skydive-cli 0.1.0-beta.363 → 0.1.0-beta.380

package/README.md

@@ -8,9 +8,45 @@ npx skydive-cli --help
 
 ## Authentication
 
-The CLI has two credentials, stored together in a single `config.json`. The
-location is platform-conventional (resolved via `env-paths`), so it is **not**
-`~/.config/skydive/` everywhere:
+Sign in once via the browser — the same shape as `doppler login`: the CLI
+opens the approval page, shows a short code, waits for you to approve, and
+then automatically mints an API key for this machine:
+
+```sh
+skydive auth login
+```
+
+That single flow yields both credentials the CLI uses, stored together in a
+single `config.json`:
+
+- an **API key** (`sky_live_…`) named after this machine and the workspace it
+  was minted in (`CLI (host) — Acme`) — the durable credential for the
+  management commands (`agents`, `keys`, `secrets`). Logging in again from the
+  same machine replaces it rather than accumulating rows, and
+  `skydive auth logout` revokes it, so signing out doesn't leave a live key
+  behind. The workspace is in the name because the key is pinned to it: unlike
+  the session, a key never follows `workspace switch`.
+- a **user session** for `skydive chat`. Chat is user-level and multi-agent,
+  so it authenticates as you — and unlike the API key (which is pinned to the
+  workspace that minted it), the session follows `skydive workspace switch`.
+  The management commands prefer the session while it's valid and fall back
+  to the API key.
+
+The flow doesn't require a TTY: in a non-interactive shell (an agent harness,
+SSH without a display) `auth login` still prints the verification URL + code
+and waits — open the link in any browser to approve. For unattended CI, skip
+the wait entirely and pass an existing key (mint one at
+`skydive.com/settings/account`):
+
+```sh
+skydive auth login --api-key sky_live_…   # or set SKYDIVE_API_KEY
+```
+
+`skydive auth status` shows both credentials; `skydive auth logout` revokes
+the auto-minted key and clears them.
+
+The config location is platform-conventional (resolved via `env-paths`), so
+it is **not** `~/.config/skydive/` everywhere:
 
 | Platform | Path                                                             |
 | -------- | ---------------------------------------------------------------- |
@@ -21,29 +57,6 @@ location is platform-conventional (resolved via `env-paths`), so it is **not**
 `skydive auth status` prints the real resolved path (`Config: …`) — trust that
 over this table if they ever disagree.
 
-- **API key** (`sky_live_…`). Mint one at `skydive.com/settings/account`, then:
-
-  ```sh
-  skydive auth login            # paste the key
-  ```
-
-- **User session** for `skydive chat`. Chat is user-level and multi-agent,
-  so it signs you in via the browser (device flow) rather than a per-agent
-  API key. `skydive chat` does this automatically on first run; you can also
-  do it up front:
-
-  ```sh
-  skydive auth login --web      # opens the browser, prompts for approval
-  ```
-
-Either credential authenticates the management commands (`agents`, `keys`,
-`secrets`): the CLI prefers the API key and falls back to the `--web` chat
-session, so a `--web` login alone is enough to run them — you do **not** need a
-separate API key. The API key is only required when you have no chat session
-(e.g. CI). `skydive chat` requires the chat session specifically.
-
-`skydive auth status` shows both; `skydive auth logout` clears them.
-
 ## Commands
 
 ```sh
@@ -164,7 +177,7 @@ skydive chat -p "status?" --agent grace --json               # structured envelo
 - `--conversation <id>` continues an existing thread; omitted, it starts a new
   one. The conversation id is included in `--json` output for chaining.
 - `-p` needs a user session just like `chat`, but never opens the interactive
-  browser login — sign in first with `skydive auth login --web` or set
+  browser login — sign in first with `skydive auth login` or set
   `SKYDIVE_SESSION_TOKEN`.
 - `--json` prints `{ agentId, agentName, conversationId, isNewConversation,
 messageId, text }` instead of streaming the raw text.

