@agentsky/sky 2.10.0 → 2.12.0

package/dist/index.js

@@ -1,4 +1,26 @@
 #!/usr/bin/env node
+import {
+  ApiError,
+  api,
+  apiBytes,
+  apiForm,
+  downloadFile,
+  postEvents,
+  resolveSessionRef,
+  streamEvents,
+  uploadFile
+} from "./chunk-7LUCHBX6.js";
+import {
+  CLI_VERSION,
+  USER_AGENT,
+  apiBase,
+  apiToken,
+  configPath,
+  consoleBase,
+  currentUniverse,
+  loadConfig,
+  saveConfig
+} from "./chunk-RF5JICNX.js";
 import {
   AGENT_TYPES,
   MODEL_SUBSCRIPTION_PLAN_PHRASE,
@@ -8,6 +30,7 @@ import {
   customDataSchema,
   defaultLlm,
   external_exports,
+  harnessProfileSchema,
   isModelEffortSupported,
   mcpServersFromKept,
   modelSubscriptionProviderFor,
@@ -16,200 +39,17 @@ import {
   skillRefSchema,
   splitMcpServers,
   supersededBy
-} from "./chunk-5QRKU3BR.js";
+} from "./chunk-XXDQKVPS.js";
+import "./chunk-MLKGABMK.js";
 
 // src/index.ts
-import { existsSync as existsSync7, readFileSync as readFileSync10, writeFileSync as writeFileSync6 } from "fs";
-import { basename as basename3, resolve as resolve4 } from "path";
+import { existsSync as existsSync8, readFileSync as readFileSync11, writeFileSync as writeFileSync6 } from "fs";
+import { basename as basename4, resolve as resolve6 } from "path";
 import { createInterface as createInterface4 } from "readline";
 import { Command } from "commander";
 
-// src/config.ts
-import { mkdirSync, readFileSync, writeFileSync } from "fs";
-import { homedir } from "os";
-import { dirname, join } from "path";
-var DEFAULT_API_BASE = "https://api.agentsky.dev/v1";
-var DEFAULT_CONSOLE_BASE = "https://platform.agentsky.dev";
-function configPath() {
-  return join(process.env.SKY_CONFIG_DIR ?? join(homedir(), ".config", "sky"), "config.json");
-}
-function loadConfig() {
-  try {
-    return JSON.parse(readFileSync(configPath(), "utf8"));
-  } catch {
-    return {};
-  }
-}
-function saveConfig(config) {
-  const path = configPath();
-  mkdirSync(dirname(path), { recursive: true });
-  writeFileSync(path, `${JSON.stringify(config, null, 2)}
-`, { mode: 384 });
-}
-function apiBase() {
-  return (process.env.SKY_API_URL ?? loadConfig().apiBase ?? DEFAULT_API_BASE).replace(/\/$/, "");
-}
-function consoleBase() {
-  const configured = process.env.SKY_CONSOLE_URL ?? loadConfig().consoleBase;
-  if (configured) return configured.replace(/\/$/, "");
-  const api2 = apiBase();
-  if (api2 === DEFAULT_API_BASE) return DEFAULT_CONSOLE_BASE;
-  return api2.replace(/\/(?:api\/)?v1$/, "") || api2;
-}
-function apiToken() {
-  return process.env.SKY_API_TOKEN ?? loadConfig().token;
-}
-function currentUniverse() {
-  return process.env.SKY_WORKSPACE ?? process.env.SKY_UNIVERSE ?? loadConfig().currentUniverse;
-}
-
-// src/version.ts
-var CLI_VERSION = "2.10.0";
-var USER_AGENT = `sky-cli/${CLI_VERSION} (${process.platform}; node/${process.versions.node})`;
-
-// src/api.ts
-var ApiError = class extends Error {
-  constructor(status, code, message2) {
-    super(message2);
-    this.status = status;
-    this.code = code;
-  }
-  status;
-  code;
-};
-function authHeaders() {
-  const token = apiToken();
-  if (!token) {
-    throw new ApiError(401, "not_logged_in", "not logged in \u2014 run `sky auth login`");
-  }
-  const headers = { authorization: `Bearer ${token}` };
-  const universe2 = currentUniverse();
-  if (universe2) headers["x-universe"] = universe2;
-  return headers;
-}
-async function parseError(res) {
-  let code = "http_error";
-  let message2 = `${res.status} ${res.statusText}`;
-  try {
-    const body = await res.json();
-    if (body.error?.message) {
-      code = body.error.code ?? code;
-      message2 = body.error.message;
-    }
-  } catch {
-  }
-  throw new ApiError(res.status, code, message2);
-}
-async function api(method, path, body, opts = {}) {
-  const res = await fetch(`${apiBase()}${path}`, {
-    method,
-    headers: {
-      "user-agent": USER_AGENT,
-      ...opts.auth === false ? {} : authHeaders(),
-      ...body !== void 0 ? { "content-type": "application/json" } : {},
-      ...opts.idempotencyKey ? { "idempotency-key": opts.idempotencyKey } : {}
-    },
-    body: body !== void 0 ? JSON.stringify(body) : void 0
-  });
-  if (!res.ok) await parseError(res);
-  if (res.status === 204) return void 0;
-  return await res.json();
-}
-async function postEvents(sessionId, events, idempotencyKey) {
-  const res = await fetch(`${apiBase()}/sessions/${encodeURIComponent(sessionId)}/events`, {
-    method: "POST",
-    headers: {
-      "user-agent": USER_AGENT,
-      ...authHeaders(),
-      "content-type": "application/json",
-      ...idempotencyKey ? { "idempotency-key": idempotencyKey } : {}
-    },
-    body: JSON.stringify({ events })
-  });
-  if (!res.ok) await parseError(res);
-  return await res.json();
-}
-async function uploadFile(bytes, filename, mediaType, expiresInSeconds) {
-  const form = new FormData();
-  form.append("file", new Blob([new Uint8Array(bytes)], { type: mediaType }), filename);
-  if (expiresInSeconds) form.append("expires_in_seconds", String(expiresInSeconds));
-  const res = await fetch(`${apiBase()}/files`, {
-    method: "POST",
-    headers: { "user-agent": USER_AGENT, ...authHeaders() },
-    body: form
-  });
-  if (!res.ok) await parseError(res);
-  return await res.json();
-}
-async function downloadFile(fileId) {
-  const res = await fetch(`${apiBase()}/files/${encodeURIComponent(fileId)}/content`, {
-    headers: { "user-agent": USER_AGENT, ...authHeaders() }
-  });
-  if (!res.ok) await parseError(res);
-  return { bytes: new Uint8Array(await res.arrayBuffer()), mediaType: res.headers.get("content-type") ?? "application/octet-stream" };
-}
-async function apiBytes(method, path, body) {
-  const res = await fetch(`${apiBase()}${path}`, {
-    method,
-    headers: {
-      "user-agent": USER_AGENT,
-      ...authHeaders(),
-      ...body ? { "content-type": body.mediaType } : {}
-    },
-    body: body ? new Uint8Array(body.bytes) : void 0
-  });
-  if (!res.ok) await parseError(res);
-  const bytes = new Uint8Array(await res.arrayBuffer());
-  return {
-    bytes,
-    mediaType: res.headers.get("content-type") ?? "application/octet-stream",
-    json: () => JSON.parse(new TextDecoder().decode(bytes))
-  };
-}
-async function resolveSessionRef(ref) {
-  if (ref.startsWith("sess-")) return ref;
-  const { agent: agent2 } = await api(
-    "GET",
-    `/agents/${encodeURIComponent(ref)}`
-  ).catch(async () => {
-    await api("GET", `/sessions/${encodeURIComponent(ref)}`);
-    return { agent: { id: ref, defaultSessionId: ref } };
-  });
-  if (!agent2.defaultSessionId) {
-    throw new ApiError(
-      404,
-      "no_sessions",
-      `agent ${agent2.id} has no sessions \u2014 create one: sky session create ${agent2.id}`
-    );
-  }
-  return agent2.defaultSessionId;
-}
-async function* streamEvents(sessionId, signal) {
-  const { parseSseStream } = await import("./src-RYECJN5I.js");
-  const res = await fetch(
-    `${apiBase()}/sessions/${encodeURIComponent(sessionId)}/stream`,
-    {
-      headers: { "user-agent": USER_AGENT, ...authHeaders(), accept: "text/event-stream" },
-      signal
-    }
-  );
-  if (!res.ok) await parseError(res);
-  if (!res.body) throw new ApiError(502, "no_body", "stream returned no body");
-  try {
-    for await (const frame of parseSseStream(res.body)) {
-      if (!frame.data) continue;
-      try {
-        yield { id: frame.id, event: frame.event, data: JSON.parse(frame.data) };
-      } catch {
-      }
-    }
-  } catch (error) {
-    if (!(error instanceof DOMException && error.name === "AbortError")) throw error;
-  }
-}
-
 // src/files.ts
-import { readFileSync as readFileSync2 } from "fs";
+import { readFileSync } from "fs";
 import { basename, extname } from "path";
 var MEDIA_TYPES = {
   ".png": "image/png",
@@ -231,7 +71,7 @@ function mediaTypeFor(path) {
   return MEDIA_TYPES[extname(path).toLowerCase()] ?? "application/octet-stream";
 }
 async function uploadLocalFile(path, expiresInSeconds) {
-  const bytes = readFileSync2(path);
+  const bytes = readFileSync(path);
   return uploadFile(new Uint8Array(bytes), basename(path), mediaTypeFor(path), expiresInSeconds);
 }
 function fileBlock(file) {
@@ -328,8 +168,8 @@ function renderGoal(goal2) {
 }
 
 // src/agent-file.ts
-import { existsSync, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
-import { dirname as dirname2, resolve } from "path";
+import { existsSync, readFileSync as readFileSync2, writeFileSync } from "fs";
+import { dirname, resolve } from "path";
 import { parse as parseToml, stringify as stringifyToml } from "smol-toml";
 var fileInstructionSchema = external_exports.object({
   name: external_exports.string(),
@@ -352,12 +192,16 @@ var agentFileSchema = external_exports.object({
   instructions: external_exports.array(fileInstructionSchema).optional(),
   skills: external_exports.array(skillRefSchema).optional(),
   customData: external_exports.array(customDataSchema).optional(),
+  /** "deny" makes the agent work alone: its sessions may not hire helpers. */
+  hiring_policy: external_exports.enum(["allow", "deny"]).optional(),
+  /** The environment its sessions boot in when they name none. */
+  environment: external_exports.string().min(1).optional(),
   /** Advanced machine shape (create-only): 1|2|4|8 vCPUs, 256MB-step memory. */
   vcpus: external_exports.number().int().optional(),
   memory_mb: external_exports.number().int().optional()
 });
 function readAgentFile(path) {
-  const raw = readFileSync3(path, "utf8");
+  const raw = readFileSync2(path, "utf8");
   const parsed = agentFileSchema.safeParse(parseToml(raw));
   if (!parsed.success) {
     const issue = parsed.error.issues[0];
@@ -369,11 +213,11 @@ function readAgentFile(path) {
       `${path}: reasoning_effort '${file.reasoning_effort}' is not available for ${file.type} \u2014 ${reasoningEffortDocLine()}`
     );
   }
-  const base = dirname2(resolve(path));
+  const base = dirname(resolve(path));
   const inline = (ref, inlineContent) => {
     if (inlineContent !== void 0) return inlineContent;
     if (!ref) return void 0;
-    return readFileSync3(resolve(base, ref), "utf8");
+    return readFileSync2(resolve(base, ref), "utf8");
   };
   const spec = {
     name: file.name,
@@ -391,20 +235,22 @@ function readAgentFile(path) {
     }),
     skills: file.skills,
     customData: file.customData,
+    hiringPolicy: file.hiring_policy,
+    environmentId: file.environment,
     vcpus: file.vcpus,
     memoryMb: file.memory_mb
   };
   return { file, spec };
 }
 function stampId(path, id) {
-  const doc = parseToml(readFileSync3(path, "utf8"));
+  const doc = parseToml(readFileSync2(path, "utf8"));
   doc.id = id;
   delete doc.slug;
-  writeFileSync2(path, stringifyToml(doc));
+  writeFileSync(path, stringifyToml(doc));
 }
 function scaffoldAgentFile(path, name) {
   if (existsSync(path)) throw new Error(`${path} already exists`);
-  writeFileSync2(
+  writeFileSync(
     path,
     `# agent.toml \u2014 everything the create wizard can set. Only \`name\` is required.
 name = "${name}"
@@ -412,6 +258,11 @@ name = "${name}"
 # llm = "deepseek-flash"       # must be compatible with type
 # reasoning_effort = "high"    # per harness \u2014 ${reasoningEffortDocLine()}
 # capabilities = []
+# hiring_policy = "deny"       # its sessions work alone; "allow" (default) lets them hire helpers
+# environment = "env_..."      # the environment its sessions boot in when they name none
+# [[skills]]                   # a skill from \`sky skills upload <dir>\`
+# type = "skill"
+# skillId = "skill_..."
 
