@agentsky/sky 2.20.0 → 2.20.2

package/dist/index.js

@@ -9,7 +9,7 @@ import {
   resolveSessionRef,
   streamEvents,
   uploadFile
-} from "./chunk-ICSGMEG5.js";
+} from "./chunk-WTFBVTMI.js";
 import {
   CLI_VERSION,
   USER_AGENT,
@@ -20,7 +20,7 @@ import {
   currentUniverse,
   loadConfig,
   saveConfig
-} from "./chunk-BHW2NAXP.js";
+} from "./chunk-HB7SPKQ5.js";
 import {
   AGENT_TYPES,
   MODEL_SUBSCRIPTION_PLAN_PHRASE,
@@ -42,11 +42,11 @@ import {
   skillRefSchema,
   splitMcpServers,
   supersededBy
-} from "./chunk-DC3R6BV2.js";
+} from "./chunk-GHTAIKQ6.js";
 import "./chunk-MLKGABMK.js";
 
 // src/index.ts
-import { existsSync as existsSync10, readFileSync as readFileSync15, writeFileSync as writeFileSync8 } from "fs";
+import { existsSync as existsSync10, readFileSync as readFileSync16, writeFileSync as writeFileSync9 } from "fs";
 import { basename as basename8, resolve as resolve9 } from "path";
 import { createInterface as createInterface6 } from "readline";
 import { Command } from "commander";
@@ -2279,6 +2279,12 @@ async function bind(connectionId, opts) {
 async function send(threadId, text) {
   await api("POST", `/channels/threads/${encodeURIComponent(threadId)}/messages`, { parts: [{ type: "markdown", text }] });
 }
+async function history(threadId, opts) {
+  const query = new URLSearchParams();
+  if (opts.limit) query.set("limit", opts.limit);
+  if (opts.cursor) query.set("cursor", opts.cursor);
+  return api("GET", `/channels/threads/${encodeURIComponent(threadId)}/messages?${query}`);
+}
 
 // src/connectors.ts
 import { createServer as createServer2 } from "http";
@@ -2705,7 +2711,7 @@ function latestTurn(events) {
   }
   return reading;
 }
-async function history(sessionId) {
+async function history2(sessionId) {
   const events = [];
   let cursor = null;
   for (; ; ) {
@@ -2724,18 +2730,19 @@ async function history(sessionId) {
 async function readTurn(sessionId, opts = {}) {
   const deadline = Date.now() + (opts.timeoutSeconds ?? 600) * 1e3;
   for (; ; ) {
-    const reading = latestTurn(await history(sessionId));
+    const reading = latestTurn(await history2(sessionId));
     if (reading.finished || !opts.wait || Date.now() >= deadline) return reading;
     await new Promise((resolve10) => setTimeout(resolve10, opts.intervalMs ?? 3e3));
   }
 }
 
 // src/setup.ts
-import { mkdirSync as mkdirSync3, readFileSync as readFileSync12, writeFileSync as writeFileSync5 } from "fs";
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync13, writeFileSync as writeFileSync6 } from "fs";
 import { dirname as dirname6, join as join13 } from "path";
 import { createInterface as createInterface3 } from "readline";
 
 // src/mcp-register.ts
+import { readFileSync as readFileSync10, writeFileSync as writeFileSync5 } from "fs";
 import { spawnSync as spawnSync4 } from "child_process";
 
 // src/skill.ts
@@ -2831,6 +2838,25 @@ Details: \`${REFERENCES_DIR}/workspaces.md\` in this skill's folder.
 - Do the work yourself when it is small, when it depends on what you already have
   in front of you, or when explaining it would take as long as doing it.
 
+## Local first, cloud when it is not here, never a stand-in
+
+- When the person names an engine that is installed and signed in on this
+  computer, run it here: it costs them nothing on AgentSky.
+- When it is not installed here, start that same engine in the cloud: its handle
+  (\`@codex\`, \`@claude_code\`, \u2026) with \`start_session\` and a \`budget_cents\`, and say so
+  in one line ("Codex is not installed on this Mac, so it ran in the cloud").
+  Do not pick another engine instead.
+- Every refused tool call carries a stable error \`code\` (in the error text and in
+  \`structuredContent.error\`) and, when there is one, a \`next_step\`. Read the code:
+  \`insufficient_credits\`, \`workspace_wallet_empty\` and \`payment_setup_required\` mean
+  the account cannot pay; \`budget_reached\` means that session's cap is spent.
+  Stop that piece of work and tell the person what was refused and what unblocks
+  it (credit or a card under Settings \u203A Billing, a larger \`budget_cents\`), then
+  offer the engines that are installed here as the free alternative. Never hire a
+  cheaper or different agent to get around a refusal.
