@agentsky/sky 2.14.0 → 2.16.0

package/dist/index.js

@@ -4,12 +4,12 @@ import {
   api,
   apiBytes,
   apiForm,
-  downloadFile,
+  downloadFileTo,
   postEvents,
   resolveSessionRef,
   streamEvents,
   uploadFile
-} from "./chunk-FOJP33RS.js";
+} from "./chunk-MQECNHD2.js";
 import {
   CLI_VERSION,
   USER_AGENT,
@@ -20,7 +20,7 @@ import {
   currentUniverse,
   loadConfig,
   saveConfig
-} from "./chunk-VJEE2ALN.js";
+} from "./chunk-5JHQH7WH.js";
 import {
   AGENT_TYPES,
   MODEL_SUBSCRIPTION_PLAN_PHRASE,
@@ -40,18 +40,122 @@ import {
   skillRefSchema,
   splitMcpServers,
   supersededBy
-} from "./chunk-7OM2B5SE.js";
+} from "./chunk-RHRREQMF.js";
 import "./chunk-MLKGABMK.js";
 
 // src/index.ts
-import { existsSync as existsSync10, readFileSync as readFileSync13, writeFileSync as writeFileSync6 } from "fs";
-import { basename as basename6, resolve as resolve7 } from "path";
-import { createInterface as createInterface4 } from "readline";
+import { existsSync as existsSync10, readFileSync as readFileSync14, writeFileSync as writeFileSync7 } from "fs";
+import { basename as basename8, resolve as resolve9 } from "path";
+import { createInterface as createInterface6 } from "readline";
 import { Command } from "commander";
 
 // src/files.ts
-import { readFileSync } from "fs";
-import { basename, extname } from "path";
+import { readFileSync as readFileSync2, statSync as statSync2 } from "fs";
+import { basename as basename2, extname } from "path";
+
+// src/resumable-upload.ts
+import { createHash } from "crypto";
+import { mkdirSync, openSync, readFileSync, readSync, closeSync, rmSync, statSync, writeFileSync } from "fs";
+import { basename, dirname, join, resolve } from "path";
+var SINGLE_REQUEST_MAX_BYTES = 32 * 1024 * 1024;
+var MAX_ATTEMPTS = 8;
+function statePath(path, size, mtimeMs) {
+  const key = createHash("sha256").update(`${resolve(path)}\0${size}\0${mtimeMs}`).digest("hex").slice(0, 32);
+  return join(dirname(configPath()), "uploads", `${key}.json`);
+}
+function loadSession(file, expiresInSeconds) {
+  try {
+    const saved = JSON.parse(readFileSync(file, "utf8"));
+    if (saved.expiresInSeconds !== expiresInSeconds) return null;
+    if (Date.parse(saved.expires_at) - Date.now() < 3600 * 1e3) return null;
+    return saved;
+  } catch {
+    return null;
+  }
+}
+function acknowledged(res) {
+  const range = res.headers.get("range")?.match(/^bytes=0-(\d+)$/);
+  return range ? Number(range[1]) + 1 : 0;
+}
+async function probe(session2) {
+  const res = await fetch(session2.upload_url, {
+    method: "PUT",
+    headers: { "user-agent": USER_AGENT, "content-range": `bytes */${session2.size_bytes}` }
+  });
+  if (res.status === 200 || res.status === 201) return "done";
+  if (res.status === 308) return acknowledged(res);
+  if (res.status === 404 || res.status === 410) throw new ApiError(res.status, "upload_expired", "the upload session is gone");
+  throw new ApiError(res.status, "upload_failed", `upload status check failed: ${res.status} ${res.statusText}`);
+}
+async function sendChunk(session2, fd, offset) {
+  const length = Math.min(session2.chunk_size, session2.size_bytes - offset);
+  const chunk = Buffer.alloc(length);
+  let read = 0;
+  while (read < length) read += readSync(fd, chunk, read, length - read, offset + read);
+  const res = await fetch(session2.upload_url, {
+    method: "PUT",
+    headers: {
+      "user-agent": USER_AGENT,
+      "content-range": `bytes ${offset}-${offset + length - 1}/${session2.size_bytes}`
+    },
+    body: chunk
+  });
+  if (res.status === 200 || res.status === 201) return "done";
+  if (res.status === 308) return acknowledged(res);
+  if (res.status >= 500 || res.status === 429) throw new Error(`transient ${res.status}`);
+  throw new ApiError(res.status, "upload_failed", `chunk upload failed: ${res.status} ${(await res.text()).slice(0, 200)}`);
+}
+async function transfer(session2, path, onProgress) {
+  const fd = openSync(path, "r");
+  try {
+    let failures = 0;
+    let state = await probe(session2);
+    while (state !== "done") {
+      onProgress(state, session2.size_bytes);
+      try {
+        state = await sendChunk(session2, fd, state);
+        failures = 0;
+      } catch (error) {
+        if (error instanceof ApiError || ++failures >= MAX_ATTEMPTS) throw error;
+        await new Promise((done) => setTimeout(done, Math.min(3e4, 500 * 2 ** failures)));
+        state = await probe(session2);
+      }
+    }
+    onProgress(session2.size_bytes, session2.size_bytes);
+  } finally {
+    closeSync(fd);
+  }
+}
+async function uploadLargeFile(path, mediaType, expiresInSeconds, onProgress) {
+  const { size, mtimeMs } = statSync(path);
+  const stateFile = statePath(path, size, mtimeMs);
+  let session2 = loadSession(stateFile, expiresInSeconds);
+  if (session2) {
+    try {
+      await probe(session2);
+    } catch (error) {
+      if (!(error instanceof ApiError) || error.status !== 404 && error.status !== 410) throw error;
+      session2 = null;
+    }
+  }
+  if (!session2) {
+    session2 = await api("POST", "/files/uploads", {
+      filename: basename(path),
+      size_bytes: size,
+      mime_type: mediaType,
+      ...expiresInSeconds ? { expires_in_seconds: expiresInSeconds } : {}
+    });
+    mkdirSync(dirname(stateFile), { recursive: true });
+    const saved = { ...session2, path: resolve(path), mtimeMs, expiresInSeconds };
+    writeFileSync(stateFile, JSON.stringify(saved), { mode: 384 });
+  }
+  await transfer(session2, path, onProgress);
+  const file = await api("POST", `/files/uploads/${encodeURIComponent(session2.id)}/complete`);
+  rmSync(stateFile, { force: true });
+  return file;
+}
+
+// src/files.ts
 var MEDIA_TYPES = {
   ".png": "image/png",
   ".jpg": "image/jpeg",
@@ -71,20 +175,24 @@ var MEDIA_TYPES = {
 function mediaTypeFor(path) {
   return MEDIA_TYPES[extname(path).toLowerCase()] ?? "application/octet-stream";
 }
-async function uploadLocalFile(path, expiresInSeconds) {
-  const bytes = readFileSync(path);
-  return uploadFile(new Uint8Array(bytes), basename(path), mediaTypeFor(path), expiresInSeconds);
+async function uploadLocalFile(path, expiresInSeconds, onProgress = () => {
+}) {
+  if (statSync2(path).size > SINGLE_REQUEST_MAX_BYTES) {
+    return uploadLargeFile(path, mediaTypeFor(path), expiresInSeconds, onProgress);
+  }
+  const bytes = readFileSync2(path);
+  return uploadFile(new Uint8Array(bytes), basename2(path), mediaTypeFor(path), expiresInSeconds);
 }
 function fileBlock(file) {
   const source = { type: "file", file_id: file.id };
   return file.mime_type.startsWith("image/") ? { type: "image", source } : { type: "document", source, title: file.filename };
 }
-function eventsFor(text, files2, system) {
+function eventsFor(text, files2, system, interactionMode2) {
   const content = [];
   if (text.trim()) content.push({ type: "text", text });
   for (const file of files2) content.push(fileBlock(file));
   if (content.length === 0) throw new Error("nothing to send: pass text, --file or --image");
-  const events = [{ type: "user.message", content }];
+  const events = [{ type: "user.message", content, ...interactionMode2 ? { interaction_mode: interactionMode2 } : {} }];
   if (system?.trim()) events.push({ type: "system.message", content: [{ type: "text", text: system }] });
   return events;
 }
@@ -286,8 +394,8 @@ function renderContextPage(page) {
 }
 
 // src/agent-file.ts
-import { existsSync, readFileSync as readFileSync2, writeFileSync } from "fs";
-import { dirname, resolve } from "path";
+import { existsSync, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
+import { dirname as dirname2, resolve as resolve2 } from "path";
 import { parse as parseToml, stringify as stringifyToml } from "smol-toml";
 var fileInstructionSchema = external_exports.object({
   name: external_exports.string(),
@@ -319,7 +427,7 @@ var agentFileSchema = external_exports.object({
   memory_mb: external_exports.number().int().optional()
 });
 function readAgentFile(path) {
-  const raw = readFileSync2(path, "utf8");
+  const raw = readFileSync3(path, "utf8");
   const parsed = agentFileSchema.safeParse(parseToml(raw));
   if (!parsed.success) {
     const issue = parsed.error.issues[0];
@@ -331,11 +439,11 @@ function readAgentFile(path) {
       `${path}: reasoning_effort '${file.reasoning_effort}' is not available for ${file.type} \u2014 ${reasoningEffortDocLine()}`
     );
   }
-  const base = dirname(resolve(path));
+  const base = dirname2(resolve2(path));
   const inline = (ref, inlineContent) => {
     if (inlineContent !== void 0) return inlineContent;
     if (!ref) return void 0;
-    return readFileSync2(resolve(base, ref), "utf8");
+    return readFileSync3(resolve2(base, ref), "utf8");
   };
   const spec = {
     name: file.name,
@@ -361,14 +469,14 @@ function readAgentFile(path) {
   return { file, spec };
 }
 function stampId(path, id) {
-  const doc = parseToml(readFileSync2(path, "utf8"));
+  const doc = parseToml(readFileSync3(path, "utf8"));
   doc.id = id;
   delete doc.slug;
-  writeFileSync(path, stringifyToml(doc));
+  writeFileSync2(path, stringifyToml(doc));
 }
 function scaffoldAgentFile(path, name) {
   if (existsSync(path)) throw new Error(`${path} already exists`);
-  writeFileSync(
+  writeFileSync2(
     path,
     `# agent.toml \u2014 everything the create wizard can set. Only \`name\` is required.
 name = "${name}"
@@ -454,18 +562,18 @@ function renderCatalogAgent(agent2) {
 
 // src/clone.ts
 import { spawn } from "child_process";
-import { existsSync as existsSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
+import { existsSync as existsSync2, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "fs";
 import { homedir } from "os";
-import { basename as basename2, join } from "path";
+import { basename as basename3, join as join2 } from "path";
 import { createInterface } from "readline";
 var PROMPT_CAP = 1e5;
 var HARNESSES = ["claude_code", "codex", "openclaw"];
 function claudeConfigRoot() {
-  return process.env.CLAUDE_CONFIG_DIR ?? join(homedir(), ".claude");
+  return process.env.CLAUDE_CONFIG_DIR ?? join2(homedir(), ".claude");
 }
 function readIfExists(path) {
   try {
-    return readFileSync3(path, "utf8");
+    return readFileSync4(path, "utf8");
   } catch {
     return void 0;
   }
@@ -481,9 +589,9 @@ function readJson(path) {
 }
 function claudeModel(configRoot) {
   const candidates = [
-    join(process.cwd(), ".claude", "settings.local.json"),
-    join(process.cwd(), ".claude", "settings.json"),
-    join(configRoot, "settings.json")
+    join2(process.cwd(), ".claude", "settings.local.json"),
+    join2(process.cwd(), ".claude", "settings.json"),
+    join2(configRoot, "settings.json")
   ];
   for (const path of candidates) {
     const model = readJson(path)?.model;
@@ -493,11 +601,11 @@ function claudeModel(configRoot) {
 }
 function claudeMcpServers() {
   const merged = {};
-  const userConfig = readJson(join(homedir(), ".claude.json"));
+  const userConfig = readJson(join2(homedir(), ".claude.json"));
   Object.assign(merged, userConfig?.mcpServers ?? {});
   Object.assign(merged, userConfig?.projects?.[process.cwd()]?.mcpServers ?? {});
   const projectConfig = readJson(
-    join(process.cwd(), ".mcp.json")
+    join2(process.cwd(), ".mcp.json")
   );
   Object.assign(merged, projectConfig?.mcpServers ?? {});
   return merged;
@@ -514,13 +622,13 @@ function readClaudeCode() {
   const configRoot = claudeConfigRoot();
   const parts = [];
   const sources = [];
-  const global = readIfExists(join(configRoot, "CLAUDE.md"));
+  const global = readIfExists(join2(configRoot, "CLAUDE.md"));
   if (global?.trim()) {
     parts.push({ label: "Global CLAUDE.md", content: global });
     sources.push("global CLAUDE.md");
   }
   for (const name of ["CLAUDE.md", "AGENTS.md"]) {
-    const project = readIfExists(join(process.cwd(), name));
+    const project = readIfExists(join2(process.cwd(), name));
     if (project?.trim()) {
       parts.push({ label: `Project ${name}`, content: project });
       sources.push(`project ${name}`);
@@ -561,8 +669,8 @@ function detectHarness(explicit) {
     return explicit;
   }
   if (existsSync2(claudeConfigRoot())) return "claude_code";
-  if (existsSync2(join(homedir(), ".codex"))) return "codex";
-  if (existsSync2(join(homedir(), ".openclaw"))) return "openclaw";
+  if (existsSync2(join2(homedir(), ".codex"))) return "codex";
+  if (existsSync2(join2(homedir(), ".openclaw"))) return "openclaw";
   throw new Error(
     "no local harness found (~/.claude, ~/.codex, ~/.openclaw) \u2014 pass --harness to override"
   );
@@ -574,14 +682,14 @@ function readLocal(harness2) {
   );
 }
 function linkPath(configRoot) {
-  return join(configRoot, "agentsky-link.json");
+  return join2(configRoot, "agentsky-link.json");
 }
 function readLink(configRoot) {
   const link = readJson(linkPath(configRoot));
   return link?.agentId ? link : void 0;
 }
 function writeLink(configRoot, link) {
-  writeFileSync2(linkPath(configRoot), `${JSON.stringify(link, null, 2)}
+  writeFileSync3(linkPath(configRoot), `${JSON.stringify(link, null, 2)}
 `);
 }
 var DEFAULT_VAULT_NAME = "default";
@@ -596,10 +704,10 @@ async function ensureDefaultVaultId() {
   const existing = await fetchDefaultVaultId();
   if (existing) return existing;
   try {
-    const { vault } = await api("POST", "/vaults", {
+    const { vault: vault2 } = await api("POST", "/vaults", {
       display_name: DEFAULT_VAULT_NAME
     });
-    return vault.id;
+    return vault2.id;
   } catch (error) {
     if (error instanceof ApiError && error.status === 409) {
       const raced = await fetchDefaultVaultId();
@@ -683,7 +791,7 @@ async function createClone(local, opts) {
     `model ${local.model ?? "(harness default)"}`,
     `${keptNames.length} MCP server${keptNames.length === 1 ? "" : "s"}${keptNames.length ? ` (${keptNames.join(", ")})` : ""}`
   ].join(" \xB7 ");
-  console.log(`Detected ${local.harness} at ${local.configRoot} (project ${basename2(process.cwd())})`);
+  console.log(`Detected ${local.harness} at ${local.configRoot} (project ${basename3(process.cwd())})`);
   console.log(`Will clone: ${summary}`);
   if (local.truncated) console.log("  note: instructions exceeded 100k chars and were truncated");
   if (local.droppedServers.length) {
@@ -820,22 +928,22 @@ async function clone(opts) {
 }
 
 // src/import-local.ts
-import { closeSync, existsSync as existsSync5, openSync, readdirSync as readdirSync2, readFileSync as readFileSync6, readSync, statSync as statSync3 } from "fs";
+import { closeSync as closeSync2, existsSync as existsSync5, openSync as openSync2, readdirSync as readdirSync2, readFileSync as readFileSync7, readSync as readSync2, statSync as statSync5 } from "fs";
 import { homedir as homedir4 } from "os";
-import { join as join4 } from "path";
-import { createHash } from "crypto";
+import { join as join5 } from "path";
+import { createHash as createHash2 } from "crypto";
 
 // src/import-files.ts
 import { isUtf8 } from "buffer";
-import { existsSync as existsSync4, readFileSync as readFileSync5, statSync as statSync2 } from "fs";
+import { existsSync as existsSync4, readFileSync as readFileSync6, statSync as statSync4 } from "fs";
 import { homedir as homedir3 } from "os";
-import { dirname as dirname3, extname as extname2, isAbsolute, join as join3, relative as relative2, resolve as resolve3, sep as sep2, basename as basename4 } from "path";
+import { dirname as dirname4, extname as extname2, isAbsolute, join as join4, relative as relative2, resolve as resolve4, sep as sep2, basename as basename5 } from "path";
 
