@shardflux/cli 0.14.5 → 0.15.0

package/dist/command-center-renderer.js

@@ -1,6 +1,6 @@
-import { browserSessionNote, workspaceBrowserSessionNote } from "./browser-profile-copy.js";
 import { agentName } from "./command-center-model.js";
 import { setupLine } from "./assisted-setup.js";
+import { terminalBrand } from "./terminal-brand.js";
 /** API titles and local input never get to send terminal controls. */
 export function plain(value) { return [...value].map(ch => { const code = ch.codePointAt(0); return code < 32 || code >= 127 && code <= 159 ? ' ' : ch; }).join(''); }
 function width(ch) {
@@ -23,63 +23,67 @@ export function clip(value, columns) {
 export function renderCenter(view, columns, height, color = true) {
     columns = Math.max(1, Math.min(1000, columns));
     height = Math.max(1, Math.min(1000, height));
-    const lines = ['shardflux  /  Cloud agents', view.filter ? `Filter: ${view.filter}` : 'Projects / agents / sessions  ·  attention first', ''];
+    const prompt = view.prompt?.replace(/ {2}\(Enter accepts, Esc cancels\)$/, '');
+    const lines = [prompt ? `  ${prompt}` : '  + New conversation  n', view.filter && !prompt ? `  Search: ${view.filter}` : ''];
+    const selectedRow = view.rows.find(row => row.id === view.selected);
     const body = [];
-    const sites = (profiles) => [...new Set(profiles.flatMap(p => p.sites.map(s => s.site)))].join(', ');
-    // Project-scoped sessions reach every row, so they are named once; workspace-scoped ones sit under their agent.
-    const shared = [...new Map(view.rows.flatMap(r => r.browserProfiles ?? []).filter(p => p.scope === 'project').map(p => [p.name, p])).values()];
-    if (shared.length)
-        body.push({ text: `Browser sessions: ${sites(shared)}` }, { text: browserSessionNote }, { text: '' });
-    let project = '', key = '';
+    const age = (since) => {
+        if (!since || !Number.isFinite(Date.parse(since)))
+            return '';
+        const minutes = Math.max(0, Math.floor(((view.now ?? Date.now()) - Date.parse(since)) / 60000));
+        return minutes < 1 ? 'now' : minutes < 60 ? `${minutes}m` : minutes < 1440 ? `${Math.floor(minutes / 60)}h` : `${Math.floor(minutes / 1440)}d`;
+    };
     for (const row of view.rows) {
-        if (row.project !== project) {
-            project = row.project;
-            key = '';
-            body.push({ text: project });
-            const setup = view.rows.find(candidate => candidate.project === project && candidate.setup)?.setup;
-            const progress = setup && setupLine(project, setup);
-            if (progress)
-                body.push({ text: `  ${progress}` });
-        }
         if (row.start) {
-            body.push({ text: '  Start Claude here (or Codex)', id: row.id });
+            body.push({ text: `  Start a conversation in ${row.project}`, id: row.id });
             continue;
         }
-        if (row.key !== key) {
-            key = row.key;
-            body.push({ text: `  ${agentName(key, row.agent?.labels ?? row.workspace?.labels ?? {})}` });
-            const own = row.browserProfiles?.filter(p => p.scope !== 'project') ?? [];
-            if (own.length)
-                body.push({ text: `    Browser sessions: ${sites(own)}` }, { text: `    ${workspaceBrowserSessionNote}` });
-        }
-        const session = row.agent?.id.slice(row.agent.workspace_id.length + 1);
-        body.push({ text: `    [${row.badge}] ${row.agent ? `${row.agent.app}  ${clip(session, 12)}  ${row.agent.title || 'Untitled session'}` : 'Open a session'}`, id: row.id, badge: row.badge });
+        const title = row.agent?.title || (row.agent ? 'Untitled conversation' : 'Open a conversation');
+        const project = `${row.project}/${agentName(row.key, row.agent?.labels ?? row.workspace?.labels ?? {})}`;
+        const suffix = `  ${clip(project, Math.max(8, Math.floor(columns * 0.29)))}  ${age(row.agent?.since).padStart(3)}`;
+        const titleWidth = Math.max(1, columns - suffix.length - 7);
+        const name = clip(title, titleWidth);
