@agentsky/sky 2.25.0 → 2.26.0

package/dist/{chunk-QROAAJN2.js → chunk-K3LB4K2C.js}

@@ -3,7 +3,7 @@ import {
   apiBase,
   apiToken,
   currentUniverse
-} from "./chunk-LPUGEMCV.js";
+} from "./chunk-UZ7KWRQH.js";
 
 // src/api.ts
 import { createWriteStream, writeFileSync } from "fs";
@@ -148,7 +148,7 @@ async function resolveSessionRef(ref) {
   return agent.defaultSessionId;
 }
 async function* streamEvents(sessionId, signal) {
-  const { parseSseStream } = await import("./src-BMXKAMOB.js");
+  const { parseSseStream } = await import("./src-OBSBFTDB.js");
   const res = await fetch(
     `${apiBase()}/sessions/${encodeURIComponent(sessionId)}/stream`,
     {

package/dist/{chunk-LPUGEMCV.js → chunk-UZ7KWRQH.js}

@@ -38,7 +38,7 @@ function currentUniverse() {
 }
 
 // src/version.ts
-var CLI_VERSION = "2.25.0";
+var CLI_VERSION = "2.26.0";
 var USER_AGENT = `sky-cli/${CLI_VERSION} (${process.platform}; node/${process.versions.node})`;
 
 export {

package/dist/index.js

@@ -11,7 +11,7 @@ import {
   streamEvents,
   uploadFile,
   writeResponseFile
-} from "./chunk-QROAAJN2.js";
+} from "./chunk-K3LB4K2C.js";
 import {
   CLI_VERSION,
   USER_AGENT,
@@ -22,7 +22,7 @@ import {
   currentUniverse,
   loadConfig,
   saveConfig
-} from "./chunk-LPUGEMCV.js";
+} from "./chunk-UZ7KWRQH.js";
 import {
   AGENT_TYPES,
   MODEL_SUBSCRIPTION_PLAN_PHRASE,
@@ -44,7 +44,7 @@ import {
   skillRefSchema,
   splitMcpServers,
   supersededBy
-} from "./chunk-D3WG4BMK.js";
+} from "./chunk-CJBZVPDF.js";
 import "./chunk-MLKGABMK.js";
 
