@neta-art/cohub-cli 1.2.0 → 1.4.0

package/dist/commands/spaces.js

@@ -1,4 +1,7 @@
-import { resolveToken } from "../auth.js";
+import { randomUUID } from "node:crypto";
+import { createReadStream } from "node:fs";
+import { readdir, stat } from "node:fs/promises";
+import { basename, dirname, relative, resolve, sep } from "node:path";
 import { createClient } from "../client.js";
 import { table, json as outJson, ok, error, handleHttp } from "../output.js";
 function requireSpace(program) {
@@ -11,6 +14,151 @@ function requireSpace(program) {
     }
     return error("Missing required option", "Add -s, --space <id> to target a space");
 }
+const slashPath = (value) => value.split(sep).join("/");
+const walkUploadPath = async (input, root, prefix = "") => {
+    const localPath = resolve(input);
+    const info = await stat(localPath);
+    const name = basename(localPath);
+    const relativePath = slashPath(prefix ? `${prefix}/${name}` : relative(root, localPath) || name);
+    if (info.isDirectory()) {
+        const children = await readdir(localPath);
+        const nested = await Promise.all(children.map((child) => walkUploadPath(resolve(localPath, child), root, relativePath)));
+        return nested.flat();
+    }
+    if (!info.isFile())
+        return [];
+    return [{
+            id: randomUploadEntryId(),
+            localPath,
+            relativePath,
+            name,
+            size: info.size,
+            mimeType: null,
+        }];
+};
+const randomUploadEntryId = () => randomUUID();
+async function collectUploadFiles(paths) {
+    if (paths.length === 0)
+        return error("No files provided", "Pass one or more local files or directories.");
+    const roots = paths.map((path) => {
+        const resolved = resolve(path);
+        return dirname(resolved);
+    });
+    const nested = await Promise.all(paths.map((path, index) => walkUploadPath(path, roots[index] ?? process.cwd())));
+    const files = nested.flat();
+    if (files.length === 0)
+        return error("No regular files found");
+    return files;
+}
+async function putUploadEntry(entry, uploadUrl, headers) {
+    const response = await fetch(uploadUrl, {
+        method: "PUT",
+        headers,
+        body: createReadStream(entry.localPath),
+        duplex: "half",
+    });
+    if (!response.ok) {
+        const detail = await response.text().catch(() => "");
+        throw new Error(`Failed to upload ${entry.relativePath}: HTTP ${response.status}${detail ? ` — ${detail}` : ""}`);
+    }
+}
+async function uploadFiles(command, paths, opts) {
+    const spaceId = requireSpace(command);
+    const client = createClient();
+    try {
+        const files = await collectUploadFiles(paths);
+        const plan = await client.space(spaceId).files.createUpload({
+            targetDir: opts.dir,
+            entries: files.map((file) => ({
+                id: file.id,
+                name: file.name,
+                relativePath: file.relativePath,
+                size: file.size,
+                mimeType: file.mimeType,
+            })),
+        });
+        const byId = new Map(files.map((file) => [file.id, file]));
+        for (const entry of plan.entries) {
+            const file = byId.get(entry.id);
+            if (!file)
+                throw new Error(`Missing upload entry: ${entry.id}`);
+            await putUploadEntry(file, entry.uploadUrl, entry.headers);
+        }
+        const result = await client.space(spaceId).files.completeUpload(plan.uploadId, {
+            entries: plan.entries.map((entry) => ({ id: entry.id })),
+        });
+        if (opts.json)
+            return outJson({ ...result, uploadId: plan.uploadId, files: files.length });
+        ok(`Uploaded ${files.length} file${files.length === 1 ? "" : "s"} — taskRunId: ${result.taskRunId}`);
+    }
+    catch (e) {
+        handleHttp(e);
+    }
+}
+async function readPromptContent(words) {
+    let content = words.join(" ");
+    if (!content && !process.stdin.isTTY) {
+        const chunks = [];
+        for await (const chunk of process.stdin)
+            chunks.push(chunk);
+        content = Buffer.concat(chunks).toString().trim();
+    }
+    if (!content)
+        return error("No content", "Pass as argument or pipe via stdin");
+    return content;
+}
+async function sendPrompt(command, words, opts) {
+    const content = await readPromptContent(words);
