@agentsky/sky 2.9.2 → 2.11.0

package/dist/index.js

@@ -1,4 +1,15 @@
 #!/usr/bin/env node
+import {
+  CLI_VERSION,
+  USER_AGENT,
+  apiBase,
+  apiToken,
+  configPath,
+  consoleBase,
+  currentUniverse,
+  loadConfig,
+  saveConfig
+} from "./chunk-RWPPIEHH.js";
 import {
   AGENT_TYPES,
   MODEL_SUBSCRIPTION_PLAN_PHRASE,
@@ -8,6 +19,7 @@ import {
   customDataSchema,
   defaultLlm,
   external_exports,
+  harnessProfileSchema,
   isModelEffortSupported,
   mcpServersFromKept,
   modelSubscriptionProviderFor,
@@ -16,57 +28,15 @@ import {
   skillRefSchema,
   splitMcpServers,
   supersededBy
-} from "./chunk-MLIZJSMO.js";
+} from "./chunk-WC7GJSAJ.js";
+import "./chunk-MLKGABMK.js";
 
 // src/index.ts
-import { existsSync as existsSync7, readFileSync as readFileSync10, writeFileSync as writeFileSync6 } from "fs";
-import { basename as basename3, resolve as resolve4 } from "path";
+import { existsSync as existsSync8, readFileSync as readFileSync11, writeFileSync as writeFileSync6 } from "fs";
+import { basename as basename4, resolve as resolve6 } from "path";
 import { createInterface as createInterface4 } from "readline";
 import { Command } from "commander";
 
-// src/config.ts
-import { mkdirSync, readFileSync, writeFileSync } from "fs";
-import { homedir } from "os";
-import { dirname, join } from "path";
-var DEFAULT_API_BASE = "https://api.agentsky.dev/v1";
-var DEFAULT_CONSOLE_BASE = "https://platform.agentsky.dev";
-function configPath() {
-  return join(process.env.SKY_CONFIG_DIR ?? join(homedir(), ".config", "sky"), "config.json");
-}
-function loadConfig() {
-  try {
-    return JSON.parse(readFileSync(configPath(), "utf8"));
-  } catch {
-    return {};
-  }
-}
-function saveConfig(config) {
-  const path = configPath();
-  mkdirSync(dirname(path), { recursive: true });
-  writeFileSync(path, `${JSON.stringify(config, null, 2)}
-`, { mode: 384 });
-}
-function apiBase() {
-  return (process.env.SKY_API_URL ?? loadConfig().apiBase ?? DEFAULT_API_BASE).replace(/\/$/, "");
-}
-function consoleBase() {
-  const configured = process.env.SKY_CONSOLE_URL ?? loadConfig().consoleBase;
-  if (configured) return configured.replace(/\/$/, "");
-  const api2 = apiBase();
-  if (api2 === DEFAULT_API_BASE) return DEFAULT_CONSOLE_BASE;
-  return api2.replace(/\/(?:api\/)?v1$/, "") || api2;
-}
-function apiToken() {
-  return process.env.SKY_API_TOKEN ?? loadConfig().token;
-}
-function currentUniverse() {
-  return process.env.SKY_UNIVERSE ?? loadConfig().currentUniverse;
-}
-
-// src/version.ts
-var CLI_VERSION = "2.9.2";
-var USER_AGENT = `sky-cli/${CLI_VERSION} (${process.platform}; node/${process.versions.node})`;
-
 // src/api.ts
 var ApiError = class extends Error {
   constructor(status, code, message2) {
@@ -141,6 +111,15 @@ async function uploadFile(bytes, filename, mediaType, expiresInSeconds) {
   if (!res.ok) await parseError(res);
   return await res.json();
 }
+async function apiForm(method, path, form) {
+  const res = await fetch(`${apiBase()}${path}`, {
+    method,
+    headers: { "user-agent": USER_AGENT, ...authHeaders() },
+    body: form
+  });
+  if (!res.ok) await parseError(res);
+  return await res.json();
+}
 async function downloadFile(fileId) {
   const res = await fetch(`${apiBase()}/files/${encodeURIComponent(fileId)}/content`, {
     headers: { "user-agent": USER_AGENT, ...authHeaders() }
@@ -185,7 +164,7 @@ async function resolveSessionRef(ref) {
   return agent2.defaultSessionId;
 }
 async function* streamEvents(sessionId, signal) {
-  const { parseSseStream } = await import("./src-QYXD7WXR.js");
+  const { parseSseStream } = await import("./src-HVCP3PPM.js");
   const res = await fetch(
     `${apiBase()}/sessions/${encodeURIComponent(sessionId)}/stream`,
     {
@@ -209,7 +188,7 @@ async function* streamEvents(sessionId, signal) {
 }
 
 // src/files.ts
-import { readFileSync as readFileSync2 } from "fs";
+import { readFileSync } from "fs";
 import { basename, extname } from "path";
 var MEDIA_TYPES = {
   ".png": "image/png",
@@ -231,7 +210,7 @@ function mediaTypeFor(path) {
   return MEDIA_TYPES[extname(path).toLowerCase()] ?? "application/octet-stream";
 }
 async function uploadLocalFile(path, expiresInSeconds) {
-  const bytes = readFileSync2(path);
+  const bytes = readFileSync(path);
   return uploadFile(new Uint8Array(bytes), basename(path), mediaTypeFor(path), expiresInSeconds);
 }
 function fileBlock(file) {
@@ -328,8 +307,8 @@ function renderGoal(goal2) {
 }
 
 // src/agent-file.ts
-import { existsSync, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
-import { dirname as dirname2, resolve } from "path";
+import { existsSync, readFileSync as readFileSync2, writeFileSync } from "fs";
+import { dirname, resolve } from "path";
 import { parse as parseToml, stringify as stringifyToml } from "smol-toml";
 var fileInstructionSchema = external_exports.object({
   name: external_exports.string(),
@@ -352,12 +331,16 @@ var agentFileSchema = external_exports.object({
   instructions: external_exports.array(fileInstructionSchema).optional(),
   skills: external_exports.array(skillRefSchema).optional(),
   customData: external_exports.array(customDataSchema).optional(),
+  /** "deny" makes the agent work alone: its sessions may not hire helpers. */
+  hiring_policy: external_exports.enum(["allow", "deny"]).optional(),
+  /** The environment its sessions boot in when they name none. */
+  environment: external_exports.string().min(1).optional(),
   /** Advanced machine shape (create-only): 1|2|4|8 vCPUs, 256MB-step memory. */
   vcpus: external_exports.number().int().optional(),
   memory_mb: external_exports.number().int().optional()
 });
 function readAgentFile(path) {
-  const raw = readFileSync3(path, "utf8");
+  const raw = readFileSync2(path, "utf8");
   const parsed = agentFileSchema.safeParse(parseToml(raw));
   if (!parsed.success) {
     const issue = parsed.error.issues[0];
@@ -369,11 +352,11 @@ function readAgentFile(path) {
       `${path}: reasoning_effort '${file.reasoning_effort}' is not available for ${file.type} \u2014 ${reasoningEffortDocLine()}`
     );
   }
-  const base = dirname2(resolve(path));
+  const base = dirname(resolve(path));
   const inline = (ref, inlineContent) => {
     if (inlineContent !== void 0) return inlineContent;
     if (!ref) return void 0;
-    return readFileSync3(resolve(base, ref), "utf8");
+    return readFileSync2(resolve(base, ref), "utf8");
   };
   const spec = {
     name: file.name,
@@ -391,20 +374,22 @@ function readAgentFile(path) {
     }),
     skills: file.skills,
     customData: file.customData,
+    hiringPolicy: file.hiring_policy,
+    environmentId: file.environment,
     vcpus: file.vcpus,
     memoryMb: file.memory_mb
   };
   return { file, spec };
 }
 function stampId(path, id) {
-  const doc = parseToml(readFileSync3(path, "utf8"));
+  const doc = parseToml(readFileSync2(path, "utf8"));
   doc.id = id;
   delete doc.slug;
-  writeFileSync2(path, stringifyToml(doc));
+  writeFileSync(path, stringifyToml(doc));
 }
 function scaffoldAgentFile(path, name) {
   if (existsSync(path)) throw new Error(`${path} already exists`);
-  writeFileSync2(
+  writeFileSync(
     path,
     `# agent.toml \u2014 everything the create wizard can set. Only \`name\` is required.
 name = "${name}"
@@ -412,6 +397,11 @@ name = "${name}"
 # llm = "deepseek-flash"       # must be compatible with type
 # reasoning_effort = "high"    # per harness \u2014 ${reasoningEffortDocLine()}
 # capabilities = []
+# hiring_policy = "deny"       # its sessions work alone; "allow" (default) lets them hire helpers
+# environment = "env_..."      # the environment its sessions boot in when they name none
+# [[skills]]                   # a skill from \`sky skills upload <dir>\`
+# type = "skill"
+# skillId = "skill_..."
 
 prompt = """
 You are ${name}, a helpful long-lived agent.
@@ -485,18 +475,18 @@ function renderCatalogAgent(agent2) {
 
 // src/clone.ts
 import { spawn } from "child_process";
-import { existsSync as existsSync2, readFileSync as readFileSync4, writeFileSync as writeFileSync3 } from "fs";
-import { homedir as homedir2 } from "os";
-import { basename as basename2, join as join2 } from "path";
+import { existsSync as existsSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
+import { homedir } from "os";
+import { basename as basename2, join } from "path";
 import { createInterface } from "readline";
 var PROMPT_CAP = 1e5;
 var HARNESSES = ["claude_code", "codex", "openclaw"];
 function claudeConfigRoot() {
-  return process.env.CLAUDE_CONFIG_DIR ?? join2(homedir2(), ".claude");
+  return process.env.CLAUDE_CONFIG_DIR ?? join(homedir(), ".claude");
 }
 function readIfExists(path) {
   try {
-    return readFileSync4(path, "utf8");
+    return readFileSync3(path, "utf8");
   } catch {
     return void 0;
   }
@@ -512,9 +502,9 @@ function readJson(path) {
 }
 function claudeModel(configRoot) {
   const candidates = [
-    join2(process.cwd(), ".claude", "settings.local.json"),
-    join2(process.cwd(), ".claude", "settings.json"),
-    join2(configRoot, "settings.json")
+    join(process.cwd(), ".claude", "settings.local.json"),
+    join(process.cwd(), ".claude", "settings.json"),
+    join(configRoot, "settings.json")
   ];
   for (const path of candidates) {
     const model = readJson(path)?.model;
@@ -524,11 +514,11 @@ function claudeModel(configRoot) {
 }
 function claudeMcpServers() {
   const merged = {};
-  const userConfig = readJson(join2(homedir2(), ".claude.json"));
+  const userConfig = readJson(join(homedir(), ".claude.json"));
   Object.assign(merged, userConfig?.mcpServers ?? {});
   Object.assign(merged, userConfig?.projects?.[process.cwd()]?.mcpServers ?? {});
   const projectConfig = readJson(
-    join2(process.cwd(), ".mcp.json")
+    join(process.cwd(), ".mcp.json")
   );
   Object.assign(merged, projectConfig?.mcpServers ?? {});
   return merged;
@@ -545,13 +535,13 @@ function readClaudeCode() {
   const configRoot = claudeConfigRoot();
   const parts = [];
   const sources = [];
-  const global = readIfExists(join2(configRoot, "CLAUDE.md"));
+  const global = readIfExists(join(configRoot, "CLAUDE.md"));
   if (global?.trim()) {
     parts.push({ label: "Global CLAUDE.md", content: global });
     sources.push("global CLAUDE.md");
   }
   for (const name of ["CLAUDE.md", "AGENTS.md"]) {
-    const project = readIfExists(join2(process.cwd(), name));
+    const project = readIfExists(join(process.cwd(), name));
     if (project?.trim()) {
       parts.push({ label: `Project ${name}`, content: project });
       sources.push(`project ${name}`);
@@ -592,27 +582,27 @@ function detectHarness(explicit) {
     return explicit;
   }
   if (existsSync2(claudeConfigRoot())) return "claude_code";
-  if (existsSync2(join2(homedir2(), ".codex"))) return "codex";
-  if (existsSync2(join2(homedir2(), ".openclaw"))) return "openclaw";
+  if (existsSync2(join(homedir(), ".codex"))) return "codex";
+  if (existsSync2(join(homedir(), ".openclaw"))) return "openclaw";
   throw new Error(
     "no local harness found (~/.claude, ~/.codex, ~/.openclaw) \u2014 pass --harness to override"
   );
 }
-function readLocal(harness) {
-  if (harness === "claude_code") return readClaudeCode();
+function readLocal(harness2) {
+  if (harness2 === "claude_code") return readClaudeCode();
   throw new Error(
-    `${harness} cloning lands next \u2014 claude_code is the first supported harness`
+    `${harness2} cloning lands next \u2014 claude_code is the first supported harness`
   );
 }
 function linkPath(configRoot) {
-  return join2(configRoot, "agentsky-link.json");
+  return join(configRoot, "agentsky-link.json");
 }
 function readLink(configRoot) {
   const link = readJson(linkPath(configRoot));
   return link?.agentId ? link : void 0;
 }
 function writeLink(configRoot, link) {
-  writeFileSync3(linkPath(configRoot), `${JSON.stringify(link, null, 2)}
+  writeFileSync2(linkPath(configRoot), `${JSON.stringify(link, null, 2)}
 `);
 }
 var DEFAULT_VAULT_NAME = "default";
@@ -843,17 +833,17 @@ async function syncClone(local, link, opts) {
   if (opts.open) openBrowser(`${apiBase()}/agents/${link.agentId}`);
 }
 async function clone(opts) {
-  const harness = detectHarness(opts.harness);
-  const local = readLocal(harness);
+  const harness2 = detectHarness(opts.harness);
+  const local = readLocal(harness2);
   const link = opts.new ? void 0 : readLink(local.configRoot);
   if (link) await syncClone(local, link, opts);
   else await createClone(local, opts);
 }
 