 prompt = """
 You are ${name}, a helpful long-lived agent.
@@ -485,18 +336,18 @@ function renderCatalogAgent(agent2) {
 
 // src/clone.ts
 import { spawn } from "child_process";
-import { existsSync as existsSync2, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "fs";
-import { homedir as homedir2 } from "os";
-import { basename as basename2, join as join2 } from "path";
+import { existsSync as existsSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
+import { homedir } from "os";
+import { basename as basename2, join } from "path";
 import { createInterface } from "readline";
 var PROMPT_CAP = 1e5;
 var HARNESSES = ["claude_code", "codex", "openclaw"];
 function claudeConfigRoot() {
-  return process.env.CLAUDE_CONFIG_DIR ?? join2(homedir2(), ".claude");
+  return process.env.CLAUDE_CONFIG_DIR ?? join(homedir(), ".claude");
 }
 function readIfExists(path) {
   try {
-    return readFileSync4(path, "utf8");
+    return readFileSync3(path, "utf8");
   } catch {
     return void 0;
   }
@@ -512,9 +363,9 @@ function readJson(path) {
 }
 function claudeModel(configRoot) {
   const candidates = [
-    join2(process.cwd(), ".claude", "settings.local.json"),
-    join2(process.cwd(), ".claude", "settings.json"),
-    join2(configRoot, "settings.json")
+    join(process.cwd(), ".claude", "settings.local.json"),
+    join(process.cwd(), ".claude", "settings.json"),
+    join(configRoot, "settings.json")
   ];
   for (const path of candidates) {
     const model = readJson(path)?.model;
@@ -524,11 +375,11 @@ function claudeModel(configRoot) {
 }
 function claudeMcpServers() {
   const merged = {};
-  const userConfig = readJson(join2(homedir2(), ".claude.json"));
+  const userConfig = readJson(join(homedir(), ".claude.json"));
   Object.assign(merged, userConfig?.mcpServers ?? {});
   Object.assign(merged, userConfig?.projects?.[process.cwd()]?.mcpServers ?? {});
   const projectConfig = readJson(
-    join2(process.cwd(), ".mcp.json")
+    join(process.cwd(), ".mcp.json")
   );
   Object.assign(merged, projectConfig?.mcpServers ?? {});
   return merged;
@@ -545,13 +396,13 @@ function readClaudeCode() {
   const configRoot = claudeConfigRoot();
   const parts = [];
   const sources = [];
-  const global = readIfExists(join2(configRoot, "CLAUDE.md"));
+  const global = readIfExists(join(configRoot, "CLAUDE.md"));
   if (global?.trim()) {
     parts.push({ label: "Global CLAUDE.md", content: global });
     sources.push("global CLAUDE.md");
   }
   for (const name of ["CLAUDE.md", "AGENTS.md"]) {
-    const project = readIfExists(join2(process.cwd(), name));
+    const project = readIfExists(join(process.cwd(), name));
     if (project?.trim()) {
       parts.push({ label: `Project ${name}`, content: project });
       sources.push(`project ${name}`);
@@ -592,27 +443,27 @@ function detectHarness(explicit) {
     return explicit;
   }
   if (existsSync2(claudeConfigRoot())) return "claude_code";
-  if (existsSync2(join2(homedir2(), ".codex"))) return "codex";
-  if (existsSync2(join2(homedir2(), ".openclaw"))) return "openclaw";
+  if (existsSync2(join(homedir(), ".codex"))) return "codex";
+  if (existsSync2(join(homedir(), ".openclaw"))) return "openclaw";
   throw new Error(
     "no local harness found (~/.claude, ~/.codex, ~/.openclaw) \u2014 pass --harness to override"
   );
 }
-function readLocal(harness) {
-  if (harness === "claude_code") return readClaudeCode();
+function readLocal(harness2) {
+  if (harness2 === "claude_code") return readClaudeCode();
   throw new Error(
-    `${harness} cloning lands next \u2014 claude_code is the first supported harness`
+    `${harness2} cloning lands next \u2014 claude_code is the first supported harness`
   );
 }
 function linkPath(configRoot) {
-  return join2(configRoot, "agentsky-link.json");
+  return join(configRoot, "agentsky-link.json");
 }
 function readLink(configRoot) {
   const link = readJson(linkPath(configRoot));
   return link?.agentId ? link : void 0;
 }
 function writeLink(configRoot, link) {
-  writeFileSync3(linkPath(configRoot), `${JSON.stringify(link, null, 2)}
+  writeFileSync2(linkPath(configRoot), `${JSON.stringify(link, null, 2)}
 `);
 }
 var DEFAULT_VAULT_NAME = "default";
@@ -843,17 +694,17 @@ async function syncClone(local, link, opts) {
   if (opts.open) openBrowser(`${apiBase()}/agents/${link.agentId}`);
 }
 async function clone(opts) {
-  const harness = detectHarness(opts.harness);
-  const local = readLocal(harness);
+  const harness2 = detectHarness(opts.harness);
+  const local = readLocal(harness2);
   const link = opts.new ? void 0 : readLink(local.configRoot);
   if (link) await syncClone(local, link, opts);
   else await createClone(local, opts);
 }
 
 // src/import-local.ts
-import { closeSync, existsSync as existsSync3, openSync, readdirSync, readFileSync as readFileSync5, readSync, statSync } from "fs";
-import { homedir as homedir3 } from "os";
-import { join as join3 } from "path";
+import { closeSync, existsSync as existsSync3, openSync, readdirSync, readFileSync as readFileSync4, readSync, statSync } from "fs";
+import { homedir as homedir2 } from "os";
+import { join as join2 } from "path";
 import { createHash } from "crypto";
 function redactLine2(raw) {
   return redactLine(raw).line;
@@ -926,13 +777,13 @@ function sniffTitle(filePath) {
   }
 }
 function listClaudeCodeSessions(limit) {
-  const root = process.env.CLAUDE_CONFIG_DIR ?? join3(homedir3(), ".claude");
-  const projectsDir = join3(root, "projects");
+  const root = process.env.CLAUDE_CONFIG_DIR ?? join2(homedir2(), ".claude");
+  const projectsDir = join2(root, "projects");
   if (!existsSync3(projectsDir)) return [];
   const sessions = [];
   try {
     for (const encoded of readdirSync(projectsDir)) {
-      const projectDir = join3(projectsDir, encoded);
+      const projectDir = join2(projectsDir, encoded);
       let entries;
       try {
         entries = readdirSync(projectDir);
@@ -943,7 +794,7 @@ function listClaudeCodeSessions(limit) {
       for (const entry2 of entries) {
         if (!entry2.endsWith(".jsonl")) continue;
         const sessionId = entry2.slice(0, -6);
-        const mainFile = join3(projectDir, entry2);
+        const mainFile = join2(projectDir, entry2);
         let stat;
         try {
           stat = statSync(mainFile);
@@ -953,12 +804,12 @@ function listClaudeCodeSessions(limit) {
         if (!stat.isFile()) continue;
         let discoveryError;
         const subagentFiles = [];
-        const subagentDir = join3(projectDir, sessionId, "subagents");
+        const subagentDir = join2(projectDir, sessionId, "subagents");
         if (existsSync3(subagentDir)) {
           try {
             const subFiles = readdirSync(subagentDir).filter((f) => f.endsWith(".jsonl")).sort();
             for (const f of subFiles) {
-              subagentFiles.push(join3(subagentDir, f));
+              subagentFiles.push(join2(subagentDir, f));
             }
           } catch {
             discoveryError = "Cannot read all recorded subagent conversations. Fix local file access before importing this session.";
@@ -980,7 +831,7 @@ function listClaudeCodeSessions(limit) {
   return sessions.sort((a, b) => b.mtimeMs - a.mtimeMs).slice(0, limit);
 }
 function listCodexSessions(limit) {
-  const sessionsDir = join3(process.env.CODEX_HOME ?? process.env.CODEX_CONFIG_DIR ?? join3(homedir3(), ".codex"), "sessions");
+  const sessionsDir = join2(process.env.CODEX_HOME ?? process.env.CODEX_CONFIG_DIR ?? join2(homedir2(), ".codex"), "sessions");
   const records = [];
   function walk(dir) {
     let entries;
@@ -990,7 +841,7 @@ function listCodexSessions(limit) {
       return;
     }
     for (const entry2 of entries) {
-      const full = join3(dir, entry2.name);
+      const full = join2(dir, entry2.name);
       if (entry2.isDirectory()) {
         walk(full);
         continue;
@@ -1032,9 +883,9 @@ function listCodexSessions(limit) {
     files: [.../* @__PURE__ */ new Set([...session2.files, ...descendants(session2.sessionId, /* @__PURE__ */ new Set())])]
   })).sort((a, b) => b.mtimeMs - a.mtimeMs).slice(0, limit);
 }
-function listRecentSessions(harness, limit) {
-  const claudeSessions = harness === "codex" ? [] : listClaudeCodeSessions(limit);
-  const codexSessions = harness === "claude_code" ? [] : listCodexSessions(limit);
+function listRecentSessions(harness2, limit) {
+  const claudeSessions = harness2 === "codex" ? [] : listClaudeCodeSessions(limit);
+  const codexSessions = harness2 === "claude_code" ? [] : listCodexSessions(limit);
   return [...claudeSessions, ...codexSessions].sort((a, b) => b.mtimeMs - a.mtimeMs).slice(0, limit);
 }
 function agentUseBase() {
@@ -1052,7 +903,7 @@ function currentSessionEnv() {
   if (codexId) return { harness: "codex", sessionId: codexId };
   return void 0;
 }
-async function mintTrace(base, harness) {
+async function mintTrace(base, harness2) {
   const token = apiToken();
   if (!token) throw new ApiError(401, "not_logged_in", "not logged in \u2014 run `sky auth login`");
   const res = await fetch(`${base}/api/traces`, {
@@ -1064,7 +915,7 @@ async function mintTrace(base, harness) {
       authorization: `Bearer ${token}`,
       "user-agent": USER_AGENT
     },
-    body: JSON.stringify({ harness })
+    body: JSON.stringify({ harness: harness2 })
   });
   if (!res.ok) {
     const body = await res.json().catch(() => null);
@@ -1077,7 +928,7 @@ async function mintTrace(base, harness) {
 function loadSummaryFile(summaryPath) {
   let raw;
   try {
-    raw = readFileSync5(summaryPath, "utf8");
+    raw = readFileSync4(summaryPath, "utf8");
   } catch {
     throw new Error(`Cannot read summary file: ${summaryPath}`);
   }
@@ -1109,7 +960,7 @@ function prepareImport(session2, summaryPath) {
   for (const path of session2.files) {
     const stat = statSync(path);
     if (!stat.isFile() || (inputBytes += stat.size) > maximum) throw new Error("Selected transcript exceeds the 16 MiB limit or is not a regular file.");
-    const text = readFileSync5(path, "utf8");
+    const text = readFileSync4(path, "utf8");
     for (const raw of text.split("\n")) {
       if (!raw.trim()) continue;
       let record;
@@ -1254,7 +1105,7 @@ async function login(opts) {
 }
 async function browserLogin(verifier, challenge) {
   const state = b64url(randomBytes(16));
-  const code = await new Promise((resolve5, reject) => {
+  const code = await new Promise((resolve7, reject) => {
     const server = createServer((req, res) => {
       const url = new URL(req.url ?? "/", "http://127.0.0.1");
       if (url.pathname !== "/callback") {
@@ -1267,7 +1118,7 @@ async function browserLogin(verifier, challenge) {
       if (url.searchParams.get("state") !== state || !got) {
         reject(new Error("login callback state mismatch"));
       } else {
-        resolve5(got);
+        resolve7(got);
       }
       server.close();
     });
@@ -1322,22 +1173,22 @@ async function headlessLogin(verifier, challenge) {
 