 // src/index.ts
@@ -2651,6 +2651,13 @@ current revision, supported access and real available members. The reference
 can name a Drive file (including an uploaded meeting note), task file, memory
 note, skill file, agent user instructions (\`{kind:"agent_prompt",agentId}\`), saved artifact or platform artifact. Only the user-authored AGENTS.md is shared; system instructions and credentials are never included. \`workspace\` names the
 audience workspace, never a storage move or the connection's default.
+For a DesignSystem file, use \`platform_artifact\` with the exact full native
+manifest \`path\`: its actual \`root\` plus an \`editable_files\` path, or the
+native document reader's \`libraryRef\`. Do not guess a folder prefix or use
+an editor's relative transport path. Omitting \`path\` shares the entire
+artifact entry. A token reads only its original file; it cannot select a
+sibling with a query parameter. Editable DesignSystem files save through
+that system's versioned writer, including derived files and republishing.
 \`share_library_file\` changes only the requested workspace/member grants;
 \`publish_library_file\` enables or disables a public view-only link while
 preserving other grants. Both read first and merge against the current
@@ -5567,6 +5574,13 @@ async function saveDesignTokens(id, baseVersion, tokens, note) {
     ...note ? { note } : {}
   })).artifact;
 }
+async function saveDesignSystemFile(id, path, baseVersion, change, note) {
+  return (await api("PUT", `/artifacts/${encodeURIComponent(id)}/design-system/files/${path.split("/").map(encodeURIComponent).join("/")}`, {
+    base_version: baseVersion,
+    ...change,
+    ...note ? { note } : {}
+  })).artifact;
+}
 function fileTableFrom(dir) {
   const files2 = {};
   const walk = (current) => {
@@ -7080,9 +7094,10 @@ plugins.command("list").description("the workspace's installed plugins and the s
     for (const p of list) console.log(`${p.name}  ${p.skills.length} skill${p.skills.length === 1 ? "" : "s"}: ${p.skills.map((s) => s.displayName.split("/").pop()).join(", ")}`);
   })
 );
-plugins.command("install <source>").description("install or update a plugin: github:owner/repo[/path][@ref] or a github.com URL").option("--json", "print the result as JSON").action(
+plugins.command("install <source>").description("install or update a plugin: github:owner/repo[/path][@ref] or a github.com URL").option("--mcp-token <server=token...>", "a bearer token for one of the plugin's remote MCP servers (repeatable)").option("--json", "print the result as JSON").action(
   run(async (source, opts) => {
-    const result = await api("POST", "/plugins", { source });
+    const mcp_tokens = Object.fromEntries((opts.mcpToken ?? []).map((pair) => [pair.slice(0, pair.indexOf("=")), pair.slice(pair.indexOf("=") + 1)]).filter(([k, v]) => k && v));
+    const result = await api("POST", "/plugins", { source, ...Object.keys(mcp_tokens).length ? { mcp_tokens } : {} });
     if (opts.json) return void console.log(JSON.stringify(result));
     console.log(`Installed ${result.plugin.name}${result.plugin.version ? ` ${result.plugin.version}` : ""} from ${result.plugin.source}: ${result.skills.length} skill(s), on for every new session.`);
     for (const c of result.connectors) {
@@ -7099,6 +7114,51 @@ plugins.command("rm <name>").description("remove a plugin's skills (a skill a se
     console.log(`Removed ${result.name}: ${result.parts.map((p) => `${p.part} ${p.result.replace("_", " ")}`).join(", ")}`);
   })
 );
+for (const [verb, enabled] of [["enable", true], ["disable", false]]) {
+  plugins.command(`${verb} <name>`).description(enabled ? "switch a plugin back on: its skills attach to new sessions again" : "switch a plugin off: its skills stop attaching to new sessions and plugin sessions refuse to start").action(
+    run(async (name) => {
+      await api("PATCH", `/plugins/${encodeURIComponent(name)}`, { enabled });
+      console.log(`${name} is ${enabled ? "on" : "off"}.`);
+    })
+  );
+}
+plugins.command("run <name> <message>").description("start a plugin session: only that plugin's skills and MCP servers, and connected apps limited to the ones it declared").option("--agent <id>", "the agent to run (default: the workspace's Sky)").option("--json", "print the created session as JSON").action(
+  run(async (name, message2, opts) => {
+    const session2 = await api("POST", `/plugins/${encodeURIComponent(name)}/sessions`, { message: message2, ...opts.agent ? { agent: opts.agent } : {} });
+    if (opts.json) return void console.log(JSON.stringify(session2));
+    console.log(`Started ${session2.id} for ${name}. Follow it: sky session read ${session2.id} --wait`);
+  })
+);
+plugins.command("policy <name> <policy>").description("workspace owners and admins: recommended | default | blocked | none (default installs it now)").option("--source <source>", "where a default plugin installs from (github:owner/repo[/path][@ref])").action(
+  run(async (name, policy2, opts) => {
+    const value = policy2 === "none" ? null : policy2;
+    const result = await api("PUT", `/plugins/${encodeURIComponent(name)}/policy`, { policy: value, ...opts.source ? { source: opts.source } : {} });
+    console.log(`${result.name}: ${result.policy ?? "no policy"}${result.installed ? " (installed)" : ""}`);
+  })
+);
+var market = plugins.command("market").description("Claude Code marketplaces the workspace lists plugins from");
+market.command("list").description("every plugin the workspace's marketplaces list, with its install source, policy and whether it is installed").option("--json", "print the marketplaces as JSON").action(
+  run(async (opts) => {
+    const { marketplaces } = await api("GET", "/plugins/marketplaces");
+    if (opts.json) return void console.log(JSON.stringify(marketplaces));
+    for (const m of marketplaces) {
+      console.log(`${m.name} (${m.source})${m.error ? `: ${m.error}` : ""}`);
+      for (const p of m.plugins) console.log(`  ${p.installed ? "\u25CF" : "\u25CB"} ${p.name}${p.policy ? ` [${p.policy}]` : ""}  ${p.source ?? "(not on GitHub)"}  ${p.description.slice(0, 80)}`);
+    }
+  })
+);