 // src/import-local.ts
-import { closeSync, existsSync as existsSync3, openSync, readdirSync, readFileSync as readFileSync5, readSync, statSync } from "fs";
-import { homedir as homedir3 } from "os";
-import { join as join3 } from "path";
+import { closeSync, existsSync as existsSync3, openSync, readdirSync, readFileSync as readFileSync4, readSync, statSync } from "fs";
+import { homedir as homedir2 } from "os";
+import { join as join2 } from "path";
 import { createHash } from "crypto";
 function redactLine2(raw) {
   return redactLine(raw).line;
@@ -926,24 +916,24 @@ function sniffTitle(filePath) {
   }
 }
 function listClaudeCodeSessions(limit) {
-  const root = process.env.CLAUDE_CONFIG_DIR ?? join3(homedir3(), ".claude");
-  const projectsDir = join3(root, "projects");
+  const root = process.env.CLAUDE_CONFIG_DIR ?? join2(homedir2(), ".claude");
+  const projectsDir = join2(root, "projects");
   if (!existsSync3(projectsDir)) return [];
   const sessions = [];
   try {
     for (const encoded of readdirSync(projectsDir)) {
-      const projectDir = join3(projectsDir, encoded);
+      const projectDir = join2(projectsDir, encoded);
       let entries;
       try {
         entries = readdirSync(projectDir);
       } catch {
         continue;
       }
-      const workspace = decodeWorkspace(encoded);
+      const workspace2 = decodeWorkspace(encoded);
       for (const entry2 of entries) {
         if (!entry2.endsWith(".jsonl")) continue;
         const sessionId = entry2.slice(0, -6);
-        const mainFile = join3(projectDir, entry2);
+        const mainFile = join2(projectDir, entry2);
         let stat;
         try {
           stat = statSync(mainFile);
@@ -953,12 +943,12 @@ function listClaudeCodeSessions(limit) {
         if (!stat.isFile()) continue;
         let discoveryError;
         const subagentFiles = [];
-        const subagentDir = join3(projectDir, sessionId, "subagents");
+        const subagentDir = join2(projectDir, sessionId, "subagents");
         if (existsSync3(subagentDir)) {
           try {
             const subFiles = readdirSync(subagentDir).filter((f) => f.endsWith(".jsonl")).sort();
             for (const f of subFiles) {
-              subagentFiles.push(join3(subagentDir, f));
+              subagentFiles.push(join2(subagentDir, f));
             }
           } catch {
             discoveryError = "Cannot read all recorded subagent conversations. Fix local file access before importing this session.";
@@ -967,7 +957,7 @@ function listClaudeCodeSessions(limit) {
         sessions.push({
           harness: "claude_code",
           sessionId,
-          workspace,
+          workspace: workspace2,
           title: sniffTitle(mainFile),
           mtimeMs: stat.mtimeMs,
           files: [mainFile, ...subagentFiles],
@@ -980,7 +970,7 @@ function listClaudeCodeSessions(limit) {
   return sessions.sort((a, b) => b.mtimeMs - a.mtimeMs).slice(0, limit);
 }
 function listCodexSessions(limit) {
-  const sessionsDir = join3(process.env.CODEX_HOME ?? process.env.CODEX_CONFIG_DIR ?? join3(homedir3(), ".codex"), "sessions");
+  const sessionsDir = join2(process.env.CODEX_HOME ?? process.env.CODEX_CONFIG_DIR ?? join2(homedir2(), ".codex"), "sessions");
   const records = [];
   function walk(dir) {
     let entries;
@@ -990,7 +980,7 @@ function listCodexSessions(limit) {
       return;
     }
     for (const entry2 of entries) {
-      const full = join3(dir, entry2.name);
+      const full = join2(dir, entry2.name);
       if (entry2.isDirectory()) {
         walk(full);
         continue;
@@ -1032,9 +1022,9 @@ function listCodexSessions(limit) {
     files: [.../* @__PURE__ */ new Set([...session2.files, ...descendants(session2.sessionId, /* @__PURE__ */ new Set())])]
   })).sort((a, b) => b.mtimeMs - a.mtimeMs).slice(0, limit);
 }
-function listRecentSessions(harness, limit) {
-  const claudeSessions = harness === "codex" ? [] : listClaudeCodeSessions(limit);
-  const codexSessions = harness === "claude_code" ? [] : listCodexSessions(limit);
+function listRecentSessions(harness2, limit) {
+  const claudeSessions = harness2 === "codex" ? [] : listClaudeCodeSessions(limit);
+  const codexSessions = harness2 === "claude_code" ? [] : listCodexSessions(limit);
   return [...claudeSessions, ...codexSessions].sort((a, b) => b.mtimeMs - a.mtimeMs).slice(0, limit);
 }
 function agentUseBase() {
@@ -1045,7 +1035,14 @@ function agentUseBase() {
   if (derived.includes("localhost:3000")) return derived.replace("localhost:3000", "localhost:3002");
   return derived;
 }
-async function mintTrace(base, harness) {
+function currentSessionEnv() {
+  const claudeId = process.env.CLAUDE_CODE_SESSION_ID;
+  if (claudeId) return { harness: "claude_code", sessionId: claudeId };
+  const codexId = process.env.CODEX_THREAD_ID;
+  if (codexId) return { harness: "codex", sessionId: codexId };
+  return void 0;
+}
+async function mintTrace(base, harness2) {
   const token = apiToken();
   if (!token) throw new ApiError(401, "not_logged_in", "not logged in \u2014 run `sky auth login`");
   const res = await fetch(`${base}/api/traces`, {
@@ -1057,7 +1054,7 @@ async function mintTrace(base, harness) {
       authorization: `Bearer ${token}`,
       "user-agent": USER_AGENT
     },
-    body: JSON.stringify({ harness })
+    body: JSON.stringify({ harness: harness2 })
   });
   if (!res.ok) {
     const body = await res.json().catch(() => null);
@@ -1067,7 +1064,27 @@ async function mintTrace(base, harness) {
   }
   return await res.json();
 }
-function prepareImport(session2) {
+function loadSummaryFile(summaryPath) {
+  let raw;
+  try {
+    raw = readFileSync4(summaryPath, "utf8");
+  } catch {
+    throw new Error(`Cannot read summary file: ${summaryPath}`);
+  }
+  let pkg;
+  try {
+    pkg = JSON.parse(raw);
+  } catch {
+    throw new Error("Summary file is not valid JSON.");
+  }
+  if (!pkg || typeof pkg !== "object" || Array.isArray(pkg)) throw new Error("Summary file must be a JSON object.");
+  const p = pkg;
+  if (p.format !== "asteroids.session-summary") throw new Error('Summary file must have format "asteroids.session-summary".');
+  if (p.format_version !== 1) throw new Error("Summary file must have format_version 1.");
+  const redacted = redactLine2(raw.trimEnd());
+  return redacted;
+}
+function prepareImport(session2, summaryPath) {
   if (session2.discoveryError) throw new Error(session2.discoveryError);
   const maximum = 16 * 1024 * 1024;
   let inputBytes = 0;
@@ -1075,19 +1092,40 @@ function prepareImport(session2) {
   const lines = [];
   const digest = createHash("sha256");
   let nativeId;
+  let redactionCount = 0;
+  let encryptedReasoningCount = 0;
+  let compactionCount = 0;
+  let unreadableCount = 0;
   for (const path of session2.files) {
     const stat = statSync(path);
     if (!stat.isFile() || (inputBytes += stat.size) > maximum) throw new Error("Selected transcript exceeds the 16 MiB limit or is not a regular file.");
-    const text = readFileSync5(path, "utf8");
+    const text = readFileSync4(path, "utf8");
     for (const raw of text.split("\n")) {
       if (!raw.trim()) continue;
-      const record = JSON.parse(raw);
+      let record;
+      try {
+        record = JSON.parse(raw);
+      } catch {
+        unreadableCount++;
+        continue;
+      }
       if (!record || typeof record !== "object" || Array.isArray(record)) throw new Error("Transcript records must be JSON objects.");
-      if (String(record.type).startsWith("import.")) throw new Error("Native transcripts cannot supply import protocol records.");
-      const id = record.type === "session_meta" ? record.payload?.id : record.sessionId;
+      const rec = record;
+      if (String(rec.type).startsWith("import.")) throw new Error("Native transcripts cannot supply import protocol records.");
+      if (rec.type === "response_item") {
+        const payload = rec.payload;
+        if (payload?.type === "reasoning" && typeof payload?.encrypted_content === "string" && payload.encrypted_content) {
+          encryptedReasoningCount++;
+        }
+      }
+      if (rec.type === "compacted") {
+        compactionCount++;
+      }
+      const id = rec.type === "session_meta" ? rec.payload?.id : rec.sessionId;
       if (!nativeId && typeof id === "string") nativeId = id;
-      const clean = redactLine(raw.replace(/\r$/, ""), { requireStructured: true }).line;
-      const line = clean + "\n";
+      const result = redactLine(raw.replace(/\r$/, ""), { requireStructured: true });
+      if (Object.keys(result.hits).length > 0) redactionCount++;
+      const line = result.line + "\n";
       outputBytes += Buffer.byteLength(line);
       if (outputBytes > maximum) throw new Error("Redacted transcript exceeds the 16 MiB limit.");
       digest.update(line);
@@ -1097,27 +1135,38 @@ function prepareImport(session2) {
   if (!lines.length) throw new Error("The selected transcript is empty.");
   const sourceId = nativeId ?? session2.sessionId;
   if (!/^[A-Za-z0-9_-]{1,200}$/.test(sourceId) || redactLine2(JSON.stringify(sourceId)) !== JSON.stringify(sourceId)) throw new Error("The source conversation has an invalid identifier.");
-  const summary = {
-    format: "asteroids.session-summary",
-    format_version: 1,
-    source_harness: session2.harness,
-    source_harness_version: null,
-    source_session_id: sourceId,
-    created_at: (/* @__PURE__ */ new Date()).toISOString(),
-    summary: "The complete selected local conversation is attached as a transcript. Review it before continuing; this automatic handoff does not infer the user's unfinished objective or claim any work is complete.",
-    context: {
-      objective: "Review the imported conversation and continue its latest unfinished authorized objective.",
-      constraints: [],
-      decisions: [],
-      completed: [],
-      pending: ["Read the complete imported transcript, reconcile the latest human instructions and completed work, then continue."],
-      verification: [],
-      blockers: ["This handoff contains the recorded conversation only. Referenced local files, runtime state, and unreadable reasoning are not transferred."],
-      artifacts: [],
-      provenance: { native_checkpoint_sha256: digest.digest("hex"), selected_native_session_id: sourceId, context_bytes: outputBytes }
-    }
-  };
-  return lines.join("") + JSON.stringify({ type: "import.summary", package: summary }) + "\n" + JSON.stringify({ type: "import.end", records: lines.length + 1 }) + "\n";
+  let summaryJson;
+  if (summaryPath) {
+    summaryJson = loadSummaryFile(summaryPath);
+  } else {
+    const summary = {
+      format: "asteroids.session-summary",
+      format_version: 1,
+      source_harness: session2.harness,
+      source_harness_version: null,
+      source_session_id: sourceId,
+      created_at: (/* @__PURE__ */ new Date()).toISOString(),
+      summary: "The complete selected local conversation is attached as a transcript. Review it before continuing; this automatic handoff does not infer the user's unfinished objective or claim any work is complete.",
+      context: {
+        objective: "Review the imported conversation and continue its latest unfinished authorized objective.",
+        constraints: [],
+        decisions: [],
+        completed: [],
+        pending: ["Read the complete imported transcript, reconcile the latest human instructions and completed work, then continue."],
+        verification: [],
+        blockers: ["This handoff contains the recorded conversation only. Referenced local files, runtime state, and unreadable reasoning are not transferred."],
+        artifacts: [],
+        provenance: { native_checkpoint_sha256: digest.digest("hex"), selected_native_session_id: sourceId, context_bytes: outputBytes }
+      }
+    };
+    summaryJson = JSON.stringify(summary);
+  }
+  const body = lines.join("") + JSON.stringify({ type: "import.summary", package: JSON.parse(summaryJson) }) + "\n" + JSON.stringify({ type: "import.end", records: lines.length + 1 }) + "\n";
+  const gaps = [];
+  if (encryptedReasoningCount > 0) gaps.push({ kind: "encrypted_reasoning", count: encryptedReasoningCount });
+  if (compactionCount > 0) gaps.push({ kind: "compaction", count: compactionCount });
+  if (unreadableCount > 0) gaps.push({ kind: "unreadable", count: unreadableCount });
+  return { body, transcriptLines: lines.length, outputBytes, redactionCount, gaps };
 }
 async function importSession(opts) {
   const base = (opts.agentUseUrl ?? agentUseBase()).replace(/\/$/, "");
@@ -1126,9 +1175,16 @@ async function importSession(opts) {
     throw new Error("Import requires HTTPS, or a loopback development server.");
   }
   opts.onProgress?.("Reading transcript and redacting secrets locally\u2026");
-  const body = prepareImport(opts.session);
-  opts.onProgress?.("Minting import key\u2026");
-  const { traceId, key } = await mintTrace(base, opts.session.harness);
+  const { body, transcriptLines, outputBytes, redactionCount, gaps } = prepareImport(opts.session, opts.summaryPath);
+  let traceId;
+  let key;
+  if (opts.importKey && opts.grantTraceId) {
+    traceId = opts.grantTraceId;
+    key = opts.importKey;
+  } else {
+    opts.onProgress?.("Minting import key\u2026");
+    ({ traceId, key } = await mintTrace(base, opts.session.harness));
+  }
   opts.onProgress?.("Uploading the complete transcript\u2026");
   const response = await fetch(`${base}/api/traces/ingest`, {
     method: "POST",
@@ -1142,7 +1198,17 @@ async function importSession(opts) {
     throw new Error(typeof result2?.error === "string" ? result2.error : result2?.error?.message ?? `Upload failed (${response.status}).`);
   }
   const result = await response.json();
-  return { traceId: result.traceId ?? traceId, url: `${base}/playground/new?import=${encodeURIComponent(result.traceId ?? traceId)}` };
+  const finalTraceId = result.traceId ?? traceId;
+  return {
+    traceId: finalTraceId,
+    url: `${base}/playground/new?import=${encodeURIComponent(finalTraceId)}`,
+    harness: opts.session.harness,
+    sessionId: opts.session.sessionId,
+    transcriptFiles: opts.session.files.length,
+    bytes: outputBytes,
+    redactionCount,
+    gaps
+  };
 }
 