 // src/import-workspace.ts
 import { spawnSync } from "child_process";
-import { existsSync as existsSync3, readdirSync, readFileSync as readFileSync4, realpathSync, statSync } from "fs";
+import { existsSync as existsSync3, readdirSync, readFileSync as readFileSync5, realpathSync, statSync as statSync3 } from "fs";
 import { homedir as homedir2 } from "os";
-import { basename as basename3, dirname as dirname2, join as join2, relative, sep } from "path";
+import { basename as basename4, dirname as dirname3, join as join3, relative, sep } from "path";
 import { parse as parseToml2 } from "smol-toml";
 var MAX_TREE = 5e3;
 var SKILL_LINE = /Base directory for this skill: (\/[^\s"'\\<>]+)/g;
@@ -845,26 +953,26 @@ function git(cwd, ...args) {
 }
 var isFile = (path) => {
   try {
-    return statSync(path).isFile();
+    return statSync3(path).isFile();
   } catch {
     return false;
   }
 };
 var isDir = (path) => {
   try {
-    return statSync(path).isDirectory();
+    return statSync3(path).isDirectory();
   } catch {
     return false;
   }
 };
 function sharedInstructionPaths(home = homedir2()) {
-  const rules = join2(home, ".agents", "rules");
+  const rules = join3(home, ".agents", "rules");
   let ruleFiles = [];
   try {
-    ruleFiles = readdirSync(rules).filter((name) => name.endsWith(".md")).sort().map((name) => join2(rules, name));
+    ruleFiles = readdirSync(rules).filter((name) => name.endsWith(".md")).sort().map((name) => join3(rules, name));
   } catch {
   }
-  return [join2(home, "AGENTS.md"), join2(home, "MEMORY.md"), ...ruleFiles].filter(isFile);
+  return [join3(home, "AGENTS.md"), join3(home, "MEMORY.md"), ...ruleFiles].filter(isFile);
 }
 function strings(value, out, depth = 0) {
   if (depth > 12) return;
@@ -873,18 +981,18 @@ function strings(value, out, depth = 0) {
   else if (value && typeof value === "object") for (const item of Object.values(value)) strings(item, out, depth + 1);
 }
 function skillRoots(cwd, home) {
-  const claude = process.env.CLAUDE_CONFIG_DIR ?? join2(home, ".claude");
-  const codex = process.env.CODEX_HOME ?? join2(home, ".codex");
+  const claude = process.env.CLAUDE_CONFIG_DIR ?? join3(home, ".claude");
+  const codex = process.env.CODEX_HOME ?? join3(home, ".codex");
   return [
-    ...cwd ? [join2(cwd, ".claude", "skills"), join2(cwd, ".agents", "skills")] : [],
-    join2(home, ".agents", "skills"),
-    join2(claude, "skills"),
-    join2(codex, "skills"),
-    join2(home, ".hermes", "skills")
+    ...cwd ? [join3(cwd, ".claude", "skills"), join3(cwd, ".agents", "skills")] : [],
+    join3(home, ".agents", "skills"),
+    join3(claude, "skills"),
+    join3(codex, "skills"),
+    join3(home, ".hermes", "skills")
   ];
 }
 function pluginSkill(plugin, skill, home) {
-  const base = join2(process.env.CLAUDE_CONFIG_DIR ?? join2(home, ".claude"), "plugins");
+  const base = join3(process.env.CLAUDE_CONFIG_DIR ?? join3(home, ".claude"), "plugins");
   const walk = (dir, depth) => {
     if (depth > 7) return null;
     let entries;
@@ -895,8 +1003,8 @@ function pluginSkill(plugin, skill, home) {
     }
     for (const entry2 of entries) {
       if (!entry2.isDirectory() || entry2.name === "node_modules" || entry2.name === ".git") continue;
-      const path = join2(dir, entry2.name);
-      if (entry2.name === skill && basename3(dir) === "skills" && path.includes(`${sep}${plugin}${sep}`) && isFile(join2(path, "SKILL.md"))) return path;
+      const path = join3(dir, entry2.name);
+      if (entry2.name === skill && basename4(dir) === "skills" && path.includes(`${sep}${plugin}${sep}`) && isFile(join3(path, "SKILL.md"))) return path;
       const found = walk(path, depth + 1);
       if (found) return found;
     }
@@ -908,16 +1016,16 @@ function findSkill(name, cwd, home) {
   const [scope, skill] = name.includes(":") ? name.split(":", 2) : [null, name];
   if (scope && skill) return pluginSkill(scope, skill, home);
   for (const root of skillRoots(cwd, home)) {
-    const direct = join2(root, name);
-    if (isFile(join2(direct, "SKILL.md"))) return realpathSync(direct);
+    const direct = join3(root, name);
+    if (isFile(join3(direct, "SKILL.md"))) return realpathSync(direct);
   }
   return null;
 }
 function loadedSkills(records, touched, cwd, home = homedir2()) {
   const dirs = /* @__PURE__ */ new Map();
   const missing = /* @__PURE__ */ new Set();
-  const add = (dir, name = basename3(dir)) => {
-    if (!isFile(join2(dir, "SKILL.md"))) return false;
+  const add = (dir, name = basename4(dir)) => {
+    if (!isFile(join3(dir, "SKILL.md"))) return false;
     const real = realpathSync(dir);
     if (![...dirs.values()].includes(real)) dirs.set(name, real);
     return true;
@@ -937,13 +1045,13 @@ function loadedSkills(records, touched, cwd, home = homedir2()) {
       if (!dir || !add(dir, name)) missing.add(name);
     }
   }
-  for (const path of touched) if (basename3(path) === "SKILL.md") add(dirname2(path));
+  for (const path of touched) if (basename4(path) === "SKILL.md") add(dirname3(path));
   for (const name of dirs.keys()) missing.delete(name);
   return { found: [...dirs].map(([name, dir]) => ({ name: name.replace(/[^A-Za-z0-9._:-]/g, "-"), dir })), missing: [...missing] };
 }
 function readJson2(path) {
   try {
-    const value = JSON.parse(readFileSync4(path, "utf8"));
+    const value = JSON.parse(readFileSync5(path, "utf8"));
     return value && typeof value === "object" ? value : null;
   } catch {
     return null;
@@ -988,16 +1096,16 @@ function mcpServers(harness2, cwd, home = homedir2()) {
     }
   };
   if (harness2 === "claude_code") {
-    const config = readJson2(join2(process.env.CLAUDE_CONFIG_DIR ? dirname2(process.env.CLAUDE_CONFIG_DIR) : home, ".claude.json"));
+    const config = readJson2(join3(process.env.CLAUDE_CONFIG_DIR ? dirname3(process.env.CLAUDE_CONFIG_DIR) : home, ".claude.json"));
     const projects = config?.projects && typeof config.projects === "object" ? config.projects : {};
     const root = cwd ? git(cwd, "rev-parse", "--show-toplevel")?.trim() || cwd : "";
     if (cwd) push(projects[cwd]?.mcpServers ?? projects[root]?.mcpServers, "local");
-    if (root) push(readJson2(join2(root, ".mcp.json"))?.mcpServers, "project");
+    if (root) push(readJson2(join3(root, ".mcp.json"))?.mcpServers, "project");
     push(config?.mcpServers, "user");
   }
   if (harness2 === "codex") {
     try {
-      const config = parseToml2(readFileSync4(join2(process.env.CODEX_HOME ?? join2(home, ".codex"), "config.toml"), "utf8"));
+      const config = parseToml2(readFileSync5(join3(process.env.CODEX_HOME ?? join3(home, ".codex"), "config.toml"), "utf8"));
       push(config.mcp_servers, "user");
     } catch {
     }
@@ -1007,7 +1115,7 @@ function mcpServers(harness2, cwd, home = homedir2()) {
 function remoteWithoutCredentials(remote) {
   return remote.trim().replace(/\/\/[^@/]+@/, "//").replace(/^[^@/]+@([^:]+):/, "$1:");
 }
-function workspaceState(cwd, harness2, skills2, home = homedir2()) {
+function workspaceState(cwd, harness2, skills2, home = homedir2(), title = null) {
   const present = !!cwd && isDir(cwd);
   const root = present ? git(cwd, "rev-parse", "--show-toplevel")?.trim() || null : null;
   let gitState = null;
@@ -1033,8 +1141,9 @@ function workspaceState(cwd, harness2, skills2, home = homedir2()) {
       format: "agentsky.import-workspace",
       format_version: 1,
       harness: harness2,
+      title: title?.trim().slice(0, 120) || null,
       cwd: cwd ? cwd.replace(home, "~") : null,
-      project: cwd ? basename3(root ?? cwd) : null,
+      project: cwd ? basename4(root ?? cwd) : null,
       git: gitState,
       tree: tree.slice(0, MAX_TREE),
       tree_truncated: tree.length > MAX_TREE,
@@ -1056,7 +1165,7 @@ function skillFiles(skill) {
     }
     for (const entry2 of entries) {
       if (entry2.name === "node_modules" || entry2.name === ".git" || entry2.name === "__pycache__" || entry2.name === ".venv") continue;
-      const path = join2(dir, entry2.name);
+      const path = join3(dir, entry2.name);
       if (entry2.isDirectory()) walk(path, depth + 1);
       else if (entry2.isFile()) out.push({ path, name: `skills/${skill.name}/${relative(skill.dir, path).split(sep).join("/")}` });
     }
@@ -1064,6 +1173,21 @@ function skillFiles(skill) {
   if (existsSync3(skill.dir)) walk(skill.dir, 0);
   return out;
 }
+function codexThreadName(sessionId, home = homedir2()) {
+  let name = null;
+  try {
+    for (const line of readFileSync5(join3(process.env.CODEX_HOME ?? join3(home, ".codex"), "session_index.jsonl"), "utf8").split("\n")) {
+      if (!line.includes(sessionId)) continue;
+      try {
+        const entry2 = JSON.parse(line);
+        if (entry2.id === sessionId && typeof entry2.thread_name === "string" && entry2.thread_name.trim()) name = entry2.thread_name.trim();
+      } catch {
+      }
+    }
+  } catch {
+  }
+  return name;
+}
 
 // src/import-files.ts
 var MAX_ATTACHED_FILE_BYTES = 10 * 1024 * 1024;
@@ -1114,7 +1238,7 @@ function classify(path) {
   if (DOCUMENTS[ext]) return { kind: "document", mediaType: DOCUMENTS[ext] };
   if (IMAGES[ext]) return { kind: "image", mediaType: IMAGES[ext] };
   if (TEXT[ext]) return { kind: "text", mediaType: TEXT[ext] };
-  if (PLAIN_TEXT.has(ext) || PLAIN_NAMES.has(basename4(path))) return { kind: "text", mediaType: "text/plain" };
+  if (PLAIN_TEXT.has(ext) || PLAIN_NAMES.has(basename5(path))) return { kind: "text", mediaType: "text/plain" };
   return null;
 }
 var SHELL_READ = /(?:^|[\s;&|(`"'])(?:cat|head|tail|nl|less|more|wc|bat|sed\s+-n\s+(?:'[^']*'|"[^"]*"|\S+))(?:\s+-[\w-]+(?:\s+\d+)?)*\s+((?:~|\.{0,2}\/)?[\w@%+./~-]*[\w-]\.[\w]{1,10}|\/[\w@%+./-]+)/g;
@@ -1133,8 +1257,8 @@ function touchedPaths(records, cwd, home = homedir3()) {
   const add = (raw, base) => {
     if (!raw || raw.length > 1e3) return;
     const path = raw.replace(/^~(?=\/)/, home);
-    if (isAbsolute(path)) out.add(resolve3(path));
-    else if (base) out.add(resolve3(base, path));
+    if (isAbsolute(path)) out.add(resolve4(path));
+    else if (base) out.add(resolve4(base, path));
   };
   const call = (name, input) => {
     const i = obj(input);
@@ -1171,33 +1295,33 @@ function touchedPaths(records, cwd, home = homedir3()) {
   return [...out];
 }
 function gitRoot(dir) {
-  for (let d = dir; ; d = dirname3(d)) {
-    if (existsSync4(join3(d, ".git"))) return d;
-    if (d === dirname3(d)) return null;
+  for (let d = dir; ; d = dirname4(d)) {
+    if (existsSync4(join4(d, ".git"))) return d;
+    if (d === dirname4(d)) return null;
   }
 }
 function instructionPaths(cwd, harness2, home = homedir3()) {
   const out = [];
   if (cwd && existsSync4(cwd)) {
     const root = gitRoot(cwd) ?? cwd;
-    for (let d = resolve3(cwd); ; d = dirname3(d)) {
-      for (const name of INSTRUCTION_FILES) out.push(join3(d, name));
-      if (d === root || d === dirname3(d)) break;
+    for (let d = resolve4(cwd); ; d = dirname4(d)) {
+      for (const name of INSTRUCTION_FILES) out.push(join4(d, name));
+      if (d === root || d === dirname4(d)) break;
     }
   }
-  if (harness2 === "claude_code") out.push(join3(process.env.CLAUDE_CONFIG_DIR ?? join3(home, ".claude"), "CLAUDE.md"));
-  if (harness2 === "codex") out.push(join3(process.env.CODEX_HOME ?? join3(home, ".codex"), "AGENTS.md"));
+  if (harness2 === "claude_code") out.push(join4(process.env.CLAUDE_CONFIG_DIR ?? join4(home, ".claude"), "CLAUDE.md"));
+  if (harness2 === "codex") out.push(join4(process.env.CODEX_HOME ?? join4(home, ".codex"), "AGENTS.md"));
   out.push(...sharedInstructionPaths(home));
   return out.filter((path) => {
     try {
-      return statSync2(path).isFile();
+      return statSync4(path).isFile();
     } catch {
       return false;
     }
   });
 }
 function resourceName(path, cwd, home = homedir3()) {
-  const inside = cwd ? relative2(resolve3(cwd), path) : "";
+  const inside = cwd ? relative2(resolve4(cwd), path) : "";
   if (cwd && inside && !inside.startsWith("..") && !isAbsolute(inside)) return `workspace/${inside.split(sep2).join("/")}`;
   const underHome = relative2(home, path);
   const shown = !underHome.startsWith("..") && !isAbsolute(underHome) ? `~/${underHome}` : path.replace(/^\/+/, "");
@@ -1209,7 +1333,7 @@ function resourceLine(name, mediaType, data) {
 }
 function collectSessionFiles(records, opts) {
   const home = opts.home ?? homedir3();
-  const exclude = new Set((opts.exclude ?? []).map((path) => resolve3(path)));
+  const exclude = new Set((opts.exclude ?? []).map((path) => resolve4(path)));
   const leftOut = [];
   const candidates = [];
   const seen = /* @__PURE__ */ new Set();
@@ -1224,7 +1348,7 @@ function collectSessionFiles(records, opts) {
     }
     let size;
     try {
-      const stat = statSync2(path);
+      const stat = statSync4(path);
       if (!stat.isFile()) return;
       size = stat.size;
     } catch {
@@ -1248,8 +1372,8 @@ function collectSessionFiles(records, opts) {
   const lines = [];
   const attached = [];
   let bytes = 0;
-  const state = workspaceState(opts.cwd, opts.harness, skills2, home);
-  const described = !!opts.cwd || state.manifest.skills.length > 0 || state.manifest.mcp_servers.length > 0;
+  const state = workspaceState(opts.cwd, opts.harness, skills2, home, opts.title ?? null);
+  const described = !!opts.cwd || !!state.manifest.title || state.manifest.skills.length > 0 || state.manifest.mcp_servers.length > 0;
   const generated = [
     ...described ? [{ name: "agentsky/workspace.json", mediaType: "application/json", data: Buffer.from(JSON.stringify(state.manifest, null, 2)) }] : [],
     ...state.patch ? [{ name: "agentsky/uncommitted.patch", mediaType: "text/x-diff", data: Buffer.from(state.patch) }] : []
@@ -1274,7 +1398,7 @@ function collectSessionFiles(records, opts) {
   for (const file of candidates) {
     let data;
     try {
-      data = readFileSync5(file.path);
+      data = readFileSync6(file.path);
     } catch {
       leftOut.push({ path: file.path, reason: "missing" });
       continue;
@@ -1320,12 +1444,12 @@ function decodeWorkspace(encoded) {
   }
 }
 function readPrefix(filePath) {
-  const fd = openSync(filePath, "r");
+  const fd = openSync2(filePath, "r");
   try {
     const bytes = Buffer.alloc(256 * 1024);
-    return bytes.subarray(0, readSync(fd, bytes, 0, bytes.length, 0)).toString("utf8");
+    return bytes.subarray(0, readSync2(fd, bytes, 0, bytes.length, 0)).toString("utf8");
   } finally {
-    closeSync(fd);
+    closeSync2(fd);
   }
 }
 function sniffTitle(filePath) {
@@ -1380,13 +1504,13 @@ function sniffTitle(filePath) {
   }
 }
 function listClaudeCodeSessions(limit) {
-  const root = process.env.CLAUDE_CONFIG_DIR ?? join4(homedir4(), ".claude");
-  const projectsDir = join4(root, "projects");
+  const root = process.env.CLAUDE_CONFIG_DIR ?? join5(homedir4(), ".claude");
+  const projectsDir = join5(root, "projects");
   if (!existsSync5(projectsDir)) return [];
   const sessions = [];
   try {
     for (const encoded of readdirSync2(projectsDir)) {
-      const projectDir = join4(projectsDir, encoded);
+      const projectDir = join5(projectsDir, encoded);
       let entries;
       try {
         entries = readdirSync2(projectDir);
@@ -1397,22 +1521,22 @@ function listClaudeCodeSessions(limit) {
       for (const entry2 of entries) {
         if (!entry2.endsWith(".jsonl")) continue;
         const sessionId = entry2.slice(0, -6);
-        const mainFile = join4(projectDir, entry2);
+        const mainFile = join5(projectDir, entry2);
         let stat;
         try {
-          stat = statSync3(mainFile);
+          stat = statSync5(mainFile);
         } catch {
           continue;
         }
         if (!stat.isFile()) continue;
         let discoveryError;
         const subagentFiles = [];
-        const subagentDir = join4(projectDir, sessionId, "subagents");
+        const subagentDir = join5(projectDir, sessionId, "subagents");
         if (existsSync5(subagentDir)) {
           try {
             const subFiles = readdirSync2(subagentDir).filter((f) => f.endsWith(".jsonl")).sort();
             for (const f of subFiles) {
-              subagentFiles.push(join4(subagentDir, f));
+              subagentFiles.push(join5(subagentDir, f));
             }
           } catch {
             discoveryError = "Cannot read all recorded subagent conversations. Fix local file access before importing this session.";
@@ -1434,7 +1558,7 @@ function listClaudeCodeSessions(limit) {
   return sessions.sort((a, b) => b.mtimeMs - a.mtimeMs).slice(0, limit);
 }
 function listCodexSessions(limit) {
-  const sessionsDir = join4(process.env.CODEX_HOME ?? process.env.CODEX_CONFIG_DIR ?? join4(homedir4(), ".codex"), "sessions");
+  const sessionsDir = join5(process.env.CODEX_HOME ?? process.env.CODEX_CONFIG_DIR ?? join5(homedir4(), ".codex"), "sessions");
   const records = [];
   function walk(dir) {
     let entries;
@@ -1444,7 +1568,7 @@ function listCodexSessions(limit) {
       return;
     }
     for (const entry2 of entries) {
-      const full = join4(dir, entry2.name);
+      const full = join5(dir, entry2.name);
       if (entry2.isDirectory()) {
         walk(full);
         continue;
@@ -1462,7 +1586,7 @@ function listCodexSessions(limit) {
             sessionId: data.id,
             workspace: typeof data.cwd === "string" ? data.cwd : dir,
             title: sniffTitle(full),
-            mtimeMs: statSync3(full).mtimeMs,
+            mtimeMs: statSync5(full).mtimeMs,
             files: [full]
           },
           ...typeof parent === "string" ? { parent } : {}
@@ -1531,7 +1655,7 @@ async function mintTrace(base, harness2) {
 function loadSummaryFile(summaryPath) {
   let raw;
   try {
-    raw = readFileSync6(summaryPath, "utf8");
+    raw = readFileSync7(summaryPath, "utf8");
   } catch {
     throw new Error(`Cannot read summary file: ${summaryPath}`);
   }
@@ -1563,7 +1687,7 @@ function prepareImport(session2, summaryPath, options = {}) {
   let inputBytes = 0;
   let outputBytes = 0;
   const lines = [];
-  const digest = createHash("sha256");
+  const digest = createHash2("sha256");
   let nativeId;
   let redactionCount = 0;
   let encryptedReasoningCount = 0;
@@ -1572,9 +1696,9 @@ function prepareImport(session2, summaryPath, options = {}) {
   const source = new SessionSourceCollector();
   const records = [];
   for (const path of session2.files) {
-    const stat = statSync3(path);
+    const stat = statSync5(path);
     if (!stat.isFile() || (inputBytes += stat.size) > maximum) throw new Error("Selected transcript exceeds the 16 MiB limit or is not a regular file.");
-    const text = readFileSync6(path, "utf8");
+    const text = readFileSync7(path, "utf8");
     for (const raw of text.split("\n")) {
       if (!raw.trim()) continue;
       let record;
@@ -1613,7 +1737,13 @@ function prepareImport(session2, summaryPath, options = {}) {
   const sourceId = nativeId ?? session2.sessionId;
   if (!/^[A-Za-z0-9_-]{1,200}$/.test(sourceId) || redactLine2(JSON.stringify(sourceId)) !== JSON.stringify(sourceId)) throw new Error("The source conversation has an invalid identifier.");
   const meta = source.result();
-  const files2 = options.files === false ? { lines: [], bytes: 0, attached: [], leftOut: [], setup: { skills: [], missingSkills: [], mcpServers: [], git: false } } : collectSessionFiles(records, { harness: session2.harness, cwd: meta.cwd ?? (session2.harness === "claude_code" ? session2.workspace : ""), budget: MAX_IMPORT_BYTES - outputBytes - SUMMARY_RESERVE_BYTES, exclude: session2.files });
+  const files2 = options.files === false ? { lines: [], bytes: 0, attached: [], leftOut: [], setup: { skills: [], missingSkills: [], mcpServers: [], git: false } } : collectSessionFiles(records, {
+    harness: session2.harness,
+    cwd: meta.cwd ?? (session2.harness === "claude_code" ? session2.workspace : ""),
+    budget: MAX_IMPORT_BYTES - outputBytes - SUMMARY_RESERVE_BYTES,
+    exclude: session2.files,
+    title: meta.title ?? (session2.harness === "codex" ? codexThreadName(session2.sessionId) : null)
+  });
   const attachedNote = files2.attached.length ? ` The ${files2.attached.length} local ${files2.attached.length === 1 ? "file" : "files"} it read, wrote or ran under, the skills it loaded and its workspace description (repository state and tool servers, agentsky/workspace.json) are attached as well (listed in artifacts).` : "";
   let summaryJson;
   if (summaryPath) {
@@ -1650,8 +1780,8 @@ function prepareImport(session2, summaryPath, options = {}) {
 }
 async function importSession(opts) {
   const base = (opts.agentUseUrl ?? agentUseBase()).replace(/\/$/, "");
-  const destination = new URL(base);
-  if (destination.username || destination.password || destination.protocol !== "https:" && !(destination.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(destination.hostname))) {
+  const destination2 = new URL(base);
+  if (destination2.username || destination2.password || destination2.protocol !== "https:" && !(destination2.protocol === "http:" && ["localhost", "127.0.0.1", "[::1]"].includes(destination2.hostname))) {
     throw new Error("Import requires HTTPS, or a loopback development server.");
   }
   opts.onProgress?.("Reading transcript and redacting secrets locally\u2026");
@@ -1694,8 +1824,59 @@ async function importSession(opts) {
   };
 }
 