package/dist/js/bin.mjs

@@ -2,7 +2,7 @@
 import { t as __exportAll } from "./rolldown-runtime-Cz4Tg37Z.mjs";
 import { hideBin } from "yargs/helpers";
 import yargs from "yargs";
-import { createInterface } from "node:readline";
+import os, { hostname } from "node:os";
 import path from "node:path";
 import Conf from "conf";
 import { err, ok } from "neverthrow";
@@ -13,11 +13,10 @@ import { spawnSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import fs from "node:fs";
 import zlib from "node:zlib";
-import os from "node:os";
 import { WebSocket } from "ws";
 
 //#region package.json
-var version$1 = "0.1.0-beta.363";
+var version$1 = "0.1.0-beta.380";
 
 //#endregion
 //#region src/types.ts
@@ -57,10 +56,18 @@ const DEFAULT_WEB_URL = "https://skydive.com";
 function resolveWebUrl(appUrl) {
 	return appUrl === DEFAULT_APP_URL ? DEFAULT_WEB_URL : appUrl;
 }
-/** Prefix on every Skydive API key. Kept in sync with the API's
+/** Prefix on workspace-scoped Skydive API keys. Kept in sync with the API's
 * `API_KEY_PREFIX` (`apps/anyone/api/src/lib/api-key.ts`); the CLI is a
 * standalone published package so it can't import the backend constant. */
 const API_KEY_PREFIX = "sky_live_";
+/**
+* Common prefix across all Skydive API key kinds — `sky_live_…` workspace
+* keys today, `sky_user_…` account keys when ANY-5105 lands. The CLI only
+* sanity-checks the family on `--api-key`; the server authoritatively rejects
+* a kind that can't drive a given route, with a clearer message than the
+* client could produce.
+*/
+const API_KEY_FAMILY_PREFIX = "sky_";
 /** Where users mint and copy API keys. Shown in the login prompt. */
 const API_KEYS_URL = "skydive.com/settings/account";
 const store = new Conf({
@@ -79,9 +86,9 @@ function resolveConfig(opts) {
 }
 /**
 * Resolve the bearer credential for the management API (`agents` / `keys` /
-* `secrets`). The server's `/v1` gate accepts either an API key or the `--web`
-* session bearer, so both work — but only one of them tracks the active
-* workspace.
+* `secrets`). The server's `/v1` gate accepts either an API key or the
+* device-flow session bearer, so both work — but only one of them tracks the
+* active workspace.
 *
 * An API key is pinned server-side to the organization that minted it and
 * ignores the workspace header by design, so it can never follow `skydive
@@ -105,11 +112,17 @@ function resolveManagementAuth(opts) {
 		apiUrl: process.env["SKYDIVE_API_URL"] ?? opts.apiUrl ?? store.get("apiUrl") ?? DEFAULT_API_URL,
 		kind: "api-key"
 	});
-	return err({ message: "Not authenticated. Run `skydive auth login` (API key) or `skydive auth login --web`." });
+	return err({ message: "Not authenticated. Run `skydive auth login`." });
 }
 function saveConfig(config) {
 	store.set("apiKey", config.apiKey);
 	store.set("apiUrl", config.apiUrl);
+	if (config.apiKeyId) store.set("apiKeyId", config.apiKeyId);
+	else store.delete("apiKeyId");
+}
+/** Server-side id of the auto-minted key, if login minted one. */
+function getStoredApiKeyId() {
+	return store.get("apiKeyId") ?? null;
 }
 function deleteConfig() {
 	store.clear();
@@ -321,7 +334,7 @@ var SkydiveApiClient = class {
 				if (body.error && typeof body.error === "string") message = body.error;
 				else if (body.error?.message) message = body.error.message;
 			} catch {}
-			if (response.status === 401 && this.authKind === "session") message = `${message} — your chat session may have expired. Run \`skydive auth login --web\`.`;
+			if (response.status === 401 && this.authKind === "session") message = `${message} — your chat session may have expired. Run \`skydive auth login\`.`;
 			return err({
 				message,
 				status: response.status
@@ -648,6 +661,94 @@ function sleep$1(ms) {
 	return new Promise((resolve) => setTimeout(resolve, ms));
 }
 
+//#endregion
+//#region src/auth/mint-key.ts
+const mintedKeySchema = z.object({
+	id: z.string(),
+	name: z.string(),
+	prefix: z.string(),
+	key: z.string()
+});
+/**
+* Mint an org-scoped (account-level) API key off a fresh device-flow session,
+* so `auth login` ends with a durable machine credential the way
+* `doppler login` does. Calls the same internal endpoint the web settings page
+* uses; no `agentId` is sent, so the key is account-level, not agent-bound.
+*
+* Scopes are `use` + `edit` because the management commands the key powers
+* (`agents create`, `keys create`, `secrets set`) are edit-tier operations.
