@agentsky/sky 2.9.1 → 2.10.0

package/dist/index.js

@@ -16,7 +16,7 @@ import {
   skillRefSchema,
   splitMcpServers,
   supersededBy
-} from "./chunk-YN7PUNIB.js";
+} from "./chunk-5QRKU3BR.js";
 
 // src/index.ts
 import { existsSync as existsSync7, readFileSync as readFileSync10, writeFileSync as writeFileSync6 } from "fs";
@@ -60,11 +60,11 @@ function apiToken() {
   return process.env.SKY_API_TOKEN ?? loadConfig().token;
 }
 function currentUniverse() {
-  return process.env.SKY_UNIVERSE ?? loadConfig().currentUniverse;
+  return process.env.SKY_WORKSPACE ?? process.env.SKY_UNIVERSE ?? loadConfig().currentUniverse;
 }
 
 // src/version.ts
-var CLI_VERSION = "2.9.1";
+var CLI_VERSION = "2.10.0";
 var USER_AGENT = `sky-cli/${CLI_VERSION} (${process.platform}; node/${process.versions.node})`;
 
 // src/api.ts
@@ -185,7 +185,7 @@ async function resolveSessionRef(ref) {
   return agent2.defaultSessionId;
 }
 async function* streamEvents(sessionId, signal) {
-  const { parseSseStream } = await import("./src-QFDLKCFY.js");
+  const { parseSseStream } = await import("./src-RYECJN5I.js");
   const res = await fetch(
     `${apiBase()}/sessions/${encodeURIComponent(sessionId)}/stream`,
     {
@@ -559,7 +559,19 @@ function readClaudeCode() {
     }
   }
   const { prompt, truncated } = assemblePrompt(parts);
-  const { kept, dropped } = splitMcpServers(claudeMcpServers());
+  const allServers = claudeMcpServers();
+  const { kept, dropped } = splitMcpServers(allServers);
+  const secretCandidates = [];
+  for (const d of dropped) {
+    const def = allServers[d.name];
+    if (!def?.env) continue;
+    for (const key of d.envKeys) {
+      const value = def.env[key];
+      if (value !== void 0 && value.trim()) {
+        secretCandidates.push({ serverName: d.name, envKey: key, value, url: d.url });
+      }
+    }
+  }
   return {
     harness: "claude_code",
     configRoot,
@@ -568,7 +580,8 @@ function readClaudeCode() {
     truncated,
     model: claudeModel(configRoot),
     keptServers: kept,
-    droppedServers: dropped
+    droppedServers: dropped,
+    secretCandidates
   };
 }
 function detectHarness(explicit) {
@@ -602,6 +615,79 @@ function writeLink(configRoot, link) {
   writeFileSync3(linkPath(configRoot), `${JSON.stringify(link, null, 2)}
 `);
 }
+var DEFAULT_VAULT_NAME = "default";
+async function fetchDefaultVaultId() {
+  const { vaults } = await api(
+    "GET",
+    "/vaults"
+  );
+  return vaults.find((v) => v.display_name === DEFAULT_VAULT_NAME)?.id ?? null;
+}
+async function ensureDefaultVaultId() {
+  const existing = await fetchDefaultVaultId();
+  if (existing) return existing;
+  try {
+    const { vault } = await api("POST", "/vaults", {
+      display_name: DEFAULT_VAULT_NAME
+    });
+    return vault.id;
+  } catch (error) {
+    if (error instanceof ApiError && error.status === 409) {
+      const raced = await fetchDefaultVaultId();
+      if (raced) return raced;
+    }
+    throw error;
+  }
+}
+async function confirmAndVaultSecrets(candidates, yes) {
+  if (!candidates.length) return;
+  if (yes) {
+    console.log(
+      `  ${candidates.length} secret${candidates.length === 1 ? "" : "s"} from dropped MCP servers not saved (--yes skips vault confirmation).`
+    );
+    return;
+  }
+  console.log("\nSecret-bearing MCP servers were left out of the clone payload.");
+  console.log("You can save their keys to your workspace vault now (values are sent encrypted, never displayed).\n");
+  let vaultId;
+  let saved = 0;
+  let skipped = 0;
+  for (const c of candidates) {
+    const chosen = await confirm(`  Add ${c.envKey} (from ${c.serverName}) to your default vault?`);
+    if (!chosen) {
+      console.log(`  \u2014 skipped ${c.envKey}`);
+      skipped += 1;
+      continue;
+    }
+    try {
+      vaultId ??= await ensureDefaultVaultId();
+      await api("POST", `/vaults/${encodeURIComponent(vaultId)}/secrets`, {
+        display_name: `${c.envKey} (${c.serverName})`,
+        auth: {
+          type: "environment_variable",
+          secret_name: c.envKey,
+          value: c.value,
+          allowed_hosts: c.url ? [c.url] : []
+        }