+- \`get_usage\` shows the balance; check it before starting several cloud sessions
+  at once so the person is told once, up front, instead of after the first fails.
+
 ## How to pick
 
 Read \`${CATALOG_FILE}\` in this skill's folder. It lists every agent you can hire,
@@ -3249,6 +3275,9 @@ function redact(text, token) {
   return text.split(token).join(`${token.slice(0, 10)}\u2026`);
 }
 function registerMcpServer(agent2, opts, runner = systemCommandRunner()) {
+  if (agent2.id === "cursor") {
+    return registerCursorMcpServer(agent2, opts);
+  }
   const commands = mcpCommands(agent2.id, opts);
   if (!commands) return { agent: agent2.id, outcome: "unsupported" };
   if (!runner.has(commands.command)) return { agent: agent2.id, outcome: "no_command", detail: `${commands.command} is not on PATH` };
@@ -3258,10 +3287,40 @@ function registerMcpServer(agent2, opts, runner = systemCommandRunner()) {
   if (added.status !== 0) return { agent: agent2.id, outcome: "failed", detail: redact(added.stderr.trim() || `exit ${added.status}`, opts.token) };
   return agent2.id === "codex" ? { agent: agent2.id, outcome: "registered", detail: `set ${CODEX_TOKEN_ENV} to an AgentSky API token in the shell that runs codex` } : { agent: agent2.id, outcome: "registered" };
 }
+function registerCursorMcpServer(agent2, opts) {
+  const configPath2 = `${agent2.root}/mcp.json`;
+  const entry2 = {
+    url: opts.mcpUrl,
+    headers: { Authorization: `Bearer ${opts.token}` }
+  };
+  if (opts.dryRun) {
+    const preview = JSON.stringify({ agentsky: { url: opts.mcpUrl, headers: { Authorization: `Bearer ${opts.token.slice(0, 10)}\u2026` } } }, null, 2);
+    return { agent: agent2.id, outcome: "planned", detail: `would write to ${configPath2}: ${preview}` };
+  }
+  let existing = { mcpServers: {} };
+  try {
+    const raw = readFileSync10(configPath2, "utf8");
+    const parsed = JSON.parse(raw);
+    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+      existing = parsed;
+    }
+  } catch {
+  }
+  const updated = {
+    ...existing,
+    mcpServers: { ...existing.mcpServers ?? {}, [MCP_SERVER_NAME]: entry2 }
+  };
+  try {
+    writeFileSync5(configPath2, JSON.stringify(updated, null, 2) + "\n", "utf8");
+  } catch (err) {
+    return { agent: agent2.id, outcome: "failed", detail: String(err) };
+  }
+  return { agent: agent2.id, outcome: "registered" };
+}
 
 // src/setup-local.ts
 import { isUtf8 as isUtf83 } from "buffer";
-import { existsSync as existsSync7, readdirSync as readdirSync6, readFileSync as readFileSync10, statSync as statSync7 } from "fs";
+import { existsSync as existsSync7, readdirSync as readdirSync6, readFileSync as readFileSync11, statSync as statSync7 } from "fs";
 import { homedir as homedir6 } from "os";
 import { dirname as dirname5, isAbsolute as isAbsolute2, join as join11, resolve as resolve6 } from "path";
 import { parse as parseToml3 } from "smol-toml";
@@ -3292,7 +3351,7 @@ function skillFiles2(root, prefix) {
     if (entry2.isDirectory()) {
       if (!SKIPPED_DIRS.has(entry2.name)) files2.push(...skillFiles2(path, `${prefix}/${entry2.name}`));
     } else if (entry2.isFile() && !sensitive(entry2.name) && statSync7(path).size <= MAX_SKILL_FILE_BYTES) {
-      const bytes = redacted(readFileSync10(path));
+      const bytes = redacted(readFileSync11(path));
       if (bytes) files2.push({ path: `${prefix}/${entry2.name}`, bytes });
     }
   }
@@ -3314,7 +3373,7 @@ function readLocalSkills(agents) {
         }
       }
       if (!isDir2 || !existsSync7(join11(dir, "SKILL.md")) || isInstalledSkill(dir)) continue;
-      const name = frontmatterName(readFileSync10(join11(dir, "SKILL.md"), "utf8"));
+      const name = frontmatterName(readFileSync11(join11(dir, "SKILL.md"), "utf8"));
       if (!name) {
         ignored.push({ agent: agent2.id, dir, reason: "SKILL.md has no name" });
         continue;
@@ -3346,7 +3405,7 @@ function inlineImports(content, from, home, depth, seen) {
     if (seen.includes(path)) return "";
     let imported;
     try {
-      imported = readFileSync10(path, "utf8");
+      imported = readFileSync11(path, "utf8");
     } catch {
       return line;
     }
@@ -3362,7 +3421,7 @@ function readGlobalInstructions(agents, home = homedir6()) {
     const path = join11(agent2.root, file);
     let raw;
     try {
-      raw = readFileSync10(path, "utf8");
+      raw = readFileSync11(path, "utf8");