+    const scheduleFlags = [opts.delayMs, opts.at, opts.cron].filter((value) => value !== undefined);
+    if (scheduleFlags.length > 1)
+        return error("Conflicting schedule", "Use only one of --delay-ms, --at, or --cron");
+    if (opts.cron && !opts.timezone)
+        return error("Missing timezone", "--timezone is required with --cron");
+    const spaceId = requireSpace(command);
+    const client = createClient();
+    try {
+        const schedule = opts.delayMs
+            ? { mode: "delay", delayMs: Number.parseInt(opts.delayMs, 10) }
+            : opts.at
+                ? { mode: "at", sendAt: opts.at }
+                : opts.cron
+                    ? { mode: "repeat", cronExpression: opts.cron, timezone: opts.timezone }
+                    : undefined;
+        const result = await client.space(spaceId).prompt({
+            sessionId: opts.session,
+            title: opts.title,
+            content: [{ type: "text", text: content }],
+            model: opts.model,
+            provider: opts.provider,
+            schedule,
+        });
+        if (opts.json)
+            return outJson(result);
+        if (result.mode === "immediate")
+            return ok(`Prompt sent — sessionId: ${result.sessionId}, turnId: ${result.turnId}`);
+        if (result.mode === "repeat")
+            return ok(`Prompt scheduled — cronJobId: ${result.cronJobId}, nextRunAt: ${result.nextRunAt}`);
+        return ok(`Prompt scheduled — taskRunId: ${result.taskRunId}, scheduledAt: ${result.scheduledAt}`);
+    }
+    catch (e) {
+        handleHttp(e);
+    }
+}
+export function registerPrompt(program) {
+    program
+        .command("prompt [content...]")
+        .description("Send or schedule a prompt in a space")
+        .option("--session <id>", "Target session ID")
+        .option("--title <title>", "Title for a newly created session or schedule")
+        .option("-m, --model <model>", "Model name")
+        .option("-p, --provider <provider>", "Provider name")
+        .option("--delay-ms <ms>", "Delay sending by milliseconds")
+        .option("--at <iso>", "Send once at an ISO 8601 time with timezone")
+        .option("--cron <expression>", "Repeat using a 5-field cron expression")
+        .option("--timezone <tz>", "IANA timezone for --cron, e.g. Asia/Shanghai")
+        .option("--json", "Output as JSON")
+        .action((words, opts) => sendPrompt(program, words, opts));
+}
 export function registerSpaces(program) {
     const spacesCmd = program.command("spaces").description("Space management");
     // ── spaces ls ──
@@ -20,8 +168,7 @@ export function registerSpaces(program) {
         .description("List all spaces")
         .option("--json", "Output as JSON")
         .action(async (opts) => {
-        const token = resolveToken() ?? missingAuth();
-        const client = createClient(token);
+        const client = createClient();
         try {
             const items = await client.spaces.list();
             if (opts.json)
@@ -42,8 +189,7 @@ export function registerSpaces(program) {
         .description("Show space details")
         .option("--json", "Output as JSON")
         .action(async (id, opts) => {
-        const token = resolveToken() ?? missingAuth();
-        const client = createClient(token);
+        const client = createClient();
         try {
             const space = await client.spaces.get(id);
             if (opts.json)
@@ -68,8 +214,7 @@ export function registerSpaces(program) {
         .option("-d, --description <desc>", "Space description")
         .option("--json", "Output as JSON")
         .action(async (opts) => {
-        const token = resolveToken() ?? missingAuth();
-        const client = createClient(token);
+        const client = createClient();
         try {
             const result = await client.spaces.create({
                 name: opts.name,
@@ -93,8 +238,7 @@ export function registerSpaces(program) {
         .command("rename <id> <name>")
         .description("Rename a space")
         .action(async (id, name) => {
-        const token = resolveToken() ?? missingAuth();
-        const client = createClient(token);
+        const client = createClient();
         try {
             await client.space(id).rename(name);
             ok(`Space renamed to "${name}"`);
@@ -105,7 +249,8 @@ export function registerSpaces(program) {
     });
     // ── spaces prompt ──
     spacesCmd
-        .command("prompt [content...]")
