skydive-cli 0.1.0-beta.276 → 0.1.0-beta.287

package/dist/js/bin.mjs

@@ -8,15 +8,15 @@ import Conf from "conf";
 import { err, ok } from "neverthrow";
 import { z } from "zod";
 import open from "open";
+import { createParser } from "eventsource-parser";
 import { spawnSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import fs from "node:fs";
 import zlib from "node:zlib";
-import { createParser } from "eventsource-parser";
 import os from "node:os";
 
 //#region package.json
-var version$1 = "0.1.0-beta.276";
+var version$1 = "0.1.0-beta.287";
 
 //#endregion
 //#region src/types.ts
@@ -78,25 +78,32 @@ function resolveConfig(opts) {
 }
 /**
 * Resolve the bearer credential for the management API (`agents` / `keys` /
-* `secrets`). Prefers an API key (`SKYDIVE_API_KEY` env, then stored), and
-* falls back to the `--web` chat session token: the server's `/v1` gate routes
-* any non-`sky_` bearer through the signed-in session, so a device login alone
-* is enough to run management commands — no separate API key required.
+* `secrets`). The server's `/v1` gate accepts either an API key or the `--web`
+* session bearer, so both work — but only one of them tracks the active
+* workspace.
+*
+* An API key is pinned server-side to the organization that minted it and
+* ignores the workspace header by design, so it can never follow `skydive
+* workspace switch`. A key is also a strictly narrower credential than its
+* owner's session. So the session wins whenever there is one, and a key is
+* what's left for machines that never ran an interactive login.
+*
+* `SKYDIVE_SESSION_TOKEN=` (empty) suppresses session auth for one
+* invocation, to drive a specific organization's key while signed in.
 */
 function resolveManagementAuth(opts) {
-	const apiUrl = process.env["SKYDIVE_API_URL"] ?? opts.apiUrl ?? store.get("apiUrl") ?? DEFAULT_API_URL;
+	const session = resolveSession({ appUrl: opts.apiUrl });
+	if (session.isOk()) return ok({
+		token: session.value.sessionToken,
+		apiUrl: session.value.appUrl,
+		kind: "session"
+	});
 	const apiKey = process.env["SKYDIVE_API_KEY"] ?? store.get("apiKey");
 	if (apiKey) return ok({
 		token: apiKey,
-		apiUrl,
+		apiUrl: process.env["SKYDIVE_API_URL"] ?? opts.apiUrl ?? store.get("apiUrl") ?? DEFAULT_API_URL,
 		kind: "api-key"
 	});
-	const sessionToken = process.env["SKYDIVE_SESSION_TOKEN"] ?? store.get("sessionToken");
-	if (sessionToken) return ok({
-		token: sessionToken,
-		apiUrl,
-		kind: "session"
-	});
 	return err({ message: "Not authenticated. Run `skydive auth login` (API key) or `skydive auth login --web`." });
 }
 function saveConfig(config) {
@@ -154,6 +161,8 @@ function saveTheme(mode, themeId) {
 //#endregion
 //#region src/api-client.ts
 const USER_AGENT = `skydive-cli/${version$1}`;
+/** Largest page `/v1/agents` will return, enforced server-side. */
+const MAX_AGENT_PAGE = 100;
 const AgentSchema = z.object({
 	id: z.string(),
 	name: z.string(),
@@ -182,20 +191,38 @@ const SetSecretResponseSchema = z.object({ key: z.string() });
 var SkydiveApiClient = class {
 	baseUrl;
 	token;
+	authKind;
 	constructor(config) {
 		this.baseUrl = `${config.apiUrl.replace(/\/$/, "")}/v1`;
 		this.token = config.token;
-	}
+		this.authKind = config.kind;
+	}
+	/**
+	* List agents in the caller's workspace, following the server's cursor
+	* until `limit` is satisfied. The endpoint caps one page at
+	* {@link MAX_AGENT_PAGE}, so a larger limit takes several requests —
+	* callers just ask for what they want. `hasMore` reports whether the
+	* roster continues past what was returned.
+	*/
 	async listAgents(params) {
-		const query = new URLSearchParams();
-		if (params.scope) query.set("scope", params.scope);
-		if (params.limit) query.set("limit", String(params.limit));
-		if (params.cursor) query.set("cursor", params.cursor);
-		const qs = query.toString();
-		return this.request({
-			method: "GET",
-			path: `/agents${qs ? `?${qs}` : ""}`,
-			schema: ListAgentsResponseSchema
+		const agents = [];
+		let cursor = null;
+		do {
+			const query = new URLSearchParams({ limit: String(Math.min(MAX_AGENT_PAGE, params.limit - agents.length)) });
+			if (params.scope) query.set("scope", params.scope);
+			if (cursor) query.set("cursor", cursor);
+			const page = await this.request({
+				method: "GET",
+				path: `/agents?${query.toString()}`,
+				schema: ListAgentsResponseSchema
+			});
+			if (page.isErr()) return err(page.error);
+			agents.push(...page.value.agents);
+			cursor = page.value.nextCursor;
+		} while (cursor && agents.length < params.limit);
+		return ok({
+			agents,
+			hasMore: cursor !== null
 		});
 	}
 	async getAgent(id) {
@@ -282,6 +309,7 @@ var SkydiveApiClient = class {
 				if (body.error && typeof body.error === "string") message = body.error;
 				else if (body.error?.message) message = body.error.message;
 			} catch {}
+			if (response.status === 401 && this.authKind === "session") message = `${message} — your chat session may have expired. Run \`skydive auth login --web\`.`;
 			return err({
 				message,
 				status: response.status
@@ -675,8 +703,12 @@ const loginCommand = {
 		const apiUrl = argv["api-url"] ?? DEFAULT_API_URL;
 		const result = await new SkydiveApiClient({
 			token: apiKey,
-			apiUrl
-		}).listAgents({ limit: 1 });
+			apiUrl,
+			kind: "api-key"
+		}).listAgents({
+			limit: 1,
+			scope: null
+		});
 		if (result.isErr()) {
 			printError(`Invalid API key or unreachable server: ${result.error.message}`);
 			process.exit(1);
@@ -734,6 +766,7 @@ const statusCommand$1 = {
 	handler: async (argv) => {
 		const apiKey = resolveConfig({ apiUrl: argv["api-url"] });
 		const session = resolveSession({});
+		const management = resolveManagementAuth({ apiUrl: argv["api-url"] });
 		const identity = session.isOk() ? (await getSessionIdentity({
 			appUrl: session.value.appUrl,
 			sessionToken: session.value.sessionToken
@@ -751,6 +784,7 @@ const statusCommand$1 = {
 					workspaceId: identity?.activeWorkspaceId ?? null,
 					workspaceName: identity?.activeWorkspaceName ?? null
 				},
+				managementAuth: management.isOk() ? management.value.kind : null,
 				configPath: getConfigPath()
 			});
 			return;
@@ -777,6 +811,10 @@ const statusCommand$1 = {
 				console.log(`  Space:  ${ws}`);
 			}
 		} else console.log("Chat session: not signed in.");
+		if (management.isOk()) {
+			const via = management.value.kind === "session" ? "chat session (follows `workspace switch`)" : "API key (pinned to the workspace that minted it)";
+			console.log(`Management commands use: ${via}`);
+		}
 		console.log(`Config: ${getConfigPath()}`);
 	}
 };
@@ -788,232 +826,656 @@ const authCommand = {
 };
 
 //#endregion
-//#region src/commands/agents.ts
-function requireClient$2(argv) {
-	const result = resolveManagementAuth({ apiUrl: argv["api-url"] });
-	if (result.isErr()) {
-		printError(result.error.message);
-		process.exit(1);
-	}
-	return new SkydiveApiClient(result.value);
-}
-const listCommand$4 = {
-	command: "list",
-	describe: "List agents",
-	builder: (y) => y.option("limit", {
-		type: "number",
-		default: 20,
-		describe: "Max results"
-	}).option("scope", {
-		type: "string",
-		choices: ["mine", "org"],
-		describe: "Filter scope"
-	}),
-	handler: async (argv) => {
-		const result = await requireClient$2(argv).listAgents({
-			limit: argv.limit,
-			scope: argv.scope
-		});
-		if (result.isErr()) {
-			printError(result.error.message);
-			process.exit(1);
-		}
-		const { agents } = result.value;
-		if (argv.json) {
-			output(argv, agents);
-			return;
-		}
-		if (agents.length === 0) {
-			console.log("No agents found.");
-			return;
-		}
-		const { headers, rows } = buildAgentTable(agents);
-		printTable(headers, rows);
+//#region src/chat/api/rest.ts
+var HttpError = class extends Error {
+	constructor(status, body) {
+		super(`HTTP ${status}: ${body.slice(0, 200)}`);
+		this.status = status;
+		this.body = body;
+		this.name = "HttpError";
 	}
 };
-const DESCRIPTION_MAX = 48;
-/**
-* Build the `agents list` table. A Description column is added only when at
-* least one agent actually has a description, so an all-empty column doesn't
-* add noise for accounts that never set them. Descriptions can be long, so
-* they are truncated to keep one verbose agent from blowing out the width.