     } catch {
       continue;
     }
@@ -3381,7 +3440,7 @@ ${item.content.trim()}`).join("\n\n");
 }
 function readJson3(path) {
   try {
-    return JSON.parse(readFileSync10(path, "utf8"));
+    return JSON.parse(readFileSync11(path, "utf8"));
   } catch {
     return void 0;
   }
@@ -3398,7 +3457,7 @@ function serversOf(agent2, home) {
   if (agent2.id === "claude_code") return readJson3(join11(home, ".claude.json"))?.mcpServers ?? {};
   if (agent2.id === "cursor") return readJson3(join11(agent2.root, "mcp.json"))?.mcpServers ?? {};
   try {
-    return parseToml3(readFileSync10(join11(agent2.root, "config.toml"), "utf8")).mcp_servers ?? {};
+    return parseToml3(readFileSync11(join11(agent2.root, "config.toml"), "utf8")).mcp_servers ?? {};
   } catch {
     return {};
   }
@@ -3419,7 +3478,7 @@ function findLocalSecrets(agents, home = homedir6()) {
 
 // src/subscriptions.ts
 import { spawn as spawn3 } from "child_process";
-import { existsSync as existsSync8, readFileSync as readFileSync11 } from "fs";
+import { existsSync as existsSync8, readFileSync as readFileSync12 } from "fs";
 import { homedir as homedir7 } from "os";
 import { join as join12 } from "path";
 import { createInterface as createInterface2 } from "readline";
@@ -3521,7 +3580,7 @@ function codexSignIn(env = process.env, home = homedir7()) {
   if (!existsSync8(path)) {
     throw new ApiError(404, "no_codex_auth", `no ${path} \u2014 run \`codex login\` first`);
   }
-  const raw = readFileSync11(path, "utf8");
+  const raw = readFileSync12(path, "utf8");
   try {
     const parsed = JSON.parse(raw);
     return { path, raw, account: parsed.tokens?.account_id };
@@ -3534,7 +3593,7 @@ function cursorSignIn(env = process.env, home = homedir7()) {
   if (!existsSync8(path)) {
     throw new ApiError(404, "no_cursor_auth", `no ${path} \u2014 run \`cursor-agent login\` first`);
   }
-  const raw = readFileSync11(path, "utf8");
+  const raw = readFileSync12(path, "utf8");
   try {
     const parsed = JSON.parse(raw);
     if (typeof parsed.accessToken !== "string" || typeof parsed.refreshToken !== "string") throw new Error("shape");
@@ -3697,7 +3756,7 @@ function reportPath() {
 }
 function loadReport() {
   try {
-    const saved = JSON.parse(readFileSync12(reportPath(), "utf8"));
+    const saved = JSON.parse(readFileSync13(reportPath(), "utf8"));
     return { agents: saved.agents ?? [], plans: saved.plans ?? [], ...saved.secrets ? { secrets: saved.secrets } : {} };
   } catch {
     return { agents: [], plans: [] };
@@ -3711,7 +3770,7 @@ function mergeReport(base, next) {
 }
 function saveReport(report) {
   mkdirSync3(dirname6(reportPath()), { recursive: true });
-  writeFileSync5(reportPath(), `${JSON.stringify(report, null, 2)}
+  writeFileSync6(reportPath(), `${JSON.stringify(report, null, 2)}
 `, { mode: 384 });
 }
 function confirm3(question) {
@@ -4060,7 +4119,7 @@ function renderArtifact(artifact2) {
 }
 
 // src/skills-store.ts
-import { readdirSync as readdirSync7, readFileSync as readFileSync13, statSync as statSync8 } from "fs";
+import { readdirSync as readdirSync7, readFileSync as readFileSync14, statSync as statSync8 } from "fs";
 import { basename as basename7, join as join14, relative as relative4, resolve as resolve7 } from "path";
 function skillBundle(dir) {
   const root = resolve7(dir);
@@ -4070,7 +4129,7 @@ function skillBundle(dir) {
     for (const name of readdirSync7(path).sort()) {
       const full = join14(path, name);
       if (statSync8(full).isDirectory()) walk(full);
-      else files2.push({ path: `${top}/${relative4(root, full)}`, bytes: readFileSync13(full) });
+      else files2.push({ path: `${top}/${relative4(root, full)}`, bytes: readFileSync14(full) });
     }
   };
   walk(root);
@@ -4109,7 +4168,7 @@ async function getSkillUsage(since) {
 
 // src/task-export.ts
 import { createHash as createHash6 } from "crypto";
-import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync6 } from "fs";
+import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync7 } from "fs";
 import { dirname as dirname7, join as join15 } from "path";
 import { stringify as stringifyToml2 } from "smol-toml";
 var TEXT_MAX = 2e4;
@@ -4402,7 +4461,7 @@ async function exportTaskHarbor(taskRef, outDir, opts) {
   for (const [path, content] of files2) {
     const target = join15(outDir, path);