 // src/login.ts
@@ -1178,7 +1244,7 @@ async function login(opts) {
 }
 async function browserLogin(verifier, challenge) {
   const state = b64url(randomBytes(16));
-  const code = await new Promise((resolve5, reject) => {
+  const code = await new Promise((resolve7, reject) => {
     const server = createServer((req, res) => {
       const url = new URL(req.url ?? "/", "http://127.0.0.1");
       if (url.pathname !== "/callback") {
@@ -1191,7 +1257,7 @@ async function browserLogin(verifier, challenge) {
       if (url.searchParams.get("state") !== state || !got) {
         reject(new Error("login callback state mismatch"));
       } else {
-        resolve5(got);
+        resolve7(got);
       }
       server.close();
     });
@@ -1246,22 +1312,22 @@ async function headlessLogin(verifier, challenge) {
 
 // src/local-agents.ts
 import { existsSync as existsSync4 } from "fs";
-import { homedir as homedir4 } from "os";
-import { join as join4 } from "path";
-function localAgents(env = process.env, home = homedir4()) {
-  const claude = env.CLAUDE_CONFIG_DIR || join4(home, ".claude");
-  const codex = env.CODEX_HOME || join4(home, ".codex");
-  const cursor = join4(home, ".cursor");
+import { homedir as homedir3 } from "os";
+import { join as join3 } from "path";
+function localAgents(env = process.env, home = homedir3()) {
+  const claude = env.CLAUDE_CONFIG_DIR || join3(home, ".claude");
+  const codex = env.CODEX_HOME || join3(home, ".codex");
+  const cursor = join3(home, ".cursor");
   return [
-    { id: "claude_code", name: "Claude Code", root: claude, skillsDir: join4(claude, "skills") },
-    { id: "codex", name: "Codex", root: codex, skillsDir: join4(codex, "skills") },
-    { id: "cursor", name: "Cursor", root: cursor, skillsDir: join4(cursor, "skills") }
+    { id: "claude_code", name: "Claude Code", root: claude, skillsDir: join3(claude, "skills") },
+    { id: "codex", name: "Codex", root: codex, skillsDir: join3(codex, "skills") },
+    { id: "cursor", name: "Cursor", root: cursor, skillsDir: join3(cursor, "skills") }
   ];
 }
-function detectLocalAgents(env = process.env, home = homedir4()) {
+function detectLocalAgents(env = process.env, home = homedir3()) {
   return localAgents(env, home).filter((agent2) => existsSync4(agent2.root));
 }
-function selectLocalAgents(ids, env = process.env, home = homedir4()) {
+function selectLocalAgents(ids, env = process.env, home = homedir3()) {
   if (!ids?.length) return detectLocalAgents(env, home);
   const known = localAgents(env, home);
   return ids.map((id) => {
@@ -1355,21 +1421,21 @@ async function readTurn(sessionId, opts = {}) {
   for (; ; ) {
     const reading = latestTurn(await history(sessionId));
     if (reading.finished || !opts.wait || Date.now() >= deadline) return reading;
-    await new Promise((resolve5) => setTimeout(resolve5, opts.intervalMs ?? 3e3));
+    await new Promise((resolve7) => setTimeout(resolve7, opts.intervalMs ?? 3e3));
   }
 }
 
 // src/setup.ts
-import { mkdirSync as mkdirSync3, readFileSync as readFileSync9, writeFileSync as writeFileSync5 } from "fs";
-import { dirname as dirname4, join as join8 } from "path";
+import { mkdirSync as mkdirSync2, readFileSync as readFileSync8, writeFileSync as writeFileSync4 } from "fs";
+import { dirname as dirname3, join as join7 } from "path";
 import { createInterface as createInterface3 } from "readline";
 
 // src/mcp-register.ts
 import { spawnSync } from "child_process";
 
 // src/skill.ts
-import { mkdirSync as mkdirSync2, readFileSync as readFileSync6, writeFileSync as writeFileSync4 } from "fs";
-import { join as join5 } from "path";
+import { mkdirSync, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "fs";
+import { join as join4 } from "path";
 
 // src/catalog-file.ts
 var CATALOG_FILE = "catalog.md";
@@ -1420,12 +1486,13 @@ function renderCatalog(agents, generatedAt) {
 }
 
 // src/skill.ts
+var REFERENCES_DIR = "references";
 var SKILL_NAME = "agentsky";
 var SKILL_MARKER = ".agentsky.json";
 function skillDocument() {
   return `---
 name: ${SKILL_NAME}
-description: "Hire cloud agents from the AgentSky catalog (included as ${CATALOG_FILE}) and coordinate them on one task. Use when the person names an agent by @handle, asks to have another agent (or another engine such as Codex, Claude Code, Gemini or Hermes) do, test or review part of the work, wants work to keep running in the cloud, or the work splits into independent parts that can run at the same time. Works through the agentsky MCP server, or the sky command where those tools are missing."
+description: "Hire cloud agents from the AgentSky catalog (included as ${CATALOG_FILE}) and coordinate them on one task. Use when: the person names an agent by @handle or wants to orchestrate agents; asks another engine (Codex, Claude Code, Gemini, Hermes) to do, test or review part of the work; wants to import, move or continue this conversation in AgentSky or the cloud; wants an agent their own application starts for its customers from a skill they supply; names a workspace; or the work splits into independent parts that can run at the same time. Works through the agentsky MCP server, or the sky command where those tools are missing."
 ---
 
 # Working with other agents through AgentSky
@@ -1440,6 +1507,14 @@ Everything below is a tool of the \`agentsky\` MCP server. If those tools are
 missing in this session, use the \`sky\` commands under "Without the MCP tools"
 at the end; they do the same things, one agent at a time.
 
+## Workspace
+
+Use the workspace the person named. If they named none, check the git root for
+\`.agentsky.json\` \u2014 if it has a \`"workspace"\` key, use that. Otherwise use the
+account default (personal). Never ask. Pass the chosen slug as \`workspace\` on
+every MCP tool that accepts it, or as \`--workspace <slug>\` on sky commands.
+Details: \`${REFERENCES_DIR}/workspaces.md\` in this skill's folder.
+
 ## When to hire
 
 - When the person names an agent (\`@handle\`) or an engine, or asks another agent
@@ -1450,9 +1525,6 @@ at the end; they do the same things, one agent at a time.
   going after this conversation ends.
 - Do the work yourself when it is small, when it depends on what you already have
   in front of you, or when explaining it would take as long as doing it.
-- Every hire spends the person's AgentSky balance. Say what you are about to hire
-  and roughly what it may cost before the first one, unless they already asked
-  for it.
 
 ## How to pick
 
@@ -1520,6 +1592,33 @@ it, and name its path in the brief.
 6. Tell the person what was done, which agent did which part, and what it cost
    (\`get_task\` reports the task's cost).
 
+## Build an agent that the person's own application runs
+
+When the person wants an agent their product starts for its customers, built
+from a skill they supply (for example: a customer uploads a file, an agent
+reviews it, their application acts on the verdict), follow
+\`${REFERENCES_DIR}/focused-agents.md\` in this skill's folder. It covers the
+prerequisites to tell them about first, one locked-down workspace per customer,
+one fresh session per event, and reading the answer as data.
+
+## Import this conversation to AgentSky
+
+When the person asks to import, move, or continue this conversation in AgentSky
+or the cloud:
+
+1. Write a summary JSON file following the schema in \`${REFERENCES_DIR}/import.md\`
+   (the only step that needs judgment \u2014 capture the objective, key decisions,
+   completed work, and next steps).
+2. Run:
+   \`\`\`
+   npx -y @agentsky/sky import --current --summary <path-to-summary.json> --yes --json
+   \`\`\`
+   Add \`--workspace <slug>\` when a workspace was chosen. Do NOT confirm or ask
+   before running; the \`--yes --json\` flags suppress prompts.
+3. Report the \`continueUrl\` from the JSON result. That is all.
+
+Only stop (non-zero exit) on a size limit, dropped content, or redaction failure.
+
 ## Without the MCP tools
 