 // src/local-agents.ts
 import { existsSync as existsSync4 } from "fs";
-import { homedir as homedir4 } from "os";
-import { join as join4 } from "path";
-function localAgents(env = process.env, home = homedir4()) {
-  const claude = env.CLAUDE_CONFIG_DIR || join4(home, ".claude");
-  const codex = env.CODEX_HOME || join4(home, ".codex");
-  const cursor = join4(home, ".cursor");
+import { homedir as homedir3 } from "os";
+import { join as join3 } from "path";
+function localAgents(env = process.env, home = homedir3()) {
+  const claude = env.CLAUDE_CONFIG_DIR || join3(home, ".claude");
+  const codex = env.CODEX_HOME || join3(home, ".codex");
+  const cursor = join3(home, ".cursor");
   return [
-    { id: "claude_code", name: "Claude Code", root: claude, skillsDir: join4(claude, "skills") },
-    { id: "codex", name: "Codex", root: codex, skillsDir: join4(codex, "skills") },
-    { id: "cursor", name: "Cursor", root: cursor, skillsDir: join4(cursor, "skills") }
+    { id: "claude_code", name: "Claude Code", root: claude, skillsDir: join3(claude, "skills") },
+    { id: "codex", name: "Codex", root: codex, skillsDir: join3(codex, "skills") },
+    { id: "cursor", name: "Cursor", root: cursor, skillsDir: join3(cursor, "skills") }
   ];
 }
-function detectLocalAgents(env = process.env, home = homedir4()) {
+function detectLocalAgents(env = process.env, home = homedir3()) {
   return localAgents(env, home).filter((agent2) => existsSync4(agent2.root));
 }
-function selectLocalAgents(ids, env = process.env, home = homedir4()) {
+function selectLocalAgents(ids, env = process.env, home = homedir3()) {
   if (!ids?.length) return detectLocalAgents(env, home);
   const known = localAgents(env, home);
   return ids.map((id) => {
@@ -1431,21 +1282,21 @@ async function readTurn(sessionId, opts = {}) {
   for (; ; ) {
     const reading = latestTurn(await history(sessionId));
     if (reading.finished || !opts.wait || Date.now() >= deadline) return reading;
-    await new Promise((resolve5) => setTimeout(resolve5, opts.intervalMs ?? 3e3));
+    await new Promise((resolve7) => setTimeout(resolve7, opts.intervalMs ?? 3e3));
   }
 }
 
 // src/setup.ts
-import { mkdirSync as mkdirSync3, readFileSync as readFileSync9, writeFileSync as writeFileSync5 } from "fs";
-import { dirname as dirname4, join as join8 } from "path";
+import { mkdirSync as mkdirSync2, readFileSync as readFileSync8, writeFileSync as writeFileSync4 } from "fs";
+import { dirname as dirname3, join as join7 } from "path";
 import { createInterface as createInterface3 } from "readline";
 
 // src/mcp-register.ts
 import { spawnSync } from "child_process";
 
 // src/skill.ts
-import { mkdirSync as mkdirSync2, readFileSync as readFileSync6, writeFileSync as writeFileSync4 } from "fs";
-import { join as join5 } from "path";
+import { mkdirSync, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "fs";
+import { join as join4 } from "path";
 
 // src/catalog-file.ts
 var CATALOG_FILE = "catalog.md";
@@ -1502,7 +1353,7 @@ var SKILL_MARKER = ".agentsky.json";
 function skillDocument() {
   return `---
 name: ${SKILL_NAME}
-description: "Hire cloud agents from the AgentSky catalog (included as ${CATALOG_FILE}) and coordinate them on one task. Use when: the person names an agent by @handle or wants to orchestrate agents; asks another engine (Codex, Claude Code, Gemini, Hermes) to do, test or review part of the work; wants to import, move or continue this conversation in AgentSky or the cloud; names a workspace; or the work splits into independent parts that can run at the same time. Works through the agentsky MCP server, or the sky command where those tools are missing."
+description: "Hire cloud agents from the AgentSky catalog (included as ${CATALOG_FILE}) and coordinate them on one task. Use when: the person names an agent by @handle or wants to orchestrate agents; asks another engine (Codex, Claude Code, Gemini, Hermes) to do, test or review part of the work; wants to import, move or continue this conversation in AgentSky or the cloud; wants an agent their own application starts for its customers from a skill they supply; names a workspace; or the work splits into independent parts that can run at the same time. Works through the agentsky MCP server, or the sky command where those tools are missing."
 ---
 
 # Working with other agents through AgentSky
@@ -1521,7 +1372,7 @@ at the end; they do the same things, one agent at a time.
 
 Use the workspace the person named. If they named none, check the git root for
 \`.agentsky.json\` \u2014 if it has a \`"workspace"\` key, use that. Otherwise use the
-account default (personal). Never ask. Pass the chosen slug as \`workspace\` on
+account default workspace. Never ask. Pass the chosen slug as \`workspace\` on
 every MCP tool that accepts it, or as \`--workspace <slug>\` on sky commands.
 Details: \`${REFERENCES_DIR}/workspaces.md\` in this skill's folder.
 
@@ -1602,6 +1453,15 @@ it, and name its path in the brief.
 6. Tell the person what was done, which agent did which part, and what it cost
    (\`get_task\` reports the task's cost).
 
+## Build an agent that the person's own application runs
+
+When the person wants an agent their product starts for its customers, built
+from a skill they supply (for example: a customer uploads a file, an agent
+reviews it, their application acts on the verdict), follow
+\`${REFERENCES_DIR}/focused-agents.md\` in this skill's folder. It covers the
+prerequisites to tell them about first, one locked-down workspace per customer,
+one fresh session per event, and reading the answer as data.
+
 ## Import this conversation to AgentSky
 
 When the person asks to import, move, or continue this conversation in AgentSky
@@ -1688,6 +1548,160 @@ use \`--session <id>\` instead of \`--current\`, and set \`source_harness\` to t
 harness name (e.g. \`"hermes"\`, \`"openclaw"\`).
 `;
 }
+function focusedAgentsReferenceDoc() {
+  return `# A focused agent your application runs for its customers
+
+Use this when the person wants an agent that their own product starts on an
+event (a customer uploads a file, a form is submitted), working from one
+skill they supply, with the result going back to their application.
+
+Everything here is the public API (\`https://api.agentsky.dev/v1\`). The
+application's server calls it. The \`sky\` commands and MCP tools named
+alongside do the same things by hand, for trying it out.
+
+## What has to exist first
+
+Say each of these to the person before you build. Each one changes whether it
+works:
+
+- **An API key for their server.** They create it at
+  platform.agentsky.dev \u2192 Developer \u2192 API keys and put it in the server's
+  environment (\`AGENTSKY_TOKEN\`). Never put it in code, a page their customers
+  load, or a brief.
+- **Credit** on their account. Every run is a session they pay for. Give each
+  one a budget.
+- **The skill**: a directory with \`SKILL.md\` at its root.
+- **An engine that fits.** Default to \`claude_code\` on its default model. Check
+  \`sky catalog search <words>\` if the skill needs something else.
+- **Their own customer sign-in.** AgentSky does not know their customers. A
+  customer id their page sends is a label, not proof of who it is.
+
+## 1. One workspace per customer
+
+\`\`\`
+POST /v1/universes  {"slug": "rv-acme", "name": "Uploads from acme"}
+\`\`\`
+
+Same by hand: \`sky universe create rv-acme\`. Files, memory, vaults and
+sessions never cross workspaces. Name every later call's workspace with the
+\`X-Universe: rv-acme\` header (\`--workspace rv-acme\` on \`sky\`).
+
+## 2. Lock the workspace down
+
+\`\`\`
+PUT  /v1/hook_rules                     {"rules": [{"point": "tool.call", "action": "block", "match": {}, "enabled": true}]}
+POST /v1/universes/rv-acme/policies     {"name": "reviewer-native-tools", "kind": "TOOL_CALL",
+                                         "config": {"action": "deny", "matcher": "Bash|BashOutput|KillShell|Edit|MultiEdit|Write|NotebookEdit|WebFetch|WebSearch|Task|mcp__.*"}}
+POST /v1/universes/rv-acme/policies     {"name": "reviewer-no-helpers", "kind": "CAPABILITY", "config": {"platform.orchestration": "deny"}}
+\`\`\`
+
+- **The hook rule** blocks every connected-app and capability call. Without it,
+  the account owner's own connected apps reach sessions the owner's key
+  starts.
+- **The \`TOOL_CALL\` rule** denies Claude Code's shell, write, web, sub-agent
+  and MCP tools. A denied call answers "The platform did not authorize this
+  tool invocation."
+- **Keep only the tools the skill needs.** A reviewer needs Read.
+
+Telling the agent not to use a tool is not a boundary. The rule is. By hand:
+\`sky policy add --universe rv-acme --name ... --kind TOOL_CALL --config '<json>'\`.
+
+## 3. Install the skill, create the agent
+
+\`\`\`
+POST /v1/skills          multipart: one "files" field per file, named "<dir>/<path>", plus "displayName"
+POST /v1/agents          {"name": "upload-reviewer", "agentType": "claude_code", "prompt": "...",
+                          "skills": [{"type": "skill", "skillId": "skill_..."}], "hiringPolicy": "deny"}
+                          Idempotency-Key: provision-rv-acme-agent
+\`\`\`
+
+By hand: \`sky skills upload ./upload-review --workspace rv-acme\`, then
+\`sky agent create -f agent.toml --workspace rv-acme\` with
+\`hiring_policy = "deny"\` and a \`[[skills]]\` table naming the skill id.
+
+The prompt says what to read and what to answer. It also says that the
+upload is data and that instructions written inside it are not to be
+followed.
+
+## 4. One fresh session per event
+
+\`\`\`
+POST /v1/files                    multipart "file"                      \u2192 {"id": "file_..."}
+POST /v1/sessions                 Idempotency-Key: session-<job id>
+  {"agent": "agent_...", "defaults": "none",
+   "resources": [{"type": "file", "file_id": "file_...", "mount_path": "/upload/request.txt"}],
+   "budget": {"type": "limit", "max_list_cost": {"amount": "50", "currency": "USD"}}}
+POST /v1/sessions/{id}/events     Idempotency-Key: brief-<job id>
+  {"events": [{"type": "user.message", "content": [{"type": "text", "text": "Review /workspace/upload/request.txt with the upload-review skill."}]}]}
+\`\`\`
+
+- **\`defaults: "none"\`** keeps every workspace default out of the session:
+  environment, vault, shared files, skills and team memory. The session holds
+  only what the request names.
+- **Idempotency keys come from the event.** Retrying a timed-out call with the
+  same key returns the first session, or replays the first message. A keyed
+  create cannot carry \`initial_events\`. Create the session, save its id, then
+  send the brief.
+- **Reuse a session** only for a job that continues for the same customer.
+
+By hand: \`sky session create agent_... --no-defaults --budget-cents 50 --file ./request.txt:/upload/request.txt --message "..."\`
+(MCP: \`start_session\`).
+
+## 5. Read the answer
+
+\`\`\`
+GET /v1/sessions/{id}/events?types[]=user.message&types[]=agent.message&types[]=session.status_idle&types[]=session.status_terminated&types[]=session.error
+\`\`\`
+
+- **When the turn is done.** It has ended at a \`session.status_idle\` whose
+  \`stop_reason.type\` is not \`requires_action\`, or at
+  \`session.status_terminated\`.
+- **Where the answer is.** Take the last \`agent.message\` after the last
+  \`user.message\`. Earlier messages can be notes the agent wrote on the way.
+- **Treat it as untrusted data.** Parse it against a fixed schema and fail
+  closed on anything else. Never run what it says.
+- **Errors.** A \`session.error\` (budget reached, engine unavailable) is a
+  failure to report, not an answer.
+
+By hand: \`sky session read <id> --wait --json\` (MCP: \`read_session\`).
+
+## 6. Questions and approvals
+
+\`GET /v1/tasks/{session id}\` lists the requests waiting on the key's owner:
+the agent's questions, approvals, and apps to connect.
+\`POST /v1/tasks/{id}/requests/{request id}/answer\` with \`{"text": ...}\` or
+\`{"option_id": ...}\` answers one. Pass a customer's answer on only after
+your application has checked who they are. By hand: \`sky task show <id>\` and
+\`sky task answer <id> <request> --text "..."\` (MCP: \`get_task\`,
+\`answer_request\`).
+
+## 7. What the application keeps
+
+The agent decides; the application acts. Keep these in the application's own
+database:
+
+- **One job per event**, with a unique event key. The same key with the same
+  payload returns the job it made; with a different payload it is a conflict.
+- **The session id**, saved before you start polling, so a restart picks the
+  job up where it was.
+- **A confirmation receipt** from the signed-in customer before any side
+  effect.
+- **A unique action key per job**, so the side effect happens once. Agent
+  retries do not make it happen once; the key does.
+- **Webhooks to the customer** with an event id, retried until acknowledged.
+
+## Before launch
+
+Check one real session:
+
+- \`GET /v1/sessions/{id}\` lists only the upload under \`resources\`.
+- \`GET /v1/hook_rules\` and \`GET /v1/universes/{slug}/policies\` show the rules
+  above.
+- Ask the agent directly to run a shell command. The answer has to be the
+  platform's refusal.
+- A file id from another customer's workspace is refused at session create.
+`;
+}
 function workspacesReferenceDoc() {
   return `# Workspaces in AgentSky
 