+market.command("add <source>").description("workspace owners and admins: list plugins from a folder holding .claude-plugin/marketplace.json").action(
+  run(async (source) => {
+    const m = await api("POST", "/plugins/marketplaces", { source });
+    console.log(`Added ${m.name} (${m.source}): ${m.plugins.length} plugins.`);
+  })
+);
+market.command("rm <source>").description("workspace owners and admins: stop listing a marketplace (installed plugins stay)").action(
+  run(async (source) => {
+    await api("DELETE", `/plugins/marketplaces?source=${encodeURIComponent(source)}`);
+    console.log(`Removed ${source}.`);
+  })
+);
 var skills = program.command("skills").description("the workspace's skill store: upload a skill, then attach it to an agent (sky skills attach, or [[skills]] in agent.toml)");
 skills.command("upload <dir>").description("upload a skill directory (SKILL.md at its root) as a new skill").option("--name <name>", "display name (default: the directory's name)").option("--json", "print the stored skill as JSON").action(
   run(async (dir, opts) => {
@@ -7285,6 +7345,13 @@ designSystem.command("tokens <id> <file>").description("save a tokens.json file
     console.log(renderArtifact(await saveDesignTokens(id, opts.base, tokens, opts.note)));
   })
 );
+designSystem.command("write <id> <path> [file]").description("save one of the system's editable files (path such as project/README.md) from a local file as its next version, or put back an earlier version's copy with --restore").requiredOption("--base <version>", "the version the file was edited from", (value) => Number(value)).option("--restore <version>", "restore the file as it was in this version instead of reading [file]", (value) => Number(value)).option("--note <note>", "one line saying what changed").action(
+  run(async (id, path, file, opts) => {
+    if (file === void 0 === (opts.restore === void 0)) throw Error("Give a local [file] to save, or --restore <version>.");
+    const change = opts.restore === void 0 ? { content: readFileSync20(resolve9(file), "utf8") } : { restore_version: opts.restore };
+    console.log(renderArtifact(await saveDesignSystemFile(id, path, opts.base, change, opts.note)));
+  })
+);
 designSystem.command("comments <id>").description("read design-system comments, or add one with --text and --base").option("--text <text>", "comment to add").option("--target <target>", "overview, color:<name> or component:<name>", "overview").option("--base <version>", "the version you viewed", Number).action(run(async (id, opts) => {
   if (opts.text !== void 0 && (!Number.isInteger(opts.base) || opts.base < 1)) throw Error("Adding a comment requires --base <version>.");
   console.log(JSON.stringify(await designComments(id, opts.text === void 0 ? void 0 : { text: opts.text, target: opts.target, base_version: opts.base }), null, 2));
@@ -7673,7 +7740,7 @@ memory.command("edit <index> <text...>").description("replace entry <index>").ac
 memory.command("rm <index>").description("remove entry <index>").action(run(async (index) => writeMemory({ op: "remove", index: memoryIndex(index) })));
 memory.command("clear").description("remove every entry").action(run(async () => writeMemory({ op: "clear" })));
 var context = program.command("context").description("search everything you can open in the workspace, and read a hit");
-context.command("search <words...>").description('plain words, "exact phrase" or /regex/ (every matching line, like grep); follow --cursor for more').option("--scope <folder>", "memory/, chats, traces, outputs/, files/, meetings/, skills/<name>/, agents/ or docs/ (default everything)").option("--limit <n>", "hits per page (default 20)").option("--cursor <cursor>", "continue a previous search").option("--since <iso>", "inclusive lower time bound").option("--until <iso>", "exclusive upper time bound").option("--json", "print the API's answer as JSON").action(
+context.command("search <words...>").description('plain words, "exact phrase" or /regex/ (every matching line, like grep); follow --cursor for more').option("--scope <folder>", "memory/, chats, traces, artifacts/, files/, meetings/, skills/<name>/, agents/ or docs/ (default everything)").option("--limit <n>", "hits per page (default 20)").option("--cursor <cursor>", "continue a previous search").option("--since <iso>", "inclusive lower time bound").option("--until <iso>", "exclusive upper time bound").option("--json", "print the API's answer as JSON").action(
   run(async (words, opts) => {
     const page = await searchContext(words.join(" "), opts);
     console.log(opts.json ? JSON.stringify(page, null, 2) : renderContextPage(page));
@@ -8306,7 +8373,7 @@ harness.command("connect").description("run an ACP agent (the command after --)
 }));
 var traceCmd = program.command("trace").description("correlate this machine's agent work with the cloud sessions it starts (metadata only unless you choose content)");
 traceCmd.command("start").description("start a trace: a grant for this machine, a root span, and the spool the hooks write to").option("--name <name>", "a name for the task").option("--source <source>", "how this machine reports itself", "claude-code").option("--hooks [settings]", "also install the Claude Code hooks (default: ./.claude/settings.local.json)").option("--capture <scopes>", "also send content, redacted on this machine first: any of prompts,tool_output,files").option("--file <path>", "a file the files scope may send (repeatable)", collect).option("--dir <path>", "a folder whose files the files scope may send when a file tool touches them (repeatable)", collect).action(run(async (opts) => {
-  const { readState, writeState, record, installClaudeHooks, parseContentScopes, chosenPaths, fileEvent } = await import("./trace-HV4E2BPX.js");
+  const { readState, writeState, record, installClaudeHooks, parseContentScopes, chosenPaths, fileEvent } = await import("./trace-OPRHOP2E.js");
   if (readState()) throw new Error("a trace is already running here \u2014 `sky trace stop` it first");
   const scopes = parseContentScopes(opts.capture);
   const chosen = chosenPaths(opts.file ?? [], opts.dir ?? []);
@@ -8341,7 +8408,7 @@ traceCmd.command("start").description("start a trace: a grant for this machine,