+        body.push({ text: `  ${row.badge === 'done' ? '○' : '●'}  ${name}${' '.repeat(Math.max(0, titleWidth - [...name].reduce((n, c) => n + width(c), 0)))}${suffix}`, id: row.id, badge: row.badge });
     }
     if (!body.length)
-        body.push({ text: view.filter ? 'No matching sessions. Press / to change the filter.' : 'No cloud agents. Run shard <path> to start a project.' });
+        body.push({ text: view.message ? '' : view.filter ? '  No conversations match this search.' : '  Your conversations will appear here.' });
     const available = Math.max(0, height - 7);
     const selected = body.findIndex(r => r.id === view.selected);
     const start = Math.max(0, selected - available + 1);
     for (const row of body.slice(start, start + available)) {
-        let line = clip(`${row.id === view.selected ? '>' : ' '} ${row.text}`, columns);
+        let line = clip(row.text, columns);
+        if (row.id && row.id === view.selected)
+            line = '›' + line.slice(1);
         if (color) {
             if (row.badge === 'working')
-                line = `\x1b[38;5;208m${line}\x1b[0m`;
+                line = line.replace('●', `\x1b[38;2;${terminalBrand['sf-molten'].join(';')}m●\x1b[39m`);
             if (row.badge === 'done')
-                line = `\x1b[2m${line}\x1b[0m`;
-            if (row.id === view.selected)
-                line = `\x1b[7m${line}\x1b[0m`;
+                line = `\x1b[2m${line}\x1b[22m`;
+            if (row.id && row.id === view.selected)
+                line = `\x1b[48;2;${terminalBrand['sf-overlay'].join(';')}m\x1b[38;2;${terminalBrand['sf-ink'].join(';')}m${line}\x1b[0m`;
         }
         lines.push(line);
     }
-    while (lines.length < height - 4)
+    while (lines.length < height - 5)
         lines.push('');
-    lines.push(view.prompt ?? view.message, 'Enter open  o open in  n session  N agent  f fork  p park', `l logs  / filter  q quit${view.extraKeys.length ? `  ${view.extraKeys.join('  ')}` : ''}`, view.menubarHint ?? `${view.rows.length} session${view.rows.length === 1 ? '' : 's'}  ·  refresh every 2s`);
+    const profiles = selectedRow?.browserProfiles ?? [];
+    const sites = (rows) => [...new Set(rows.flatMap(p => p.sites.map(s => s.site)))].join(', ');
+    const sharedSites = sites(profiles.filter(p => p.scope === 'project'));
+    const ownSites = sites(profiles.filter(p => p.scope !== 'project'));
+    const browserContext = [sharedSites && `project · ${sharedSites}`, ownSites && `conversation · ${ownSites}`].filter(Boolean).join('  |  ');
+    const detail = selectedRow && !selectedRow.start ? `${selectedRow.agent?.app === 'codex' ? 'Codex' : 'Claude'} · ${selectedRow.badge}${selectedRow.agent?.last_message ? ` · ${selectedRow.agent.last_message}` : ''}` : '';
+    lines.push(view.message || (selectedRow?.setup && setupLine(selectedRow.project, selectedRow.setup)) || detail);
+    lines.push(browserContext ? `  Browser sign-ins: ${browserContext}` : '');
+    lines.push(view.doneCount ? `  ${view.doneCount} done  ·  D ${view.showDone ? 'hide' : 'show'}` : '');
+    lines.push(view.prompt ? '  Enter continue   Esc cancel' : '  Enter open   n new   / search   ? actions   q quit');
+    lines.push(view.menubarHint ?? '');
     if (view.menu) {
-        const menu = [view.menu.title, ...view.menu.items.map((item, i) => `${i === view.menu.selected ? '>' : ' '} ${item}`), 'Enter select  Esc cancel'];
-        const offset = Math.min(3, Math.max(0, height - menu.length));
+        const menu = [`  ${view.menu.title}`, '', ...view.menu.items.map((item, i) => `${i === view.menu.selected ? '›' : ' '} ${item}`), '', '  Enter select   Esc back'];
+        const offset = Math.min(2, Math.max(0, height - menu.length));
         for (let i = 0; i < menu.length && offset + i < height; i++)
-            lines[offset + i] = menu[i];
+            lines[offset + i] = clip(menu[i], columns);
+        for (let i = offset + menu.length; i < height - 1; i++)
+            lines[i] = '';
     }
     return lines.slice(0, height).map(line => line.includes('\x1b') ? line : clip(line, columns));
 }