 Run \`sky auth whoami\`. If it says you are not logged in, ask the person to run
@@ -1539,9 +1638,245 @@ Run \`sky auth whoami\`. If it says you are not logged in, ask the person to run
   read again.
 `;
 }
+function importReferenceDoc() {
+  return `# Import this conversation to AgentSky
+
+## Summary schema (asteroids.session-summary v1)
+
+Write a JSON file with these fields:
+
+\`\`\`json
+{
+  "format": "asteroids.session-summary",
+  "format_version": 1,
+  "source_harness": "claude_code",
+  "source_harness_version": null,
+  "source_session_id": "<the session id, e.g. from CLAUDE_CODE_SESSION_ID>",
+  "created_at": "<ISO 8601 timestamp>",
+  "summary": "<one paragraph: what this conversation accomplished>",
+  "context": {
+    "objective": "<what the person ultimately wants>",
+    "constraints": ["<must not do X>"],
+    "decisions": ["<decided to use Y approach>"],
+    "completed": ["<finished task A>"],
+    "pending": ["<next: do B>"],
+    "verification": ["<how to confirm B is correct>"],
+    "blockers": ["<needs access to X>"],
+    "artifacts": [{"path": "path/to/file.ts", "description": "what it is"}]
+  }
+}
+\`\`\`
+
+Only \`summary\` and \`context\` require judgment. All other fields are fixed values
+or can be omitted (the CLI validates \`format\` and \`format_version\`).
+
+## Gaps
+
+The import transfers the recorded conversation only. These are NOT transferred:
+- Local files not included in the transcript
+- Runtime state (variables, shell state, running processes)
+- Unrecorded tool outputs or reasoning
+- Login credentials and secrets
+
+List known gaps in \`context.blockers\`.
+
+## Non-Claude/Codex harnesses
+
+For harnesses that do not set \`CLAUDE_CODE_SESSION_ID\` or \`CODEX_THREAD_ID\`:
+use \`--session <id>\` instead of \`--current\`, and set \`source_harness\` to the
+harness name (e.g. \`"hermes"\`, \`"openclaw"\`).
+`;
+}
+function focusedAgentsReferenceDoc() {
+  return `# A focused agent your application runs for its customers
+
+Use this when the person wants an agent that their own product starts on an
+event (a customer uploads a file, a form is submitted), working from one
+skill they supply, with the result going back to their application.
+
+Everything here is the public API (\`https://api.agentsky.dev/v1\`). The
+application's server calls it. The \`sky\` commands and MCP tools named
+alongside do the same things by hand, for trying it out.
+
+## What has to exist first
+
+Say each of these to the person before you build. Each one changes whether it
+works:
+
+- **An API key for their server.** They create it at
+  platform.agentsky.dev \u2192 Developer \u2192 API keys and put it in the server's
+  environment (\`AGENTSKY_TOKEN\`). Never put it in code, a page their customers
+  load, or a brief.
+- **Credit** on their account. Every run is a session they pay for. Give each
+  one a budget.
+- **The skill**: a directory with \`SKILL.md\` at its root.
+- **An engine that fits.** Default to \`claude_code\` on its default model. Check
+  \`sky catalog search <words>\` if the skill needs something else.
+- **Their own customer sign-in.** AgentSky does not know their customers. A
+  customer id their page sends is a label, not proof of who it is.
+
+## 1. One workspace per customer
+
+\`\`\`
+POST /v1/universes  {"slug": "rv-acme", "name": "Uploads from acme"}
+\`\`\`
+
+Same by hand: \`sky universe create rv-acme\`. Files, memory, vaults and
+sessions never cross workspaces. Name every later call's workspace with the
+\`X-Universe: rv-acme\` header (\`--workspace rv-acme\` on \`sky\`).
+
+## 2. Lock the workspace down
+
+\`\`\`
+PUT  /v1/hook_rules                     {"rules": [{"point": "tool.call", "action": "block", "match": {}, "enabled": true}]}
+POST /v1/universes/rv-acme/policies     {"name": "reviewer-native-tools", "kind": "TOOL_CALL",
+                                         "config": {"action": "deny", "matcher": "Bash|BashOutput|KillShell|Edit|MultiEdit|Write|NotebookEdit|WebFetch|WebSearch|Task|mcp__.*"}}
+POST /v1/universes/rv-acme/policies     {"name": "reviewer-no-helpers", "kind": "CAPABILITY", "config": {"platform.orchestration": "deny"}}
+\`\`\`
+
+- **The hook rule** blocks every connected-app and capability call. Without it,
+  the account owner's own connected apps reach sessions the owner's key
+  starts.
+- **The \`TOOL_CALL\` rule** denies Claude Code's shell, write, web, sub-agent
+  and MCP tools. A denied call answers "The platform did not authorize this
+  tool invocation."
+- **Keep only the tools the skill needs.** A reviewer needs Read.
+
+Telling the agent not to use a tool is not a boundary. The rule is. By hand:
+\`sky policy add --universe rv-acme --name ... --kind TOOL_CALL --config '<json>'\`.
+
+## 3. Install the skill, create the agent
+
+\`\`\`
+POST /v1/skills          multipart: one "files" field per file, named "<dir>/<path>", plus "displayName"
+POST /v1/agents          {"name": "upload-reviewer", "agentType": "claude_code", "prompt": "...",
+                          "skills": [{"type": "skill", "skillId": "skill_..."}], "hiringPolicy": "deny"}
+                          Idempotency-Key: provision-rv-acme-agent
+\`\`\`
+
+By hand: \`sky skills upload ./upload-review --workspace rv-acme\`, then
+\`sky agent create -f agent.toml --workspace rv-acme\` with
+\`hiring_policy = "deny"\` and a \`[[skills]]\` table naming the skill id.
+
+The prompt says what to read and what to answer. It also says that the
+upload is data and that instructions written inside it are not to be
+followed.
+
+## 4. One fresh session per event
+
+\`\`\`
+POST /v1/files                    multipart "file"                      \u2192 {"id": "file_..."}
+POST /v1/sessions                 Idempotency-Key: session-<job id>
+  {"agent": "agent_...", "defaults": "none",
+   "resources": [{"type": "file", "file_id": "file_...", "mount_path": "/upload/request.txt"}],
+   "budget": {"type": "limit", "max_list_cost": {"amount": "50", "currency": "USD"}}}
+POST /v1/sessions/{id}/events     Idempotency-Key: brief-<job id>
+  {"events": [{"type": "user.message", "content": [{"type": "text", "text": "Review /workspace/upload/request.txt with the upload-review skill."}]}]}
+\`\`\`
+
+- **\`defaults: "none"\`** keeps every workspace default out of the session:
+  environment, vault, shared files, skills and team memory. The session holds
+  only what the request names.
+- **Idempotency keys come from the event.** Retrying a timed-out call with the
+  same key returns the first session, or replays the first message. A keyed
+  create cannot carry \`initial_events\`. Create the session, save its id, then
+  send the brief.
+- **Reuse a session** only for a job that continues for the same customer.
+
+By hand: \`sky session create agent_... --no-defaults --budget-cents 50 --file ./request.txt:/upload/request.txt --message "..."\`
+(MCP: \`start_session\`).
+
+## 5. Read the answer
+
+\`\`\`
+GET /v1/sessions/{id}/events?types[]=user.message&types[]=agent.message&types[]=session.status_idle&types[]=session.status_terminated&types[]=session.error
+\`\`\`
+
+- **When the turn is done.** It has ended at a \`session.status_idle\` whose
+  \`stop_reason.type\` is not \`requires_action\`, or at
+  \`session.status_terminated\`.
+- **Where the answer is.** Take the last \`agent.message\` after the last
+  \`user.message\`. Earlier messages can be notes the agent wrote on the way.
+- **Treat it as untrusted data.** Parse it against a fixed schema and fail
+  closed on anything else. Never run what it says.
+- **Errors.** A \`session.error\` (budget reached, engine unavailable) is a
+  failure to report, not an answer.
+
+By hand: \`sky session read <id> --wait --json\` (MCP: \`read_session\`).
+
+## 6. Questions and approvals
+
+\`GET /v1/tasks/{session id}\` lists the requests waiting on the key's owner:
+the agent's questions, approvals, and apps to connect.
+\`POST /v1/tasks/{id}/requests/{request id}/answer\` with \`{"text": ...}\` or
+\`{"option_id": ...}\` answers one. Pass a customer's answer on only after
+your application has checked who they are. By hand: \`sky task show <id>\` and
+\`sky task answer <id> <request> --text "..."\` (MCP: \`get_task\`,
+\`answer_request\`).
+
+## 7. What the application keeps
+
+The agent decides; the application acts. Keep these in the application's own
+database:
+
+- **One job per event**, with a unique event key. The same key with the same
+  payload returns the job it made; with a different payload it is a conflict.
+- **The session id**, saved before you start polling, so a restart picks the
+  job up where it was.
+- **A confirmation receipt** from the signed-in customer before any side
+  effect.
+- **A unique action key per job**, so the side effect happens once. Agent
+  retries do not make it happen once; the key does.
+- **Webhooks to the customer** with an event id, retried until acknowledged.
+
+## Before launch
+
+Check one real session:
+
+- \`GET /v1/sessions/{id}\` lists only the upload under \`resources\`.
+- \`GET /v1/hook_rules\` and \`GET /v1/universes/{slug}/policies\` show the rules
+  above.
+- Ask the agent directly to run a shell command. The answer has to be the
+  platform's refusal.
+- A file id from another customer's workspace is refused at session create.
+`;
+}
+function workspacesReferenceDoc() {
+  return `# Workspaces in AgentSky
+
+A workspace (also called a universe) groups agents and sessions. Every API call
+and MCP tool accepts an optional workspace slug.
+
+## How to choose
+
+1. The person named one \u2192 use it.
+2. Check the git root for \`.agentsky.json\` with a \`"workspace"\` key \u2192 use that.
+3. Neither \u2192 use the account default (personal workspace). Never ask.
+
+## Applying it
+
+- MCP tools: pass \`workspace: "<slug>"\` on tools that accept it.
+- sky CLI: \`--workspace <slug>\` on any command, or set \`SKY_WORKSPACE=<slug>\`.
+- Tools that take a \`task_id\` or \`session_id\` inherit that task's workspace
+  automatically; one task never spans workspaces.
+
+## Listing workspaces
+
+\`sky workspace list\` (or \`sky universe list\`) prints your workspaces, with
+\`*\` marking the current default.
+
+## .agentsky.json
+
+To set a per-repo default, create \`.agentsky.json\` at the git root:
+
+\`\`\`json
+{"workspace": "my-team-slug"}
+\`\`\`
+`;
+}
 function installedVersion(dir) {
   try {
-    const marker = JSON.parse(readFileSync6(join5(dir, SKILL_MARKER), "utf8"));
+    const marker = JSON.parse(readFileSync5(join4(dir, SKILL_MARKER), "utf8"));
     return typeof marker.version === "string" ? marker.version : null;
   } catch {
     return null;
@@ -1551,20 +1886,25 @@ function isInstalledSkill(dir) {
   return installedVersion(dir) !== null;
 }
 function installSkill(agent2, opts = {}) {
-  const dir = join5(agent2.skillsDir, SKILL_NAME);
+  const dir = join4(agent2.skillsDir, SKILL_NAME);
   const previous = installedVersion(dir);
   const outcome = previous === CLI_VERSION ? "current" : previous ? "updated" : "installed";
   if (opts.dryRun) return { agent: agent2.id, path: dir, outcome };
   if (outcome !== "current") {
-    mkdirSync2(dir, { recursive: true });
-    writeFileSync4(join5(dir, "SKILL.md"), skillDocument());
-    writeFileSync4(join5(dir, SKILL_MARKER), `${JSON.stringify({ version: CLI_VERSION }, null, 2)}
+    mkdirSync(dir, { recursive: true });
+    writeFileSync3(join4(dir, "SKILL.md"), skillDocument());
+    writeFileSync3(join4(dir, SKILL_MARKER), `${JSON.stringify({ version: CLI_VERSION }, null, 2)}
 `);
   }
   if (opts.catalog) {
-    mkdirSync2(dir, { recursive: true });
-    writeFileSync4(join5(dir, CATALOG_FILE), renderCatalog(opts.catalog, opts.now ?? /* @__PURE__ */ new Date()));
+    mkdirSync(dir, { recursive: true });
+    writeFileSync3(join4(dir, CATALOG_FILE), renderCatalog(opts.catalog, opts.now ?? /* @__PURE__ */ new Date()));
   }
+  const refsDir = join4(dir, REFERENCES_DIR);
+  mkdirSync(refsDir, { recursive: true });
+  writeFileSync3(join4(refsDir, "import.md"), importReferenceDoc());
+  writeFileSync3(join4(refsDir, "workspaces.md"), workspacesReferenceDoc());
+  writeFileSync3(join4(refsDir, "focused-agents.md"), focusedAgentsReferenceDoc());
   return { agent: agent2.id, path: dir, outcome };
 }
 
@@ -1615,9 +1955,9 @@ function registerMcpServer(agent2, opts, runner = systemCommandRunner()) {
 }
 
