skydive-cli 0.1.0-beta.87 → 0.1.0-beta.90

package/README.md

@@ -8,10 +8,20 @@ npx skydive-cli --help
 
 ## Authentication
 
-The CLI has two credentials, stored together in `~/.config/skydive/config.json`:
+The CLI has two credentials, stored together in a single `config.json`. The
+location is platform-conventional (resolved via `env-paths`), so it is **not**
+`~/.config/skydive/` everywhere:
 
-- **API key** (`sky_live_…`) for the management commands. Mint one at
-  `skydive.com/account`, then:
+| Platform | Path                                                             |
+| -------- | ---------------------------------------------------------------- |
+| macOS    | `~/Library/Preferences/skydive/config.json`                      |
+| Linux    | `~/.config/skydive/config.json` (or `$XDG_CONFIG_HOME/skydive/`) |
+| Windows  | `%APPDATA%\skydive\config.json`                                  |
+
+`skydive auth status` prints the real resolved path (`Config: …`) — trust that
+over this table if they ever disagree.
+
+- **API key** (`sky_live_…`). Mint one at `skydive.com/account`, then:
 
   ```sh
   skydive auth login            # paste the key
@@ -26,6 +36,12 @@ The CLI has two credentials, stored together in `~/.config/skydive/config.json`:
   skydive auth login --web      # opens the browser, prompts for approval
   ```
 
+Either credential authenticates the management commands (`agents`, `keys`,
+`secrets`): the CLI prefers the API key and falls back to the `--web` chat
+session, so a `--web` login alone is enough to run them — you do **not** need a
+separate API key. The API key is only required when you have no chat session
+(e.g. CI). `skydive chat` requires the chat session specifically.
+
 `skydive auth status` shows both; `skydive auth logout` clears them.
 
 ## Commands
@@ -58,7 +74,7 @@ API key with edit access to that agent.
 ```sh
 skydive secrets list --agent-id <id>              # names only — values are never returned
 skydive secrets set OPENAI_API_KEY --agent-id <id>   # reads the value from stdin
-echo -n "$TOKEN" | skydive secrets set MY_TOKEN --agent-id <id>
+printf '%s' "$TOKEN" | skydive secrets set MY_TOKEN --agent-id <id>
 skydive secrets set MY_TOKEN "literal-value" --agent-id <id>
 skydive secrets rm MY_TOKEN --agent-id <id>
 ```
@@ -67,6 +83,11 @@ skydive secrets rm MY_TOKEN --agent-id <id>
 - `set` reads the value from **stdin** when no value argument is given, so the
   secret stays out of shell history. Passing it inline is supported for
   scripting but avoid it in an interactive shell.
+- Use `printf '%s'` rather than `echo -n` when piping a value: `echo -n` is not
+  portable (some `sh` builtins emit `-n` literally instead of suppressing the
+  newline), which would silently store a corrupted value. Since values are
+  write-only and cannot be read back to verify, that failure stays invisible
+  until something downstream breaks.
 - **Values are write-only over the API.** `list` returns key names, never
   values — the same contract as the in-sandbox `platform secrets` surface.
 - Setting a secret updates the agent's vault. If an outbound-proxy rule
@@ -122,6 +143,17 @@ skydive chat -p "status?" --agent grace --json               # structured envelo
   `SKYDIVE_SESSION_TOKEN`.
 - `--json` prints `{ agentId, agentName, conversationId, isNewConversation,
 runId, text }` instead of streaming the raw text.
+- **Recovering a dropped run.** A long run's stream can be cut off at the edge
+  (a gateway 502/504) after the run was created. The run keeps going
+  server-side, so a blind retry would re-execute the agent. Instead, note the
+  `runId` (always in `--json` output) and fetch the result once it's done:
+
+  ```sh
+  skydive runs get <runId>            # prints the reply; --json for the envelope
+  ```
+
+  `runs get` re-attaches to the run and replays its full reply whether it's
+  still streaming or already finished.
 
 It defaults to the production API (`https://api.skydive.com`). For local
 dev, point it at your stack:
@@ -136,22 +168,62 @@ management API used by `agents`/`keys`.
 