+        .command("prompt [content...]", { hidden: true })
+        .alias("send")
         .description("Send or schedule a prompt in the target space")
         .option("--session <id>", "Target session ID")
         .option("--title <title>", "Title for a newly created session or schedule")
@@ -116,52 +261,7 @@ export function registerSpaces(program) {
         .option("--cron <expression>", "Repeat using a 5-field cron expression")
         .option("--timezone <tz>", "IANA timezone for --cron, e.g. Asia/Shanghai")
         .option("--json", "Output as JSON")
-        .action(async (words, opts) => {
-        const token = resolveToken() ?? missingAuth();
-        let content = words.join(" ");
-        if (!content && !process.stdin.isTTY) {
-            const chunks = [];
-            for await (const chunk of process.stdin)
-                chunks.push(chunk);
-            content = Buffer.concat(chunks).toString().trim();
-        }
-        if (!content)
-            return error("No content", "Pass as argument or pipe via stdin");
-        const scheduleFlags = [opts.delayMs, opts.at, opts.cron].filter((value) => value !== undefined);
-        if (scheduleFlags.length > 1)
-            return error("Conflicting schedule", "Use only one of --delay-ms, --at, or --cron");
-        if (opts.cron && !opts.timezone)
-            return error("Missing timezone", "--timezone is required with --cron");
-        const spaceId = requireSpace(spacesCmd);
-        const client = createClient(token);
-        try {
-            const schedule = opts.delayMs
-                ? { mode: "delay", delayMs: Number.parseInt(opts.delayMs, 10) }
-                : opts.at
-                    ? { mode: "at", sendAt: opts.at }
-                    : opts.cron
-                        ? { mode: "repeat", cronExpression: opts.cron, timezone: opts.timezone }
-                        : undefined;
-            const result = await client.space(spaceId).prompt({
-                sessionId: opts.session,
-                title: opts.title,
-                content: [{ type: "text", text: content }],
-                model: opts.model,
-                provider: opts.provider,
-                schedule,
-            });
-            if (opts.json)
-                return outJson(result);
-            if (result.mode === "immediate")
-                return ok(`Prompt sent — sessionId: ${result.sessionId}, turnId: ${result.turnId}`);
-            if (result.mode === "repeat")
-                return ok(`Prompt scheduled — cronJobId: ${result.cronJobId}, nextRunAt: ${result.nextRunAt}`);
-            return ok(`Prompt scheduled — taskRunId: ${result.taskRunId}, scheduledAt: ${result.scheduledAt}`);
-        }
-        catch (e) {
-            handleHttp(e);
-        }
-    });
+        .action((words, opts) => sendPrompt(spacesCmd, words, opts));
     // ── spaces files ──
     registerFiles(spacesCmd);
     // ── spaces sessions ──
@@ -178,9 +278,8 @@ export function registerSpaces(program) {
         .description("Space usage statistics (default: 30 days)")
         .option("--json", "Output as JSON")
         .action(async (days, opts) => {
-        const token = resolveToken() ?? missingAuth();
         const spaceId = requireSpace(spacesCmd);
-        const client = createClient(token);
+        const client = createClient();
         try {
             const usage = await client.space(spaceId).usage.get(Number.parseInt(days ?? "30", 10));
             if (opts.json)
@@ -211,9 +310,8 @@ function registerFiles(spacesCmd) {
         .description("List directory tree")
         .option("--json", "Output as JSON")
         .action(async (path, opts) => {
-        const token = resolveToken() ?? missingAuth();
         const spaceId = requireSpace(spacesCmd);
-        const client = createClient(token);
+        const client = createClient();
         try {
             const tree = await client.space(spaceId).files.list(path ?? "");
             if (opts.json)
@@ -237,11 +335,15 @@ function registerFiles(spacesCmd) {
         .command("cat <path>")
         .description("Read file content")
         .action(async (path) => {
-        const token = resolveToken() ?? missingAuth();
         const spaceId = requireSpace(spacesCmd);