-*/
-function buildAgentTable(agents) {
-	if (agents.some((a) => (a.description ?? "").trim().length > 0)) return {
-		headers: [
-			"Name",
-			"Description",
-			"URL",
-			"Model"
-		],
-		rows: agents.map((a) => [
-			a.name,
-			truncate(a.description ?? "", DESCRIPTION_MAX),
-			a.url ?? "-",
-			a.model ?? "default"
-		])
-	};
-	return {
-		headers: [
-			"Name",
-			"URL",
-			"Model"
-		],
-		rows: agents.map((a) => [
-			a.name,
-			a.url ?? "-",
-			a.model ?? "default"
-		])
+const MAX_STREAM_RECONNECTS = 5;
+function createRestClient({ appUrl, sessionToken }) {
+	const baseHeaders = {
+		authorization: `Bearer ${sessionToken}`,
+		accept: "application/json"
 	};
-}
-function truncate(value, max) {
-	const trimmed = value.trim();
-	if (trimmed.length <= max) return trimmed || "-";
-	return `${trimmed.slice(0, max - 1)}\u2026`;
-}
-const getCommand$1 = {
-	command: "get <id>",
-	describe: "Get agent details",
-	builder: (y) => y.positional("id", {
-		type: "string",
-		demandOption: true,
-		describe: "Agent ID"
-	}),
-	handler: async (argv) => {
-		const result = await requireClient$2(argv).getAgent(argv.id);
-		if (result.isErr()) {
-			printError(result.error.message);
-			process.exit(1);
-		}
-		const agent = result.value;
-		if (argv.json) {
-			output(argv, agent);
-			return;
-		}
-		if (argv.quiet) {
-			console.log(agent.id);
-			return;
-		}
-		console.log(`Name:        ${agent.name}`);
-		console.log(`ID:          ${agent.id}`);
-		console.log(`Model:       ${agent.model ?? "default"}`);
-		if (agent.description) console.log(`Description: ${agent.description}`);
-		if (agent.url) console.log(`Endpoint:    ${agent.url}`);
-		console.log(`Git:         ${agent.gitUrl}`);
+	async function get(path, schema) {
+		const res = await fetch(`${appUrl}${path}`, { headers: baseHeaders });
+		if (!res.ok) throw new HttpError(res.status, await res.text().catch(() => ""));
+		return schema.parse(await res.json());
 	}
-};
-const createCommand$1 = {
-	command: "create",
-	describe: "Create a new agent",
-	builder: (y) => y.option("name", {
-		type: "string",
-		demandOption: true,
-		describe: "Agent name"
-	}).option("model", {
-		type: "string",
-		describe: "Model to use"
-	}),
-	handler: async (argv) => {
-		const result = await requireClient$2(argv).createAgent({
-			name: argv.name,
-			model: argv.model
+	async function post(path, body, schema, method = "POST") {
+		const res = await fetch(`${appUrl}${path}`, {
+			method,
+			headers: {
+				...baseHeaders,
+				"content-type": "application/json"
+			},
+			body: JSON.stringify(body)
 		});
-		if (result.isErr()) {
-			printError(result.error.message);
-			process.exit(1);
-		}
-		const agent = result.value;
-		if (argv.json) {
-			output(argv, agent);
-			return;
-		}
-		if (argv.quiet) {
-			console.log(agent.id);
-			return;
-		}
-		console.log(`Agent created.`);
-		console.log(`  Name: ${agent.name}`);
-		console.log(`  ID:   ${agent.id}`);
-		console.log(`  Git:  ${agent.gitUrl}`);
-		if (agent.url) console.log(`  API:  ${agent.url}`);
-	}
-};
-const agentsCommand = {
-	command: "agents",
-	describe: "Manage agents",
-	builder: (y) => y.command(listCommand$4).command(getCommand$1).command(createCommand$1).demandCommand(1, "Specify a subcommand: list, get, create"),
-	handler: () => {}
-};
-
-//#endregion
-//#region src/commands/keys.ts
-function requireClient$1(argv) {
-	const result = resolveManagementAuth({ apiUrl: argv["api-url"] });
-	if (result.isErr()) {
-		printError(result.error.message);
-		process.exit(1);
-	}
-	return new SkydiveApiClient(result.value);
-}
-const listCommand$3 = {
-	command: "list",
-	describe: "List API keys for an agent",
-	handler: async (argv) => {
-		const result = await requireClient$1(argv).listKeys(argv["agent-id"]);
-		if (result.isErr()) {
-			printError(result.error.message);
-			process.exit(1);
-		}
-		const keys = result.value;
-		if (argv.json) {
-			output(argv, keys);
-			return;
-		}
-		if (keys.length === 0) {
-			console.log("No API keys found.");
-			return;
-		}
-		printTable([
-			"Name",
-			"Prefix",
-			"Last Used",
-			"Created"
-		], keys.map((k) => [
-			k.name,
-			k.prefix,
-			k.lastUsedAt ? new Date(k.lastUsedAt).toLocaleDateString() : "Never",
-			new Date(k.createdAt).toLocaleDateString()
-		]));
+		if (!res.ok) throw new HttpError(res.status, await res.text().catch(() => ""));
+		return schema.parse(await res.json());
 	}
-};
-const createCommand = {
-	command: "create <name>",
-	describe: "Create a new API key for an agent",
-	builder: (y) => y.positional("name", {
-		type: "string",
-		demandOption: true,
-		describe: "Key name"
-	}),
-	handler: async (argv) => {
-		const result = await requireClient$1(argv).createKey(argv["agent-id"], argv.name);
-		if (result.isErr()) {
-			printError(result.error.message);
-			process.exit(1);
-		}
-		const key = result.value;
-		if (argv.json) {
-			output(argv, key);
-			return;
-		}
-		if (argv.quiet) {
-			console.log(key.key);
-			return;
-		}
-		console.log(`API key created.`);
-		console.log(`  Name: ${key.name}`);
-		console.log(`  Key:  ${key.key}`);
-		console.log("");
-		console.log("  Save this key — it will not be shown again.");
+	async function del(path) {
+		const res = await fetch(`${appUrl}${path}`, {
+			method: "DELETE",
+			headers: baseHeaders
+		});
+		if (!res.ok) throw new HttpError(res.status, await res.text().catch(() => ""));
+	}
+	const streamEvents = async ({ path, label, signal, onEvent }) => {
+		let lastEventId = null;
+		let finished = false;
+		let reconnects = 0;
+		for (;;) {
+			if (signal.aborted) return;
+			try {
+				const headers = {
+					authorization: `Bearer ${sessionToken}`,
+					accept: "text/event-stream"
+				};
+				if (lastEventId) headers["last-event-id"] = lastEventId;
+				const res = await fetch(`${appUrl}${path}`, {
+					headers,
+					signal
+				});
+				if (!res.ok || !res.body) throw new HttpError(res.status, await res.text().catch(() => ""));
+				reconnects = 0;
+				const parser = createParser({ onEvent: (message) => {
+					if (message.id) lastEventId = message.id;
+					if (message.event === "error") {
+						const { error } = streamErrorSchema.parse(JSON.parse(message.data));
+						throw new Error(error);
+					}
+					const event = runStreamEventSchema.parse(JSON.parse(message.data));
+					if (event.kind === "finished") finished = true;
+					onEvent(event.kind === "finished" ? {
+						...event,
+						error: event.error ?? null
+					} : event);
+				} });
+				const decoder = new TextDecoder();
+				const reader = res.body.getReader();
+				try {
+					for (;;) {
+						const { done, value } = await reader.read();
+						if (done) break;
+						parser.feed(decoder.decode(value, { stream: true }));
+						if (finished) return;
+					}
+				} finally {
+					try {
+						await reader.cancel();
+					} catch (_error) {}
+				}
+			} catch (err) {
+				if (signal.aborted) return;
+				if (err instanceof HttpError && err.status >= 400 && err.status < 500) throw err;
+				reconnects += 1;
+				if (reconnects > MAX_STREAM_RECONNECTS) throw err;
+				await sleep(Math.min(500 * 2 ** reconnects, 5e3));
+				continue;
+			}
+			if (finished) return;
+			reconnects += 1;
+			if (reconnects > MAX_STREAM_RECONNECTS) throw new Error(`${label} stream ended unexpectedly`);
+			await sleep(Math.min(500 * 2 ** reconnects, 5e3));
+		}
+	};
+	return {
+		listAgents: async ({ scope, onPage }) => {
+			const all = [];
+			let cursor;
+			const maxAgents = 2e3;
+			do {
+				const params = new URLSearchParams({
+					limit: "100",
+					scope,
+					sort: "mine_first_usage",
+					includeStats: "false"
+				});
+				if (cursor) params.set("cursor", cursor);
+				const page = await get(`/api/v1/agents?${params.toString()}`, listAgentsResponseSchema);
+				all.push(...page.agents);
+				cursor = page.nextCursor ?? void 0;
+				onPage?.([...all]);
+			} while (cursor && all.length < maxAgents);
+			return all;
+		},
+		createAgent: async ({ name }) => {
+			const { agent } = await post("/api/v1/agents", { name }, createAgentResponseSchema);
+			return agent;
+		},
+		getConversation: async ({ conversationId }) => {
+			const { conversation } = await get(`/api/v1/conversations/${encodeURIComponent(conversationId)}`, getConversationResponseSchema);
+			return conversation;
+		},
+		listModels: async () => {
+			const { models } = await get("/api/v1/models", listModelsResponseSchema);
+			return models;
+		},
+		updateAgentModel: async ({ agentId, model }) => {
+			const { agent } = await post(`/api/v1/agents/${encodeURIComponent(agentId)}`, { model }, updateAgentResponseSchema, "PATCH");
+			return { model: agent.model ?? null };
+		},
+		listConversations: async ({ agentId, limit }) => {
+			const all = [];
+			const maxConversations = limit ?? 5e3;
+			let cursor;
+			do {
+				const remaining = maxConversations - all.length;
+				const params = new URLSearchParams({
+					agentId,
+					includeTotal: "false"
+				});
+				params.set("limit", String(Math.min(remaining, 100)));
+				if (cursor) params.set("cursor", cursor);
+				const page = await get(`/api/v1/conversations?${params.toString()}`, listConversationsResponseSchema);
+				all.push(...page.conversations);
+				cursor = page.nextCursor ?? void 0;
+			} while (cursor && all.length < maxConversations);
+			return limit ? all.slice(0, limit) : all;
+		},
+		listMessages: async ({ conversationId }) => {
+			const { messages } = await get(`/api/v1/conversations/${encodeURIComponent(conversationId)}/messages`, listMessagesResponseSchema);
+			return messages;
+		},
+		getRecap: async ({ conversationId }) => {
+			const { recap } = await get(`/api/v1/conversations/${encodeURIComponent(conversationId)}/recap`, recapResponseSchema);
+			return recap?.text ?? null;
+		},
+		uploadAttachment: async ({ agentId, fileName, mediaType, data }) => {
+			const size = data.byteLength;
+			const presign = await post("/api/v1/attachments/presign", {
+				agentId,
+				fileName,
+				mediaType,
+				size
+			}, presignResponseSchema);
+			const putRes = await fetch(presign.uploadUrl, {
+				method: "PUT",
+				headers: { "content-type": mediaType },
+				body: new Uint8Array(data)
+			});
+			if (!putRes.ok) throw new HttpError(putRes.status, await putRes.text().catch(() => ""));
+			const finalized = await post(`/api/v1/attachments/${encodeURIComponent(presign.id)}/finalize`, {
+				agentId,
+				fileName: presign.fileName,