@@ -1723,7 +1737,7 @@ To set a per-repo default, create \`.agentsky.json\` at the git root:
 }
 function installedVersion(dir) {
   try {
-    const marker = JSON.parse(readFileSync6(join5(dir, SKILL_MARKER), "utf8"));
+    const marker = JSON.parse(readFileSync5(join4(dir, SKILL_MARKER), "utf8"));
     return typeof marker.version === "string" ? marker.version : null;
   } catch {
     return null;
@@ -1733,24 +1747,25 @@ function isInstalledSkill(dir) {
   return installedVersion(dir) !== null;
 }
 function installSkill(agent2, opts = {}) {
-  const dir = join5(agent2.skillsDir, SKILL_NAME);
+  const dir = join4(agent2.skillsDir, SKILL_NAME);
   const previous = installedVersion(dir);
   const outcome = previous === CLI_VERSION ? "current" : previous ? "updated" : "installed";
   if (opts.dryRun) return { agent: agent2.id, path: dir, outcome };
   if (outcome !== "current") {
-    mkdirSync2(dir, { recursive: true });
-    writeFileSync4(join5(dir, "SKILL.md"), skillDocument());
-    writeFileSync4(join5(dir, SKILL_MARKER), `${JSON.stringify({ version: CLI_VERSION }, null, 2)}
+    mkdirSync(dir, { recursive: true });
+    writeFileSync3(join4(dir, "SKILL.md"), skillDocument());
+    writeFileSync3(join4(dir, SKILL_MARKER), `${JSON.stringify({ version: CLI_VERSION }, null, 2)}
 `);
   }
   if (opts.catalog) {
-    mkdirSync2(dir, { recursive: true });
-    writeFileSync4(join5(dir, CATALOG_FILE), renderCatalog(opts.catalog, opts.now ?? /* @__PURE__ */ new Date()));
+    mkdirSync(dir, { recursive: true });
+    writeFileSync3(join4(dir, CATALOG_FILE), renderCatalog(opts.catalog, opts.now ?? /* @__PURE__ */ new Date()));
   }
-  const refsDir = join5(dir, REFERENCES_DIR);
-  mkdirSync2(refsDir, { recursive: true });
-  writeFileSync4(join5(refsDir, "import.md"), importReferenceDoc());
-  writeFileSync4(join5(refsDir, "workspaces.md"), workspacesReferenceDoc());
+  const refsDir = join4(dir, REFERENCES_DIR);
+  mkdirSync(refsDir, { recursive: true });
+  writeFileSync3(join4(refsDir, "import.md"), importReferenceDoc());
+  writeFileSync3(join4(refsDir, "workspaces.md"), workspacesReferenceDoc());
+  writeFileSync3(join4(refsDir, "focused-agents.md"), focusedAgentsReferenceDoc());
   return { agent: agent2.id, path: dir, outcome };
 }
 
@@ -1801,9 +1816,9 @@ function registerMcpServer(agent2, opts, runner = systemCommandRunner()) {
 }
 
 // src/setup-local.ts
-import { existsSync as existsSync5, readdirSync as readdirSync2, readFileSync as readFileSync7, statSync as statSync2 } from "fs";
-import { homedir as homedir5 } from "os";
-import { dirname as dirname3, isAbsolute, join as join6, resolve as resolve3 } from "path";
+import { existsSync as existsSync5, readdirSync as readdirSync2, readFileSync as readFileSync6, statSync as statSync2 } from "fs";
+import { homedir as homedir4 } from "os";
+import { dirname as dirname2, isAbsolute, join as join5, resolve as resolve3 } from "path";
 import { parse as parseToml2 } from "smol-toml";
 var MAX_SKILL_FILE_BYTES = 1024 * 1024;
 var MAX_IMPORT_DEPTH = 5;
@@ -1819,22 +1834,22 @@ function sensitive(name) {
 function skillFiles(root, prefix) {
   const files2 = [];
   for (const entry2 of readdirSync2(root, { withFileTypes: true })) {
-    const path = join6(root, entry2.name);
+    const path = join5(root, entry2.name);
     if (entry2.isDirectory()) {
       if (!SKIPPED_DIRS.has(entry2.name)) files2.push(...skillFiles(path, `${prefix}/${entry2.name}`));
     } else if (entry2.isFile() && !sensitive(entry2.name) && statSync2(path).size <= MAX_SKILL_FILE_BYTES) {
-      files2.push({ path: `${prefix}/${entry2.name}`, bytes: new Uint8Array(readFileSync7(path)) });
+      files2.push({ path: `${prefix}/${entry2.name}`, bytes: new Uint8Array(readFileSync6(path)) });
     }
   }
   return files2;
 }
 function readLocalSkills(agents) {
-  const skills = [];
+  const skills2 = [];
   const ignored = [];
   for (const agent2 of agents) {
     if (!existsSync5(agent2.skillsDir)) continue;
     for (const entry2 of readdirSync2(agent2.skillsDir, { withFileTypes: true })) {
-      const dir = join6(agent2.skillsDir, entry2.name);
+      const dir = join5(agent2.skillsDir, entry2.name);
       let isDir = entry2.isDirectory();
       if (entry2.isSymbolicLink()) {
         try {
@@ -1843,22 +1858,22 @@ function readLocalSkills(agents) {
           isDir = false;
         }
       }
-      if (!isDir || !existsSync5(join6(dir, "SKILL.md")) || isInstalledSkill(dir)) continue;
-      const name = frontmatterName(readFileSync7(join6(dir, "SKILL.md"), "utf8"));
+      if (!isDir || !existsSync5(join5(dir, "SKILL.md")) || isInstalledSkill(dir)) continue;
+      const name = frontmatterName(readFileSync6(join5(dir, "SKILL.md"), "utf8"));
       if (!name) {
         ignored.push({ agent: agent2.id, dir, reason: "SKILL.md has no name" });
         continue;
       }
-      const taken = skills.find((skill) => skill.name === name);
+      const taken = skills2.find((skill) => skill.name === name);
       if (taken) {
         ignored.push({ agent: agent2.id, dir, reason: `${taken.agent} already has a skill named ${name}` });
         continue;
       }
       const files2 = skillFiles(dir, entry2.name);
-      skills.push({ name, agent: agent2.id, dir, files: files2, bytes: files2.reduce((sum, file) => sum + file.bytes.length, 0) });
+      skills2.push({ name, agent: agent2.id, dir, files: files2, bytes: files2.reduce((sum, file) => sum + file.bytes.length, 0) });
     }
   }
-  return { skills, ignored };
+  return { skills: skills2, ignored };
 }
 var INSTRUCTION_FILES = { claude_code: "CLAUDE.md", codex: "AGENTS.md" };
 function inlineImports(content, from, home, depth, seen) {
@@ -1872,11 +1887,11 @@ function inlineImports(content, from, home, depth, seen) {
     }
     const target = fence ? void 0 : line.match(/^@(\S+\.(?:md|markdown|txt))$/i)?.[1];
     if (!target || depth >= MAX_IMPORT_DEPTH) return line;
-    const path = target.startsWith("~/") ? join6(home, target.slice(2)) : isAbsolute(target) ? target : resolve3(dirname3(from), target);
+    const path = target.startsWith("~/") ? join5(home, target.slice(2)) : isAbsolute(target) ? target : resolve3(dirname2(from), target);
     if (seen.includes(path)) return "";
     let imported;
     try {
-      imported = readFileSync7(path, "utf8");
+      imported = readFileSync6(path, "utf8");
     } catch {
       return line;
     }
@@ -1884,15 +1899,15 @@ function inlineImports(content, from, home, depth, seen) {
     return inlineImports(imported, path, home, depth + 1, seen).trim();
   }).join("\n");
 }
-function readGlobalInstructions(agents, home = homedir5()) {
+function readGlobalInstructions(agents, home = homedir4()) {
   const found = [];
   for (const agent2 of agents) {
     const file = INSTRUCTION_FILES[agent2.id];
     if (!file) continue;
-    const path = join6(agent2.root, file);
+    const path = join5(agent2.root, file);
     let raw;
     try {
-      raw = readFileSync7(path, "utf8");
+      raw = readFileSync6(path, "utf8");
     } catch {
       continue;
     }
@@ -1911,7 +1926,7 @@ ${item.content.trim()}`).join("\n\n");
 }
 function readJson2(path) {
   try {
-    return JSON.parse(readFileSync7(path, "utf8"));
+    return JSON.parse(readFileSync6(path, "utf8"));
   } catch {
     return void 0;
   }
@@ -1925,15 +1940,15 @@ function bearerOf(def) {
   return match?.[1] ?? null;
 }
 function serversOf(agent2, home) {
-  if (agent2.id === "claude_code") return readJson2(join6(home, ".claude.json"))?.mcpServers ?? {};
-  if (agent2.id === "cursor") return readJson2(join6(agent2.root, "mcp.json"))?.mcpServers ?? {};
+  if (agent2.id === "claude_code") return readJson2(join5(home, ".claude.json"))?.mcpServers ?? {};
+  if (agent2.id === "cursor") return readJson2(join5(agent2.root, "mcp.json"))?.mcpServers ?? {};
   try {
-    return parseToml2(readFileSync7(join6(agent2.root, "config.toml"), "utf8")).mcp_servers ?? {};
+    return parseToml2(readFileSync6(join5(agent2.root, "config.toml"), "utf8")).mcp_servers ?? {};
   } catch {
     return {};
   }
 }
-function findLocalSecrets(agents, home = homedir5()) {
+function findLocalSecrets(agents, home = homedir4()) {
   const secrets2 = [];
   for (const agent2 of agents) {
     for (const [name, def] of Object.entries(serversOf(agent2, home))) {
@@ -1949,9 +1964,9 @@ function findLocalSecrets(agents, home = homedir5()) {
 