 ### Keybindings
 
-| Context      | Key           | Action                               |
-| ------------ | ------------- | ------------------------------------ |
-| Pickers      | _type_        | filter the list                      |
-| Pickers      | `↑` / `↓`     | move selection                       |
-| Pickers      | `↵`           | open / select                        |
-| Pickers      | `esc`         | back                                 |
-| Agent picker | `ctrl+n`      | create an agent                      |
-| Chat         | `↵`           | send (or queue, while streaming)     |
-| Chat         | `pgup`/`pgdn` | scroll the transcript                |
-| Chat         | `ctrl+c`      | cancel the active run; again to quit |
-| Chat         | `esc`         | back to the conversation picker      |
+| Context             | Key           | Action                                |
+| ------------------- | ------------- | ------------------------------------- |
+| Pickers             | _type_        | filter the list                       |
+| Pickers             | `↑` / `↓`     | move selection                        |
+| Pickers             | `↵`           | open / select                         |
+| Pickers             | `esc`         | back                                  |
+| Agent picker        | `ctrl+n`      | create an agent                       |
+| Agent picker        | `ctrl+w`      | switch workspace                      |
+| Agent picker        | `tab`         | toggle mine / whole-org agents        |
+| Conversation picker | `ctrl+d`      | delete the highlighted conversation   |
+| Chat                | `↵`           | send (or queue, while streaming)      |
+| Chat                | `pgup`/`pgdn` | scroll the transcript                 |
+| Chat                | `ctrl+c`      | cancel the active run; again to quit  |
+| Chat                | `esc`         | back to the conversation picker       |
+| Chat                | `ctrl+p`      | switch model                          |
+| Chat                | `ctrl+o`      | switch theme                          |
+| Chat                | `ctrl+t`      | grant / revoke local machine access   |
+| Chat                | `ctrl+l`      | open this conversation in the browser |
+| Chat                | `ctrl+r`      | run the newest pending connect card   |
+| Chat                | `ctrl+v`      | paste an image from the clipboard     |
+| Chat                | `ctrl+x`      | drop the most recently staged image   |
+| Chat                | `?`           | show the keybinding reference         |
 
 Messages typed while a response is streaming are **queued** and sent in
 order as each run finishes; `ctrl+c` cancels the current run and clears the
 queue.
 
+### Local machine access (`--share-machine` / `ctrl+t`)
+
+The chat TUI can grant the agent the ability to run commands **on your local
+machine** so it can read the repo you launched from, run local tooling, etc.
+This is off by default (default-deny) and you opt in explicitly:
+
+- `skydive chat --share-machine` enables it at launch, or
+- `ctrl+t` toggles it from the chat screen (the status bar shows `local access`
+  when on, `revoke access` when off).
+
+What to know before enabling it:
+
+- **Per-agent.** The grant is scoped to the agent you're chatting with; other
+  agents don't inherit it.
+- **The working directory is a starting point, not a jail.** Commands run with
+  their working directory set to wherever you launched `skydive chat`, but this
+  is **not** a hard filesystem boundary. This is genuine remote command
+  execution (a WebSocket streaming stdin/stdout/stderr), so the agent runs
+  commands as your user and can reach anything your user can, including paths
+  outside the launch directory. Launch from a scoped directory, but treat the
+  grant as "this agent can act as me on this machine," not "this agent can only
+  see this folder."
+- **Teardown is automatic.** Access is revoked when the TUI unmounts, so
+  quitting the chat drops the grant and reaps any processes the agent spawned.
+- **Interactive only.** Machine sharing is **not** available in `-p`
+  (non-interactive) mode \u2014 `--share-machine` has no effect there and the
+  print path carries no portal code. You can have scripted (`-p`) or local
+  access, not both, in a single invocation.
+
 ## Environment variables
 
 | Variable                | Effect                                           |
@@ -160,6 +232,8 @@ queue.
 | `SKYDIVE_API_URL`       | Management API base URL                          |
 | `SKYDIVE_SESSION_TOKEN` | Chat session token (for non-interactive use)     |
 | `SKYDIVE_APP_URL`       | Chat app/session origin (overrides stored value) |
+| `SKYDIVE_THEME`         | Chat colorscheme id (flag `--theme` overrides)   |
+| `SKYDIVE_CONFIG_NAME`   | On-disk config profile name (default `skydive`)  |
 
 ## Testing the TUI
 

package/dist/js/bin.mjs

@@ -13,7 +13,7 @@ import fs from "node:fs";
 import zlib from "node:zlib";
 