package/dist/command-center.js

@@ -12,6 +12,7 @@ import { ensureMenubar } from "./menubar.js";
 import { MenubarManager } from "./menubar.js";
 import { homedir } from 'node:os';
 import { retrySetupStep } from "./assisted-setup.js";
+import { localConversations } from "./conversations.js";
 export async function showCenter(ctx, scope, options = {}) {
     const input = ctx.io.stdin;
     if (!input.isTTY || !input.setRawMode || !input.on || !input.off)
@@ -30,6 +31,7 @@ export async function showCenter(ctx, scope, options = {}) {
     let timer, escapeTimer;
     let refreshing;
     let edit;
+    let showDone = false, draftPrompt = '';
     let menuActions = [];
     let finish;
     const done = new Promise(resolve => { finish = resolve; });
@@ -41,7 +43,10 @@ export async function showCenter(ctx, scope, options = {}) {
         ctx.io.stdout.write(renderer.draw(renderCenter(view, size.columns, size.rows, ctx.io.env.NO_COLOR === undefined && ctx.io.env.TERM !== 'dumb')));
     };
     const updateRows = () => {
-        view.rows = centerRows(data, scope, view.filter);
+        const rows = centerRows(data, scope, view.filter);
+        view.doneCount = rows.filter(row => row.badge === 'done').length;
+        view.showDone = showDone;
+        view.rows = showDone || view.filter ? rows : rows.filter(row => row.badge !== 'done');
         if (!view.rows.some(r => r.id === view.selected))
             view.selected = view.rows[0]?.id;
     };
@@ -157,6 +162,43 @@ export async function showCenter(ctx, scope, options = {}) {
             return;
         }
         if (edit) {
+            if ((edit.kind === 'task' || edit.kind === 'project') && key === 'enter') {
+                if (!edit.text.trim()) {
+                    view.message = edit.kind === 'task' ? 'Describe what the agent should do.' : 'Choose a project folder.';
+                    draw();
+                    return;
+                }
+                if (edit.kind === 'task') {
+                    draftPrompt = edit.text;
+                    const row = view.rows.find(r => r.id === view.selected);
+                    const records = Object.values(localConversations(ctx));
+                    const folder = scope?.folder ?? records.find(r => r.conversation.workspace_id === row?.workspace?.id)?.folder ?? records[0]?.folder ?? process.cwd();
+                    edit = { kind: 'project', text: folder };
+                    view.message = '';
+                    view.prompt = `Project folder: ${folder}  (Enter accepts, Esc cancels)`;
+                }
+                else {
+                    let project;
+                    try {
+                        project = projectIdentity(edit.text);
+                    }
+                    catch {
+                        view.message = 'Choose an accessible project folder.';
+                        draw();
+                        return;
+                    }
+                    edit = undefined;
+                    view.prompt = undefined;
+                    view.message = '';
+                    const preferred = options.app ?? new AgentStateStore(ctx.store.dir).app(project.remote ?? project.folder);
+                    menu('Start conversation', [preferred, preferred === 'claude' ? 'codex' : 'claude'].map(app => ({
+                        label: `${app === 'claude' ? 'Claude' : 'Codex'} · ${project.slug}`,
+                        run: () => dispatch('new', { path: project.folder, app, prompt: draftPrompt }, [], true),
+                    })));
+                }
+                draw();
+                return;
+            }
             if (key === 'escape') {
                 if (edit.kind === 'filter') {
                     view.filter = edit.previous ?? '';
@@ -164,6 +206,7 @@ export async function showCenter(ctx, scope, options = {}) {
                 }
                 edit = undefined;
                 view.prompt = undefined;
+                view.message = '';
             }
             else if (key === 'enter') {
                 const current = edit;
@@ -193,14 +236,14 @@ export async function showCenter(ctx, scope, options = {}) {
             }
             else if (key === 'backspace')
                 edit.text = [...edit.text].slice(0, -1).join('');
-            else if ([...key].length === 1 && key >= ' ' && edit.text.length < (edit.kind === 'filter' ? 256 : 64))
+            else if ([...key].length === 1 && key >= ' ' && edit.text.length < (edit.kind === 'task' ? 4096 : edit.kind === 'project' ? 2048 : edit.kind === 'filter' ? 256 : 64))
                 edit.text += key;
             if (edit) {
                 if (edit.kind === 'filter') {
                     view.filter = edit.text;
                     updateRows();
                 }
-                view.prompt = `${edit.kind === 'filter' ? 'Filter' : 'New agent name'}: ${edit.text}  (Enter accepts, Esc cancels)`;
+                view.prompt = `${edit.kind === 'filter' ? 'Search' : edit.kind === 'task' ? 'What should the agent do?' : edit.kind === 'project' ? 'Project folder' : 'New agent name'}: ${edit.text}  (Enter accepts, Esc cancels)`;
             }
             draw();
             return;
@@ -230,10 +273,28 @@ export async function showCenter(ctx, scope, options = {}) {
         }
         if (key === '/') {
             edit = { kind: 'filter', text: view.filter, previous: view.filter };
-            view.prompt = `Filter: ${view.filter}`;
+            view.prompt = `Search: ${view.filter}`;
             draw();
             return;
         }
+        if (key === 'D') {
+            showDone = !showDone;
+            updateRows();
+            draw();
+            return;
+        }
+        if (key === 'n' || key === 'enter' && view.rows.find(r => r.id === view.selected)?.start) {
+            edit = { kind: 'task', text: '' };
+            view.message = '';
+            view.prompt = 'What should the agent do? ';
+            draw();
+            return;
+        }
+        if (key === '?') {
+            const choices = [['n', 'New conversation'], ['o', 'Open in…'], ['N', 'New agent workspace'], ['f', 'Fork workspace'], ['p', 'Park'], ['l', 'View logs'], ...(view.rows.find(row => row.id === view.selected)?.setup ? [['r', 'Retry setup']] : []), ...extra, ['D', showDone ? 'Hide done conversations' : 'Show done conversations']];
+            menu('Conversation actions', choices.map(([key, label]) => ({ label: `${key}  ${label}`, run: () => handle(key) })));
+            return;
+        }
         const row = view.rows.find(r => r.id === view.selected);
         if (!row)
             return;
@@ -257,10 +318,6 @@ export async function showCenter(ctx, scope, options = {}) {
         }
         const project = scope ? scope.remote ?? scope.folder : row.workspace?.labels.repo_remote || row.project;
         const app = row.agent?.app || options.app || new AgentStateStore(ctx.store.dir).app(project, row.workspace?.labels.app === 'codex' ? 'codex' : 'claude');
-        if (row.start && ['enter', 'n', 'N'].includes(key)) {
-            menu('Start here', [app, app === 'claude' ? 'codex' : 'claude'].map(app => ({ label: `Start ${app === 'claude' ? 'Claude' : 'Codex'} here`, run: () => dispatch('new', { path: scope.folder, app }, [], true) })));
-            return;
-        }
         if (key === 'enter') {
             const target = new AgentStateStore(ctx.store.dir).target(project, ['terminal', ...installedTargets(ctx.io.env).targets]);
             await dispatch('open', { app, project, in: target }, [row.key], true);
@@ -272,9 +329,6 @@ export async function showCenter(ctx, scope, options = {}) {
                     await dispatch('open', { app, project, in: target }, [row.key], true);
                 } })));
         }
-        else if (key === 'n') {
-            menu('New session', ['claude', 'codex'].map(app => ({ label: `${app === 'claude' ? 'Claude' : 'Codex'} (reattach if running)`, run: () => dispatch('new', { app, project }, [row.key], true) })));
-        }
         else if (key === 'N' || key === 'f') {
             edit = { kind: key === 'N' ? 'new' : 'fork', text: '' };
             view.prompt = 'New agent name: ';

