skydive-cli 0.1.0-beta.380 → 0.1.0-beta.389

package/dist/js/bin.mjs

@@ -1,22 +1,25 @@
 #!/usr/bin/env node
-import { t as __exportAll } from "./rolldown-runtime-Cz4Tg37Z.mjs";
+import { A as getStoredApiKeyId, C as DEFAULT_WEB_URL, E as getPromptHistoryPath, F as resolveSession, L as saveConfig, M as resolveAppUrl, N as resolveConfig, P as resolveManagementAuth, R as saveSession, T as getConfigPath, _ as setActiveWorkspace, b as API_KEY_PREFIX, d as themes, g as listWorkspaces, h as getSessionIdentity, j as getUpdateCheckDisabled, k as getShareMachineDefault, m as getActiveWorkspaceId, p as ensureActiveOrganization, v as API_KEYS_URL, w as deleteConfig, x as DEFAULT_API_URL, y as API_KEY_FAMILY_PREFIX } from "./theme-DRuLtrTy.mjs";
+import { n as createRestClient } from "./rest-DTlkPko_.mjs";
+import { i as resolveAgent } from "./print-BhfjRrxI.mjs";
+import { a as registerPortalDevice, c as machineIdentity, n as findThisDevice, o as revokePortalAccess, r as grantPortalAccess, t as fetchPortalDevices } from "./api-DRpbKHz6.mjs";
+import { t as SandboxStream } from "./client-BVOAwU8M.mjs";
 import { hideBin } from "yargs/helpers";
 import yargs from "yargs";
-import os, { hostname } from "node:os";
+import { hostname } from "node:os";
 import path from "node:path";
-import Conf from "conf";
 import { err, ok } from "neverthrow";
 import { z } from "zod";
 import open from "open";
-import { createParser } from "eventsource-parser";
-import { spawnSync } from "node:child_process";
+import { spawn, spawnSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import fs from "node:fs";
 import zlib from "node:zlib";
-import { WebSocket } from "ws";
+import semver from "semver";
 
 //#region package.json
-var version$1 = "0.1.0-beta.380";
+var name = "skydive-cli";
+var version = "0.1.0-beta.389";
 
 //#endregion
 //#region src/types.ts
@@ -30,162 +33,9 @@ function isNonInteractive() {
 	return NON_INTERACTIVE_ENV_VARS.some((key) => process.env[key]);
 }
 
-//#endregion
-//#region src/config.ts
-/** Default host for the public management API (`/v1`, API-key auth). */
-const DEFAULT_API_URL = "https://api.skydive.com";
-/**
-* Default origin for the interactive chat client (`skydive chat`).
-*
-* The API host that serves better-auth (`/api/auth/*`) and the internal tRPC
-* API (`/api/v1/trpc`) that chat streams over. We target the API host
-* directly (not the web front door) because chat opens a WebSocket and
-* authenticates with a bearer token on the upgrade request. Same host as
-* `DEFAULT_API_URL`; override with `--api-url` / `SKYDIVE_APP_URL` for local
-* dev or while the DNS record is still being provisioned.
-*/
-const DEFAULT_APP_URL = "https://api.skydive.com";
-/** Web front door, for pages opened in the user's browser. */
-const DEFAULT_WEB_URL = "https://skydive.com";
-/**
-* Origin for browser-facing links (e.g. opening a conversation's web page).
-* The app origin is the API host, which serves no web UI in production, so
-* map the default to the web front door. Overridden origins (local dev,
-* previews) serve both and pass through unchanged.
-*/
-function resolveWebUrl(appUrl) {
-	return appUrl === DEFAULT_APP_URL ? DEFAULT_WEB_URL : appUrl;
-}
-/** Prefix on workspace-scoped Skydive API keys. Kept in sync with the API's
-* `API_KEY_PREFIX` (`apps/anyone/api/src/lib/api-key.ts`); the CLI is a
-* standalone published package so it can't import the backend constant. */
-const API_KEY_PREFIX = "sky_live_";
-/**
-* Common prefix across all Skydive API key kinds — `sky_live_…` workspace
-* keys today, `sky_user_…` account keys when ANY-5105 lands. The CLI only
-* sanity-checks the family on `--api-key`; the server authoritatively rejects
-* a kind that can't drive a given route, with a clearer message than the
-* client could produce.
-*/
-const API_KEY_FAMILY_PREFIX = "sky_";
-/** Where users mint and copy API keys. Shown in the login prompt. */
-const API_KEYS_URL = "skydive.com/settings/account";
-const store = new Conf({
-	projectName: process.env["SKYDIVE_CONFIG_NAME"] ?? "skydive",
-	projectSuffix: "",
-	configFileMode: 384
-});
-function resolveConfig(opts) {
-	const apiKey = process.env["SKYDIVE_API_KEY"] ?? store.get("apiKey");
-	const apiUrl = process.env["SKYDIVE_API_URL"] ?? opts.apiUrl ?? store.get("apiUrl") ?? DEFAULT_API_URL;
-	if (!apiKey) return err({ message: "Not authenticated. Run `skydive auth login` first." });
-	return ok({
-		apiKey,
-		apiUrl
-	});
-}
-/**
-* Resolve the bearer credential for the management API (`agents` / `keys` /
-* `secrets`). The server's `/v1` gate accepts either an API key or the
-* device-flow session bearer, so both work — but only one of them tracks the
-* active workspace.
-*
-* An API key is pinned server-side to the organization that minted it and
-* ignores the workspace header by design, so it can never follow `skydive
-* workspace switch`. A key is also a strictly narrower credential than its
-* owner's session. So the session wins whenever there is one, and a key is
-* what's left for machines that never ran an interactive login.
-*
-* `SKYDIVE_SESSION_TOKEN=` (empty) suppresses session auth for one
-* invocation, to drive a specific organization's key while signed in.
-*/
-function resolveManagementAuth(opts) {
-	const session = resolveSession({ appUrl: opts.apiUrl });
-	if (session.isOk()) return ok({
-		token: session.value.sessionToken,
-		apiUrl: session.value.appUrl,
-		kind: "session"
-	});
-	const apiKey = process.env["SKYDIVE_API_KEY"] ?? store.get("apiKey");
-	if (apiKey) return ok({
-		token: apiKey,
-		apiUrl: process.env["SKYDIVE_API_URL"] ?? opts.apiUrl ?? store.get("apiUrl") ?? DEFAULT_API_URL,
-		kind: "api-key"
-	});
-	return err({ message: "Not authenticated. Run `skydive auth login`." });
-}
-function saveConfig(config) {
-	store.set("apiKey", config.apiKey);
-	store.set("apiUrl", config.apiUrl);
-	if (config.apiKeyId) store.set("apiKeyId", config.apiKeyId);
-	else store.delete("apiKeyId");
-}
-/** Server-side id of the auto-minted key, if login minted one. */
-function getStoredApiKeyId() {
-	return store.get("apiKeyId") ?? null;
-}
-function deleteConfig() {
-	store.clear();
-}
-function getConfigPath() {
-	return store.path;
-}
-/**
-* Where the chat TUI persists its prompt history (up-arrow recall). Kept
-* beside the config file so all CLI state lives in one directory.
-*/
-function getPromptHistoryPath() {
-	return path.join(path.dirname(store.path), "prompt-history.jsonl");
-}
-/**
-* Resolve the chat/auth origin. Precedence: `SKYDIVE_APP_URL` env > explicit
-* `--api-url` style override > stored value > `SKYDIVE_API_URL` env >
-* `DEFAULT_APP_URL`.
-*
-* The `SKYDIVE_API_URL` fallback matters for previews: the device/`--web`
-* flow and chat hit the same api service as the management API, so pointing
-* `SKYDIVE_API_URL` at a preview stack is enough — you don't also have to set
-* `SKYDIVE_APP_URL`. Otherwise auth would silently fall through to prod
-* (`DEFAULT_APP_URL`) and hand back a prod verification URL.
-*/
-function resolveAppUrl(opts) {
-	return process.env["SKYDIVE_APP_URL"] ?? opts.appUrl ?? store.get("appUrl") ?? process.env["SKYDIVE_API_URL"] ?? DEFAULT_APP_URL;
-}
-function resolveSession(opts) {
-	const sessionToken = process.env["SKYDIVE_SESSION_TOKEN"] ?? store.get("sessionToken");
-	const appUrl = resolveAppUrl(opts);
-	if (!sessionToken) return err({ message: "Not signed in for chat. Run `skydive chat` to sign in." });
-	return ok({
-		sessionToken,
-		appUrl
-	});
-}
-function saveSession(session) {
-	store.set("sessionToken", session.sessionToken);
-	store.set("sessionObtainedAt", (/* @__PURE__ */ new Date()).toISOString());
-	store.set("appUrl", session.appUrl);
-}
-function getSavedTheme(mode) {
-	return store.get(mode === "dark" ? "themeDark" : "themeLight");
-}
-function saveTheme(mode, themeId) {
-	store.set(mode === "dark" ? "themeDark" : "themeLight", themeId);
-}
-/**
-* Whether `skydive chat` should enable portal machine sharing on launch
-* without `--share-machine`. Set by hand-editing `shareMachineDefault` in
-* config.json — deliberately no CLI command (kept off the API surface).
-* Sharing only makes the machine reachable — agents still need a
-* (persistent) grant to run anything, so this default skips the per-session
-* enable step, not the consent step.
-*/
-function getShareMachineDefault() {
-	return store.get("shareMachineDefault") ?? false;
-}
-
 //#endregion
 //#region src/api-client.ts
-const USER_AGENT = `skydive-cli/${version$1}`;
+const USER_AGENT = `skydive-cli/${version}`;
 /** Largest page `/v1/agents` will return, enforced server-side. */
 const MAX_AGENT_PAGE = 100;
 const AgentSchema = z.object({
@@ -468,121 +318,6 @@ async function pollDeviceToken({ appUrl, deviceCode, currentIntervalMs, signal }
 	}
 }
 
-//#endregion
-//#region src/auth/organization.ts
-const workspaceSchema = z.object({
-	id: z.string(),
-	name: z.string(),
-	slug: z.string()
-});
-function authHeaders(sessionToken) {
-	return { authorization: `Bearer ${sessionToken}` };
-}
-async function listWorkspaces({ appUrl, sessionToken }) {
-	try {
-		const res = await fetch(`${appUrl}/api/auth/organization/list`, { headers: authHeaders(sessionToken) });
-		if (!res.ok) return err({ message: `failed to list workspaces (${res.status})` });
-		const parsed = z.array(workspaceSchema).safeParse(await res.json());
-		if (!parsed.success) return err({ message: "unexpected workspace list response" });
-		return ok(parsed.data);
-	} catch (e) {
-		return err({ message: e instanceof Error ? e.message : String(e) });
-	}
-}
-/**
-* Resolve who the current chat session belongs to: the signed-in user's
-* email/name and the active workspace. Used by `auth status` so a user running
-* multiple accounts can answer "am I logged into the right one?" without
-* another command. Best-effort: any failure yields nulls rather than throwing,
-* since `auth status` should still report the rest of the state.
-*/
-async function getSessionIdentity({ appUrl, sessionToken }) {
-	try {
-		const res = await fetch(`${appUrl}/api/auth/get-session?disableCookieCache=true`, { headers: authHeaders(sessionToken) });
-		if (!res.ok) return err({ message: `failed to read session (${res.status})` });
-		const parsed = z.object({
-			user: z.object({
-				email: z.string().nullable().optional(),
-				name: z.string().nullable().optional()
-			}).nullable().optional(),
-			session: z.object({ activeOrganizationId: z.string().nullable().optional() }).nullable().optional()
-		}).nullable().safeParse(await res.json());
-		if (!parsed.success) return err({ message: "unexpected session response" });
-		const activeWorkspaceId = parsed.data?.session?.activeOrganizationId ?? null;
-		let activeWorkspaceName = null;
-		if (activeWorkspaceId) {
-			const workspaces = await listWorkspaces({
-				appUrl,
-				sessionToken
-			});
-			if (workspaces.isOk()) activeWorkspaceName = workspaces.value.find((w) => w.id === activeWorkspaceId)?.name ?? null;
-		}
-		return ok({
-			email: parsed.data?.user?.email ?? null,
-			name: parsed.data?.user?.name ?? null,
-			activeWorkspaceId,
-			activeWorkspaceName
-		});
-	} catch (e) {
-		return err({ message: e instanceof Error ? e.message : String(e) });
-	}
-}
-/** The workspace bound to the current session, or `null` if none is set. */
-async function getActiveWorkspaceId({ appUrl, sessionToken }) {
-	try {
-		const res = await fetch(`${appUrl}/api/auth/get-session?disableCookieCache=true`, { headers: authHeaders(sessionToken) });
-		if (!res.ok) return err({ message: `failed to read session (${res.status})` });
-		const parsed = z.object({ session: z.object({ activeOrganizationId: z.string().nullable().optional() }).nullable().optional() }).nullable().safeParse(await res.json());
-		if (!parsed.success) return err({ message: "unexpected session response" });
-		return ok(parsed.data?.session?.activeOrganizationId ?? null);
-	} catch (e) {
-		return err({ message: e instanceof Error ? e.message : String(e) });
-	}
-}
-async function setActiveWorkspace({ appUrl, sessionToken, organizationId }) {
-	try {
-		const res = await fetch(`${appUrl}/api/v1/workspaces/switch`, {
-			method: "POST",
-			headers: {
-				...authHeaders(sessionToken),
-				"content-type": "application/json"
-			},
-			body: JSON.stringify({ organizationId })
-		});
-		if (!res.ok) return err({ message: `failed to switch workspace (${res.status})` });
-		return ok(void 0);
-	} catch (e) {
-		return err({ message: e instanceof Error ? e.message : String(e) });
-	}
-}
-/**
-* Ensures the session has an active workspace. The device flow issues a
-* session without one (unlike a normal web sign-in, which sets it), so the
-* internal API rejects every request with "no active organization" until we
-* set it. Picks the account's first workspace by join order — run `skydive
-* workspace list` + `skydive workspace switch` afterward if that's the wrong
-* one (e.g. a personal workspace joined before a shared team workspace).