     mkdirSync4(dirname7(target), { recursive: true });
-    writeFileSync6(target, content, typeof content === "string" ? { mode: path.endsWith(".sh") || path.endsWith(".py") ? 493 : 420 } : void 0);
+    writeFileSync7(target, content, typeof content === "string" ? { mode: path.endsWith(".sh") || path.endsWith(".py") ? 493 : 420 } : void 0);
     written.push(path);
   }
   return { written, record };
@@ -4677,7 +4736,9 @@ async function listBrowserProfiles() {
   return data;
 }
 async function getBrowserProfile(scope) {
-  const { profile } = await api("GET", `/browser_profiles/${encodeURIComponent(scope)}`);
+  const profiles = await listBrowserProfiles();
+  const profile = profiles.find((entry2) => entry2.scope === scope);
+  if (!profile) throw new ApiError(404, "not_found", "browser profile not found");
   return profile;
 }
 async function importBrowserProfileState(scope, state) {
@@ -4687,16 +4748,24 @@ async function listBrowserProfileSites(scope) {
   const profile = await getBrowserProfile(scope);
   return profile.sites;
 }
+async function browserSiteReference(scope, site) {
+  const sites = await listBrowserProfileSites(scope);
+  const row = sites.find((entry2) => entry2.site === site) ?? sites.find((entry2) => entry2.site_id === site);
+  if (!row) throw new ApiError(404, "not_found", "site not found in this browser profile");
+  return row.site_id ? `${encodeURIComponent(row.site_id)}?by=id` : encodeURIComponent(row.site);
+}
 async function removeBrowserProfileSite(scope, site) {
-  await api("DELETE", `/browser_profiles/${encodeURIComponent(scope)}/sites/${encodeURIComponent(site)}`);
+  await api("DELETE", `/browser_profiles/${encodeURIComponent(scope)}/sites/${await browserSiteReference(scope, site)}`);
 }
 async function moveBrowserProfileSite(scope, site, to) {
-  return api("POST", `/browser_profiles/${encodeURIComponent(scope)}/sites/${encodeURIComponent(site)}/move`, { to });
+  const reference = await browserSiteReference(scope, site);
+  const [identifier, query] = reference.split("?");
+  return api("POST", `/browser_profiles/${encodeURIComponent(scope)}/sites/${identifier}/move${query ? `?${query}` : ""}`, { to });
 }
 function renderBrowserProfileSite(site) {
   const who = site.signed_in_by?.email ?? site.signed_in_by?.name ?? "unknown";
   const used = site.last_used_at ? `used ${site.last_used_at.slice(0, 10)}` : "never used";
-  return `${site.site.padEnd(40)} ${site.status.padEnd(14)} ${who}  ${used}`;
+  return `${site.site.padEnd(40)} ${site.status.padEnd(14)} ${who}  ${used}${site.status === "removing" && site.site_id ? `  retry with site ID ${site.site_id}` : ""}`;
 }
 function renderBrowserProfile(profile) {
   const lines = [`scope: ${profile.scope}  revision: ${profile.revision}  sites: ${profile.sites.length}`];
@@ -4737,7 +4806,7 @@ function renderThreadSummary(t) {
 }
 
 // src/harness.ts
-import { existsSync as existsSync9, mkdirSync as mkdirSync5, readFileSync as readFileSync14, writeFileSync as writeFileSync7 } from "fs";
+import { existsSync as existsSync9, mkdirSync as mkdirSync5, readFileSync as readFileSync15, writeFileSync as writeFileSync8 } from "fs";
 import { dirname as dirname8, join as join16, resolve as resolve8 } from "path";
 var HARNESS_FILE = "harness.json";
 function harnessFilePath(dir) {
@@ -4749,7 +4818,7 @@ function readHarnessFile(dir) {
     throw new Error(`no ${HARNESS_FILE} found in ${resolve8(dir)} \u2014 run \`sky harness init\` first`);
   }
   try {
-    return JSON.parse(readFileSync14(path, "utf8"));
+    return JSON.parse(readFileSync15(path, "utf8"));
   } catch (err) {
     throw new Error(`could not parse ${path}: ${err instanceof Error ? err.message : String(err)}`);
   }
@@ -4780,7 +4849,7 @@ function harnessInit(dir) {
     throw new Error(`${path} already exists \u2014 delete it to re-init`);
   }
   mkdirSync5(dirname8(path), { recursive: true });
-  writeFileSync7(path, `${JSON.stringify(INIT_SKELETON, null, 2)}
+  writeFileSync8(path, `${JSON.stringify(INIT_SKELETON, null, 2)}
 `);
   console.log(`Created ${path}`);
   console.log(INIT_COMMENT);
@@ -5239,12 +5308,15 @@ session.command("create <agent>").description("create a session (starts provisio
     }
   )
 );
-session.command("list [agent]").action(
-  run(async (agentRef) => {
-    const qs = agentRef ? `?agent=${encodeURIComponent(agentRef)}` : "";
-    const { sessions } = await api("GET", `/sessions${qs}`);
