [text]").description("send one message to the default session and stream the turn until idle").option("--detach", "don't follow the stream; exit once the message is accepted").option("--file <path...>", "attach local files (uploaded first, sent as document blocks)").option("--image <path...>", "attach local images (uploaded first, sent as image blocks)").option("--system <text>", "per-turn system text sent alongside the message").action(
   run(
-    async (slug, text, opts) => sendAndFollow(await resolveSessionRef(slug), text, Boolean(opts.detach))
+    async (id, text, opts) => sendAndFollow(await resolveSessionRef(id), text ?? "", opts)
   )
 );
-agent.command("chat <slug>").description("interactive REPL with the default session").action(run(async (slug) => chatLoop(await resolveSessionRef(slug))));
+agent.command("chat <id>").description("interactive REPL with the default session").option("--system <text>", "per-turn system text sent with the first message").action(run(async (id, opts) => chatLoop(await resolveSessionRef(id), opts)));
 var session = program.command("session").description("sessions: the running instances of an agent");
-session.command("create <agent>").description("create a session (cheap \u2014 the pod starts on the first message)").option("--title <title>", "session title").option("--message <text>", "seed the session and start its first turn").option("--vcpus <n>", "machine vCPUs: 1, 2, 4 or 8 (default 2)").option("--memory <mb>", "machine memory in MB, 256MB steps (default 4096)").action(
-  run(async (agentRef, opts) => {
-    const { session: created } = await api("POST", "/api/v1/sessions", {
-      agent: agentRef,
-      ...opts.title ? { title: opts.title } : {},
-      ...opts.vcpus !== void 0 ? { vcpus: Number(opts.vcpus) } : {},
-      ...opts.memory !== void 0 ? { memoryMb: Number(opts.memory) } : {},
-      ...opts.message ? { initial_events: [{ type: "user.message", parts: [{ type: "text", index: 0, text: opts.message }] }] } : {}
-    });
-    console.log(`Created ${created.id} (${created.agent} \xB7 ${created.status})${created.default ? " [default]" : ""}`);
-    console.log(`  sky agent message ${created.agent} "hello"`);
-  })
+async function fileResource(spec) {
+  const at = spec.lastIndexOf(":/");
+  const path = at > 0 ? spec.slice(0, at) : spec;
+  const mount = at > 0 ? spec.slice(at + 1) : void 0;
+  const file = await uploadLocalFile(path);
+  console.error(`uploaded ${file.filename} \u2192 ${file.id}`);
+  return { type: "file", file_id: file.id, ...mount ? { mount_path: mount } : {} };
+}
+function repoResource(spec, token) {
+  const at = spec.lastIndexOf("@");
+  const url = at > "https://".length ? spec.slice(0, at) : spec;
+  const ref = at > "https://".length ? spec.slice(at + 1) : "";
+  const checkout = ref ? /^[0-9a-f]{7,64}$/.test(ref) ? { type: "commit", sha: ref } : { type: "branch", name: ref } : void 0;
+  return { type: "github_repository", url, ...checkout ? { checkout } : {}, ...token ? { authorization_token: token } : {} };
+}
+async function resourceParams(opts) {
+  const files2 = await Promise.all((opts.file ?? []).map(fileResource));
+  return [...files2, ...(opts.repo ?? []).map((spec) => repoResource(spec, opts.repoToken))];
+}
+function renderResource(r) {
+  if (r.type === "file") return `${r.id}  file  ${r.mount_path}  ${r.file_id}`;
+  const ref = r.checkout ? `@${r.checkout.type === "branch" ? r.checkout.name : r.checkout.sha}` : "";
+  return `${r.id}  repo  ${r.mount_path}  ${r.url}${ref}`;
+}
+session.command("create <agent>").description("create a session (the pod is provisioned now)").option("--title <title>", "session title").option("--message <text>", "seed the session and start its first turn").option("--vcpus <n>", "machine vCPUs: 1, 2, 4 or 8 (default 2)").option("--memory <mb>", "machine memory in MB, 256MB steps (default 4096)").option("--file <path...>", "mount local files read-only in the working directory: path[:/mount] (uploaded first)").option("--repo <url...>", "clone GitHub repositories into the working directory: https://github.com/{owner}/{repo}[@branch|@sha]").option("--repo-token <token>", "token for the --repo clones; compiled into the sandbox's egress policy, never sent to it").action(