 }));
 traceCmd.command("hook").description("record one Claude Code hook event read from stdin (run by the installed hooks; never fails, prints nothing)").action(async () => {
   try {
-    const { readState, record, flush, grantSender, eventsForClaudeHook, contentForClaudeHook, clearState } = await import("./trace-HV4E2BPX.js");
+    const { readState, record, flush, grantSender, eventsForClaudeHook, contentForClaudeHook, clearState } = await import("./trace-OPRHOP2E.js");
     const chunks = [];
     for await (const chunk of process.stdin) chunks.push(chunk);
     const input = JSON.parse(Buffer.concat(chunks).toString("utf8") || "{}");
@@ -8354,14 +8421,14 @@ traceCmd.command("hook").description("record one Claude Code hook event read fro
   }
 });
 traceCmd.command("flush").description("send what the spool holds, retrying with backoff").action(run(async () => {
-  const { readState, flush, grantSender } = await import("./trace-HV4E2BPX.js");
+  const { readState, flush, grantSender } = await import("./trace-OPRHOP2E.js");
   const state = readState();
   if (!state) throw new Error("no trace is running here");
   const outcome = await flush(grantSender(state), { attempts: 4 });
   console.log(`sent ${outcome.sent}, refused ${outcome.refused}, given up ${outcome.expired}, still pending ${outcome.pending}${outcome.stopped ? ` (stopped: ${outcome.stopped})` : ""}`);
 }));
 traceCmd.command("status").description("the running trace and its spool").action(run(async () => {
-  const { readState, spoolStatus } = await import("./trace-HV4E2BPX.js");
+  const { readState, spoolStatus } = await import("./trace-OPRHOP2E.js");
   const state = readState();
   if (!state) {
     console.log("No trace is running here.");
@@ -8371,7 +8438,7 @@ traceCmd.command("status").description("the running trace and its spool").action
   console.log(`${state.trace_id} as ${state.source}: ${spool.pending} pending, ${spool.dropped_full} dropped (spool full), ${spool.dropped_expired} given up, ${spool.refused} refused`);
 }));
 traceCmd.command("show [id]").description("the trace bundle: spans, the sessions they reach, cost counted once per session").option("--json", "print the bundle as JSON").action(run(async (id, opts) => {
-  const { readState } = await import("./trace-HV4E2BPX.js");
+  const { readState } = await import("./trace-OPRHOP2E.js");
   const ref = id ?? readState()?.trace_id;
   if (!ref) throw new Error("name a trace, or start one here");
   const bundle = await api("GET", `/traces/${ref}`);
@@ -8398,7 +8465,7 @@ traceCmd.command("show [id]").description("the trace bundle: spans, the sessions
   for (const gap of bundle.gaps) console.log(`  gap: ${gap.span_id} ${gap.reason}`);
 }));
 traceCmd.command("stop").description("end the root span, send what is left, and revoke this machine's grant").action(run(async () => {
-  const { readState, record, flush, grantSender, clearState } = await import("./trace-HV4E2BPX.js");
+  const { readState, record, flush, grantSender, clearState } = await import("./trace-OPRHOP2E.js");
   const state = readState();
   if (!state) throw new Error("no trace is running here");
   if (state.root_span) record(() => [{ span_id: state.root_span, kind: "end", outcome: "completed" }]);
@@ -8408,7 +8475,7 @@ traceCmd.command("stop").description("end the root span, send what is left, and
   console.log(`Stopped ${state.trace_id}${outcome.pending ? ` (${outcome.pending} events could not be sent)` : ""}`);
 }));
 traceCmd.command("sync [payload]").description("upload this machine's agent sessions (Claude Code, Codex, Cursor, Gemini CLI and every other agent `--agents` lists) to the matching workspace's trace library, redacted here first").option("--enable", "turn sync on for this machine").option("--disable", "turn sync off; nothing more is uploaded").option("--route <match=workspace>", "send sessions whose folder path contains <match> to <workspace> (repeatable; replaces the saved rules)", collect).option("--default <workspace>", "where a session no rule matches goes").option("--keep-local", "keep sessions no rule matches on this machine (the default)").option("--session <ref>", "only this session: its id or transcript path (repeatable)", collect).option("--import <export>", "add a downloaded cloud export (claude.ai, ChatGPT, Gemini, Grok, DeepSeek \u2026: its .zip, folder or file) so sync uploads it (repeatable)", collect).option("--agents", "list the agents sync reads and which are on this machine").option("--full", "re-read every session, not only files that changed").option("--limit <n>", "at most this many changed sessions this run", (v) => Number.parseInt(v, 10)).option("--dry-run", "show what would be uploaded without uploading").option("--hook", "run from a Claude Code SessionEnd hook or Codex notify: upload that session in the background and return at once").option("--install-schedule", "also sweep every 15 minutes (macOS launchd)").option("--status", "what sync has done on this machine").option("--quiet", "print only failures").action(async (payload, opts) => {
-  const lib = await import("./trace-library-HJWI7KM7.js");
+  const lib = await import("./trace-library-SB7QYAU5.js");
   if (opts.hook) {
     try {
       let raw = payload ?? "";
@@ -8523,7 +8590,7 @@ traceCmd.command("search <query...>").description("search every session in a wor
   console.log(opts.json ? JSON.stringify(page, null, 2) : renderContextPage(page));
 }));
 traceCmd.command("library").description("list the sessions in a workspace's trace library, most recently updated first").option("--workspace <slug>", "the workspace (default: the current one)").option("--limit <n>", "how many", (v) => Number.parseInt(v, 10), 20).option("--json", "print the page as JSON").action(run(async (opts) => {
-  const { libraryRequest } = await import("./trace-library-HJWI7KM7.js");
+  const { libraryRequest } = await import("./trace-library-SB7QYAU5.js");
   const workspace2 = opts.workspace ?? currentUniverse();
   if (!workspace2) throw new Error("name a workspace with --workspace");
   const page = await libraryRequest("GET", `/trace-library?limit=${opts.limit}`, workspace2);