 //#region package.json
-var version$1 = "0.1.0-beta.87";
+var version$1 = "0.1.0-beta.90";
 
 //#endregion
 //#region src/types.ts
@@ -433,6 +433,44 @@ async function listWorkspaces({ appUrl, sessionToken }) {
 		return err({ message: e instanceof Error ? e.message : String(e) });
 	}
 }
+/**
+* Resolve who the current chat session belongs to: the signed-in user's
+* email/name and the active workspace. Used by `auth status` so a user running
+* multiple accounts can answer "am I logged into the right one?" without
+* another command. Best-effort: any failure yields nulls rather than throwing,
+* since `auth status` should still report the rest of the state.
+*/
+async function getSessionIdentity({ appUrl, sessionToken }) {
+	try {
+		const res = await fetch(`${appUrl}/api/auth/get-session?disableCookieCache=true`, { headers: authHeaders(sessionToken) });
+		if (!res.ok) return err({ message: `failed to read session (${res.status})` });
+		const parsed = z.object({
+			user: z.object({
+				email: z.string().nullable().optional(),
+				name: z.string().nullable().optional()
+			}).nullable().optional(),
+			session: z.object({ activeOrganizationId: z.string().nullable().optional() }).nullable().optional()
+		}).nullable().safeParse(await res.json());
+		if (!parsed.success) return err({ message: "unexpected session response" });
+		const activeWorkspaceId = parsed.data?.session?.activeOrganizationId ?? null;
+		let activeWorkspaceName = null;
+		if (activeWorkspaceId) {
+			const workspaces = await listWorkspaces({
+				appUrl,
+				sessionToken
+			});
+			if (workspaces.isOk()) activeWorkspaceName = workspaces.value.find((w) => w.id === activeWorkspaceId)?.name ?? null;
+		}
+		return ok({
+			email: parsed.data?.user?.email ?? null,
+			name: parsed.data?.user?.name ?? null,
+			activeWorkspaceId,
+			activeWorkspaceName
+		});
+	} catch (e) {
+		return err({ message: e instanceof Error ? e.message : String(e) });
+	}
+}
 /** The workspace bound to the current session, or `null` if none is set. */
 async function getActiveWorkspaceId({ appUrl, sessionToken }) {
 	try {
@@ -693,6 +731,10 @@ const statusCommand = {
 	handler: async (argv) => {
 		const apiKey = resolveConfig({ apiUrl: argv["api-url"] });
 		const session = resolveSession({});
+		const identity = session.isOk() ? (await getSessionIdentity({
+			appUrl: session.value.appUrl,
+			sessionToken: session.value.sessionToken
+		})).unwrapOr(null) : null;
 		if (argv.json) {
 			output(argv, {
 				authenticated: apiKey.isOk(),
@@ -700,7 +742,11 @@ const statusCommand = {
 				apiUrl: apiKey.isOk() ? apiKey.value.apiUrl : null,
 				chat: {
 					authenticated: session.isOk(),
-					appUrl: session.isOk() ? session.value.appUrl : null
+					appUrl: session.isOk() ? session.value.appUrl : null,
+					email: identity?.email ?? null,
+					name: identity?.name ?? null,
+					workspaceId: identity?.activeWorkspaceId ?? null,
+					workspaceName: identity?.activeWorkspaceName ?? null
 				},
 				configPath: getConfigPath()
 			});
@@ -718,6 +764,15 @@ const statusCommand = {
 		if (session.isOk()) {
 			console.log("Chat session:");
 			console.log(`  App:    ${session.value.appUrl}`);
+			if (identity?.email || identity?.name) {
+				const who = identity.email ?? identity.name;
+				const suffix = identity.email && identity.name ? ` (${identity.name})` : "";
+				console.log(`  User:   ${who}${suffix}`);
+			}
+			if (identity?.activeWorkspaceName || identity?.activeWorkspaceId) {
+				const ws = identity.activeWorkspaceName ?? identity.activeWorkspaceId;
+				console.log(`  Space:  ${ws}`);
+			}
 		} else console.log("Chat session: not signed in.");
 		console.log(`Config: ${getConfigPath()}`);
 	}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skydive-cli",
-  "version": "0.1.0-beta.87",
+  "version": "0.1.0-beta.90",
   "description": "Skydive CLI — manage AI agents from the command line",
   "homepage": "https://skydive.com",
   "license": "MIT",