+*/
+async function mintCliApiKey({ appUrl, sessionToken, name }) {
+	try {
+		const res = await fetch(`${appUrl}/api/v1/api-keys`, {
+			method: "POST",
+			headers: {
+				authorization: `Bearer ${sessionToken}`,
+				"content-type": "application/json"
+			},
+			body: JSON.stringify({
+				name,
+				scopes: ["use", "edit"]
+			})
+		});
+		if (!res.ok) return err({ message: `failed to mint API key (${res.status})` });
+		const parsed = mintedKeySchema.safeParse(await res.json());
+		if (!parsed.success) return err({ message: "unexpected mint response" });
+		return ok(parsed.data);
+	} catch (e) {
+		return err({ message: e instanceof Error ? e.message : String(e) });
+	}
+}
+const keyListSchema = z.object({ keys: z.array(z.object({
+	id: z.string(),
+	name: z.string(),
+	agentId: z.string().nullish()
+})) });
+/**
+* Revoke every active account-level key with the given name. Login calls this
+* before minting so repeated logins from the same machine + workspace replace
+* their key instead of piling up indistinguishable rows (`logout`'s revoke is
+* best-effort, and login-without-logout is the normal case — a wiped
+* container, an expired session). Agent-scoped keys are never touched even on
+* a name collision.
+*/
+async function revokeKeysByName({ appUrl, sessionToken, name }) {
+	try {
+		const res = await fetch(`${appUrl}/api/v1/api-keys`, { headers: { authorization: `Bearer ${sessionToken}` } });
+		if (!res.ok) return err({ message: `failed to list API keys (${res.status})` });
+		const parsed = keyListSchema.safeParse(await res.json());
+		if (!parsed.success) return err({ message: "unexpected key list response" });
+		const matches = parsed.data.keys.filter((key) => key.name === name && !key.agentId);
+		const failures = (await Promise.all(matches.map((key) => revokeApiKey({
+			appUrl,
+			token: sessionToken,
+			id: key.id
+		})))).filter((result) => result.isErr());
+		if (failures.length > 0) return err({ message: `failed to revoke ${failures.length} of ${matches.length} existing keys` });
+		return ok(matches.length);
+	} catch (e) {
+		return err({ message: e instanceof Error ? e.message : String(e) });
+	}
+}
+/**
+* Revoke an API key by id. Used by `auth logout` to clean up the key that
+* login auto-minted, so signing out on a machine doesn't leave a live
+* credential behind. `token` may be a session bearer or an API key — the
+* server accepts both on this route.
+*/
+async function revokeApiKey({ appUrl, token, id }) {
+	try {
+		const res = await fetch(`${appUrl}/api/v1/api-keys/${id}`, {
+			method: "DELETE",
+			headers: { authorization: `Bearer ${token}` }
+		});
+		if (!res.ok && res.status !== 404) return err({ message: `failed to revoke API key (${res.status})` });
+		return ok(void 0);
+	} catch (e) {
+		return err({ message: e instanceof Error ? e.message : String(e) });
+	}
+}
+
 //#endregion
 //#region src/output.ts
 function output(argv, data) {
@@ -677,99 +778,160 @@ function printError(message) {
 //#region src/commands/auth.ts
 const loginCommand = {
 	command: "login",
-	describe: "Authenticate with a Skydive API key (or --web for chat)",
+	describe: "Sign in via the browser (use --api-key for CI / headless)",
 	builder: (y) => y.option("api-key", {
 		type: "string",
-		describe: `API key (${API_KEY_PREFIX}...)`
+		describe: `Skip the browser and authenticate with an existing API key (${API_KEY_PREFIX}...)`
 	}).option("web", {
 		type: "boolean",
 		default: false,
-		describe: "Sign in for `skydive chat` via the browser (device flow) instead of an API key"
+		hidden: true,
+		describe: "Deprecated: browser sign-in is now the default"
 	}),
 	handler: async (argv) => {
-		if (argv.web) {
-			await runWebLogin(argv);
+		if (argv["api-key"]) {
+			await runApiKeyLogin(argv, argv["api-key"]);
 			return;
 		}
-		let apiKey = argv["api-key"] ?? process.env["SKYDIVE_API_KEY"];
-		if (!apiKey) {
-			const rl = createInterface({
-				input: process.stdin,
-				output: process.stderr
-			});
-			apiKey = await new Promise((resolve) => {
-				rl.question(`Enter your API key (from ${API_KEYS_URL}): `, (answer) => {
-					rl.close();
-					resolve(answer.trim());
-				});
-			});
-		}
-		if (!apiKey) {
-			printError("No API key provided.");
-			process.exit(1);
-		}
-		if (!apiKey.startsWith(API_KEY_PREFIX)) {
-			printError(`API key must start with ${API_KEY_PREFIX}`);
-			process.exit(1);
-		}
-		const apiUrl = argv["api-url"] ?? DEFAULT_API_URL;
-		const result = await new SkydiveApiClient({
-			token: apiKey,
-			apiUrl,
-			kind: "api-key"
-		}).listAgents({
-			limit: 1,
-			scope: null
-		});
-		if (result.isErr()) {
-			printError(`Invalid API key or unreachable server: ${result.error.message}`);
-			process.exit(1);
+		if (isNonInteractive()) {
+			const envKey = process.env["SKYDIVE_API_KEY"];
+			if (envKey) {
+				await runApiKeyLogin(argv, envKey);
+				return;
+			}
 		}
-		saveConfig({
-			apiKey,
-			apiUrl
-		});
-		if (argv.json) output(argv, {
+		await runBrowserLogin(argv);
+	}
+};
+/**
+* Browser sign-in, shaped like `doppler login`: open the approval page with a
+* short code, wait for the user to approve, then automatically mint an API
+* key for this machine. One flow yields both credentials — the session (chat,
+* workspace-following management calls) and a durable `sky_live_…` key that
+* keeps headless/management use working after the session expires.