 // src/subscriptions.ts
 import { spawn as spawn3 } from "child_process";
-import { existsSync as existsSync6, readFileSync as readFileSync8 } from "fs";
-import { homedir as homedir6 } from "os";
-import { join as join7 } from "path";
+import { existsSync as existsSync6, readFileSync as readFileSync7 } from "fs";
+import { homedir as homedir5 } from "os";
+import { join as join6 } from "path";
 import { createInterface as createInterface2 } from "readline";
 var ALIASES = {
   claude: "anthropic",
@@ -2036,12 +2051,12 @@ async function connectClaude() {
   const expiry = sub.expiresAt ? ` (expires ~${sub.expiresAt.slice(0, 10)})` : "";
   console.log(`Connected Claude subscription${expiry}. Powers new eligible agents.`);
 }
-function codexSignIn(env = process.env, home = homedir6()) {
-  const path = join7(env.CODEX_HOME || join7(home, ".codex"), "auth.json");
+function codexSignIn(env = process.env, home = homedir5()) {
+  const path = join6(env.CODEX_HOME || join6(home, ".codex"), "auth.json");
   if (!existsSync6(path)) {
     throw new ApiError(404, "no_codex_auth", `no ${path} \u2014 run \`codex login\` first`);
   }
-  const raw = readFileSync8(path, "utf8");
+  const raw = readFileSync7(path, "utf8");
   try {
     const parsed = JSON.parse(raw);
     return { path, raw, account: parsed.tokens?.account_id };
@@ -2049,12 +2064,12 @@ function codexSignIn(env = process.env, home = homedir6()) {
     throw new ApiError(400, "invalid_codex_auth", `${path} isn't valid JSON \u2014 re-run \`codex login\``);
   }
 }
-function cursorSignIn(env = process.env, home = homedir6()) {
-  const path = join7(env.XDG_CONFIG_HOME || join7(home, ".config"), "cursor", "auth.json");
+function cursorSignIn(env = process.env, home = homedir5()) {
+  const path = join6(env.XDG_CONFIG_HOME || join6(home, ".config"), "cursor", "auth.json");
   if (!existsSync6(path)) {
     throw new ApiError(404, "no_cursor_auth", `no ${path} \u2014 run \`cursor-agent login\` first`);
   }
-  const raw = readFileSync8(path, "utf8");
+  const raw = readFileSync7(path, "utf8");
   try {
     const parsed = JSON.parse(raw);
     if (typeof parsed.accessToken !== "string" || typeof parsed.refreshToken !== "string") throw new Error("shape");
@@ -2133,11 +2148,11 @@ function planProviders(names) {
   }));
 }
 function reportPath() {
-  return join8(dirname4(configPath()), "setup.json");
+  return join7(dirname3(configPath()), "setup.json");
 }
 function loadReport() {
   try {
-    const saved = JSON.parse(readFileSync9(reportPath(), "utf8"));
+    const saved = JSON.parse(readFileSync8(reportPath(), "utf8"));
     return { agents: saved.agents ?? [], plans: saved.plans ?? [], ...saved.secrets ? { secrets: saved.secrets } : {} };
   } catch {
     return { agents: [], plans: [] };
@@ -2150,8 +2165,8 @@ function mergeReport(base, next) {
   return { agents, plans, ...secrets2 ? { secrets: secrets2 } : {} };
 }
 function saveReport(report) {
-  mkdirSync3(dirname4(reportPath()), { recursive: true });
-  writeFileSync5(reportPath(), `${JSON.stringify(report, null, 2)}
+  mkdirSync2(dirname3(reportPath()), { recursive: true });
+  writeFileSync4(reportPath(), `${JSON.stringify(report, null, 2)}
 `, { mode: 384 });
 }
 function confirm3(question) {
@@ -2321,13 +2336,13 @@ async function runSetup(opts) {
     await connectPlans(agents, opts, interactive, emit, run2);
     await tell();
   }
-  const { skills, ignored } = wantsImport ? readLocalSkills(agents) : { skills: [], ignored: [] };
+  const { skills: skills2, ignored } = wantsImport ? readLocalSkills(agents) : { skills: [], ignored: [] };
   const instructions = wantsImport ? readGlobalInstructions(agents) : [];
   const secrets2 = wantsSecrets ? findLocalSecrets(agents) : [];
   if (wantsImport || wantsSecrets) {
     emit({
       type: "found",
-      skills: skills.map((skill) => ({ name: skill.name, agent: skill.agent, files: skill.files.length, bytes: skill.bytes })),
+      skills: skills2.map((skill) => ({ name: skill.name, agent: skill.agent, files: skill.files.length, bytes: skill.bytes })),
       ignored: ignored.map((item) => ({ dir: item.dir, reason: item.reason })),
       instructions: instructions.map((item) => ({ agent: item.agent, path: item.path, bytes: Buffer.byteLength(item.content), imports: item.imports })),
       secrets: secrets2.map((secret) => ({ name: secret.name, agent: secret.agent, url: secret.url }))
@@ -2341,8 +2356,8 @@ async function runSetup(opts) {
   const report = mergeReport(earlier, run2);
   saveReport(report);
   if (key) {
-    const sendFiles = wantsImport && (skills.length > 0 || instructions.length > 0) && await agreed("Send these skills and instructions to your AgentSky workspace?");
-    await importToWorkspace(key, held, sendFiles ? skills : [], sendFiles ? combineInstructions(instructions) : "", emit);
+    const sendFiles = wantsImport && (skills2.length > 0 || instructions.length > 0) && await agreed("Send these skills and instructions to your AgentSky workspace?");
+    await importToWorkspace(key, held, sendFiles ? skills2 : [], sendFiles ? combineInstructions(instructions) : "", emit);
   }
   emit({ type: "done", report });
 }
@@ -2421,10 +2436,10 @@ async function saveSecrets(found, opts, interactive, emit) {
   }
   return counts;
 }
-async function importToWorkspace(key, held, skills, instructions, emit) {
+async function importToWorkspace(key, held, skills2, instructions, emit) {
   const outcomes = [];
   let signedOut = false;
-  for (const skill of skills) {
+  for (const skill of skills2) {
     if (signedOut) {
       outcomes.push({ name: skill.name, outcome: "skipped: sign in to agentsky.dev again" });
       continue;
@@ -2499,6 +2514,50 @@ function renderArtifact(artifact2) {
   return `${artifact2.id}  ${artifact2.name}  v${artifact2.version}  ${files2}  entry ${artifact2.entry}${artifact2.share_url ? `  shared ${artifact2.share_url}` : ""}`;
 }
 
+// src/skills-store.ts
+import { readdirSync as readdirSync3, readFileSync as readFileSync9, statSync as statSync3 } from "fs";
+import { basename as basename3, join as join8, relative, resolve as resolve4 } from "path";
+function skillBundle(dir) {
+  const root = resolve4(dir);
+  const top = basename3(root);
+  const files2 = [];
+  const walk = (path) => {
+    for (const name of readdirSync3(path).sort()) {
+      const full = join8(path, name);
+      if (statSync3(full).isDirectory()) walk(full);
+      else files2.push({ path: `${top}/${relative(root, full)}`, bytes: readFileSync9(full) });
+    }
+  };
+  walk(root);
+  if (!files2.some((file) => file.path === `${top}/SKILL.md`)) throw new Error(`${dir}: no SKILL.md at its root`);
+  return files2;
+}
+async function uploadSkill(dir, displayName) {
+  const form = new FormData();
+  for (const file of skillBundle(dir)) form.append("files", new Blob([new Uint8Array(file.bytes)]), file.path);
+  form.append("displayName", displayName ?? basename3(resolve4(dir)));
+  return apiForm("POST", "/skills", form);
+}
+async function listSkills() {
+  return (await api("GET", "/skills")).skills;
+}
+async function getTask(task2) {
+  return (await api("GET", `/tasks/${encodeURIComponent(task2)}`)).task;
+}
+function answerBody(answer) {
+  if (!answer.option === !answer.text) throw new Error("give exactly one of --option or --text");
+  return { ...answer.option ? { option_id: answer.option } : { text: answer.text }, ...answer.note ? { note: answer.note } : {} };
+}
+async function answerRequest(task2, request, answer) {
+  return api("POST", `/tasks/${encodeURIComponent(task2)}/requests/${encodeURIComponent(request)}/answer`, answerBody(answer));
+}
+function renderRequest(request) {
+  const options = request.options.length ? `
+    options: ${request.options.map((option) => `${option.id} (${option.label})`).join(", ")}` : "";
+  return `${request.id}  ${request.kind}  from ${request.session_id}
+    ${request.question}${options}`;
+}
+
 // src/workspace.ts
 var KINDS = ["TOOL_CALL", "SPEND_CAP", "CALL_COUNT", "CAPABILITY"];
 async function workspaceSlug(explicit) {
@@ -2593,6 +2652,173 @@ function renderPolicy(rule) {
   return `${state}  ${rule.layer.padEnd(9)}  ${rule.kind.padEnd(10)}  ${rule.name}  ${JSON.stringify(rule.config)}  ${rule.id}`;
 }
 