package/dist/conversation-terminal.js

@@ -13,13 +13,22 @@ import { ensureMenubar, MenubarManager } from "./menubar.js";
 import { UsageError } from "./errors.js";
 import { localResumeTerminal } from "./conversation-local-resume.js";
 import { agentReachability } from "./agent-reachability.js";
+import { promptWithImages, readInitialImages, readInitialPrompt, uploadInitialImages } from "./initial-prompt.js";
+import { launchCodexCloud, openCodexConversation } from "./codex-cloud.js";
 /** Every terminal entry point uses the durable conversation's native harness, worktree and session. */
 export async function conversationTerminal(ctx, ws, c, project, values) {
+    if (c.route === 'codex-cloud')
+        return openCodexConversation(ctx, c);
     await restoreConversationBinding(ctx, c, ws);
     return terminal(ctx, ws, c.harness, conversationName(c), project, values, undefined, c.worktree_path, { id: c.id, session: c.harness_session_id });
 }
 /** Select a durable conversation, then use the harness's native terminal for all interaction. */
 export const launchConversationProject = async (ctx, values, [path = './', explicit]) => {
+    const text = await readInitialPrompt(ctx, values);
+    // Images are read and validated before allocation, held in memory, and written only into the new VM.
+    const images = await readInitialImages(ctx, values, text);
+    const initialPrompt = text === undefined ? undefined : promptWithImages(text, images);
+    values = { ...values, ...(initialPrompt === undefined ? {} : { initialPrompt }) };
     const project = projectIdentity(path), store = new AgentStateStore(ctx.store.dir);
     const app = explicit === 'claude' || explicit === 'codex' ? explicit : store.app(project.remote ?? project.folder);
     if (explicit && explicit !== app)
@@ -39,9 +48,13 @@ export const launchConversationProject = async (ctx, values, [path = './', expli
             return localResumeTerminal(ctx, c, project.folder);
         const next = await resumeConversation(ctx, c);
         rememberConversation(ctx, next, project.folder);
+        if (next.route === 'codex-cloud')
+            return openCodexConversation(ctx, next);
         const ws = await conversationWorkspace(ctx, next);
         return conversationTerminal(ctx, ws, next, project.remote ?? project.folder, values);
     }
+    if (app === 'codex')
+        return launchCodexCloud(ctx, values, path, images);
     await syncAgentCredentials(ctx.cloud(), { home: ctx.io.env.HOME, redact: value => ctx.addSecret(value) });
     const signedIn = app === 'claude' ? await cloudClaudeLogin(ctx) : true;
     if (!signedIn)
@@ -59,7 +72,10 @@ export const launchConversationProject = async (ctx, values, [path = './', expli
         const ws = await ctx.cloud().workspaces.open({ ...agentReachability(values), key: `${project.slug}/${name}`, template: prepared.template,
             labels: { ...projectLabels(project, name, app), ...prepared.labels, repo_path: projectWorkspacePath(project) },
             wait: { timeoutMs: ctx.wakeTimeoutMs, signal: ctx.signal } });
+        if (values.computer === true)
+            await ws.setComputerUse(true);
         await seedAgentRepository(ctx, ws, project.folder, { populate: true });
+        await uploadInitialImages(ws.cell(), images, ctx.signal);
         if (!signedIn)
             await loginClaudeInWorkspace(ctx, ws);
         if (!(await savedMachine(ctx))?.template)
@@ -67,6 +83,9 @@ export const launchConversationProject = async (ctx, values, [path = './', expli
         return terminal(ctx, ws, app, name, project.remote ?? project.folder, values, prepared.setupHash);
     }
     const { conversation: c, workspace: ws } = created;
+    if (values.computer === true)
+        await ws.setComputerUse(true);
+    await uploadInitialImages(ws.cell(), images, ctx.signal);
     if (values.reachable !== undefined)
         await ctx.cloud().workspaces.open({ key: ws.key, ...agentReachability(values), wait: false });
     if (!signedIn)