+				mediaType: presign.mediaType,
+				size
+			}, finalizeResponseSchema);
+			return {
+				id: presign.id,
+				fileName: finalized.fileName,
+				mediaType: finalized.mediaType,
+				sizeBytes: finalized.sizeBytes ?? size
+			};
+		},
+		deleteConversation: async ({ conversationId }) => {
+			await del(`/api/v1/conversations/${encodeURIComponent(conversationId)}`);
+		},
+		sendMessage: async ({ clientSurface, ...input }) => post("/api/v1/chat/send", {
+			...input,
+			clientSurface
+		}, sendResultSchema),
+		activeRun: async ({ conversationId }) => {
+			const { run } = await get(`/api/v1/chat/active-run?${new URLSearchParams({ conversationId }).toString()}`, activeRunResponseSchema);
+			return run;
+		},
+		cancelRun: async ({ runId }) => {
+			await post(`/api/v1/chat/runs/${encodeURIComponent(runId)}/cancel`, {}, z.object({ ok: z.boolean() }));
+		},
+		cancelSteer: async ({ directiveId }) => {
+			await post(`/api/v1/chat/steer/${encodeURIComponent(directiveId)}/cancel`, {}, z.object({ ok: z.boolean() }));
+		},
+		oauthConnect: async (input) => {
+			const { connectLink } = await post("/api/v1/oauth/connect", input, oauthConnectResponseSchema);
+			return { connectLink };
+		},
+		externalOauthConnect: async (input) => {
+			const { authorizationUrl } = await post("/api/v1/external-oauth/connect", input, externalOauthConnectResponseSchema);
+			return { authorizationUrl: authorizationUrl ?? null };
+		},
+		fulfillCredential: async ({ url, body }) => {
+			const target = new URL(url, appUrl).toString();
+			const res = await fetch(target, {
+				method: "POST",
+				headers: {
+					...baseHeaders,
+					"content-type": "application/json"
+				},
+				body: JSON.stringify(body)
+			});
+			if (!res.ok) throw new HttpError(res.status, await res.text().catch(() => ""));
+		},
+		streamRun: async ({ runId, signal, onEvent }) => streamEvents({
+			path: `/api/v1/chat/runs/${encodeURIComponent(runId)}/stream`,
+			label: "run",
+			signal,
+			onEvent
+		}),
+		streamMessage: async ({ messageId, signal, onEvent }) => streamEvents({
+			path: `/api/v1/chat/messages/${encodeURIComponent(messageId)}/stream`,
+			label: "message",
+			signal,
+			onEvent
+		}),
+		streamConversation: async ({ conversationId, signal, onEvent }) => {
+			let reconnects = 0;
+			for (;;) {
+				if (signal.aborted) return;
+				try {
+					const res = await fetch(`${appUrl}/api/v1/chat/conversations/${encodeURIComponent(conversationId)}/stream`, {
+						headers: {
+							authorization: `Bearer ${sessionToken}`,
+							accept: "text/event-stream"
+						},
+						signal
+					});
+					if (!res.ok || !res.body) throw new HttpError(res.status, await res.text().catch(() => ""));
+					reconnects = 0;
+					const parser = createParser({ onEvent: (message) => {
+						const parsed = conversationStreamEventSchema.safeParse(JSON.parse(message.data));
+						if (parsed.success) onEvent(parsed.data);
+					} });
+					const decoder = new TextDecoder();
+					const reader = res.body.getReader();
+					try {
+						for (;;) {
+							const { done, value } = await reader.read();
+							if (done) break;
+							parser.feed(decoder.decode(value, { stream: true }));
+						}
+					} finally {
+						try {
+							await reader.cancel();
+						} catch (_error) {}
+					}
+				} catch (err) {
+					if (signal.aborted) return;
+					if (err instanceof HttpError && err.status >= 400 && err.status < 500) throw err;
+					reconnects += 1;
+					if (reconnects > MAX_STREAM_RECONNECTS) throw err;
+					await sleep(Math.min(500 * 2 ** reconnects, 5e3));
+					continue;
+				}
+				if (signal.aborted) return;
+				reconnects += 1;
+				if (reconnects > MAX_STREAM_RECONNECTS) throw new Error("conversation stream ended unexpectedly");
+				await sleep(Math.min(500 * 2 ** reconnects, 5e3));
+			}
+		}
+	};
+}
+function sleep(ms) {
+	return new Promise((resolve) => setTimeout(resolve, ms));
+}
+const agentSummarySchema = z.object({
+	id: z.string().uuid(),
+	name: z.string(),
+	slug: z.string().nullable().optional(),
+	title: z.string().nullable().optional(),
+	description: z.string().nullable().optional(),
+	createdAt: z.string(),
+	creatorName: z.string().nullable().optional(),
+	model: z.string().nullable().optional(),
+	modelLocked: z.boolean().optional()
+});
+const platformModelSchema = z.object({
+	id: z.string(),
+	displayName: z.string(),
+	providerDisplay: z.string().optional(),
+	reasoning: z.boolean().optional(),
+	compliant: z.boolean().optional()
+}).passthrough();
+const listModelsResponseSchema = z.object({ models: z.array(platformModelSchema) });
+const updateAgentResponseSchema = z.object({ agent: z.object({ model: z.string().nullable().optional() }).passthrough() });
+const listAgentsResponseSchema = z.object({
+	agents: z.array(agentSummarySchema),
+	nextCursor: z.string().nullable().optional(),
+	totalCount: z.number().nullable().optional()
+});
+const createAgentResponseSchema = z.object({ agent: agentSummarySchema });
+const conversationSummarySchema = z.object({
+	id: z.string().uuid(),
+	title: z.string().nullable(),
+	createdAt: z.string(),
+	updatedAt: z.string(),
+	preview: z.string().nullable(),
+	channel: z.string().nullable(),
+	channelLabel: z.string().nullable(),
+	agent: z.object({
+		id: z.string().uuid(),
+		name: z.string(),
+		slug: z.string().nullable().optional(),
+		title: z.string().nullable().optional()
+	})
+});
+const conversationTitleSchema = z.object({
+	id: z.string().uuid(),
+	title: z.string().nullable()
+});
+const getConversationResponseSchema = z.object({ conversation: conversationTitleSchema });
+const listConversationsResponseSchema = z.object({
+	conversations: z.array(conversationSummarySchema),
+	nextCursor: z.string().nullable().optional(),
+	totalCount: z.number().optional()
+});
+const uiMessagePartSchema = z.union([
+	z.object({
+		type: z.literal("text"),
+		text: z.string()
+	}),
+	z.object({
+		type: z.literal("reasoning"),
+		text: z.string().optional()
+	}),
+	z.object({
+		type: z.literal("dynamic-tool"),
+		toolCallId: z.string(),
+		toolName: z.string(),
+		input: z.unknown().optional(),
+		output: z.unknown().optional(),
+		state: z.string().optional(),
+		errorText: z.string().optional()
+	}),
+	z.object({ type: z.string() }).passthrough()
+]);
+const uiMessageSchema = z.object({
+	id: z.string(),
+	role: z.string(),
+	parts: z.array(uiMessagePartSchema)
+});
+const recapResponseSchema = z.object({ recap: z.object({ text: z.string() }).nullable() });
+const listMessagesResponseSchema = z.object({ messages: z.array(uiMessageSchema) });
+const sendResultSchema = z.object({
+	runId: z.string(),
+	messageId: z.string().uuid().nullish(),
+	conversationId: z.string().uuid(),
+	isNewConversation: z.boolean(),
+	steered: z.boolean().optional(),
+	directive: z.object({ id: z.string() }).passthrough().optional()
+});
+const presignResponseSchema = z.object({
+	id: z.string(),
+	uploadUrl: z.string(),
+	fileName: z.string(),
+	mediaType: z.string()
+});
+const finalizeResponseSchema = z.object({
+	fileName: z.string(),
+	mediaType: z.string(),
+	sizeBytes: z.number().nullable().optional()
+});
+const activeRunResponseSchema = z.object({ run: z.object({ runId: z.string() }).nullable() });
+const oauthConnectResponseSchema = z.object({ connectLink: z.string() }).passthrough();
+const externalOauthConnectResponseSchema = z.object({ authorizationUrl: z.string().optional() }).passthrough();
+const runStreamEventSchema = z.union([z.object({
+	kind: z.literal("chunk"),
+	chunk: z.record(z.unknown())
+}), z.object({
+	kind: z.literal("finished"),
+	status: z.string(),
+	error: z.string().nullish()
+})]);
+const streamErrorSchema = z.object({ error: z.string() });
+const conversationStreamEventSchema = z.object({
+	kind: z.literal("conversation"),
+	id: z.string(),
+	title: z.string().nullable()
+});
+
+//#endregion
+//#region src/commands/session.ts
+/**
+* Resolve the signed-in chat session or exit with a friendly hint. Shared by
+* every command that talks to the authenticated REST API so the
+* resolve-or-exit block isn't copy-pasted per command.
+*/
+function requireSession(argv) {
+	const session = resolveSession({ appUrl: resolveAppUrl({ appUrl: argv["api-url"] }) });
+	if (session.isErr()) {
+		printError(`${session.error.message} Run \`skydive auth login --web\` first, or set SKYDIVE_SESSION_TOKEN.`);
+		process.exit(1);
+	}
+	return session.value;
+}
+/**
+* Resolve the management-API credential (see
+* {@link resolveManagementAuth}) or exit with a friendly hint, then build the
+* `/v1` client. Shared by `agents`, `keys` and `secrets`.
+*/
+function requireManagementClient(argv) {
+	const auth = resolveManagementAuth({ apiUrl: argv["api-url"] });
+	if (auth.isErr()) {
+		printError(auth.error.message);
+		process.exit(1);
+	}
+	return new SkydiveApiClient(auth.value);
+}
+/** Resolve the session (see {@link requireSession}) and build a REST client. */
+function requireRestClient(argv) {
+	const session = requireSession(argv);
+	return createRestClient({
+		appUrl: session.appUrl,
+		sessionToken: session.sessionToken
+	});
+}
+
+//#endregion
+//#region src/commands/agents.ts
+const listCommand$4 = {
+	command: "list",
+	describe: "List agents in the active workspace",
+	builder: (y) => y.option("limit", {
+		type: "number",
+		default: 20,
+		describe: "Max results"
+	}).option("scope", {
+		type: "string",
+		choices: ["mine", "org"],
+		describe: "Filter scope"
+	}),
+	handler: async (argv) => {
+		const result = await requireManagementClient(argv).listAgents({
+			limit: argv.limit,
+			scope: argv.scope ?? null
+		});
+		if (result.isErr()) {
+			printError(result.error.message);
+			process.exit(1);
+		}
+		const { agents, hasMore } = result.value;
+		if (argv.json) {
+			output(argv, agents);
+			return;
+		}
+		if (agents.length === 0) {
+			console.log("No agents found.");
+			return;
+		}
+		const { headers, rows } = buildAgentTable(agents);
+		printTable(headers, rows);
+		if (hasMore && !argv.quiet) console.log(`\nShowing the ${agents.length} newest. Raise --limit to see more.`);
+	}
+};
+const DESCRIPTION_MAX = 48;
+/**
+* Build the `agents list` table. A Description column is added only when at
+* least one agent actually has a description, so an all-empty column doesn't
+* add noise for accounts that never set them. Descriptions can be long, so
+* they are truncated to keep one verbose agent from blowing out the width.