+      });
+      console.log(`  \u2713 saved ${c.envKey}`);
+      saved += 1;
+    } catch (error) {
+      if (error instanceof ApiError && error.status === 409) {
+        console.log(`  \u2014 ${c.envKey} already in vault`);
+      } else {
+        const msg = error instanceof Error ? error.message : String(error);
+        console.log(`  \u2717 ${c.envKey} failed: ${msg}`);
+      }
+    }
+  }
+  if (saved || skipped) {
+    console.log(
+      `
+Vault: ${saved} saved, ${skipped} skipped. Attach the "default" vault to a session to use these keys.`
+    );
+  }
+}
 function confirm(question) {
   return new Promise((done) => {
     const rl = createInterface({ input: process.stdin, output: process.stdout });
@@ -633,7 +719,7 @@ async function createClone(local, opts) {
   if (local.truncated) console.log("  note: instructions exceeded 100k chars and were truncated");
   if (local.droppedServers.length) {
     console.log(
-      `Left out (need a key): ${local.droppedServers.map((n) => `${n} MCP`).join(", ")}. Run \`sky setup secrets\` to choose which keys to save to your vault.`
+      `Left out of clone (secret-bearing): ${local.droppedServers.map((d) => `${d.name} MCP`).join(", ")}`
     );
   }
   if (opts.dryRun) {
@@ -689,6 +775,7 @@ async function createClone(local, opts) {
   console.log(
     `Linked this machine (${linkPath(local.configRoot)}). Push prompt changes anytime by running \`sky clone\` again.`
   );
+  await confirmAndVaultSecrets(local.secretCandidates, opts.yes ?? false);
   if (opts.open) openBrowser(url);
 }
 async function syncClone(local, link, opts) {
@@ -747,11 +834,12 @@ async function syncClone(local, link, opts) {
   }
   if (local.droppedServers.length) {
     console.log(
-      `  left out (need a key): ${local.droppedServers.map((n) => `${n} MCP`).join(", ")}. Run \`sky setup secrets\` to choose which keys to save to your vault.`
+      `  left out of clone (secret-bearing): ${local.droppedServers.map((d) => `${d.name} MCP`).join(", ")}`
     );
   }
   writeLink(local.configRoot, { ...link, lastSyncedAt: (/* @__PURE__ */ new Date()).toISOString() });
   console.log(`Synced ${link.agentId}.`);
+  await confirmAndVaultSecrets(local.secretCandidates, opts.yes ?? false);
   if (opts.open) openBrowser(`${apiBase()}/agents/${link.agentId}`);
 }
 async function clone(opts) {
@@ -851,7 +939,7 @@ function listClaudeCodeSessions(limit) {
       } catch {
         continue;
       }
-      const workspace = decodeWorkspace(encoded);
+      const workspace2 = decodeWorkspace(encoded);
       for (const entry2 of entries) {
         if (!entry2.endsWith(".jsonl")) continue;
         const sessionId = entry2.slice(0, -6);
@@ -879,7 +967,7 @@ function listClaudeCodeSessions(limit) {
         sessions.push({
           harness: "claude_code",
           sessionId,
-          workspace,
+          workspace: workspace2,
           title: sniffTitle(mainFile),
           mtimeMs: stat.mtimeMs,
           files: [mainFile, ...subagentFiles],
@@ -957,6 +1045,13 @@ function agentUseBase() {
   if (derived.includes("localhost:3000")) return derived.replace("localhost:3000", "localhost:3002");
   return derived;
 }
+function currentSessionEnv() {
+  const claudeId = process.env.CLAUDE_CODE_SESSION_ID;
+  if (claudeId) return { harness: "claude_code", sessionId: claudeId };
+  const codexId = process.env.CODEX_THREAD_ID;
+  if (codexId) return { harness: "codex", sessionId: codexId };
+  return void 0;
+}
 async function mintTrace(base, harness) {
   const token = apiToken();
   if (!token) throw new ApiError(401, "not_logged_in", "not logged in \u2014 run `sky auth login`");
@@ -979,7 +1074,27 @@ async function mintTrace(base, harness) {
   }
   return await res.json();
 }
-function prepareImport(session2) {
+function loadSummaryFile(summaryPath) {
+  let raw;
+  try {
+    raw = readFileSync5(summaryPath, "utf8");
+  } catch {
+    throw new Error(`Cannot read summary file: ${summaryPath}`);
+  }
+  let pkg;
+  try {
+    pkg = JSON.parse(raw);
+  } catch {
+    throw new Error("Summary file is not valid JSON.");
+  }