-*/
-async function ensureActiveOrganization({ appUrl, sessionToken }) {
-	const workspaces = await listWorkspaces({
-		appUrl,
-		sessionToken
-	});
-	if (workspaces.isErr()) return err(workspaces.error);
-	const workspace = workspaces.value[0];
-	if (!workspace) return err({ message: "your account has no organization yet" });
-	const setResult = await setActiveWorkspace({
-		appUrl,
-		sessionToken,
-		organizationId: workspace.id
-	});
-	if (setResult.isErr()) return err(setResult.error);
-	return ok({
-		organizationId: workspace.id,
-		name: workspace.name
-	});
-}
-
 //#endregion
 //#region src/auth/device-login.ts
 const DEFAULT_INTERVAL_MS = 5e3;
@@ -609,7 +344,7 @@ async function loginWithDevice({ appUrl, openBrowser = true }) {
 	let intervalMs = (code.interval ?? 5) * 1e3 || DEFAULT_INTERVAL_MS;
 	const expiresAt = Date.now() + code.expires_in * 1e3;
 	while (Date.now() < expiresAt) {
-		await sleep$1(intervalMs);
+		await sleep(intervalMs);
 		const result = await pollDeviceToken({
 			appUrl,
 			deviceCode: code.device_code,
@@ -657,7 +392,7 @@ function formatUserCode(code) {
 	if (code.length !== 8) return code;
 	return `${code.slice(0, 4)}-${code.slice(4)}`;
 }
-function sleep$1(ms) {
+function sleep(ms) {
 	return new Promise((resolve) => setTimeout(resolve, ms));
 }
 
@@ -999,436 +734,6 @@ const authCommand = {
 	handler: () => {}
 };
 
-//#endregion
-//#region src/chat/api/rest.ts
-var rest_exports = /* @__PURE__ */ __exportAll({
-	HttpError: () => HttpError,
-	createRestClient: () => createRestClient,
-	errorDetail: () => errorDetail
-});
-var HttpError = class extends Error {
-	constructor(status, body) {
-		super(`HTTP ${status}: ${body.slice(0, 200)}`);
-		this.status = status;
-		this.body = body;
-		this.name = "HttpError";
-	}
-};
-const ERROR_DETAIL_MAX_BODY = 2e3;
-/**
-* Fullest renderable text for a thrown value. `HttpError.message` clips the
-* response body to 200 chars (it flows into logs and one-line UIs); the
-* transcript renders errors collapsed to a single line, so it can afford the
-* whole body — capped with an explicit marker, never cut silently.
-*/
-function errorDetail(err) {
-	if (err instanceof HttpError) {
-		const body = err.body.length > ERROR_DETAIL_MAX_BODY ? `${err.body.slice(0, ERROR_DETAIL_MAX_BODY)}… (+${err.body.length - ERROR_DETAIL_MAX_BODY} chars)` : err.body;
-		return body ? `HTTP ${err.status}: ${body}` : `HTTP ${err.status}`;
-	}
-	return err instanceof Error ? err.message : String(err);
-}
-const MAX_STREAM_RECONNECTS = 5;
-function createRestClient({ appUrl, sessionToken }) {
-	const baseHeaders = {
-		authorization: `Bearer ${sessionToken}`,
-		accept: "application/json"
-	};
-	async function get(path, schema) {
-		const res = await fetch(`${appUrl}${path}`, { headers: baseHeaders });
-		if (!res.ok) throw new HttpError(res.status, await res.text().catch(() => ""));
-		return schema.parse(await res.json());
-	}
-	async function post(path, body, schema, method = "POST") {
-		const res = await fetch(`${appUrl}${path}`, {
-			method,
-			headers: {
-				...baseHeaders,
-				"content-type": "application/json"
-			},
-			body: JSON.stringify(body)
-		});
-		if (!res.ok) throw new HttpError(res.status, await res.text().catch(() => ""));
-		return schema.parse(await res.json());
-	}
-	async function del(path) {
-		const res = await fetch(`${appUrl}${path}`, {
-			method: "DELETE",
-			headers: baseHeaders
-		});
-		if (!res.ok) throw new HttpError(res.status, await res.text().catch(() => ""));
-	}
-	const streamEvents = async ({ path, label, signal, onEvent }) => {
-		let lastEventId = null;
-		let finished = false;
-		let reconnects = 0;
-		for (;;) {
-			if (signal.aborted) return;
-			try {
-				const headers = {
-					authorization: `Bearer ${sessionToken}`,
-					accept: "text/event-stream"
-				};
-				if (lastEventId) headers["last-event-id"] = lastEventId;
-				const res = await fetch(`${appUrl}${path}`, {
-					headers,
-					signal
-				});
-				if (!res.ok || !res.body) throw new HttpError(res.status, await res.text().catch(() => ""));
-				reconnects = 0;
-				const parser = createParser({ onEvent: (message) => {
-					if (message.id) lastEventId = message.id;
-					if (message.event === "error") {
-						const { error } = streamErrorSchema.parse(JSON.parse(message.data));
-						throw new Error(error);
-					}
-					const event = runStreamEventSchema.parse(JSON.parse(message.data));
-					if (event.kind === "finished") finished = true;
-					onEvent(event.kind === "finished" ? {
-						...event,
-						error: event.error ?? null
-					} : event);
-				} });
-				const decoder = new TextDecoder();
-				const reader = res.body.getReader();
-				try {
-					for (;;) {
-						const { done, value } = await reader.read();
-						if (done) break;
-						parser.feed(decoder.decode(value, { stream: true }));
-						if (finished) return;
-					}
-				} finally {
-					try {
-						await reader.cancel();
-					} catch (_error) {}
-				}
-			} catch (err) {
-				if (signal.aborted) return;
-				if (err instanceof HttpError && err.status >= 400 && err.status < 500) throw err;
-				reconnects += 1;
-				if (reconnects > MAX_STREAM_RECONNECTS) throw err;
-				await sleep(Math.min(500 * 2 ** reconnects, 5e3));
-				continue;
-			}
-			if (finished) return;
-			reconnects += 1;
-			if (reconnects > MAX_STREAM_RECONNECTS) throw new Error(`${label} stream ended unexpectedly`);
-			await sleep(Math.min(500 * 2 ** reconnects, 5e3));
-		}
-	};
-	return {
-		listAgents: async ({ scope, onPage }) => {
-			const all = [];
-			let cursor;
-			const maxAgents = 2e3;
-			do {
-				const params = new URLSearchParams({
-					limit: "100",
-					scope,
-					sort: "mine_first_usage",
-					includeStats: "false"
-				});
-				if (cursor) params.set("cursor", cursor);
-				const page = await get(`/api/v1/agents?${params.toString()}`, listAgentsResponseSchema);
-				all.push(...page.agents);
-				cursor = page.nextCursor ?? void 0;
-				onPage?.([...all]);
-			} while (cursor && all.length < maxAgents);
-			return all;
-		},
-		createAgent: async ({ name }) => {
-			const { agent } = await post("/api/v1/agents", { name }, createAgentResponseSchema);
-			return agent;
-		},
-		getConversation: async ({ conversationId }) => {
-			const { conversation } = await get(`/api/v1/conversations/${encodeURIComponent(conversationId)}`, getConversationResponseSchema);
-			return conversation;
-		},
-		listModels: async () => {
-			const { models } = await get("/api/v1/models", listModelsResponseSchema);
-			return models;
-		},
-		updateAgentModel: async ({ agentId, model }) => {
-			const { agent } = await post(`/api/v1/agents/${encodeURIComponent(agentId)}`, { model }, updateAgentResponseSchema, "PATCH");
-			return { model: agent.model ?? null };
-		},
-		listConversations: async ({ agentId, limit, channels, onPage }) => {
-			const all = [];
-			const maxConversations = limit ?? 5e3;
-			let cursor;
-			do {
-				const remaining = maxConversations - all.length;
-				const params = new URLSearchParams({
-					agentId,
-					includeTotal: "false"
-				});
-				params.set("limit", String(Math.min(remaining, 100)));
-				if (cursor) params.set("cursor", cursor);
-				for (const channel of channels ?? []) params.append("channels", channel);
-				const page = await get(`/api/v1/conversations?${params.toString()}`, listConversationsResponseSchema);
-				all.push(...page.conversations);
-				cursor = page.nextCursor ?? void 0;
-				onPage?.(limit ? all.slice(0, limit) : [...all]);
-			} while (cursor && all.length < maxConversations);
-			return limit ? all.slice(0, limit) : all;
-		},
-		listMessages: async ({ conversationId }) => {
-			const { messages } = await get(`/api/v1/conversations/${encodeURIComponent(conversationId)}/messages`, listMessagesResponseSchema);
-			return messages;
-		},
-		getRecap: async ({ conversationId }) => {
-			const { recap } = await get(`/api/v1/conversations/${encodeURIComponent(conversationId)}/recap`, recapResponseSchema);
-			return recap?.text ?? null;
-		},
-		uploadAttachment: async ({ agentId, fileName, mediaType, data }) => {
-			const size = data.byteLength;
-			const presign = await post("/api/v1/attachments/presign", {
-				agentId,
-				fileName,
-				mediaType,
-				size
-			}, presignResponseSchema);
-			const putRes = await fetch(presign.uploadUrl, {
-				method: "PUT",
-				headers: { "content-type": mediaType },
-				body: new Uint8Array(data)
-			});
-			if (!putRes.ok) throw new HttpError(putRes.status, await putRes.text().catch(() => ""));
-			const finalized = await post(`/api/v1/attachments/${encodeURIComponent(presign.id)}/finalize`, {
-				agentId,
-				fileName: presign.fileName,
-				mediaType: presign.mediaType,
-				size
-			}, finalizeResponseSchema);
-			return {
-				id: presign.id,
-				fileName: finalized.fileName,
-				mediaType: finalized.mediaType,
-				sizeBytes: finalized.sizeBytes ?? size
-			};
-		},
-		deleteConversation: async ({ conversationId }) => {
-			await del(`/api/v1/conversations/${encodeURIComponent(conversationId)}`);
-		},
-		sendMessage: async ({ clientSurface, ...input }) => post("/api/v1/chat/send", {
-			...input,
-			clientSurface
-		}, sendResultSchema),
-		cancelRun: async ({ runId }) => {
-			await post(`/api/v1/chat/runs/${encodeURIComponent(runId)}/cancel`, {}, z.object({ ok: z.boolean() }));
-		},
-		cancelSteer: async ({ directiveId }) => {
-			await post(`/api/v1/chat/steer/${encodeURIComponent(directiveId)}/cancel`, {}, z.object({ ok: z.boolean() }));
-		},
-		oauthConnect: async (input) => {
-			const { connectLink } = await post("/api/v1/oauth/connect", input, oauthConnectResponseSchema);
-			return { connectLink };
-		},
-		externalOauthConnect: async (input) => {
-			const { authorizationUrl } = await post("/api/v1/external-oauth/connect", input, externalOauthConnectResponseSchema);
-			return { authorizationUrl: authorizationUrl ?? null };
-		},
-		fulfillCredential: async ({ url, body }) => {
-			const target = new URL(url, appUrl).toString();
-			const res = await fetch(target, {
-				method: "POST",
-				headers: {
-					...baseHeaders,
-					"content-type": "application/json"
-				},
-				body: JSON.stringify(body)
-			});
-			if (!res.ok) throw new HttpError(res.status, await res.text().catch(() => ""));
-		},
-		streamRun: async ({ runId, signal, onEvent }) => streamEvents({