-        const client = createClient(token);
+        const client = createClient();
         try {
             const file = await client.space(spaceId).files.read(path);
+            if (!("content" in file))
+                return error("File is being prepared. Please retry shortly.");
+            if (file.delivery === "url" && file.url) {
+                console.log(`[CDN] ${file.url}`);
+            }
             console.log(file.content);
         }
         catch (e) {
@@ -254,7 +356,6 @@ function registerFiles(spacesCmd) {
         .option("-c, --content <text>", "File content")
         .option("-e, --encoding <enc>", "Encoding (utf-8 or base64)", "utf-8")
         .action(async (path, opts) => {
-        const token = resolveToken() ?? missingAuth();
         let content = opts.content ?? "";
         if (!content && !process.stdin.isTTY) {
             const chunks = [];
@@ -265,7 +366,7 @@ function registerFiles(spacesCmd) {
         if (!content)
             return error("No content provided", "Use -c or pipe via stdin");
         const spaceId = requireSpace(spacesCmd);
-        const client = createClient(token);
+        const client = createClient();
         try {
             const result = await client.space(spaceId).files.write({
                 path,
@@ -278,13 +379,18 @@ function registerFiles(spacesCmd) {
             handleHttp(e);
         }
     });
+    filesCmd
+        .command("upload <paths...>")
+        .description("Upload local files or directories")
+        .option("--dir <path>", "Target directory in the space")
+        .option("--json", "Output as JSON")
+        .action((paths, opts) => uploadFiles(spacesCmd, paths, opts));
     filesCmd
         .command("mkdir <path>")
         .description("Create a directory")
         .action(async (path) => {
-        const token = resolveToken() ?? missingAuth();
         const spaceId = requireSpace(spacesCmd);
-        const client = createClient(token);
+        const client = createClient();
         try {
             await client.space(spaceId).files.createDir(path);
             ok(`Directory created: ${path}`);
@@ -298,9 +404,8 @@ function registerFiles(spacesCmd) {
         .description("Delete a file or directory")
         .option("-r, --recursive", "Delete recursively")
         .action(async (path, opts) => {
-        const token = resolveToken() ?? missingAuth();
         const spaceId = requireSpace(spacesCmd);
-        const client = createClient(token);
+        const client = createClient();
         try {
             await client.space(spaceId).files.delete(path, opts.recursive ?? false);
             ok(`Deleted: ${path}`);
@@ -313,9 +418,8 @@ function registerFiles(spacesCmd) {
         .command("mv <from> <to>")
         .description("Move or rename")
         .action(async (from, to) => {
-        const token = resolveToken() ?? missingAuth();
         const spaceId = requireSpace(spacesCmd);
-        const client = createClient(token);
+        const client = createClient();
         try {
             await client.space(spaceId).files.move({ fromPath: from, toPath: to });
             ok(`Moved: ${from} → ${to}`);
@@ -324,19 +428,12 @@ function registerFiles(spacesCmd) {
             handleHttp(e);
         }
     });
-    filesCmd
-        .command("upload <files...>")
-        .description("Upload files to a directory")
-        .option("--dir <dir>", "Target directory", "")
-        .action(async (_files) => {
-        error("Upload requires browser File API", "Use the web interface for now");
-    });
 }
 // ── Session operations ──
 function registerSessions(spacesCmd) {
     const sessionsCmd = spacesCmd
         .command("sessions")
-        .description("Session operations")
+        .description("Browse sessions and turns")
         .hook("preAction", () => { requireSpace(spacesCmd); });
     sessionsCmd
         .command("ls")
@@ -344,9 +441,8 @@ function registerSessions(spacesCmd) {
         .description("List sessions")
         .option("--json", "Output as JSON")
         .action(async (opts) => {
-        const token = resolveToken() ?? missingAuth();
         const spaceId = requireSpace(spacesCmd);
-        const client = createClient(token);