+*/
+function buildAgentTable(agents) {
+	if (agents.some((a) => (a.description ?? "").trim().length > 0)) return {
+		headers: [
+			"Name",
+			"Description",
+			"URL",
+			"Model"
+		],
+		rows: agents.map((a) => [
+			a.name,
+			truncate(a.description ?? "", DESCRIPTION_MAX),
+			a.url ?? "-",
+			a.model ?? "default"
+		])
+	};
+	return {
+		headers: [
+			"Name",
+			"URL",
+			"Model"
+		],
+		rows: agents.map((a) => [
+			a.name,
+			a.url ?? "-",
+			a.model ?? "default"
+		])
+	};
+}
+function truncate(value, max) {
+	const trimmed = value.trim();
+	if (trimmed.length <= max) return trimmed || "-";
+	return `${trimmed.slice(0, max - 1)}\u2026`;
+}
+const getCommand$1 = {
+	command: "get <id>",
+	describe: "Get agent details",
+	builder: (y) => y.positional("id", {
+		type: "string",
+		demandOption: true,
+		describe: "Agent ID"
+	}),
+	handler: async (argv) => {
+		const result = await requireManagementClient(argv).getAgent(argv.id);
+		if (result.isErr()) {
+			printError(result.error.message);
+			process.exit(1);
+		}
+		const agent = result.value;
+		if (argv.json) {
+			output(argv, agent);
+			return;
+		}
+		if (argv.quiet) {
+			console.log(agent.id);
+			return;
+		}
+		console.log(`Name:        ${agent.name}`);
+		console.log(`ID:          ${agent.id}`);
+		console.log(`Model:       ${agent.model ?? "default"}`);
+		if (agent.description) console.log(`Description: ${agent.description}`);
+		if (agent.url) console.log(`Endpoint:    ${agent.url}`);
+		console.log(`Git:         ${agent.gitUrl}`);
+	}
+};
+const createCommand$1 = {
+	command: "create",
+	describe: "Create a new agent",
+	builder: (y) => y.option("name", {
+		type: "string",
+		demandOption: true,
+		describe: "Agent name"
+	}).option("model", {
+		type: "string",
+		describe: "Model to use"
+	}),
+	handler: async (argv) => {
+		const result = await requireManagementClient(argv).createAgent({
+			name: argv.name,
+			model: argv.model
+		});
+		if (result.isErr()) {
+			printError(result.error.message);
+			process.exit(1);
+		}
+		const agent = result.value;
+		if (argv.json) {
+			output(argv, agent);
+			return;
+		}
+		if (argv.quiet) {
+			console.log(agent.id);
+			return;
+		}
+		console.log(`Agent created.`);
+		console.log(`  Name: ${agent.name}`);
+		console.log(`  ID:   ${agent.id}`);
+		console.log(`  Git:  ${agent.gitUrl}`);
+		if (agent.url) console.log(`  API:  ${agent.url}`);
+	}
+};
+const agentsCommand = {
+	command: "agents",
+	describe: "Manage agents",
+	builder: (y) => y.command(listCommand$4).command(getCommand$1).command(createCommand$1).demandCommand(1, "Specify a subcommand: list, get, create"),
+	handler: () => {}
+};
+
+//#endregion
+//#region src/commands/keys.ts
+const listCommand$3 = {
+	command: "list",
+	describe: "List API keys for an agent",
+	handler: async (argv) => {
+		const result = await requireManagementClient(argv).listKeys(argv["agent-id"]);
+		if (result.isErr()) {
+			printError(result.error.message);
+			process.exit(1);
+		}
+		const keys = result.value;
+		if (argv.json) {
+			output(argv, keys);
+			return;
+		}
+		if (keys.length === 0) {
+			console.log("No API keys found.");
+			return;
+		}
+		printTable([
+			"Name",
+			"Prefix",
+			"Last Used",
+			"Created"
+		], keys.map((k) => [
+			k.name,
+			k.prefix,
+			k.lastUsedAt ? new Date(k.lastUsedAt).toLocaleDateString() : "Never",
+			new Date(k.createdAt).toLocaleDateString()
+		]));
+	}
+};
+const createCommand = {
+	command: "create <name>",
+	describe: "Create a new API key for an agent",
+	builder: (y) => y.positional("name", {
+		type: "string",
+		demandOption: true,
+		describe: "Key name"
+	}),
+	handler: async (argv) => {
+		const result = await requireManagementClient(argv).createKey(argv["agent-id"], argv.name);
+		if (result.isErr()) {
+			printError(result.error.message);
+			process.exit(1);
+		}
+		const key = result.value;
+		if (argv.json) {
+			output(argv, key);
+			return;
+		}
+		if (argv.quiet) {
+			console.log(key.key);
+			return;
+		}
+		console.log(`API key created.`);
+		console.log(`  Name: ${key.name}`);
+		console.log(`  Key:  ${key.key}`);
+		console.log("");
+		console.log("  Save this key — it will not be shown again.");
 	}
 };
 const revokeCommand$1 = {
@@ -1025,7 +1487,7 @@ const revokeCommand$1 = {
 		describe: "Key ID"
 	}),
 	handler: async (argv) => {
-		const result = await requireClient$1(argv).revokeKey(argv["agent-id"], argv.id);
+		const result = await requireManagementClient(argv).revokeKey(argv["agent-id"], argv.id);
 		if (result.isErr()) {
 			printError(result.error.message);
 			process.exit(1);
@@ -1050,14 +1512,6 @@ const keysCommand = {
 
 //#endregion
 //#region src/commands/secrets.ts
-function requireClient(argv) {
-	const result = resolveManagementAuth({ apiUrl: argv["api-url"] });
-	if (result.isErr()) {
-		printError(result.error.message);
-		process.exit(1);
-	}
-	return new SkydiveApiClient(result.value);
-}
 /** Read all of stdin as UTF-8, trimming a single trailing newline. */
 async function readStdin$1() {
 	const chunks = [];
@@ -1068,7 +1522,7 @@ const listCommand$2 = {
 	command: "list",
 	describe: "List secret names for an agent (values are never shown)",
 	handler: async (argv) => {
-		const result = await requireClient(argv).listSecrets(argv["agent-id"]);
+		const result = await requireManagementClient(argv).listSecrets(argv["agent-id"]);
 		if (result.isErr()) {
 			printError(result.error.message);
 			process.exit(1);
@@ -1109,7 +1563,7 @@ const setCommand = {
 			printError("Empty secret value.");
 			process.exit(1);
 		}
-		const result = await requireClient(argv).setSecret(argv["agent-id"], argv.key, value);
+		const result = await requireManagementClient(argv).setSecret(argv["agent-id"], argv.key, value);
 		if (result.isErr()) {
 			printError(result.error.message);
 			process.exit(1);
@@ -1131,7 +1585,7 @@ const rmCommand = {
 		describe: "Secret name"
 	}),
 	handler: async (argv) => {
-		const result = await requireClient(argv).deleteSecret(argv["agent-id"], argv.key);
+		const result = await requireManagementClient(argv).deleteSecret(argv["agent-id"], argv.key);
 		if (result.isErr()) {
 			printError(result.error.message);
 			process.exit(1);
@@ -1885,786 +2339,384 @@ function binDir() {
 }
 /** Absolute path to the version-pinned cached Bun (may not exist yet). */
 function cachedBunPath(version = PINNED_BUN_VERSION) {
-	const exe = process.platform === "win32" ? "bun.exe" : "bun";
-	return path.join(binDir(), `bun-${version}`, exe);
-}
-function isExecutableFile(p) {
-	try {
-		if (!fs.statSync(p).isFile()) return false;
-		if (process.platform !== "win32") fs.accessSync(p, fs.constants.X_OK);
-		return true;
-	} catch {
-		return false;
-	}
-}
-/**
-* Locate a usable Bun without downloading. Order:
-*   1. `SKYDIVE_BUN_PATH` (explicit override / air-gapped installs)
-*   2. the version-pinned cache this CLI manages
-*   3. `bun` already on PATH
-* Returns null if none is usable.
-*/
-function findExistingBun() {
-	const override = process.env["SKYDIVE_BUN_PATH"];
-	if (override && isExecutableFile(override)) return override;
-	const cached = cachedBunPath();
-	if (isExecutableFile(cached)) return cached;
-	const onPath = resolveBunOnPath();
-	if (onPath) return onPath;
-	return null;
-}
-/** `which`/`where` for bun, without spawning a shell. */
-function resolveBunOnPath() {
-	const pathVar = process.env["PATH"] ?? "";
-	if (!pathVar) return null;
-	const exts = process.platform === "win32" ? (process.env["PATHEXT"] ?? ".EXE").split(";") : [""];
-	for (const dir of pathVar.split(path.delimiter)) {
-		if (!dir) continue;
-		for (const ext of exts) {
-			const candidate = path.join(dir, `bun${ext}`);
-			if (isExecutableFile(candidate)) return candidate;
-		}
-	}
-	return null;
-}
-async function fetchOk(url) {
-	const res = await fetch(url, {
-		headers: { "user-agent": "skydive-cli" },
-		redirect: "follow"
-	});
-	if (!res.ok) throw new Error(`GET ${url} -> ${res.status} ${res.statusText}`);
-	return res;
-}
-/**
-* Look up the published SHA-256 for `assetName` in the pinned release's
-* `SHASUMS256.txt`. Verifying against the release's own manifest keeps
-* integrity checking correct across version bumps without hardcoding a hash
-* per platform.
-*/
-async function expectedSha256(version, assetName) {
-	const url = `${BUN_RELEASE_BASE}/bun-v${version}/SHASUMS256.txt`;
-	const text = await (await fetchOk(url)).text();
-	for (const line of text.split("\n")) {
-		const [sum, name] = line.trim().split(/\s+/);
-		if (name === assetName && sum) return sum.toLowerCase();
-	}
-	throw new Error(`${assetName} not found in ${url}`);
-}
-function sha256(buf) {
-	return createHash("sha256").update(buf).digest("hex");
-}
-/**
-* Extract the single `bun` executable from a Bun release zip buffer. The zip
-* lays the binary out as `<target>/bun` (or `bun.exe` on Windows). Implemented
-* without a zip dependency by parsing the central directory — Bun's release zips
-* use a streaming data descriptor, so the *local* file header carries zeroed
-* sizes; the central directory is the only place with correct sizes/offsets.
-*/
-function extractBunFromZip(zip, target) {
-	const exeName = process.platform === "win32" ? "bun.exe" : "bun";
-	let eocd = -1;
-	for (let i = zip.length - 22; i >= 0; i--) if (zip.readUInt32LE(i) === 101010256) {
-		eocd = i;
-		break;
-	}
-	if (eocd < 0) throw new Error("release zip has no end-of-central-directory");
-	const entryCount = zip.readUInt16LE(eocd + 10);
-	let off = zip.readUInt32LE(eocd + 16);
-	for (let n = 0; n < entryCount; n++) {
-		if (zip.readUInt32LE(off) !== 33639248) throw new Error("malformed central directory in release zip");
-		const method = zip.readUInt16LE(off + 10);
-		const compSize = zip.readUInt32LE(off + 20);
-		const nameLen = zip.readUInt16LE(off + 28);
-		const extraLen = zip.readUInt16LE(off + 30);
-		const commentLen = zip.readUInt16LE(off + 32);
-		const localHeaderOffset = zip.readUInt32LE(off + 42);
-		const name = zip.toString("utf8", off + 46, off + 46 + nameLen);
-		if (name === `${target}/${exeName}` || name === exeName) {
-			const lNameLen = zip.readUInt16LE(localHeaderOffset + 26);
-			const lExtraLen = zip.readUInt16LE(localHeaderOffset + 28);
-			const dataStart = localHeaderOffset + 30 + lNameLen + lExtraLen;
-			const data = zip.subarray(dataStart, dataStart + compSize);
-			if (method === 0) return Buffer.from(data);
-			if (method === 8) return zlib.inflateRawSync(data);
-			throw new Error(`unsupported zip compression method ${method}`);
-		}
-		off += 46 + nameLen + extraLen + commentLen;
-	}
-	throw new Error(`bun binary not found in release zip for ${target}`);
+	const exe = process.platform === "win32" ? "bun.exe" : "bun";
+	return path.join(binDir(), `bun-${version}`, exe);
 }
-/**
-* Download, verify, and cache the pinned Bun for this platform. Returns the
-* path to the cached executable, or null if Bun can't be provisioned (no
-* network, unsupported platform, checksum mismatch) — the caller then prints
-* the manual-install guidance. Never throws for the expected failure modes.
-*/
-async function downloadBun(onProgress) {
-	const target = bunAssetTarget();
-	if (!target) return null;
-	const assetName = `${target}.zip`;
-	const dest = cachedBunPath();
+function isExecutableFile(p) {
 	try {
-		onProgress?.(`Fetching Bun v${PINNED_BUN_VERSION} (one-time setup)…`);
-		const url = `${BUN_RELEASE_BASE}/bun-v${PINNED_BUN_VERSION}/${assetName}`;
-		const [zipRes, want] = await Promise.all([fetchOk(url), expectedSha256(PINNED_BUN_VERSION, assetName)]);
-		const zip = Buffer.from(await zipRes.arrayBuffer());
-		const got = sha256(zip);
-		if (got !== want) {
-			onProgress?.(`Bun download failed integrity check (expected ${want}, got ${got}).`);
-			return null;
-		}
-		const bin = extractBunFromZip(zip, target);
-		fs.mkdirSync(path.dirname(dest), { recursive: true });
-		const tmp = path.join(path.dirname(dest), `.bun.tmp-${process.pid}-${Date.now()}`);
-		fs.writeFileSync(tmp, bin, { mode: 493 });
-		if (process.platform !== "win32") fs.chmodSync(tmp, 493);
-		fs.renameSync(tmp, dest);
-		return dest;
-	} catch (e) {
-		onProgress?.(`Could not download Bun automatically: ${e instanceof Error ? e.message : String(e)}`);
-		return null;
+		if (!fs.statSync(p).isFile()) return false;
+		if (process.platform !== "win32") fs.accessSync(p, fs.constants.X_OK);
+		return true;
+	} catch {
+		return false;
 	}
 }
 /**
-* Ensure a usable Bun exists: already running under Bun, found on disk/PATH, or
-* freshly downloaded and cached. Pure resolution — does not re-exec.
+* Locate a usable Bun without downloading. Order:
+*   1. `SKYDIVE_BUN_PATH` (explicit override / air-gapped installs)
+*   2. the version-pinned cache this CLI manages
+*   3. `bun` already on PATH
+* Returns null if none is usable.