+  run(
+    async (agentRef, opts) => {
+      const resources = await resourceParams(opts);
+      const { session: created } = await api("POST", "/sessions", {
+        agent: agentRef,
+        ...opts.title ? { title: opts.title } : {},
+        ...opts.vcpus !== void 0 ? { vcpus: Number(opts.vcpus) } : {},
+        ...opts.memory !== void 0 ? { memoryMb: Number(opts.memory) } : {},
+        ...resources.length ? { resources } : {},
+        ...opts.message ? { initial_events: [{ type: "user.message", content: [{ type: "text", text: opts.message }] }] } : {}
+      });
+      console.log(`Created ${created.id} (${created.agent} \xB7 ${created.status})${created.default ? " [default]" : ""}`);
+      printModelBilling(created);
+      for (const r of created.resources ?? []) console.log(`  ${renderResource(r)}`);
+      console.log(`  sky agent message ${created.agent} "hello"`);
+    }
+  )
 );
 session.command("list [agent]").action(
   run(async (agentRef) => {
     const qs = agentRef ? `?agent=${encodeURIComponent(agentRef)}` : "";
-    const { sessions } = await api("GET", `/api/v1/sessions${qs}`);
+    const { sessions } = await api("GET", `/sessions${qs}`);
     if (!sessions.length) {
       console.log("No sessions. `sky session create <agent>` to start one.");
       return;
@@ -930,7 +1185,7 @@ session.command("show <id>").action(
   run(async (id) => {
     const { session: s } = await api(
       "GET",
-      `/api/v1/sessions/${encodeURIComponent(id)}`
+      `/sessions/${encodeURIComponent(id)}`
     );
     console.log(`${s.id}${s.default ? " [default]" : ""}`);
     console.log(`  agent   ${s.agent ?? "-"}`);
@@ -939,68 +1194,113 @@ session.command("show <id>").action(
     console.log(`  model   ${s.agentType} \xB7 ${s.llm}`);
   })
 );
-session.command("destroy <id>").description("end the session and tear down its pod (admin scope)").action(
+function failWithInterruptHint(error, id) {
+  if (error instanceof ApiError && error.code === "session_running") {
+    console.error(
+      `sky: session is running \u2014 \`sky session interrupt ${id}\`, wait for idle, then retry`
+    );
+    process.exit(1);
+  }
+  throw error;
+}
+session.command("archive <id>").description("irreversibly archive: no new messages, pod torn down, history stays readable").action(
+  run(async (id) => {
+    await api("POST", `/sessions/${encodeURIComponent(id)}/archive`).catch(
+      (error) => failWithInterruptHint(error, id)
+    );
+    console.log(`Archived ${id} \u2014 terminated; history stays readable. This is irreversible.`);
+  })
+);
+session.command("delete <id>").description("permanently delete the session, its events, and its sandbox").action(
   run(async (id) => {
-    await api("DELETE", `/api/v1/sessions/${encodeURIComponent(id)}`);
-    console.log(`Destroyed ${id}`);
+    await api("DELETE", `/sessions/${encodeURIComponent(id)}`).catch(
+      (error) => failWithInterruptHint(error, id)
+    );
+    console.log(`Deleted ${id}`);
   })
 );
-session.command("message <ref> <text>").description("send one message (session id, or agent slug = its default session)").option("--detach", "don't follow the stream; exit after the 202").action(
+session.command("message <ref> [text]").description("send one message (session id, or agent id = its default session)").option("--detach", "don't follow the stream; exit once the message is accepted").option("--file <path...>", "attach local files (uploaded first, sent as document blocks)").option("--image <path...>", "attach local images (uploaded first, sent as image blocks)").option("--system <text>", "per-turn system text sent alongside the message").action(
   run(