+        const client = createClient();
         try {
             const result = await client.space(spaceId).sessions.list();
             if (opts.json)
@@ -371,9 +467,8 @@ function registerSessions(spacesCmd) {
         .description("Create a session")
         .option("--json", "Output as JSON")
         .action(async (title, opts) => {
-        const token = resolveToken() ?? missingAuth();
         const spaceId = requireSpace(spacesCmd);
-        const client = createClient(token);
+        const client = createClient();
         try {
             const result = await client.space(spaceId).sessions.create({ title });
             if (opts.json)
@@ -393,9 +488,8 @@ function registerSessions(spacesCmd) {
         .description("Session details")
         .option("--json", "Output as JSON")
         .action(async (id, opts) => {
-        const token = resolveToken() ?? missingAuth();
         const spaceId = requireSpace(spacesCmd);
-        const client = createClient(token);
+        const client = createClient();
         try {
             const result = await client.space(spaceId).session(id).get();
             if (opts.json)
@@ -416,9 +510,8 @@ function registerSessions(spacesCmd) {
         .command("rename <id> <name>")
         .description("Rename a session")
         .action(async (id, name) => {
-        const token = resolveToken() ?? missingAuth();
         const spaceId = requireSpace(spacesCmd);
-        const client = createClient(token);
+        const client = createClient();
         try {
             await client.space(spaceId).session(id).rename(name);
             ok(`Session renamed to "${name}"`);
@@ -427,17 +520,14 @@ function registerSessions(spacesCmd) {
             handleHttp(e);
         }
     });
-    // ── sessions messages ──
-    registerMessages(sessionsCmd);
     // ── sessions tail ──
     sessionsCmd
         .command("tail <id>")
         .description("Stream realtime session events")
         .option("--json", "Output as JSON")
         .action(async (id, opts) => {
-        const token = resolveToken() ?? missingAuth();
         const spaceId = requireSpace(spacesCmd);
-        const client = createClient(token);
+        const client = createClient();
         const session = client.space(spaceId).session(id);
         process.stdout.write("  Listening for events...\n\n");
         let lastAppendPath = null;
@@ -474,71 +564,202 @@ function registerSessions(spacesCmd) {
             process.exit(1);
         });
     });
+    // ── sessions turns ──
+    registerTurns(sessionsCmd);
+    // ── sessions access ──
+    registerSessionAccess(sessionsCmd);
 }
-// ── Message operations ──
-function registerMessages(sessionsCmd) {
-    const msgsCmd = sessionsCmd.command("messages").description("Message operations");
-    msgsCmd
+// ── Turn operations ──
+function registerTurns(sessionsCmd) {
+    const turnsCmd = sessionsCmd.command("turns").description("Inspect session turns");
+    turnsCmd
         .command("ls <sessionId>")
         .alias("list")
-        .description("List session messages")
+        .description("List recent turns")
+        .option("--cursor <sequence>", "Turn sequence cursor")
+        .option("--direction <older|newer>", "Page direction", "older")
+        .option("--limit <n>", "Page size", "30")
         .option("--json", "Output as JSON")
-        .option("--limit <n>", "Page size", "50")
         .action(async (sessionId, opts) => {
-        const token = resolveToken() ?? missingAuth();
         const spaceId = requireSpace(sessionsCmd);
-        const client = createClient(token);
+        const client = createClient();
         try {
-            const result = await client.space(spaceId).session(sessionId).messages.listPaginated({
-                limit: Number.parseInt(opts.limit ?? "50", 10),
+            const result = await client.space(spaceId).session(sessionId).turns.listPaginated({
+                cursor: opts.cursor === undefined ? undefined : Number.parseInt(opts.cursor, 10),
+                direction: opts.direction,
+                limit: Number.parseInt(opts.limit ?? "30", 10),
             });
             if (opts.json)
                 return outJson(result);