+// src/channels.ts
+function connectionLine(c) {
+  const route = c.bound_session ? `\u2192 ${c.bound_session.id}${c.bound_session.label ? ` (${c.bound_session.label})` : ""}` : "unrouted";
+  return `${c.id}  ${c.platform.padEnd(9)} ${c.status.padEnd(12)} ${c.label ?? ""}  ${route}`;
+}
+function connectSteps(c) {
+  const steps = [];
+  if (c.connect?.url) steps.push(`Open: ${c.connect.url}`);
+  if (c.connect?.phone && c.connect.code) steps.push(`Text ${c.connect.code} to ${c.connect.phone}`);
+  else if (c.connect?.app_id && c.connect.code) steps.push(`Send ${c.connect.code} to the bot (app ${c.connect.app_id})`);
+  else if (c.connect?.code) steps.push(`Send ${c.connect.code} to the bot`);
+  if (c.connect?.expires_at) steps.push(`Expires ${c.connect.expires_at.replace("T", " ").slice(0, 16)}`);
+  return steps;
+}
+function destination(opts) {
+  if (Boolean(opts.session) === Boolean(opts.webhook)) {
+    throw new ApiError(400, "invalid_destination", "pass exactly one of --session or --webhook");
+  }
+  return opts.session ? { session: opts.session } : { webhook: opts.webhook };
+}
+async function listConnections() {
+  return (await api("GET", "/channels/connections")).connections;
+}
+async function connect(platform, opts) {
+  return api("POST", "/channels/connections", {
+    platform,
+    ...opts.label ? { label: opts.label } : {},
+    ...opts.app ? { app: opts.app } : {},
+    ...opts.session || opts.webhook ? { destination: destination(opts) } : {}
+  });
+}
+async function waitConnected(id, opts = {}) {
+  const deadline = Date.now() + (opts.timeoutMs ?? 10 * 6e4);
+  for (; ; ) {
+    const found = (await listConnections()).find((c) => c.id === id);
+    if (!found) throw new ApiError(404, "not_found", `connection ${id} is gone`);
+    if (found.status !== "PENDING") return found;
+    if (Date.now() > deadline) throw new ApiError(408, "connect_timeout", "the connection was not claimed within 10 minutes");
+    await new Promise((r) => setTimeout(r, opts.pollMs ?? 3e3));
+  }
+}
+async function bind(connectionId, opts) {
+  await api("PUT", `/channels/connections/${encodeURIComponent(connectionId)}/binding`, { destination: destination(opts) });
+}
+async function send(threadId, text) {
+  await api("POST", `/channels/threads/${encodeURIComponent(threadId)}/messages`, { parts: [{ type: "markdown", text }] });
+}
+
+// src/connectors.ts
+import { createServer as createServer2 } from "http";
+
 // src/login.ts
-import { createHash as createHash2, randomBytes } from "crypto";
+import { createHash as createHash3, randomBytes } from "crypto";
 import { createServer } from "http";
 import { hostname } from "os";
 import { spawn as spawn2 } from "child_process";
@@ -1711,7 +1892,7 @@ function openBrowser2(url) {
 }
 async function login(opts) {
   const verifier = b64url(randomBytes(32));
-  const challenge = b64url(createHash2("sha256").update(verifier).digest());
+  const challenge = b64url(createHash3("sha256").update(verifier).digest());
   const result = opts.noBrowser ? await headlessLogin(verifier, challenge) : await browserLogin(verifier, challenge);
   saveConfig({
     ...loadConfig(),
@@ -1727,7 +1908,7 @@ async function login(opts) {
 }
 async function browserLogin(verifier, challenge) {
   const state = b64url(randomBytes(16));
-  const code = await new Promise((resolve8, reject) => {
+  const code = await new Promise((resolve10, reject) => {
     const server = createServer((req, res) => {
       const url = new URL(req.url ?? "/", "http://127.0.0.1");
       if (url.pathname !== "/callback") {
@@ -1740,7 +1921,7 @@ async function browserLogin(verifier, challenge) {
       if (url.searchParams.get("state") !== state || !got) {
         reject(new Error("login callback state mismatch"));
       } else {
-        resolve8(got);
+        resolve10(got);
       }
       server.close();
     });
@@ -1793,18 +1974,244 @@ async function headlessLogin(verifier, challenge) {
   throw new Error("login timed out after 10 minutes");
 }
 