+*
+* Deliberately no TTY requirement: the flow only prints the verification URL
+* + code and polls, so it also works from a non-interactive shell — an agent
+* driving the CLI relays the URL to its human, who approves in any browser
+* (the auto-open is best-effort). The cost is that an unattended run with no
+* key configured waits out the device code's expiry instead of failing fast.
+*/
+async function runBrowserLogin(argv) {
+	const appUrl = resolveAppUrl({ appUrl: argv["api-url"] });
+	const login = await loginWithDevice({ appUrl });
+	if (login.isErr()) {
+		printError(login.error.message);
+		process.exit(1);
+	}
+	const { sessionToken } = login.value;
+	const identity = (await getSessionIdentity({
+		appUrl,
+		sessionToken
+	})).unwrapOr(null);
+	const keyName = identity?.activeWorkspaceName ? `CLI (${hostname()}) — ${identity.activeWorkspaceName}` : `CLI (${hostname()})`;
+	const replaced = await revokeKeysByName({
+		appUrl,
+		sessionToken,
+		name: keyName
+	});
+	if (replaced.isErr()) process.stderr.write(`Warning: could not revoke this machine's previous API key (${replaced.error.message}); minting a new one anyway.\n`);
+	const minted = await mintCliApiKey({
+		appUrl,
+		sessionToken,
+		name: keyName
+	});
+	if (minted.isOk()) saveConfig({
+		apiKey: minted.value.key,
+		apiUrl: appUrl,
+		apiKeyId: minted.value.id
+	});
+	else process.stderr.write(`Warning: signed in, but could not mint an API key (${minted.error.message}). Management commands will use your session; run \`skydive auth login\` again to retry.
+`);
+	if (argv.json) {
+		output(argv, {
 			authenticated: true,
-			prefix: apiKey.slice(0, 12),
+			mode: "browser",
+			appUrl,
+			prefix: minted.isOk() ? minted.value.prefix : null,
+			email: identity?.email ?? null,
+			workspaceName: identity?.activeWorkspaceName ?? null,
 			configPath: getConfigPath()
 		});
-		else if (!argv.quiet) {
-			console.log(`Authenticated successfully.`);
-			console.log(`  Key:    ${apiKey.slice(0, 12)}...`);
-			console.log(`  Config: ${getConfigPath()}`);
-		}
+		return;
 	}
-};
-async function runWebLogin(argv) {
-	if (isNonInteractive()) {
-		printError("`auth login --web` needs an interactive terminal. Set SKYDIVE_SESSION_TOKEN for non-interactive use.");
+	if (argv.quiet) return;
+	const who = identity?.name ?? identity?.email;
+	console.log(who ? `Welcome, ${who}!` : "Signed in.");
+	if (identity?.activeWorkspaceName) console.log(`  Workspace: ${identity.activeWorkspaceName}`);
+	if (minted.isOk()) console.log(`  API key:   ${minted.value.prefix}… (${minted.value.name})`);
+	console.log(`  Config:    ${getConfigPath()}`);
+}
+/** CI / headless path: validate and persist an existing key, no browser. */
+async function runApiKeyLogin(argv, apiKey) {
+	if (!apiKey.startsWith(API_KEY_FAMILY_PREFIX)) {
+		printError(`API key must start with ${API_KEY_FAMILY_PREFIX}`);
 		process.exit(1);
 	}
-	const result = await loginWithDevice({ appUrl: resolveAppUrl({ appUrl: argv["api-url"] }) });
+	const apiUrl = argv["api-url"] ?? DEFAULT_API_URL;
+	const result = await new SkydiveApiClient({
+		token: apiKey,
+		apiUrl,
+		kind: "api-key"