-            if (result.messages.length === 0) {
-                console.log("  (empty)");
-                return;
-            }
-            table(result.messages, [
+            if (result.turns.length === 0)
+                return console.log("  No turns found");
+            table(result.turns, [
+                { key: "sequence", label: "Seq" },
                 { key: "id", label: "ID" },
-                { key: "role", label: "Role" },
-                { key: "createdAt", label: "Created" },
+                { key: "status", label: "Status" },
+                { key: "userText", label: "User" },
+                { key: "assistantText", label: "Assistant" },
+                { key: "updatedAt", label: "Updated" },
             ]);
-            if (result.hasMore) {
-                console.log(`\n  (more — use --cursor ${result.nextCursor} for next page)`);
-            }
+            if (result.hasMore)
+                console.log(`\n  More turns available — next cursor: ${result.nextCursor}`);
         }
         catch (e) {
             handleHttp(e);
         }
     });
-    msgsCmd
-        .command("send <sessionId> [content...]")
-        .description("Send a message to a session")
-        .option("-m, --model <model>", "Model name")
-        .option("-p, --provider <provider>", "Provider name")
+    turnsCmd
+        .command("get <sessionId> <turnId>")
+        .description("Show turn details")
         .option("--json", "Output as JSON")
-        .action(async (sessionId, words, opts) => {
-        const token = resolveToken() ?? missingAuth();
-        let content = words.join(" ");
-        if (!content && !process.stdin.isTTY) {
-            const chunks = [];
-            for await (const chunk of process.stdin)
-                chunks.push(chunk);
-            content = Buffer.concat(chunks).toString().trim();
+        .action(async (sessionId, turnId, opts) => {
+        const spaceId = requireSpace(sessionsCmd);
+        const client = createClient();
+        try {
+            const result = await client.space(spaceId).session(sessionId).turns.get(turnId);
+            if (opts.json)
+                return outJson(result);
+            table([result.turn], [
+                { key: "sequence", label: "Seq" },
+                { key: "id", label: "ID" },
+                { key: "status", label: "Status" },
+                { key: "provider", label: "Provider" },
+                { key: "model", label: "Model" },
+                { key: "stopReason", label: "Stop" },
+                { key: "errorMessage", label: "Error" },
+            ]);
+            if (result.turn.userText)
+                console.log(`\nUser:\n${result.turn.userText}`);
+            if (result.turn.assistantText)
+                console.log(`\nAssistant:\n${result.turn.assistantText}`);
         }
-        if (!content)
-            return error("No content", "Pass as argument or pipe via stdin");
+        catch (e) {
+            handleHttp(e);
+        }
+    });
+    turnsCmd
+        .command("index <sessionId>", { hidden: true })
+        .description("List lightweight turn index")
+        .option("--cursor <sequence>", "Turn sequence cursor")
+        .option("--limit <n>", "Page size", "100")
+        .option("--json", "Output as JSON")
+        .action(async (sessionId, opts) => {
+        const spaceId = requireSpace(sessionsCmd);
+        const client = createClient();
+        try {
+            const result = await client.space(spaceId).session(sessionId).turns.index({
+                cursor: opts.cursor === undefined ? undefined : Number.parseInt(opts.cursor, 10),
+                limit: Number.parseInt(opts.limit ?? "100", 10),
+            });
+            if (opts.json)
+                return outJson(result);
+            if (result.turns.length === 0)
+                return console.log("  No turns found");
+            table(result.turns, [
+                { key: "sequence", label: "Seq" },
+                { key: "id", label: "ID" },
+                { key: "status", label: "Status" },
+                { key: "userPreview", label: "User" },
+                { key: "assistantPreview", label: "Assistant" },
+            ]);
+            if (result.hasMore)