-    async (ref, text, opts) => sendAndFollow(await resolveSessionRef(ref), text, Boolean(opts.detach))
+    async (ref, text, opts) => sendAndFollow(await resolveSessionRef(ref), text ?? "", opts)
   )
 );
-session.command("chat <ref>").description("interactive REPL over the standing stream").action(run(async (ref) => chatLoop(await resolveSessionRef(ref))));
+session.command("chat <ref>").description("interactive REPL over the standing stream").option("--system <text>", "per-turn system text sent with the first message").action(run(async (ref, opts) => chatLoop(await resolveSessionRef(ref), opts)));
 session.command("interrupt <ref>").description("abort the in-flight turn").action(
   run(async (ref) => {
     const id = await resolveSessionRef(ref);
     const res = await api(
       "POST",
-      `/api/v1/sessions/${encodeURIComponent(id)}/interrupt`
+      `/sessions/${encodeURIComponent(id)}/interrupt`
     );
     console.log(res.status === "no_turn" ? "nothing in flight" : "interrupting");
   })
 );
-session.command("logs <ref>").option("-f, --follow", "follow (SSE)").option("--since <duration>", "how far back, e.g. 1h, 30m", "1h").action(
-  run(async (ref, opts) => {
+var sessionResources = session.command("resources").description("files and GitHub repositories mounted into a session's working directory");
+var resourcesPath = (id) => `/sessions/${encodeURIComponent(id)}/resources`;
+sessionResources.command("list <ref>").description("the session's resources, oldest first").action(
+  run(async (ref) => {
     const id = await resolveSessionRef(ref);
-    const qs = `?since=${encodeURIComponent(opts.since)}${opts.follow ? "&follow=true" : ""}`;
-    if (!opts.follow) {
-      const { lines } = await api(
-        "GET",
-        `/api/v1/sessions/${encodeURIComponent(id)}/logs${qs}`
-      );
-      for (const entry of lines) console.log(`${entry.at} ${entry.line}`);
+    const { data } = await api("GET", resourcesPath(id));
+    if (!data.length) {
+      console.log("No resources. `sky session resources add <session> <path>` mounts a file.");
       return;
     }
-    const { parseSseStream } = await import("./src-Y2XOFL3Z.js");
-    const { apiBase: apiBase2 } = await import("./config-HRDRNTUU.js");
-    const token = apiToken();
-    const res = await fetch(`${apiBase2()}/api/v1/sessions/${encodeURIComponent(id)}/logs${qs}`, {
-      headers: {
-        "user-agent": USER_AGENT,
-        authorization: `Bearer ${token}`,
-        accept: "text/event-stream"
-      }
+    for (const r of data) console.log(renderResource(r));
+  })
+);
+sessionResources.command("get <ref> <rid>").description("one resource, as JSON").action(
+  run(async (ref, rid) => {
+    const id = await resolveSessionRef(ref);
+    console.log(JSON.stringify(await api("GET", `${resourcesPath(id)}/${encodeURIComponent(rid)}`), null, 2));
+  })
+);
+sessionResources.command("add <ref> <path>").description("upload a local file and mount it read-only: path[:/mount] \u2014 on disk before the next turn").action(
+  run(async (ref, spec) => {
+    const id = await resolveSessionRef(ref);
+    const added = await api("POST", resourcesPath(id), await fileResource(spec));
+    console.log(renderResource(added));
+  })
+);
+sessionResources.command("rm <ref> <rid>").description("remove a mounted file (repositories stay for the session's lifetime)").action(
+  run(async (ref, rid) => {
+    const id = await resolveSessionRef(ref);
+    const gone = await api("DELETE", `${resourcesPath(id)}/${encodeURIComponent(rid)}`);
+    console.log(`Removed ${gone.id}`);
+  })
+);
+sessionResources.command("rotate <ref> <rid> <token>").description("replace a repository's token; the sandbox's egress policy is updated in place").action(
+  run(async (ref, rid, token) => {
+    const id = await resolveSessionRef(ref);
+    const updated = await api("POST", `${resourcesPath(id)}/${encodeURIComponent(rid)}`, {
+      authorization_token: token
     });