 // src/setup-local.ts
-import { existsSync as existsSync5, readdirSync as readdirSync2, readFileSync as readFileSync7, statSync as statSync2 } from "fs";
-import { homedir as homedir5 } from "os";
-import { dirname as dirname3, isAbsolute, join as join6, resolve as resolve3 } from "path";
+import { existsSync as existsSync5, readdirSync as readdirSync2, readFileSync as readFileSync6, statSync as statSync2 } from "fs";
+import { homedir as homedir4 } from "os";
+import { dirname as dirname2, isAbsolute, join as join5, resolve as resolve3 } from "path";
 import { parse as parseToml2 } from "smol-toml";
 var MAX_SKILL_FILE_BYTES = 1024 * 1024;
 var MAX_IMPORT_DEPTH = 5;
@@ -1633,22 +1973,22 @@ function sensitive(name) {
 function skillFiles(root, prefix) {
   const files2 = [];
   for (const entry2 of readdirSync2(root, { withFileTypes: true })) {
-    const path = join6(root, entry2.name);
+    const path = join5(root, entry2.name);
     if (entry2.isDirectory()) {
       if (!SKIPPED_DIRS.has(entry2.name)) files2.push(...skillFiles(path, `${prefix}/${entry2.name}`));
     } else if (entry2.isFile() && !sensitive(entry2.name) && statSync2(path).size <= MAX_SKILL_FILE_BYTES) {
-      files2.push({ path: `${prefix}/${entry2.name}`, bytes: new Uint8Array(readFileSync7(path)) });
+      files2.push({ path: `${prefix}/${entry2.name}`, bytes: new Uint8Array(readFileSync6(path)) });
     }
   }
   return files2;
 }
 function readLocalSkills(agents) {
-  const skills = [];
+  const skills2 = [];
   const ignored = [];
   for (const agent2 of agents) {
     if (!existsSync5(agent2.skillsDir)) continue;
     for (const entry2 of readdirSync2(agent2.skillsDir, { withFileTypes: true })) {
-      const dir = join6(agent2.skillsDir, entry2.name);
+      const dir = join5(agent2.skillsDir, entry2.name);
       let isDir = entry2.isDirectory();
       if (entry2.isSymbolicLink()) {
         try {
@@ -1657,22 +1997,22 @@ function readLocalSkills(agents) {
           isDir = false;
         }
       }
-      if (!isDir || !existsSync5(join6(dir, "SKILL.md")) || isInstalledSkill(dir)) continue;
-      const name = frontmatterName(readFileSync7(join6(dir, "SKILL.md"), "utf8"));
+      if (!isDir || !existsSync5(join5(dir, "SKILL.md")) || isInstalledSkill(dir)) continue;
+      const name = frontmatterName(readFileSync6(join5(dir, "SKILL.md"), "utf8"));
       if (!name) {
         ignored.push({ agent: agent2.id, dir, reason: "SKILL.md has no name" });
         continue;
       }
-      const taken = skills.find((skill) => skill.name === name);
+      const taken = skills2.find((skill) => skill.name === name);
       if (taken) {
         ignored.push({ agent: agent2.id, dir, reason: `${taken.agent} already has a skill named ${name}` });
         continue;
       }
       const files2 = skillFiles(dir, entry2.name);
-      skills.push({ name, agent: agent2.id, dir, files: files2, bytes: files2.reduce((sum, file) => sum + file.bytes.length, 0) });
+      skills2.push({ name, agent: agent2.id, dir, files: files2, bytes: files2.reduce((sum, file) => sum + file.bytes.length, 0) });
     }
   }
-  return { skills, ignored };
+  return { skills: skills2, ignored };
 }
 var INSTRUCTION_FILES = { claude_code: "CLAUDE.md", codex: "AGENTS.md" };
 function inlineImports(content, from, home, depth, seen) {
@@ -1686,11 +2026,11 @@ function inlineImports(content, from, home, depth, seen) {
     }
     const target = fence ? void 0 : line.match(/^@(\S+\.(?:md|markdown|txt))$/i)?.[1];
     if (!target || depth >= MAX_IMPORT_DEPTH) return line;
-    const path = target.startsWith("~/") ? join6(home, target.slice(2)) : isAbsolute(target) ? target : resolve3(dirname3(from), target);
+    const path = target.startsWith("~/") ? join5(home, target.slice(2)) : isAbsolute(target) ? target : resolve3(dirname2(from), target);
     if (seen.includes(path)) return "";
     let imported;
     try {
-      imported = readFileSync7(path, "utf8");
+      imported = readFileSync6(path, "utf8");
     } catch {
       return line;
     }
@@ -1698,15 +2038,15 @@ function inlineImports(content, from, home, depth, seen) {
     return inlineImports(imported, path, home, depth + 1, seen).trim();
   }).join("\n");
 }
-function readGlobalInstructions(agents, home = homedir5()) {
+function readGlobalInstructions(agents, home = homedir4()) {
   const found = [];
   for (const agent2 of agents) {
     const file = INSTRUCTION_FILES[agent2.id];
     if (!file) continue;
-    const path = join6(agent2.root, file);
+    const path = join5(agent2.root, file);
     let raw;
     try {
-      raw = readFileSync7(path, "utf8");
+      raw = readFileSync6(path, "utf8");
     } catch {
       continue;
     }
@@ -1725,7 +2065,7 @@ ${item.content.trim()}`).join("\n\n");
 }
 function readJson2(path) {
   try {
-    return JSON.parse(readFileSync7(path, "utf8"));
+    return JSON.parse(readFileSync6(path, "utf8"));
   } catch {
     return void 0;
   }
@@ -1739,15 +2079,15 @@ function bearerOf(def) {
   return match?.[1] ?? null;
 }
 function serversOf(agent2, home) {
-  if (agent2.id === "claude_code") return readJson2(join6(home, ".claude.json"))?.mcpServers ?? {};
-  if (agent2.id === "cursor") return readJson2(join6(agent2.root, "mcp.json"))?.mcpServers ?? {};
+  if (agent2.id === "claude_code") return readJson2(join5(home, ".claude.json"))?.mcpServers ?? {};
+  if (agent2.id === "cursor") return readJson2(join5(agent2.root, "mcp.json"))?.mcpServers ?? {};
   try {
-    return parseToml2(readFileSync7(join6(agent2.root, "config.toml"), "utf8")).mcp_servers ?? {};
+    return parseToml2(readFileSync6(join5(agent2.root, "config.toml"), "utf8")).mcp_servers ?? {};
   } catch {
     return {};
   }
 }
-function findLocalSecrets(agents, home = homedir5()) {
+function findLocalSecrets(agents, home = homedir4()) {
   const secrets2 = [];
   for (const agent2 of agents) {
     for (const [name, def] of Object.entries(serversOf(agent2, home))) {
@@ -1763,9 +2103,9 @@ function findLocalSecrets(agents, home = homedir5()) {
 
 // src/subscriptions.ts
 import { spawn as spawn3 } from "child_process";
-import { existsSync as existsSync6, readFileSync as readFileSync8 } from "fs";
-import { homedir as homedir6 } from "os";
-import { join as join7 } from "path";
+import { existsSync as existsSync6, readFileSync as readFileSync7 } from "fs";
+import { homedir as homedir5 } from "os";
+import { join as join6 } from "path";
 import { createInterface as createInterface2 } from "readline";
 var ALIASES = {
   claude: "anthropic",
@@ -1850,12 +2190,12 @@ async function connectClaude() {
   const expiry = sub.expiresAt ? ` (expires ~${sub.expiresAt.slice(0, 10)})` : "";
   console.log(`Connected Claude subscription${expiry}. Powers new eligible agents.`);
 }
-function codexSignIn(env = process.env, home = homedir6()) {
-  const path = join7(env.CODEX_HOME || join7(home, ".codex"), "auth.json");
+function codexSignIn(env = process.env, home = homedir5()) {
+  const path = join6(env.CODEX_HOME || join6(home, ".codex"), "auth.json");
   if (!existsSync6(path)) {
     throw new ApiError(404, "no_codex_auth", `no ${path} \u2014 run \`codex login\` first`);
   }
-  const raw = readFileSync8(path, "utf8");
+  const raw = readFileSync7(path, "utf8");
   try {
     const parsed = JSON.parse(raw);
     return { path, raw, account: parsed.tokens?.account_id };
@@ -1863,12 +2203,12 @@ function codexSignIn(env = process.env, home = homedir6()) {
     throw new ApiError(400, "invalid_codex_auth", `${path} isn't valid JSON \u2014 re-run \`codex login\``);
   }
 }
-function cursorSignIn(env = process.env, home = homedir6()) {
-  const path = join7(env.XDG_CONFIG_HOME || join7(home, ".config"), "cursor", "auth.json");
+function cursorSignIn(env = process.env, home = homedir5()) {
+  const path = join6(env.XDG_CONFIG_HOME || join6(home, ".config"), "cursor", "auth.json");
   if (!existsSync6(path)) {
     throw new ApiError(404, "no_cursor_auth", `no ${path} \u2014 run \`cursor-agent login\` first`);
   }
-  const raw = readFileSync8(path, "utf8");
+  const raw = readFileSync7(path, "utf8");
   try {
     const parsed = JSON.parse(raw);
     if (typeof parsed.accessToken !== "string" || typeof parsed.refreshToken !== "string") throw new Error("shape");
@@ -1947,11 +2287,11 @@ function planProviders(names) {
   }));
 }
 function reportPath() {
-  return join8(dirname4(configPath()), "setup.json");
+  return join7(dirname3(configPath()), "setup.json");
 }
 function loadReport() {
   try {
-    const saved = JSON.parse(readFileSync9(reportPath(), "utf8"));
+    const saved = JSON.parse(readFileSync8(reportPath(), "utf8"));
     return { agents: saved.agents ?? [], plans: saved.plans ?? [], ...saved.secrets ? { secrets: saved.secrets } : {} };
   } catch {
     return { agents: [], plans: [] };
@@ -1964,8 +2304,8 @@ function mergeReport(base, next) {
   return { agents, plans, ...secrets2 ? { secrets: secrets2 } : {} };
 }
 function saveReport(report) {
-  mkdirSync3(dirname4(reportPath()), { recursive: true });
-  writeFileSync5(reportPath(), `${JSON.stringify(report, null, 2)}
+  mkdirSync2(dirname3(reportPath()), { recursive: true });
+  writeFileSync4(reportPath(), `${JSON.stringify(report, null, 2)}
 `, { mode: 384 });
 }
 function confirm3(question) {
@@ -2135,13 +2475,13 @@ async function runSetup(opts) {
     await connectPlans(agents, opts, interactive, emit, run2);
     await tell();
   }
-  const { skills, ignored } = wantsImport ? readLocalSkills(agents) : { skills: [], ignored: [] };
+  const { skills: skills2, ignored } = wantsImport ? readLocalSkills(agents) : { skills: [], ignored: [] };
   const instructions = wantsImport ? readGlobalInstructions(agents) : [];
   const secrets2 = wantsSecrets ? findLocalSecrets(agents) : [];
   if (wantsImport || wantsSecrets) {
     emit({
       type: "found",
-      skills: skills.map((skill) => ({ name: skill.name, agent: skill.agent, files: skill.files.length, bytes: skill.bytes })),
+      skills: skills2.map((skill) => ({ name: skill.name, agent: skill.agent, files: skill.files.length, bytes: skill.bytes })),
       ignored: ignored.map((item) => ({ dir: item.dir, reason: item.reason })),
       instructions: instructions.map((item) => ({ agent: item.agent, path: item.path, bytes: Buffer.byteLength(item.content), imports: item.imports })),
       secrets: secrets2.map((secret) => ({ name: secret.name, agent: secret.agent, url: secret.url }))
@@ -2155,8 +2495,8 @@ async function runSetup(opts) {
   const report = mergeReport(earlier, run2);
   saveReport(report);
   if (key) {
-    const sendFiles = wantsImport && (skills.length > 0 || instructions.length > 0) && await agreed("Send these skills and instructions to your AgentSky workspace?");
-    await importToWorkspace(key, held, sendFiles ? skills : [], sendFiles ? combineInstructions(instructions) : "", emit);
+    const sendFiles = wantsImport && (skills2.length > 0 || instructions.length > 0) && await agreed("Send these skills and instructions to your AgentSky workspace?");
+    await importToWorkspace(key, held, sendFiles ? skills2 : [], sendFiles ? combineInstructions(instructions) : "", emit);
   }
   emit({ type: "done", report });
 }
@@ -2235,10 +2575,10 @@ async function saveSecrets(found, opts, interactive, emit) {
   }
   return counts;
 }
-async function importToWorkspace(key, held, skills, instructions, emit) {
+async function importToWorkspace(key, held, skills2, instructions, emit) {
   const outcomes = [];
   let signedOut = false;
-  for (const skill of skills) {
+  for (const skill of skills2) {
     if (signedOut) {
       outcomes.push({ name: skill.name, outcome: "skipped: sign in to agentsky.dev again" });
       continue;
@@ -2313,6 +2653,50 @@ function renderArtifact(artifact2) {
   return `${artifact2.id}  ${artifact2.name}  v${artifact2.version}  ${files2}  entry ${artifact2.entry}${artifact2.share_url ? `  shared ${artifact2.share_url}` : ""}`;
 }
 