+	}).listAgents({
+		limit: 1,
+		scope: null
+	});
 	if (result.isErr()) {
-		printError(result.error.message);
+		printError(`Invalid API key or unreachable server: ${result.error.message}`);
 		process.exit(1);
 	}
+	saveConfig({
+		apiKey,
+		apiUrl,
+		apiKeyId: null
+	});
 	if (argv.json) output(argv, {
 		authenticated: true,
-		mode: "session",
-		appUrl: result.value.appUrl,
+		prefix: apiKey.slice(0, 12),
 		configPath: getConfigPath()
 	});
 	else if (!argv.quiet) {
-		console.log("Signed in for chat.");
-		console.log(`  App:    ${result.value.appUrl}`);
+		console.log(`Authenticated successfully.`);
+		console.log(`  Key:    ${apiKey.slice(0, 12)}...`);
 		console.log(`  Config: ${getConfigPath()}`);
 	}
 }
 const logoutCommand = {
 	command: "logout",
-	describe: "Clear stored credentials (API key and chat session)",
+	describe: "Revoke the auto-minted API key and clear stored credentials",
 	handler: async (argv) => {
+		const keyId = getStoredApiKeyId();
+		let keyRevoked = false;
+		if (keyId) {
+			const session = resolveSession({ appUrl: argv["api-url"] });
+			const config = resolveConfig({ apiUrl: argv["api-url"] });
+			const credential = session.isOk() ? {
+				appUrl: session.value.appUrl,
+				token: session.value.sessionToken
+			} : config.isOk() ? {
+				appUrl: config.value.apiUrl,
+				token: config.value.apiKey
+			} : null;
+			if (credential) {
+				const revoked = await revokeApiKey({
+					...credential,
+					id: keyId
+				});
+				keyRevoked = revoked.isOk();
+				if (revoked.isErr()) process.stderr.write(`Warning: could not revoke this machine's API key (${revoked.error.message}). Revoke it manually at ${API_KEYS_URL}.\n`);
+			}
+		}
 		deleteConfig();
-		if (argv.json) output(argv, { authenticated: false });
-		else if (!argv.quiet) console.log("Logged out.");
+		if (argv.json) output(argv, {
+			authenticated: false,
+			keyRevoked
+		});
+		else if (!argv.quiet) console.log(keyRevoked ? "Logged out. API key revoked." : "Logged out.");
 	}
 };
 const statusCommand$1 = {
@@ -802,7 +964,7 @@ const statusCommand$1 = {
 			return;
 		}
 		if (apiKey.isErr() && session.isErr()) {
-			console.log("Not authenticated. Run `skydive auth login` (API key) or `skydive auth login --web` (chat).");
+			console.log("Not authenticated. Run `skydive auth login`.");
 			return;
 		}
 		if (apiKey.isOk()) {
@@ -841,7 +1003,8 @@ const authCommand = {
 //#region src/chat/api/rest.ts
 var rest_exports = /* @__PURE__ */ __exportAll({
 	HttpError: () => HttpError,
-	createRestClient: () => createRestClient
+	createRestClient: () => createRestClient,
+	errorDetail: () => errorDetail
 });
 var HttpError = class extends Error {
 	constructor(status, body) {
@@ -851,6 +1014,20 @@ var HttpError = class extends Error {
 		this.name = "HttpError";
 	}
 };
+const ERROR_DETAIL_MAX_BODY = 2e3;
+/**
+* Fullest renderable text for a thrown value. `HttpError.message` clips the
+* response body to 200 chars (it flows into logs and one-line UIs); the
+* transcript renders errors collapsed to a single line, so it can afford the
+* whole body — capped with an explicit marker, never cut silently.