+  if (!pkg || typeof pkg !== "object" || Array.isArray(pkg)) throw new Error("Summary file must be a JSON object.");
+  const p = pkg;
+  if (p.format !== "asteroids.session-summary") throw new Error('Summary file must have format "asteroids.session-summary".');
+  if (p.format_version !== 1) throw new Error("Summary file must have format_version 1.");
+  const redacted = redactLine2(raw.trimEnd());
+  return redacted;
+}
+function prepareImport(session2, summaryPath) {
   if (session2.discoveryError) throw new Error(session2.discoveryError);
   const maximum = 16 * 1024 * 1024;
   let inputBytes = 0;
@@ -987,19 +1102,40 @@ function prepareImport(session2) {
   const lines = [];
   const digest = createHash("sha256");
   let nativeId;
+  let redactionCount = 0;
+  let encryptedReasoningCount = 0;
+  let compactionCount = 0;
+  let unreadableCount = 0;
   for (const path of session2.files) {
     const stat = statSync(path);
     if (!stat.isFile() || (inputBytes += stat.size) > maximum) throw new Error("Selected transcript exceeds the 16 MiB limit or is not a regular file.");
     const text = readFileSync5(path, "utf8");
     for (const raw of text.split("\n")) {
       if (!raw.trim()) continue;
-      const record = JSON.parse(raw);
+      let record;
+      try {
+        record = JSON.parse(raw);
+      } catch {
+        unreadableCount++;
+        continue;
+      }
       if (!record || typeof record !== "object" || Array.isArray(record)) throw new Error("Transcript records must be JSON objects.");
-      if (String(record.type).startsWith("import.")) throw new Error("Native transcripts cannot supply import protocol records.");
-      const id = record.type === "session_meta" ? record.payload?.id : record.sessionId;
+      const rec = record;
+      if (String(rec.type).startsWith("import.")) throw new Error("Native transcripts cannot supply import protocol records.");
+      if (rec.type === "response_item") {
+        const payload = rec.payload;
+        if (payload?.type === "reasoning" && typeof payload?.encrypted_content === "string" && payload.encrypted_content) {
+          encryptedReasoningCount++;
+        }
+      }
+      if (rec.type === "compacted") {
+        compactionCount++;
+      }
+      const id = rec.type === "session_meta" ? rec.payload?.id : rec.sessionId;
       if (!nativeId && typeof id === "string") nativeId = id;
-      const clean = redactLine(raw.replace(/\r$/, ""), { requireStructured: true }).line;
-      const line = clean + "\n";
+      const result = redactLine(raw.replace(/\r$/, ""), { requireStructured: true });
+      if (Object.keys(result.hits).length > 0) redactionCount++;
+      const line = result.line + "\n";
       outputBytes += Buffer.byteLength(line);
       if (outputBytes > maximum) throw new Error("Redacted transcript exceeds the 16 MiB limit.");
       digest.update(line);
@@ -1009,27 +1145,38 @@ function prepareImport(session2) {
   if (!lines.length) throw new Error("The selected transcript is empty.");
   const sourceId = nativeId ?? session2.sessionId;
   if (!/^[A-Za-z0-9_-]{1,200}$/.test(sourceId) || redactLine2(JSON.stringify(sourceId)) !== JSON.stringify(sourceId)) throw new Error("The source conversation has an invalid identifier.");
-  const summary = {
-    format: "asteroids.session-summary",
-    format_version: 1,
-    source_harness: session2.harness,
-    source_harness_version: null,
-    source_session_id: sourceId,
-    created_at: (/* @__PURE__ */ new Date()).toISOString(),
-    summary: "The complete selected local conversation is attached as a transcript. Review it before continuing; this automatic handoff does not infer the user's unfinished objective or claim any work is complete.",
-    context: {
-      objective: "Review the imported conversation and continue its latest unfinished authorized objective.",
-      constraints: [],
-      decisions: [],
-      completed: [],
-      pending: ["Read the complete imported transcript, reconcile the latest human instructions and completed work, then continue."],
-      verification: [],
-      blockers: ["This handoff contains the recorded conversation only. Referenced local files, runtime state, and unreadable reasoning are not transferred."],