-			path: `/api/v1/chat/runs/${encodeURIComponent(runId)}/stream`,
-			label: "run",
-			signal,
-			onEvent
-		}),
-		streamMessage: async ({ messageId, signal, onEvent }) => streamEvents({
-			path: `/api/v1/chat/messages/${encodeURIComponent(messageId)}/stream`,
-			label: "message",
-			signal,
-			onEvent
-		}),
-		streamConversation: async ({ conversationId, signal, onEvent }) => {
-			let reconnects = 0;
-			for (;;) {
-				if (signal.aborted) return;
-				try {
-					const res = await fetch(`${appUrl}/api/v1/chat/conversations/${encodeURIComponent(conversationId)}/stream`, {
-						headers: {
-							authorization: `Bearer ${sessionToken}`,
-							accept: "text/event-stream"
-						},
-						signal
-					});
-					if (!res.ok || !res.body) throw new HttpError(res.status, await res.text().catch(() => ""));
-					reconnects = 0;
-					const parser = createParser({ onEvent: (message) => {
-						const parsed = conversationStreamEventSchema.safeParse(JSON.parse(message.data));
-						if (parsed.success) onEvent(parsed.data);
-					} });
-					const decoder = new TextDecoder();
-					const reader = res.body.getReader();
-					try {
-						for (;;) {
-							const { done, value } = await reader.read();
-							if (done) break;
-							parser.feed(decoder.decode(value, { stream: true }));
-						}
-					} finally {
-						try {
-							await reader.cancel();
-						} catch (_error) {}
-					}
-				} catch (err) {
-					if (signal.aborted) return;
-					if (err instanceof HttpError && err.status >= 400 && err.status < 500) throw err;
-					reconnects += 1;
-					if (reconnects > MAX_STREAM_RECONNECTS) throw err;
-					await sleep(Math.min(500 * 2 ** reconnects, 5e3));
-					continue;
-				}
-				if (signal.aborted) return;
-				reconnects += 1;
-				if (reconnects > MAX_STREAM_RECONNECTS) throw new Error("conversation stream ended unexpectedly");
-				await sleep(Math.min(500 * 2 ** reconnects, 5e3));
-			}
-		}
-	};
-}
-function sleep(ms) {
-	return new Promise((resolve) => setTimeout(resolve, ms));
-}
-const agentSummarySchema = z.object({
-	id: z.string().uuid(),
-	name: z.string(),
-	slug: z.string().nullable().optional(),
-	title: z.string().nullable().optional(),
-	description: z.string().nullable().optional(),
-	createdAt: z.string(),
-	creatorName: z.string().nullable().optional(),
-	model: z.string().nullable().optional(),
-	modelLocked: z.boolean().optional()
-});
-const platformModelSchema = z.object({
-	id: z.string(),
-	displayName: z.string(),
-	providerDisplay: z.string().optional(),
-	reasoning: z.boolean().optional(),
-	compliant: z.boolean().optional()
-}).passthrough();
-const listModelsResponseSchema = z.object({ models: z.array(platformModelSchema) });
-const updateAgentResponseSchema = z.object({ agent: z.object({ model: z.string().nullable().optional() }).passthrough() });
-const listAgentsResponseSchema = z.object({
-	agents: z.array(agentSummarySchema),
-	nextCursor: z.string().nullable().optional(),
-	totalCount: z.number().nullable().optional()
-});
-const createAgentResponseSchema = z.object({ agent: agentSummarySchema });
-const conversationSummarySchema = z.object({
-	id: z.string().uuid(),
-	title: z.string().nullable(),
-	createdAt: z.string(),
-	updatedAt: z.string(),
-	preview: z.string().nullable(),
-	channel: z.string().nullable(),
-	channelLabel: z.string().nullable(),
-	agent: z.object({
-		id: z.string().uuid(),
-		name: z.string(),
-		slug: z.string().nullable().optional(),
-		title: z.string().nullable().optional()
-	})
-});
-const conversationDetailSchema = z.object({
-	id: z.string().uuid(),
-	title: z.string().nullable(),
-	agentId: z.string().uuid(),
-	createdAt: z.string(),
-	updatedAt: z.string()
-});
-const getConversationResponseSchema = z.object({ conversation: conversationDetailSchema });
-const listConversationsResponseSchema = z.object({
-	conversations: z.array(conversationSummarySchema),
-	nextCursor: z.string().nullable().optional(),
-	totalCount: z.number().optional()
-});
-const uiMessagePartSchema = z.union([
-	z.object({
-		type: z.literal("text"),
-		text: z.string()
-	}),
-	z.object({
-		type: z.literal("reasoning"),
-		text: z.string().optional()
-	}),
-	z.object({
-		type: z.literal("dynamic-tool"),
-		toolCallId: z.string(),
-		toolName: z.string(),
-		input: z.unknown().optional(),
-		output: z.unknown().optional(),
-		state: z.string().optional(),
-		errorText: z.string().optional()
-	}),
-	z.object({ type: z.string() }).passthrough()
-]);
-const uiMessageSchema = z.object({
-	id: z.string(),
-	role: z.string(),
-	parts: z.array(uiMessagePartSchema),
-	metadata: z.object({ custom: z.object({
-		agentId: z.string().nullish(),
-		agentName: z.string().nullish()
-	}).passthrough().optional() }).passthrough().optional()
-});
-const recapResponseSchema = z.object({ recap: z.object({ text: z.string() }).nullable() });
-const listMessagesResponseSchema = z.object({ messages: z.array(uiMessageSchema) });
-const sendResultSchema = z.object({
-	runId: z.string(),
-	messageId: z.string().uuid().nullish(),
-	conversationId: z.string().uuid(),
-	isNewConversation: z.boolean(),
-	agentId: z.string().nullish(),
-	agentName: z.string().nullish(),
-	steered: z.boolean().optional(),
-	directive: z.object({ id: z.string() }).passthrough().optional()
-});
-const presignResponseSchema = z.object({
-	id: z.string(),
-	uploadUrl: z.string(),
-	fileName: z.string(),
-	mediaType: z.string()
-});
-const finalizeResponseSchema = z.object({
-	fileName: z.string(),
-	mediaType: z.string(),
-	sizeBytes: z.number().nullable().optional()
-});
-const oauthConnectResponseSchema = z.object({ connectLink: z.string() }).passthrough();
-const externalOauthConnectResponseSchema = z.object({ authorizationUrl: z.string().optional() }).passthrough();
-const runStreamEventSchema = z.union([z.object({
-	kind: z.literal("chunk"),
-	chunk: z.record(z.unknown())
-}), z.object({
-	kind: z.literal("finished"),
-	status: z.string(),
-	error: z.string().nullish()
-})]);
-const streamErrorSchema = z.object({ error: z.string() });
-const conversationStreamEventSchema = z.discriminatedUnion("kind", [z.object({
-	kind: z.literal("conversation"),
-	id: z.string(),
-	title: z.string().nullable()
-}), z.object({
-	kind: z.literal("run"),
-	runId: z.string()
-})]);
-
 //#endregion
 //#region src/commands/session.ts
 /**
@@ -1715,7 +1020,7 @@ const keysCommand = {
 //#endregion
 //#region src/commands/secrets.ts
 /** Read all of stdin as UTF-8, trimming a single trailing newline. */
-async function readStdin$1() {
+async function readStdin() {
 	const chunks = [];
 	for await (const chunk of process.stdin) chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
 	return Buffer.concat(chunks).toString("utf8").replace(/\n$/, "");
@@ -1759,7 +1064,7 @@ const setCommand = {
 				printError("No value given. Pass it as an argument or pipe it on stdin, e.g. `echo -n \"$TOKEN\" | skydive secrets set MY_KEY --agent-id <id>`.");
 				process.exit(1);
 			}
-			value = await readStdin$1();
+			value = await readStdin();
 		}
 		if (!value) {
 			printError("Empty secret value.");
@@ -1810,688 +1115,6 @@ const secretsCommand = {
 	handler: () => {}
 };
 
-//#endregion
-//#region src/chat/tui/theme.ts
-const tokyonight = {
-	id: "tokyonight",
-	label: "Tokyo Night",
-	mode: "dark",
-	palette: {
-		fg: "#c0caf5",
-		muted: "#7a7a7a",
-		dim: "#565f89",
-		faint: "#3b4261",
-		surface: "#16161e",
-		accent: "#7aa2f7",
-		success: "#9ece6a",
-		warning: "#e0af68",
-		error: "#f7768e",
-		user: "#7aa2f7",
-		assistant: "#c0caf5",
-		tool: "#bb9af7",
-		reasoning: "#565f89",
-		syntaxBlue: "#7aa2f7",
-		syntaxCyan: "#7dcfff",
-		syntaxTeal: "#73daca",
-		syntaxGreen: "#9ece6a",
-		syntaxYellow: "#e0af68",
-		syntaxOrange: "#ff9e64",
-		syntaxRed: "#f7768e",
-		syntaxMagenta: "#bb9af7"
-	}
-};
-const tokyonightDay = {
-	id: "tokyonight-day",
-	label: "Tokyo Night Day",
-	mode: "light",
-	palette: {
-		fg: "#3760bf",
-		muted: "#848cb5",
-		dim: "#9da3c2",
-		faint: "#c4c8da",
-		surface: "#d0d1d8",
-		accent: "#2e7de9",
-		success: "#587539",
-		warning: "#8c6c3e",
-		error: "#f52a65",
-		user: "#2e7de9",
-		assistant: "#3760bf",
-		tool: "#9854f1",
-		reasoning: "#848cb5",
-		syntaxBlue: "#2e7de9",
-		syntaxCyan: "#007197",
-		syntaxTeal: "#118c74",
-		syntaxGreen: "#587539",
-		syntaxYellow: "#8c6c3e",
-		syntaxOrange: "#b15c00",
-		syntaxRed: "#f52a65",
-		syntaxMagenta: "#9854f1"
-	}
-};
-const catppuccinMocha = {
-	id: "catppuccin-mocha",
-	label: "Catppuccin Mocha",
-	mode: "dark",
-	palette: {
-		fg: "#cdd6f4",
-		muted: "#7f849c",
-		dim: "#6c7086",
-		faint: "#45475a",
-		surface: "#181825",
-		accent: "#89b4fa",
-		success: "#a6e3a1",
-		warning: "#f9e2af",
-		error: "#f38ba8",
-		user: "#89b4fa",
-		assistant: "#cdd6f4",
-		tool: "#cba6f7",
-		reasoning: "#6c7086",
-		syntaxBlue: "#89b4fa",
-		syntaxCyan: "#89dceb",
-		syntaxTeal: "#94e2d5",
-		syntaxGreen: "#a6e3a1",
-		syntaxYellow: "#f9e2af",
-		syntaxOrange: "#fab387",
-		syntaxRed: "#f38ba8",
-		syntaxMagenta: "#cba6f7"
-	}
-};
-const catppuccinLatte = {
-	id: "catppuccin-latte",
-	label: "Catppuccin Latte",
-	mode: "light",
-	palette: {
-		fg: "#4c4f69",
-		muted: "#8c8fa1",
-		dim: "#9ca0b0",
-		faint: "#bcc0cc",
-		surface: "#e6e9ef",
-		accent: "#1e66f5",
-		success: "#40a02b",
-		warning: "#df8e1d",
-		error: "#d20f39",
-		user: "#1e66f5",
-		assistant: "#4c4f69",
-		tool: "#8839ef",
-		reasoning: "#9ca0b0",
-		syntaxBlue: "#1e66f5",
-		syntaxCyan: "#04a5e5",
-		syntaxTeal: "#179299",
-		syntaxGreen: "#40a02b",
-		syntaxYellow: "#df8e1d",
-		syntaxOrange: "#fe640b",
-		syntaxRed: "#d20f39",
-		syntaxMagenta: "#8839ef"
-	}
-};
-const gruvboxDark = {
-	id: "gruvbox-dark",
-	label: "Gruvbox Dark",
-	mode: "dark",
-	palette: {
-		fg: "#ebdbb2",
-		muted: "#928374",
-		dim: "#7c6f64",
-		faint: "#504945",
-		surface: "#1d2021",
-		accent: "#83a598",
-		success: "#b8bb26",
-		warning: "#fabd2f",
-		error: "#fb4934",
-		user: "#83a598",
-		assistant: "#ebdbb2",
-		tool: "#d3869b",
-		reasoning: "#7c6f64",
-		syntaxBlue: "#83a598",
-		syntaxCyan: "#8ec07c",
-		syntaxTeal: "#8ec07c",
-		syntaxGreen: "#b8bb26",
-		syntaxYellow: "#fabd2f",
-		syntaxOrange: "#fe8019",
-		syntaxRed: "#fb4934",
-		syntaxMagenta: "#d3869b"
-	}
-};
-const gruvboxLight = {
-	id: "gruvbox-light",
-	label: "Gruvbox Light",
-	mode: "light",
-	palette: {
-		fg: "#3c3836",
-		muted: "#928374",