+session.command("list [agent]").option("--limit <n>", "how many of the newest sessions to list (1-500)", "100").option("--cursor <cursor>", "continue from the cursor a previous page printed").action(
+  run(async (agentRef, opts = {}) => {
+    const params = new URLSearchParams();
+    if (agentRef) params.set("agent", agentRef);
+    if (opts.limit) params.set("limit", opts.limit);
+    if (opts.cursor) params.set("cursor", opts.cursor);
+    const { sessions, next_cursor } = await api("GET", `/sessions?${params}`);
     if (!sessions.length) {
-      console.log("No sessions. `sky session create <agent>` to start one.");
+      console.log(opts.cursor ? "No more sessions." : "No sessions. `sky session create <agent>` to start one.");
       return;
     }
     for (const s of sessions) {
@@ -5252,6 +5324,7 @@ session.command("list [agent]").action(
         `${s.id.padEnd(24)} ${(s.agentId ?? "-").padEnd(20)} ${(s.title ?? "").padEnd(16)} ${s.status}${s.default ? " *" : ""}`
       );
     }
+    if (next_cursor) console.log(`  more: sky session list${agentRef ? ` ${agentRef}` : ""} --cursor ${next_cursor}`);
   })
 );
 session.command("show <id>").action(
@@ -5485,7 +5558,7 @@ sessionWorkspace.command("cat <ref> <path>").description("print a file (up to 1
   run(async (ref, path, opts) => {
     const bytes = await readFile(await resolveSessionRef(ref), path);
     if (opts.out) {
-      writeFileSync8(opts.out, bytes);
+      writeFileSync9(opts.out, bytes);
       console.error(`saved ${bytes.length} bytes to ${opts.out}`);
     } else process.stdout.write(bytes);
   })
@@ -5502,7 +5575,7 @@ sessionWorkspace.command("patch <ref> [repo]").description("the work in a reposi
     console.error(`${meta.repo}: ${meta.commits.length} commit${meta.commits.length === 1 ? "" : "s"} since ${meta.base_branch || "the imported copy"} (${meta.base_commit.slice(0, 12)})`);
     if (!patch.length) console.error("nothing changed");
     else if (opts.out) {
-      writeFileSync8(opts.out, patch);
+      writeFileSync9(opts.out, patch);
       console.error(`wrote ${opts.out} \u2014 apply with: git apply ${opts.out}`);
     } else process.stdout.write(patch);
   })
@@ -6010,14 +6083,14 @@ task.command("get <task> <path>").description("read one task file; prints it, or
   run(async (taskId, path, opts) => {
     const bytes = await readTaskFile(taskId, path);
     if (opts.out) {
-      writeFileSync8(opts.out, bytes);
+      writeFileSync9(opts.out, bytes);
       console.log(`Wrote ${bytes.length} bytes to ${opts.out}`);
     } else process.stdout.write(bytes);
   })
 );
 task.command("put <task> <path> <local>").description("write a local file to <path> in the task's files (every session of the task sees it)").action(
   run(async (taskId, path, local) => {
-    const { file, conflict } = await writeTaskFile(taskId, path, readFileSync15(local), mediaTypeFor(local));
+    const { file, conflict } = await writeTaskFile(taskId, path, readFileSync16(local), mediaTypeFor(local));
     console.log(`${renderTaskFile(file)}${conflict ? "  (replaced a version you had not seen)" : ""}`);
   })
 );
@@ -6171,7 +6244,7 @@ artifact.command("get <id> <path>").description("read one file of an artifact; p
   run(async (id, path, opts) => {
     const bytes = await readArtifactFile(id, path);
     if (opts.out) {
-      writeFileSync8(opts.out, bytes);
+      writeFileSync9(opts.out, bytes);
       console.log(`Wrote ${bytes.length} bytes to ${opts.out}`);
     } else process.stdout.write(bytes);
   })
@@ -6469,7 +6542,7 @@ usageOptions(
   run(async (opts) => {
     const { bytes } = await apiBytes("GET", `/billing/usage/export${usageQuery(opts)}`);
     if (opts.out) {
-      writeFileSync8(opts.out, bytes);
+      writeFileSync9(opts.out, bytes);
       console.log(`Wrote ${bytes.length} bytes to ${opts.out}`);
     } else {
       process.stdout.write(bytes);
@@ -6543,7 +6616,7 @@ webhook.command("list").action(
     for (const w of webhooks) console.log(webhookLine(w));
   })
 );
-webhook.command("create <url>").description("register an endpoint; its signing secret is printed once").requiredOption("--event <type...>", "event types to deliver, e.g. goal.completed routine_run.failed").action(
+webhook.command("create <url>").description("register an endpoint; its signing secret is printed once").requiredOption("--event <type...>", "event types to deliver, e.g. goal.completed routine_run.failed connector.connected connector.granted").action(