-      artifacts: [],
-      provenance: { native_checkpoint_sha256: digest.digest("hex"), selected_native_session_id: sourceId, context_bytes: outputBytes }
-    }
-  };
-  return lines.join("") + JSON.stringify({ type: "import.summary", package: summary }) + "\n" + JSON.stringify({ type: "import.end", records: lines.length + 1 }) + "\n";
+  let summaryJson;
+  if (summaryPath) {
+    summaryJson = loadSummaryFile(summaryPath);
+  } else {
+    const summary = {
+      format: "asteroids.session-summary",
+      format_version: 1,
+      source_harness: session2.harness,
+      source_harness_version: null,
+      source_session_id: sourceId,
+      created_at: (/* @__PURE__ */ new Date()).toISOString(),
+      summary: "The complete selected local conversation is attached as a transcript. Review it before continuing; this automatic handoff does not infer the user's unfinished objective or claim any work is complete.",
+      context: {
+        objective: "Review the imported conversation and continue its latest unfinished authorized objective.",
+        constraints: [],
+        decisions: [],
+        completed: [],
+        pending: ["Read the complete imported transcript, reconcile the latest human instructions and completed work, then continue."],
+        verification: [],
+        blockers: ["This handoff contains the recorded conversation only. Referenced local files, runtime state, and unreadable reasoning are not transferred."],
+        artifacts: [],
+        provenance: { native_checkpoint_sha256: digest.digest("hex"), selected_native_session_id: sourceId, context_bytes: outputBytes }
+      }
+    };
+    summaryJson = JSON.stringify(summary);
+  }
+  const body = lines.join("") + JSON.stringify({ type: "import.summary", package: JSON.parse(summaryJson) }) + "\n" + JSON.stringify({ type: "import.end", records: lines.length + 1 }) + "\n";
+  const gaps = [];
+  if (encryptedReasoningCount > 0) gaps.push({ kind: "encrypted_reasoning", count: encryptedReasoningCount });
+  if (compactionCount > 0) gaps.push({ kind: "compaction", count: compactionCount });
+  if (unreadableCount > 0) gaps.push({ kind: "unreadable", count: unreadableCount });
+  return { body, transcriptLines: lines.length, outputBytes, redactionCount, gaps };
 }
 async function importSession(opts) {
   const base = (opts.agentUseUrl ?? agentUseBase()).replace(/\/$/, "");
@@ -1038,9 +1185,16 @@ async function importSession(opts) {
     throw new Error("Import requires HTTPS, or a loopback development server.");
   }
   opts.onProgress?.("Reading transcript and redacting secrets locally\u2026");
-  const body = prepareImport(opts.session);
-  opts.onProgress?.("Minting import key\u2026");
-  const { traceId, key } = await mintTrace(base, opts.session.harness);
+  const { body, transcriptLines, outputBytes, redactionCount, gaps } = prepareImport(opts.session, opts.summaryPath);
+  let traceId;
+  let key;
+  if (opts.importKey && opts.grantTraceId) {
+    traceId = opts.grantTraceId;
+    key = opts.importKey;
+  } else {
+    opts.onProgress?.("Minting import key\u2026");
+    ({ traceId, key } = await mintTrace(base, opts.session.harness));
+  }
   opts.onProgress?.("Uploading the complete transcript\u2026");
   const response = await fetch(`${base}/api/traces/ingest`, {
     method: "POST",
@@ -1054,7 +1208,17 @@ async function importSession(opts) {
     throw new Error(typeof result2?.error === "string" ? result2.error : result2?.error?.message ?? `Upload failed (${response.status}).`);
   }
   const result = await response.json();
-  return { traceId: result.traceId ?? traceId, url: `${base}/playground/new?import=${encodeURIComponent(result.traceId ?? traceId)}` };
+  const finalTraceId = result.traceId ?? traceId;
+  return {
+    traceId: finalTraceId,
+    url: `${base}/playground/new?import=${encodeURIComponent(finalTraceId)}`,
+    harness: opts.session.harness,
+    sessionId: opts.session.sessionId,
+    transcriptFiles: opts.session.files.length,
+    bytes: outputBytes,
+    redactionCount,
+    gaps
+  };
 }
 