package/dist/{src-BMXKAMOB.js → src-OBSBFTDB.js}

@@ -2,7 +2,7 @@ import {
   admittedInputScopeSchema,
   external_exports,
   messagePartSchema
-} from "./chunk-D3WG4BMK.js";
+} from "./chunk-CJBZVPDF.js";
 import "./chunk-MLKGABMK.js";
 
 // ../../packages/chat/src/stream.ts

package/dist/{trace-HV4E2BPX.js → trace-OPRHOP2E.js}

@@ -1,11 +1,11 @@
 import {
   USER_AGENT,
   configPath
-} from "./chunk-LPUGEMCV.js";
+} from "./chunk-UZ7KWRQH.js";
 import {
   TRACE_CONTENT_SCOPES,
   redactTraceText
-} from "./chunk-D3WG4BMK.js";
+} from "./chunk-CJBZVPDF.js";
 import "./chunk-MLKGABMK.js";
 
 // src/trace.ts

package/dist/{trace-library-HJWI7KM7.js → trace-library-SB7QYAU5.js}

@@ -1,16 +1,16 @@
 import {
   ApiError
-} from "./chunk-QROAAJN2.js";
+} from "./chunk-K3LB4K2C.js";
 import {
   USER_AGENT,
   apiBase,
   apiToken
-} from "./chunk-LPUGEMCV.js";
+} from "./chunk-UZ7KWRQH.js";
 import {
   SessionSourceCollector,
   publicRemote,
   redactTraceText
-} from "./chunk-D3WG4BMK.js";
+} from "./chunk-CJBZVPDF.js";
 import "./chunk-MLKGABMK.js";
 
 // src/trace-library.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentsky/sky",
-  "version": "2.25.0",
+  "version": "2.26.0",
   "description": "sky \u2014 the AgentSky developer CLI: launch and talk to long-lived agents from your terminal.",
   "license": "MIT",
   "type": "module",