+*/
+function errorDetail(err) {
+	if (err instanceof HttpError) {
+		const body = err.body.length > ERROR_DETAIL_MAX_BODY ? `${err.body.slice(0, ERROR_DETAIL_MAX_BODY)}… (+${err.body.length - ERROR_DETAIL_MAX_BODY} chars)` : err.body;
+		return body ? `HTTP ${err.status}: ${body}` : `HTTP ${err.status}`;
+	}
+	return err instanceof Error ? err.message : String(err);
+}
 const MAX_STREAM_RECONNECTS = 5;
 function createRestClient({ appUrl, sessionToken }) {
 	const baseHeaders = {
@@ -1262,7 +1439,7 @@ const conversationStreamEventSchema = z.discriminatedUnion("kind", [z.object({
 function requireSession(argv) {
 	const session = resolveSession({ appUrl: resolveAppUrl({ appUrl: argv["api-url"] }) });
 	if (session.isErr()) {
-		printError(`${session.error.message} Run \`skydive auth login --web\` first, or set SKYDIVE_SESSION_TOKEN.`);
+		printError(`${session.error.message} Run \`skydive auth login\` first, or set SKYDIVE_SESSION_TOKEN.`);
 		process.exit(1);
 	}
 	return session.value;
@@ -2597,7 +2774,7 @@ const chatCommand = {
 		let session = resolveSession({ appUrl });
 		if (session.isErr()) {
 			if (isNonInteractive()) {
-				printError("Not signed in for chat and no interactive terminal. Run `skydive auth login --web`, or set SKYDIVE_SESSION_TOKEN.");
+				printError("Not signed in for chat and no interactive terminal. Run `skydive auth login`, or set SKYDIVE_SESSION_TOKEN.");
 				process.exit(1);
 			}
 			const login = await loginWithDevice({ appUrl });
@@ -2616,7 +2793,7 @@ const chatCommand = {
 			printError(`Unknown theme "${themeId}". Valid themes: ${themes.map((t) => t.id).join(", ")}`);
 			process.exit(1);
 		}
-		const { runChat } = await import("./boot-C1WUzzUo.mjs");
+		const { runChat } = await import("./boot-DML2xNb6.mjs");
 		await runChat({
 			appUrl,
 			sessionToken: session.value.sessionToken,
@@ -2640,7 +2817,7 @@ function resolveShareMachine(argv) {
 async function runPrintMode({ argv, appUrl }) {
 	const session = resolveSession({ appUrl });
 	if (session.isErr()) {
-		printError(`${session.error.message} For non-interactive use, run \`skydive auth login --web\` first, or set SKYDIVE_SESSION_TOKEN.`);
+		printError(`${session.error.message} For non-interactive use, run \`skydive auth login\` first, or set SKYDIVE_SESSION_TOKEN.`);
 		process.exit(1);
 	}
 	const { runPrint, readStdin } = await Promise.resolve().then(() => print_exports);
@@ -2728,7 +2905,7 @@ const getCommand = {
 		const appUrl = resolveAppUrl({ appUrl: argv["api-url"] });
 		const session = resolveSession({ appUrl });
 		if (session.isErr()) {
-			printError(`${session.error.message} Run \`skydive auth login --web\` first, or set SKYDIVE_SESSION_TOKEN.`);
+			printError(`${session.error.message} Run \`skydive auth login\` first, or set SKYDIVE_SESSION_TOKEN.`);
 			process.exit(1);
 		}
 		const { messageGet } = await Promise.resolve().then(() => print_exports);
@@ -3410,7 +3587,7 @@ const switchCommand = {
 				printError("The workspace picker needs the Bun runtime and it could not be set up automatically. Pass a workspace slug instead, or install Bun and retry.");
 				process.exit(1);
 			}
-			const { runWorkspacePicker } = await import("./boot-C1WUzzUo.mjs");
+			const { runWorkspacePicker } = await import("./boot-DML2xNb6.mjs");
 			await runWorkspacePicker(session);
 			return;
 		}
@@ -3538,8 +3715,8 @@ async function portalFetch(auth, path, init) {
 		...init.body ? { body: init.body } : {}
 	});
 	if (!res.ok) {
-		const body = await res.text().then((text) => text.slice(0, 120)).catch(() => "");
-		throw new Error(`${init.method} ${path} failed (${res.status}): ${body}`);
+		const body = await res.text().catch(() => "");
+		throw new HttpError(res.status, body);
 	}
 	return res.json();
 }
@@ -4137,4 +4314,4 @@ function resolveArgv(args, tty = {
 createCli(resolveArgv(hideBin(process.argv))).parse();
 
 //#endregion