+// src/connectors.ts
+async function listApps(query, limit = 50) {
+  const apps = [];
+  let cursor = null;
+  do {
+    const params = new URLSearchParams();
+    if (query) params.set("q", query);
+    if (cursor) params.set("cursor", cursor);
+    const qs = params.toString();
+    const page = await api("GET", `/connectors/apps${qs ? `?${qs}` : ""}`);
+    apps.push(...page.apps);
+    cursor = page.next_cursor;
+  } while (cursor && apps.length < limit);
+  return apps.slice(0, limit);
+}
+function connectionLine2(c) {
+  return `${c.id}  ${c.app_name} (${c.app})  ${c.label}  since ${c.created_at.slice(0, 10)}`;
+}
+function workspaceConnectionLine(c) {
+  const owner = c.workspace_owned ? "the workspace" : c.mine ? "you" : c.shared_by?.name ?? c.shared_by?.user_id ?? "someone";
+  return `${c.connection_id}  ${c.app_name} (${c.app})  ${c.label}  shared by ${owner}`;
+}
+function browserReturn(start, opts = {}) {
+  return new Promise((resolve10, reject) => {
+    const server = createServer2((req, res) => {
+      const url = new URL(req.url ?? "/", "http://127.0.0.1");
+      if (url.pathname !== "/done" && url.pathname !== "/failed") {
+        res.writeHead(404).end();
+        return;
+      }
+      const ok = url.pathname === "/done";
+      res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
+      res.end(ok ? "<p>Connected \u2014 you can close this tab and return to your terminal.</p>" : "<p>The app was not connected. Return to your terminal.</p>");
+      server.close();
+      if (ok) resolve10(url.searchParams.get("account_id") ?? void 0);
+      else reject(new ApiError(400, "connect_failed", "the app was not connected"));
+    });
+    server.listen(0, "127.0.0.1", () => {
+      const address = server.address();
+      const port = typeof address === "object" && address ? address.port : 0;
+      const base = `http://127.0.0.1:${port}`;
+      start(`${base}/done`, `${base}/failed`).then(
+        (authorizeUrl) => {
+          console.log(`Authorize access in your browser:
+  ${authorizeUrl}`);
+          if (opts.open !== false) openBrowser2(authorizeUrl);
+        },
+        (err) => {
+          server.close();
+          reject(err);
+        }
+      );
+    });
+    setTimeout(() => {
+      server.close();
+      reject(new ApiError(408, "connect_timeout", "nobody finished the authorization within 10 minutes"));
+    }, opts.timeoutMs ?? 10 * 6e4).unref();
+  });
+}
+async function connectApp(app, opts = {}) {
+  const base = opts.workspace ? `/universes/${encodeURIComponent(opts.workspace)}/connections` : "/connectors/connections";
+  const accountId = await browserReturn(async (success_url, error_url) => {
+    const { url } = await api("POST", base, { app, success_url, error_url });
+    return url;
+  }, { open: opts.open });
+  const done = await api("POST", `${base}/complete`, {
+    app,
+    ...accountId ? { account_id: accountId } : {}
+  });
+  return done.connection;
+}
+
+// src/routine-triggers.ts
+var triggerPath = (id, resource) => `/routines/${encodeURIComponent(id)}/${resource}`;
+function inboundLine(u) {
+  if (!u) return "no inbound URL \u2014 make one with --create";
+  return u.url ?? `inbound URL ${u.prefix}\u2026 made ${u.created_at.slice(0, 10)}${u.last_used_at ? `, last used ${u.last_used_at.slice(0, 16).replace("T", " ")}` : ", never used"}`;
+}
+function precheckLine(p) {
+  if (!p) return "no precheck: every scheduled fire runs";
+  const last = p.last_result ? `last check ${p.last_result}${p.last_error ? ` (${p.last_error.type}: ${p.last_error.message})` : ""}` : "not checked yet";
+  return `fires only when ${p.url} changes \xB7 ${last}`;
+}
+function triggerLine(t, available = true) {
+  if (!t) return "no chat trigger";
+  const where = t.thread_id ? `thread ${t.thread_id} on ${t.connection_id}` : `any conversation on ${t.connection_id}`;
+  const what = t.text_prefix ? `messages starting "${t.text_prefix}"` : "every message";
+  return `${what} in ${where} start a run${available ? "" : " (chat messages are not offered to routines in this deployment)"}`;
+}
+function deliverLine(d) {
+  return d ? `answers post to thread ${d.thread_id} on ${d.connection_id}` : "answers are posted nowhere";
+}
+function triggerBody(opts) {
+  if (!opts.connection) throw new ApiError(400, "invalid_request", "--connection is required (see `sky channel list`)");
+  return { connection_id: opts.connection, ...opts.thread ? { thread_id: opts.thread } : {}, ...opts.prefix ? { text_prefix: opts.prefix } : {} };
+}
+function deliverBody(opts) {
+  if (!opts.connection) throw new ApiError(400, "invalid_request", "--connection is required (see `sky channel list`)");
+  return { type: "channel_thread", connection_id: opts.connection, ...opts.thread ? { thread_id: opts.thread } : {} };
+}
+async function triggerRequest(id, resource, change) {
+  const path = triggerPath(id, resource);
+  if (change.remove) return api("DELETE", path);
+  if (change.create) return api("POST", path);
+  if (change.body) return api("PUT", path, change.body);
+  return api("GET", path);
+}
+
+// src/session-workspace.ts
+import { spawnSync as spawnSync2 } from "child_process";
+import { createHash as createHash4, randomUUID } from "crypto";
+import { readdirSync as readdirSync3, statSync as statSync6 } from "fs";
+import { basename as basename6, join as join6, relative as relative3, resolve as resolve5 } from "path";
+var SINGLE_IMPORT_MAX = 25 * 1024 * 1024;
+var PART_SIZE = 8 * 1024 * 1024;
+var SKIPPED = /* @__PURE__ */ new Set([".git", "node_modules"]);
+var workspacePath = (id) => `/sessions/${encodeURIComponent(id)}/workspace`;
+async function listFiles(id, path, hidden) {
+  const query = new URLSearchParams();
+  if (path) query.set("path", path);
+  if (hidden) query.set("hidden", "true");
+  const qs = query.toString();
+  return api("GET", `${workspacePath(id)}/files${qs ? `?${qs}` : ""}`);
+}
+function entryLine(e) {
+  const size = e.type === "directory" ? "-" : String(e.size ?? 0);
+  return `${e.type === "directory" ? "d" : "-"} ${size.padStart(10)}  ${(e.mtime ?? "").slice(0, 16).replace("T", " ")}  ${e.name}${e.type === "directory" ? "/" : ""}`;
+}
+async function readFile(id, path) {
+  return (await apiBytes("GET", `${workspacePath(id)}/files/content?path=${encodeURIComponent(path)}`)).bytes;
+}
+function renderChanges(changes) {
+  if (!changes.repos.length) return [`no git repository under ${changes.root}`];
+  return changes.repos.flatMap((r) => [
+    `${r.path === "." ? changes.root : r.path}: ${r.status ? "changed" : "clean"}`,
+    ...(r.stat ?? r.status ?? "").split("\n").filter(Boolean).map((line) => `  ${line}`)
+  ]);
+}
+async function workspacePatch(id, repo) {
+  const { patch, ...meta } = await api("POST", `${workspacePath(id)}/patch`, { repo });
+  return { meta, patch: Buffer.from(patch, "base64") };
+}
+function folderFiles(dir) {
+  const git2 = spawnSync2("git", ["-C", dir, "ls-files", "-z", "--cached", "--others", "--exclude-standard"], { encoding: "utf8" });
+  const top = spawnSync2("git", ["-C", dir, "rev-parse", "--show-prefix"], { encoding: "utf8" });
+  if (git2.status === 0 && top.status === 0) {
+    return git2.stdout.split("\0").filter((path) => path && statSync6(join6(dir, path), { throwIfNoEntry: false })?.isFile());
+  }
+  const files2 = [];
+  const walk = (at) => {
+    for (const entry2 of readdirSync3(at, { withFileTypes: true })) {
+      if (SKIPPED.has(entry2.name)) continue;
+      const full = join6(at, entry2.name);
+      if (entry2.isDirectory()) walk(full);
+      else if (entry2.isFile()) files2.push(relative3(dir, full));
+    }
+  };
+  walk(dir);
+  return files2;
+}
+function folderArchive(dir, files2) {
+  const tar = spawnSync2("tar", ["--format=ustar", "-czf", "-", "-C", dir, "-T", "-"], {
+    input: files2.join("\n"),
+    env: { ...process.env, COPYFILE_DISABLE: "1" },
+    maxBuffer: 2 * 1024 * 1024 * 1024
+  });
+  if (tar.status !== 0) throw new ApiError(400, "archive_failed", `tar failed: ${tar.stderr.toString().trim()}`);
+  return tar.stdout;
+}
+async function importFolder(id, dir, opts = {}) {
+  const root = resolve5(dir);
+  const name = opts.name ?? basename6(root);
+  const archive = opts.archive ?? folderArchive(root, folderFiles(root));
+  if (archive.length <= SINGLE_IMPORT_MAX) {
+    const res = await apiBytes("POST", `${workspacePath(id)}/import?name=${encodeURIComponent(name)}`, { bytes: archive, mediaType: "application/gzip" });
+    return res.json();
+  }
+  const sha256 = createHash4("sha256").update(archive).digest("hex");
+  let upload = await api("POST", `${workspacePath(id)}/imports`, { name, size: archive.length, sha256, part_size: PART_SIZE });
+  const uploadPath = `${workspacePath(id)}/imports/${encodeURIComponent(upload.id)}`;
+  for (let part = 0; part < upload.parts; part += 1) {
+    if (upload.received.includes(part)) continue;
+    const bytes = archive.subarray(part * upload.part_size, (part + 1) * upload.part_size);
+    await apiBytes("PUT", `${uploadPath}/parts/${part}`, { bytes, mediaType: "application/octet-stream" });
+  }
+  upload = await api("POST", `${uploadPath}/complete`);
+  while (upload.state !== "imported" && upload.state !== "failed") {
+    await new Promise((r) => setTimeout(r, opts.pollMs ?? 2e3));
+    upload = await api("GET", uploadPath);
+  }
+  if (upload.state === "failed") throw new ApiError(422, upload.error?.code ?? "import_failed", upload.error?.message ?? "the import failed");
+  return { path: upload.path ?? name, files: upload.files ?? 0 };
+}
+function renderAccess(a) {
+  const lines = [
+    `${a.session_id}${a.title ? ` \u2014 ${a.title}` : ""}`,
+    `  ${a.visibility === "private" ? "private to its owner" : `visible to ${a.workspace.name} (${a.workspace.slug})`} \xB7 you are its ${a.access}`,
+    `  owner: ${a.owner.name ?? a.owner.email ?? "unknown"}`
+  ];
+  if (a.viewers) lines.push(a.viewers.length ? `  viewers: ${a.viewers.map((v) => v.email).join(", ")}` : "  viewers: none");
+  return lines;
+}
+function accessPatch(opts) {
+  if (opts.private && opts.members) throw new ApiError(400, "invalid_request", "pass --private or --members, not both");
+  return {
+    ...opts.private ? { visibility: "private" } : opts.members ? { visibility: "workspace" } : {},
+    ...opts.addViewer?.length ? { add_viewers: opts.addViewer } : {},
+    ...opts.removeViewer?.length ? { remove_viewers: opts.removeViewer } : {}
+  };
+}
+var TERMINAL = /* @__PURE__ */ new Set(["completed", "failed", "cancelled"]);
+async function handoff(id, targetAgent, opts = {}) {
+  let { handoff: h } = await api("POST", `/sessions/${encodeURIComponent(id)}/handoff`, {
+    target_agent: targetAgent,
+    ...opts.fromMessage ? { last_message_id: opts.fromMessage } : {}
+  }, { idempotencyKey: opts.idempotencyKey ?? randomUUID() });
+  opts.onStatus?.(h);
+  while (opts.wait && !TERMINAL.has(h.status)) {
+    await new Promise((r) => setTimeout(r, opts.pollMs ?? 2e3));
+    const next = (await api("GET", `/session-handoffs/${encodeURIComponent(h.id)}`)).handoff;
+    if (next.status !== h.status) opts.onStatus?.(next);
+    h = next;
+  }
+  return h;
+}
+
 // src/local-agents.ts
 import { existsSync as existsSync6 } from "fs";
 import { homedir as homedir5 } from "os";
-import { join as join5 } from "path";
+import { join as join7 } from "path";
 function localAgents(env = process.env, home = homedir5()) {
-  const claude = env.CLAUDE_CONFIG_DIR || join5(home, ".claude");
-  const codex = env.CODEX_HOME || join5(home, ".codex");
-  const cursor = join5(home, ".cursor");
+  const claude = env.CLAUDE_CONFIG_DIR || join7(home, ".claude");
+  const codex = env.CODEX_HOME || join7(home, ".codex");
+  const cursor = join7(home, ".cursor");
   return [
-    { id: "claude_code", name: "Claude Code", root: claude, skillsDir: join5(claude, "skills") },
-    { id: "codex", name: "Codex", root: codex, skillsDir: join5(codex, "skills") },
-    { id: "cursor", name: "Cursor", root: cursor, skillsDir: join5(cursor, "skills") }
+    { id: "claude_code", name: "Claude Code", root: claude, skillsDir: join7(claude, "skills") },
+    { id: "codex", name: "Codex", root: codex, skillsDir: join7(codex, "skills") },
+    { id: "cursor", name: "Cursor", root: cursor, skillsDir: join7(cursor, "skills") }
   ];
 }
 function detectLocalAgents(env = process.env, home = homedir5()) {
@@ -1904,21 +2311,21 @@ async function readTurn(sessionId, opts = {}) {
   for (; ; ) {
     const reading = latestTurn(await history(sessionId));
     if (reading.finished || !opts.wait || Date.now() >= deadline) return reading;
-    await new Promise((resolve8) => setTimeout(resolve8, opts.intervalMs ?? 3e3));
+    await new Promise((resolve10) => setTimeout(resolve10, opts.intervalMs ?? 3e3));
   }
 }
 
 // src/setup.ts
-import { mkdirSync as mkdirSync2, readFileSync as readFileSync10, writeFileSync as writeFileSync4 } from "fs";
-import { dirname as dirname5, join as join9 } from "path";
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync11, writeFileSync as writeFileSync5 } from "fs";
+import { dirname as dirname6, join as join11 } from "path";
 import { createInterface as createInterface3 } from "readline";
 
 // src/mcp-register.ts
-import { spawnSync as spawnSync2 } from "child_process";
+import { spawnSync as spawnSync3 } from "child_process";
 
 // src/skill.ts
-import { mkdirSync, readFileSync as readFileSync7, writeFileSync as writeFileSync3 } from "fs";
-import { join as join6 } from "path";
+import { mkdirSync as mkdirSync2, readFileSync as readFileSync8, writeFileSync as writeFileSync4 } from "fs";
+import { join as join8 } from "path";
 
 // src/catalog-file.ts
 var CATALOG_FILE = "catalog.md";
@@ -2359,7 +2766,7 @@ To set a per-repo default, create \`.agentsky.json\` at the git root:
 }
 function installedVersion(dir) {
   try {
-    const marker = JSON.parse(readFileSync7(join6(dir, SKILL_MARKER), "utf8"));
+    const marker = JSON.parse(readFileSync8(join8(dir, SKILL_MARKER), "utf8"));
     return typeof marker.version === "string" ? marker.version : null;
   } catch {
     return null;
@@ -2369,25 +2776,25 @@ function isInstalledSkill(dir) {
   return installedVersion(dir) !== null;
 }
 function installSkill(agent2, opts = {}) {
-  const dir = join6(agent2.skillsDir, SKILL_NAME);
+  const dir = join8(agent2.skillsDir, SKILL_NAME);
   const previous = installedVersion(dir);
   const outcome = previous === CLI_VERSION ? "current" : previous ? "updated" : "installed";
   if (opts.dryRun) return { agent: agent2.id, path: dir, outcome };
   if (outcome !== "current") {
-    mkdirSync(dir, { recursive: true });
-    writeFileSync3(join6(dir, "SKILL.md"), skillDocument());
-    writeFileSync3(join6(dir, SKILL_MARKER), `${JSON.stringify({ version: CLI_VERSION }, null, 2)}
+    mkdirSync2(dir, { recursive: true });
+    writeFileSync4(join8(dir, "SKILL.md"), skillDocument());
+    writeFileSync4(join8(dir, SKILL_MARKER), `${JSON.stringify({ version: CLI_VERSION }, null, 2)}
 `);
   }
   if (opts.catalog) {
-    mkdirSync(dir, { recursive: true });
-    writeFileSync3(join6(dir, CATALOG_FILE), renderCatalog(opts.catalog, opts.now ?? /* @__PURE__ */ new Date()));
-  }
-  const refsDir = join6(dir, REFERENCES_DIR);
-  mkdirSync(refsDir, { recursive: true });
-  writeFileSync3(join6(refsDir, "import.md"), importReferenceDoc());
-  writeFileSync3(join6(refsDir, "workspaces.md"), workspacesReferenceDoc());
-  writeFileSync3(join6(refsDir, "focused-agents.md"), focusedAgentsReferenceDoc());
+    mkdirSync2(dir, { recursive: true });
+    writeFileSync4(join8(dir, CATALOG_FILE), renderCatalog(opts.catalog, opts.now ?? /* @__PURE__ */ new Date()));
+  }
+  const refsDir = join8(dir, REFERENCES_DIR);
+  mkdirSync2(refsDir, { recursive: true });
+  writeFileSync4(join8(refsDir, "import.md"), importReferenceDoc());
+  writeFileSync4(join8(refsDir, "workspaces.md"), workspacesReferenceDoc());
+  writeFileSync4(join8(refsDir, "focused-agents.md"), focusedAgentsReferenceDoc());
   return { agent: agent2.id, path: dir, outcome };
 }
 
@@ -2396,9 +2803,9 @@ var MCP_SERVER_NAME = SKILL_NAME;
 var CODEX_TOKEN_ENV = "AGENTSKY_API_KEY";
 function systemCommandRunner() {
   return {
-    has: (command) => spawnSync2(command, ["--version"], { stdio: "ignore" }).status === 0,
+    has: (command) => spawnSync3(command, ["--version"], { stdio: "ignore" }).status === 0,
     run: (command, args) => {
-      const result = spawnSync2(command, args, { encoding: "utf8" });
+      const result = spawnSync3(command, args, { encoding: "utf8" });
       return { status: result.status, stderr: result.stderr ?? "" };
     }
   };
@@ -2439,9 +2846,9 @@ function registerMcpServer(agent2, opts, runner = systemCommandRunner()) {
 
 // src/setup-local.ts
 import { isUtf8 as isUtf82 } from "buffer";
-import { existsSync as existsSync7, readdirSync as readdirSync3, readFileSync as readFileSync8, statSync as statSync4 } from "fs";
+import { existsSync as existsSync7, readdirSync as readdirSync4, readFileSync as readFileSync9, statSync as statSync7 } from "fs";
 import { homedir as homedir6 } from "os";
-import { dirname as dirname4, isAbsolute as isAbsolute2, join as join7, resolve as resolve4 } from "path";
+import { dirname as dirname5, isAbsolute as isAbsolute2, join as join9, resolve as resolve6 } from "path";
 import { parse as parseToml3 } from "smol-toml";
 var MAX_SKILL_FILE_BYTES = 1024 * 1024;
 var MAX_IMPORT_DEPTH = 5;
@@ -2465,12 +2872,12 @@ function redacted(data) {
 }
 function skillFiles2(root, prefix) {
   const files2 = [];
-  for (const entry2 of readdirSync3(root, { withFileTypes: true })) {
-    const path = join7(root, entry2.name);
+  for (const entry2 of readdirSync4(root, { withFileTypes: true })) {
+    const path = join9(root, entry2.name);
     if (entry2.isDirectory()) {
       if (!SKIPPED_DIRS.has(entry2.name)) files2.push(...skillFiles2(path, `${prefix}/${entry2.name}`));
-    } else if (entry2.isFile() && !sensitive(entry2.name) && statSync4(path).size <= MAX_SKILL_FILE_BYTES) {
-      const bytes = redacted(readFileSync8(path));
+    } else if (entry2.isFile() && !sensitive(entry2.name) && statSync7(path).size <= MAX_SKILL_FILE_BYTES) {
+      const bytes = redacted(readFileSync9(path));
       if (bytes) files2.push({ path: `${prefix}/${entry2.name}`, bytes });
     }
   }
@@ -2481,18 +2888,18 @@ function readLocalSkills(agents) {
   const ignored = [];
   for (const agent2 of agents) {
     if (!existsSync7(agent2.skillsDir)) continue;
-    for (const entry2 of readdirSync3(agent2.skillsDir, { withFileTypes: true })) {
-      const dir = join7(agent2.skillsDir, entry2.name);
+    for (const entry2 of readdirSync4(agent2.skillsDir, { withFileTypes: true })) {
+      const dir = join9(agent2.skillsDir, entry2.name);
       let isDir2 = entry2.isDirectory();
       if (entry2.isSymbolicLink()) {
         try {
-          isDir2 = statSync4(dir).isDirectory();
+          isDir2 = statSync7(dir).isDirectory();
         } catch {
           isDir2 = false;
         }
       }
-      if (!isDir2 || !existsSync7(join7(dir, "SKILL.md")) || isInstalledSkill(dir)) continue;
-      const name = frontmatterName(readFileSync8(join7(dir, "SKILL.md"), "utf8"));
+      if (!isDir2 || !existsSync7(join9(dir, "SKILL.md")) || isInstalledSkill(dir)) continue;
+      const name = frontmatterName(readFileSync9(join9(dir, "SKILL.md"), "utf8"));
       if (!name) {
         ignored.push({ agent: agent2.id, dir, reason: "SKILL.md has no name" });
         continue;
@@ -2520,11 +2927,11 @@ function inlineImports(content, from, home, depth, seen) {
     }
     const target = fence ? void 0 : line.match(/^@(\S+\.(?:md|markdown|txt))$/i)?.[1];
     if (!target || depth >= MAX_IMPORT_DEPTH) return line;
-    const path = target.startsWith("~/") ? join7(home, target.slice(2)) : isAbsolute2(target) ? target : resolve4(dirname4(from), target);
+    const path = target.startsWith("~/") ? join9(home, target.slice(2)) : isAbsolute2(target) ? target : resolve6(dirname5(from), target);
     if (seen.includes(path)) return "";
     let imported;
     try {
-      imported = readFileSync8(path, "utf8");
+      imported = readFileSync9(path, "utf8");
     } catch {
       return line;
     }
@@ -2537,10 +2944,10 @@ function readGlobalInstructions(agents, home = homedir6()) {
   for (const agent2 of agents) {
     const file = INSTRUCTION_FILES2[agent2.id];
     if (!file) continue;
-    const path = join7(agent2.root, file);
+    const path = join9(agent2.root, file);
     let raw;
     try {
-      raw = readFileSync8(path, "utf8");
+      raw = readFileSync9(path, "utf8");
     } catch {
       continue;
     }
@@ -2559,7 +2966,7 @@ ${item.content.trim()}`).join("\n\n");
 }
 function readJson3(path) {
   try {
-    return JSON.parse(readFileSync8(path, "utf8"));
+    return JSON.parse(readFileSync9(path, "utf8"));
   } catch {
     return void 0;
   }
@@ -2573,10 +2980,10 @@ function bearerOf(def) {
   return match?.[1] ?? null;
 }
 function serversOf(agent2, home) {
-  if (agent2.id === "claude_code") return readJson3(join7(home, ".claude.json"))?.mcpServers ?? {};
-  if (agent2.id === "cursor") return readJson3(join7(agent2.root, "mcp.json"))?.mcpServers ?? {};
+  if (agent2.id === "claude_code") return readJson3(join9(home, ".claude.json"))?.mcpServers ?? {};
+  if (agent2.id === "cursor") return readJson3(join9(agent2.root, "mcp.json"))?.mcpServers ?? {};
   try {
-    return parseToml3(readFileSync8(join7(agent2.root, "config.toml"), "utf8")).mcp_servers ?? {};
+    return parseToml3(readFileSync9(join9(agent2.root, "config.toml"), "utf8")).mcp_servers ?? {};
   } catch {
     return {};
   }
@@ -2597,9 +3004,9 @@ function findLocalSecrets(agents, home = homedir6()) {
 