+                console.log(`\n  More turns available — next cursor: ${result.nextCursor}`);
+        }
+        catch (e) {
+            handleHttp(e);
+        }
+    });
+    turnsCmd
+        .command("window <sessionId>", { hidden: true })
+        .description("Load turns around a sequence or turn ID")
+        .option("--sequence <n>", "Anchor turn sequence")
+        .option("--turn <id>", "Anchor turn ID")
+        .option("--before <n>", "Turns before anchor", "10")
+        .option("--after <n>", "Turns after anchor", "20")
+        .option("--json", "Output as JSON")
+        .action(async (sessionId, opts) => {
         const spaceId = requireSpace(sessionsCmd);
-        const client = createClient(token);
+        if (!opts.sequence && !opts.turn)
+            return error("Missing anchor", "Use --sequence <n> or --turn <id>");
+        const client = createClient();
         try {
-            const result = await client.space(spaceId).session(sessionId).messages.send({
-                content: [{ type: "text", text: content }],
-                model: opts.model,
-                provider: opts.provider,
+            const result = await client.space(spaceId).session(sessionId).turns.window({
+                sequence: opts.sequence === undefined ? undefined : Number.parseInt(opts.sequence, 10),
+                turnId: opts.turn,
+                before: Number.parseInt(opts.before ?? "10", 10),
+                after: Number.parseInt(opts.after ?? "20", 10),
             });
             if (opts.json)
                 return outJson(result);
-            ok(`Message sent — userMessageId: ${result.userMessageId}`);
+            if (result.turns.length === 0)
+                return console.log("  No turns found");
+            table(result.turns, [
+                { key: "sequence", label: "Seq" },
+                { key: "id", label: "ID" },
+                { key: "status", label: "Status" },
+                { key: "userText", label: "User" },
+                { key: "assistantText", label: "Assistant" },
+            ]);
+            console.log(`\n  Window — older: ${result.hasMoreOlder ? "yes" : "no"}, newer: ${result.hasMoreNewer ? "yes" : "no"}`);
+        }
+        catch (e) {
+            handleHttp(e);
+        }
+    });
+}
+// ── Session access operations ──
+function registerSessionAccess(sessionsCmd) {
+    const accessCmd = sessionsCmd.command("access").description("Session access control");
+    accessCmd
+        .command("get <id>")
+        .description("Get session access policy")
+        .option("--json", "Output as JSON")
+        .action(async (id, opts) => {
+        const client = createClient();
+        try {
+            const policy = await client.sessionAccess.get(id);
+            if (opts.json)
+                return outJson(policy);
+            table([policy], [
+                { key: "signed_in_user", label: "Signed-in" },
+                { key: "anonymous_user", label: "Anonymous" },
+            ]);
+        }
+        catch (e) {
+            handleHttp(e);
+        }
+    });
+    accessCmd
+        .command("set <id>")
+        .description("Set session anonymous access")
+        .option("--anonymous <role>", "Anonymous role (host|builder|guest|null)")
+        .option("--json", "Output as JSON")
+        .action(async (id, opts) => {
+        const client = createClient();
+        try {
+            const policy = await client.sessionAccess.set(id, {
+                anonymous_user: (opts.anonymous ?? null),
+            });
+            if (opts.json)
+                return outJson(policy);
+            ok("Session access updated");
+            table([policy], [
+                { key: "signed_in_user", label: "Signed-in" },
+                { key: "anonymous_user", label: "Anonymous" },
+            ]);
+        }
+        catch (e) {
+            handleHttp(e);
+        }
+    });
+    accessCmd
+        .command("remove <id>")
+        .description("Remove session access override")
+        .action(async (id) => {
+        const client = createClient();
+        try {
+            await client.sessionAccess.remove(id);
+            ok(`Session access override removed: ${id}`);
         }
         catch (e) {
             handleHttp(e);