-		dim: "#a89984",
-		faint: "#d5c4a1",
-		surface: "#ebdbb2",
-		accent: "#076678",
-		success: "#79740e",
-		warning: "#b57614",
-		error: "#9d0006",
-		user: "#076678",
-		assistant: "#3c3836",
-		tool: "#8f3f71",
-		reasoning: "#a89984",
-		syntaxBlue: "#076678",
-		syntaxCyan: "#427b58",
-		syntaxTeal: "#427b58",
-		syntaxGreen: "#79740e",
-		syntaxYellow: "#b57614",
-		syntaxOrange: "#af3a03",
-		syntaxRed: "#9d0006",
-		syntaxMagenta: "#8f3f71"
-	}
-};
-const solarizedDark = {
-	id: "solarized-dark",
-	label: "Solarized Dark",
-	mode: "dark",
-	palette: {
-		fg: "#93a1a1",
-		muted: "#586e75",
-		dim: "#586e75",
-		faint: "#073642",
-		surface: "#00212b",
-		accent: "#268bd2",
-		success: "#859900",
-		warning: "#b58900",
-		error: "#dc322f",
-		user: "#268bd2",
-		assistant: "#93a1a1",
-		tool: "#6c71c4",
-		reasoning: "#586e75",
-		syntaxBlue: "#268bd2",
-		syntaxCyan: "#2aa198",
-		syntaxTeal: "#2aa198",
-		syntaxGreen: "#859900",
-		syntaxYellow: "#b58900",
-		syntaxOrange: "#cb4b16",
-		syntaxRed: "#dc322f",
-		syntaxMagenta: "#6c71c4"
-	}
-};
-const solarizedLight = {
-	id: "solarized-light",
-	label: "Solarized Light",
-	mode: "light",
-	palette: {
-		fg: "#657b83",
-		muted: "#839496",
-		dim: "#93a1a1",
-		faint: "#eee8d5",
-		surface: "#eee8d5",
-		accent: "#268bd2",
-		success: "#859900",
-		warning: "#b58900",
-		error: "#dc322f",
-		user: "#268bd2",
-		assistant: "#657b83",
-		tool: "#6c71c4",
-		reasoning: "#93a1a1",
-		syntaxBlue: "#268bd2",
-		syntaxCyan: "#2aa198",
-		syntaxTeal: "#2aa198",
-		syntaxGreen: "#859900",
-		syntaxYellow: "#b58900",
-		syntaxOrange: "#cb4b16",
-		syntaxRed: "#dc322f",
-		syntaxMagenta: "#6c71c4"
-	}
-};
-const nord = {
-	id: "nord",
-	label: "Nord",
-	mode: "dark",
-	palette: {
-		fg: "#d8dee9",
-		muted: "#616e88",
-		dim: "#4c566a",
-		faint: "#3b4252",
-		surface: "#272c36",
-		accent: "#88c0d0",
-		success: "#a3be8c",
-		warning: "#ebcb8b",
-		error: "#bf616a",
-		user: "#88c0d0",
-		assistant: "#d8dee9",
-		tool: "#b48ead",
-		reasoning: "#4c566a",
-		syntaxBlue: "#81a1c1",
-		syntaxCyan: "#88c0d0",
-		syntaxTeal: "#8fbcbb",
-		syntaxGreen: "#a3be8c",
-		syntaxYellow: "#ebcb8b",
-		syntaxOrange: "#d08770",
-		syntaxRed: "#bf616a",
-		syntaxMagenta: "#b48ead"
-	}
-};
-const dracula = {
-	id: "dracula",
-	label: "Dracula",
-	mode: "dark",
-	palette: {
-		fg: "#f8f8f2",
-		muted: "#6272a4",
-		dim: "#6272a4",
-		faint: "#44475a",
-		surface: "#21222c",
-		accent: "#bd93f9",
-		success: "#50fa7b",
-		warning: "#ffb86c",
-		error: "#ff5555",
-		user: "#bd93f9",
-		assistant: "#f8f8f2",
-		tool: "#ff79c6",
-		reasoning: "#6272a4",
-		syntaxBlue: "#bd93f9",
-		syntaxCyan: "#8be9fd",
-		syntaxTeal: "#8be9fd",
-		syntaxGreen: "#50fa7b",
-		syntaxYellow: "#f1fa8c",
-		syntaxOrange: "#ffb86c",
-		syntaxRed: "#ff5555",
-		syntaxMagenta: "#ff79c6"
-	}
-};
-const oneDark = {
-	id: "one-dark",
-	label: "One Dark",
-	mode: "dark",
-	palette: {
-		fg: "#abb2bf",
-		muted: "#5c6370",
-		dim: "#5c6370",
-		faint: "#3e4451",
-		surface: "#21252b",
-		accent: "#61afef",
-		success: "#98c379",
-		warning: "#e5c07b",
-		error: "#e06c75",
-		user: "#61afef",
-		assistant: "#abb2bf",
-		tool: "#c678dd",
-		reasoning: "#5c6370",
-		syntaxBlue: "#61afef",
-		syntaxCyan: "#56b6c2",
-		syntaxTeal: "#56b6c2",
-		syntaxGreen: "#98c379",
-		syntaxYellow: "#e5c07b",
-		syntaxOrange: "#d19a66",
-		syntaxRed: "#e06c75",
-		syntaxMagenta: "#c678dd"
-	}
-};
-const oneLight = {
-	id: "one-light",
-	label: "One Light",
-	mode: "light",
-	palette: {
-		fg: "#383a42",
-		muted: "#a0a1a7",
-		dim: "#a0a1a7",
-		faint: "#e5e5e6",
-		surface: "#f0f0f1",
-		accent: "#4078f2",
-		success: "#50a14f",
-		warning: "#c18401",
-		error: "#e45649",
-		user: "#4078f2",
-		assistant: "#383a42",
-		tool: "#a626a4",
-		reasoning: "#a0a1a7",
-		syntaxBlue: "#4078f2",
-		syntaxCyan: "#0184bc",
-		syntaxTeal: "#0184bc",
-		syntaxGreen: "#50a14f",
-		syntaxYellow: "#c18401",
-		syntaxOrange: "#986801",
-		syntaxRed: "#e45649",
-		syntaxMagenta: "#a626a4"
-	}
-};
-const rosePine = {
-	id: "rose-pine",
-	label: "Rosé Pine",
-	mode: "dark",
-	palette: {
-		fg: "#e0def4",
-		muted: "#908caa",
-		dim: "#6e6a86",
-		faint: "#403d52",
-		surface: "#16141f",
-		accent: "#c4a7e7",
-		success: "#9ccfd8",
-		warning: "#f6c177",
-		error: "#eb6f92",
-		user: "#c4a7e7",
-		assistant: "#e0def4",
-		tool: "#ebbcba",
-		reasoning: "#908caa",
-		syntaxBlue: "#9ccfd8",
-		syntaxCyan: "#9ccfd8",
-		syntaxTeal: "#31748f",
-		syntaxGreen: "#31748f",
-		syntaxYellow: "#f6c177",
-		syntaxOrange: "#ebbcba",
-		syntaxRed: "#eb6f92",
-		syntaxMagenta: "#c4a7e7"
-	}
-};
-const rosePineDawn = {
-	id: "rose-pine-dawn",
-	label: "Rosé Pine Dawn",
-	mode: "light",
-	palette: {
-		fg: "#575279",
-		muted: "#797593",
-		dim: "#9893a5",
-		faint: "#cecacd",
-		surface: "#f2e9e1",
-		accent: "#907aa9",
-		success: "#56949f",
-		warning: "#ea9d34",
-		error: "#b4637a",
-		user: "#907aa9",
-		assistant: "#575279",
-		tool: "#d7827e",
-		reasoning: "#9893a5",
-		syntaxBlue: "#56949f",
-		syntaxCyan: "#56949f",
-		syntaxTeal: "#286983",
-		syntaxGreen: "#286983",
-		syntaxYellow: "#ea9d34",
-		syntaxOrange: "#d7827e",
-		syntaxRed: "#b4637a",
-		syntaxMagenta: "#907aa9"
-	}
-};
-const everforestDark = {
-	id: "everforest-dark",
-	label: "Everforest Dark",
-	mode: "dark",
-	palette: {
-		fg: "#d3c6aa",
-		muted: "#859289",
-		dim: "#7a8478",
-		faint: "#414b50",
-		surface: "#232a2e",
-		accent: "#7fbbb3",
-		success: "#a7c080",
-		warning: "#dbbc7f",
-		error: "#e67e80",
-		user: "#7fbbb3",
-		assistant: "#d3c6aa",
-		tool: "#d699b6",
-		reasoning: "#7a8478",
-		syntaxBlue: "#7fbbb3",
-		syntaxCyan: "#83c092",
-		syntaxTeal: "#83c092",
-		syntaxGreen: "#a7c080",
-		syntaxYellow: "#dbbc7f",
-		syntaxOrange: "#e69875",
-		syntaxRed: "#e67e80",
-		syntaxMagenta: "#d699b6"
-	}
-};
-const everforestLight = {
-	id: "everforest-light",
-	label: "Everforest Light",
-	mode: "light",
-	palette: {
-		fg: "#5c6a72",
-		muted: "#939f91",
-		dim: "#a6b0a0",
-		faint: "#e0dcc7",
-		surface: "#f4f0d9",
-		accent: "#3a94c5",
-		success: "#8da101",
-		warning: "#dfa000",
-		error: "#f85552",
-		user: "#3a94c5",
-		assistant: "#5c6a72",
-		tool: "#df69ba",
-		reasoning: "#a6b0a0",
-		syntaxBlue: "#3a94c5",
-		syntaxCyan: "#35a77c",
-		syntaxTeal: "#35a77c",
-		syntaxGreen: "#8da101",
-		syntaxYellow: "#dfa000",
-		syntaxOrange: "#f57d26",
-		syntaxRed: "#f85552",
-		syntaxMagenta: "#df69ba"
-	}
-};
-const githubDark = {
-	id: "github-dark",
-	label: "GitHub Dark",
-	mode: "dark",
-	palette: {
-		fg: "#c9d1d9",
-		muted: "#8b949e",
-		dim: "#6e7681",
-		faint: "#30363d",
-		surface: "#161b22",
-		accent: "#58a6ff",
-		success: "#3fb950",
-		warning: "#d29922",
-		error: "#f85149",
-		user: "#58a6ff",
-		assistant: "#c9d1d9",
-		tool: "#bc8cff",
-		reasoning: "#6e7681",
-		syntaxBlue: "#58a6ff",
-		syntaxCyan: "#39c5cf",
-		syntaxTeal: "#39c5cf",
-		syntaxGreen: "#3fb950",
-		syntaxYellow: "#d29922",
-		syntaxOrange: "#db6d28",
-		syntaxRed: "#f85149",
-		syntaxMagenta: "#bc8cff"
-	}
-};
-const githubLight = {
-	id: "github-light",
-	label: "GitHub Light",
-	mode: "light",
-	palette: {
-		fg: "#24292f",
-		muted: "#57606a",
-		dim: "#8c959f",
-		faint: "#d0d7de",
-		surface: "#f6f8fa",
-		accent: "#0969da",
-		success: "#1a7f37",
-		warning: "#9a6700",
-		error: "#cf222e",
-		user: "#0969da",
-		assistant: "#24292f",
-		tool: "#8250df",
-		reasoning: "#8c959f",
-		syntaxBlue: "#0969da",
-		syntaxCyan: "#1b7c83",
-		syntaxTeal: "#1b7c83",
-		syntaxGreen: "#1a7f37",
-		syntaxYellow: "#9a6700",
-		syntaxOrange: "#bc4c00",
-		syntaxRed: "#cf222e",
-		syntaxMagenta: "#8250df"
-	}
-};
-const kanagawa = {
-	id: "kanagawa",
-	label: "Kanagawa",
-	mode: "dark",
-	palette: {
-		fg: "#dcd7ba",
-		muted: "#727169",
-		dim: "#54546d",
-		faint: "#363646",
-		surface: "#16161d",
-		accent: "#7e9cd8",
-		success: "#98bb6c",
-		warning: "#e6c384",
-		error: "#e46876",
-		user: "#7e9cd8",
-		assistant: "#dcd7ba",
-		tool: "#957fb8",
-		reasoning: "#727169",
-		syntaxBlue: "#7e9cd8",
-		syntaxCyan: "#7aa89f",
-		syntaxTeal: "#7aa89f",
-		syntaxGreen: "#98bb6c",
-		syntaxYellow: "#e6c384",
-		syntaxOrange: "#ffa066",
-		syntaxRed: "#e46876",
-		syntaxMagenta: "#957fb8"
-	}
-};
-const cursorDark = {
-	id: "cursor-dark",
-	label: "Cursor Dark",
-	mode: "dark",
-	palette: {
-		background: "#181818",
-		fg: "#d4d4d4",
-		muted: "#898989",
-		dim: "#636363",
-		faint: "#272727",
-		surface: "#141414",
-		accent: "#88c0d0",
-		success: "#70b489",
-		warning: "#f1b467",
-		error: "#fc6b83",
-		diffAdded: "#3fa266",
-		diffRemoved: "#b80049",
-		diffWeight: .2,
-		user: "#88c0d0",
-		assistant: "#d4d4d4",
-		tool: "#aaa0fa",
-		reasoning: "#636363",
-		syntaxBlue: "#ebc88d",
-		syntaxCyan: "#87c3ff",
-		syntaxTeal: "#aaa0fa",
-		syntaxGreen: "#e394dc",
-		syntaxYellow: "#d4d4d4",
-		syntaxOrange: "#f8c762",
-		syntaxRed: "#cc7c8a",
-		syntaxMagenta: "#82d2ce"
-	}
-};
-const themes = [
-	tokyonight,
-	tokyonightDay,
-	catppuccinMocha,
-	catppuccinLatte,
-	gruvboxDark,
-	gruvboxLight,
-	solarizedDark,
-	solarizedLight,
-	nord,
-	dracula,
-	oneDark,
-	oneLight,
-	rosePine,
-	rosePineDawn,
-	everforestDark,
-	everforestLight,
-	githubDark,
-	githubLight,
-	kanagawa,
-	cursorDark
-];
-const DEFAULT_THEME_ID = {
-	dark: tokyonight.id,
-	light: tokyonightDay.id
-};
-/** All-undefined palette for NO_COLOR: every fg/bg falls back to the
-* terminal's own defaults, so nothing emits color. Not listed in `themes` —
-* it's forced, never picked. */
-const monoTheme = {
-	id: "mono",
-	label: "No color",
-	mode: "dark",
-	palette: {
-		fg: void 0,
-		muted: void 0,
-		dim: void 0,
-		faint: void 0,
-		surface: void 0,
-		accent: void 0,
-		success: void 0,
-		warning: void 0,
-		error: void 0,
-		user: void 0,
-		assistant: void 0,
-		tool: void 0,
-		reasoning: void 0,
-		syntaxBlue: void 0,
-		syntaxCyan: void 0,
-		syntaxTeal: void 0,
-		syntaxGreen: void 0,
-		syntaxYellow: void 0,
-		syntaxOrange: void 0,
-		syntaxRed: void 0,
-		syntaxMagenta: void 0
-	}
-};
-function themesForMode(mode) {
-	return themes.filter((t) => t.mode === mode);
-}
-function findTheme(id) {
-	if (id === monoTheme.id) return monoTheme;
-	return themes.find((t) => t.id === id);
-}
-/**
-* The saved theme to use for a mode: the persisted pick if it exists *and*
-* still matches the mode (a stale/renamed id falls back), else the default.