   run(async (url, opts) => {
     const { webhook: created } = await api("POST", "/webhooks", { url, events: opts.event });
     console.error(webhookLine(created));
@@ -6587,6 +6660,9 @@ channel.command("bind <connectionId>").description("route a connection to a sess
     console.log(`${connectionId} \u2192 ${opts.session ?? opts.webhook}`);
   })
 );
+channel.command("history <threadId>").description("read one authorized history page; provider history or retained SDK cache, never an agent turn").option("--limit <count>", "messages per page (1..50)", "20").option("--cursor <cursor>", "opaque next_cursor returned for this thread and page size").action(run(async (threadId, opts) => {
+  console.log(JSON.stringify(await history(threadId, opts), null, 2));
+}));
 channel.command("send <threadId> <text...>").description("post a markdown message into a connected thread").action(
   run(async (threadId, text) => {
     await send(threadId, text.join(" "));
@@ -6672,6 +6748,35 @@ connector.command("unshare <connectionId>").description("stop sharing a connecti
     console.log(`Stopped sharing ${connectionId} with ${slug}`);
   })
 );
+var grantLine = (g) => `${g.id}  \u2192 ${g.workspace.slug}  ${g.key ? `key ${g.key.name} (${g.key.id})` : "every key"}  since ${g.created_at.slice(0, 10)}  ${g.use_count} call${g.use_count === 1 ? "" : "s"}`;
+connector.command("grant <connectionId>").description("let a workspace's API keys call through one of your connections (POST /connectors/proxy)").option("--key <id>", "only this key of the workspace, instead of every key").option("--universe <slug>", "the workspace (default: the current one)").action(
+  run(async (connectionId, opts) => {
+    const slug = await workspaceSlug(opts.universe);
+    const { grant } = await api("POST", `/connectors/connections/${encodeURIComponent(connectionId)}/grants`, opts.key ? { key_id: opts.key } : {}, { universe: slug });
+    console.log(`Granted ${connectionId} to ${grant.key ? `key ${grant.key.name}` : "every key"} of ${slug}`);
+  })
+);
+connector.command("revoke <connectionId>").description("take a grant back; the service loses the connection at once").option("--key <id>", "the grant for this one key, instead of the workspace-wide one").option("--universe <slug>", "the workspace (default: the current one)").action(
+  run(async (connectionId, opts) => {
+    const slug = await workspaceSlug(opts.universe);
+    await api("DELETE", `/connectors/connections/${encodeURIComponent(connectionId)}/grants`, opts.key ? { key_id: opts.key } : {}, { universe: slug });
+    console.log(`Revoked ${connectionId} from ${opts.key ? `key ${opts.key}` : "every key"} of ${slug}`);
+  })
+);
+connector.command("grants <connectionId>").description("who may call through one of your connections with a key, and how often they did").action(
+  run(async (connectionId) => {
+    const { grants } = await api("GET", `/connectors/connections/${encodeURIComponent(connectionId)}/grants`);
+    if (!grants.length) console.log("no grants \u2014 `sky connector grant <connectionId> --universe <slug>`");
+    for (const g of grants) console.log(grantLine(g));
+  })
+);
+connector.command("granted").description("connections other people let this key call through").action(
+  run(async () => {
+    const { connections } = await api("GET", "/connectors/connections?granted=true");
+    if (!connections.length) console.log("nothing is granted to this key");
+    for (const c of connections) console.log(`${connectionLine2(c)}  owner ${c.owner_user_id}${c.grant.key_id ? "" : "  (workspace-wide)"}`);
+  })
+);
 connector.command("shared").description("everything you share with workspaces, and the calls made through each").action(
   run(async () => {
     const { shared } = await api("GET", "/shared-connections");
@@ -6988,7 +7093,7 @@ harness.command("connect").description("run an ACP agent (the command after --)
 }));
 var traceCmd = program.command("trace").description("correlate this machine's agent work with the cloud sessions it starts (metadata only unless you choose content)");