 */
-async function resolveBun(onProgress) {
-	if (isBun()) return { kind: "already-bun" };
-	const existing = findExistingBun();
-	if (existing) return {
-		kind: "found",
-		bunPath: existing
-	};
-	const downloaded = await downloadBun(onProgress);
-	if (downloaded) return {
-		kind: "found",
-		bunPath: downloaded
-	};
-	return { kind: "unavailable" };
+function findExistingBun() {
+	const override = process.env["SKYDIVE_BUN_PATH"];
+	if (override && isExecutableFile(override)) return override;
+	const cached = cachedBunPath();
+	if (isExecutableFile(cached)) return cached;
+	const onPath = resolveBunOnPath();
+	if (onPath) return onPath;
+	return null;
 }
-/**
-* The heart of the transparent-Bun story. Called by `chat` before it touches
-* OpenTUI:
-*   - Under Bun already, or if a re-exec guard is set: return 'proceed'.
-*   - Otherwise resolve/provision Bun and re-exec this exact CLI invocation
-*     under it (inheriting stdio + argv), then exit with the child's code.
-*   - If Bun can't be provisioned: return 'unavailable' so the caller prints
-*     the existing manual-install message.
-*
-* Returns 'proceed' only when it's safe to load OpenTUI in this process.
-*/
-function ensureBunAndReexec(onProgress) {
-	if (isBun() || process.env[REEXEC_GUARD] === "1") return Promise.resolve("proceed");
-	return resolveBun(onProgress).then((resolution) => {
-		if (resolution.kind === "already-bun") return "proceed";
-		if (resolution.kind === "unavailable") return "unavailable";
-		const argv = process.argv.slice(1);
-		const result = spawnSync(resolution.bunPath, argv, {
-			stdio: "inherit",
-			env: {
-				...process.env,
-				[REEXEC_GUARD]: "1"
-			}
-		});
-		if (result.error) {
-			onProgress?.(`Failed to launch chat under Bun (${resolution.bunPath}): ${result.error.message}`);
-			return "unavailable";
+/** `which`/`where` for bun, without spawning a shell. */
+function resolveBunOnPath() {
+	const pathVar = process.env["PATH"] ?? "";
+	if (!pathVar) return null;
+	const exts = process.platform === "win32" ? (process.env["PATHEXT"] ?? ".EXE").split(";") : [""];
+	for (const dir of pathVar.split(path.delimiter)) {
+		if (!dir) continue;
+		for (const ext of exts) {
+			const candidate = path.join(dir, `bun${ext}`);
+			if (isExecutableFile(candidate)) return candidate;
 		}
-		process.exit(result.status ?? 0);
+	}
+	return null;
+}
+async function fetchOk(url) {
+	const res = await fetch(url, {
+		headers: { "user-agent": "skydive-cli" },
+		redirect: "follow"
 	});
+	if (!res.ok) throw new Error(`GET ${url} -> ${res.status} ${res.statusText}`);
+	return res;
 }
-
-//#endregion
-//#region src/commands/chat.ts
-const chatCommand = {
-	command: "chat",
-	describe: "Open the interactive chat TUI, or -p for a one-shot",
-	builder: (y) => y.option("print", {
-		alias: "p",
-		type: "string",
-		describe: "Non-interactive: send one prompt, print the reply, and exit (like `claude -p`). Reads the prompt from stdin if given no value. Runs under Node — no Bun required."
-	}).option("agent", {
-		type: "string",
-		describe: "Target agent, by id, slug, or name. With -p, the agent to send the one-shot prompt to. Without -p, pre-selects the agent and opens its conversation list, skipping the agent picker. Optional when the account has exactly one agent."
-	}).option("conversation", {
-		type: "string",
-		describe: "For -p: continue an existing conversation by id instead of starting a new one."
-	}).option("share-machine", {
-		type: "boolean",
-		default: false,
-		describe: "Share this machine with the agent over the portal so it can run commands here (default-deny; in the TUI you approve per agent, with -p the flag grants the target agent for the run)"
-	}).option("theme", {
-		type: "string",
-		describe: `Pin a colorscheme (disables automatic light/dark switching). One of: ${themes.map((t) => t.id).join(", ")}. Defaults to following the terminal background; also settable via SKYDIVE_THEME.`
-	}).option("notify", {
-		type: "boolean",
-		default: true,
-		describe: "Show a desktop notification when a run finishes or needs your input while this terminal is unfocused (use --no-notify to disable)"
-	}).example("skydive chat -p \"summarize my open PRs\" --agent grace", "One-shot, non-interactive").example("echo \"what changed today?\" | skydive chat -p --agent grace", "Read the prompt from stdin").example("skydive chat --agent grace", "Open Grace's conversation list in the TUI (skips the agent picker)"),
-	handler: async (argv) => {
-		const appUrl = resolveAppUrl({ appUrl: argv["api-url"] });
-		if (argv.print !== void 0) {
-			await runPrintMode({
-				argv,
-				appUrl
-			});
-			return;
-		}
-		if (await ensureBunAndReexec((msg) => process.stderr.write(`${msg}\n`)) === "unavailable") {
-			printError(`chat needs the Bun runtime and it couldn't be set up automatically (no network, an unsupported platform, or a failed download). Install Bun (https://bun.sh) and run chat under it, e.g. \`bun ${process.argv[1] ?? "skydive"} chat\`, or point SKYDIVE_BUN_PATH at an existing bun binary. For a non-interactive one-shot that runs under Node, use \`chat -p "<prompt>"\`.`);
-			process.exit(1);
-		}
-		let session = resolveSession({ appUrl });
-		if (session.isErr()) {
-			if (isNonInteractive()) {
-				printError("Not signed in for chat and no interactive terminal. Run `skydive auth login --web`, or set SKYDIVE_SESSION_TOKEN.");
-				process.exit(1);
-			}
-			const login = await loginWithDevice({ appUrl });
-			if (login.isErr()) {
-				printError(login.error.message);
-				process.exit(1);
-			}
-			session = resolveSession({ appUrl });
-			if (session.isErr()) {
-				printError("Signed in, but no session was stored.");
-				process.exit(1);
-			}
-		}
-		const themeId = argv.theme ?? process.env["SKYDIVE_THEME"] ?? void 0;
-		if (themeId !== void 0 && !themes.some((t) => t.id === themeId)) {
-			printError(`Unknown theme "${themeId}". Valid themes: ${themes.map((t) => t.id).join(", ")}`);
-			process.exit(1);
-		}
-		const { runChat } = await import("./boot-FPpnUcyM.mjs");
-		await runChat({
-			appUrl,
-			sessionToken: session.value.sessionToken,
-			shareMachine: argv["share-machine"],
-			promptHistoryPath: getPromptHistoryPath(),
-			theme: themeId,
-			notifications: argv.notify,
-			agentSelector: argv.agent ?? null
-		});
-	}
-};
-async function runPrintMode({ argv, appUrl }) {
-	const session = resolveSession({ appUrl });
-	if (session.isErr()) {
-		printError(`${session.error.message} For non-interactive use, run \`skydive auth login --web\` first, or set SKYDIVE_SESSION_TOKEN.`);
-		process.exit(1);
-	}
-	const { runPrint, readStdin } = await Promise.resolve().then(() => print_exports);
-	let prompt = (argv.print ?? "").trim();
-	if (!prompt) {
-		if (process.stdin.isTTY) {
-			printError("No prompt given. Pass it inline (`-p \"your prompt\"`) or pipe it on stdin.");
-			process.exit(1);
-		}
-		prompt = (await readStdin()).trim();
-		if (!prompt) {
-			printError("Empty prompt on stdin.");
-			process.exit(1);
-		}
-	}
-	let machineShare = null;
-	if (argv["share-machine"]) {
-		const { PortalClient } = await import("./client-_OL8-XGH.mjs").then((n) => n.n);
-		let signalConnected;
-		const connected = new Promise((resolve) => {
-			signalConnected = resolve;
-		});
-		machineShare = new PortalClient({
-			appUrl,
-			sessionToken: session.value.sessionToken,
-			cwd: process.cwd(),
-			onState: (state) => {
-				if (state.status === "connected") signalConnected();
-				if (state.status === "error") console.error(`portal: connection error: ${state.error ?? "unknown"} — retrying`);
-			}
-		});
-		machineShare.enable();
-		if (await Promise.race([connected.then(() => false), new Promise((resolve) => setTimeout(() => resolve(true), 3e4).unref())])) {
-			machineShare.dispose();
-			printError("Could not connect the portal within 30s — machine sharing is unavailable (network, or the portal kill switch is off). Re-run without --share-machine, or check `skydive portal status`.");
-			process.exit(1);
-		}
-	}
-	try {
-		const result = await runPrint({
-			appUrl,
-			sessionToken: session.value.sessionToken,
-			prompt,
-			agentSelector: argv.agent ?? null,
-			conversationId: argv.conversation ?? null,
-			json: argv.json,
-			machineShare
-		});
-		if (argv.json) output(argv, result);
-	} catch (error) {
-		printError(error instanceof Error ? error.message : String(error));
-		process.exit(1);
-	} finally {
-		machineShare?.dispose();
+/**
+* Look up the published SHA-256 for `assetName` in the pinned release's
+* `SHASUMS256.txt`. Verifying against the release's own manifest keeps
+* integrity checking correct across version bumps without hardcoding a hash
+* per platform.
+*/
+async function expectedSha256(version, assetName) {
+	const url = `${BUN_RELEASE_BASE}/bun-v${version}/SHASUMS256.txt`;
+	const text = await (await fetchOk(url)).text();
+	for (const line of text.split("\n")) {
+		const [sum, name] = line.trim().split(/\s+/);
+		if (name === assetName && sum) return sum.toLowerCase();
 	}
+	throw new Error(`${assetName} not found in ${url}`);
+}
+function sha256(buf) {
+	return createHash("sha256").update(buf).digest("hex");
 }
-
-//#endregion
-//#region src/commands/messages.ts
 /**
-* `skydive messages get <messageId>` re-attaches to an exchange by message id
-* and prints the agent's reply.
-*
-* This is the recovery path for `chat -p`: a long run's stream can drop at the
-* edge (Cloudflare 502/504) after the message was accepted, leaving the caller
-* with a messageId but no result. The agent keeps working server-side, so a
-* blind retry would double-execute an agent that may have write access.
-* Instead, fetch the finished result by message id here — the server resolves
-* the run behind the message and replays it from its persisted event log, so
-* this works whether the run is still live or already done.
-*
-* Message ids are the currency of this API: `chat -p --json` reports the
-* `messageId` and this command consumes it. Run ids stay server-side.
+* Extract the single `bun` executable from a Bun release zip buffer. The zip
+* lays the binary out as `<target>/bun` (or `bun.exe` on Windows). Implemented
+* without a zip dependency by parsing the central directory — Bun's release zips
+* use a streaming data descriptor, so the *local* file header carries zeroed
+* sizes; the central directory is the only place with correct sizes/offsets.