-*/
-function themeForMode(mode, savedId) {
-	if (savedId) {
-		const saved = findTheme(savedId);
-		if (saved && saved.mode === mode) return saved;
-	}
-	return findTheme(DEFAULT_THEME_ID[mode]) ?? tokyonight;
-}
-/** https://no-color.org — any non-empty value disables color output. */
-function noColorRequested(env = process.env) {
-	const v = env["NO_COLOR"];
-	return v !== void 0 && v !== "";
-}
-/**
-* Fallback light/dark sniff for terminals that never answer the OSC 10/11
-* query: `COLORFGBG` is "<fg>;<bg>" (sometimes "<fg>;default;<bg>") with
-* ANSI palette indexes. Background 7/15 (white/bright white) means a light
-* terminal; anything else we call dark. Returns null when unset/unparsable.
-*/
-function themeModeFromColorFgBg(env = process.env) {
-	const raw = env["COLORFGBG"];
-	if (!raw) return null;
-	const parts = raw.split(";");
-	const bg = parts[parts.length - 1];
-	if (bg === void 0 || !/^\d+$/.test(bg)) return null;
-	const idx = Number(bg);
-	return idx === 7 || idx === 15 ? "light" : "dark";
-}
-/** Single source of truth for colors. Mutated in place by `applyTheme` so
-* existing `theme.fg`-style reads across the TUI stay valid. */
-const theme = { ...tokyonight.palette };
-let version = 0;
-function themeVersion() {
-	return version;
-}
-let mode = tokyonight.mode;
-function themeMode() {
-	return mode;
-}
-function applyTheme(def) {
-	Object.assign(theme, def.palette);
-	theme.background = def.palette.background;
-	theme.diffAdded = def.palette.diffAdded;
-	theme.diffRemoved = def.palette.diffRemoved;
-	theme.diffWeight = def.palette.diffWeight;
-	mode = def.mode;
-	version++;
-}
-
 //#endregion
 //#region src/chat/bun-runtime.ts
 /**
@@ -2793,7 +1416,7 @@ const chatCommand = {
 			printError(`Unknown theme "${themeId}". Valid themes: ${themes.map((t) => t.id).join(", ")}`);
 			process.exit(1);
 		}
-		const { runChat } = await import("./boot-DML2xNb6.mjs");
+		const { runChat } = await import("./boot-CMhIv1BG.mjs");
 		await runChat({
 			appUrl,
 			sessionToken: session.value.sessionToken,
@@ -2820,7 +1443,7 @@ async function runPrintMode({ argv, appUrl }) {
 		printError(`${session.error.message} For non-interactive use, run \`skydive auth login\` first, or set SKYDIVE_SESSION_TOKEN.`);
 		process.exit(1);
 	}
-	const { runPrint, readStdin } = await Promise.resolve().then(() => print_exports);
+	const { runPrint, readStdin } = await import("./print-DFPzQQk8.mjs");
 	let prompt = (argv.print ?? "").trim();
 	if (!prompt) {
 		if (process.stdin.isTTY) {
@@ -2835,7 +1458,7 @@ async function runPrintMode({ argv, appUrl }) {
 	}
 	let machineShare = null;
 	if (resolveShareMachine(argv)) {
-		const { PortalClient } = await import("./client-XFsd0Wy9.mjs").then((n) => n.n);
+		const { PortalClient } = await import("./client-C-s6b9Yu.mjs");
 		let signalConnected;
 		const connected = new Promise((resolve) => {
 			signalConnected = resolve;
@@ -2908,7 +1531,7 @@ const getCommand = {
 			printError(`${session.error.message} Run \`skydive auth login\` first, or set SKYDIVE_SESSION_TOKEN.`);
 			process.exit(1);
 		}
-		const { messageGet } = await Promise.resolve().then(() => print_exports);
+		const { messageGet } = await import("./print-DFPzQQk8.mjs");
 		try {
 			const result = await messageGet({
 				appUrl,
@@ -2930,488 +1553,6 @@ const messagesCommand = {
 	handler: () => {}
 };
 
-//#endregion
-//#region src/chat/util.ts
-/** Narrowing helper for the many `unknown` payloads the chat stream and
-* tool inputs/outputs carry. A type predicate (not an `as` cast), so call
-* sites can read properties without asserting. */
-function isRecord(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-/** Best-effort message from an unknown thrown value. */
-function errorMessage(err) {
-	return err instanceof Error ? err.message : String(err);
-}
-
-//#endregion
-//#region src/chat/tui/chat/card.ts
-const urlActionKinds = [
-	"open_oauth",
-	"open_external_oauth",
-	"open_github_app",
-	"submit_credential"
-];
-function isUrlActionKind(value) {
-	return typeof value === "string" && urlActionKinds.includes(value);
-}
-function optionalString(value) {
-	return typeof value === "string" && value ? value : null;
-}
-function bindStateKey(props) {
-	const value = props.value;
-	if (!isRecord(value)) return null;
-	const pointer = value.$bindState;
-	if (typeof pointer !== "string") return null;
-	return pointer.startsWith("/") ? pointer.slice(1) : pointer;
-}
-function parseButton(element) {
-	const props = isRecord(element.props) ? element.props : {};
-	const label = optionalString(props.label) ?? "Connect";
-	const on = isRecord(element.on) ? element.on : null;
-	const press = on && isRecord(on.press) ? on.press : null;
-	if (!press) return null;
-	const params = isRecord(press.params) ? press.params : {};
-	const primary = props.variant === "primary";
-	if (press.action === "approve_portal_access") {
-		const agentId = params.agentId;
-		if (typeof agentId !== "string" || !agentId) return null;
-		return {
-			label,
-			action: {
-				kind: "grant_portal",
-				agentId,
-				deviceId: typeof params.deviceId === "string" && params.deviceId ? params.deviceId : null
-			},
-			primary
-		};
-	}
-	if (!isUrlActionKind(press.action)) return null;
-	const url = params.url;
-	if (typeof url !== "string" || !url) return null;
-	return {
-		label,
-		action: {
-			kind: press.action,
-			url
-		},
-		primary
-	};
-}
-function parseConnectCard(spec) {
-	if (!isRecord(spec)) return null;
-	const { root, elements } = spec;
-	if (typeof root !== "string" || !isRecord(elements)) return null;
-	const rootEl = elements[root];
-	if (!isRecord(rootEl) || rootEl.type !== "Card") return null;
-	const rootProps = isRecord(rootEl.props) ? rootEl.props : {};
-	const title = optionalString(rootProps.title);
-	if (!title) return null;
-	const fields = [];
-	const buttons = [];
-	const children = Array.isArray(rootEl.children) ? rootEl.children : [];
-	for (const childId of children) {
-		if (typeof childId !== "string") continue;
-		const el = elements[childId];
-		if (!isRecord(el)) continue;
-		if (el.type === "TextInput" || el.type === "SecretInput") {
-			const props = isRecord(el.props) ? el.props : {};
-			const key = bindStateKey(props);
-			if (!key) continue;
-			fields.push({
-				key,
-				label: optionalString(props.label) ?? key,
-				placeholder: optionalString(props.placeholder),
-				secret: el.type === "SecretInput"
-			});
-			continue;
-		}
-		if (el.type === "Button") {
-			const button = parseButton(el);
-			if (button) buttons.push(button);
-		}
-	}
-	const preferred = buttons.find((b) => b.primary) ?? buttons[0] ?? null;
-	return {
-		title,
-		subtitle: optionalString(rootProps.subtitle),
-		description: optionalString(rootProps.description),
-		fields,
-		button: preferred ? {
-			label: preferred.label,
-			action: preferred.action
-		} : null,
-		state: isRecord(spec.state) ? spec.state : {}
-	};
-}
-
-//#endregion
-//#region src/chat/tui/chat/card-actions.ts
-function safeUrl(url) {
-	try {
-		return new URL(url, "http://localhost");
-	} catch (_error) {
-		return null;
-	}
-}
-/**
-* Resolve a connect URL to an absolute one the OS can open in a browser.
-*
-* The server builds lazy connect links as server-relative paths (e.g.
-* `/api/v1/oauth/start/slack?connect_session_token=...`). The web client
-* resolves these against its own origin implicitly; the TUI runs outside a
-* browser, so `open()` on a scheme-less path is a silent no-op — the browser
-* never launches and the connect card sits in `launched` forever (the Slack
-* channel-connect deadlock). Resolve against `appUrl` first, mirroring the
-* `open_github_app` / `fulfillCredential` branches, so both the browser we
-* launch and the URL shown on the card are absolute. An already-absolute URL
-* passes through unchanged; if `appUrl` is missing we return the input as-is.
-*/
-function resolveConnectUrl(url, appUrl) {
-	if (!appUrl) return url;
-	try {
-		return new URL(url, appUrl).toString();
-	} catch (_error) {
-		return url;
-	}
-}
-function parseOauthConnectParams(url) {
-	const parsed = safeUrl(url);
-	if (!parsed) return null;
-	const integrationKey = parsed.searchParams.get("integration");
-	const agentId = parsed.searchParams.get("agent_id");
-	const authConfigId = parsed.searchParams.get("auth_config_id");
-	const conversationId = parsed.searchParams.get("conversation_id");
-	if (!integrationKey || !agentId || !authConfigId || !conversationId) return null;
-	return {
-		integrationKey,
-		agentId,
-		authConfigId,
-		conversationId,
-		scopes: parsed.searchParams.get("scopes")
-	};
-}
-function parseExternalOauthConnectParams(url) {
-	const parsed = safeUrl(url);
-	if (!parsed) return null;
-	const agentId = parsed.searchParams.get("agent_id");
-	const conversationId = parsed.searchParams.get("conversation_id");
-	const serverUrl = parsed.searchParams.get("server_url");
-	if (!agentId || !conversationId || !serverUrl) return null;
-	return {
-		agentId,
-		conversationId,
-		serverUrl
-	};
-}
-/**
-* A short human line for a failed card action. Fulfill/connect endpoints
-* return `{ error: string }` bodies (e.g. "already fulfilled") — prefer that
-* over the generic HttpError message.