package/dist/conversations.d.ts

@@ -9,7 +9,7 @@ export interface Conversation {
     summary: string;
     harness: Harness;
     harness_session_id: string | null;
-    route: 'terminal' | 'acp' | 'codex-app' | 'claude-desktop' | 't3-ssh';
+    route: 'terminal' | 'acp' | 'codex-app' | 'codex-cloud' | 'claude-desktop' | 't3-ssh';
     workspace_id: string;
     worktree_path: string;
     branch: string;

package/dist/conversations.js

@@ -104,14 +104,27 @@ export async function createConversationRecord(ctx, folder, harness, route, name
 export async function createConversation(ctx, folder, harness, route, name) {
     const project = projectIdentity(folder);
     const c = await createConversationRecord(ctx, project.folder, harness, route, name);
-    const ws = await conversationWorkspace(ctx, c);
-    // This is a one-time seed. A conversation never watches or writes the owner's checkout.
-    await seedAgentRepository(ctx, ws, project.folder, { root: c.worktree_path, populate: true });
-    const cell = ws.cell();
-    const result = await cell.exec.run(['git', '-C', c.worktree_path, 'checkout', '-B', c.branch, c.base_commit], { timeoutMs: 30_000, signal: ctx.signal });
-    if (result.exitCode !== 0)
-        throw new Error(`Conversation branch could not be prepared: ${result.stderr.trim()}`);
-    return { conversation: c, workspace: ws };
+    try {
+        const ws = await conversationWorkspace(ctx, c);
+        // This is a one-time seed. A conversation never watches or writes the owner's checkout.
+        await seedAgentRepository(ctx, ws, project.folder, { root: c.worktree_path, populate: true });
+        const cell = ws.cell();
+        const result = await cell.exec.run(['git', '-C', c.worktree_path, 'checkout', '-B', c.branch, c.base_commit], { timeoutMs: 30_000, signal: ctx.signal });
+        if (result.exitCode !== 0)
+            throw new Error(`Conversation branch could not be prepared: ${result.stderr.trim()}`);
+        return { conversation: c, workspace: ws };
+    }
+    catch (error) {
+        if (route === 'codex-cloud') {
+            try {
+                await ctx.cloud().workspaces.delete(c.workspace_id);
+            }
+            catch (cleanup) {
+                throw new AggregateError([error, cleanup], `Cloud setup failed; remove owned workspace ${c.workspace_id} before retrying.`, { cause: cleanup });
+            }
+        }
+        throw error;
+    }
 }
 export async function resumeConversation(ctx, c) {
     if (c.state !== 'done' && c.state !== 'archived')

package/dist/credential-prompts.d.ts

@@ -5,6 +5,8 @@ type Selection = {
     vault: Vault;
     item: string;
     always: boolean;
+    scope?: 'ask' | 'project' | 'machine';
+    remember?: boolean;
     fields: CredentialRequest['fields'];
 };
 export declare class SiteVaultStore {
@@ -12,8 +14,8 @@ export declare class SiteVaultStore {
     constructor(directory: string);
     key(api: string, project: string, site: string): string;
     read(): Record<string, Selection>;
-    get(api: string, project: string, site: string): Selection | undefined;
-    save(api: string, project: string, site: string, selection: Selection): void;
+    get(api: string, project: string, site: string, profile?: string): Selection | undefined;
+    save(api: string, project: string, site: string, selection: Selection, profile?: string): void;
 }
 export declare function approveCredential(ctx: Ctx, request: CredentialRequest, selection: Selection, remember?: boolean): Promise<void>;
 export declare function configureCredentialFill(ctx: Ctx, ws: Workspace): Promise<boolean>;