 */
-const getCommand = {
-	command: "get <message-id>",
-	describe: "Fetch a message by id and print the reply (recovers a timed-out -p)",
-	builder: (y) => y.positional("message-id", {
-		type: "string",
-		demandOption: true,
-		describe: "Message id (the `messageId` from a prior `chat -p --json`)"
-	}),
-	handler: async (argv) => {
-		const appUrl = resolveAppUrl({ appUrl: argv["api-url"] });
-		const session = resolveSession({ appUrl });
-		if (session.isErr()) {
-			printError(`${session.error.message} Run \`skydive auth login --web\` first, or set SKYDIVE_SESSION_TOKEN.`);
-			process.exit(1);
-		}
-		const { messageGet } = await Promise.resolve().then(() => print_exports);
-		try {
-			const result = await messageGet({
-				appUrl,
-				sessionToken: session.value.sessionToken,
-				messageId: argv["message-id"],
-				json: argv.json
-			});
-			if (argv.json) output(argv, result);
-		} catch (error) {
-			printError(error instanceof Error ? error.message : String(error));
-			process.exit(1);
+function extractBunFromZip(zip, target) {
+	const exeName = process.platform === "win32" ? "bun.exe" : "bun";
+	let eocd = -1;
+	for (let i = zip.length - 22; i >= 0; i--) if (zip.readUInt32LE(i) === 101010256) {
+		eocd = i;
+		break;
+	}
+	if (eocd < 0) throw new Error("release zip has no end-of-central-directory");
+	const entryCount = zip.readUInt16LE(eocd + 10);
+	let off = zip.readUInt32LE(eocd + 16);
+	for (let n = 0; n < entryCount; n++) {
+		if (zip.readUInt32LE(off) !== 33639248) throw new Error("malformed central directory in release zip");
+		const method = zip.readUInt16LE(off + 10);
+		const compSize = zip.readUInt32LE(off + 20);
+		const nameLen = zip.readUInt16LE(off + 28);
+		const extraLen = zip.readUInt16LE(off + 30);
+		const commentLen = zip.readUInt16LE(off + 32);
+		const localHeaderOffset = zip.readUInt32LE(off + 42);
+		const name = zip.toString("utf8", off + 46, off + 46 + nameLen);
+		if (name === `${target}/${exeName}` || name === exeName) {
+			const lNameLen = zip.readUInt16LE(localHeaderOffset + 26);
+			const lExtraLen = zip.readUInt16LE(localHeaderOffset + 28);
+			const dataStart = localHeaderOffset + 30 + lNameLen + lExtraLen;
+			const data = zip.subarray(dataStart, dataStart + compSize);
+			if (method === 0) return Buffer.from(data);
+			if (method === 8) return zlib.inflateRawSync(data);
+			throw new Error(`unsupported zip compression method ${method}`);
 		}
+		off += 46 + nameLen + extraLen + commentLen;
 	}
-};
-const messagesCommand = {
-	command: "messages",
-	describe: "Inspect chat messages and re-fetch agent replies",
-	builder: (y) => y.command(getCommand).demandCommand(1, "Specify a subcommand: get"),
-	handler: () => {}
-};
-
-//#endregion
-//#region src/chat/api/rest.ts
-var HttpError = class extends Error {
-	constructor(status, body) {
-		super(`HTTP ${status}: ${body.slice(0, 200)}`);
-		this.status = status;
-		this.body = body;
-		this.name = "HttpError";
+	throw new Error(`bun binary not found in release zip for ${target}`);
+}
+/**
+* Download, verify, and cache the pinned Bun for this platform. Returns the
+* path to the cached executable, or null if Bun can't be provisioned (no
+* network, unsupported platform, checksum mismatch) — the caller then prints
+* the manual-install guidance. Never throws for the expected failure modes.
+*/
+async function downloadBun(onProgress) {
+	const target = bunAssetTarget();
+	if (!target) return null;
+	const assetName = `${target}.zip`;
+	const dest = cachedBunPath();
+	try {
+		onProgress?.(`Fetching Bun v${PINNED_BUN_VERSION} (one-time setup)…`);
+		const url = `${BUN_RELEASE_BASE}/bun-v${PINNED_BUN_VERSION}/${assetName}`;
+		const [zipRes, want] = await Promise.all([fetchOk(url), expectedSha256(PINNED_BUN_VERSION, assetName)]);
+		const zip = Buffer.from(await zipRes.arrayBuffer());
+		const got = sha256(zip);
+		if (got !== want) {
+			onProgress?.(`Bun download failed integrity check (expected ${want}, got ${got}).`);
+			return null;
+		}
+		const bin = extractBunFromZip(zip, target);
+		fs.mkdirSync(path.dirname(dest), { recursive: true });
+		const tmp = path.join(path.dirname(dest), `.bun.tmp-${process.pid}-${Date.now()}`);
+		fs.writeFileSync(tmp, bin, { mode: 493 });
+		if (process.platform !== "win32") fs.chmodSync(tmp, 493);
+		fs.renameSync(tmp, dest);
+		return dest;
+	} catch (e) {
+		onProgress?.(`Could not download Bun automatically: ${e instanceof Error ? e.message : String(e)}`);
+		return null;
 	}
-};
-const MAX_STREAM_RECONNECTS = 5;
-function createRestClient({ appUrl, sessionToken }) {
-	const baseHeaders = {
-		authorization: `Bearer ${sessionToken}`,
-		accept: "application/json"
+}
+/**
+* Ensure a usable Bun exists: already running under Bun, found on disk/PATH, or
+* freshly downloaded and cached. Pure resolution — does not re-exec.
+*/
+async function resolveBun(onProgress) {
+	if (isBun()) return { kind: "already-bun" };
+	const existing = findExistingBun();
+	if (existing) return {
+		kind: "found",
+		bunPath: existing
 	};
-	async function get(path, schema) {
-		const res = await fetch(`${appUrl}${path}`, { headers: baseHeaders });
-		if (!res.ok) throw new HttpError(res.status, await res.text().catch(() => ""));
-		return schema.parse(await res.json());
-	}
-	async function post(path, body, schema, method = "POST") {
-		const res = await fetch(`${appUrl}${path}`, {
-			method,
-			headers: {
-				...baseHeaders,
-				"content-type": "application/json"
-			},
-			body: JSON.stringify(body)
-		});
-		if (!res.ok) throw new HttpError(res.status, await res.text().catch(() => ""));
-		return schema.parse(await res.json());
-	}
-	async function del(path) {
-		const res = await fetch(`${appUrl}${path}`, {
-			method: "DELETE",
-			headers: baseHeaders
-		});
-		if (!res.ok) throw new HttpError(res.status, await res.text().catch(() => ""));
-	}
-	const streamEvents = async ({ path, label, signal, onEvent }) => {
-		let lastEventId = null;
-		let finished = false;
-		let reconnects = 0;
-		for (;;) {
-			if (signal.aborted) return;
-			try {
-				const headers = {
-					authorization: `Bearer ${sessionToken}`,
-					accept: "text/event-stream"
-				};
-				if (lastEventId) headers["last-event-id"] = lastEventId;
-				const res = await fetch(`${appUrl}${path}`, {
-					headers,
-					signal
-				});
-				if (!res.ok || !res.body) throw new HttpError(res.status, await res.text().catch(() => ""));
-				reconnects = 0;
-				const parser = createParser({ onEvent: (message) => {
-					if (message.id) lastEventId = message.id;
-					if (message.event === "error") {
-						const { error } = streamErrorSchema.parse(JSON.parse(message.data));
-						throw new Error(error);
-					}
-					const event = runStreamEventSchema.parse(JSON.parse(message.data));
-					if (event.kind === "finished") finished = true;
-					onEvent(event.kind === "finished" ? {
-						...event,
-						error: event.error ?? null
-					} : event);
-				} });
-				const decoder = new TextDecoder();
-				const reader = res.body.getReader();
-				try {
-					for (;;) {
-						const { done, value } = await reader.read();
-						if (done) break;
-						parser.feed(decoder.decode(value, { stream: true }));
-						if (finished) return;
-					}
-				} finally {
-					try {
-						await reader.cancel();
-					} catch (_error) {}
-				}
-			} catch (err) {
-				if (signal.aborted) return;
-				if (err instanceof HttpError && err.status >= 400 && err.status < 500) throw err;
-				reconnects += 1;
-				if (reconnects > MAX_STREAM_RECONNECTS) throw err;
-				await sleep(Math.min(500 * 2 ** reconnects, 5e3));
-				continue;
+	const downloaded = await downloadBun(onProgress);
+	if (downloaded) return {
+		kind: "found",
+		bunPath: downloaded
+	};
+	return { kind: "unavailable" };
+}
+/**
+* The heart of the transparent-Bun story. Called by `chat` before it touches
+* OpenTUI:
+*   - Under Bun already, or if a re-exec guard is set: return 'proceed'.
+*   - Otherwise resolve/provision Bun and re-exec this exact CLI invocation
+*     under it (inheriting stdio + argv), then exit with the child's code.
+*   - If Bun can't be provisioned: return 'unavailable' so the caller prints
+*     the existing manual-install message.
+*
+* Returns 'proceed' only when it's safe to load OpenTUI in this process.
+*/
+function ensureBunAndReexec(onProgress) {
+	if (isBun() || process.env[REEXEC_GUARD] === "1") return Promise.resolve("proceed");
+	return resolveBun(onProgress).then((resolution) => {
+		if (resolution.kind === "already-bun") return "proceed";
+		if (resolution.kind === "unavailable") return "unavailable";
+		const argv = process.argv.slice(1);
+		const result = spawnSync(resolution.bunPath, argv, {
+			stdio: "inherit",
+			env: {
+				...process.env,
+				[REEXEC_GUARD]: "1"
 			}
-			if (finished) return;
-			reconnects += 1;
-			if (reconnects > MAX_STREAM_RECONNECTS) throw new Error(`${label} stream ended unexpectedly`);
-			await sleep(Math.min(500 * 2 ** reconnects, 5e3));
+		});
+		if (result.error) {
+			onProgress?.(`Failed to launch chat under Bun (${resolution.bunPath}): ${result.error.message}`);
+			return "unavailable";
 		}
-	};
-	return {
-		listAgents: async ({ scope, onPage }) => {
-			const all = [];
-			let cursor;
-			const maxAgents = 2e3;
-			do {
-				const params = new URLSearchParams({
-					limit: "100",
-					scope,
-					sort: "mine_first_usage",
-					includeStats: "false"
-				});
-				if (cursor) params.set("cursor", cursor);
-				const page = await get(`/api/v1/agents?${params.toString()}`, listAgentsResponseSchema);
-				all.push(...page.agents);
-				cursor = page.nextCursor ?? void 0;
-				onPage?.([...all]);
-			} while (cursor && all.length < maxAgents);
-			return all;
-		},
-		createAgent: async ({ name }) => {
-			const { agent } = await post("/api/v1/agents", { name }, createAgentResponseSchema);
-			return agent;
-		},
-		getConversation: async ({ conversationId }) => {
-			const { conversation } = await get(`/api/v1/conversations/${encodeURIComponent(conversationId)}`, getConversationResponseSchema);
-			return conversation;
-		},
-		listModels: async () => {
-			const { models } = await get("/api/v1/models", listModelsResponseSchema);
-			return models;
-		},
-		updateAgentModel: async ({ agentId, model }) => {
-			const { agent } = await post(`/api/v1/agents/${encodeURIComponent(agentId)}`, { model }, updateAgentResponseSchema, "PATCH");
-			return { model: agent.model ?? null };
-		},
-		listConversations: async ({ agentId, limit }) => {
-			const all = [];
-			const maxConversations = limit ?? 5e3;
-			let cursor;
-			do {
-				const remaining = maxConversations - all.length;
-				const params = new URLSearchParams({
-					agentId,
-					includeTotal: "false"
-				});
-				params.set("limit", String(Math.min(remaining, 100)));
-				if (cursor) params.set("cursor", cursor);
-				const page = await get(`/api/v1/conversations?${params.toString()}`, listConversationsResponseSchema);
-				all.push(...page.conversations);
-				cursor = page.nextCursor ?? void 0;
-			} while (cursor && all.length < maxConversations);
-			return limit ? all.slice(0, limit) : all;
-		},
-		listMessages: async ({ conversationId }) => {
-			const { messages } = await get(`/api/v1/conversations/${encodeURIComponent(conversationId)}/messages`, listMessagesResponseSchema);
-			return messages;
-		},
-		getRecap: async ({ conversationId }) => {
-			const { recap } = await get(`/api/v1/conversations/${encodeURIComponent(conversationId)}/recap`, recapResponseSchema);
-			return recap?.text ?? null;
-		},
-		uploadAttachment: async ({ agentId, fileName, mediaType, data }) => {
-			const size = data.byteLength;
-			const presign = await post("/api/v1/attachments/presign", {
-				agentId,
-				fileName,
-				mediaType,
-				size
-			}, presignResponseSchema);
-			const putRes = await fetch(presign.uploadUrl, {
-				method: "PUT",
-				headers: { "content-type": mediaType },
-				body: new Uint8Array(data)
-			});
-			if (!putRes.ok) throw new HttpError(putRes.status, await putRes.text().catch(() => ""));
-			const finalized = await post(`/api/v1/attachments/${encodeURIComponent(presign.id)}/finalize`, {
-				agentId,
-				fileName: presign.fileName,
-				mediaType: presign.mediaType,
-				size
-			}, finalizeResponseSchema);
-			return {
-				id: presign.id,
-				fileName: finalized.fileName,
-				mediaType: finalized.mediaType,
-				sizeBytes: finalized.sizeBytes ?? size
-			};
-		},
-		deleteConversation: async ({ conversationId }) => {
-			await del(`/api/v1/conversations/${encodeURIComponent(conversationId)}`);
-		},
-		sendMessage: async ({ clientSurface, ...input }) => post("/api/v1/chat/send", {
-			...input,
-			clientSurface
-		}, sendResultSchema),
-		activeRun: async ({ conversationId }) => {
-			const { run } = await get(`/api/v1/chat/active-run?${new URLSearchParams({ conversationId }).toString()}`, activeRunResponseSchema);
-			return run;
-		},
-		cancelRun: async ({ runId }) => {
-			await post(`/api/v1/chat/runs/${encodeURIComponent(runId)}/cancel`, {}, z.object({ ok: z.boolean() }));
-		},
-		cancelSteer: async ({ directiveId }) => {
-			await post(`/api/v1/chat/steer/${encodeURIComponent(directiveId)}/cancel`, {}, z.object({ ok: z.boolean() }));
-		},
-		oauthConnect: async (input) => {
-			const { connectLink } = await post("/api/v1/oauth/connect", input, oauthConnectResponseSchema);
-			return { connectLink };
-		},
-		externalOauthConnect: async (input) => {
-			const { authorizationUrl } = await post("/api/v1/external-oauth/connect", input, externalOauthConnectResponseSchema);
-			return { authorizationUrl: authorizationUrl ?? null };
-		},
-		fulfillCredential: async ({ url, body }) => {
-			const target = new URL(url, appUrl).toString();
-			const res = await fetch(target, {
-				method: "POST",
-				headers: {
-					...baseHeaders,
-					"content-type": "application/json"
-				},
-				body: JSON.stringify(body)
+		process.exit(result.status ?? 0);
+	});
+}
+
+//#endregion
+//#region src/commands/chat.ts
+const chatCommand = {
+	command: "chat",
+	describe: "Open the interactive chat TUI, or -p for a one-shot",
+	builder: (y) => y.option("print", {
+		alias: "p",
+		type: "string",
+		describe: "Non-interactive: send one prompt, print the reply, and exit (like `claude -p`). Reads the prompt from stdin if given no value. Runs under Node — no Bun required."