 // src/subscriptions.ts
 import { spawn as spawn3 } from "child_process";
-import { existsSync as existsSync8, readFileSync as readFileSync9 } from "fs";
+import { existsSync as existsSync8, readFileSync as readFileSync10 } from "fs";
 import { homedir as homedir7 } from "os";
-import { join as join8 } from "path";
+import { join as join10 } from "path";
 import { createInterface as createInterface2 } from "readline";
 var ALIASES = {
   claude: "anthropic",
@@ -2615,14 +3022,24 @@ function providerFor(name) {
   }
   return provider;
 }
+var MANAGED_ALIASES = {
+  ...ALIASES,
+  cursor: "cursor",
+  grok: "xai",
+  xai: "xai",
+  muse: "meta",
+  meta: "meta"
+};
 function managedProviderFor(name) {
-  if (name.toLowerCase() === "cursor") return "cursor";
-  const provider = ALIASES[name.toLowerCase()];
+  const provider = MANAGED_ALIASES[name.toLowerCase()];
   if (!provider) {
-    throw new ApiError(400, "unknown_provider", `unknown provider "${name}" \u2014 use claude, chatgpt or cursor`);
+    throw new ApiError(400, "unknown_provider", `unknown provider "${name}" \u2014 use claude, chatgpt, cursor, grok or muse`);
   }
   return provider;
 }
+function accountQuery(account) {
+  return account ? `?accountId=${encodeURIComponent(account)}` : "";
+}
 function ask(question) {
   return new Promise((done) => {
     const rl = createInterface2({ input: process.stdin, output: process.stdout });
@@ -2685,11 +3102,11 @@ async function connectClaude() {
   console.log(`Connected Claude subscription${expiry}. Powers new eligible agents.`);
 }
 function codexSignIn(env = process.env, home = homedir7()) {
-  const path = join8(env.CODEX_HOME || join8(home, ".codex"), "auth.json");
+  const path = join10(env.CODEX_HOME || join10(home, ".codex"), "auth.json");
   if (!existsSync8(path)) {
     throw new ApiError(404, "no_codex_auth", `no ${path} \u2014 run \`codex login\` first`);
   }
-  const raw = readFileSync9(path, "utf8");
+  const raw = readFileSync10(path, "utf8");
   try {
     const parsed = JSON.parse(raw);
     return { path, raw, account: parsed.tokens?.account_id };
@@ -2698,11 +3115,11 @@ function codexSignIn(env = process.env, home = homedir7()) {
   }
 }
 function cursorSignIn(env = process.env, home = homedir7()) {
-  const path = join8(env.XDG_CONFIG_HOME || join8(home, ".config"), "cursor", "auth.json");
+  const path = join10(env.XDG_CONFIG_HOME || join10(home, ".config"), "cursor", "auth.json");
   if (!existsSync8(path)) {
     throw new ApiError(404, "no_cursor_auth", `no ${path} \u2014 run \`cursor-agent login\` first`);
   }
-  const raw = readFileSync9(path, "utf8");
+  const raw = readFileSync10(path, "utf8");
   try {
     const parsed = JSON.parse(raw);
     if (typeof parsed.accessToken !== "string" || typeof parsed.refreshToken !== "string") throw new Error("shape");
@@ -2765,7 +3182,87 @@ async function disconnect(name, opts) {
     console.log(
       `${affectedAgents.length} agent${affectedAgents.length === 1 ? "" : "s"} still point at it and will fail: ` + affectedAgents.map((a) => a.agentId ?? a.id).join(", ")
     );
-    console.log("Switch them to Platform in each agent's Configure tab (or reconnect).");
+    console.log(`Move them to platform credits with \`sky auth switch-to-credits ${name}\`, or reconnect.`);
+  }
+}
+async function browserSignIn(name, opts) {
+  const provider = managedProviderFor(name);
+  const base = `/model-subscriptions/${provider}/logins`;
+  const readCode = opts.readCode ?? ask;
+  let { login: login2 } = await api("POST", base, {
+    ...opts.account ? { accountId: opts.account } : {},
+    ...opts.label ? { label: opts.label } : {}
+  });
+  let shown = false;
+  let codeSent = false;
+  const cancel = () => {
+    if ("loginId" in login2 && login2.loginId) {
+      void api("DELETE", `${base}/${encodeURIComponent(login2.loginId)}`).catch(() => void 0);
+    }
+  };
+  process.once("SIGINT", cancel);
+  try {
+    for (; ; ) {
+      if (login2.state === "connected" || login2.state === "cleanup_pending") {
+        if (login2.state === "cleanup_pending") cancel();
+        return login2.subscription;
+      }
+      if (login2.state === "failed") {
+        if (login2.loginId) cancel();
+        throw new ApiError(422, "sign_in_failed", login2.reason);
+      }
+      if (login2.state === "waiting" && !shown) {
+        shown = true;
+        console.log(`Sign in to ${MODEL_SUBSCRIPTION_PROVIDER_NAME[provider]} at:
+  ${login2.url}`);
+        if (login2.userCode) console.log(`Confirm this code on that page: ${login2.userCode}`);
+        if (opts.browser !== false) openBrowser2(login2.url);
+      }
+      if (login2.state === "waiting" && login2.acceptsCode && !codeSent) {
+        const code = await readCode("Paste the code the sign-in page shows: ");
+        if (!code) throw new ApiError(400, "no_code", "no code provided");
+        await api("POST", `${base}/${encodeURIComponent(login2.loginId)}/code`, { code });
+        codeSent = true;
+      } else {
+        await new Promise((r) => setTimeout(r, opts.pollMs ?? 2e3));
+      }
+      ({ login: login2 } = await api("GET", `${base}/${encodeURIComponent(login2.loginId)}`));
+    }
+  } finally {
+    process.removeListener("SIGINT", cancel);
+  }
+}
+async function subscriptionUsage(name, account) {
+  const provider = managedProviderFor(name);
+  const { usage } = await api("GET", `/model-subscriptions/${provider}/usage${accountQuery(account)}`);
+  return usage;
+}
+function renderSubscriptionUsage(name, usage) {
+  const label = MODEL_SUBSCRIPTION_PROVIDER_NAME[managedProviderFor(name)];
+  if (usage.status === "unavailable") return [`${label}: usage unavailable (${usage.reason ?? "unknown"})`];
+  const head = [`${label}${usage.plan ? ` ${usage.plan}` : ""}`, usage.allowed === false ? "limit reached" : null].filter(Boolean).join(" \xB7 ");
+  const rows = usage.windows.map(
+    (w) => `  ${w.label}: ${Math.round(w.remainingPercent)}% left${w.resetsAt ? ` \xB7 resets ${w.resetsAt.slice(0, 16).replace("T", " ")}` : ""}`
+  );
+  return [head, ...rows.length ? rows : ["  no usage windows reported"]];
+}
+async function switchToCredits(name, opts) {
+  const provider = managedProviderFor(name);
+  const label = MODEL_SUBSCRIPTION_PROVIDER_NAME[provider];
+  if (!opts.yes) {
+    const ok = await confirm2(`Move every agent on this ${label} account to platform credits? Their running sessions restart.`);
+    if (!ok) {
+      console.log("Aborted.");
+      return;
+    }
+  }
+  const result = await api(
+    "POST",
+    `/model-subscriptions/${provider}/switch-to-credits${accountQuery(opts.account)}`
+  );
+  console.log(`Moved ${result.switched} agent${result.switched === 1 ? "" : "s"} to platform credits.`);
+  if (result.restartFailures.length) {
+    console.log(`Couldn't restart: ${result.restartFailures.join(", ")} \u2014 they pick up credits on their next start.`);
   }
 }
 
@@ -2781,11 +3278,11 @@ function planProviders(names2) {
   }));
 }
 function reportPath() {
-  return join9(dirname5(configPath()), "setup.json");
+  return join11(dirname6(configPath()), "setup.json");
 }
 function loadReport() {
   try {
-    const saved = JSON.parse(readFileSync10(reportPath(), "utf8"));
+    const saved = JSON.parse(readFileSync11(reportPath(), "utf8"));
     return { agents: saved.agents ?? [], plans: saved.plans ?? [], ...saved.secrets ? { secrets: saved.secrets } : {} };
   } catch {
     return { agents: [], plans: [] };
@@ -2798,8 +3295,8 @@ function mergeReport(base, next) {
   return { agents, plans, ...secrets2 ? { secrets: secrets2 } : {} };
 }
 function saveReport(report) {
-  mkdirSync2(dirname5(reportPath()), { recursive: true });
-  writeFileSync4(reportPath(), `${JSON.stringify(report, null, 2)}
+  mkdirSync3(dirname6(reportPath()), { recursive: true });
+  writeFileSync5(reportPath(), `${JSON.stringify(report, null, 2)}
 `, { mode: 384 });
 }
 function confirm3(question) {
@@ -2886,7 +3383,7 @@ async function connectedProviders() {
 var WORKSPACE_VAULT_NAME = "default";
 async function findWorkspaceVault() {
   const { vaults } = await api("GET", "/vaults");
-  return vaults.find((vault) => vault.display_name === WORKSPACE_VAULT_NAME)?.id ?? null;
+  return vaults.find((vault2) => vault2.display_name === WORKSPACE_VAULT_NAME)?.id ?? null;
 }
 async function workspaceVaultId() {
   const existing = await findWorkspaceVault();
@@ -3148,17 +3645,17 @@ function renderArtifact(artifact2) {
 }
 
 // src/skills-store.ts
-import { readdirSync as readdirSync4, readFileSync as readFileSync11, statSync as statSync5 } from "fs";
-import { basename as basename5, join as join10, relative as relative3, resolve as resolve5 } from "path";
+import { readdirSync as readdirSync5, readFileSync as readFileSync12, statSync as statSync8 } from "fs";
+import { basename as basename7, join as join12, relative as relative4, resolve as resolve7 } from "path";
 function skillBundle(dir) {
-  const root = resolve5(dir);
-  const top = basename5(root);
+  const root = resolve7(dir);
+  const top = basename7(root);
   const files2 = [];
   const walk = (path) => {
-    for (const name of readdirSync4(path).sort()) {
-      const full = join10(path, name);
-      if (statSync5(full).isDirectory()) walk(full);
-      else files2.push({ path: `${top}/${relative3(root, full)}`, bytes: readFileSync11(full) });
+    for (const name of readdirSync5(path).sort()) {
+      const full = join12(path, name);
+      if (statSync8(full).isDirectory()) walk(full);
+      else files2.push({ path: `${top}/${relative4(root, full)}`, bytes: readFileSync12(full) });
     }
   };
   walk(root);
@@ -3168,7 +3665,7 @@ function skillBundle(dir) {
 async function uploadSkill(dir, displayName) {
   const form = new FormData();
   for (const file of skillBundle(dir)) form.append("files", new Blob([new Uint8Array(file.bytes)]), file.path);
-  form.append("displayName", displayName ?? basename5(resolve5(dir)));
+  form.append("displayName", displayName ?? basename7(resolve7(dir)));
   return apiForm("POST", "/skills", form);
 }
 async function listSkills() {
@@ -3192,6 +3689,7 @@ function renderRequest(request) {
 }
 
 // src/workspace.ts
+import { createInterface as createInterface4 } from "readline";
 var KINDS = ["TOOL_CALL", "SPEND_CAP", "CALL_COUNT", "CAPABILITY"];
 async function workspaceSlug(explicit) {
   if (explicit) return explicit;
@@ -3199,9 +3697,9 @@ async function workspaceSlug(explicit) {
   if (current) return current;
   return (await api("GET", "/whoami")).universe.slug;
 }
-var workspacePath = (slug) => `/universes/${encodeURIComponent(slug)}`;
+var workspacePath2 = (slug) => `/universes/${encodeURIComponent(slug)}`;
 async function listMembers(slug) {
-  return api("GET", `${workspacePath(slug)}/members`);
+  return api("GET", `${workspacePath2(slug)}/members`);
 }
 function findMember(members, ref) {
   const needle = ref.toLowerCase();
@@ -3220,20 +3718,20 @@ function inviteBody(emails, options) {
   };
 }
 async function invite(slug, emails, options) {
-  return api("POST", `${workspacePath(slug)}/invites`, inviteBody(emails, options));
+  return api("POST", `${workspacePath2(slug)}/invites`, inviteBody(emails, options));
 }
 async function withdrawInvite(slug, inviteId) {
-  await api("DELETE", `${workspacePath(slug)}/invites/${encodeURIComponent(inviteId)}`);
+  await api("DELETE", `${workspacePath2(slug)}/invites/${encodeURIComponent(inviteId)}`);
 }
 async function setRole(slug, memberRef, role) {
   if (role !== "admin" && role !== "member") throw new ApiError(400, "invalid_request", "a role is admin or member");
   const member = findMember((await listMembers(slug)).members, memberRef);
-  await api("PATCH", `${workspacePath(slug)}/members/${encodeURIComponent(member.user_id)}`, { role });
+  await api("PATCH", `${workspacePath2(slug)}/members/${encodeURIComponent(member.user_id)}`, { role });
   return member;
 }
 async function removeMember(slug, memberRef) {
   const member = findMember((await listMembers(slug)).members, memberRef);
-  await api("DELETE", `${workspacePath(slug)}/members/${encodeURIComponent(member.user_id)}`);
+  await api("DELETE", `${workspacePath2(slug)}/members/${encodeURIComponent(member.user_id)}`);
   return member;
 }
 async function joinWorkspace(token) {
@@ -3266,7 +3764,7 @@ function policyRuleBody(options) {
     ...options.disabled ? { enabled: false } : {}
   };
 }
-var policiesPath = (scope) => "session" in scope ? `/sessions/${encodeURIComponent(scope.session)}/policies` : `${workspacePath(scope.slug)}/policies`;
+var policiesPath = (scope) => "session" in scope ? `/sessions/${encodeURIComponent(scope.session)}/policies` : `${workspacePath2(scope.slug)}/policies`;
 async function listPolicies(scope, effective = false) {
   if (effective && "session" in scope) return api("GET", `/sessions/${encodeURIComponent(scope.session)}/effective-policy`);
   return api("GET", policiesPath(scope));
@@ -3284,21 +3782,145 @@ function renderPolicy(rule) {
   const state = rule.enabled ? "on " : "off";
   return `${state}  ${rule.layer.padEnd(9)}  ${rule.kind.padEnd(10)}  ${rule.name}  ${JSON.stringify(rule.config)}  ${rule.id}`;
 }
+var REMOVED_KINDS = [
+  ["sessions", "sessions and their transcripts"],
+  ["agents", "agents"],
+  ["artifacts", "artifacts"],
+  ["files", "task files"],
+  ["memory_stores", "memory stores"],
+  ["routines", "routines"],
+  ["channels", "channel connections"],
+  ["webhooks", "webhooks"],
+  ["api_keys", "API keys"],
+  ["vaults", "vaults"],
+  ["skills", "skills"],
+  ["environments", "environments"],
+  ["connections", "connected apps"],
+  ["traces", "uploaded traces"],
+  ["members", "other members"],
+  ["invites", "pending invitations"]
+];
+async function deletionPreview(slug) {
+  return api("GET", `/universes/${encodeURIComponent(slug)}/deletion`);
+}
+function renderDeletionPreview(preview) {
+  if (!preview.can_delete) return [`${preview.workspace.slug} cannot be deleted:`, ...preview.blockers.map((b) => `  ${b.message}`)];
+  const lines = [`Deleting ${preview.workspace.slug} (${preview.workspace.name}) permanently removes:`];
+  const removed = REMOVED_KINDS.filter(([key]) => (preview.removes[key] ?? 0) > 0);
+  for (const [key, label] of removed) lines.push(`  ${preview.removes[key]} ${label}`);
+  if (!removed.length) lines.push("  nothing: the workspace is empty");
+  const running = preview.removes.running_sessions ?? 0;
+  if (running) lines.push(`${running} running session${running === 1 ? " is" : "s are"} stopped first.`);
+  if (preview.wallet) lines.push(`$${(preview.wallet.balance_micros / 1e6).toFixed(2)} in its wallet goes back to ${preview.wallet.returns_to ?? "you"}.`);
+  lines.push("This cannot be undone.");
+  return lines;
+}
+async function deleteWorkspace(slug) {
+  return (await api("DELETE", `/universes/${encodeURIComponent(slug)}`)).deleted;
+}
+function typedConfirmation(slug) {
+  return new Promise((done) => {
+    const rl = createInterface4({ input: process.stdin, output: process.stdout });
+    rl.question(`Type ${slug} to delete it: `, (answer) => {
+      rl.close();
+      done(answer.trim() === slug);
+    });
+  });
+}
+
+// src/vaults.ts
+import { createInterface as createInterface5 } from "readline";
+var vaultPath = (id) => `/vaults/${encodeURIComponent(id)}`;
+function secretLine(s) {
+  const target = s.secret_name ? `$${s.secret_name}` : s.mcp_server_url ?? "";
+  return `${s.id}  ${s.auth_type.padEnd(20)} ${s.display_name}  ${target}  ${s.status}${s.expires_at ? `  expires ${s.expires_at.slice(0, 10)}` : ""}`;
+}
+async function readSecretValue(prompt, input = process.stdin) {
+  if (!input.isTTY) {
+    const chunks = [];
+    for await (const chunk of input) chunks.push(chunk);
+    return Buffer.concat(chunks).toString("utf8").replace(/\r?\n$/, "");
+  }
+  const rl = createInterface5({ input, output: process.stdout, terminal: true });
+  const write = rl._writeToOutput.bind(rl);
+  let prompted = false;
+  rl._writeToOutput = (s) => {
+    if (!prompted) {
+      prompted = true;
+      write(s);
+    }
+  };
+  const value = await new Promise((done) => rl.question(prompt, done));
+  rl.close();
+  process.stdout.write("\n");
+  return value;
+}
+function secretBody(input) {
+  if (input.kind === "mcp") {
+    return { display_name: input.displayName ?? new URL(input.url).host, auth: { type: "static_bearer", mcp_server_url: input.url, token: input.token } };
+  }
+  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(input.name)) {
+    throw new ApiError(400, "invalid_name", `"${input.name}" is not an environment variable name`);
+  }
+  if (!input.hosts.length) throw new ApiError(400, "no_hosts", "name at least one --host the secret may be sent to");
+  const injection = {
+    header: true,
+    body: false,
+    ...input.header ? { header_name: input.header } : {},
+    ...input.template ? { value_template: input.template } : {}
+  };
+  return {
+    display_name: input.displayName ?? input.name,
+    auth: { type: "environment_variable", secret_name: input.name, value: input.value, allowed_hosts: input.hosts, injection_location: injection }
+  };
+}
+async function listVaults() {
+  return (await api("GET", "/vaults")).vaults;
+}
+async function listSecrets(vaultId) {
+  return (await api("GET", `${vaultPath(vaultId)}/secrets`)).secrets;
+}
+async function addSecret(vaultId, input) {
+  return (await api("POST", `${vaultPath(vaultId)}/secrets`, secretBody(input))).secret;
+}
+async function updateSecret(vaultId, secretId, patch) {
+  const body = {
+    ...patch.value !== void 0 ? { value: patch.value } : {},
+    ...patch.token !== void 0 ? { token: patch.token } : {},
+    ...patch.hosts?.length ? { allowed_hosts: patch.hosts } : {},
+    ...patch.displayName ? { display_name: patch.displayName } : {}
+  };
+  if (!Object.keys(body).length) throw new ApiError(400, "nothing_to_change", "pass a new value, --host or --name");
+  return (await api("PATCH", `${vaultPath(vaultId)}/secrets/${encodeURIComponent(secretId)}`, body)).secret;
+}
+async function moveSecrets(intoVault, from, dryRun) {
+  const result = await api("POST", `${vaultPath(intoVault)}/secrets/move`, { from, ...dryRun ? { dry_run: true } : {} });
+  return result.secrets;
+}
+function confirmPrompt(question) {
+  return new Promise((done) => {
+    const rl = createInterface5({ input: process.stdin, output: process.stdout });
+    rl.question(`${question} [y/N] `, (answer) => {
+      rl.close();
+      done(/^y(es)?$/i.test(answer.trim()));
+    });
+  });
+}
 