package/dist/credential-prompts.js

@@ -21,12 +21,20 @@ export class SiteVaultStore {
             throw new UsageError('Could not read site vault choices.');
         return raw;
     }
-    get(api, project, site) {
-        return this.read()[this.key(api, project, site)];
+    get(api, project, site, profile) {
+        const all = this.read();
+        return all[this.key(api, project, site)] ?? (profile ? all[this.key(api, `machine:${profile}`, site)] : undefined);
     }
-    save(api, project, site, selection) {
+    save(api, project, site, selection, profile) {
         const all = this.read();
-        all[this.key(api, project, site)] = selection;
+        if (selection.scope === 'machine') {
+            if (!profile)
+                throw new UsageError('Sign in or save a project profile before choosing machine scope.');
+            delete all[this.key(api, project, site)];
+            all[this.key(api, `machine:${profile}`, site)] = selection;
+        }
+        else
+            all[this.key(api, project, site)] = selection;
         mkdirSync(join(this.file, '..'), { recursive: true, mode: 0o700 });
         const temp = `${this.file}.${process.pid}.tmp`;
         writeFileSync(temp, JSON.stringify(all), { mode: 0o600, flag: 'wx' });
@@ -34,9 +42,20 @@ export class SiteVaultStore {
         chmodSync(this.file, 0o600);
     }
 }
+function vaultProfile(ctx) {
+    const profile = ctx.store.profile(ctx.apiUrl);
+    return profile.organization_id ? `org:${profile.organization_id}${profile.session?.user?.id ? `|user:${profile.session.user.id}` : ""}` : profile.session?.user?.id ? `user:${profile.session.user.id}` : profile.api_key?.key_id ? `key:${profile.api_key.key_id}` : undefined;
+}
+function approvalScope(value) {
+    if (value !== undefined && !['ask', 'project', 'machine'].includes(value))
+        throw new UsageError('--scope must be ask, project or machine');
+    return value;
+}
 export async function approveCredential(ctx, request, selection, remember = false) {
     if (request.state !== 'pending' || Date.parse(request.expires_at) <= Date.now())
         throw new UsageError(`Credential request ${request.id} has expired or ended. ${VAULT_SECURITY_NOTE}`);
+    if (selection.scope === 'machine' && !vaultProfile(ctx))
+        throw new UsageError('Sign in or save a project profile before choosing machine scope.');
     const credential = await vaultCredential(selection.vault, selection.item, request.site, { signal: ctx.signal });
     for (const value of Object.values(credential))
         if (typeof value === 'string' && value)
@@ -50,8 +69,8 @@ export async function approveCredential(ctx, request, selection, remember = fals
     if (answered.state !== 'fulfilled')
         throw new UsageError(`Credential request is ${answered.state}. ${VAULT_SECURITY_NOTE}`);
     if (remember)
-        await ctx.cloud().credentialRequests.remember(request.workspace_id, request.site, credential);
-    new SiteVaultStore(ctx.store.dir).save(ctx.apiUrl, request.project_id, request.site, selection);
+        await ctx.cloud().credentialRequests.remember(request.workspace_id, request.site, subset, selection.scope ? { scope: selection.scope === 'ask' ? 'conversation' : selection.scope } : {});
+    new SiteVaultStore(ctx.store.dir).save(ctx.apiUrl, request.project_id, request.site, { ...selection, always: selection.scope ? selection.scope !== 'ask' : selection.always, remember }, vaultProfile(ctx));
     ctx.io.stderr.write(`Approved ${request.site}. ${remember ? REMEMBERED_SECURITY_NOTE : VAULT_SECURITY_NOTE}\n`);
 }
 export async function configureCredentialFill(ctx, ws) {
@@ -88,23 +107,23 @@ export async function watchCredentialPrompts(ctx, ws, ask, signal) {
                 continue;
             seen.add(r.id);
             try {
-                const saved = store.get(ctx.apiUrl, r.project_id, r.site);
-                if (saved?.always && r.fields.every((f) => saved.fields.includes(f))) {
-                    await approveCredential(ctx, r, saved);
+                const saved = store.get(ctx.apiUrl, r.project_id, r.site, vaultProfile(ctx));
+                if (saved && (saved.scope ? saved.scope !== 'ask' : saved.always) && r.fields.every((f) => saved.fields.includes(f))) {
+                    await approveCredential(ctx, r, saved, saved.remember);
                     continue;
                 }
-                const choice = (await ask(`${r.site} requests ${r.fields.join(', ')}. Allow once / Always for this project / Deny [once/always/deny]. ${VAULT_SECURITY_NOTE}\n`)).toLowerCase();
+                const choice = (await ask(`${r.site} requests ${r.fields.join(', ')}. Ask every time / Allow for this project / Allow on my machine / Deny [once/project/machine/deny]. ${VAULT_SECURITY_NOTE}\n`)).toLowerCase();
                 if (choice === 'deny') {
                     await ctx.cloud().credentialRequests.deny(r.id);
                     ctx.io.stderr.write(`Denied ${r.site}. ${VAULT_SECURITY_NOTE}\n`);
                     continue;
                 }
-                if (choice !== 'once' && choice !== 'always')
-                    throw new UsageError(`Choose once, always or deny. ${VAULT_SECURITY_NOTE}`);
+                if (!['once', 'always', 'project', 'machine'].includes(choice))
+                    throw new UsageError(`Choose once, project, machine or deny. ${VAULT_SECURITY_NOTE}`);
                 const vault = vaultType(saved?.vault ?? (await ask(`Choose hsec, 1password, bitwarden or keychain. ${VAULT_SECURITY_NOTE}\n`)));
                 const item = saved?.item ?? (await ask(`Vault item name for ${r.site}. ${VAULT_SECURITY_NOTE}\n`));
                 const remember = (await ask(`Remember for unattended use? [yes/no]. ${REMEMBERED_SECURITY_NOTE}\n`)).toLowerCase() === 'yes';
-                await approveCredential(ctx, r, { vault, item, always: choice === 'always', fields: r.fields }, remember);
+                await approveCredential(ctx, r, { vault, item, always: choice !== 'once', scope: choice === 'once' ? 'ask' : choice === 'machine' ? 'machine' : 'project', fields: r.fields }, remember);
             }
             catch (e) {
                 if (signal.aborted)
@@ -162,7 +181,7 @@ export const CREDENTIAL_HANDLERS = {
         const item = str(values.item);
         if (!item)
             throw new UsageError('--item names a vault login');
-        await approveCredential(ctx, request, { vault, item, always: values.always === true, fields: request.fields }, values.remember === true);
+        await approveCredential(ctx, request, { vault, item, always: values.always === true || ['project', 'machine'].includes(str(values.scope) ?? ''), scope: approvalScope(str(values.scope)), fields: request.fields }, values.remember === true);
         if (ctx.json)
             ctx.io.stdout.write(JSON.stringify({
                 approved: true,
@@ -178,9 +197,12 @@ export const CREDENTIAL_HANDLERS = {
             : `Credential request ${r.state}. ${VAULT_SECURITY_NOTE}\n`);
         return 0;
     },
-    async 'credentials forget'(ctx, _values, [ref, site]) {
+    async 'credentials forget'(ctx, values, [ref, site]) {
         const ws = await resolveWorkspace(ctx, ref);
-        await ctx.cloud().credentialRequests.forget(ws.id, site);
+        const scope = str(values.scope);
+        if (scope && !['conversation', 'project', 'machine'].includes(scope))
+            throw new UsageError('--scope must be conversation, project or machine');
+        await ctx.cloud().credentialRequests.forget(ws.id, site, { scope: scope });
         ctx.io.stdout.write(ctx.json
             ? JSON.stringify({
                 forgotten: true,