 // src/login.ts
@@ -1332,12 +1496,13 @@ function renderCatalog(agents, generatedAt) {
 }
 
 // src/skill.ts
+var REFERENCES_DIR = "references";
 var SKILL_NAME = "agentsky";
 var SKILL_MARKER = ".agentsky.json";
 function skillDocument() {
   return `---
 name: ${SKILL_NAME}
-description: "Hire cloud agents from the AgentSky catalog (included as ${CATALOG_FILE}) and coordinate them on one task. Use when the person names an agent by @handle, asks to have another agent (or another engine such as Codex, Claude Code, Gemini or Hermes) do, test or review part of the work, wants work to keep running in the cloud, or the work splits into independent parts that can run at the same time. Works through the agentsky MCP server, or the sky command where those tools are missing."
+description: "Hire cloud agents from the AgentSky catalog (included as ${CATALOG_FILE}) and coordinate them on one task. Use when: the person names an agent by @handle or wants to orchestrate agents; asks another engine (Codex, Claude Code, Gemini, Hermes) to do, test or review part of the work; wants to import, move or continue this conversation in AgentSky or the cloud; names a workspace; or the work splits into independent parts that can run at the same time. Works through the agentsky MCP server, or the sky command where those tools are missing."
 ---
 
 # Working with other agents through AgentSky
@@ -1352,6 +1517,14 @@ Everything below is a tool of the \`agentsky\` MCP server. If those tools are
 missing in this session, use the \`sky\` commands under "Without the MCP tools"
 at the end; they do the same things, one agent at a time.
 
+## Workspace
+
+Use the workspace the person named. If they named none, check the git root for
+\`.agentsky.json\` \u2014 if it has a \`"workspace"\` key, use that. Otherwise use the
+account default (personal). Never ask. Pass the chosen slug as \`workspace\` on
+every MCP tool that accepts it, or as \`--workspace <slug>\` on sky commands.
+Details: \`${REFERENCES_DIR}/workspaces.md\` in this skill's folder.
+
 ## When to hire
 
 - When the person names an agent (\`@handle\`) or an engine, or asks another agent
@@ -1362,9 +1535,6 @@ at the end; they do the same things, one agent at a time.
   going after this conversation ends.
 - Do the work yourself when it is small, when it depends on what you already have
   in front of you, or when explaining it would take as long as doing it.
-- Every hire spends the person's AgentSky balance. Say what you are about to hire
-  and roughly what it may cost before the first one, unless they already asked
-  for it.
 
 ## How to pick
 
@@ -1432,6 +1602,24 @@ it, and name its path in the brief.
 6. Tell the person what was done, which agent did which part, and what it cost
    (\`get_task\` reports the task's cost).
 
+## Import this conversation to AgentSky
+
+When the person asks to import, move, or continue this conversation in AgentSky
+or the cloud:
+
+1. Write a summary JSON file following the schema in \`${REFERENCES_DIR}/import.md\`
+   (the only step that needs judgment \u2014 capture the objective, key decisions,
+   completed work, and next steps).
+2. Run:
+   \`\`\`
+   npx -y @agentsky/sky import --current --summary <path-to-summary.json> --yes --json
+   \`\`\`
+   Add \`--workspace <slug>\` when a workspace was chosen. Do NOT confirm or ask
+   before running; the \`--yes --json\` flags suppress prompts.
+3. Report the \`continueUrl\` from the JSON result. That is all.
+
+Only stop (non-zero exit) on a size limit, dropped content, or redaction failure.
+
 ## Without the MCP tools
 