+	}).option("agent", {
+		type: "string",
+		describe: "Target agent, by id, slug, or name. With -p, the agent to send the one-shot prompt to. Without -p, pre-selects the agent and opens its conversation list, skipping the agent picker. Optional when the account has exactly one agent."
+	}).option("conversation", {
+		type: "string",
+		describe: "For -p: continue an existing conversation by id instead of starting a new one."
+	}).option("share-machine", {
+		type: "boolean",
+		default: false,
+		describe: "Share this machine with the agent over the portal so it can run commands here (default-deny; in the TUI you approve per agent, with -p the flag grants the target agent for the run)"
+	}).option("theme", {
+		type: "string",
+		describe: `Pin a colorscheme (disables automatic light/dark switching). One of: ${themes.map((t) => t.id).join(", ")}. Defaults to following the terminal background; also settable via SKYDIVE_THEME.`
+	}).option("notify", {
+		type: "boolean",
+		default: true,
+		describe: "Show a desktop notification when a run finishes or needs your input while this terminal is unfocused (use --no-notify to disable)"
+	}).example("skydive chat -p \"summarize my open PRs\" --agent grace", "One-shot, non-interactive").example("echo \"what changed today?\" | skydive chat -p --agent grace", "Read the prompt from stdin").example("skydive chat --agent grace", "Open Grace's conversation list in the TUI (skips the agent picker)"),
+	handler: async (argv) => {
+		const appUrl = resolveAppUrl({ appUrl: argv["api-url"] });
+		if (argv.print !== void 0) {
+			await runPrintMode({
+				argv,
+				appUrl
 			});
-			if (!res.ok) throw new HttpError(res.status, await res.text().catch(() => ""));
-		},
-		streamRun: async ({ runId, signal, onEvent }) => streamEvents({
-			path: `/api/v1/chat/runs/${encodeURIComponent(runId)}/stream`,
-			label: "run",
-			signal,
-			onEvent
-		}),
-		streamMessage: async ({ messageId, signal, onEvent }) => streamEvents({
-			path: `/api/v1/chat/messages/${encodeURIComponent(messageId)}/stream`,
-			label: "message",
-			signal,
-			onEvent
-		}),
-		streamConversation: async ({ conversationId, signal, onEvent }) => {
-			let reconnects = 0;
-			for (;;) {
-				if (signal.aborted) return;
-				try {
-					const res = await fetch(`${appUrl}/api/v1/chat/conversations/${encodeURIComponent(conversationId)}/stream`, {
-						headers: {
-							authorization: `Bearer ${sessionToken}`,
-							accept: "text/event-stream"
-						},
-						signal
-					});
-					if (!res.ok || !res.body) throw new HttpError(res.status, await res.text().catch(() => ""));
-					reconnects = 0;
-					const parser = createParser({ onEvent: (message) => {
-						const parsed = conversationStreamEventSchema.safeParse(JSON.parse(message.data));
-						if (parsed.success) onEvent(parsed.data);
-					} });
-					const decoder = new TextDecoder();
-					const reader = res.body.getReader();
-					try {
-						for (;;) {
-							const { done, value } = await reader.read();
-							if (done) break;
-							parser.feed(decoder.decode(value, { stream: true }));
-						}
-					} finally {
-						try {
-							await reader.cancel();
-						} catch (_error) {}
-					}
-				} catch (err) {
-					if (signal.aborted) return;
-					if (err instanceof HttpError && err.status >= 400 && err.status < 500) throw err;
-					reconnects += 1;
-					if (reconnects > MAX_STREAM_RECONNECTS) throw err;
-					await sleep(Math.min(500 * 2 ** reconnects, 5e3));
-					continue;
-				}
-				if (signal.aborted) return;
-				reconnects += 1;
-				if (reconnects > MAX_STREAM_RECONNECTS) throw new Error("conversation stream ended unexpectedly");
-				await sleep(Math.min(500 * 2 ** reconnects, 5e3));
+			return;
+		}
+		if (await ensureBunAndReexec((msg) => process.stderr.write(`${msg}\n`)) === "unavailable") {
+			printError(`chat needs the Bun runtime and it couldn't be set up automatically (no network, an unsupported platform, or a failed download). Install Bun (https://bun.sh) and run chat under it, e.g. \`bun ${process.argv[1] ?? "skydive"} chat\`, or point SKYDIVE_BUN_PATH at an existing bun binary. For a non-interactive one-shot that runs under Node, use \`chat -p "<prompt>"\`.`);
+			process.exit(1);
+		}
+		let session = resolveSession({ appUrl });
+		if (session.isErr()) {
+			if (isNonInteractive()) {
+				printError("Not signed in for chat and no interactive terminal. Run `skydive auth login --web`, or set SKYDIVE_SESSION_TOKEN.");
+				process.exit(1);
+			}
+			const login = await loginWithDevice({ appUrl });
+			if (login.isErr()) {
+				printError(login.error.message);
+				process.exit(1);
+			}
+			session = resolveSession({ appUrl });
+			if (session.isErr()) {
+				printError("Signed in, but no session was stored.");
+				process.exit(1);
+			}
+		}
+		const themeId = argv.theme ?? process.env["SKYDIVE_THEME"] ?? void 0;
+		if (themeId !== void 0 && !themes.some((t) => t.id === themeId)) {
+			printError(`Unknown theme "${themeId}". Valid themes: ${themes.map((t) => t.id).join(", ")}`);
+			process.exit(1);
+		}
+		const { runChat } = await import("./boot-DtAYHuRB.mjs");
+		await runChat({
+			appUrl,
+			sessionToken: session.value.sessionToken,
+			shareMachine: argv["share-machine"],
+			promptHistoryPath: getPromptHistoryPath(),
+			theme: themeId,
+			notifications: argv.notify,
+			agentSelector: argv.agent ?? null
+		});
+	}
+};
+async function runPrintMode({ argv, appUrl }) {
+	const session = resolveSession({ appUrl });
+	if (session.isErr()) {
+		printError(`${session.error.message} For non-interactive use, run \`skydive auth login --web\` first, or set SKYDIVE_SESSION_TOKEN.`);
+		process.exit(1);
+	}
+	const { runPrint, readStdin } = await Promise.resolve().then(() => print_exports);
+	let prompt = (argv.print ?? "").trim();
+	if (!prompt) {
+		if (process.stdin.isTTY) {
+			printError("No prompt given. Pass it inline (`-p \"your prompt\"`) or pipe it on stdin.");
+			process.exit(1);
+		}
+		prompt = (await readStdin()).trim();
+		if (!prompt) {
+			printError("Empty prompt on stdin.");
+			process.exit(1);
+		}
+	}
+	let machineShare = null;
+	if (argv["share-machine"]) {
+		const { PortalClient } = await import("./client-_OL8-XGH.mjs").then((n) => n.n);
+		let signalConnected;
+		const connected = new Promise((resolve) => {
+			signalConnected = resolve;
+		});
+		machineShare = new PortalClient({
+			appUrl,
+			sessionToken: session.value.sessionToken,
+			cwd: process.cwd(),
+			onState: (state) => {
+				if (state.status === "connected") signalConnected();
+				if (state.status === "error") console.error(`portal: connection error: ${state.error ?? "unknown"} — retrying`);
 			}
+		});
+		machineShare.enable();
+		if (await Promise.race([connected.then(() => false), new Promise((resolve) => setTimeout(() => resolve(true), 3e4).unref())])) {
+			machineShare.dispose();
+			printError("Could not connect the portal within 30s — machine sharing is unavailable (network, or the portal kill switch is off). Re-run without --share-machine, or check `skydive portal status`.");
+			process.exit(1);
 		}
-	};
-}
-function sleep(ms) {
-	return new Promise((resolve) => setTimeout(resolve, ms));
+	}
+	try {
+		const result = await runPrint({
+			appUrl,
+			sessionToken: session.value.sessionToken,
+			prompt,
+			agentSelector: argv.agent ?? null,
+			conversationId: argv.conversation ?? null,
+			json: argv.json,
+			machineShare
+		});
+		if (argv.json) output(argv, result);
+	} catch (error) {
+		printError(error instanceof Error ? error.message : String(error));
+		process.exit(1);
+	} finally {
+		machineShare?.dispose();
+	}
 }
-const agentSummarySchema = z.object({
-	id: z.string().uuid(),
-	name: z.string(),
-	slug: z.string().nullable().optional(),
-	title: z.string().nullable().optional(),
-	description: z.string().nullable().optional(),
-	createdAt: z.string(),
-	creatorName: z.string().nullable().optional(),
-	model: z.string().nullable().optional(),
-	modelLocked: z.boolean().optional()
-});
-const platformModelSchema = z.object({
-	id: z.string(),
-	displayName: z.string(),
-	providerDisplay: z.string().optional(),
-	reasoning: z.boolean().optional(),
-	compliant: z.boolean().optional()
-}).passthrough();
-const listModelsResponseSchema = z.object({ models: z.array(platformModelSchema) });
-const updateAgentResponseSchema = z.object({ agent: z.object({ model: z.string().nullable().optional() }).passthrough() });
-const listAgentsResponseSchema = z.object({
-	agents: z.array(agentSummarySchema),
-	nextCursor: z.string().nullable().optional(),
-	totalCount: z.number().nullable().optional()
-});
-const createAgentResponseSchema = z.object({ agent: agentSummarySchema });
-const conversationSummarySchema = z.object({
-	id: z.string().uuid(),
-	title: z.string().nullable(),
-	createdAt: z.string(),
-	updatedAt: z.string(),
-	preview: z.string().nullable(),
-	channel: z.string().nullable(),
-	channelLabel: z.string().nullable(),
-	agent: z.object({
-		id: z.string().uuid(),
-		name: z.string(),
-		slug: z.string().nullable().optional(),
-		title: z.string().nullable().optional()
-	})
-});
-const conversationTitleSchema = z.object({
-	id: z.string().uuid(),
-	title: z.string().nullable()
-});
-const getConversationResponseSchema = z.object({ conversation: conversationTitleSchema });
-const listConversationsResponseSchema = z.object({
-	conversations: z.array(conversationSummarySchema),
-	nextCursor: z.string().nullable().optional(),
-	totalCount: z.number().optional()
-});
-const uiMessagePartSchema = z.union([
-	z.object({
-		type: z.literal("text"),
-		text: z.string()
-	}),
-	z.object({
-		type: z.literal("reasoning"),
-		text: z.string().optional()
-	}),
-	z.object({
-		type: z.literal("dynamic-tool"),
-		toolCallId: z.string(),
-		toolName: z.string(),
-		input: z.unknown().optional(),
-		output: z.unknown().optional(),
-		state: z.string().optional(),
-		errorText: z.string().optional()
+
+//#endregion
+//#region src/commands/messages.ts
+/**
+* `skydive messages get <messageId>` re-attaches to an exchange by message id
+* and prints the agent's reply.