package/dist/device-bridge.d.ts

@@ -31,6 +31,14 @@ export interface DeviceApproval {
     conversation_id: string;
     summary: string;
     outside: boolean;
+    kind?: DeviceRequest['kind'];
+    argv?: string[];
+    local_path?: string;
+    remote_path?: string;
+    project_name?: string;
+    conversation_title?: string;
+    local_port?: number;
+    remote_port?: number;
 }
 type Result = {
     state: 'approved' | 'denied' | 'running' | 'done' | 'failed';
@@ -56,6 +64,11 @@ export declare class DeviceGrants {
     save(api: string, project: string, root: string, kind: string): Promise<void>;
 }
 export declare function deviceSummary(r: DeviceRequest): string;
+/** Structured local approval details; the summary remains for older menu bar and ACP clients. */
+export declare function deviceApproval(r: DeviceRequest, c: Conversation, target: {
+    path: string;
+    outside: boolean;
+}, folder: string): DeviceApproval;
 export declare function tryLocallyAction(r: DeviceRequest): 'start' | 'stop' | null;
 export declare function ensureConversationWorktree(ctx: Ctx, c: Conversation, folder: string, ws?: Workspace): Promise<string>;
 export declare function deviceExec(argv: string[], cwd: string, timeoutSeconds?: number, signal?: AbortSignal): Promise<Result>;