-    if (!res.ok || !res.body) throw new ApiError(res.status, "logs_failed", await res.text());
-    for await (const frame of parseSseStream(res.body)) {
-      try {
-        const entry = JSON.parse(frame.data);
-        if (entry.line) console.log(`${entry.at ?? ""} ${entry.line}`);
-      } catch {
-      }
-    }
+    console.log(`Rotated ${updated.id}`);
   })
 );
-async function sendAndFollow(sessionId, text, detach) {
+async function uploadAttachments(opts) {
+  const files2 = [];
+  for (const path of [...opts.image ?? [], ...opts.file ?? []]) {
+    const file = await uploadLocalFile(path);
+    console.error(`uploaded ${file.filename} \u2192 ${file.id}`);
+    files2.push(file);
+  }
+  return files2;
+}
+function turnOver(frame) {
+  if (frame.event === "session.status_terminated") return true;
+  if (frame.event !== "session.status_idle") return false;
+  const stopReason = frame.data.stop_reason;
+  return stopReason?.type !== "requires_action";
+}
+async function sendAndFollow(sessionId, text, opts) {
+  const events = eventsFor(text, await uploadAttachments(opts), opts.system);
   const controller = new AbortController();
   let opened = null;
-  if (!detach) {
+  if (!opts.detach) {
     opened = (async () => {
       for await (const frame of streamEvents(sessionId, controller.signal)) {
         renderEvent(frame.event, frame.data);
-        if (frame.event === "turn.status_idle" || frame.event === "turn.interrupted") {
+        if (turnOver(frame)) {
           controller.abort();
           break;
         }
@@ -1008,24 +1308,24 @@ async function sendAndFollow(sessionId, text, detach) {
     })();
     await new Promise((r) => setTimeout(r, 300));
   }
-  await api("POST", `/api/v1/sessions/${encodeURIComponent(sessionId)}/messages`, {
-    parts: [{ type: "text", index: 0, text }]
-  });
-  if (detach) {
+  await postEvents(sessionId, events);
+  if (opts.detach) {
     console.log("accepted");
     return;
   }
   await opened;
 }
-async function chatLoop(sessionId) {
+async function chatLoop(sessionId, opts = {}) {
   console.log(`Chatting with ${sessionId} \u2014 Ctrl-C to leave.`);
   const controller = new AbortController();
   const rl = createInterface3({ input: process.stdin, output: process.stdout, prompt: "> " });
+  let system = opts.system;
   void (async () => {
     try {
       for await (const frame of streamEvents(sessionId, controller.signal)) {
         renderEvent(frame.event, frame.data);
-        if (frame.event === "turn.status_idle") rl.prompt();
+        if (frame.event === "session.status_terminated") rl.close();
+        else if (frame.event === "session.status_idle") rl.prompt();
       }
     } catch (error) {
       fail(error);
@@ -1038,9 +1338,9 @@ async function chatLoop(sessionId) {
       rl.prompt();
       return;
     }
-    void api("POST", `/api/v1/sessions/${encodeURIComponent(sessionId)}/messages`, {
-      parts: [{ type: "text", index: 0, text }]
-    }).catch((error) => {
+    const events = eventsFor(text, [], system);
+    system = void 0;
+    void postEvents(sessionId, events).catch((error) => {
       console.error(`sky: ${error instanceof Error ? error.message : String(error)}`);
       rl.prompt();
     });
@@ -1053,90 +1353,99 @@ async function chatLoop(sessionId) {
   });
 }
 var secrets = program.command("secrets").description("agent secrets (values write-only)");
-secrets.command("set <slug> <pairs...>").description("set KEY=VALUE pairs on the agent").action(
-  run(async (slug, pairs) => {
+secrets.command("set <id> <pairs...>").description("set KEY=VALUE pairs on the agent").action(
+  run(async (id, pairs) => {
     for (const pair of pairs) {
       const eq = pair.indexOf("=");
       if (eq < 1) throw new Error(`expected KEY=VALUE, got ${pair}`);
       const key = pair.slice(0, eq);
-      await api("PUT", `/api/v1/agents/${encodeURIComponent(slug)}/secrets/${encodeURIComponent(key)}`, {
+      await api("PUT", `/agents/${encodeURIComponent(id)}/secrets/${encodeURIComponent(key)}`, {