+// src/skills-store.ts
+import { readdirSync as readdirSync3, readFileSync as readFileSync9, statSync as statSync3 } from "fs";
+import { basename as basename3, join as join8, relative, resolve as resolve4 } from "path";
+function skillBundle(dir) {
+  const root = resolve4(dir);
+  const top = basename3(root);
+  const files2 = [];
+  const walk = (path) => {
+    for (const name of readdirSync3(path).sort()) {
+      const full = join8(path, name);
+      if (statSync3(full).isDirectory()) walk(full);
+      else files2.push({ path: `${top}/${relative(root, full)}`, bytes: readFileSync9(full) });
+    }
+  };
+  walk(root);
+  if (!files2.some((file) => file.path === `${top}/SKILL.md`)) throw new Error(`${dir}: no SKILL.md at its root`);
+  return files2;
+}
+async function uploadSkill(dir, displayName) {
+  const form = new FormData();
+  for (const file of skillBundle(dir)) form.append("files", new Blob([new Uint8Array(file.bytes)]), file.path);
+  form.append("displayName", displayName ?? basename3(resolve4(dir)));
+  return apiForm("POST", "/skills", form);
+}
+async function listSkills() {
+  return (await api("GET", "/skills")).skills;
+}
+async function getTask(task2) {
+  return (await api("GET", `/tasks/${encodeURIComponent(task2)}`)).task;
+}
+function answerBody(answer) {
+  if (!answer.option === !answer.text) throw new Error("give exactly one of --option or --text");
+  return { ...answer.option ? { option_id: answer.option } : { text: answer.text }, ...answer.note ? { note: answer.note } : {} };
+}
+async function answerRequest(task2, request, answer) {
+  return api("POST", `/tasks/${encodeURIComponent(task2)}/requests/${encodeURIComponent(request)}/answer`, answerBody(answer));
+}
+function renderRequest(request) {
+  const options = request.options.length ? `
+    options: ${request.options.map((option) => `${option.id} (${option.label})`).join(", ")}` : "";
+  return `${request.id}  ${request.kind}  from ${request.session_id}
+    ${request.question}${options}`;
+}
+
 // src/workspace.ts
 var KINDS = ["TOOL_CALL", "SPEND_CAP", "CALL_COUNT", "CAPABILITY"];
 async function workspaceSlug(explicit) {
@@ -2407,6 +2791,173 @@ function renderPolicy(rule) {
   return `${state}  ${rule.layer.padEnd(9)}  ${rule.kind.padEnd(10)}  ${rule.name}  ${JSON.stringify(rule.config)}  ${rule.id}`;
 }
 