package/dist/device-bridge.js

@@ -3,7 +3,7 @@ import { spawn } from 'node:child_process';
 import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, rmSync, statSync } from 'node:fs';
 import { readFile, writeFile, mkdir, realpath, stat } from 'node:fs/promises';
 import { createConnection, createServer } from 'node:net';
-import { dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
 import { WorkspaceTunnels } from '@shardflux/sdk';
 import { writePrivateFile } from "./credentials.js";
 import { conversationName, conversationWorkspace, getConversation, localConversations } from "./conversations.js";
@@ -73,8 +73,18 @@ export function deviceSummary(r) {
     if (r.kind === 'exec')
         return `Run on your Mac: ${JSON.stringify(r.exec?.argv)} · directory ${r.exec?.cwd_relative ?? '.'}`;
     if (r.files)
-        return `${r.kind === 'files_pull' ? 'Send to VM' : 'Save on your Mac'}: ${r.files.local_path_relative} ↔ ${r.files.remote_path}`;
-    return `${r.kind === 'port_forward' ? 'Open VM port on your Mac' : 'Reach your Mac from VM'}: ${r.port?.remote_port} ↔ localhost:${r.port?.local_port}`;
+        return `${r.kind === 'files_pull' ? 'Share with conversation' : 'Save on your Mac'}: ${r.files.local_path_relative} ↔ ${r.files.remote_path}`;
+    return `${r.kind === 'port_forward' ? 'Open conversation preview on your Mac' : 'Connect conversation to your Mac'}: ${r.port?.remote_port} ↔ localhost:${r.port?.local_port}`;
+}
+/** Structured local approval details; the summary remains for older menu bar and ACP clients. */
+export function deviceApproval(r, c, target, folder) {
+    return {
+        type: 'approval', request_id: r.id, project_id: r.project_id, conversation_id: c.id,
+        summary: deviceSummary(r), outside: target.outside, kind: r.kind, local_path: target.path,
+        project_name: basename(folder), conversation_title: c.title || conversationName(c),
+        ...(r.exec ? { argv: r.exec.argv } : {}), ...(r.files ? { remote_path: r.files.remote_path } : {}),
+        ...(r.port ? { local_port: r.port.local_port, remote_port: r.port.remote_port } : {}),
+    };
 }
 export function tryLocallyAction(r) {
     if (r.kind === 'try_locally')
@@ -172,7 +182,7 @@ export class DeviceExecutor {
         const requested = r.exec?.cwd_relative ?? r.files?.local_path_relative ?? '.';
         const target = devicePath(planned.path, requested), grants = new DeviceGrants(ctx.store.dir);
         target.outside ||= planned.outside;
-        const choice = grants.allows(ctx.apiUrl, r.project_id, record.folder, r.kind, target.outside) ? 'once' : await this.#ask({ type: 'approval', request_id: r.id, project_id: r.project_id, conversation_id: c.id, summary: deviceSummary(r), outside: target.outside });
+        const choice = grants.allows(ctx.apiUrl, r.project_id, record.folder, r.kind, target.outside) ? 'once' : await this.#ask(deviceApproval(r, c, target, record.folder));
         if (choice === 'deny') {
             await this.result(r, { state: 'denied' });
             return;

package/dist/device-helper.js

@@ -46,7 +46,8 @@ export async function runDeviceHelper(ctx) {
             ctx.io.stdout.write(JSON.stringify(approval) + '\n');
             if (signal.aborted)
                 denied();
-        });
+        }).finally(() => { if (!signal.aborted)
+            ctx.io.stdout.write(JSON.stringify({ type: 'approval_resolved', request_id: approval.request_id }) + '\n'); });
     };
     const working = new Map();
     const mirrored = new ConversationMirrorState();

package/dist/errors.d.ts

@@ -45,6 +45,15 @@ export declare class CodedError extends HintedError {
     readonly details: Record<string, unknown> | undefined;
     constructor(code: string, message: string, hint?: string, details?: Record<string, unknown>);
 }
+/**
+ * A command that can create an account ran without the agreement to the Terms of Service (0.15.0+): no
+ * --accept-terms / SHARDFLUX_ACCEPT_TERMS=1 and no terminal to ask on, or the person answered no. Nothing was sent.
+ * Code `terms_not_accepted`, exit 2 (usage); `details` has both links and the flag.
+ */
+export declare class TermsNotAcceptedError extends CodedError {
+    name: string;
+    constructor(declined?: boolean);
+}
 /** No usable credential: SHARDFLUX_API_KEY / the saved key, or the session, missing or malformed (never carries it). */
 export declare class AuthConfigError extends HintedError {
     name: string;