         value: pair.slice(eq + 1)
       });
       console.log(`set ${key}`);
     }
   })
 );
-secrets.command("list <slug>").action(
-  run(async (slug) => {
-    const { secrets: keys } = await api("GET", `/api/v1/agents/${encodeURIComponent(slug)}/secrets`);
+secrets.command("list <id>").action(
+  run(async (id) => {
+    const { secrets: keys } = await api("GET", `/agents/${encodeURIComponent(id)}/secrets`);
     if (!keys.length) console.log("no secrets set");
     for (const s of keys) {
       console.log(`\u25CF ${s.key}${s.description ? ` \u2014 ${s.description}` : ""}`);
     }
   })
 );
-secrets.command("unset <slug> <key>").action(
-  run(async (slug, key) => {
+secrets.command("unset <id> <key>").action(
+  run(async (id, key) => {
     await api(
       "DELETE",
-      `/api/v1/agents/${encodeURIComponent(slug)}/secrets/${encodeURIComponent(key)}`
+      `/agents/${encodeURIComponent(id)}/secrets/${encodeURIComponent(key)}`
     );
     console.log(`unset ${key}`);
   })
 );
-program.command("launch").description("scaffold ./agent.toml if absent, create the agent, print its address").option("-f, --file <path>", "agent file", "agent.toml").action(
+program.command("launch").description("scaffold ./agent.toml if absent, create the agent, print its address").option("-f, --file <path>", "agent file", "agent.toml").option("--type <type>", "override the file's harness: hermes | claude_code | codex | openclaw | pi | dsh | kimi_code | opencode").option("--llm <llm>", "override the file's model (must suit the harness)").action(
   run(async (opts) => {
     const path = resolve3(opts.file);
     if (!existsSync4(path)) {
-      const name = basename2(process.cwd()).replace(/[^a-zA-Z0-9 _-]/g, "") || "my-agent";
+      const name = basename3(process.cwd()).replace(/[^a-zA-Z0-9 _-]/g, "") || "my-agent";
       scaffoldAgentFile(path, name);
       console.log(`Scaffolded ${opts.file} \u2014 edit it anytime; re-apply with \`sky deploy\`.`);
     }
     const { file, spec } = readAgentFile(path);
-    if (file.slug) {
-      console.log(`${file.slug} already launched \u2014 use \`sky deploy\` to re-apply.`);
+    if (file.id) {
+      console.log(`${file.id} already launched \u2014 use \`sky deploy\` to re-apply.`);
       return;
     }
     const { vcpus, memoryMb, ...specBody } = spec;
-    const { agent: created } = await api("POST", "/api/v1/agents", specBody);
-    await api("POST", "/api/v1/sessions", {
-      agent: created.slug,
+    const body = {
+      ...specBody,
+      ...opts.type ? { agentType: opts.type } : {},
+      ...opts.llm ? { llm: opts.llm } : {}
+    };
+    const { agent: created } = await api("POST", "/agents", body);
+    console.log("Starting its runtime\u2026");
+    const { session: session2 } = await api("POST", "/sessions", {
+      agent: created.id,
       ...vcpus !== void 0 ? { vcpus } : {},
       ...memoryMb !== void 0 ? { memoryMb } : {}
     });
-    stampSlug(path, created.slug);
-    console.log(`Launched ${created.slug} (${created.agentType} \xB7 ${created.llm})`);
-    console.log(`  sky agent message ${created.slug} "hello"`);
-    console.log(`  sky agent chat ${created.slug}`);
+    stampId(path, created.id);
+    console.log(`Launched ${created.id} (${created.agentType} \xB7 ${created.llm})`);
+    printModelBilling(session2);
+    console.log(`  sky agent message ${created.id} "hello"`);
+    console.log(`  sky agent chat ${created.id}`);
   })
 );
 program.command("deploy").description("re-apply ./agent.toml to the existing agent (idempotent)").option("-f, --file <path>", "agent file", "agent.toml").action(
   run(async (opts) => {
     const path = resolve3(opts.file);
     const { file, spec } = readAgentFile(path);
-    if (!file.slug) {
-      console.log("No slug in the file yet \u2014 running launch instead.");
+    if (!file.id) {
+      console.log("No agent id in the file yet \u2014 running launch instead.");