+// src/harness.ts
+import { existsSync as existsSync7, mkdirSync as mkdirSync3, readFileSync as readFileSync10, writeFileSync as writeFileSync5 } from "fs";
+import { dirname as dirname4, join as join9, resolve as resolve5 } from "path";
+var HARNESS_FILE = "harness.json";
+function harnessFilePath(dir) {
+  return join9(resolve5(dir), HARNESS_FILE);
+}
+function readHarnessFile(dir) {
+  const path = harnessFilePath(dir);
+  if (!existsSync7(path)) {
+    throw new Error(`no ${HARNESS_FILE} found in ${resolve5(dir)} \u2014 run \`sky harness init\` first`);
+  }
+  try {
+    return JSON.parse(readFileSync10(path, "utf8"));
+  } catch (err) {
+    throw new Error(`could not parse ${path}: ${err instanceof Error ? err.message : String(err)}`);
+  }
+}
+var INIT_SKELETON = {
+  id: "my_harness",
+  name: "My Harness",
+  version: "0.1.0",
+  distribution: {
+    // choose one distribution kind and remove the others:
+    npx: "@your-scope/my-harness@0.1.0"
+    // uvx: "my-harness==0.1.0",
+    // binary: { url: "https://example.com/my-harness-linux-amd64", sha256: "..." },
+  }
+  // optional: declare the tools this harness exposes
+  // tools: [{ id: "bash", kind: "execute", title: "Shell" }],
+  // optional: feature flags
+  // features: ["subagents"],
+};
+var INIT_COMMENT = `# harness.json \u2014 workspace harness profile skeleton
+# Validate locally: sky harness verify .
+# Submit:          sky harness push .
+# Full schema:     https://agentsky.dev/docs/harness-profile
+`;
+function harnessInit(dir) {
+  const path = harnessFilePath(dir);
+  if (existsSync7(path)) {
+    throw new Error(`${path} already exists \u2014 delete it to re-init`);
+  }
+  mkdirSync3(dirname4(path), { recursive: true });
+  writeFileSync5(path, `${JSON.stringify(INIT_SKELETON, null, 2)}
+`);
+  console.log(`Created ${path}`);
+  console.log(INIT_COMMENT);
+}
+async function harnessVerify(dir, opts) {
+  const raw = readHarnessFile(dir);
+  const parsed = harnessProfileSchema.safeParse(raw);
+  if (!parsed.success) {
+    console.error("harness.json schema errors:");
+    for (const issue of parsed.error.issues) {
+      const path = issue.path.length ? issue.path.join(".") : "(root)";
+      console.error(`  ${path}: ${issue.message}`);
+    }
+    process.exit(1);
+  }
+  console.log(`harness.json  ok  (id: ${parsed.data.id}, version: ${parsed.data.version})`);
+  if (!opts.handle) return;
+  const rawHandle = opts.handle.replace(/^@/, "");
+  console.log(`Starting conformance run for @${rawHandle}\u2026`);
+  let runId;
+  try {
+    const { run: run2 } = await api(
+      "POST",
+      `/catalog/listings/${encodeURIComponent(rawHandle)}/conformance`
+    );
+    runId = run2.id;
+    console.log(`  run ${runId}  status: ${run2.status}`);
+  } catch (err) {
+    if (err instanceof ApiError) {
+      console.error(`sky: conformance start failed \u2014 ${err.message} (${err.code})`);
+    } else {
+      console.error(`sky: conformance start failed \u2014 ${String(err)}`);
+    }
+    process.exit(1);
+  }
+  const pollMs = 4e3;
+  const maxWaitMs = 5 * 60 * 1e3;
+  const deadline = Date.now() + maxWaitMs;
+  while (Date.now() < deadline) {
+    await new Promise((r) => setTimeout(r, pollMs));
+    try {
+      const { run: run2 } = await api("GET", `/catalog/listings/${encodeURIComponent(rawHandle)}/conformance`);
+      if (run2.status === "running") {
+        process.stdout.write(".");
+        continue;
+      }
+      process.stdout.write("\n");
+      if (run2.status === "failed") {
+        console.error(`conformance run failed: ${run2.reason ?? "unknown reason"}`);
+        process.exit(1);
+      }
+      console.log(`
+Conformance report for @${rawHandle}`);
+      console.log(
+        `  required_passed: ${run2.required_passed ? "yes" : "no"}  all_passed: ${run2.all_passed ? "yes" : "no"}`
+      );
+      if (run2.report?.checks) {
+        for (const check of run2.report.checks) {
+          const icon = check.status === "pass" ? "\u2713" : check.status === "skipped" ? "\u2013" : "\u2717";
+          const req = check.required ? " [required]" : "";
+          console.log(`  ${icon} ${check.id}${req} \u2014 ${check.reason ?? check.status} (${check.seconds}s)`);
+        }
+      }
+      if (!run2.required_passed) process.exit(1);
+      return;
+    } catch (err) {
+      console.error(`
+sky: conformance poll failed \u2014 ${err instanceof Error ? err.message : String(err)}`);
+      process.exit(1);
+    }
+  }
+  console.error("\nsky: timed out waiting for conformance run (5 min)");
+  process.exit(1);
+}
+async function harnessPush(dir, opts) {
+  const raw = readHarnessFile(dir);
+  const parsed = harnessProfileSchema.safeParse(raw);
+  if (!parsed.success) {
+    console.error("harness.json is invalid \u2014 run `sky harness verify` first:");
+    for (const issue of parsed.error.issues) {
+      const path = issue.path.length ? issue.path.join(".") : "(root)";
+      console.error(`  ${path}: ${issue.message}`);
+    }
+    process.exit(1);
+  }
+  const profile = parsed.data;
+  const version = opts.version ?? profile.version;
+  const handle = profile.id;
+  let existing;
+  try {
+    const { harnesses } = await api("GET", "/harnesses");
+    existing = harnesses.find((h) => h.handle === handle);
+  } catch (err) {
+    if (!(err instanceof ApiError && err.status === 404)) throw err;
+  }
+  if (!existing) {
+    const { harness: harness2 } = await api("POST", "/harnesses", {
+      handle,
+      name: profile.name,
+      profile,
+      model_billing: "gateway"
+    });
+    existing = harness2;
+    console.log(`Created harness  ${harness2.id}  handle: ${harness2.handle}`);
+  } else {
+    console.log(`Harness exists  ${existing.id}  handle: ${existing.handle}`);
+  }
+  const { version: ver } = await api(
+    "POST",
+    `/harnesses/${encodeURIComponent(existing.id)}/versions`,
+    { version, profile }
+  );
+  console.log(
+    `Version ${ver.version}  status: ${ver.status}  id: ${ver.id}  created: ${ver.created_at}`
+  );
+  console.log(
+    `
+Next step: run conformance
+  sky harness verify . --handle @${handle}`
+  );
+}
+
 // src/index.ts
 function printModelBilling(session2) {
   if (session2.modelBilling !== "account") return;
@@ -2416,7 +2967,11 @@ function printModelBilling(session2) {
   console.log(`Model billing: ${label} \u2014 $0 model usage`);
 }
 var program = new Command();
-program.name("sky").description("Launch and talk to long-lived agents \u2014 agentsky.dev").version(CLI_VERSION);
+program.name("sky").description("Launch and talk to long-lived agents \u2014 agentsky.dev").version(CLI_VERSION).option("--workspace <slug>", "workspace to act in (overrides sky universe switch and SKY_UNIVERSE; alias of --universe on sub-commands)");
+program.hook("preAction", () => {
+  const workspace2 = program.opts().workspace;
+  if (workspace2) process.env.SKY_WORKSPACE = workspace2;
+});
 function fail(error) {
   if (error instanceof ApiError) console.error(`sky: ${error.message} (${error.code})`);
   else console.error(`sky: ${error instanceof Error ? error.message : String(error)}`);
@@ -2518,8 +3073,19 @@ universe.command("remove <member>").description("remove a member (user id or ema
 );
 universe.command("join <token>").description("accept an invitation sent to your verified email").action(
   run(async (token) => {
-    const workspace = await joinWorkspace(token);
-    console.log(`Joined ${workspace.slug} (${workspace.name}) \u2014 sky universe switch ${workspace.slug}`);
+    const workspace2 = await joinWorkspace(token);
+    console.log(`Joined ${workspace2.slug} (${workspace2.name}) \u2014 sky universe switch ${workspace2.slug}`);
+  })
+);
+var workspace = program.command("workspace").description("alias of universe: grouping boundary for agents");
+workspace.command("list").action(
+  run(async () => {
+    const { universes } = await api("GET", "/universes");
+    const current = currentUniverse();
+    for (const u of universes) {
+      const marker = u.slug === current || !current && u.isPersonal ? "*" : " ";
+      console.log(`${marker} ${u.slug}${u.isPersonal ? " (personal)" : ""}`);
+    }
   })
 );
 var policy = program.command("policy").description("policy rules: tool calls, spend caps, call counts, capabilities");
@@ -2663,7 +3229,7 @@ function renderResource(r) {
   const ref = r.checkout ? `@${r.checkout.type === "branch" ? r.checkout.name : r.checkout.sha}` : "";
   return `${r.id}  repo  ${r.mount_path}  ${r.url}${ref}`;
 }
-session.command("create <agent>").description("create a session (starts provisioning by default)").option("--title <title>", "session title").option("--message <text>", "start the first turn immediately, provisioning even with --deferred").option("--deferred", "leave the session idle without a pod until its first turn").option("--vcpus <n>", "machine vCPUs: 1, 2, 4 or 8 (default 2)").option("--memory <mb>", "machine memory in MB, 256MB steps (default 4096)").option("--file <path...>", "mount local files read-only in the working directory: path[:/mount] (uploaded first)").option("--repo <url...>", "clone GitHub repositories into the working directory: https://github.com/{owner}/{repo}[@branch|@sha]").option("--repo-token <token>", "token for the --repo clones; compiled into the sandbox's egress policy, never sent to it").option("--json", "print the created session as JSON").action(
+session.command("create <agent>").description("create a session (starts provisioning by default)").option("--title <title>", "session title").option("--message <text>", "start the first turn immediately, provisioning even with --deferred").option("--deferred", "leave the session idle without a pod until its first turn").option("--vcpus <n>", "machine vCPUs: 1, 2, 4 or 8 (default 2)").option("--memory <mb>", "machine memory in MB, 256MB steps (default 4096)").option("--file <path...>", "mount local files read-only in the working directory: path[:/mount] (uploaded first)").option("--repo <url...>", "clone GitHub repositories into the working directory: https://github.com/{owner}/{repo}[@branch|@sha]").option("--repo-token <token>", "token for the --repo clones; compiled into the sandbox's egress policy, never sent to it").option("--json", "print the created session as JSON").option("--no-defaults", "attach only what this command names: no workspace default environment, vault, files, skills or memory").option("--budget-cents <cents>", "the most the session may spend, in whole US cents").action(
   run(
     async (agentRef, opts) => {
       const resources = await resourceParams(opts);
@@ -2673,6 +3239,8 @@ session.command("create <agent>").description("create a session (starts provisio
         ...opts.vcpus !== void 0 ? { vcpus: Number(opts.vcpus) } : {},
         ...opts.memory !== void 0 ? { memoryMb: Number(opts.memory) } : {},
         ...opts.deferred ? { provision: "deferred" } : {},
+        ...opts.defaults === false ? { defaults: "none" } : {},
+        ...opts.budgetCents ? { budget: { type: "limit", max_list_cost: { amount: opts.budgetCents, currency: "USD" } } } : {},
         ...resources.length ? { resources } : {},
         ...opts.message ? { initial_events: [{ type: "user.message", content: [{ type: "text", text: opts.message }] }] } : {}
       });
@@ -3005,9 +3573,9 @@ secrets.command("unset <id> <key>").action(
 );
 program.command("launch").description("scaffold ./agent.toml if absent, create the agent, print its address").option("-f, --file <path>", "agent file", "agent.toml").option("--type <type>", "override the file's harness: hermes | claude_code | codex | openclaw | pi | dsh | kimi_code | opencode").option("--llm <llm>", "override the file's model (must suit the harness)").action(
   run(async (opts) => {
-    const path = resolve4(opts.file);
-    if (!existsSync7(path)) {
-      const name = basename3(process.cwd()).replace(/[^a-zA-Z0-9 _-]/g, "") || "my-agent";
+    const path = resolve6(opts.file);
+    if (!existsSync8(path)) {
+      const name = basename4(process.cwd()).replace(/[^a-zA-Z0-9 _-]/g, "") || "my-agent";
       scaffoldAgentFile(path, name);
       console.log(`Scaffolded ${opts.file} \u2014 edit it anytime; re-apply with \`sky deploy\`.`);
     }
@@ -3038,7 +3606,7 @@ program.command("launch").description("scaffold ./agent.toml if absent, create t
 );
 program.command("deploy").description("re-apply ./agent.toml to the existing agent (idempotent)").option("-f, --file <path>", "agent file", "agent.toml").action(
   run(async (opts) => {
-    const path = resolve4(opts.file);
+    const path = resolve6(opts.file);
     const { file, spec } = readAgentFile(path);
     if (!file.id) {
       console.log("No agent id in the file yet \u2014 running launch instead.");
@@ -3081,30 +3649,54 @@ function formatRelative(msAgo) {
   if (hours < 48) return `${hours}h ago`;
   return `${Math.round(hours / 24)}d ago`;
 }
-program.command("import").description("import a local Claude Code or Codex session to AgentSky and continue it in the cloud").option("--all", "import all found sessions up to --limit").option("-y, --yes", "confirm transfer of the selected conversations without prompting").option("--limit <n>", "maximum sessions to list or import", "10").option("--session <id>", "import one specific session by its ID").option("--harness <type>", "claude_code | codex | all (default: all)").option("--url <base>", "agent-use app URL (default: derived from SKY_API_URL or AGENT_USE_URL)").action(
+program.command("import").description("import a local Claude Code or Codex session to AgentSky and continue it in the cloud").option("--current", "import the session this agent is running in (reads CLAUDE_CODE_SESSION_ID or CODEX_THREAD_ID, then falls back to most recent session in the cwd)").option("--all", "import all found sessions up to --limit").option("-y, --yes", "confirm transfer without prompting (default when --current or --session is given in non-TTY)").option("--json", "print one JSON result object per import and nothing else to stdout").option("--limit <n>", "maximum sessions to list or import", "10").option("--session <id>", "import one specific session by its ID").option("--harness <type>", "claude_code | codex | all (default: all)").option("--summary <path>", "attach a pre-written summary JSON (asteroids.session-summary v1) instead of the auto-generated one").option("--key <importKey>", "import grant key minted by the web page (skips sky auth login)").option("--trace <traceId>", "trace id paired with --key").option("--url <base>", "agent-use app URL (default: derived from SKY_API_URL or AGENT_USE_URL)").action(
   run(
     async (opts) => {
+      if (opts.key && !opts.trace) throw new Error("--key requires --trace <traceId>");
+      if (opts.trace && !opts.key) throw new Error("--trace requires --key <importKey>");
       const limit = Math.max(1, Math.min(50, parseInt(opts.limit ?? "10", 10) || 10));
       if (opts.harness && !["claude_code", "codex", "all"].includes(opts.harness)) throw new Error("Use --harness claude_code, codex, or all.");
-      const harness = opts.harness ?? "all";
+      const harness2 = opts.harness ?? "all";
       const base = opts.url ?? agentUseBase();
-      const candidates = opts.session ? listRecentSessions(harness === "all" ? void 0 : harness, Number.POSITIVE_INFINITY).filter(
-        (s) => s.sessionId === opts.session
-      ) : listRecentSessions(harness === "all" ? void 0 : harness, limit);
-      if (candidates.length === 0) {
-        if (opts.session) {
-          throw new Error(`Session "${opts.session}" not found in ~/.claude or ~/.codex.`);
+      const nonInteractive = !process.stdin.isTTY;
+      const autoConfirm = opts.yes || opts.current || !!opts.session && nonInteractive;
+      let candidates;
+      if (opts.current) {
+        const env = currentSessionEnv();
+        if (env) {
+          candidates = listRecentSessions(env.harness, Number.POSITIVE_INFINITY).filter(
+            (s) => s.sessionId === env.sessionId
+          );
+          if (candidates.length === 0) {
+            const cwd = process.cwd();
+            const all = listRecentSessions(env.harness, 50);
+            const byCwd = all.filter((s) => s.workspace === cwd || s.workspace.startsWith(cwd + "/"));
+            candidates = byCwd.length > 0 ? [byCwd[0]] : all.length > 0 ? [all[0]] : [];
+          }
+        } else {
+          const cwd = process.cwd();
+          const all = listRecentSessions(harness2 === "all" ? void 0 : harness2, 50);
+          const byCwd = all.filter((s) => s.workspace === cwd || s.workspace.startsWith(cwd + "/"));
+          candidates = byCwd.length > 0 ? [byCwd[0]] : all.length > 0 ? [all[0]] : [];
         }
-        console.log(
-          "No recent sessions found. Make sure you have run Claude Code (sessions in ~/.claude) or Codex (sessions in ~/.codex)."
+        if (candidates.length === 0) throw new Error("No local session found for the current environment. Run with --session <id> or start an agent session first.");
+      } else if (opts.session) {
+        candidates = listRecentSessions(harness2 === "all" ? void 0 : harness2, Number.POSITIVE_INFINITY).filter(
+          (s) => s.sessionId === opts.session
         );
-        return;
+        if (candidates.length === 0) throw new Error(`Session "${opts.session}" not found in ~/.claude or ~/.codex.`);
+      } else {
+        candidates = listRecentSessions(harness2 === "all" ? void 0 : harness2, limit);
+        if (candidates.length === 0) {
+          console.log("No recent sessions found. Make sure you have run Claude Code (sessions in ~/.claude) or Codex (sessions in ~/.codex).");
+          return;
+        }
       }
       let toImport;
-      if (opts.all || opts.session || candidates.length === 1) {
+      if (opts.current || opts.all || opts.session || candidates.length === 1) {
         toImport = candidates;
       } else {
-        if (!process.stdin.isTTY) throw new Error("Use --session or --all to select conversations in a non-interactive terminal.");
+        if (nonInteractive) throw new Error("Use --session, --current, or --all to select conversations in a non-interactive terminal.");
         console.log("\nRecent local sessions:\n");
         candidates.forEach((s, i) => {
           const label = s.title ? `"${s.title.slice(0, 70)}"` : "(no title)";