 Run \`sky auth whoami\`. If it says you are not logged in, ask the person to run
@@ -1451,6 +1639,88 @@ Run \`sky auth whoami\`. If it says you are not logged in, ask the person to run
   read again.
 `;
 }
+function importReferenceDoc() {
+  return `# Import this conversation to AgentSky
+
+## Summary schema (asteroids.session-summary v1)
+
+Write a JSON file with these fields:
+
+\`\`\`json
+{
+  "format": "asteroids.session-summary",
+  "format_version": 1,
+  "source_harness": "claude_code",
+  "source_harness_version": null,
+  "source_session_id": "<the session id, e.g. from CLAUDE_CODE_SESSION_ID>",
+  "created_at": "<ISO 8601 timestamp>",
+  "summary": "<one paragraph: what this conversation accomplished>",
+  "context": {
+    "objective": "<what the person ultimately wants>",
+    "constraints": ["<must not do X>"],
+    "decisions": ["<decided to use Y approach>"],
+    "completed": ["<finished task A>"],
+    "pending": ["<next: do B>"],
+    "verification": ["<how to confirm B is correct>"],
+    "blockers": ["<needs access to X>"],
+    "artifacts": [{"path": "path/to/file.ts", "description": "what it is"}]
+  }
+}
+\`\`\`
+
+Only \`summary\` and \`context\` require judgment. All other fields are fixed values
+or can be omitted (the CLI validates \`format\` and \`format_version\`).
+
+## Gaps
+
+The import transfers the recorded conversation only. These are NOT transferred:
+- Local files not included in the transcript
+- Runtime state (variables, shell state, running processes)
+- Unrecorded tool outputs or reasoning
+- Login credentials and secrets
+
+List known gaps in \`context.blockers\`.
+
+## Non-Claude/Codex harnesses
+
+For harnesses that do not set \`CLAUDE_CODE_SESSION_ID\` or \`CODEX_THREAD_ID\`:
+use \`--session <id>\` instead of \`--current\`, and set \`source_harness\` to the
+harness name (e.g. \`"hermes"\`, \`"openclaw"\`).
+`;
+}
+function workspacesReferenceDoc() {
+  return `# Workspaces in AgentSky
+
+A workspace (also called a universe) groups agents and sessions. Every API call
+and MCP tool accepts an optional workspace slug.
+
+## How to choose
+
+1. The person named one \u2192 use it.
+2. Check the git root for \`.agentsky.json\` with a \`"workspace"\` key \u2192 use that.
+3. Neither \u2192 use the account default (personal workspace). Never ask.
+
+## Applying it
+
+- MCP tools: pass \`workspace: "<slug>"\` on tools that accept it.
+- sky CLI: \`--workspace <slug>\` on any command, or set \`SKY_WORKSPACE=<slug>\`.
+- Tools that take a \`task_id\` or \`session_id\` inherit that task's workspace
+  automatically; one task never spans workspaces.
+
+## Listing workspaces
+
+\`sky workspace list\` (or \`sky universe list\`) prints your workspaces, with
+\`*\` marking the current default.
+
+## .agentsky.json
+
+To set a per-repo default, create \`.agentsky.json\` at the git root:
+
+\`\`\`json
+{"workspace": "my-team-slug"}
+\`\`\`
+`;
+}
 function installedVersion(dir) {
   try {
     const marker = JSON.parse(readFileSync6(join5(dir, SKILL_MARKER), "utf8"));
@@ -1477,6 +1747,10 @@ function installSkill(agent2, opts = {}) {
     mkdirSync2(dir, { recursive: true });
     writeFileSync4(join5(dir, CATALOG_FILE), renderCatalog(opts.catalog, opts.now ?? /* @__PURE__ */ new Date()));
   }
+  const refsDir = join5(dir, REFERENCES_DIR);
+  mkdirSync2(refsDir, { recursive: true });
+  writeFileSync4(join5(refsDir, "import.md"), importReferenceDoc());
+  writeFileSync4(join5(refsDir, "workspaces.md"), workspacesReferenceDoc());
   return { agent: agent2.id, path: dir, outcome };
 }
 