       const { vcpus, memoryMb, ...specBody } = spec;
-      const { agent: created } = await api("POST", "/api/v1/agents", specBody);
-      await api("POST", "/api/v1/sessions", {
-        agent: created.slug,
+      const { agent: created } = await api("POST", "/agents", specBody);
+      await api("POST", "/sessions", {
+        agent: created.id,
         ...vcpus !== void 0 ? { vcpus } : {},
         ...memoryMb !== void 0 ? { memoryMb } : {}
       });
-      stampSlug(path, created.slug);
-      console.log(`Launched ${created.slug}`);
+      stampId(path, created.id);
+      console.log(`Launched ${created.id}`);
       return;
     }
     if (spec.prompt !== void 0) {
-      await api("PUT", `/api/v1/agents/${encodeURIComponent(file.slug)}/prompt`, {
+      await api("PUT", `/agents/${encodeURIComponent(file.id)}/prompt`, {
         prompt: spec.prompt
       });
     }
-    await api("PATCH", `/api/v1/agents/${encodeURIComponent(file.slug)}`, {
+    await api("PATCH", `/agents/${encodeURIComponent(file.id)}`, {
       displayName: spec.displayName,
-      ...spec.capabilities ? { capabilities: spec.capabilities } : {}
+      ...spec.capabilities ? { capabilities: spec.capabilities } : {},
+      ...spec.reasoningEffort ? { reasoningEffort: spec.reasoningEffort } : {},
+      ...spec.skills ? { skills: spec.skills } : {}
     });
-    console.log(`Deployed ${file.slug} (prompt + settings re-applied)`);
+    console.log(`Deployed ${file.id} (prompt + settings re-applied)`);
   })
 );
 program.command("clone").description("clone your local agent (Claude Code, \u2026) into the cloud; re-run to sync its prompt").option("--harness <type>", "claude_code | codex | openclaw (default: detected)").option("--new", "always launch a fresh agent, even if this machine is linked").option("--dry-run", "print the plan and send nothing").option("-y, --yes", "skip the confirmation").option("--open", "open the agent page when done").action(
@@ -1144,6 +1453,184 @@ program.command("clone").description("clone your local agent (Claude Code, \u202
     async (opts) => clone(opts)
   )
 );
+var files = program.command("files").description("files: upload once, reference by id from any message");
+files.command("upload <path>").description("upload a local file; prints the file id to reference from a message").option("--expires <seconds>", "expire the upload after this many seconds (3600\u20137776000)").action(
+  run(async (path, opts) => {
+    const file = await uploadLocalFile(path, opts.expires ? Number(opts.expires) : void 0);
+    console.log(`${file.id}  ${file.filename}  ${file.mime_type}  ${file.size_bytes} bytes`);
+  })
+);
+files.command("list").description("list your uploads, or one session's files with --session").option("--session <ref>", "list the files of this session (its message copies and outputs)").option("--limit <n>", "page size (default 20)").option("--page <cursor>", "continue from a previous page").action(
+  run(async (opts) => {
+    const params = new URLSearchParams();
+    if (opts.session) params.set("scope_id", await resolveSessionRef(opts.session));
+    if (opts.limit) params.set("limit", opts.limit);
+    if (opts.page) params.set("page", opts.page);
+    const query = params.toString();
+    const page = await api("GET", `/files${query ? `?${query}` : ""}`);
+    for (const file of page.data) {
+      console.log(`${file.id}  ${file.filename}  ${file.mime_type}  ${file.size_bytes} bytes${file.downloadable ? "" : "  (upload)"}`);
+    }
+    if (page.next_page) console.log(`\u2026 more: --page ${page.next_page}`);
+  })
+);
+files.command("get <id>").description("show one file's metadata").action(
+  run(
+    async (id) => console.log(JSON.stringify(await api("GET", `/files/${encodeURIComponent(id)}`), null, 2))
+  )
+);
+files.command("rm <id>").description("delete a file (a session that already received it keeps its copy)").action(
+  run(async (id) => {
+    await api("DELETE", `/files/${encodeURIComponent(id)}`);