@@ -3117,11 +3709,11 @@ program.command("import").description("import a local Claude Code or Codex sessi
         console.log();
         const rl = createInterface4({ input: process.stdin, output: process.stdout });
         const answer = await new Promise(
-          (resolve5) => rl.question(
+          (resolve7) => rl.question(
             `Import which session? [1-${candidates.length}, or comma-separated, or "all"]: `,
             (a) => {
               rl.close();
-              resolve5(a.trim());
+              resolve7(a.trim());
             }
           )
         );
@@ -3137,14 +3729,16 @@ program.command("import").description("import a local Claude Code or Codex sessi
         }
       }
       toImport = [...new Map(toImport.map((session2) => [`${session2.harness}:${session2.sessionId}`, session2])).values()];
-      console.log(`Selected ${toImport.length} conversation(s), ${toImport.reduce((count, session2) => count + session2.files.length, 0)} transcript file(s). Destination: ${base}`);
-      console.log("The recorded conversation is redacted locally. Local project files and login credentials are not transferred.");
-      if (!opts.yes) {
-        if (!process.stdin.isTTY) throw new Error("Use --yes to confirm this transfer in a non-interactive terminal.");
+      if (!opts.json) {
+        console.log(`Selected ${toImport.length} conversation(s), ${toImport.reduce((count, session2) => count + session2.files.length, 0)} transcript file(s). Destination: ${base}`);
+        console.log("The recorded conversation is redacted locally. Local project files and login credentials are not transferred.");
+      }
+      if (!autoConfirm) {
+        if (nonInteractive) throw new Error("Use --yes to confirm this transfer in a non-interactive terminal.");
         const prompt = createInterface4({ input: process.stdin, output: process.stdout });
-        const answer = await new Promise((resolve5) => prompt.question("Upload these selected conversations? [y/N] ", (value) => {
+        const answer = await new Promise((resolve7) => prompt.question("Upload these selected conversations? [y/N] ", (value) => {
           prompt.close();
-          resolve5(value);
+          resolve7(value);
         }));
         if (!/^y(?:es)?$/i.test(answer.trim())) {
           console.log("Cancelled. Nothing uploaded.");
@@ -3153,18 +3747,36 @@ program.command("import").description("import a local Claude Code or Codex sessi
       }
       for (const session2 of toImport) {
         const label = session2.title ? `"${session2.title.slice(0, 60)}"` : session2.sessionId;
-        process.stdout.write(`
+        if (!opts.json) process.stdout.write(`
 Importing ${label} \u2026
 `);
         const result = await importSession({
           session: session2,
           agentUseUrl: base,
-          onProgress: (msg) => process.stdout.write(`  ${msg}
+          summaryPath: opts.summary,
+          importKey: opts.key,
+          grantTraceId: opts.trace,
+          onProgress: opts.json ? void 0 : (msg) => process.stdout.write(`  ${msg}
 `)
         });
-        console.log(`  \u2713 Imported. Continue here:
+        if (opts.json) {
+          console.log(JSON.stringify({
+            traceId: result.traceId,
+            url: result.url,
+            workspace: currentUniverse() ?? null,
+            harness: result.harness,
+            sessionId: result.sessionId,
+            transcriptFiles: result.transcriptFiles,
+            bytes: result.bytes,
+            redactionCount: result.redactionCount,
+            gaps: result.gaps,
+            continueUrl: result.url
+          }));
+        } else {
+          console.log(`  \u2713 Imported. Continue here:
     ${result.url}
 `);
+        }
       }
     }
   )
@@ -3208,7 +3820,7 @@ files.command("download <id>").description("download a session file's bytes").re
     console.log(`Wrote ${bytes.length} bytes to ${opts.out}`);
   })
 );
-var task = program.command("task").description("a task's shared files (the task is its first session's id)");
+var task = program.command("task").description("a task's shared files and open requests (the task is its first session's id)");
 task.command("files <task>").description("list the task's current files").action(
   run(async (taskId) => {
     const list = await listTaskFiles(taskId);
@@ -3227,7 +3839,7 @@ task.command("get <task> <path>").description("read one task file; prints it, or
 );
 task.command("put <task> <path> <local>").description("write a local file to <path> in the task's files (every session of the task sees it)").action(
   run(async (taskId, path, local) => {
-    const { file, conflict } = await writeTaskFile(taskId, path, readFileSync10(local), mediaTypeFor(local));
+    const { file, conflict } = await writeTaskFile(taskId, path, readFileSync11(local), mediaTypeFor(local));
     console.log(`${renderTaskFile(file)}${conflict ? "  (replaced a version you had not seen)" : ""}`);
   })
 );
@@ -3237,6 +3849,45 @@ task.command("rm <task> <path>").description("remove a path from the task's file
     console.log(`Removed ${path}`);
   })
 );
+task.command("show <task>").description("the task's sessions and the requests waiting on you (questions, approvals, apps to connect)").option("--json", "print the task as JSON").action(
+  run(async (taskId, opts) => {
+    const found = await getTask(taskId);
+    if (opts.json) {
+      console.log(JSON.stringify(found));
+      return;
+    }
+    for (const member of found.sessions ?? []) console.log(`${member.id}  ${member.role}${member.status ? `  ${member.status}` : ""}`);
+    if (!found.requests.length) console.log("no open requests");
+    for (const request of found.requests) console.log(renderRequest(request));
+  })
+);
+task.command("answer <task> <request>").description("answer an open request; the asking session continues with the answer").option("--option <id>", "the id of one of the request's options").option("--text <text>", "a free-text answer").option("--note <text>", "sent to the agent after the answer, in the same turn").action(
+  run(async (taskId, requestId, opts) => {
+    await answerRequest(taskId, requestId, opts);
+    console.log(`Answered ${requestId}`);
+  })
+);
+var skills = program.command("skills").description("the workspace's skill store: upload a skill, then attach it to an agent by id");
+skills.command("upload <dir>").description("upload a skill directory (SKILL.md at its root) as a new skill").option("--name <name>", "display name (default: the directory's name)").option("--json", "print the stored skill as JSON").action(
+  run(async (dir, opts) => {
+    const { skill } = await uploadSkill(dir, opts.name);
+    if (opts.json) {
+      console.log(JSON.stringify(skill));
+      return;
+    }
+    console.log(`Uploaded ${skill.id} (${skill.displayName ?? dir}). Attach it in agent.toml:`);
+    console.log(`  [[skills]]
+  type = "skill"
+  skillId = "${skill.id}"`);
+  })
+);
+skills.command("list").description("the workspace's stored skills").action(
+  run(async () => {
+    const list = await listSkills();
+    if (!list.length) console.log("no skills");
+    for (const skill of list) console.log(`${skill.id}  ${skill.displayName ?? ""}`);
+  })
+);
 var artifact = program.command("artifact").description("artifacts: publish a task's files as a named, shareable result");
 artifact.command("list").description("the workspace's artifacts, or one task's with --task").option("--task <task>", "only this task's artifacts").action(
   run(async (opts) => {
@@ -3447,5 +4098,143 @@ program.command("config").description("show the CLI config location and current
   console.log(`  token:    ${config.token ? `${config.token.slice(0, 10)}\u2026` : "(none)"}`);
   console.log(`  universe: ${config.currentUniverse ?? "(personal)"}`);
 });
+var harness = program.command("harness").description("workspace harnesses: init, verify, push");
+harness.command("init [dir]").description("write a harness.json profile skeleton in the given directory (default: .)").action(run(async (dir) => {
+  harnessInit(dir ?? ".");
+}));
+harness.command("verify [dir]").description("validate harness.json against the profile schema; with --handle, also run conformance").option("--handle <@listing>", "catalog listing handle to run conformance against").action(run(async (dir, opts) => {
+  await harnessVerify(dir ?? ".", { handle: opts.handle });
+}));
+harness.command("push [dir]").description("create or update the workspace harness from harness.json").option("--version <semver>", "override the version (default: the version in harness.json)").action(run(async (dir, opts) => {
+  await harnessPush(dir ?? ".", { version: opts.version });
+}));
+harness.command("connect").description("run an ACP agent (the command after --) as a session's brain, over the platform relay").option("--session <id>", "the session to be the brain of (default: $AGENTSKY_HARNESS_RELAY_URL names it)").option("--token <token>", "the harness connect token, hct_\u2026 (default: $AGENTSKY_HARNESS_TOKEN)").option("--once", "exit when the connection ends instead of reconnecting").allowExcessArguments(true).action(run(async (opts) => {
+  const { connectHarness, serveHarness, agentCommandFrom } = await import("./harness-connect-DUC7GIBL.js");
+  const token = opts.token ?? process.env.AGENTSKY_HARNESS_TOKEN ?? "";
+  const url = opts.session ? void 0 : process.env.AGENTSKY_HARNESS_RELAY_URL;
+  const apiBase2 = (loadConfig().apiBase ?? "https://api.agentsky.dev").replace(/\/$/, "");
+  const ac = new AbortController();
+  process.on("SIGINT", () => ac.abort());
+  process.on("SIGTERM", () => ac.abort());
+  const options = { url, apiBase: apiBase2, session: opts.session, token, command: agentCommandFrom(process.argv), signal: ac.signal };
+  process.exitCode = opts.once ? await connectHarness(options) : await serveHarness(options);
+}));
+var traceCmd = program.command("trace").description("correlate this machine's agent work with the cloud sessions it starts (metadata only unless you choose content)");
+traceCmd.command("start").description("start a trace: a grant for this machine, a root span, and the spool the hooks write to").option("--name <name>", "a name for the task").option("--source <source>", "how this machine reports itself", "claude-code").option("--hooks [settings]", "also install the Claude Code hooks (default: ./.claude/settings.local.json)").option("--capture <scopes>", "also send content, redacted on this machine first: any of prompts,tool_output,files").option("--file <path>", "a file the files scope may send (repeatable)", collect).option("--dir <path>", "a folder whose files the files scope may send when a file tool touches them (repeatable)", collect).action(run(async (opts) => {
+  const { readState, writeState, record, installClaudeHooks, parseContentScopes, chosenPaths, fileEvent } = await import("./trace-MPGQYXNR.js");
+  if (readState()) throw new Error("a trace is already running here \u2014 `sky trace stop` it first");
+  const scopes = parseContentScopes(opts.capture);
+  const chosen = chosenPaths(opts.file ?? [], opts.dir ?? []);
+  if ((chosen.files.length || chosen.dirs.length) && !scopes.includes("files")) throw new Error("--file and --dir need --capture files");
+  if (scopes.includes("files") && !chosen.files.length && !chosen.dirs.length) throw new Error("--capture files needs at least one --file or --dir");
+  const { trace } = await api("POST", "/traces", opts.name ? { name: opts.name } : {});
+  const { grant, token } = await api("POST", `/traces/${trace.id}/grants`, {
+    source: opts.source,
+    ...scopes.length ? { content_scopes: scopes } : {}
+  });
+  const root = `task:${trace.id}`;
+  const state = {
+    trace_id: trace.id,
+    grant_id: grant.id,
+    token,
+    source: opts.source,
+    api_base: apiBase(),
+    next_sequence: 0,
+    root_span: root,
+    ...scopes.length ? { content_scopes: scopes, files: chosen.files, dirs: chosen.dirs } : {}
+  };
+  writeState(state);
+  record(() => [
+    { span_id: root, parent_span_id: null, kind: "start", name: opts.name ?? "task" },
+    ...chosen.files.flatMap((path) => fileEvent(root, path, state) ?? [])
+  ]);
+  console.log(`Tracing ${trace.id} as ${opts.source} until ${grant.expires_at}`);
+  console.log(scopes.length ? `  content: ${scopes.join(", ")} (redacted here before it leaves)` : "  metadata only");
+  if (opts.hooks) console.log(`  hooks: ${installClaudeHooks(resolve6(typeof opts.hooks === "string" ? opts.hooks : ".claude/settings.local.json"))}`);
+  console.log(`  a session started elsewhere joins it with metadata {"trace_id": "${trace.id}"}`);
+  console.log(`  sky trace show ${trace.id}`);
+}));
+traceCmd.command("hook").description("record one Claude Code hook event read from stdin (run by the installed hooks; never fails, prints nothing)").action(async () => {
+  try {
+    const { readState, record, flush, grantSender, eventsForClaudeHook, contentForClaudeHook, clearState } = await import("./trace-MPGQYXNR.js");
+    const chunks = [];
+    for await (const chunk of process.stdin) chunks.push(chunk);
+    const input = JSON.parse(Buffer.concat(chunks).toString("utf8") || "{}");
+    if (!record((state2) => [...eventsForClaudeHook(input, state2), ...contentForClaudeHook(input, state2)])) return;
+    const state = readState();
+    if (!state) return;
+    const outcome = await flush(grantSender(state, 3e3));
+    if (outcome.stopped === "grant_revoked" || outcome.stopped === "grant_expired") clearState();
+  } catch {
+  }
+});
+traceCmd.command("flush").description("send what the spool holds, retrying with backoff").action(run(async () => {
+  const { readState, flush, grantSender } = await import("./trace-MPGQYXNR.js");
+  const state = readState();
+  if (!state) throw new Error("no trace is running here");
+  const outcome = await flush(grantSender(state), { attempts: 4 });
+  console.log(`sent ${outcome.sent}, refused ${outcome.refused}, given up ${outcome.expired}, still pending ${outcome.pending}${outcome.stopped ? ` (stopped: ${outcome.stopped})` : ""}`);
+}));
+traceCmd.command("status").description("the running trace and its spool").action(run(async () => {
+  const { readState, spoolStatus } = await import("./trace-MPGQYXNR.js");
+  const state = readState();
+  if (!state) {
+    console.log("No trace is running here.");
+    return;
+  }
+  const spool = spoolStatus();
+  console.log(`${state.trace_id} as ${state.source}: ${spool.pending} pending, ${spool.dropped_full} dropped (spool full), ${spool.dropped_expired} given up, ${spool.refused} refused`);
+}));
+traceCmd.command("show [id]").description("the trace bundle: spans, the sessions they reach, cost counted once per session").option("--json", "print the bundle as JSON").action(run(async (id, opts) => {
+  const { readState } = await import("./trace-MPGQYXNR.js");
+  const ref = id ?? readState()?.trace_id;
+  if (!ref) throw new Error("name a trace, or start one here");
+  const bundle = await api("GET", `/traces/${ref}`);
+  if (opts.json) {
+    console.log(JSON.stringify(bundle, null, 2));
+    return;
+  }
+  console.log(`${bundle.trace.id}${bundle.trace.name ? `  ${bundle.trace.name}` : ""}`);
+  const children = /* @__PURE__ */ new Map();
+  for (const span of bundle.spans) {
+    const parent = span.parent_span_id && bundle.spans.some((other) => other.span_id === span.parent_span_id) ? span.parent_span_id : null;
+    children.set(parent, [...children.get(parent) ?? [], span]);
+  }
+  const print = (parent, depth) => {
+    for (const span of children.get(parent) ?? []) {
+      const withContent = span.events.filter((event) => event.content).length;
+      console.log(`${"  ".repeat(depth + 1)}${span.name ?? span.span_id}  [${span.source} \xB7 ${span.outcome}${span.outcome_source === "platform" ? " with its session" : ""}${span.edge === "root" || span.edge === "resolved" ? "" : ` \xB7 parent ${span.edge}`}]  ${span.events.length} events${withContent ? `, ${withContent} with content` : ""}`);
+      print(span.span_id, depth + 1);
+    }
+  };
+  print(null, 0);
+  for (const session2 of bundle.sessions) console.log(`  session ${session2.id}  ${session2.agent_type}  ${session2.status}  ${session2.role} of ${session2.task_id}  (${session2.linked_by})`);
+  console.log(`  cost: $${bundle.consumed_cost.amount}  \xB7  coverage: ${bundle.coverage}`);
+  for (const gap of bundle.gaps) console.log(`  gap: ${gap.span_id} ${gap.reason}`);
+}));
+traceCmd.command("stop").description("end the root span, send what is left, and revoke this machine's grant").action(run(async () => {
+  const { readState, record, flush, grantSender, clearState } = await import("./trace-MPGQYXNR.js");
+  const state = readState();
+  if (!state) throw new Error("no trace is running here");
+  if (state.root_span) record(() => [{ span_id: state.root_span, kind: "end", outcome: "completed" }]);
+  const outcome = await flush(grantSender(readState() ?? state), { attempts: 4 });
+  await api("DELETE", `/traces/${state.trace_id}/grants/${state.grant_id}`);
+  clearState();
+  console.log(`Stopped ${state.trace_id}${outcome.pending ? ` (${outcome.pending} events could not be sent)` : ""}`);
+}));
+var workerCmd = program.command("worker").description("run a pod on this machine and connect it to a worker pool");
+workerCmd.command("start <pool>").description("start a worker connected to the given pool (wpool_\u2026 id)").option("--token <token>", "bearer token (default: $SKY_WORKER_TOKEN)").option("--label <label>", "a human-readable name for this machine", "cli").action(async (poolId, options) => {
+  const { startWorker } = await import("./worker-6Q4K4HZW.js");
+  const token = options.token ?? process.env.SKY_WORKER_TOKEN ?? "";
+  if (!token) {
+    console.error("error: provide --token or set SKY_WORKER_TOKEN");
+    process.exit(1);
+  }
+  const base = (loadConfig().apiBase ?? "https://api.agentsky.dev").replace(/\/$/, "");
+  const ac = new AbortController();
+  process.on("SIGINT", () => ac.abort());
+  process.on("SIGTERM", () => ac.abort());
+  await startWorker({ poolId, token, label: options.label, apiBase: base, signal: ac.signal });
+});
 var ARGUMENTS_FOLLOW_THE_SCRIPT_PATH_ON_EVERY_RUNTIME = { from: "node" };
 program.parseAsync(process.argv, ARGUMENTS_FOLLOW_THE_SCRIPT_PATH_ON_EVERY_RUNTIME).catch(fail);