-export { HttpError as A, saveTheme as B, noColorRequested as C, themeModeFromColorFgBg as D, themeMode as E, DEFAULT_API_URL as F, DEFAULT_APP_URL as I, getConfigPath as L, getActiveWorkspaceId as M, listWorkspaces as N, themeVersion as O, setActiveWorkspace as P, getSavedTheme as R, monoTheme as S, themeForMode as T, errorMessage as _, mintPortalDeviceToken as a, applyTheme as b, portalWsUrl as c, cardActionErrorMessage as d, parseExternalOauthConnectParams as f, parseConnectCard as g, resolveConnectUrl as h, grantPortalAccess as i, createRestClient as j, themesForMode as k, resolveAgent as l, reconcileMaskedInput as m, fetchPortalDevices as n, buildEnv as o, parseOauthConnectParams as p, findThisDevice as r, machineIdentity as s, SandboxStream as t, MASK_CHAR as u, isRecord as v, theme as w, findTheme as x, DEFAULT_THEME_ID as y, resolveWebUrl as z };
+export { HttpError as A, resolveWebUrl as B, noColorRequested as C, themeModeFromColorFgBg as D, themeMode as E, setActiveWorkspace as F, DEFAULT_API_URL as I, DEFAULT_APP_URL as L, errorDetail as M, getActiveWorkspaceId as N, themeVersion as O, listWorkspaces as P, getConfigPath as R, monoTheme as S, themeForMode as T, saveTheme as V, errorMessage as _, mintPortalDeviceToken as a, applyTheme as b, portalWsUrl as c, cardActionErrorMessage as d, parseExternalOauthConnectParams as f, parseConnectCard as g, resolveConnectUrl as h, grantPortalAccess as i, createRestClient as j, themesForMode as k, resolveAgent as l, reconcileMaskedInput as m, fetchPortalDevices as n, buildEnv as o, parseOauthConnectParams as p, findThisDevice as r, machineIdentity as s, SandboxStream as t, MASK_CHAR as u, isRecord as v, theme as w, findTheme as x, DEFAULT_THEME_ID as y, getSavedTheme as z };

package/dist/js/{boot-C1WUzzUo.mjs → boot-DML2xNb6.mjs}

@@ -1,15 +1,15 @@
 #!/usr/bin/env node
-import { A as HttpError, B as saveTheme, C as noColorRequested, D as themeModeFromColorFgBg, E as themeMode, F as DEFAULT_API_URL, I as DEFAULT_APP_URL, L as getConfigPath, M as getActiveWorkspaceId, N as listWorkspaces, O as themeVersion, P as setActiveWorkspace, R as getSavedTheme, S as monoTheme, T as themeForMode, _ as errorMessage, b as applyTheme, d as cardActionErrorMessage, f as parseExternalOauthConnectParams, g as parseConnectCard, h as resolveConnectUrl, j as createRestClient, k as themesForMode, l as resolveAgent, m as reconcileMaskedInput, p as parseOauthConnectParams, t as SandboxStream, u as MASK_CHAR, v as isRecord, w as theme, x as findTheme, y as DEFAULT_THEME_ID, z as resolveWebUrl } from "./bin.mjs";
+import { A as HttpError, B as resolveWebUrl, C as noColorRequested, D as themeModeFromColorFgBg, E as themeMode, F as setActiveWorkspace, I as DEFAULT_API_URL, L as DEFAULT_APP_URL, M as errorDetail, N as getActiveWorkspaceId, O as themeVersion, P as listWorkspaces, R as getConfigPath, S as monoTheme, T as themeForMode, V as saveTheme, _ as errorMessage, b as applyTheme, d as cardActionErrorMessage, f as parseExternalOauthConnectParams, g as parseConnectCard, h as resolveConnectUrl, j as createRestClient, k as themesForMode, l as resolveAgent, m as reconcileMaskedInput, p as parseOauthConnectParams, t as SandboxStream, u as MASK_CHAR, v as isRecord, w as theme, x as findTheme, y as DEFAULT_THEME_ID, z as getSavedTheme } from "./bin.mjs";
 import { t as PortalClient } from "./client-XFsd0Wy9.mjs";
 import { n as runRawPtyPassthrough } from "./raw-pty-C1DXKms6.mjs";
+import * as os$1 from "node:os";
+import { homedir, platform, release, tmpdir } from "node:os";
 import path, { basename, extname, isAbsolute, join, win32 } from "node:path";
 import { z } from "zod";
 import open from "open";
 import { execFile, spawn } from "node:child_process";
 import { createHash } from "node:crypto";
 import { constants } from "node:fs";
-import * as os$1 from "node:os";
-import { homedir, platform, release, tmpdir } from "node:os";
 import { MarkdownRenderable, RenderableEvents, SyntaxStyle, createCliRenderer, decodePasteBytes, detectLinks } from "@opentui/core";
 import { createRoot, extend, useKeyboard, usePaste, useRenderer, useTerminalDimensions } from "@opentui/react";
 import { createContext, useCallback, useContext, useEffect, useMemo, useRef, useState } from "react";
@@ -2106,6 +2106,51 @@ function StatusLine({ item }) {
 	}
 }
 
+//#endregion
+//#region src/chat/tui/chunks/error-item.tsx
+/**
+* Transcript error block. Anything longer than one line collapses to its
+* first line — an HTTP error body or a stack must not bury the conversation —
+* and clicking toggles the full text, matching the reasoning/tool blocks.