@@ -2328,7 +2602,11 @@ function printModelBilling(session2) {
   console.log(`Model billing: ${label} \u2014 $0 model usage`);
 }
 var program = new Command();
-program.name("sky").description("Launch and talk to long-lived agents \u2014 agentsky.dev").version(CLI_VERSION);
+program.name("sky").description("Launch and talk to long-lived agents \u2014 agentsky.dev").version(CLI_VERSION).option("--workspace <slug>", "workspace to act in (overrides sky universe switch and SKY_UNIVERSE; alias of --universe on sub-commands)");
+program.hook("preAction", () => {
+  const workspace2 = program.opts().workspace;
+  if (workspace2) process.env.SKY_WORKSPACE = workspace2;
+});
 function fail(error) {
   if (error instanceof ApiError) console.error(`sky: ${error.message} (${error.code})`);
   else console.error(`sky: ${error instanceof Error ? error.message : String(error)}`);
@@ -2430,8 +2708,19 @@ universe.command("remove <member>").description("remove a member (user id or ema
 );
 universe.command("join <token>").description("accept an invitation sent to your verified email").action(
   run(async (token) => {
-    const workspace = await joinWorkspace(token);
-    console.log(`Joined ${workspace.slug} (${workspace.name}) \u2014 sky universe switch ${workspace.slug}`);
+    const workspace2 = await joinWorkspace(token);
+    console.log(`Joined ${workspace2.slug} (${workspace2.name}) \u2014 sky universe switch ${workspace2.slug}`);
+  })
+);
+var workspace = program.command("workspace").description("alias of universe: grouping boundary for agents");
+workspace.command("list").action(
+  run(async () => {
+    const { universes } = await api("GET", "/universes");
+    const current = currentUniverse();
+    for (const u of universes) {
+      const marker = u.slug === current || !current && u.isPersonal ? "*" : " ";
+      console.log(`${marker} ${u.slug}${u.isPersonal ? " (personal)" : ""}`);
+    }
   })
 );
 var policy = program.command("policy").description("policy rules: tool calls, spend caps, call counts, capabilities");
@@ -2993,30 +3282,54 @@ function formatRelative(msAgo) {
   if (hours < 48) return `${hours}h ago`;
   return `${Math.round(hours / 24)}d ago`;
 }
-program.command("import").description("import a local Claude Code or Codex session to AgentSky and continue it in the cloud").option("--all", "import all found sessions up to --limit").option("-y, --yes", "confirm transfer of the selected conversations without prompting").option("--limit <n>", "maximum sessions to list or import", "10").option("--session <id>", "import one specific session by its ID").option("--harness <type>", "claude_code | codex | all (default: all)").option("--url <base>", "agent-use app URL (default: derived from SKY_API_URL or AGENT_USE_URL)").action(
+program.command("import").description("import a local Claude Code or Codex session to AgentSky and continue it in the cloud").option("--current", "import the session this agent is running in (reads CLAUDE_CODE_SESSION_ID or CODEX_THREAD_ID, then falls back to most recent session in the cwd)").option("--all", "import all found sessions up to --limit").option("-y, --yes", "confirm transfer without prompting (default when --current or --session is given in non-TTY)").option("--json", "print one JSON result object per import and nothing else to stdout").option("--limit <n>", "maximum sessions to list or import", "10").option("--session <id>", "import one specific session by its ID").option("--harness <type>", "claude_code | codex | all (default: all)").option("--summary <path>", "attach a pre-written summary JSON (asteroids.session-summary v1) instead of the auto-generated one").option("--key <importKey>", "import grant key minted by the web page (skips sky auth login)").option("--trace <traceId>", "trace id paired with --key").option("--url <base>", "agent-use app URL (default: derived from SKY_API_URL or AGENT_USE_URL)").action(
   run(
     async (opts) => {
+      if (opts.key && !opts.trace) throw new Error("--key requires --trace <traceId>");
+      if (opts.trace && !opts.key) throw new Error("--trace requires --key <importKey>");
       const limit = Math.max(1, Math.min(50, parseInt(opts.limit ?? "10", 10) || 10));
       if (opts.harness && !["claude_code", "codex", "all"].includes(opts.harness)) throw new Error("Use --harness claude_code, codex, or all.");
       const harness = opts.harness ?? "all";
       const base = opts.url ?? agentUseBase();
-      const candidates = opts.session ? listRecentSessions(harness === "all" ? void 0 : harness, Number.POSITIVE_INFINITY).filter(
-        (s) => s.sessionId === opts.session
-      ) : listRecentSessions(harness === "all" ? void 0 : harness, limit);
-      if (candidates.length === 0) {
-        if (opts.session) {
-          throw new Error(`Session "${opts.session}" not found in ~/.claude or ~/.codex.`);
+      const nonInteractive = !process.stdin.isTTY;
+      const autoConfirm = opts.yes || opts.current || !!opts.session && nonInteractive;
+      let candidates;
+      if (opts.current) {
+        const env = currentSessionEnv();
+        if (env) {
+          candidates = listRecentSessions(env.harness, Number.POSITIVE_INFINITY).filter(
+            (s) => s.sessionId === env.sessionId