-*/
-function cardActionErrorMessage(err) {
-	if (err instanceof HttpError) {
-		try {
-			const parsed = JSON.parse(err.body);
-			if (isRecord(parsed) && typeof parsed.error === "string") return parsed.error;
-		} catch (_error) {}
-		return `request failed (HTTP ${err.status})`;
-	}
-	return errorMessage(err);
-}
-const MASK_CHAR = "•";
-/**
-* Recover the real secret from the masked input's displayed text. The input
-* is controlled: after every edit we render bullets, which forces the cursor
-* to the end, so the next edit is always a tail edit — the displayed text is
-* some prefix of the old mask (kept characters) followed by newly typed or
-* pasted plaintext. Characters beyond the retained bullets are the new tail.
-*/
-function reconcileMaskedInput(previousValue, displayed) {
-	let kept = 0;
-	while (kept < displayed.length && kept < previousValue.length && displayed[kept] === MASK_CHAR) kept++;
-	return previousValue.slice(0, kept) + displayed.slice(kept);
-}
-
-//#endregion
-//#region src/chat/connect-cards.ts
-/**
-* Turn a parsed ConnectCard into the headless summary, resolving any relative
-* connect URL against the app origin so the emitted URL is directly openable.
-*/
-function summarizeConnectCard(card, appUrl) {
-	const base = {
-		title: card.title,
-		subtitle: card.subtitle,
-		description: card.description
-	};
-	const button = card.button;
-	if (!button) return {
-		...base,
-		action: { kind: "unsupported" }
-	};
-	const act = button.action;
-	switch (act.kind) {
-		case "open_oauth":
-		case "open_external_oauth":
-		case "open_github_app": return {
-			...base,
-			action: {
-				kind: "open_url",
-				url: resolveConnectUrl(act.url, appUrl)
-			}
-		};
-		case "submit_credential": return {
-			...base,
-			action: {
-				kind: "submit_credential",
-				url: resolveConnectUrl(act.url, appUrl),
-				fields: card.fields.map((f) => f.label)
-			}
-		};
-		case "grant_portal": return {
-			...base,
-			action: {
-				kind: "approve_portal",
-				agentId: act.agentId
-			}
-		};
-		default: return {
-			...base,
-			action: { kind: "unsupported" }
-		};
-	}
-}
-/**
-* Parse a `data-anyone-render-spec` stream chunk into a connect-card summary,
-* or null if the chunk isn't a connect card (other render specs — training,
-* deep-learn, compute-request — parse to null, same as the TUI).
-*/
-function connectCardFromChunk(chunk, appUrl) {
-	if (chunk["type"] !== "data-anyone-render-spec") return null;
-	const data = chunk["data"];
-	if (!isRecord(data)) return null;
-	const card = parseConnectCard(data["spec"]);
-	if (!card) return null;
-	return summarizeConnectCard(card, appUrl);
-}
-/** Render a connect-card summary as a human-readable action block. */
-function formatConnectCard(card) {
-	const lines = [];
-	lines.push(`\n[action needed] ${card.title}`);
-	if (card.subtitle) lines.push(card.subtitle);
-	if (card.description) lines.push(card.description);
-	switch (card.action.kind) {
-		case "open_url":
-			lines.push(`Open to continue: ${card.action.url}`);
-			break;
-		case "submit_credential":
-			lines.push(`Provide credential (${card.action.fields.join(", ") || "value"}) at: ${card.action.url}`);
-			break;
-		case "approve_portal":
-			lines.push(`Approve local-machine access for agent ${card.action.agentId} in the TUI or web app.`);
-			break;
-		case "unsupported":
-			lines.push("Open this conversation in the web app to continue.");
-			break;
-	}
-	return lines.join("\n");
-}
-
-//#endregion
-//#region src/chat/print.ts
-var print_exports = /* @__PURE__ */ __exportAll({
-	collectRunText: () => collectRunText,
-	messageGet: () => messageGet,
-	readStdin: () => readStdin,
-	resolveAgent: () => resolveAgent,
-	runPrint: () => runPrint,
-	toPrintError: () => toPrintError
-});
-/**
-* Non-interactive chat, à la `claude -p`. Sends a single prompt to an
-* agent, streams the run, and prints the assistant's reply to stdout
-* before exiting. No OpenTUI, no Bun requirement — this rides the same
-* Node-friendly REST client the TUI uses, so it runs anywhere the
-* management commands do (CI, pipes, scripts).
-*
-* Resolution rules kept deliberately strict because there's no human to
-* disambiguate: an `--agent` selector must match exactly one agent, and
-* when it's omitted we only auto-pick if the account has exactly one.
-*/
-async function runPrint({ appUrl, sessionToken, prompt, agentSelector, conversationId, json, machineShare, grantTargetAgent }) {
-	const client = createRestClient({
-		appUrl,
-		sessionToken
-	});
-	const agent = resolveAgent(await client.listAgents({
-		scope: "org",
-		onPage: null
-	}), agentSelector);
-	if (machineShare) {
-		if (!machineShare.isGranted(agent.id) && grantTargetAgent) await machineShare.grantAgent(agent.id);
-		if (machineShare.isGranted(agent.id)) console.error(`portal: shared this machine with ${agent.name} for this run (grant persists until revoked)`);
-		else console.error(`portal: this machine is shared (shareMachineDefault), but ${agent.name} has no grant — approve its request, or run \`skydive portal grant --agent ${agent.name}\`.`);
-	}
-	let send;
-	try {
-		send = await client.sendMessage({
-			agentId: agent.id,
-			conversationId,
-			content: prompt,
-			attachmentIds: [],
-			clientSurface: "cli"
-		});
-	} catch (err) {
-		throw toPrintError(err);
-	}
-	const { text, connectCards } = await collectRunText({
-		client,
-		appUrl,
-		target: {
-			kind: "run",
-			id: send.runId
-		},
-		onText: json ? null : (delta) => process.stdout.write(delta),
-		messageIdForHint: send.messageId ?? null
-	});
-	if (!json && text && !text.endsWith("\n")) process.stdout.write("\n");
-	if (!json) for (const card of connectCards) process.stdout.write(`${formatConnectCard(card)}\n`);
-	return {
-		agentId: agent.id,
-		agentName: agent.name,
-		conversationId: send.conversationId,
-		isNewConversation: send.isNewConversation,
-		messageId: send.messageId ?? null,
-		text,
-		connectCards
-	};
-}
-/**
-* Turn a transport failure into an actionable CLI error. A Cloudflare edge
-* 5xx (502/504) on a long run otherwise leaks a raw HTML/JSON error page to
-* stdout, which is impossible to act on. When a messageId is known and
-* recoverable we point the user at `skydive messages get <messageId>` rather
-* than a blind retry (a retry re-executes an agent that may have write access).
-*/
-function toPrintError(err, messageId) {
-	if (err instanceof HttpError && err.status >= 500) {
-		const recovery = messageId ? ` The run may still be completing server-side. Do NOT blindly retry (it would re-run the agent). Fetch the result with: skydive messages get ${messageId}` : "";
-		return /* @__PURE__ */ new Error(`The request to Skydive timed out at the edge (HTTP ${err.status}).${recovery}`);
-	}
-	return err instanceof Error ? err : new Error(String(err));
-}
-/**
-* Stream a run to completion, folding text-delta chunks into the reply and
-* collecting any connect cards (OAuth / MCP / credential requests) the run
-* posts. Shared by `chat -p` (streaming the run it just created) and `messages
-* get` (re-attaching by message id — the server replays a finished run from its
-* persisted log, so this works whether the run is live or already done).
-*/
-async function collectRunText({ client, appUrl, target, onText, messageIdForHint }) {
-	let text = "";
-	const controller = new AbortController();
-	let streamError = null;
-	const connectCards = [];
-	const onEvent = (event) => {
-		if (event.kind === "finished") {
-			if (event.error) streamError = event.error;
-			return;
-		}
-		const chunk = event.chunk;
-		if (chunk["type"] === "text-delta") {
-			const delta = typeof chunk["delta"] === "string" ? chunk["delta"] : typeof chunk["text"] === "string" ? chunk["text"] : "";
-			if (delta) {
-				text += delta;
-				if (onText) onText(delta);
-			}
-		} else if (chunk["type"] === "error") streamError = typeof chunk["errorText"] === "string" ? chunk["errorText"] : "unknown error";
-		else {
-			const card = connectCardFromChunk(chunk, appUrl);
-			if (card) connectCards.push(card);
-		}
-	};
-	try {
-		if (target.kind === "message") await client.streamMessage({
-			messageId: target.id,
-			signal: controller.signal,
-			onEvent
-		});
-		else await client.streamRun({
-			runId: target.id,
-			signal: controller.signal,
-			onEvent
-		});
-	} catch (err) {
-		throw toPrintError(err, messageIdForHint);
-	}
-	if (streamError) throw new Error(streamError);
-	return {
-		text,
-		connectCards
-	};
-}
-/**
-* Re-attach to an exchange by message id and print its reply. Backs `skydive
-* messages get <messageId>` — the recovery path when a `chat -p` stream dropped
-* at the edge after the message was accepted. The server resolves the run
-* behind the message and replays it from its persisted event log, so this
-* returns the full reply whether the run is still live or already done.
-*/
-async function messageGet({ appUrl, sessionToken, messageId, json }) {
-	const { text, connectCards } = await collectRunText({
-		client: createRestClient({
-			appUrl,
-			sessionToken
-		}),
-		appUrl,
-		target: {
-			kind: "message",
-			id: messageId
-		},
-		onText: json ? null : (delta) => process.stdout.write(delta),
-		messageIdForHint: null
-	});
-	if (!json && text && !text.endsWith("\n")) process.stdout.write("\n");
-	if (!json) for (const card of connectCards) process.stdout.write(`${formatConnectCard(card)}\n`);
-	return {
-		messageId,
-		text,
-		connectCards
-	};
-}
-/**
-* Pick the target agent. With no selector, auto-pick only when the
-* account has exactly one agent; otherwise the user must name one (there's
-* no picker in non-interactive mode). A selector matches by id first, then
-* a unique case-insensitive slug/name; ambiguous or missing matches throw
-* with the candidate list so the caller knows what to pass.
-*/
-function resolveAgent(agents, selector) {
-	if (!selector) {
-		const [only, ...rest] = agents;
-		if (!only) throw new Error("No agents on this account.");
-		if (rest.length === 0) return only;
-		throw new Error(`Multiple agents on this account — pass --agent <id|slug|name>. Candidates:\n${formatCandidates(agents)}`);
-	}
-	const byId = agents.find((a) => a.id === selector);
-	if (byId) return byId;
-	const needle = selector.toLowerCase();
-	const matches = agents.filter((a) => a.slug && a.slug.toLowerCase() === needle || a.name.toLowerCase() === needle);
-	const [firstMatch, ...restMatches] = matches;
-	if (firstMatch && restMatches.length === 0) return firstMatch;
-	if (restMatches.length > 0) throw new Error(`Multiple agents match "${selector}" — pass the id instead. Candidates:\n${formatCandidates(matches)}`);
-	throw new Error(`No agent matches "${selector}". Candidates:\n${formatCandidates(agents)}`);
-}
-function formatCandidates(agents) {
-	return agents.slice(0, 25).map((a) => `  ${a.id}  ${a.slug ?? a.name}`).join("\n");
-}
-/** Read all of stdin as UTF-8. Used when `-p` is passed with no value. */
-async function readStdin() {
-	const chunks = [];
-	for await (const chunk of process.stdin) chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
-	return Buffer.concat(chunks).toString("utf8");
-}
-
 //#endregion
 //#region src/commands/conversations.ts
 /**
@@ -3587,7 +1728,7 @@ const switchCommand = {
 				printError("The workspace picker needs the Bun runtime and it could not be set up automatically. Pass a workspace slug instead, or install Bun and retry.");
 				process.exit(1);
 			}
-			const { runWorkspacePicker } = await import("./boot-DML2xNb6.mjs");
+			const { runWorkspacePicker } = await import("./boot-CMhIv1BG.mjs");
 			await runWorkspacePicker(session);
 			return;
 		}
@@ -3624,145 +1765,6 @@ const workspaceCommand = {
 	handler: (argv) => runList(argv, { hint: true })
 };
 
-//#endregion
-//#region src/chat/portal/machine.ts
-/**
-* Identity this machine registers under when the CLI shares it via the portal.
-*
-* The `-cli` suffix / `(CLI)` label keep a CLI-shared machine a DISTINCT portal
-* device from the same host's Skydive Desktop app. `portal_device` is unique on
-* (org, user, machineName), and directives route to whichever socket holds the
-* device — if the CLI and desktop registered the same name they'd share a
-* device row and both execute every directive. Distinct names also make the
-* grant UI unambiguous about which surface is being authorized.