+    console.log(`Deleted ${id}`);
+  })
+);
+files.command("download <id>").description("download a session file's bytes").requiredOption("-o, --out <path>", "where to write the bytes").action(
+  run(async (id, opts) => {
+    const { bytes } = await downloadFile(id);
+    writeFileSync4(opts.out, bytes);
+    console.log(`Wrote ${bytes.length} bytes to ${opts.out}`);
+  })
+);
+function routineLine(r) {
+  const target = r.target.type === "session" ? `\u2192 ${r.target.session_id}` : `+ ${r.target.agent}`;
+  const cron = r.schedule ? `${r.schedule.expression} ${r.schedule.timezone}` : "manual-only";
+  const state = r.archived_at ? "archived" : r.status === "paused" ? `paused (${r.paused_reason?.error?.type ?? r.paused_reason?.type ?? "manual"})` : "active";
+  return `${r.id.padEnd(30)} ${r.name.padEnd(24)} ${cron.padEnd(26)} ${target.padEnd(30)} ${state}`;
+}
+var routine = program.command("routine").description("run agents on a schedule: cron-fired sessions or turns into a long-lived session");
+routine.command("create <name>").description("create a routine; --agent starts a fresh session per fire, --session fires into one session").option("--agent <id>", "target: create a new session from this agent each fire").option("--session <id>", "target: send each fire into this existing session").option("--message <text>", "the user message delivered on every fire (required)").option("--cron <expression>", '5-field POSIX cron, e.g. "0 9 * * 1-5" (omit for manual-only)').option("--timezone <tz>", "IANA timezone for --cron (default UTC)").option("--budget-cents <n>", "per-run spend cap in whole US cents").action(
+  run(
+    async (name, opts) => {
+      if (!opts.message) throw new Error("--message is required");
+      if (!opts.agent === !opts.session) throw new Error("pass exactly one of --agent or --session");
+      const { routine: created } = await api("POST", "/routines", {
+        name,
+        target: opts.agent ? { type: "new_session", agent: opts.agent } : { type: "session", session_id: opts.session },
+        initial_events: [
+          { type: "user.message", content: [{ type: "text", text: opts.message }] }
+        ],
+        ...opts.cron ? { schedule: { type: "cron", expression: opts.cron, timezone: opts.timezone ?? "UTC" } } : {},
+        ...opts.budgetCents ? { budget: { type: "limit", max_list_cost: { amount: opts.budgetCents, currency: "USD" } } } : {}
+      });
+      console.log(`Created ${created.id}`);
+      if (created.schedule) {
+        console.log(`  next fires: ${created.schedule.upcoming_runs_at.slice(0, 3).join(", ")}`);
+      } else {
+        console.log(`  manual-only \u2014 fire with: sky routine run ${created.id}`);
+      }
+    }
+  )
+);
+routine.command("list").action(
+  run(async () => {
+    const { items } = await api("GET", "/routines");
+    if (!items.length) {
+      console.log("No routines. `sky routine create <name> --agent <id> --message <text> --cron <expr>`");
+      return;
+    }
+    for (const r of items) console.log(routineLine(r));
+  })
+);
+routine.command("show <id>").action(
+  run(async (id) => {
+    const { routine: r } = await api(
+      "GET",
+      `/routines/${encodeURIComponent(id)}`
+    );
+    console.log(routineLine(r));
+    const { items } = await api(
+      "GET",
+      `/routine-runs?routine=${encodeURIComponent(id)}&limit=5`
+    );
+    for (const runRow of items) {
+      const outcome = runRow.error ? `FAILED ${runRow.error.type}` : runRow.session_id ?? "ok";
+      console.log(`  ${runRow.created_at}  ${runRow.trigger_context.type.padEnd(8)} ${outcome}`);
+    }
+  })
+);
+routine.command("run <id>").description("fire now, outside the schedule (works while paused)").action(
+  run(async (id) => {
+    const { run: fired } = await api(
+      "POST",
+      `/routines/${encodeURIComponent(id)}/run`
+    );
+    if (fired.error) console.log(`Run ${fired.id} failed: ${fired.error.type} \u2014 ${fired.error.message}`);