+// src/harness.ts
+import { existsSync as existsSync7, mkdirSync as mkdirSync3, readFileSync as readFileSync10, writeFileSync as writeFileSync5 } from "fs";
+import { dirname as dirname4, join as join9, resolve as resolve5 } from "path";
+var HARNESS_FILE = "harness.json";
+function harnessFilePath(dir) {
+  return join9(resolve5(dir), HARNESS_FILE);
+}
+function readHarnessFile(dir) {
+  const path = harnessFilePath(dir);
+  if (!existsSync7(path)) {
+    throw new Error(`no ${HARNESS_FILE} found in ${resolve5(dir)} \u2014 run \`sky harness init\` first`);
+  }
+  try {
+    return JSON.parse(readFileSync10(path, "utf8"));
+  } catch (err) {
+    throw new Error(`could not parse ${path}: ${err instanceof Error ? err.message : String(err)}`);
+  }
+}
+var INIT_SKELETON = {
+  id: "my_harness",
+  name: "My Harness",
+  version: "0.1.0",
+  distribution: {
+    // choose one distribution kind and remove the others:
+    npx: "@your-scope/my-harness@0.1.0"
+    // uvx: "my-harness==0.1.0",
+    // binary: { url: "https://example.com/my-harness-linux-amd64", sha256: "..." },
+  }
+  // optional: declare the tools this harness exposes
+  // tools: [{ id: "bash", kind: "execute", title: "Shell" }],
+  // optional: feature flags
+  // features: ["subagents"],
+};
+var INIT_COMMENT = `# harness.json \u2014 workspace harness profile skeleton
+# Validate locally: sky harness verify .
+# Submit:          sky harness push .
+# Full schema:     https://agentsky.dev/docs/harness-profile
+`;
+function harnessInit(dir) {
+  const path = harnessFilePath(dir);
+  if (existsSync7(path)) {
+    throw new Error(`${path} already exists \u2014 delete it to re-init`);
+  }
+  mkdirSync3(dirname4(path), { recursive: true });
+  writeFileSync5(path, `${JSON.stringify(INIT_SKELETON, null, 2)}
+`);
+  console.log(`Created ${path}`);
+  console.log(INIT_COMMENT);
+}
+async function harnessVerify(dir, opts) {
+  const raw = readHarnessFile(dir);
+  const parsed = harnessProfileSchema.safeParse(raw);
+  if (!parsed.success) {
+    console.error("harness.json schema errors:");
+    for (const issue of parsed.error.issues) {
+      const path = issue.path.length ? issue.path.join(".") : "(root)";
+      console.error(`  ${path}: ${issue.message}`);
+    }
+    process.exit(1);
+  }
+  console.log(`harness.json  ok  (id: ${parsed.data.id}, version: ${parsed.data.version})`);
+  if (!opts.handle) return;
+  const rawHandle = opts.handle.replace(/^@/, "");
+  console.log(`Starting conformance run for @${rawHandle}\u2026`);
+  let runId;
+  try {
+    const { run: run2 } = await api(
+      "POST",
+      `/catalog/listings/${encodeURIComponent(rawHandle)}/conformance`
+    );
+    runId = run2.id;
+    console.log(`  run ${runId}  status: ${run2.status}`);
+  } catch (err) {
+    if (err instanceof ApiError) {
+      console.error(`sky: conformance start failed \u2014 ${err.message} (${err.code})`);
+    } else {
+      console.error(`sky: conformance start failed \u2014 ${String(err)}`);
+    }
+    process.exit(1);
+  }
+  const pollMs = 4e3;
+  const maxWaitMs = 5 * 60 * 1e3;
+  const deadline = Date.now() + maxWaitMs;
+  while (Date.now() < deadline) {
+    await new Promise((r) => setTimeout(r, pollMs));
+    try {
+      const { run: run2 } = await api("GET", `/catalog/listings/${encodeURIComponent(rawHandle)}/conformance`);
+      if (run2.status === "running") {
+        process.stdout.write(".");
+        continue;
+      }
+      process.stdout.write("\n");
+      if (run2.status === "failed") {
+        console.error(`conformance run failed: ${run2.reason ?? "unknown reason"}`);
+        process.exit(1);
+      }
+      console.log(`
+Conformance report for @${rawHandle}`);
+      console.log(
+        `  required_passed: ${run2.required_passed ? "yes" : "no"}  all_passed: ${run2.all_passed ? "yes" : "no"}`
+      );
+      if (run2.report?.checks) {
+        for (const check of run2.report.checks) {
+          const icon = check.status === "pass" ? "\u2713" : check.status === "skipped" ? "\u2013" : "\u2717";
+          const req = check.required ? " [required]" : "";
+          console.log(`  ${icon} ${check.id}${req} \u2014 ${check.reason ?? check.status} (${check.seconds}s)`);
+        }
+      }
+      if (!run2.required_passed) process.exit(1);
+      return;
+    } catch (err) {
+      console.error(`
+sky: conformance poll failed \u2014 ${err instanceof Error ? err.message : String(err)}`);
+      process.exit(1);
+    }
+  }
+  console.error("\nsky: timed out waiting for conformance run (5 min)");
+  process.exit(1);
+}
+async function harnessPush(dir, opts) {
+  const raw = readHarnessFile(dir);
+  const parsed = harnessProfileSchema.safeParse(raw);
+  if (!parsed.success) {
+    console.error("harness.json is invalid \u2014 run `sky harness verify` first:");
+    for (const issue of parsed.error.issues) {
+      const path = issue.path.length ? issue.path.join(".") : "(root)";
+      console.error(`  ${path}: ${issue.message}`);
+    }
+    process.exit(1);
+  }
+  const profile = parsed.data;
+  const version = opts.version ?? profile.version;
+  const handle = profile.id;
+  let existing;
+  try {
+    const { harnesses } = await api("GET", "/harnesses");
+    existing = harnesses.find((h) => h.handle === handle);
+  } catch (err) {
+    if (!(err instanceof ApiError && err.status === 404)) throw err;
+  }
+  if (!existing) {
+    const { harness: harness2 } = await api("POST", "/harnesses", {
+      handle,
+      name: profile.name,
+      profile,
+      model_billing: "gateway"
+    });
+    existing = harness2;
+    console.log(`Created harness  ${harness2.id}  handle: ${harness2.handle}`);
+  } else {
+    console.log(`Harness exists  ${existing.id}  handle: ${existing.handle}`);
+  }
+  const { version: ver } = await api(
+    "POST",
+    `/harnesses/${encodeURIComponent(existing.id)}/versions`,
+    { version, profile }
+  );
+  console.log(
+    `Version ${ver.version}  status: ${ver.status}  id: ${ver.id}  created: ${ver.created_at}`
+  );
+  console.log(
+    `
+Next step: run conformance
+  sky harness verify . --handle @${handle}`
+  );
+}
+
 // src/index.ts
 function printModelBilling(session2) {
   if (session2.modelBilling !== "account") return;
@@ -2625,7 +2851,7 @@ auth.command("whoami").description("who the current token acts as").action(
   run(async () => {
     const who = await api("GET", "/whoami");
     console.log(
-      `${who.user.email ?? "unknown"} \xB7 universe ${who.universe.slug}${who.universe.isPersonal ? " (personal)" : ""} \xB7 scopes ${who.scopes.join(",")}`
+      `${who.user.email ?? "unknown"} \xB7 universe ${who.universe.slug}${who.universe.isPersonal ? " (default)" : ""} \xB7 scopes ${who.scopes.join(",")}`
     );
   })
 );
@@ -2645,7 +2871,7 @@ universe.command("list").action(
     const current = currentUniverse();
     for (const u of universes) {
       const marker = u.slug === current || !current && u.isPersonal ? "*" : " ";
-      console.log(`${marker} ${u.slug}${u.isPersonal ? " (personal)" : ""}`);
+      console.log(`${marker} ${u.slug}${u.isPersonal ? " (default)" : ""}`);
     }
   })
 );
@@ -2671,7 +2897,7 @@ universe.command("show").action(
       console.log(`${u.slug} \u2014 ${u.name} \xB7 ${u.agents} agents \xB7 ${u.members} members`);
     } else {
       const who = await api("GET", path);
-      console.log(`${who.universe.slug} (personal)`);
+      console.log(`${who.universe.slug} (default)`);
     }
   })
 );
@@ -2719,7 +2945,7 @@ workspace.command("list").action(
     const current = currentUniverse();
     for (const u of universes) {
       const marker = u.slug === current || !current && u.isPersonal ? "*" : " ";
-      console.log(`${marker} ${u.slug}${u.isPersonal ? " (personal)" : ""}`);
+      console.log(`${marker} ${u.slug}${u.isPersonal ? " (default)" : ""}`);
     }
   })
 );
@@ -2864,7 +3090,7 @@ function renderResource(r) {
   const ref = r.checkout ? `@${r.checkout.type === "branch" ? r.checkout.name : r.checkout.sha}` : "";
   return `${r.id}  repo  ${r.mount_path}  ${r.url}${ref}`;
 }
-session.command("create <agent>").description("create a session (starts provisioning by default)").option("--title <title>", "session title").option("--message <text>", "start the first turn immediately, provisioning even with --deferred").option("--deferred", "leave the session idle without a pod until its first turn").option("--vcpus <n>", "machine vCPUs: 1, 2, 4 or 8 (default 2)").option("--memory <mb>", "machine memory in MB, 256MB steps (default 4096)").option("--file <path...>", "mount local files read-only in the working directory: path[:/mount] (uploaded first)").option("--repo <url...>", "clone GitHub repositories into the working directory: https://github.com/{owner}/{repo}[@branch|@sha]").option("--repo-token <token>", "token for the --repo clones; compiled into the sandbox's egress policy, never sent to it").option("--json", "print the created session as JSON").action(
+session.command("create <agent>").description("create a session (starts provisioning by default)").option("--title <title>", "session title").option("--message <text>", "start the first turn immediately, provisioning even with --deferred").option("--deferred", "leave the session idle without a pod until its first turn").option("--vcpus <n>", "machine vCPUs: 1, 2, 4 or 8 (default 2)").option("--memory <mb>", "machine memory in MB, 256MB steps (default 4096)").option("--file <path...>", "mount local files read-only in the working directory: path[:/mount] (uploaded first)").option("--repo <url...>", "clone GitHub repositories into the working directory: https://github.com/{owner}/{repo}[@branch|@sha]").option("--repo-token <token>", "token for the --repo clones; compiled into the sandbox's egress policy, never sent to it").option("--json", "print the created session as JSON").option("--no-defaults", "attach only what this command names: no workspace default environment, vault, files, skills or memory").option("--budget-cents <cents>", "the most the session may spend, in whole US cents").action(
   run(
     async (agentRef, opts) => {
       const resources = await resourceParams(opts);
@@ -2874,6 +3100,8 @@ session.command("create <agent>").description("create a session (starts provisio
         ...opts.vcpus !== void 0 ? { vcpus: Number(opts.vcpus) } : {},
         ...opts.memory !== void 0 ? { memoryMb: Number(opts.memory) } : {},
         ...opts.deferred ? { provision: "deferred" } : {},
+        ...opts.defaults === false ? { defaults: "none" } : {},
+        ...opts.budgetCents ? { budget: { type: "limit", max_list_cost: { amount: opts.budgetCents, currency: "USD" } } } : {},
         ...resources.length ? { resources } : {},
         ...opts.message ? { initial_events: [{ type: "user.message", content: [{ type: "text", text: opts.message }] }] } : {}
       });
@@ -3206,9 +3434,9 @@ secrets.command("unset <id> <key>").action(
 );
 program.command("launch").description("scaffold ./agent.toml if absent, create the agent, print its address").option("-f, --file <path>", "agent file", "agent.toml").option("--type <type>", "override the file's harness: hermes | claude_code | codex | openclaw | pi | dsh | kimi_code | opencode").option("--llm <llm>", "override the file's model (must suit the harness)").action(
   run(async (opts) => {
-    const path = resolve4(opts.file);
-    if (!existsSync7(path)) {
-      const name = basename3(process.cwd()).replace(/[^a-zA-Z0-9 _-]/g, "") || "my-agent";
+    const path = resolve6(opts.file);
+    if (!existsSync8(path)) {
+      const name = basename4(process.cwd()).replace(/[^a-zA-Z0-9 _-]/g, "") || "my-agent";
       scaffoldAgentFile(path, name);
       console.log(`Scaffolded ${opts.file} \u2014 edit it anytime; re-apply with \`sky deploy\`.`);
     }
@@ -3239,7 +3467,7 @@ program.command("launch").description("scaffold ./agent.toml if absent, create t
 );
 program.command("deploy").description("re-apply ./agent.toml to the existing agent (idempotent)").option("-f, --file <path>", "agent file", "agent.toml").action(
   run(async (opts) => {
-    const path = resolve4(opts.file);
+    const path = resolve6(opts.file);
     const { file, spec } = readAgentFile(path);
     if (!file.id) {
       console.log("No agent id in the file yet \u2014 running launch instead.");
@@ -3289,7 +3517,7 @@ program.command("import").description("import a local Claude Code or Codex sessi
       if (opts.trace && !opts.key) throw new Error("--trace requires --key <importKey>");
       const limit = Math.max(1, Math.min(50, parseInt(opts.limit ?? "10", 10) || 10));
       if (opts.harness && !["claude_code", "codex", "all"].includes(opts.harness)) throw new Error("Use --harness claude_code, codex, or all.");
-      const harness = opts.harness ?? "all";
+      const harness2 = opts.harness ?? "all";
       const base = opts.url ?? agentUseBase();
       const nonInteractive = !process.stdin.isTTY;
       const autoConfirm = opts.yes || opts.current || !!opts.session && nonInteractive;
@@ -3308,18 +3536,18 @@ program.command("import").description("import a local Claude Code or Codex sessi
           }
         } else {
           const cwd = process.cwd();