+*/
+function ErrorItem({ item }) {
+	const [expanded, setExpanded] = useState(false);
+	const text = item.text.trim();
+	const firstLine = text.split("\n").find((line) => line.trim()) ?? text;
+	if (!(text.includes("\n") || firstLine.length > 100)) return /* @__PURE__ */ jsxs("text", {
+		fg: theme.error,
+		children: ["✗ ", text]
+	});
+	if (expanded) return /* @__PURE__ */ jsxs("box", {
+		style: {
+			flexDirection: "column",
+			backgroundColor: theme.surface
+		},
+		onMouseDown: () => setExpanded(false),
+		children: [/* @__PURE__ */ jsx("text", {
+			fg: theme.error,
+			children: "✗ error"
+		}), /* @__PURE__ */ jsxs(Indented, { children: [/* @__PURE__ */ jsx(ExpandedLines, {
+			text,
+			fg: theme.error
+		}), /* @__PURE__ */ jsx(CollapseHint, {})] })]
+	});
+	return /* @__PURE__ */ jsx("box", {
+		onMouseDown: () => setExpanded(true),
+		children: /* @__PURE__ */ jsxs("text", {
+			fg: theme.error,
+			children: [
+				"✗ ",
+				truncate(firstLine, 100),
+				/* @__PURE__ */ jsx("span", {
+					fg: theme.dim,
+					children: " · click to expand"
+				})
+			]
+		})
+	});
+}
+
 //#endregion
 //#region src/chat/tui/chunks/tool-call-summary.ts
 const TOOL_CALL_SUMMARY_KEY = "__skydive_summary__";
@@ -3018,10 +3063,7 @@ function RenderItem({ item }) {
 		});
 		case "error": return /* @__PURE__ */ jsx(Row, {
 			barColor: null,
-			children: /* @__PURE__ */ jsx("text", {
-				fg: theme.error,
-				children: item.text
-			})
+			children: /* @__PURE__ */ jsx(ErrorItem, { item })
 		});
 		case "card": return /* @__PURE__ */ jsx(Row, {
 			barColor: null,
@@ -5485,7 +5527,7 @@ function ChatScreen({ agent, conversation }) {
 				setItems((prev) => [...prev, {
 					kind: "error",
 					id: crypto.randomUUID(),
-					text: `failed to load history: ${errorMessage(err)}`
+					text: `failed to load history: ${errorDetail(err)}`
 				}]);
 			} finally {
 				if (!cancelled) setHistoryLoaded(true);
@@ -5541,7 +5583,7 @@ function ChatScreen({ agent, conversation }) {
 			setItems((prev) => [...prev, {
 				kind: "error",
 				id: crypto.randomUUID(),
-				text: errorMessage(err)
+				text: errorDetail(err)
 			}]);
 			setRun({ kind: "idle" });
 		});
@@ -5608,7 +5650,7 @@ function ChatScreen({ agent, conversation }) {
 					setItems((prev) => [...prev, {
 						kind: "error",
 						id: crypto.randomUUID(),
-						text: `attachment failed: ${row.fileName}${result.status === "rejected" ? ` (${errorMessage(result.reason)})` : ""}`
+						text: `attachment failed: ${row.fileName}${result.status === "rejected" ? ` (${errorDetail(result.reason)})` : ""}`
 					}]);
 				}
 			}
@@ -5642,7 +5684,7 @@ function ChatScreen({ agent, conversation }) {
 			setItems((prev) => [...prev.filter((m) => m.id !== optimisticId), {
 				kind: "error",
 				id: crypto.randomUUID(),
-				text: errorMessage(err)
+				text: errorDetail(err)
 			}]);
 			if (echo) setInput((existing) => existing ? existing : trimmed);
 			const restore = staged.filter((a) => uploadsRef.current.has(a.tempId));
@@ -5670,7 +5712,7 @@ function ChatScreen({ agent, conversation }) {
 			setItems((prev) => [...prev, {
 				kind: "error",
 				id: crypto.randomUUID(),
-				text: `steer cancel failed: ${errorMessage(err)}`
+				text: `steer cancel failed: ${errorDetail(err)}`
 			}]);
 		});
 		return true;
@@ -6131,7 +6173,7 @@ function ChatScreen({ agent, conversation }) {
 		})).catch((err) => setItems((prev) => [...prev, {
 			kind: "error",
 			id: crypto.randomUUID(),
-			text: `couldn't share machine: ${errorMessage(err)}`
+			text: `couldn't share machine: ${errorDetail(err)}`
 		}]));
 	}, [
 		portalClient,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skydive-cli",
-  "version": "0.1.0-beta.363",
+  "version": "0.1.0-beta.380",
   "description": "Skydive CLI — manage AI agents from the command line",
   "homepage": "https://skydive.com",
   "license": "MIT",