+    else console.log(`Run ${fired.id} \u2192 ${fired.session_id}`);
+  })
+);
+for (const [verb, blurb] of [
+  ["pause", "suppress scheduled fires (manual runs still work)"],
+  ["unpause", "resume from the next occurrence \u2014 missed fires are not backfilled"],
+  ["archive", "terminal: the schedule stops and the routine becomes immutable"]
+]) {
+  routine.command(`${verb} <id>`).description(blurb).action(
+    run(async (id) => {
+      const { routine: r } = await api(
+        "POST",
+        `/routines/${encodeURIComponent(id)}/${verb}`
+      );
+      console.log(`${r.id}: ${r.archived_at ? "archived" : r.status}`);
+    })
+  );
+}
+var collect = (value, previous = []) => [...previous, value];
+function goalPath(sessionId, suffix = "") {
+  return `/sessions/${encodeURIComponent(sessionId)}/goal${suffix}`;
+}
+function withGoalWriteOptions(command) {
+  return command.option("--criterion <text>", "a requirement the grader checks (repeatable)", collect).option("--check <command>", 'a shell command that must exit 0, optionally "<text> :: <command>" (repeatable)', collect).option("--max-iterations <n>", "self-started turns before the goal stops (default 20)").option("--max-spend-cents <n>", 'spend ceiling in whole US cents, or "none"').option("--max-tokens <n>", 'token ceiling (uncached input + output), or "none"').option("--max-minutes <n>", `wall-clock ceiling from the goal's start, or "none"`).option("--idempotency-key <key>", "make a retried request safe to repeat");
+}
+var goal = program.command("goal").description("give a session a standing objective it keeps working toward until the criteria are met");
+goal.command("get <session>").description("show the session's goal, its limits, and what the last check found").option("--json", "print the raw goal object").action(
+  run(async (ref, opts) => {
+    const { goal: current } = await api("GET", goalPath(await resolveSessionRef(ref)));
+    console.log(opts.json ? JSON.stringify(current, null, 2) : renderGoal(current));
+  })
+);
+withGoalWriteOptions(
+  goal.command("set <session> <objective...>").description("set the goal, replacing any existing one; work starts right away")
+).action(
+  run(async (ref, words, opts) => {
+    const { goal: created } = await api(
+      "POST",
+      goalPath(await resolveSessionRef(ref)),
+      setGoalBody(words.join(" "), opts),
+      { idempotencyKey: opts.idempotencyKey }
+    );
+    console.log(renderGoal(created));
+  })
+);
+withGoalWriteOptions(
+  goal.command("edit <session>").description("change the goal in place; iterations and spend so far carry over").option("--objective <text>", "the new objective")
+).action(
+  run(async (ref, opts) => {
+    const { goal: edited } = await api(
+      "PATCH",
+      goalPath(await resolveSessionRef(ref)),
+      editGoalBody(opts),
+      { idempotencyKey: opts.idempotencyKey }
+    );
+    console.log(renderGoal(edited));
+  })
+);
+for (const [verb, method, suffix, blurb] of [
+  ["pause", "POST", "/pause", "stop taking turns and interrupt the run the goal started"],
+  ["resume", "POST", "/resume", "start taking turns again; a deadline moves out by the paused time"],
+  ["clear", "DELETE", "", "stop the goal for good and interrupt the run it started"]
+]) {
+  goal.command(`${verb} <session>`).description(blurb).option("--idempotency-key <key>", "make a retried request safe to repeat").action(
+    run(async (ref, opts) => {
+      const { goal: changed } = await api(
+        method,
+        goalPath(await resolveSessionRef(ref), suffix),
+        void 0,
+        { idempotencyKey: opts.idempotencyKey }
+      );
+      console.log(`${changed.id}: ${changed.status}${changed.stop_reason ? ` (${changed.stop_reason})` : ""}`);
+    })
+  );
+}
 program.command("config").description("show the CLI config location and current values").action(() => {
   const config = loadConfig();
   console.log(`config: ${configPath()}`);