-          const all = listRecentSessions(harness === "all" ? void 0 : harness, 50);
+          const all = listRecentSessions(harness2 === "all" ? void 0 : harness2, 50);
           const byCwd = all.filter((s) => s.workspace === cwd || s.workspace.startsWith(cwd + "/"));
           candidates = byCwd.length > 0 ? [byCwd[0]] : all.length > 0 ? [all[0]] : [];
         }
         if (candidates.length === 0) throw new Error("No local session found for the current environment. Run with --session <id> or start an agent session first.");
       } else if (opts.session) {
-        candidates = listRecentSessions(harness === "all" ? void 0 : harness, Number.POSITIVE_INFINITY).filter(
+        candidates = listRecentSessions(harness2 === "all" ? void 0 : harness2, Number.POSITIVE_INFINITY).filter(
           (s) => s.sessionId === opts.session
         );
         if (candidates.length === 0) throw new Error(`Session "${opts.session}" not found in ~/.claude or ~/.codex.`);
       } else {
-        candidates = listRecentSessions(harness === "all" ? void 0 : harness, limit);
+        candidates = listRecentSessions(harness2 === "all" ? void 0 : harness2, limit);
         if (candidates.length === 0) {
           console.log("No recent sessions found. Make sure you have run Claude Code (sessions in ~/.claude) or Codex (sessions in ~/.codex).");
           return;
@@ -3342,11 +3570,11 @@ program.command("import").description("import a local Claude Code or Codex sessi
         console.log();
         const rl = createInterface4({ input: process.stdin, output: process.stdout });
         const answer = await new Promise(
-          (resolve5) => rl.question(
+          (resolve7) => rl.question(
             `Import which session? [1-${candidates.length}, or comma-separated, or "all"]: `,
             (a) => {
               rl.close();
-              resolve5(a.trim());
+              resolve7(a.trim());
             }
           )
         );
@@ -3369,9 +3597,9 @@ program.command("import").description("import a local Claude Code or Codex sessi
       if (!autoConfirm) {
         if (nonInteractive) throw new Error("Use --yes to confirm this transfer in a non-interactive terminal.");
         const prompt = createInterface4({ input: process.stdin, output: process.stdout });
-        const answer = await new Promise((resolve5) => prompt.question("Upload these selected conversations? [y/N] ", (value) => {
+        const answer = await new Promise((resolve7) => prompt.question("Upload these selected conversations? [y/N] ", (value) => {
           prompt.close();
-          resolve5(value);
+          resolve7(value);
         }));
         if (!/^y(?:es)?$/i.test(answer.trim())) {
           console.log("Cancelled. Nothing uploaded.");
@@ -3453,7 +3681,7 @@ files.command("download <id>").description("download a session file's bytes").re
     console.log(`Wrote ${bytes.length} bytes to ${opts.out}`);
   })
 );
-var task = program.command("task").description("a task's shared files (the task is its first session's id)");
+var task = program.command("task").description("a task's shared files and open requests (the task is its first session's id)");
 task.command("files <task>").description("list the task's current files").action(
   run(async (taskId) => {
     const list = await listTaskFiles(taskId);
@@ -3472,7 +3700,7 @@ task.command("get <task> <path>").description("read one task file; prints it, or
 );
 task.command("put <task> <path> <local>").description("write a local file to <path> in the task's files (every session of the task sees it)").action(
   run(async (taskId, path, local) => {
-    const { file, conflict } = await writeTaskFile(taskId, path, readFileSync10(local), mediaTypeFor(local));
+    const { file, conflict } = await writeTaskFile(taskId, path, readFileSync11(local), mediaTypeFor(local));
     console.log(`${renderTaskFile(file)}${conflict ? "  (replaced a version you had not seen)" : ""}`);
   })
 );
@@ -3482,6 +3710,45 @@ task.command("rm <task> <path>").description("remove a path from the task's file
     console.log(`Removed ${path}`);
   })
 );
+task.command("show <task>").description("the task's sessions and the requests waiting on you (questions, approvals, apps to connect)").option("--json", "print the task as JSON").action(
+  run(async (taskId, opts) => {
+    const found = await getTask(taskId);
+    if (opts.json) {
+      console.log(JSON.stringify(found));
+      return;
+    }
+    for (const member of found.sessions ?? []) console.log(`${member.id}  ${member.role}${member.status ? `  ${member.status}` : ""}`);
+    if (!found.requests.length) console.log("no open requests");
+    for (const request of found.requests) console.log(renderRequest(request));
+  })
+);
+task.command("answer <task> <request>").description("answer an open request; the asking session continues with the answer").option("--option <id>", "the id of one of the request's options").option("--text <text>", "a free-text answer").option("--note <text>", "sent to the agent after the answer, in the same turn").action(
+  run(async (taskId, requestId, opts) => {
+    await answerRequest(taskId, requestId, opts);
+    console.log(`Answered ${requestId}`);
+  })
+);
+var skills = program.command("skills").description("the workspace's skill store: upload a skill, then attach it to an agent by id");
+skills.command("upload <dir>").description("upload a skill directory (SKILL.md at its root) as a new skill").option("--name <name>", "display name (default: the directory's name)").option("--json", "print the stored skill as JSON").action(
+  run(async (dir, opts) => {
+    const { skill } = await uploadSkill(dir, opts.name);
+    if (opts.json) {
+      console.log(JSON.stringify(skill));
+      return;
+    }
+    console.log(`Uploaded ${skill.id} (${skill.displayName ?? dir}). Attach it in agent.toml:`);
+    console.log(`  [[skills]]
+  type = "skill"
+  skillId = "${skill.id}"`);
+  })
+);
+skills.command("list").description("the workspace's stored skills").action(
+  run(async () => {
+    const list = await listSkills();
+    if (!list.length) console.log("no skills");
+    for (const skill of list) console.log(`${skill.id}  ${skill.displayName ?? ""}`);
+  })
+);
 var artifact = program.command("artifact").description("artifacts: publish a task's files as a named, shareable result");
 artifact.command("list").description("the workspace's artifacts, or one task's with --task").option("--task <task>", "only this task's artifacts").action(
   run(async (opts) => {
@@ -3690,7 +3957,274 @@ program.command("config").description("show the CLI config location and current
   console.log(`config: ${configPath()}`);
   console.log(`  apiBase:  ${config.apiBase ?? "(default)"}`);
   console.log(`  token:    ${config.token ? `${config.token.slice(0, 10)}\u2026` : "(none)"}`);
-  console.log(`  universe: ${config.currentUniverse ?? "(personal)"}`);
+  console.log(`  universe: ${config.currentUniverse ?? "(default)"}`);
+});
+var harness = program.command("harness").description("workspace harnesses: init, verify, push");
+harness.command("init [dir]").description("write a harness.json profile skeleton in the given directory (default: .)").action(run(async (dir) => {
+  harnessInit(dir ?? ".");
+}));
+harness.command("verify [dir]").description("validate harness.json against the profile schema; with --handle, also run conformance").option("--handle <@listing>", "catalog listing handle to run conformance against").action(run(async (dir, opts) => {
+  await harnessVerify(dir ?? ".", { handle: opts.handle });
+}));
+harness.command("push [dir]").description("create or update the workspace harness from harness.json").option("--version <semver>", "override the version (default: the version in harness.json)").action(run(async (dir, opts) => {
+  await harnessPush(dir ?? ".", { version: opts.version });
+}));
+harness.command("connect").description("run an ACP agent (the command after --) as a session's brain, over the platform relay").option("--session <id>", "the session to be the brain of (default: $AGENTSKY_HARNESS_RELAY_URL names it)").option("--token <token>", "the harness connect token, hct_\u2026 (default: $AGENTSKY_HARNESS_TOKEN)").option("--once", "exit when the connection ends instead of reconnecting").allowExcessArguments(true).action(run(async (opts) => {
+  const { connectHarness, serveHarness, agentCommandFrom } = await import("./harness-connect-DUC7GIBL.js");
+  const token = opts.token ?? process.env.AGENTSKY_HARNESS_TOKEN ?? "";
+  const url = opts.session ? void 0 : process.env.AGENTSKY_HARNESS_RELAY_URL;
+  const apiBase2 = (loadConfig().apiBase ?? "https://api.agentsky.dev").replace(/\/$/, "");
+  const ac = new AbortController();
+  process.on("SIGINT", () => ac.abort());
+  process.on("SIGTERM", () => ac.abort());
+  const options = { url, apiBase: apiBase2, session: opts.session, token, command: agentCommandFrom(process.argv), signal: ac.signal };
+  process.exitCode = opts.once ? await connectHarness(options) : await serveHarness(options);
+}));
+var traceCmd = program.command("trace").description("correlate this machine's agent work with the cloud sessions it starts (metadata only unless you choose content)");
+traceCmd.command("start").description("start a trace: a grant for this machine, a root span, and the spool the hooks write to").option("--name <name>", "a name for the task").option("--source <source>", "how this machine reports itself", "claude-code").option("--hooks [settings]", "also install the Claude Code hooks (default: ./.claude/settings.local.json)").option("--capture <scopes>", "also send content, redacted on this machine first: any of prompts,tool_output,files").option("--file <path>", "a file the files scope may send (repeatable)", collect).option("--dir <path>", "a folder whose files the files scope may send when a file tool touches them (repeatable)", collect).action(run(async (opts) => {
+  const { readState, writeState, record, installClaudeHooks, parseContentScopes, chosenPaths, fileEvent } = await import("./trace-UJTFSXNM.js");
+  if (readState()) throw new Error("a trace is already running here \u2014 `sky trace stop` it first");
+  const scopes = parseContentScopes(opts.capture);
+  const chosen = chosenPaths(opts.file ?? [], opts.dir ?? []);
+  if ((chosen.files.length || chosen.dirs.length) && !scopes.includes("files")) throw new Error("--file and --dir need --capture files");
+  if (scopes.includes("files") && !chosen.files.length && !chosen.dirs.length) throw new Error("--capture files needs at least one --file or --dir");
+  const { trace } = await api("POST", "/traces", opts.name ? { name: opts.name } : {});
+  const { grant, token } = await api("POST", `/traces/${trace.id}/grants`, {
+    source: opts.source,
+    ...scopes.length ? { content_scopes: scopes } : {}
+  });
+  const root = `task:${trace.id}`;
+  const state = {
+    trace_id: trace.id,
+    grant_id: grant.id,
+    token,
+    source: opts.source,
+    api_base: apiBase(),
+    next_sequence: 0,
+    root_span: root,
+    ...scopes.length ? { content_scopes: scopes, files: chosen.files, dirs: chosen.dirs } : {}
+  };
+  writeState(state);
+  record(() => [
+    { span_id: root, parent_span_id: null, kind: "start", name: opts.name ?? "task" },
+    ...chosen.files.flatMap((path) => fileEvent(root, path, state) ?? [])
+  ]);
+  console.log(`Tracing ${trace.id} as ${opts.source} until ${grant.expires_at}`);
+  console.log(scopes.length ? `  content: ${scopes.join(", ")} (redacted here before it leaves)` : "  metadata only");
+  if (opts.hooks) console.log(`  hooks: ${installClaudeHooks(resolve6(typeof opts.hooks === "string" ? opts.hooks : ".claude/settings.local.json"))}`);
+  console.log(`  a session started elsewhere joins it with metadata {"trace_id": "${trace.id}"}`);
+  console.log(`  sky trace show ${trace.id}`);
+}));
+traceCmd.command("hook").description("record one Claude Code hook event read from stdin (run by the installed hooks; never fails, prints nothing)").action(async () => {
+  try {
+    const { readState, record, flush, grantSender, eventsForClaudeHook, contentForClaudeHook, clearState } = await import("./trace-UJTFSXNM.js");
+    const chunks = [];
+    for await (const chunk of process.stdin) chunks.push(chunk);
+    const input = JSON.parse(Buffer.concat(chunks).toString("utf8") || "{}");
+    if (!record((state2) => [...eventsForClaudeHook(input, state2), ...contentForClaudeHook(input, state2)])) return;
+    const state = readState();
+    if (!state) return;
+    const outcome = await flush(grantSender(state, 3e3));
+    if (outcome.stopped === "grant_revoked" || outcome.stopped === "grant_expired") clearState();
+  } catch {
+  }
+});
+traceCmd.command("flush").description("send what the spool holds, retrying with backoff").action(run(async () => {
+  const { readState, flush, grantSender } = await import("./trace-UJTFSXNM.js");
+  const state = readState();
+  if (!state) throw new Error("no trace is running here");
+  const outcome = await flush(grantSender(state), { attempts: 4 });