 traceCmd.command("start").description("start a trace: a grant for this machine, a root span, and the spool the hooks write to").option("--name <name>", "a name for the task").option("--source <source>", "how this machine reports itself", "claude-code").option("--hooks [settings]", "also install the Claude Code hooks (default: ./.claude/settings.local.json)").option("--capture <scopes>", "also send content, redacted on this machine first: any of prompts,tool_output,files").option("--file <path>", "a file the files scope may send (repeatable)", collect).option("--dir <path>", "a folder whose files the files scope may send when a file tool touches them (repeatable)", collect).action(run(async (opts) => {
-  const { readState, writeState, record, installClaudeHooks, parseContentScopes, chosenPaths, fileEvent } = await import("./trace-DI2SQI7M.js");
+  const { readState, writeState, record, installClaudeHooks, parseContentScopes, chosenPaths, fileEvent } = await import("./trace-HTWXINXI.js");
   if (readState()) throw new Error("a trace is already running here \u2014 `sky trace stop` it first");
   const scopes = parseContentScopes(opts.capture);
   const chosen = chosenPaths(opts.file ?? [], opts.dir ?? []);
@@ -7023,7 +7128,7 @@ traceCmd.command("start").description("start a trace: a grant for this machine,
 }));
 traceCmd.command("hook").description("record one Claude Code hook event read from stdin (run by the installed hooks; never fails, prints nothing)").action(async () => {
   try {
-    const { readState, record, flush, grantSender, eventsForClaudeHook, contentForClaudeHook, clearState } = await import("./trace-DI2SQI7M.js");
+    const { readState, record, flush, grantSender, eventsForClaudeHook, contentForClaudeHook, clearState } = await import("./trace-HTWXINXI.js");
     const chunks = [];
     for await (const chunk of process.stdin) chunks.push(chunk);
     const input = JSON.parse(Buffer.concat(chunks).toString("utf8") || "{}");
@@ -7036,14 +7141,14 @@ traceCmd.command("hook").description("record one Claude Code hook event read fro
   }
 });
 traceCmd.command("flush").description("send what the spool holds, retrying with backoff").action(run(async () => {
-  const { readState, flush, grantSender } = await import("./trace-DI2SQI7M.js");
+  const { readState, flush, grantSender } = await import("./trace-HTWXINXI.js");
   const state = readState();
   if (!state) throw new Error("no trace is running here");
   const outcome = await flush(grantSender(state), { attempts: 4 });
   console.log(`sent ${outcome.sent}, refused ${outcome.refused}, given up ${outcome.expired}, still pending ${outcome.pending}${outcome.stopped ? ` (stopped: ${outcome.stopped})` : ""}`);
 }));
 traceCmd.command("status").description("the running trace and its spool").action(run(async () => {
-  const { readState, spoolStatus } = await import("./trace-DI2SQI7M.js");
+  const { readState, spoolStatus } = await import("./trace-HTWXINXI.js");
   const state = readState();
   if (!state) {
     console.log("No trace is running here.");
@@ -7053,7 +7158,7 @@ traceCmd.command("status").description("the running trace and its spool").action
   console.log(`${state.trace_id} as ${state.source}: ${spool.pending} pending, ${spool.dropped_full} dropped (spool full), ${spool.dropped_expired} given up, ${spool.refused} refused`);
 }));
 traceCmd.command("show [id]").description("the trace bundle: spans, the sessions they reach, cost counted once per session").option("--json", "print the bundle as JSON").action(run(async (id, opts) => {
-  const { readState } = await import("./trace-DI2SQI7M.js");
+  const { readState } = await import("./trace-HTWXINXI.js");
   const ref = id ?? readState()?.trace_id;
   if (!ref) throw new Error("name a trace, or start one here");
   const bundle = await api("GET", `/traces/${ref}`);
@@ -7080,7 +7185,7 @@ traceCmd.command("show [id]").description("the trace bundle: spans, the sessions
   for (const gap of bundle.gaps) console.log(`  gap: ${gap.span_id} ${gap.reason}`);
 }));
 traceCmd.command("stop").description("end the root span, send what is left, and revoke this machine's grant").action(run(async () => {
-  const { readState, record, flush, grantSender, clearState } = await import("./trace-DI2SQI7M.js");
+  const { readState, record, flush, grantSender, clearState } = await import("./trace-HTWXINXI.js");
   const state = readState();
   if (!state) throw new Error("no trace is running here");
   if (state.root_span) record(() => [{ span_id: state.root_span, kind: "end", outcome: "completed" }]);