+          );
+          if (candidates.length === 0) {
+            const cwd = process.cwd();
+            const all = listRecentSessions(env.harness, 50);
+            const byCwd = all.filter((s) => s.workspace === cwd || s.workspace.startsWith(cwd + "/"));
+            candidates = byCwd.length > 0 ? [byCwd[0]] : all.length > 0 ? [all[0]] : [];
+          }
+        } else {
+          const cwd = process.cwd();
+          const all = listRecentSessions(harness === "all" ? void 0 : harness, 50);
+          const byCwd = all.filter((s) => s.workspace === cwd || s.workspace.startsWith(cwd + "/"));
+          candidates = byCwd.length > 0 ? [byCwd[0]] : all.length > 0 ? [all[0]] : [];
         }
-        console.log(
-          "No recent sessions found. Make sure you have run Claude Code (sessions in ~/.claude) or Codex (sessions in ~/.codex)."
+        if (candidates.length === 0) throw new Error("No local session found for the current environment. Run with --session <id> or start an agent session first.");
+      } else if (opts.session) {
+        candidates = listRecentSessions(harness === "all" ? void 0 : harness, Number.POSITIVE_INFINITY).filter(
+          (s) => s.sessionId === opts.session
         );
-        return;
+        if (candidates.length === 0) throw new Error(`Session "${opts.session}" not found in ~/.claude or ~/.codex.`);
+      } else {
+        candidates = listRecentSessions(harness === "all" ? void 0 : harness, limit);
+        if (candidates.length === 0) {
+          console.log("No recent sessions found. Make sure you have run Claude Code (sessions in ~/.claude) or Codex (sessions in ~/.codex).");
+          return;
+        }
       }
       let toImport;
-      if (opts.all || opts.session || candidates.length === 1) {
+      if (opts.current || opts.all || opts.session || candidates.length === 1) {
         toImport = candidates;
       } else {
-        if (!process.stdin.isTTY) throw new Error("Use --session or --all to select conversations in a non-interactive terminal.");
+        if (nonInteractive) throw new Error("Use --session, --current, or --all to select conversations in a non-interactive terminal.");
         console.log("\nRecent local sessions:\n");
         candidates.forEach((s, i) => {
           const label = s.title ? `"${s.title.slice(0, 70)}"` : "(no title)";
@@ -3049,10 +3362,12 @@ program.command("import").description("import a local Claude Code or Codex sessi
         }
       }
       toImport = [...new Map(toImport.map((session2) => [`${session2.harness}:${session2.sessionId}`, session2])).values()];
-      console.log(`Selected ${toImport.length} conversation(s), ${toImport.reduce((count, session2) => count + session2.files.length, 0)} transcript file(s). Destination: ${base}`);
-      console.log("The recorded conversation is redacted locally. Local project files and login credentials are not transferred.");
-      if (!opts.yes) {
-        if (!process.stdin.isTTY) throw new Error("Use --yes to confirm this transfer in a non-interactive terminal.");
+      if (!opts.json) {
+        console.log(`Selected ${toImport.length} conversation(s), ${toImport.reduce((count, session2) => count + session2.files.length, 0)} transcript file(s). Destination: ${base}`);
+        console.log("The recorded conversation is redacted locally. Local project files and login credentials are not transferred.");
+      }
+      if (!autoConfirm) {
+        if (nonInteractive) throw new Error("Use --yes to confirm this transfer in a non-interactive terminal.");
         const prompt = createInterface4({ input: process.stdin, output: process.stdout });
         const answer = await new Promise((resolve5) => prompt.question("Upload these selected conversations? [y/N] ", (value) => {
           prompt.close();
@@ -3065,18 +3380,36 @@ program.command("import").description("import a local Claude Code or Codex sessi
       }
       for (const session2 of toImport) {
         const label = session2.title ? `"${session2.title.slice(0, 60)}"` : session2.sessionId;
-        process.stdout.write(`
+        if (!opts.json) process.stdout.write(`
 Importing ${label} \u2026
 `);
         const result = await importSession({
           session: session2,
           agentUseUrl: base,
-          onProgress: (msg) => process.stdout.write(`  ${msg}
+          summaryPath: opts.summary,
+          importKey: opts.key,
+          grantTraceId: opts.trace,
+          onProgress: opts.json ? void 0 : (msg) => process.stdout.write(`  ${msg}
 `)
         });
-        console.log(`  \u2713 Imported. Continue here:
+        if (opts.json) {
+          console.log(JSON.stringify({
+            traceId: result.traceId,
+            url: result.url,
+            workspace: currentUniverse() ?? null,
+            harness: result.harness,
+            sessionId: result.sessionId,
+            transcriptFiles: result.transcriptFiles,
+            bytes: result.bytes,
+            redactionCount: result.redactionCount,
+            gaps: result.gaps,
+            continueUrl: result.url
+          }));
+        } else {
+          console.log(`  \u2713 Imported. Continue here:
     ${result.url}
 `);
+        }
       }
     }
   )