+*
+* This is the recovery path for `chat -p`: a long run's stream can drop at the
+* edge (Cloudflare 502/504) after the message was accepted, leaving the caller
+* with a messageId but no result. The agent keeps working server-side, so a
+* blind retry would double-execute an agent that may have write access.
+* Instead, fetch the finished result by message id here — the server resolves
+* the run behind the message and replays it from its persisted event log, so
+* this works whether the run is still live or already done.
+*
+* Message ids are the currency of this API: `chat -p --json` reports the
+* `messageId` and this command consumes it. Run ids stay server-side.
+*/
+const getCommand = {
+	command: "get <message-id>",
+	describe: "Fetch a message by id and print the reply (recovers a timed-out -p)",
+	builder: (y) => y.positional("message-id", {
+		type: "string",
+		demandOption: true,
+		describe: "Message id (the `messageId` from a prior `chat -p --json`)"
 	}),
-	z.object({ type: z.string() }).passthrough()
-]);
-const uiMessageSchema = z.object({
-	id: z.string(),
-	role: z.string(),
-	parts: z.array(uiMessagePartSchema)
-});
-const recapResponseSchema = z.object({ recap: z.object({ text: z.string() }).nullable() });
-const listMessagesResponseSchema = z.object({ messages: z.array(uiMessageSchema) });
-const sendResultSchema = z.object({
-	runId: z.string(),
-	messageId: z.string().uuid().nullish(),
-	conversationId: z.string().uuid(),
-	isNewConversation: z.boolean(),
-	steered: z.boolean().optional(),
-	directive: z.object({ id: z.string() }).passthrough().optional()
-});
-const presignResponseSchema = z.object({
-	id: z.string(),
-	uploadUrl: z.string(),
-	fileName: z.string(),
-	mediaType: z.string()
-});
-const finalizeResponseSchema = z.object({
-	fileName: z.string(),
-	mediaType: z.string(),
-	sizeBytes: z.number().nullable().optional()
-});
-const activeRunResponseSchema = z.object({ run: z.object({ runId: z.string() }).nullable() });
-const oauthConnectResponseSchema = z.object({ connectLink: z.string() }).passthrough();
-const externalOauthConnectResponseSchema = z.object({ authorizationUrl: z.string().optional() }).passthrough();
-const runStreamEventSchema = z.union([z.object({
-	kind: z.literal("chunk"),
-	chunk: z.record(z.unknown())
-}), z.object({
-	kind: z.literal("finished"),
-	status: z.string(),
-	error: z.string().nullish()
-})]);
-const streamErrorSchema = z.object({ error: z.string() });
-const conversationStreamEventSchema = z.object({
-	kind: z.literal("conversation"),
-	id: z.string(),
-	title: z.string().nullable()
-});
+	handler: async (argv) => {
+		const appUrl = resolveAppUrl({ appUrl: argv["api-url"] });
+		const session = resolveSession({ appUrl });
+		if (session.isErr()) {
+			printError(`${session.error.message} Run \`skydive auth login --web\` first, or set SKYDIVE_SESSION_TOKEN.`);
+			process.exit(1);
+		}
+		const { messageGet } = await Promise.resolve().then(() => print_exports);
+		try {
+			const result = await messageGet({
+				appUrl,
+				sessionToken: session.value.sessionToken,
+				messageId: argv["message-id"],
+				json: argv.json
+			});
+			if (argv.json) output(argv, result);
+		} catch (error) {
+			printError(error instanceof Error ? error.message : String(error));
+			process.exit(1);
+		}
+	}
+};
+const messagesCommand = {
+	command: "messages",
+	describe: "Inspect chat messages and re-fetch agent replies",
+	builder: (y) => y.command(getCommand).demandCommand(1, "Specify a subcommand: get"),
+	handler: () => {}
+};
 
 //#endregion
 //#region src/chat/util.ts
@@ -3147,30 +3199,6 @@ async function readStdin() {
 	return Buffer.concat(chunks).toString("utf8");
 }
 
-//#endregion
-//#region src/commands/session.ts
-/**
-* Resolve the signed-in chat session or exit with a friendly hint. Shared by
-* every command that talks to the authenticated REST API so the
-* resolve-or-exit block isn't copy-pasted per command.
-*/
-function requireSession(argv) {
-	const session = resolveSession({ appUrl: resolveAppUrl({ appUrl: argv["api-url"] }) });
-	if (session.isErr()) {
-		printError(`${session.error.message} Run \`skydive auth login --web\` first, or set SKYDIVE_SESSION_TOKEN.`);
-		process.exit(1);
-	}
-	return session.value;
-}
-/** Resolve the session (see {@link requireSession}) and build a REST client. */
-function requireRestClient(argv) {
-	const session = requireSession(argv);
-	return createRestClient({
-		appUrl: session.appUrl,
-		sessionToken: session.sessionToken
-	});
-}
-
 //#endregion
 //#region src/commands/conversations.ts
 /**
@@ -3328,7 +3356,7 @@ const listCommand = {
 };
 const switchCommand = {
 	command: "switch [workspace]",
-	describe: "Switch which workspace `skydive chat` uses",
+	describe: "Switch the workspace all `skydive` commands act on",
 	builder: (y) => y.positional("workspace", {
 		type: "string",
 		demandOption: false,
@@ -3345,7 +3373,7 @@ const switchCommand = {
 				printError("The workspace picker needs the Bun runtime and it could not be set up automatically. Pass a workspace slug instead, or install Bun and retry.");
 				process.exit(1);
 			}
-			const { runWorkspacePicker } = await import("./boot-FPpnUcyM.mjs");
+			const { runWorkspacePicker } = await import("./boot-DtAYHuRB.mjs");
 			await runWorkspacePicker(session);
 			return;
 		}
@@ -3377,7 +3405,7 @@ const switchCommand = {
 };
 const workspaceCommand = {
 	command: "workspace",
-	describe: "List or switch which workspace `skydive chat` uses",
+	describe: "List or switch the workspace all `skydive` commands act on",
 	builder: (y) => y.command(listCommand).command(switchCommand),
 	handler: (argv) => runList(argv, { hint: true })
 };
@@ -3676,7 +3704,7 @@ const portalCommand = {
 //#endregion
 //#region src/cli.ts
 function createCli(argv) {
-	return yargs(argv).scriptName("skydive").usage("$0 <command> [options]").example("skydive auth login", "Store your API key").example("skydive chat", "Open the interactive chat TUI (prod)").example("skydive chat --api-url http://localhost:4500", "Chat against a local dev API").example("skydive agents list", "List your agents").example("skydive keys create \"my-key\"", "Create an API key").example("skydive secrets set OPENAI_API_KEY --agent-id <id>", "Set a secret (value from stdin)").example("skydive workspace list", "List workspaces on your account").example("skydive workspace switch acme-team", "Switch which workspace `skydive chat` uses").example("skydive portal open --agent grace", "Open the portal to this machine for an agent, headless (no TUI)").option("json", {
+	return yargs(argv).scriptName("skydive").usage("$0 <command> [options]").example("skydive auth login", "Store your API key").example("skydive chat", "Open the interactive chat TUI (prod)").example("skydive chat --api-url http://localhost:4500", "Chat against a local dev API").example("skydive agents list", "List your agents").example("skydive keys create \"my-key\"", "Create an API key").example("skydive secrets set OPENAI_API_KEY --agent-id <id>", "Set a secret (value from stdin)").example("skydive workspace list", "List workspaces on your account").example("skydive workspace switch acme-team", "Switch the workspace all `skydive` commands act on").example("skydive portal open --agent grace", "Open the portal to this machine for an agent, headless (no TUI)").option("json", {
 		type: "boolean",
 		default: false,
 		global: true,
@@ -3763,4 +3791,4 @@ function resolveArgv(args, tty = {
 createCli(resolveArgv(hideBin(process.argv))).parse();
 
 //#endregion
-export { themesForMode as A, monoTheme as C, themeMode as D, themeForMode as E, DEFAULT_APP_URL as F, getConfigPath as I, getSavedTheme as L, listWorkspaces as M, setActiveWorkspace as N, themeModeFromColorFgBg as O, DEFAULT_API_URL as P, resolveWebUrl as R, findTheme as S, theme as T, isRecord as _, buildEnv as a, DEFAULT_THEME_ID as b, resolveAgent as c, parseExternalOauthConnectParams as d, parseOauthConnectParams as f, errorMessage as g, parseConnectCard as h, mintPortalDeviceToken as i, getActiveWorkspaceId as j, themeVersion as k, MASK_CHAR as l, resolveConnectUrl as m, findThisDevice as n, machineIdentity as o, reconcileMaskedInput as p, grantPortalAccess as r, portalWsUrl as s, fetchPortalDevices as t, cardActionErrorMessage as u, HttpError as v, noColorRequested as w, applyTheme as x, createRestClient as y, saveTheme as z };
+export { createRestClient as A, theme as C, themeVersion as D, themeModeFromColorFgBg as E, DEFAULT_APP_URL as F, getConfigPath as I, getSavedTheme as L, listWorkspaces as M, setActiveWorkspace as N, themesForMode as O, DEFAULT_API_URL as P, resolveWebUrl as R, noColorRequested as S, themeMode as T, isRecord as _, buildEnv as a, findTheme as b, resolveAgent as c, parseExternalOauthConnectParams as d, parseOauthConnectParams as f, errorMessage as g, parseConnectCard as h, mintPortalDeviceToken as i, getActiveWorkspaceId as j, HttpError as k, MASK_CHAR as l, resolveConnectUrl as m, findThisDevice as n, machineIdentity as o, reconcileMaskedInput as p, grantPortalAccess as r, portalWsUrl as s, fetchPortalDevices as t, cardActionErrorMessage as u, DEFAULT_THEME_ID as v, themeForMode as w, monoTheme as x, applyTheme as y, saveTheme as z };