 // src/harness.ts
-import { existsSync as existsSync9, mkdirSync as mkdirSync3, readFileSync as readFileSync12, writeFileSync as writeFileSync5 } from "fs";
-import { dirname as dirname6, join as join11, resolve as resolve6 } from "path";
+import { existsSync as existsSync9, mkdirSync as mkdirSync4, readFileSync as readFileSync13, writeFileSync as writeFileSync6 } from "fs";
+import { dirname as dirname7, join as join13, resolve as resolve8 } from "path";
 var HARNESS_FILE = "harness.json";
 function harnessFilePath(dir) {
-  return join11(resolve6(dir), HARNESS_FILE);
+  return join13(resolve8(dir), HARNESS_FILE);
 }
 function readHarnessFile(dir) {
   const path = harnessFilePath(dir);
   if (!existsSync9(path)) {
-    throw new Error(`no ${HARNESS_FILE} found in ${resolve6(dir)} \u2014 run \`sky harness init\` first`);
+    throw new Error(`no ${HARNESS_FILE} found in ${resolve8(dir)} \u2014 run \`sky harness init\` first`);
   }
   try {
-    return JSON.parse(readFileSync12(path, "utf8"));
+    return JSON.parse(readFileSync13(path, "utf8"));
   } catch (err) {
     throw new Error(`could not parse ${path}: ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -3328,8 +3950,8 @@ function harnessInit(dir) {
   if (existsSync9(path)) {
     throw new Error(`${path} already exists \u2014 delete it to re-init`);
   }
-  mkdirSync3(dirname6(path), { recursive: true });
-  writeFileSync5(path, `${JSON.stringify(INIT_SKELETON, null, 2)}
+  mkdirSync4(dirname7(path), { recursive: true });
+  writeFileSync6(path, `${JSON.stringify(INIT_SKELETON, null, 2)}
 `);
   console.log(`Created ${path}`);
   console.log(INIT_COMMENT);
@@ -3466,6 +4088,18 @@ program.hook("preAction", () => {
   const workspace2 = program.opts().workspace;
   if (workspace2) process.env.SKY_WORKSPACE = workspace2;
 });
+var lastProgressDecile = -1;
+function uploadProgress(sent, total) {
+  const percent = Math.floor(sent / total * 100);
+  const line = `uploading ${(sent / 1024 / 1024).toFixed(0)} / ${(total / 1024 / 1024).toFixed(0)} MiB (${percent}%)`;
+  if (process.stderr.isTTY) {
+    process.stderr.write(`\r${line}${sent >= total ? "\n" : ""}`);
+  } else if (Math.floor(percent / 10) !== lastProgressDecile) {
+    lastProgressDecile = Math.floor(percent / 10);
+    process.stderr.write(`${line}
+`);
+  }
+}
 function fail(error) {
   if (error instanceof ApiError) console.error(`sky: ${error.message} (${error.code})`);
   else console.error(`sky: ${error instanceof Error ? error.message : String(error)}`);
@@ -3488,13 +4122,26 @@ auth.command("whoami").description("who the current token acts as").action(
     );
   })
 );
-auth.command("connect <provider>").description("connect a model subscription: claude (setup-token) or chatgpt (Codex sign-in)").option("-y, --yes", "skip the consent prompt").action(
+auth.command("connect <provider>").description("connect a model subscription: claude (setup-token) or chatgpt (Codex sign-in); --browser signs any plan in on its own page").option("-y, --yes", "skip the consent prompt").option("--browser", "sign in on the provider's page instead of using this machine's sign-in (claude, chatgpt, cursor, grok, muse)").option("--account <id>", "with --browser: re-sign an additional account, or `new` to add one").option("--label <label>", "with --browser: name the account").option("--no-open", "with --browser: print the sign-in link without opening it").action(
   run(async (name, opts) => {
+    if (opts.browser) {
+      const sub = await browserSignIn(name, { account: opts.account, label: opts.label, browser: opts.open });
+      console.log(`Connected ${MODEL_SUBSCRIPTION_PROVIDER_NAME[sub.provider]} (${sub.label}). Powers new eligible agents.`);
+      return;
+    }
     const provider = providerFor(name);
     if (provider === "anthropic") await connectClaude();
     else await connectChatgpt(opts);
   })
 );
+auth.command("usage <provider>").description("plan allowance left on a connected model subscription").option("--account <id>", "an additional account (default: the provider's first account)").option("--json", "print the raw usage").action(
+  run(async (name, opts) => {
+    const usage = await subscriptionUsage(name, opts.account);
+    if (opts.json) console.log(JSON.stringify(usage, null, 2));
+    else for (const line of renderSubscriptionUsage(name, usage)) console.log(line);
+  })
+);
+auth.command("switch-to-credits <provider>").description("move the agents on a model subscription onto platform credits (do this before disconnecting)").option("--account <id>", "an additional account (default: the provider's first account)").option("-y, --yes", "skip the confirmation prompt").action(run(async (name, opts) => switchToCredits(name, opts)));
 auth.command("accounts").description("list connected model subscriptions and the agents they power").action(run(async () => listSubscriptions()));
 auth.command("disconnect <provider>").description("disconnect a model subscription (agents on it fail until switched)").option("-y, --yes", "skip the confirmation prompt").action(run(async (name, opts) => disconnect(name, opts)));
 var universe = program.command("universe").description("grouping boundary for agents");
@@ -3565,6 +4212,19 @@ universe.command("remove <member>").description("remove a member (user id or ema
     console.log(`Removed ${member.email ?? member.user_id}`);
   })
 );
+async function deleteWorkspaceCommand(slug, opts) {
+  const preview = await deletionPreview(slug);
+  for (const line of renderDeletionPreview(preview)) console.log(line);
+  if (!preview.can_delete) process.exit(1);
+  if (!opts.yes && !await typedConfirmation(slug)) {
+    console.log("Aborted.");
+    return;
+  }
+  const deleted = await deleteWorkspace(slug);
+  if (currentUniverse() === slug) saveConfig({ ...loadConfig(), currentUniverse: void 0 });
+  console.log(`Deleted ${deleted.slug}${deleted.sessions_stopped ? ` \xB7 stopped ${deleted.sessions_stopped} running session${deleted.sessions_stopped === 1 ? "" : "s"}` : ""}`);
+}
+universe.command("delete <slug>").description("permanently delete a workspace you own and everything in it (asks you to type the slug)").option("-y, --yes", "skip typing the slug").action(run(deleteWorkspaceCommand));
 universe.command("join <token>").description("accept an invitation sent to your verified email").action(
   run(async (token) => {
     const workspace2 = await joinWorkspace(token);
@@ -3582,6 +4242,7 @@ workspace.command("list").action(
     }
   })
 );
+workspace.command("delete <slug>").description("permanently delete a workspace you own and everything in it (asks you to type the slug)").option("-y, --yes", "skip typing the slug").action(run(deleteWorkspaceCommand));
 var policy = program.command("policy").description("policy rules: tool calls, spend caps, call counts, capabilities");
 async function policyScope(opts) {
   return opts.session ? { session: await resolveSessionRef(opts.session) } : { slug: await workspaceSlug(opts.universe) };
@@ -3692,7 +4353,7 @@ agent.command("destroy <id>").description("delete the spec; requires all session
     console.log(`Destroyed ${id}`);
   })
 );
-agent.command("message <id> [text]").description("send one message to the default session and stream the turn until idle").option("--detach", "don't follow the stream; exit once the message is accepted").option("--file <path...>", "attach local files (uploaded first, sent as document blocks)").option("--image <path...>", "attach local images (uploaded first, sent as image blocks)").option("--system <text>", "per-turn system text sent alongside the message").action(
+agent.command("message <id> [text]").description("send one message to the default session and stream the turn until idle").option("--detach", "don't follow the stream; exit once the message is accepted").option("--file <path...>", "attach local files (uploaded first, sent as document blocks)").option("--image <path...>", "attach local images (uploaded first, sent as image blocks)").option("--system <text>", "per-turn system text sent alongside the message").option("--plan", "plan mode: the agent inspects and answers with a plan, then waits for you to choose to implement it").option("--build", "build mode for this turn, overriding a session left in plan mode").action(
   run(
     async (id, text, opts) => sendAndFollow(await resolveSessionRef(id), text ?? "", opts)
   )
@@ -3802,7 +4463,7 @@ session.command("delete <id>").description("permanently delete the session, its
     console.log(`Deleted ${id}`);
   })
 );
-session.command("message <ref> [text]").description("send one message (session id, or agent id = its default session)").option("--detach", "don't follow the stream; exit once the message is accepted").option("--file <path...>", "attach local files (uploaded first, sent as document blocks)").option("--image <path...>", "attach local images (uploaded first, sent as image blocks)").option("--system <text>", "per-turn system text sent alongside the message").action(
+session.command("message <ref> [text]").description("send one message (session id, or agent id = its default session)").option("--detach", "don't follow the stream; exit once the message is accepted").option("--file <path...>", "attach local files (uploaded first, sent as document blocks)").option("--image <path...>", "attach local images (uploaded first, sent as image blocks)").option("--system <text>", "per-turn system text sent alongside the message").option("--plan", "plan mode: the agent inspects and answers with a plan, then waits for you to choose to implement it").option("--build", "build mode for this turn, overriding a session left in plan mode").action(
   run(
     async (ref, text, opts) => sendAndFollow(await resolveSessionRef(ref), text ?? "", opts)
   )
@@ -3944,6 +4605,78 @@ sessionPorts.command("revoke <ref> <port>").description("stop exposing a port; i
     console.log(`Revoked port ${port}`);
   })
 );
+session.command("access <ref>").description("who may use the session; --private/--members and --add-viewer/--remove-viewer change it (owner)").option("--private", "only you can use it").option("--members", "every member of its workspace can read and prompt it").option("--add-viewer <email...>", "people who may read its messages from any workspace").option("--remove-viewer <email...>", "take viewers off").action(
+  run(async (ref, opts) => {
+    const id = await resolveSessionRef(ref);
+    const patch = accessPatch(opts);
+    const path = `/sessions/${encodeURIComponent(id)}/access`;
+    const access = await api(Object.keys(patch).length ? "PATCH" : "GET", path, Object.keys(patch).length ? patch : void 0);
+    for (const line of renderAccess(access)) console.log(line);
+  })
+);
+session.command("shared").description("sessions other people shared with you to read, newest first").option("--limit <n>", "at most this many (1\u2013100, default 50)").action(
+  run(async (opts) => {
+    const { sessions } = await api("GET", `/shared-sessions${opts.limit ? `?limit=${encodeURIComponent(opts.limit)}` : ""}`);
+    if (!sessions.length) console.log("nobody has shared a session with you");
+    for (const s of sessions) console.log(`${s.id}  ${s.agent_type.padEnd(12)} ${s.title ?? "(untitled)"}  from ${s.owner.name ?? s.owner.email ?? "unknown"}  ${s.shared_at.slice(0, 10)}`);
+  })
+);
+session.command("handoff <ref> <targetAgent>").description("hand the session's context to another agent (agent id or catalog handle); prints the new session").option("--from-message <id>", "carry the conversation up to this message only").option("--no-wait", "return once the handoff is accepted").action(
+  run(async (ref, targetAgent, opts) => {
+    const id = await resolveSessionRef(ref);
+    const done = await handoff(id, targetAgent, {
+      fromMessage: opts.fromMessage,
+      wait: opts.wait !== false,
+      onStatus: (h) => console.error(`${h.id}: ${h.status}`)
+    });
+    if (done.status === "failed") throw new ApiError(422, done.error?.code ?? "handoff_failed", done.error?.message ?? "the handoff failed");
+    if (done.target_session) console.log(`${done.target_session}  (${done.resolved_mode === "native_fork" ? "forked" : "from a written summary"})`);
+  })
+);
+var sessionWorkspace = session.command("workspace").description("the session's workspace: list and read files, see changes, take a patch, copy a folder in");
+sessionWorkspace.command("ls <ref> [path]").description("list a directory (default: the workspace root)").option("--hidden", "include dotfiles").action(
+  run(async (ref, path, opts) => {
+    const listing = await listFiles(await resolveSessionRef(ref), path, Boolean(opts.hidden));
+    for (const e of listing.entries) console.log(entryLine(e));
+    if (listing.truncated) console.error(`(only the first ${listing.entries.length} entries)`);
+  })
+);
+sessionWorkspace.command("cat <ref> <path>").description("print a file (up to 1 MB), or save it with --out").option("--out <file>", "write it to this local file").action(
+  run(async (ref, path, opts) => {
+    const bytes = await readFile(await resolveSessionRef(ref), path);
+    if (opts.out) {
+      writeFileSync7(opts.out, bytes);
+      console.error(`saved ${bytes.length} bytes to ${opts.out}`);
+    } else process.stdout.write(bytes);
+  })
+);
+sessionWorkspace.command("changes <ref>").description("git status and diff summary of each repository in the workspace").action(
+  run(async (ref) => {
+    const changes = await api("GET", `/sessions/${encodeURIComponent(await resolveSessionRef(ref))}/workspace/changes`);
+    for (const line of renderChanges(changes)) console.log(line);
+  })
+);
+sessionWorkspace.command("patch <ref> [repo]").description("the work in a repository since its base branch, as a git patch (default repo: the root)").option("--out <file>", "write the patch to this file instead of stdout").action(
+  run(async (ref, repo, opts) => {
+    const { meta, patch } = await workspacePatch(await resolveSessionRef(ref), repo ?? ".");
+    console.error(`${meta.repo}: ${meta.commits.length} commit${meta.commits.length === 1 ? "" : "s"} since ${meta.base_branch || "the imported copy"} (${meta.base_commit.slice(0, 12)})`);
+    if (!patch.length) console.error("nothing changed");
+    else if (opts.out) {
+      writeFileSync7(opts.out, patch);
+      console.error(`wrote ${opts.out} \u2014 apply with: git apply ${opts.out}`);
+    } else process.stdout.write(patch);
+  })
+);
+sessionWorkspace.command("import <ref> <dir>").description("copy a local folder into the workspace as a git repository (files git ignores are left out)").option("--name <name>", "its folder name in the workspace (default: the local folder's name)").action(
+  run(async (ref, dir, opts) => {
+    const imported = await importFolder(await resolveSessionRef(ref), dir, { name: opts.name });
+    console.log(`${imported.path}  (${imported.files} files)`);
+  })
+);
+function interactionMode(opts) {
+  if (opts.plan && opts.build) throw new ApiError(400, "invalid_request", "pass --plan or --build, not both");
+  return opts.plan ? "plan" : opts.build ? "build" : void 0;
+}
 async function uploadAttachments(opts) {
   const files2 = [];
   for (const path of [...opts.image ?? [], ...opts.file ?? []]) {
@@ -3960,7 +4693,8 @@ function turnOver(frame) {
   return stopReason?.type !== "requires_action";
 }
 async function sendAndFollow(sessionId, text, opts) {
-  const events = eventsFor(text, await uploadAttachments(opts), opts.system);
+  const mode = interactionMode(opts);
+  const events = eventsFor(text, await uploadAttachments(opts), opts.system, mode);
   const controller = new AbortController();
   let opened = null;
   if (!opts.detach) {
@@ -3985,7 +4719,7 @@ async function sendAndFollow(sessionId, text, opts) {
 async function chatLoop(sessionId, opts = {}) {
   console.log(`Chatting with ${sessionId} \u2014 Ctrl-C to leave.`);
   const controller = new AbortController();
-  const rl = createInterface4({ input: process.stdin, output: process.stdout, prompt: "> " });
+  const rl = createInterface6({ input: process.stdin, output: process.stdout, prompt: "> " });
   let system = opts.system;
   void (async () => {
     try {
@@ -4099,9 +4833,9 @@ secrets.command("unset <id> <key>").action(
 );