-*/
-function machineIdentity() {
-	const host = (os.hostname() || "machine").trim().replace(/\.local$/i, "") || "machine";
-	return {
-		machineName: `${host}-cli`,
-		friendlyName: `${host} (CLI)`
-	};
-}
-const INHERITED_ENV = [
-	"HOME",
-	"USER",
-	"LOGNAME",
-	"SHELL",
-	"LANG",
-	"LC_ALL",
-	"TMPDIR",
-	"TERM",
-	"PATH"
-];
-function buildEnv(extra) {
-	const env = {};
-	for (const key of INHERITED_ENV) {
-		const value = process.env[key];
-		if (value !== void 0) env[key] = value;
-	}
-	if (extra) for (const [key, value] of Object.entries(extra)) env[key] = value;
-	return env;
-}
-/**
-* Build the desktop-portal WebSocket URL from the chat origin. Mirrors the Rust
-* desktop client: http→ws, https→wss, scheme-less defaults to wss, and the
-* machine/label ride as query pairs (percent-encoded by URL).
-*/
-function portalWsUrl(appUrl, machine, label) {
-	const base = appUrl.replace(/\/+$/, "");
-	let wsBase;
-	if (base.startsWith("https://")) wsBase = `wss://${base.slice(8)}`;
-	else if (base.startsWith("http://")) wsBase = `ws://${base.slice(7)}`;
-	else wsBase = `wss://${base}`;
-	const url = new URL(`${wsBase}/api/v1/portal/desktop`);
-	url.searchParams.set("machine", machine);
-	url.searchParams.set("label", label);
-	return url.toString();
-}
-
-//#endregion
-//#region src/chat/portal/api.ts
-/**
-* The portal's session-authed REST surface, shared by `PortalClient` (the
-* TUI/`portal open` connection) and the `skydive portal` management
-* commands, so the endpoint contracts and response schemas live in exactly
-* one place.
-*/
-const deviceSchema = z.object({
-	id: z.string(),
-	machineName: z.string(),
-	friendlyName: z.string(),
-	connected: z.boolean(),
-	lastSeen: z.string().nullable(),
-	grantedAgentIds: z.array(z.string())
-});
-const devicesResponseSchema = z.object({
-	devices: z.array(deviceSchema),
-	agents: z.array(z.object({
-		id: z.string(),
-		name: z.string()
-	}))
-});
-const deviceTokenSchema = z.object({ token: z.string().min(1) });
-async function portalFetch(auth, path, init) {
-	const res = await fetch(`${auth.appUrl}${path}`, {
-		method: init.method,
-		headers: {
-			authorization: `Bearer ${auth.sessionToken}`,
-			accept: "application/json",
-			...init.body ? { "content-type": "application/json" } : {}
-		},
-		...init.body ? { body: init.body } : {}
-	});
-	if (!res.ok) {
-		const body = await res.text().catch(() => "");
-		throw new HttpError(res.status, body);
-	}
-	return res.json();
-}
-async function fetchPortalDevices(auth) {
-	const json = await portalFetch(auth, "/api/v1/portal/devices", { method: "GET" });
-	return devicesResponseSchema.parse(json);
-}
-const registerResponseSchema = z.object({ device: z.object({ id: z.string() }) });
-/**
-* Register this machine's device row without connecting. Connecting registers
-* as a side effect; this covers granting an agent on a machine that has never
-* shared yet (the grant references the device row).
-*/
-async function registerPortalDevice(auth, { machineName, friendlyName }) {
-	const json = await portalFetch(auth, "/api/v1/portal/devices", {
-		method: "POST",
-		body: JSON.stringify({
-			machineName,
-			friendlyName
-		})
-	});
-	return registerResponseSchema.parse(json).device;
-}
-/** Short-lived token the machine presents when dialing the portal WebSocket. */
-async function mintPortalDeviceToken(auth) {
-	const json = await portalFetch(auth, "/api/v1/portal/device-token", { method: "POST" });
-	return deviceTokenSchema.parse(json).token;
-}
-async function grantPortalAccess(auth, { deviceId, agentId }) {
-	await portalFetch(auth, `/api/v1/portal/devices/${encodeURIComponent(deviceId)}/grants`, {
-		method: "POST",
-		body: JSON.stringify({ agentId })
-	});
-}
-async function revokePortalAccess(auth, { deviceId, agentId }) {
-	await portalFetch(auth, `/api/v1/portal/devices/${encodeURIComponent(deviceId)}/grants/${encodeURIComponent(agentId)}`, { method: "DELETE" });
-}
-/**
-* The device row for a given machine identity. Matching is by `machineName`
-* equality — the stable per-surface handle (`<host>-cli` vs the desktop's
-* `<host>`), not the display label.
-*/
-function findThisDevice(devices, machineName) {
-	return devices.find((device) => device.machineName === machineName) ?? null;
-}
-
 //#endregion
 //#region src/commands/portal.ts
 /**
@@ -3804,7 +1806,7 @@ const openCommand = {
 		const agent = argv.agent ? resolveAgent((await fetchPortalDevices(session)).agents, argv.agent) : null;
 		const cwd = argv.cwd ? path.resolve(argv.cwd) : process.cwd();
 		const { machineName } = machineIdentity();
-		const { PortalClient } = await import("./client-XFsd0Wy9.mjs").then((n) => n.n);
+		const { PortalClient } = await import("./client-C-s6b9Yu.mjs");
 		let lastLine = "";
 		let signalConnected;
 		const connected = new Promise((resolve) => {
@@ -3935,171 +1937,6 @@ const portalCommand = {
 	handler: () => {}
 };
 
-//#endregion
-//#region ../sandbox-stream-protocol/src/index.ts
-const SANDBOX_STREAM_PATH = "/api/v1/sandbox/stream";
-const FRAME = {
-	DATA: 1,
-	EXIT: 2,
-	ERROR: 3,
-	INPUT: 16,
-	RESIZE: 17
-};
-const MAX_INPUT_BYTES = 1 * 1024 * 1024;
-/** Query params for the upgrade URL, from a spec. Inverse of {@link parseStreamSpec}. */
-function streamSpecToQuery(spec) {
-	if (spec.mode === "pty") return {
-		agentId: spec.agentId,
-		mode: "pty",
-		cols: String(spec.cols),
-		rows: String(spec.rows)
-	};
-	return {
-		agentId: spec.agentId,
-		mode: "exec",
-		command: spec.command
-	};
-}
-function withType(type, payload) {
-	const frame = new Uint8Array(1 + payload.length);
-	frame[0] = type;
-	frame.set(payload, 1);
-	return frame;
-}
-/** client → server: keystroke bytes for the pty stdin. */
-function encodeInput(data) {
-	return withType(FRAME.INPUT, data);
-}
-/** client → server: the client terminal was resized. */
-function encodeResize(cols, rows) {
-	const frame = new Uint8Array(5);
-	frame[0] = FRAME.RESIZE;
-	const view = new DataView(frame.buffer);
-	view.setUint16(1, cols & 65535);
-	view.setUint16(3, rows & 65535);
-	return frame;
-}
-const view = (frame) => new DataView(frame.buffer, frame.byteOffset, frame.byteLength);
-/**
-* Decode a frame the server sent. Returns null for an empty, unknown, or
-* truncated frame — a peer speaking a newer protocol must not crash us.
-*/
-function decodeServerFrame(frame) {
-	const payload = frame.subarray(1);
-	switch (frame[0]) {
-		case FRAME.DATA: return {
-			type: "data",
-			payload
-		};
-		case FRAME.EXIT: return {
-			type: "exit",
-			code: payload.length >= 4 ? view(frame).getInt32(1) : 0
-		};
-		case FRAME.ERROR: return {
-			type: "error",
-			message: new TextDecoder().decode(payload)
-		};
-		default: return null;
-	}
-}
-
-//#endregion
-//#region src/chat/sandbox/client.ts
-function wsBase(appUrl) {
-	const base = appUrl.replace(/\/+$/, "");
-	if (base.startsWith("https://")) return `wss://${base.slice(8)}`;
-	if (base.startsWith("http://")) return `ws://${base.slice(7)}`;
-	return `wss://${base}`;
-}
-/**
-* A connected sandbox-stream session. Construct via `openSandboxStream`. Carries
-* the write side (keystrokes / resize for pty mode) and teardown.
-*/
-var SandboxStream = class SandboxStream {
-	ws;
-	closed = false;
-	constructor(ws, onEvent) {
-		this.ws = ws;
-		let ended = false;
-		const emitEnd = (event) => {
-			if (ended) return;
-			ended = true;
-			onEvent(event);
-		};
-		ws.on("message", (data, isBinary) => {
-			if (!isBinary) return;
-			const frame = decodeServerFrame(toBuffer(data));
-			if (!frame) return;
-			switch (frame.type) {
-				case "data":
-					onEvent({
-						type: "data",
-						bytes: new Uint8Array(frame.payload)
-					});
-					break;
-				case "exit":
-					emitEnd({
-						type: "exit",
-						code: frame.code
-					});
-					break;
-				case "error":
-					emitEnd({
-						type: "error",
-						message: frame.message
-					});
-					break;
-			}
-		});
-		let failure = null;
-		ws.on("error", (err) => {
-			failure = err.message;
-		});
-		ws.on("close", () => {
-			this.closed = true;
-			emitEnd({
-				type: "close",
-				failure
-			});
-		});
-	}
-	/** Feed keystroke bytes to the pty stdin. */
-	sendInput(data) {
-		if (this.closed || this.ws.readyState !== WebSocket.OPEN) return;
-		this.ws.send(encodeInput(data));
-	}
-	/** Notify the pty of a terminal resize. */
-	resize(cols, rows) {
-		if (this.closed || this.ws.readyState !== WebSocket.OPEN) return;
-		this.ws.send(encodeResize(cols, rows));
-	}
-	close() {
-		this.closed = true;
-		this.ws.close();
-	}
-	/** Open a stream. `mode` is 'pty' (interactive) or 'exec' (one-shot). */
-	static open(opts) {
-		const spec = opts.mode === "pty" ? {
-			mode: "pty",
-			agentId: opts.agentId,
-			cols: opts.cols,
-			rows: opts.rows
-		} : {
-			mode: "exec",
-			agentId: opts.agentId,
-			command: opts.command
-		};
-		const url = new URL(`${wsBase(opts.appUrl)}${SANDBOX_STREAM_PATH}`);
-		for (const [key, value] of Object.entries(streamSpecToQuery(spec))) url.searchParams.set(key, value);
-		return new SandboxStream(new WebSocket(url.toString(), { headers: { authorization: `Bearer ${opts.sessionToken}` } }), opts.onEvent);
-	}
-};
-function toBuffer(data) {
-	if (Buffer.isBuffer(data)) return data;
-	if (Array.isArray(data)) return Buffer.concat(data);
-	return Buffer.from(data);
-}
-
 //#endregion
 //#region src/commands/sandbox.ts
 /** POSIX single-quote one word so the remote shell treats it as one token. */
@@ -4141,8 +1978,8 @@ const sandboxCommand = {
 	}).example("skydive sandbox --agent grace", "Live terminal (Ctrl-] detaches)").example("skydive sandbox --agent grace -- tail -n 50 /tmp/harness.log", "One-shot command (use `--` so its flags reach the sandbox)").example("skydive sandbox --agent grace -- sh -c 'ls /tmp | wc -l'", "Shell features go through an explicit `sh -c`"),
 	handler: async (argv) => {
 		const session = requireSession(argv);
-		const { createRestClient } = await Promise.resolve().then(() => rest_exports);
-		const { resolveAgent } = await Promise.resolve().then(() => print_exports);
+		const { createRestClient } = await import("./rest-DQruM5kj.mjs");
+		const { resolveAgent } = await import("./print-DFPzQQk8.mjs");
 		const client = createRestClient({
 			appUrl: session.appUrl,
 			sessionToken: session.sessionToken
@@ -4211,7 +2048,7 @@ async function runPty({ session, agentId, agentName }) {
 		return 1;
 	}
 	console.error(`Connecting to ${agentName}'s sandbox… (Ctrl-] detaches)`);
-	const { runRawPtyPassthrough } = await import("./raw-pty-C1DXKms6.mjs").then((n) => n.t);
+	const { runRawPtyPassthrough } = await import("./raw-pty-pspO57gT.mjs");
 	const result = await runRawPtyPassthrough({
 		stdin: process.stdin,
 		stdout: process.stdout,
@@ -4240,7 +2077,7 @@ function createCli(argv) {
 		type: "string",
 		global: true,
 		describe: "Override API base URL"
-	}).command(authCommand).command(chatCommand).command(messagesCommand).command(conversationsCommand).command(agentsCommand).command(keysCommand).command(secretsCommand).command(workspaceCommand).command(portalCommand).command(sandboxCommand).demandCommand(1, "Specify a command. Run --help for usage.").strict().wrap(null).version(version$1).alias("v", "version").alias("h", "help").help().fail((msg, err) => {
+	}).command(authCommand).command(chatCommand).command(messagesCommand).command(conversationsCommand).command(agentsCommand).command(keysCommand).command(secretsCommand).command(workspaceCommand).command(portalCommand).command(sandboxCommand).demandCommand(1, "Specify a command. Run --help for usage.").strict().wrap(null).version(version).alias("v", "version").alias("h", "help").help().fail((msg, err) => {
 		printError(err ? err instanceof Error ? err.message : String(err) : msg ?? "Unknown error");
 		process.exit(1);
 	});
@@ -4309,9 +2146,250 @@ function resolveArgv(args, tty = {
 	return shouldDefaultToChat(args, tty, nonInteractive) ? ["chat", ...args] : args;
 }
 
+//#endregion
+//#region src/update-check/cache.ts
+/**
+* The on-disk state behind the update check: a single small JSON file the
+* fast path reads synchronously on every command and the background worker
+* rewrites after a successful fetch. Every read tolerates a missing, torn,
+* or type-mangled file (each field validates independently), and a failed
+* write is silently skipped — the cache must never break a command.