@@ -7090,7 +7195,7 @@ traceCmd.command("stop").description("end the root span, send what is left, and
   console.log(`Stopped ${state.trace_id}${outcome.pending ? ` (${outcome.pending} events could not be sent)` : ""}`);
 }));
 traceCmd.command("sync [payload]").description("upload this machine's Claude Code and Codex sessions to the matching workspace's trace library, redacted here first").option("--enable", "turn sync on for this machine").option("--disable", "turn sync off; nothing more is uploaded").option("--route <match=workspace>", "send sessions whose folder path contains <match> to <workspace> (repeatable; replaces the saved rules)", collect).option("--default <workspace>", "where a session no rule matches goes").option("--keep-local", "keep sessions no rule matches on this machine (the default)").option("--session <ref>", "only this session: its id or transcript path (repeatable)", collect).option("--full", "re-read every session, not only files that changed").option("--limit <n>", "at most this many changed sessions this run", (v) => Number.parseInt(v, 10)).option("--dry-run", "show what would be uploaded without uploading").option("--hook", "run from a Claude Code SessionEnd hook or Codex notify: upload that session in the background and return at once").option("--install-schedule", "also sweep every 15 minutes (macOS launchd)").option("--status", "what sync has done on this machine").option("--quiet", "print only failures").action(async (payload, opts) => {
-  const lib = await import("./trace-library-4WWKCSVU.js");
+  const lib = await import("./trace-library-QR54Q4Z3.js");
   if (opts.hook) {
     try {
       let raw = payload ?? "";
@@ -7151,11 +7256,11 @@ traceCmd.command("sync [payload]").description("upload this machine's Claude Cod
       console.log(`Sweeping every 15 minutes (${plist}); a full re-read runs weekly. Log: ${log}`);
     }
     if (opts.status) {
-      const { readFileSync: readFileSync16 } = await import("fs");
+      const { readFileSync: readFileSync17 } = await import("fs");
       const { join: join17 } = await import("path");
       let state = { sessions: {} };
       try {
-        state = JSON.parse(readFileSync16(join17(lib.syncConfigPath(), "..", "trace-sync-state.json"), "utf8"));
+        state = JSON.parse(readFileSync17(join17(lib.syncConfigPath(), "..", "trace-sync-state.json"), "utf8"));
       } catch {
       }
       const counts = /* @__PURE__ */ new Map();
@@ -7188,7 +7293,7 @@ traceCmd.command("sync [payload]").description("upload this machine's Claude Cod
   })();
 });
 traceCmd.command("search <query...>").description("search every session in a workspace's trace library (literal substring)").option("--workspace <slug>", "the workspace to search (default: the current one)").option("--limit <n>", "hits per page", (v) => Number.parseInt(v, 10), 20).option("--cursor <cursor>", "the next page of an earlier search").option("--json", "print the page as JSON").action(run(async (words, opts) => {
-  const { libraryRequest } = await import("./trace-library-4WWKCSVU.js");
+  const { libraryRequest } = await import("./trace-library-QR54Q4Z3.js");
   const workspace2 = opts.workspace ?? currentUniverse();
   if (!workspace2) throw new Error("name a workspace with --workspace");
   const params = new URLSearchParams({ q: words.join(" "), scope: "traces", limit: String(opts.limit), ...opts.cursor ? { cursor: opts.cursor } : {} });
@@ -7205,7 +7310,7 @@ traceCmd.command("search <query...>").description("search every session in a wor
   if (page.nextCursor) console.log(`More: sky trace search ${JSON.stringify(words.join(" "))} --workspace ${workspace2} --cursor ${page.nextCursor}`);
 }));
 traceCmd.command("library").description("list the sessions in a workspace's trace library, most recently updated first").option("--workspace <slug>", "the workspace (default: the current one)").option("--limit <n>", "how many", (v) => Number.parseInt(v, 10), 20).option("--json", "print the page as JSON").action(run(async (opts) => {
-  const { libraryRequest } = await import("./trace-library-4WWKCSVU.js");
+  const { libraryRequest } = await import("./trace-library-QR54Q4Z3.js");
   const workspace2 = opts.workspace ?? currentUniverse();
   if (!workspace2) throw new Error("name a workspace with --workspace");
   const page = await libraryRequest("GET", `/trace-library?limit=${opts.limit}`, workspace2);