@@ -557,9 +778,8 @@ function registerMembers(spacesCmd) {
         .description("List space members")
         .option("--json", "Output as JSON")
         .action(async (opts) => {
-        const token = resolveToken() ?? missingAuth();
         const spaceId = requireSpace(spacesCmd);
-        const client = createClient(token);
+        const client = createClient();
         try {
             const result = await client.space(spaceId).members.list();
             if (opts.json)
@@ -582,9 +802,8 @@ function registerMembers(spacesCmd) {
         .command("update <userId> <role>")
         .description("Change member role (host | builder | guest)")
         .action(async (userId, role) => {
-        const token = resolveToken() ?? missingAuth();
         const spaceId = requireSpace(spacesCmd);
-        const client = createClient(token);
+        const client = createClient();
         try {
             await client.space(spaceId).members.update(userId, role);
             ok(`${userId} → ${role}`);
@@ -597,9 +816,8 @@ function registerMembers(spacesCmd) {
         .command("remove <userId>")
         .description("Remove a member")
         .action(async (userId) => {
-        const token = resolveToken() ?? missingAuth();
         const spaceId = requireSpace(spacesCmd);
-        const client = createClient(token);
+        const client = createClient();
         try {
             await client.space(spaceId).members.remove(userId);
             ok(`${userId} removed`);
@@ -620,9 +838,8 @@ function registerAccess(spacesCmd) {
         .description("Get access policy")
         .option("--json", "Output as JSON")
         .action(async (opts) => {
-        const token = resolveToken() ?? missingAuth();
         const spaceId = requireSpace(spacesCmd);
-        const client = createClient(token);
+        const client = createClient();
         try {
             const policy = await client.space(spaceId).access.get();
             if (opts.json)
@@ -643,9 +860,8 @@ function registerAccess(spacesCmd) {
         .option("--anonymous <role>", "Role for anonymous users (host|builder|guest|null)")
         .option("--json", "Output as JSON")
         .action(async (opts) => {
-        const token = resolveToken() ?? missingAuth();
         const spaceId = requireSpace(spacesCmd);
-        const client = createClient(token);
+        const client = createClient();
         try {
             const policy = await client.space(spaceId).access.set({
                 signed_in_user: (opts.signedIn ?? null),
@@ -676,9 +892,8 @@ function registerCheckpoints(spacesCmd) {
         .description("List checkpoints")
         .option("--json", "Output as JSON")
         .action(async (opts) => {
-        const token = resolveToken() ?? missingAuth();
         const spaceId = requireSpace(spacesCmd);
-        const client = createClient(token);
+        const client = createClient();
         try {
             const result = await client.space(spaceId).checkpoints.list();
             if (opts.json)
@@ -703,9 +918,8 @@ function registerCheckpoints(spacesCmd) {
         .description("Checkpoint details")
         .option("--json", "Output as JSON")
         .action(async (id, opts) => {
-        const token = resolveToken() ?? missingAuth();
         const spaceId = requireSpace(spacesCmd);
-        const client = createClient(token);
+        const client = createClient();
         try {
             const result = await client.space(spaceId).checkpoints.get(id);
             if (opts.json)
@@ -727,9 +941,8 @@ function registerCheckpoints(spacesCmd) {
         .description("Create a checkpoint")
         .option("--json", "Output as JSON")
         .action(async (description, opts) => {
-        const token = resolveToken() ?? missingAuth();
         const spaceId = requireSpace(spacesCmd);
-        const client = createClient(token);
+        const client = createClient();
         try {
             const result = await client.space(spaceId).checkpoints.create(description ?? null);
             if (opts.json)
@@ -741,6 +954,3 @@ function registerCheckpoints(spacesCmd) {
         }
     });
 }
-function missingAuth() {
-    return error("Not authenticated", "Run 'cohub auth login <token>'");
-}