+  console.log(`sent ${outcome.sent}, refused ${outcome.refused}, given up ${outcome.expired}, still pending ${outcome.pending}${outcome.stopped ? ` (stopped: ${outcome.stopped})` : ""}`);
+}));
+traceCmd.command("status").description("the running trace and its spool").action(run(async () => {
+  const { readState, spoolStatus } = await import("./trace-UJTFSXNM.js");
+  const state = readState();
+  if (!state) {
+    console.log("No trace is running here.");
+    return;
+  }
+  const spool = spoolStatus();
+  console.log(`${state.trace_id} as ${state.source}: ${spool.pending} pending, ${spool.dropped_full} dropped (spool full), ${spool.dropped_expired} given up, ${spool.refused} refused`);
+}));
+traceCmd.command("show [id]").description("the trace bundle: spans, the sessions they reach, cost counted once per session").option("--json", "print the bundle as JSON").action(run(async (id, opts) => {
+  const { readState } = await import("./trace-UJTFSXNM.js");
+  const ref = id ?? readState()?.trace_id;
+  if (!ref) throw new Error("name a trace, or start one here");
+  const bundle = await api("GET", `/traces/${ref}`);
+  if (opts.json) {
+    console.log(JSON.stringify(bundle, null, 2));
+    return;
+  }
+  console.log(`${bundle.trace.id}${bundle.trace.name ? `  ${bundle.trace.name}` : ""}`);
+  const children = /* @__PURE__ */ new Map();
+  for (const span of bundle.spans) {
+    const parent = span.parent_span_id && bundle.spans.some((other) => other.span_id === span.parent_span_id) ? span.parent_span_id : null;
+    children.set(parent, [...children.get(parent) ?? [], span]);
+  }
+  const print = (parent, depth) => {
+    for (const span of children.get(parent) ?? []) {
+      const withContent = span.events.filter((event) => event.content).length;
+      console.log(`${"  ".repeat(depth + 1)}${span.name ?? span.span_id}  [${span.source} \xB7 ${span.outcome}${span.outcome_source === "platform" ? " with its session" : ""}${span.edge === "root" || span.edge === "resolved" ? "" : ` \xB7 parent ${span.edge}`}]  ${span.events.length} events${withContent ? `, ${withContent} with content` : ""}`);
+      print(span.span_id, depth + 1);
+    }
+  };
+  print(null, 0);
+  for (const session2 of bundle.sessions) console.log(`  session ${session2.id}  ${session2.agent_type}  ${session2.status}  ${session2.role} of ${session2.task_id}  (${session2.linked_by})`);
+  console.log(`  cost: $${bundle.consumed_cost.amount}  \xB7  coverage: ${bundle.coverage}`);
+  for (const gap of bundle.gaps) console.log(`  gap: ${gap.span_id} ${gap.reason}`);
+}));
+traceCmd.command("stop").description("end the root span, send what is left, and revoke this machine's grant").action(run(async () => {
+  const { readState, record, flush, grantSender, clearState } = await import("./trace-UJTFSXNM.js");
+  const state = readState();
+  if (!state) throw new Error("no trace is running here");
+  if (state.root_span) record(() => [{ span_id: state.root_span, kind: "end", outcome: "completed" }]);
+  const outcome = await flush(grantSender(readState() ?? state), { attempts: 4 });
+  await api("DELETE", `/traces/${state.trace_id}/grants/${state.grant_id}`);
+  clearState();
+  console.log(`Stopped ${state.trace_id}${outcome.pending ? ` (${outcome.pending} events could not be sent)` : ""}`);
+}));
+traceCmd.command("sync [payload]").description("upload this machine's Claude Code and Codex sessions to the matching workspace's trace library, redacted here first").option("--enable", "turn sync on for this machine").option("--disable", "turn sync off; nothing more is uploaded").option("--route <match=workspace>", "send sessions whose folder path contains <match> to <workspace> (repeatable; replaces the saved rules)", collect).option("--default <workspace>", "where a session no rule matches goes").option("--keep-local", "keep sessions no rule matches on this machine (the default)").option("--session <ref>", "only this session: its id or transcript path (repeatable)", collect).option("--full", "re-read every session, not only files that changed").option("--limit <n>", "at most this many changed sessions this run", (v) => Number.parseInt(v, 10)).option("--dry-run", "show what would be uploaded without uploading").option("--hook", "run from a Claude Code SessionEnd hook or Codex notify: upload that session in the background and return at once").option("--install-schedule", "also sweep every 15 minutes (macOS launchd)").option("--status", "what sync has done on this machine").option("--quiet", "print only failures").action(async (payload, opts) => {
+  const lib = await import("./trace-library-474QJTAZ.js");
+  if (opts.hook) {
+    try {
+      let raw = payload ?? "";
+      if (!raw && !process.stdin.isTTY) {
+        const chunks = [];
+        for await (const chunk of process.stdin) chunks.push(chunk);
+        raw = Buffer.concat(chunks).toString("utf8");
+      }
+      if (!lib.loadSyncConfig().enabled) return;
+      const ref = lib.hookSessionRef(raw);
+      const { spawn: spawn4 } = await import("child_process");
+      spawn4(process.execPath, [process.argv[1], "trace", "sync", "--quiet", ...ref ? ["--session", ref] : []], { detached: true, stdio: "ignore" }).unref();
+    } catch {
+    }
+    return;
+  }
+  await run(async () => {
+    const config = lib.loadSyncConfig();
+    if (opts.disable) {
+      lib.saveSyncConfig({ ...config, enabled: false });
+      console.log("Trace sync is off on this machine. Uploaded traces stay in their workspaces until deleted there.");
+      return;
+    }
+    const changedSettings = opts.enable || opts.route || opts.default || opts.keepLocal;
+    if (changedSettings) {
+      if (opts.enable && !apiToken()) throw new Error("not logged in \u2014 run `sky auth login` first");
+      const rules = opts.route ? opts.route.map((spec) => {
+        const at = spec.lastIndexOf("=");
+        if (at <= 0 || at === spec.length - 1) throw new Error(`--route takes match=workspace, got "${spec}"`);
+        return { match: spec.slice(0, at), workspace: spec.slice(at + 1) };
+      }) : config.rules;
+      const next = {
+        ...config,
+        rules,
+        enabled: opts.enable ? true : config.enabled,
+        enabledAt: opts.enable ? (/* @__PURE__ */ new Date()).toISOString() : config.enabledAt,
+        fallback: opts.keepLocal ? void 0 : opts.default ?? config.fallback
+      };
+      lib.saveSyncConfig(next);
+      console.log(`Trace sync is ${next.enabled ? "on" : "off"} on this machine. It reads only:`);
+      for (const folder of lib.sourceFolders()) console.log(`  ${folder}`);
+      console.log("and sends each session, redacted here first, to:");
+      for (const rule of next.rules) console.log(`  folder path contains "${rule.match}" \u2192 ${rule.workspace}`);
+      console.log(`  anything else \u2192 ${next.fallback ?? "stays on this machine"}`);
+      console.log(`A repository's .agentsky.json "workspace" wins over these rules.`);
+    }
+    if (opts.installSchedule) {
+      const { join: join10 } = await import("path");
+      const { homedir: homedir6 } = await import("os");
+      const { execFileSync } = await import("child_process");
+      const log = join10(homedir6(), ".config", "sky", "trace-sync.log");
+      const plist = lib.installLaunchd([process.execPath, process.argv[1], "trace", "sync", "--quiet"], log);
+      try {
+        execFileSync("launchctl", ["unload", plist], { stdio: "ignore" });
+      } catch {
+      }
+      execFileSync("launchctl", ["load", plist]);
+      console.log(`Sweeping every 15 minutes (${plist}); a full re-read runs weekly. Log: ${log}`);
+    }
+    if (opts.status) {
+      const { readFileSync: readFileSync12 } = await import("fs");
+      const { join: join10 } = await import("path");
+      let state = { sessions: {} };
+      try {
+        state = JSON.parse(readFileSync12(join10(lib.syncConfigPath(), "..", "trace-sync-state.json"), "utf8"));
+      } catch {
+      }
+      const counts = /* @__PURE__ */ new Map();
+      for (const entry2 of Object.values(state.sessions)) {
+        const label = entry2.status === "stored" ? `stored in ${entry2.workspace}` : entry2.status;
+        counts.set(label, (counts.get(label) ?? 0) + 1);
+      }
+      console.log(`Trace sync is ${config.enabled ? "on" : "off"}${config.enabledAt ? ` (since ${config.enabledAt})` : ""}. Last full sweep: ${state.lastFullAt ?? "never"}.`);
+      for (const [label, count] of [...counts].sort((a, b) => b[1] - a[1])) console.log(`  ${count}  ${label}`);
+      return;
+    }
+    if (changedSettings && !opts.full && !opts.session) return;
+    const report = await lib.syncTraces({
+      full: opts.full,
+      only: opts.session,
+      dryRun: opts.dryRun,
+      limit: opts.limit,
+      onProgress: opts.quiet ? void 0 : (line) => console.log(line)
+    });
+    if (!report) {
+      if (!opts.quiet) console.log("Another sync is running on this machine; it will pick these up.");
+      return;
+    }
+    if (!opts.quiet || report.failed) {
+      const where = Object.entries(report.byWorkspace).map(([workspace2, count]) => `${count} \u2192 ${workspace2}`).join(", ");
+      console.log(`${opts.dryRun ? "Would upload" : "Uploaded"} ${report.uploaded}${where ? ` (${where})` : ""}; unchanged ${report.unchanged}; kept local ${report.local}; empty ${report.empty}; another member's ${report.owned}; failed ${report.failed}. Scanned ${report.scanned}, ${report.changed} changed.`);
+      for (const error of report.errors.slice(0, 20)) console.error(`  ${error}`);
+    }
+    if (report.failed) process.exitCode = 1;
+  })();
+});
+traceCmd.command("search <query...>").description("search every session in a workspace's trace library (literal substring)").option("--workspace <slug>", "the workspace to search (default: the current one)").option("--limit <n>", "hits per page", (v) => Number.parseInt(v, 10), 20).option("--cursor <cursor>", "the next page of an earlier search").option("--json", "print the page as JSON").action(run(async (words, opts) => {
+  const { libraryRequest } = await import("./trace-library-474QJTAZ.js");
+  const workspace2 = opts.workspace ?? currentUniverse();
+  if (!workspace2) throw new Error("name a workspace with --workspace");
+  const params = new URLSearchParams({ q: words.join(" "), scope: "traces", limit: String(opts.limit), ...opts.cursor ? { cursor: opts.cursor } : {} });
+  const page = await libraryRequest("GET", `/context/search?${params}`, workspace2);
+  if (opts.json) {
+    console.log(JSON.stringify(page, null, 2));
+    return;
+  }
+  if (!page.hits.length) console.log(page.partial ? `No hits, but the search was cut short (${page.coverage}).` : "No hits.");
+  for (const { hit } of page.hits) {
+    console.log(`${hit.occurredAt?.slice(0, 16).replace("T", " ") ?? "                "}  ${hit.title}`);
+    console.log(`  ${hit.snippet.replace(/\s+/g, " ")}`);
+  }
+  if (page.nextCursor) console.log(`More: sky trace search ${JSON.stringify(words.join(" "))} --workspace ${workspace2} --cursor ${page.nextCursor}`);
+}));
+traceCmd.command("library").description("list the sessions in a workspace's trace library, most recently updated first").option("--workspace <slug>", "the workspace (default: the current one)").option("--limit <n>", "how many", (v) => Number.parseInt(v, 10), 20).option("--json", "print the page as JSON").action(run(async (opts) => {
+  const { libraryRequest } = await import("./trace-library-474QJTAZ.js");
+  const workspace2 = opts.workspace ?? currentUniverse();
+  if (!workspace2) throw new Error("name a workspace with --workspace");
+  const page = await libraryRequest("GET", `/trace-library?limit=${opts.limit}`, workspace2);
+  if (opts.json) {
+    console.log(JSON.stringify(page, null, 2));
+    return;
+  }
+  console.log(`${page.total} sessions in ${workspace2}'s trace library`);
+  for (const trace of page.traces) {
+    console.log(`${trace.updated_at.slice(0, 16).replace("T", " ")}  ${trace.harness.padEnd(11)} ${(trace.project ?? "").padEnd(16)} ${String(trace.messages).padStart(5)} msgs  ${trace.title ?? trace.session_id}`);
+  }
+}));
+var workerCmd = program.command("worker").description("run a pod on this machine and connect it to a worker pool");
+workerCmd.command("start <pool>").description("start a worker connected to the given pool (wpool_\u2026 id)").option("--token <token>", "bearer token (default: $SKY_WORKER_TOKEN)").option("--label <label>", "a human-readable name for this machine", "cli").action(async (poolId, options) => {
+  const { startWorker } = await import("./worker-6Q4K4HZW.js");
+  const token = options.token ?? process.env.SKY_WORKER_TOKEN ?? "";
+  if (!token) {
+    console.error("error: provide --token or set SKY_WORKER_TOKEN");
+    process.exit(1);
+  }
+  const base = (loadConfig().apiBase ?? "https://api.agentsky.dev").replace(/\/$/, "");
+  const ac = new AbortController();
+  process.on("SIGINT", () => ac.abort());
+  process.on("SIGTERM", () => ac.abort());
+  await startWorker({ poolId, token, label: options.label, apiBase: base, signal: ac.signal });
 });
 var ARGUMENTS_FOLLOW_THE_SCRIPT_PATH_ON_EVERY_RUNTIME = { from: "node" };
 program.parseAsync(process.argv, ARGUMENTS_FOLLOW_THE_SCRIPT_PATH_ON_EVERY_RUNTIME).catch(fail);