 program.command("launch").description("scaffold ./agent.toml if absent, create the agent, print its address").option("-f, --file <path>", "agent file", "agent.toml").option("--type <type>", "override the file's harness: hermes | claude_code | codex | openclaw | pi | dsh | kimi_code | opencode").option("--llm <llm>", "override the file's model (must suit the harness)").action(
   run(async (opts) => {
-    const path = resolve7(opts.file);
+    const path = resolve9(opts.file);
     if (!existsSync10(path)) {
-      const name = basename6(process.cwd()).replace(/[^a-zA-Z0-9 _-]/g, "") || "my-agent";
+      const name = basename8(process.cwd()).replace(/[^a-zA-Z0-9 _-]/g, "") || "my-agent";
       scaffoldAgentFile(path, name);
       console.log(`Scaffolded ${opts.file} \u2014 edit it anytime; re-apply with \`sky deploy\`.`);
     }
@@ -4132,7 +4866,7 @@ program.command("launch").description("scaffold ./agent.toml if absent, create t
 );
 program.command("deploy").description("re-apply ./agent.toml to the existing agent (idempotent)").option("-f, --file <path>", "agent file", "agent.toml").action(
   run(async (opts) => {
-    const path = resolve7(opts.file);
+    const path = resolve9(opts.file);
     const { file, spec } = readAgentFile(path);
     if (!file.id) {
       console.log("No agent id in the file yet \u2014 running launch instead.");
@@ -4233,13 +4967,13 @@ program.command("import").description("import a local Claude Code or Codex sessi
           console.log(`       ${ws}`);
         });
         console.log();
-        const rl = createInterface4({ input: process.stdin, output: process.stdout });
+        const rl = createInterface6({ input: process.stdin, output: process.stdout });
         const answer = await new Promise(
-          (resolve8) => rl.question(
+          (resolve10) => rl.question(
             `Import which session? [1-${candidates.length}, or comma-separated, or "all"]: `,
             (a) => {
               rl.close();
-              resolve8(a.trim());
+              resolve10(a.trim());
             }
           )
         );
@@ -4261,10 +4995,10 @@ program.command("import").description("import a local Claude Code or Codex sessi
       }
       if (!autoConfirm) {
         if (nonInteractive) throw new Error("Use --yes to confirm this transfer in a non-interactive terminal.");
-        const prompt = createInterface4({ input: process.stdin, output: process.stdout });
-        const answer = await new Promise((resolve8) => prompt.question("Upload these selected conversations? [y/N] ", (value) => {
+        const prompt = createInterface6({ input: process.stdin, output: process.stdout });
+        const answer = await new Promise((resolve10) => prompt.question("Upload these selected conversations? [y/N] ", (value) => {
           prompt.close();
-          resolve8(value);
+          resolve10(value);
         }));
         if (!/^y(?:es)?$/i.test(answer.trim())) {
           console.log("Cancelled. Nothing uploaded.");
@@ -4318,7 +5052,7 @@ Importing ${label} \u2026
 var files = program.command("files").description("files: upload once, reference by id from any message");
 files.command("upload <path>").description("upload a local file; prints the file id to reference from a message").option("--expires <seconds>", "expire the upload after this many seconds (3600\u20137776000)").action(
   run(async (path, opts) => {
-    const file = await uploadLocalFile(path, opts.expires ? Number(opts.expires) : void 0);
+    const file = await uploadLocalFile(path, opts.expires ? Number(opts.expires) : void 0, uploadProgress);
     console.log(`${file.id}  ${file.filename}  ${file.mime_type}  ${file.size_bytes} bytes`);
   })
 );
@@ -4349,9 +5083,8 @@ files.command("rm <id>").description("delete a file (a session that already rece
 );
 files.command("download <id>").description("download a session file's bytes").requiredOption("-o, --out <path>", "where to write the bytes").action(
   run(async (id, opts) => {
-    const { bytes } = await downloadFile(id);
-    writeFileSync6(opts.out, bytes);
-    console.log(`Wrote ${bytes.length} bytes to ${opts.out}`);
+    const written = await downloadFileTo(id, opts.out);
+    console.log(`Wrote ${written} bytes to ${opts.out}`);
   })
 );
 var task = program.command("task").description("a task's shared files and open requests (the task is its first session's id)");
@@ -4366,14 +5099,14 @@ task.command("get <task> <path>").description("read one task file; prints it, or
   run(async (taskId, path, opts) => {
     const bytes = await readTaskFile(taskId, path);
     if (opts.out) {
-      writeFileSync6(opts.out, bytes);
+      writeFileSync7(opts.out, bytes);
       console.log(`Wrote ${bytes.length} bytes to ${opts.out}`);
     } else process.stdout.write(bytes);
   })
 );
 task.command("put <task> <path> <local>").description("write a local file to <path> in the task's files (every session of the task sees it)").action(
   run(async (taskId, path, local) => {
-    const { file, conflict } = await writeTaskFile(taskId, path, readFileSync13(local), mediaTypeFor(local));
+    const { file, conflict } = await writeTaskFile(taskId, path, readFileSync14(local), mediaTypeFor(local));
     console.log(`${renderTaskFile(file)}${conflict ? "  (replaced a version you had not seen)" : ""}`);
   })
 );
@@ -4439,7 +5172,7 @@ artifact.command("get <id> <path>").description("read one file of an artifact; p
   run(async (id, path, opts) => {
     const bytes = await readArtifactFile(id, path);
     if (opts.out) {
-      writeFileSync6(opts.out, bytes);
+      writeFileSync7(opts.out, bytes);
       console.log(`Wrote ${bytes.length} bytes to ${opts.out}`);
     } else process.stdout.write(bytes);
   })
@@ -4551,6 +5284,50 @@ routine.command("runs [id]").description("every fire attempt, newest first \u201
     }
   })
 );
+routine.command("inbound-url <id>").description("a URL that starts a run when posted to, for services that can't hold an API token").option("--create", "make one (replaces any earlier URL); the URL is printed once").option("--rm", "remove it; posting to it stops working").action(
+  run(async (id, opts) => {
+    const res = await triggerRequest(id, "inbound-url", { create: opts.create, remove: opts.rm });
+    console.log(opts.rm ? res.removed ? "Removed the inbound URL" : "There was no inbound URL" : inboundLine(res.inbound_url ?? null));
+  })
+);
+routine.command("precheck <id> [url]").description("run scheduled fires only when the content at an https URL changed; no url shows the precheck").option("--rm", "remove it: every scheduled fire runs again").action(
+  run(async (id, url, opts) => {
+    const res = await triggerRequest(id, "precheck", { body: url ? { url } : void 0, remove: opts.rm });
+    console.log(opts.rm ? res.removed ? "Removed the precheck" : "There was no precheck" : precheckLine(res.precheck ?? null));
+  })
+);
+routine.command("result-email <id> [state]").description("email you each run's result: on or off; no state shows the setting (new-session routines only)").action(
+  run(async (id, state) => {
+    if (state && state !== "on" && state !== "off") throw new ApiError(400, "invalid_request", "state is on or off");
+    const res = await api(
+      state === "on" ? "PUT" : state === "off" ? "DELETE" : "GET",
+      triggerPath(id, "result-email")
+    );
+    console.log(`result email ${res.result_email.enabled ? "on" : "off"}`);
+  })
+);
+routine.command("chat-trigger <id>").description("start a run from your own message in a connected chat; no flags shows the trigger").option("--connection <id>", "the chat connection (see `sky channel list`)").option("--thread <id>", "only this conversation (default: every conversation on the connection)").option("--prefix <text>", "only messages starting with this; the rest of the message is the run's input").option("--rm", "remove the trigger").action(
+  run(async (id, opts) => {
+    const setting = Boolean(opts.connection || opts.thread || opts.prefix);
+    const res = await triggerRequest(
+      id,
+      "channel-trigger",
+      { body: setting ? triggerBody(opts) : void 0, remove: opts.rm }
+    );
+    console.log(opts.rm ? res.removed ? "Removed the chat trigger" : "There was no chat trigger" : triggerLine(res.channel_trigger ?? null, res.available ?? true));
+  })
+);
+routine.command("deliver-to <id>").description("post each run's answer to a conversation in a connected chat; no flags shows where").option("--connection <id>", "the chat connection (see `sky channel list`)").option("--thread <id>", "the conversation (default: the chat itself)").option("--rm", "stop posting answers").action(
+  run(async (id, opts) => {
+    const setting = Boolean(opts.connection || opts.thread);
+    const res = await triggerRequest(
+      id,
+      "deliver-to",
+      { body: setting ? deliverBody(opts) : void 0, remove: opts.rm }
+    );
+    console.log(opts.rm ? res.removed ? "Stopped posting answers" : "Answers were posted nowhere" : deliverLine(res.deliver_to ?? null));
+  })
+);
 var collect = (value, previous = []) => [...previous, value];
 function goalPath(sessionId, suffix = "") {
   return `/sessions/${encodeURIComponent(sessionId)}/goal${suffix}`;
@@ -4693,7 +5470,7 @@ usageOptions(
   run(async (opts) => {
     const { bytes } = await apiBytes("GET", `/billing/usage/export${usageQuery(opts)}`);
     if (opts.out) {
-      writeFileSync6(opts.out, bytes);
+      writeFileSync7(opts.out, bytes);
       console.log(`Wrote ${bytes.length} bytes to ${opts.out}`);
     } else {
       process.stdout.write(bytes);
@@ -4786,6 +5563,189 @@ webhook.command("rm <id>").description("delete an endpoint").action(
     console.log(`Deleted ${id}`);
   })
 );
+var channel = program.command("channel").description("chat surfaces (Slack, Telegram, Discord, WhatsApp, iMessage, \u2026) routed to a session");
+channel.command("list").description("your connections and the session each routes to").action(
+  run(async () => {
+    const connections = await listConnections();
+    if (!connections.length) console.log("no channels \u2014 connect one with `sky channel connect <platform> --session sess_\u2026`");
+    for (const c of connections) console.log(connectionLine(c));
+  })
+);
+channel.command("connect <platform>").description("connect a surface; prints the link or code that finishes it").option("--session <id>", "route it to this session (sess_\u2026) once claimed").option("--webhook <id>", "route it to this channel webhook endpoint instead").option("--app <id>", "run the connection on your own registered bot or number (see `sky channel apps`)").option("--label <label>", "a name for the connection").option("--wait", "wait until the connection is claimed").action(
+  run(async (platform, opts) => {
+    const created = await connect(platform, opts);
+    console.log(connectionLine(created));
+    for (const step of connectSteps(created)) console.log(`  ${step}`);
+    if (opts.wait && created.status === "PENDING") {
+      const done = await waitConnected(created.id);
+      console.log(connectionLine(done));
+    }
+  })
+);
+channel.command("bind <connectionId>").description("route a connection to a session or a channel webhook endpoint").option("--session <id>", "the session (sess_\u2026)").option("--webhook <id>", "the channel webhook endpoint").action(
+  run(async (connectionId, opts) => {
+    await bind(connectionId, opts);
+    console.log(`${connectionId} \u2192 ${opts.session ?? opts.webhook}`);
+  })
+);
+channel.command("send <threadId> <text...>").description("post a markdown message into a connected thread").action(
+  run(async (threadId, text) => {
+    await send(threadId, text.join(" "));
+    console.log(`Sent to ${threadId}`);
+  })
+);
+channel.command("disconnect <connectionId>").description("disconnect a surface").action(
+  run(async (connectionId) => {
+    await api("DELETE", `/channels/connections/${encodeURIComponent(connectionId)}`);
+    console.log(`Disconnected ${connectionId}`);
+  })
+);
+channel.command("apps").description("your own bots and numbers registered as channel apps").action(
+  run(async () => {
+    const { apps } = await api("GET", "/channels/apps");
+    if (!apps.length) console.log("no channel apps \u2014 connections use the shared AgentSky bots");
+    for (const a of apps) console.log(`${a.id}  ${a.platform.padEnd(9)} ${a.label}${a.status ? `  ${a.status}` : ""}`);
+  })
+);
+channel.command("identities").description("chat identities whose messages run as you").action(
+  run(async () => {
+    const { identities } = await api("GET", "/channels/identities");
+    if (!identities.length) console.log("no linked chat identities");
+    for (const i of identities) console.log(`${i.id}  ${i.platform.padEnd(9)} ${i.display_name ?? i.external_user_id}${i.linked_at ? `  since ${i.linked_at.slice(0, 10)}` : ""}`);
+  })
+);
+channel.command("unlink <identityId>").description("unlink a chat identity; that person's messages stop running as you").action(
+  run(async (identityId) => {
+    await api("DELETE", `/channels/identities/${encodeURIComponent(identityId)}`);
+    console.log(`Unlinked ${identityId}`);
+  })
+);
+var connector = program.command("connector").description("apps your agents can use: connect, list, share with a workspace");
+connector.command("apps [query]").description("apps you can connect, searched by name").option("--limit <n>", "at most this many", (v) => Number.parseInt(v, 10), 50).action(
+  run(async (query, opts) => {
+    for (const a of await listApps(query, opts.limit)) console.log(`${a.slug.padEnd(24)} ${a.name} \u2014 ${a.description}`);
+  })
+);
+connector.command("list").description("the accounts you connected").action(
+  run(async () => {
+    const { connections, credit } = await api("GET", "/connectors/connections");
+    if (!connections.length) console.log("no connections \u2014 connect one with `sky connector connect <app>`");
+    for (const c of connections) console.log(connectionLine2(c));
+    if (credit.cap_usd > 0) console.log(`credit earned by connecting: $${credit.earned_usd} of $${credit.cap_usd}`);
+  })
+);
+connector.command("connect <app>").description("connect an app in the browser (the slug from `sky connector apps`)").option("--universe <slug>", "connect it for this workspace itself (owner or admin)").option("--no-open", "print the authorization link without opening it").action(
+  run(async (app, opts) => {
+    const connection = await connectApp(app, { workspace: opts.universe, open: opts.open });
+    console.log(`Connected ${connection.app_name} (${connection.label})${opts.universe ? ` for ${opts.universe}` : ""}`);
+  })
+);
+connector.command("disconnect <connectionId>").description("disconnect one of your connections; agents lose it at once").action(
+  run(async (connectionId) => {
+    await api("DELETE", `/connectors/connections/${encodeURIComponent(connectionId)}`);
+    console.log(`Disconnected ${connectionId}`);
+  })
+);
+connector.command("repos").description("repositories your GitHub connection can reach").action(
+  run(async () => {
+    const { repos } = await api("GET", "/connectors/github/repos");
+    for (const r of repos) console.log(`${r.full_name}  ${r.default_branch}${r.private ? "  private" : ""}`);
+  })
+);
+connector.command("workspace [slug]").description("connections shared with a workspace (default: the current one)").action(
+  run(async (slug) => {
+    const ws = await api("GET", `/universes/${encodeURIComponent(await workspaceSlug(slug))}/connections`);
+    if (!ws.sharing) console.log("this workspace does not take shared connections");
+    for (const c of ws.connections) console.log(workspaceConnectionLine(c));
+  })
+);
+connector.command("share <connectionId>").description("share one of your connections with a workspace, so its sessions can call through it").option("--universe <slug>", "the workspace (default: the current one)").action(
+  run(async (connectionId, opts) => {
+    const slug = await workspaceSlug(opts.universe);
+    await api("POST", `/universes/${encodeURIComponent(slug)}/connections`, { connection_id: connectionId });
+    console.log(`Shared ${connectionId} with ${slug}`);
+  })
+);
+connector.command("unshare <connectionId>").description("stop sharing a connection with a workspace").option("--universe <slug>", "the workspace (default: the current one)").action(