+*/
+const CHECK_INTERVAL_MS = 1440 * 60 * 1e3;
+const cacheSchema = z.object({
+	lastCheckedAt: z.string().optional().catch(void 0),
+	channel: z.string().optional().catch(void 0),
+	latestVersion: z.string().optional().catch(void 0)
+});
+/** Beside config.json so all CLI state shares one directory (and the
+* `SKYDIVE_CONFIG_NAME` profile isolation). */
+function getUpdateCachePath() {
+	return path.join(path.dirname(getConfigPath()), "update-check.json");
+}
+function readUpdateCache() {
+	try {
+		const raw = fs.readFileSync(getUpdateCachePath(), "utf8");
+		return cacheSchema.parse(JSON.parse(raw));
+	} catch (_error) {
+		return {};
+	}
+}
+function writeUpdateCache(cache) {
+	try {
+		const file = getUpdateCachePath();
+		fs.mkdirSync(path.dirname(file), { recursive: true });
+		fs.writeFileSync(file, `${JSON.stringify(cache, null, 2)}\n`, { mode: 384 });
+	} catch (_error) {}
+}
+function isCheckDue(lastCheckedAt, now = Date.now()) {
+	if (!lastCheckedAt) return true;
+	const then = Date.parse(lastCheckedAt);
+	if (Number.isNaN(then)) return true;
+	if (then > now) return true;
+	return now - then >= CHECK_INTERVAL_MS;
+}
+
+//#endregion
+//#region src/update-check/versions.ts
+/** Canary builds carry a prerelease suffix (`X.Y.Z-beta.N`, synthesized in
+* CI); a plain semver is a stable release. An unparseable version defaults
+* to stable. */
+function resolveChannel(version) {
+	return (semver.prerelease(version, { loose: true })?.length ?? 0) > 0 ? "canary" : "stable";
+}
+/** npm dist-tag for a channel (see release-skydive-cli.yml). */
+function distTagForChannel(channel) {
+	return channel === "canary" ? "beta" : "latest";
+}
+/**
+* True when `candidate` is a strictly newer release than `current`, per
+* semver precedence (the `semver` package, including prerelease ordering).
+* Unparseable input is never newer, so garbage from the registry can't
+* produce a notice.
+*/
+function isNewerVersion(candidate, current) {
+	if (!semver.valid(candidate, { loose: true })) return false;
+	if (!semver.valid(current, { loose: true })) return false;
+	return semver.gt(candidate, current, { loose: true });
+}
+
+//#endregion
+//#region src/update-check/notice.ts
+/** The install-mode-specific action line. A package-manager install is never
+* self-mutated — we only tell the user what to run. */
+function renderUpdateCommand(channel, source) {
+	if (source === "binary") return `curl -fsSL ${DEFAULT_WEB_URL}/api/v1/cli/install.sh | ${channel === "canary" ? "SKYDIVE_CHANNEL=canary " : ""}sh`;
+	return `npm install -g ${name}@${distTagForChannel(channel)}`;
+}
+function renderUpdateNotice(opts) {
+	return `\nUpdate available: ${opts.currentVersion} \u2192 ${opts.latestVersion}\nRun ${renderUpdateCommand(opts.channel, opts.source)}\n`;
+}
+/**
+* Whether this invocation may print the notice. Pure so it's testable; the
+* inputs are raw pre-yargs argv (parsing hasn't happened when this runs) and
+* stderr's TTY-ness. `--json`/`--quiet` go to stdout, and the notice goes to
+* stderr — but scripts commonly capture 2>&1, so machine-readable modes
+* suppress it entirely rather than risk corrupting piped output.
+*/
+function shouldNotify(opts) {
+	if (!opts.stderrIsTTY) return false;
+	if (opts.argv.includes("--json") || opts.argv.includes("--quiet")) return false;
+	return true;
+}
+
+//#endregion
+//#region src/update-check/sources.ts
+function resolveInstallSource() {
+	return typeof SKYDIVE_CLI_INSTALL_SOURCE === "string" && SKYDIVE_CLI_INSTALL_SOURCE === "binary" ? "binary" : "package-manager";
+}
+const NPM_REGISTRY_URL = "https://registry.npmjs.org";
+const npmDistTagsSchema = z.record(z.string(), z.unknown());
+const binaryManifestSchema = z.object({ version: z.unknown().optional() });
+/** npm dist-tags for the published package (`skydive-cli`). */
+const npmReleaseSource = { async fetchLatestVersion(channel, { signal }) {
+	const response = await fetch(`${NPM_REGISTRY_URL}/-/package/${name}/dist-tags`, {
+		signal,
+		headers: { accept: "application/json" }
+	});
+	if (!response.ok) return null;
+	const tags = npmDistTagsSchema.safeParse(await response.json());
+	if (!tags.success) return null;
+	const version = tags.data[distTagForChannel(channel)];
+	return typeof version === "string" ? version : null;
+} };
+/**
+* Release CDN (CloudFront over the releases bucket, infra: CliReleasesCdn).
+* Serves the channel pointers the release workflow uploads
+* (`channels/{stable,canary}.json`, cached max-age=60) alongside the
+* binaries. The daily poll goes here, not to the api, so a fleet of
+* installed binaries puts no load on — and takes no dependency on — the api.
+*/
+const RELEASE_CDN_URL = "https://dl.skydive.com";
+/** Channel manifest on the release CDN, for compiled binaries. The same
+* document the api's channel route serves (see
+* apps/anyone/api/src/routes/cli-releases.ts, which reads it from the
+* bucket this CDN fronts). */
+const binaryReleaseSource = { async fetchLatestVersion(channel, { signal }) {
+	const response = await fetch(`${RELEASE_CDN_URL}/channels/${channel}.json`, {
+		signal,
+		headers: { accept: "application/json" }
+	});
+	if (!response.ok) return null;
+	const manifest = binaryManifestSchema.safeParse(await response.json());
+	if (!manifest.success) return null;
+	return typeof manifest.data.version === "string" ? manifest.data.version : null;
+} };
+function releaseSourceForInstall(source) {
+	return source === "binary" ? binaryReleaseSource : npmReleaseSource;
+}
+
+//#endregion
+//#region src/update-check/index.ts
+/**
+* Non-blocking update check, update-notifier style: a command never waits on
+* the network. Each invocation reads a small on-disk cache (./cache.ts) and,
+* when it records a newer version for this build's channel, prints a notice
+* (./notice.ts) to stderr at process exit. Separately, at most once per
+* check interval, it spawns a short-lived detached child (this same
+* executable with {@link UPDATE_WORKER_FLAG}) that fetches release metadata
+* (./sources.ts) and rewrites the cache for *future* invocations. So a
+* notice is always one check behind — the price of never delaying a command.
+*
+* Two install modes share everything except the metadata source and the
+* suggested action (see ./sources.ts):
+*
+* - package-manager (npm/Yarn/pnpm/Bun): compare against npm dist-tags,
+*   print the install command, never self-mutate the install.
+* - compiled binary: compare against the release channel manifest served by
+*   the api, print the installer one-liner; a real `skydive update`
+*   self-updater can slot in behind the same boundary later.
+*
+* Failure policy: every path here is best-effort. Network errors, timeouts,
+* a torn cache file, an unwritable config dir — all silent. The check must
+* never break or slow a command.
+*/
+/** Hidden argv sentinel that turns an invocation into the background refresh
+* worker (see bin.ts). Namespaced so it can never collide with a real flag. */
+const UPDATE_WORKER_FLAG = "--skydive-internal-update-check";
+const FETCH_TIMEOUT_MS = 1e4;
+function isCheckDisabled(env) {
+	return Boolean(env["SKYDIVE_NO_UPDATE_CHECK"] || env["NO_UPDATE_NOTIFIER"] || env["CI"]) || getUpdateCheckDisabled();
+}
+/** A cached answer counts only if it's for this build's channel and strictly
+* newer than what's running. */
+function updateAvailable(cache, currentVersion, channel) {
+	return Boolean(cache.latestVersion && cache.channel === channel && isNewerVersion(cache.latestVersion, currentVersion));
+}
+function registerExitNotice(notice) {
+	process.once("exit", () => {
+		process.stderr.write(notice);
+	});
+}
+/** Stamp the claim before the worker spawns, so a crashing/offline worker
+* retries next interval instead of respawning on every command. */
+function claimCheckInterval(cache) {
+	writeUpdateCache({
+		...cache,
+		lastCheckedAt: (/* @__PURE__ */ new Date()).toISOString()
+	});
+}
+function spawnUpdateCheckWorker() {
+	const args = resolveInstallSource() === "binary" ? [UPDATE_WORKER_FLAG] : [...process.argv[1] ? [process.argv[1]] : [], UPDATE_WORKER_FLAG];
+	spawn(process.execPath, args, {
+		detached: true,
+		stdio: "ignore"
+	}).unref();
+}
+/**
+* The detached child's whole job: fetch the channel's current version and
+* rewrite the cache. Timeout-bounded and silent on failure by design.
+*/
+async function runUpdateCheckWorker() {
+	try {
+		const channel = resolveChannel(version);
+		const latestVersion = await releaseSourceForInstall(resolveInstallSource()).fetchLatestVersion(channel, { signal: AbortSignal.timeout(FETCH_TIMEOUT_MS) });
+		if (!latestVersion) return;
+		writeUpdateCache({
+			lastCheckedAt: (/* @__PURE__ */ new Date()).toISOString(),
+			channel,
+			latestVersion
+		});
+	} catch (_error) {}
+}
+/**
+* Called once from bin.ts before command dispatch. Synchronous — one small
+* file read; the network work happens in the detached worker.
+*/
+function setupUpdateCheck(argv) {
+	try {
+		if (isCheckDisabled(process.env)) return;
+		const currentVersion = version;
+		const channel = resolveChannel(currentVersion);
+		const cache = readUpdateCache();
+		if (updateAvailable(cache, currentVersion, channel) && shouldNotify({
+			argv,
+			stderrIsTTY: Boolean(process.stderr.isTTY)
+		})) registerExitNotice(renderUpdateNotice({
+			currentVersion,
+			latestVersion: cache.latestVersion,
+			channel,
+			source: resolveInstallSource()
+		}));
+		if (isCheckDue(cache.lastCheckedAt)) {
+			claimCheckInterval(cache);
+			spawnUpdateCheckWorker();
+		}
+	} catch (_error) {}
+}
+
 //#endregion
 //#region src/bin.ts
+if (process.argv.includes(UPDATE_WORKER_FLAG)) {
+	await runUpdateCheckWorker();
+	process.exit(0);
+}
+setupUpdateCheck(hideBin(process.argv));
 createCli(resolveArgv(hideBin(process.argv))).parse();
 
 //#endregion
-export { HttpError as A, resolveWebUrl as B, noColorRequested as C, themeModeFromColorFgBg as D, themeMode as E, setActiveWorkspace as F, DEFAULT_API_URL as I, DEFAULT_APP_URL as L, errorDetail as M, getActiveWorkspaceId as N, themeVersion as O, listWorkspaces as P, getConfigPath as R, monoTheme as S, themeForMode as T, saveTheme as V, errorMessage as _, mintPortalDeviceToken as a, applyTheme as b, portalWsUrl as c, cardActionErrorMessage as d, parseExternalOauthConnectParams as f, parseConnectCard as g, resolveConnectUrl as h, grantPortalAccess as i, createRestClient as j, themesForMode as k, resolveAgent as l, reconcileMaskedInput as m, fetchPortalDevices as n, buildEnv as o, parseOauthConnectParams as p, findThisDevice as r, machineIdentity as s, SandboxStream as t, MASK_CHAR as u, isRecord as v, theme as w, findTheme as x, DEFAULT_THEME_ID as y, getSavedTheme as z };
+export {  };