+  run(async (connectionId, opts) => {
+    const slug = await workspaceSlug(opts.universe);
+    await api("DELETE", `/universes/${encodeURIComponent(slug)}/connections/${encodeURIComponent(connectionId)}`);
+    console.log(`Stopped sharing ${connectionId} with ${slug}`);
+  })
+);
+connector.command("shared").description("everything you share with workspaces, and the calls made through each").action(
+  run(async () => {
+    const { shared } = await api("GET", "/shared-connections");
+    if (!shared.length) console.log("you share no connections");
+    for (const s of shared) console.log(`${s.connection_id}  ${s.app_name} (${s.label}) \u2192 ${s.workspace.slug}  ${s.use_count} call${s.use_count === 1 ? "" : "s"}`);
+  })
+);
+var vault = program.command("vault").description("vaults: credentials a session is granted when it starts (values write-only)");
+vault.command("list").description("the workspace's vaults").action(
+  run(async () => {
+    const vaults = await listVaults();
+    if (!vaults.length) console.log("no vaults");
+    for (const v of vaults) console.log(`${v.id}  ${v.display_name}`);
+  })
+);
+vault.command("create <name>").description("create a vault; pass its id as vault_ids when starting a session").action(
+  run(async (name) => {
+    const { vault: created } = await api("POST", "/vaults", { display_name: name });
+    console.log(`${created.id}  ${created.display_name}`);
+  })
+);
+vault.command("show <vaultId>").description("a vault's secrets (metadata only)").action(
+  run(async (vaultId) => {
+    const secrets2 = await listSecrets(vaultId);
+    if (!secrets2.length) console.log("no secrets");
+    for (const secret of secrets2) console.log(secretLine(secret));
+  })
+);
+vault.command("rm <vaultId>").description("delete a vault and every secret in it").option("-y, --yes", "skip the confirmation prompt").action(
+  run(async (vaultId, opts) => {
+    if (!opts.yes && !await confirmPrompt(`Delete ${vaultId} and every secret in it?`)) return void console.log("Aborted.");
+    await api("DELETE", `/vaults/${encodeURIComponent(vaultId)}`);
+    console.log(`Deleted ${vaultId}`);
+  })
+);
+vault.command("move <intoVaultId>").description("move the secrets of other vaults into this one").requiredOption("--from <vaultId...>", "the vaults to move out of").option("--dry-run", "only report what would move").action(
+  run(async (intoVaultId, opts) => {
+    for (const m of await moveSecrets(intoVaultId, opts.from, Boolean(opts.dryRun))) {
+      console.log(`${m.outcome.padEnd(8)} ${m.name}  from ${m.from}${m.reason ? `  (${m.reason})` : ""}`);
+    }
+  })
+);
+var vaultSecret = vault.command("secret").description("the secrets in a vault");
+vaultSecret.command("add <vaultId> <name>").description("add an environment variable (value from stdin or a hidden prompt), or an MCP server's bearer token with --mcp").option("--host <host...>", "hosts the environment variable may be sent to").option("--header <name>", "the header it is sent in (default: Authorization)").option("--template <template>", "how the header value is built, e.g. 'Bearer {secret}'").option("--mcp <url>", "store a bearer token for this MCP server instead; <name> is its display name").action(
+  run(async (vaultId, name, opts) => {
+    const value = await readSecretValue(opts.mcp ? "Token: " : `Value for ${name}: `);
+    if (!value) throw new ApiError(400, "no_value", "no value provided");
+    const input = opts.mcp ? { kind: "mcp", url: opts.mcp, token: value, displayName: name } : { kind: "env", name, value, hosts: opts.host ?? [], header: opts.header, template: opts.template };
+    console.log(secretLine(await addSecret(vaultId, input)));
+  })
+);
+vaultSecret.command("rotate <vaultId> <secretId>").description("replace a secret's value in place (stdin or a hidden prompt); running sessions keep working").option("--host <host...>", "also replace the hosts it may be sent to").option("--keep-value", "only change --host, keep the value").action(
+  run(async (vaultId, secretId, opts) => {
+    const current = (await listSecrets(vaultId)).find((s) => s.id === secretId);
+    if (!current) throw new ApiError(404, "not_found", `no secret ${secretId} in ${vaultId}`);
+    const value = opts.keepValue ? void 0 : await readSecretValue("New value: ");
+    if (value === "") throw new ApiError(400, "no_value", "no value provided");
+    const field = current.auth_type === "environment_variable" ? "value" : "token";
+    console.log(secretLine(await updateSecret(vaultId, secretId, { [field]: value, hosts: opts.host })));
+  })
+);
+vaultSecret.command("rm <vaultId> <secretId>").description("delete a secret").action(
+  run(async (vaultId, secretId) => {
+    await api("DELETE", `/vaults/${encodeURIComponent(vaultId)}/secrets/${encodeURIComponent(secretId)}`);
+    console.log(`Deleted ${secretId}`);
+  })
+);
+vaultSecret.command("validate <vaultId> <secretId>").description("check that an MCP OAuth grant still works").action(
+  run(async (vaultId, secretId) => {
+    const { result } = await api("POST", `/vaults/${encodeURIComponent(vaultId)}/secrets/${encodeURIComponent(secretId)}/validate`);
+    console.log(`${secretId}: ${result}`);
+  })
+);
 var harness = program.command("harness").description("workspace harnesses: init, verify, push");
 harness.command("init [dir]").description("write a harness.json profile skeleton in the given directory (default: .)").action(run(async (dir) => {
   harnessInit(dir ?? ".");
@@ -4809,7 +5769,7 @@ harness.command("connect").description("run an ACP agent (the command after --)
 }));
 var traceCmd = program.command("trace").description("correlate this machine's agent work with the cloud sessions it starts (metadata only unless you choose content)");
 traceCmd.command("start").description("start a trace: a grant for this machine, a root span, and the spool the hooks write to").option("--name <name>", "a name for the task").option("--source <source>", "how this machine reports itself", "claude-code").option("--hooks [settings]", "also install the Claude Code hooks (default: ./.claude/settings.local.json)").option("--capture <scopes>", "also send content, redacted on this machine first: any of prompts,tool_output,files").option("--file <path>", "a file the files scope may send (repeatable)", collect).option("--dir <path>", "a folder whose files the files scope may send when a file tool touches them (repeatable)", collect).action(run(async (opts) => {
-  const { readState, writeState, record, installClaudeHooks, parseContentScopes, chosenPaths, fileEvent } = await import("./trace-YKEGRVJN.js");
+  const { readState, writeState, record, installClaudeHooks, parseContentScopes, chosenPaths, fileEvent } = await import("./trace-IOARVWJ6.js");
   if (readState()) throw new Error("a trace is already running here \u2014 `sky trace stop` it first");
   const scopes = parseContentScopes(opts.capture);
   const chosen = chosenPaths(opts.file ?? [], opts.dir ?? []);
@@ -4838,13 +5798,13 @@ traceCmd.command("start").description("start a trace: a grant for this machine,
   ]);
   console.log(`Tracing ${trace.id} as ${opts.source} until ${grant.expires_at}`);
   console.log(scopes.length ? `  content: ${scopes.join(", ")} (redacted here before it leaves)` : "  metadata only");
-  if (opts.hooks) console.log(`  hooks: ${installClaudeHooks(resolve7(typeof opts.hooks === "string" ? opts.hooks : ".claude/settings.local.json"))}`);
+  if (opts.hooks) console.log(`  hooks: ${installClaudeHooks(resolve9(typeof opts.hooks === "string" ? opts.hooks : ".claude/settings.local.json"))}`);
   console.log(`  a session started elsewhere joins it with metadata {"trace_id": "${trace.id}"}`);
   console.log(`  sky trace show ${trace.id}`);
 }));
 traceCmd.command("hook").description("record one Claude Code hook event read from stdin (run by the installed hooks; never fails, prints nothing)").action(async () => {
   try {
-    const { readState, record, flush, grantSender, eventsForClaudeHook, contentForClaudeHook, clearState } = await import("./trace-YKEGRVJN.js");
+    const { readState, record, flush, grantSender, eventsForClaudeHook, contentForClaudeHook, clearState } = await import("./trace-IOARVWJ6.js");
     const chunks = [];
     for await (const chunk of process.stdin) chunks.push(chunk);
     const input = JSON.parse(Buffer.concat(chunks).toString("utf8") || "{}");
@@ -4857,14 +5817,14 @@ traceCmd.command("hook").description("record one Claude Code hook event read fro
   }
 });
 traceCmd.command("flush").description("send what the spool holds, retrying with backoff").action(run(async () => {
-  const { readState, flush, grantSender } = await import("./trace-YKEGRVJN.js");
+  const { readState, flush, grantSender } = await import("./trace-IOARVWJ6.js");
   const state = readState();
   if (!state) throw new Error("no trace is running here");
   const outcome = await flush(grantSender(state), { attempts: 4 });
   console.log(`sent ${outcome.sent}, refused ${outcome.refused}, given up ${outcome.expired}, still pending ${outcome.pending}${outcome.stopped ? ` (stopped: ${outcome.stopped})` : ""}`);
 }));
 traceCmd.command("status").description("the running trace and its spool").action(run(async () => {
-  const { readState, spoolStatus } = await import("./trace-YKEGRVJN.js");
+  const { readState, spoolStatus } = await import("./trace-IOARVWJ6.js");
   const state = readState();
   if (!state) {
     console.log("No trace is running here.");
@@ -4874,7 +5834,7 @@ traceCmd.command("status").description("the running trace and its spool").action
   console.log(`${state.trace_id} as ${state.source}: ${spool.pending} pending, ${spool.dropped_full} dropped (spool full), ${spool.dropped_expired} given up, ${spool.refused} refused`);
 }));
 traceCmd.command("show [id]").description("the trace bundle: spans, the sessions they reach, cost counted once per session").option("--json", "print the bundle as JSON").action(run(async (id, opts) => {
-  const { readState } = await import("./trace-YKEGRVJN.js");
+  const { readState } = await import("./trace-IOARVWJ6.js");
   const ref = id ?? readState()?.trace_id;
   if (!ref) throw new Error("name a trace, or start one here");
   const bundle = await api("GET", `/traces/${ref}`);
@@ -4901,7 +5861,7 @@ traceCmd.command("show [id]").description("the trace bundle: spans, the sessions
   for (const gap of bundle.gaps) console.log(`  gap: ${gap.span_id} ${gap.reason}`);
 }));
 traceCmd.command("stop").description("end the root span, send what is left, and revoke this machine's grant").action(run(async () => {
-  const { readState, record, flush, grantSender, clearState } = await import("./trace-YKEGRVJN.js");
+  const { readState, record, flush, grantSender, clearState } = await import("./trace-IOARVWJ6.js");
   const state = readState();
   if (!state) throw new Error("no trace is running here");
   if (state.root_span) record(() => [{ span_id: state.root_span, kind: "end", outcome: "completed" }]);
@@ -4911,7 +5871,7 @@ traceCmd.command("stop").description("end the root span, send what is left, and
   console.log(`Stopped ${state.trace_id}${outcome.pending ? ` (${outcome.pending} events could not be sent)` : ""}`);
 }));
 traceCmd.command("sync [payload]").description("upload this machine's Claude Code and Codex sessions to the matching workspace's trace library, redacted here first").option("--enable", "turn sync on for this machine").option("--disable", "turn sync off; nothing more is uploaded").option("--route <match=workspace>", "send sessions whose folder path contains <match> to <workspace> (repeatable; replaces the saved rules)", collect).option("--default <workspace>", "where a session no rule matches goes").option("--keep-local", "keep sessions no rule matches on this machine (the default)").option("--session <ref>", "only this session: its id or transcript path (repeatable)", collect).option("--full", "re-read every session, not only files that changed").option("--limit <n>", "at most this many changed sessions this run", (v) => Number.parseInt(v, 10)).option("--dry-run", "show what would be uploaded without uploading").option("--hook", "run from a Claude Code SessionEnd hook or Codex notify: upload that session in the background and return at once").option("--install-schedule", "also sweep every 15 minutes (macOS launchd)").option("--status", "what sync has done on this machine").option("--quiet", "print only failures").action(async (payload, opts) => {
-  const lib = await import("./trace-library-6BK5GJVD.js");
+  const lib = await import("./trace-library-K3NE26GH.js");
   if (opts.hook) {
     try {
       let raw = payload ?? "";
@@ -4959,10 +5919,10 @@ traceCmd.command("sync [payload]").description("upload this machine's Claude Cod
       console.log(`A repository's .agentsky.json "workspace" wins over these rules.`);
     }
     if (opts.installSchedule) {
-      const { join: join12 } = await import("path");
+      const { join: join14 } = await import("path");
       const { homedir: homedir8 } = await import("os");
       const { execFileSync } = await import("child_process");
-      const log = join12(homedir8(), ".config", "sky", "trace-sync.log");
+      const log = join14(homedir8(), ".config", "sky", "trace-sync.log");
       const plist = lib.installLaunchd([process.execPath, process.argv[1], "trace", "sync", "--quiet"], log);
       try {
         execFileSync("launchctl", ["unload", plist], { stdio: "ignore" });
@@ -4972,11 +5932,11 @@ traceCmd.command("sync [payload]").description("upload this machine's Claude Cod
       console.log(`Sweeping every 15 minutes (${plist}); a full re-read runs weekly. Log: ${log}`);
     }
     if (opts.status) {
-      const { readFileSync: readFileSync14 } = await import("fs");
-      const { join: join12 } = await import("path");
+      const { readFileSync: readFileSync15 } = await import("fs");
+      const { join: join14 } = await import("path");
       let state = { sessions: {} };
       try {
-        state = JSON.parse(readFileSync14(join12(lib.syncConfigPath(), "..", "trace-sync-state.json"), "utf8"));
+        state = JSON.parse(readFileSync15(join14(lib.syncConfigPath(), "..", "trace-sync-state.json"), "utf8"));
       } catch {
       }
       const counts = /* @__PURE__ */ new Map();
@@ -5009,7 +5969,7 @@ traceCmd.command("sync [payload]").description("upload this machine's Claude Cod
   })();
 });
 traceCmd.command("search <query...>").description("search every session in a workspace's trace library (literal substring)").option("--workspace <slug>", "the workspace to search (default: the current one)").option("--limit <n>", "hits per page", (v) => Number.parseInt(v, 10), 20).option("--cursor <cursor>", "the next page of an earlier search").option("--json", "print the page as JSON").action(run(async (words, opts) => {
-  const { libraryRequest } = await import("./trace-library-6BK5GJVD.js");
+  const { libraryRequest } = await import("./trace-library-K3NE26GH.js");
   const workspace2 = opts.workspace ?? currentUniverse();
   if (!workspace2) throw new Error("name a workspace with --workspace");
   const params = new URLSearchParams({ q: words.join(" "), scope: "traces", limit: String(opts.limit), ...opts.cursor ? { cursor: opts.cursor } : {} });
@@ -5026,7 +5986,7 @@ traceCmd.command("search <query...>").description("search every session in a wor
   if (page.nextCursor) console.log(`More: sky trace search ${JSON.stringify(words.join(" "))} --workspace ${workspace2} --cursor ${page.nextCursor}`);
 }));
 traceCmd.command("library").description("list the sessions in a workspace's trace library, most recently updated first").option("--workspace <slug>", "the workspace (default: the current one)").option("--limit <n>", "how many", (v) => Number.parseInt(v, 10), 20).option("--json", "print the page as JSON").action(run(async (opts) => {
-  const { libraryRequest } = await import("./trace-library-6BK5GJVD.js");
+  const { libraryRequest } = await import("./trace-library-K3NE26GH.js");
   const workspace2 = opts.workspace ?? currentUniverse();
   if (!workspace2) throw new Error("name a workspace with --workspace");
   const page = await libraryRequest("GET", `/trace-library?limit=${opts.limit}`, workspace2);