skydive-cli 0.1.0 → 0.2.0-beta.421

package/dist/js/bin.mjs

@@ -1,19 +1,26 @@
 #!/usr/bin/env node
+import { A as getShareMachineDefault, B as saveSession, C as DEFAULT_WEB_URL, D as getPromptHistoryPath, E as getLastSeenVersion, F as resolveConfig, H as setLastSeenVersion, I as resolveManagementAuth, L as resolveSession, M as getStoredApiKeyWorkspaceName, N as getUpdateCheckDisabled, P as resolveAppUrl, T as getConfigPath, _ as setActiveWorkspace, b as API_KEY_PREFIX, d as themes, g as listWorkspaces, h as getSessionIdentity, j as getStoredApiKeyId, m as getActiveWorkspaceId, p as ensureActiveOrganization, v as API_KEYS_URL, w as deleteConfig, x as DEFAULT_API_URL, y as API_KEY_FAMILY_PREFIX, z as saveConfig } from "./theme-CuQhvqzN.mjs";
+import { n as printError, r as printTable, t as output } from "./output-B4cW10Ph.mjs";
+import { n as createRestClient } from "./rest-CamHVOce.mjs";
+import { i as resolveAgent } from "./print-DausK_KZ.mjs";
+import { a as registerPortalDevice, c as machineIdentity, n as findThisDevice, o as revokePortalAccess, r as grantPortalAccess, t as fetchPortalDevices } from "./api-CDTKq_5Q.mjs";
+import { t as SandboxStream } from "./client-CpEvH2Pq.mjs";
 import { hideBin } from "yargs/helpers";
 import yargs from "yargs";
-import { createInterface } from "node:readline";
+import { hostname } from "node:os";
 import path from "node:path";
-import Conf from "conf";
 import { err, ok } from "neverthrow";
 import { z } from "zod";
 import open from "open";
-import { spawnSync } from "node:child_process";
+import { spawn, spawnSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import fs from "node:fs";
 import zlib from "node:zlib";
+import semver from "semver";
 
 //#region package.json
-var version$1 = "0.1.0";
+var name = "skydive-cli";
+var version = "0.2.0-beta.421";
 
 //#endregion
 //#region src/types.ts
@@ -27,130 +34,11 @@ function isNonInteractive() {
 	return NON_INTERACTIVE_ENV_VARS.some((key) => process.env[key]);
 }
 
-//#endregion
-//#region src/config.ts
-/** Default host for the public management API (`/v1`, API-key auth). */
-const DEFAULT_API_URL = "https://api.skydive.com";
-/**
-* Default origin for the interactive chat client (`skydive chat`).
-*
-* The API host that serves better-auth (`/api/auth/*`) and the internal tRPC
-* API (`/api/v1/trpc`) that chat streams over. We target the API host
-* directly (not the web front door) because chat opens a WebSocket and
-* authenticates with a bearer token on the upgrade request. Same host as
-* `DEFAULT_API_URL`; override with `--api-url` / `SKYDIVE_APP_URL` for local
-* dev or while the DNS record is still being provisioned.
-*/
-const DEFAULT_APP_URL = "https://api.skydive.com";
-/** Web front door, for pages opened in the user's browser. */
-const DEFAULT_WEB_URL = "https://skydive.com";
-/**
-* Origin for browser-facing links (e.g. opening a conversation's web page).
-* The app origin is the API host, which serves no web UI in production, so
-* map the default to the web front door. Overridden origins (local dev,
-* previews) serve both and pass through unchanged.
-*/
-function resolveWebUrl(appUrl) {
-	return appUrl === DEFAULT_APP_URL ? DEFAULT_WEB_URL : appUrl;
-}
-/** Prefix on every Skydive API key. Kept in sync with the API's
-* `API_KEY_PREFIX` (`apps/anyone/api/src/lib/api-key.ts`); the CLI is a
-* standalone published package so it can't import the backend constant. */
-const API_KEY_PREFIX = "sky_live_";
-/** Where users mint and copy API keys. Shown in the login prompt. */
-const API_KEYS_URL = "skydive.com/account";
-const store = new Conf({
-	projectName: process.env["SKYDIVE_CONFIG_NAME"] ?? "skydive",
-	projectSuffix: "",
-	configFileMode: 384
-});
-function resolveConfig(opts) {
-	const apiKey = process.env["SKYDIVE_API_KEY"] ?? store.get("apiKey");
-	const apiUrl = process.env["SKYDIVE_API_URL"] ?? opts.apiUrl ?? store.get("apiUrl") ?? DEFAULT_API_URL;
-	if (!apiKey) return err({ message: "Not authenticated. Run `skydive auth login` first." });
-	return ok({
-		apiKey,
-		apiUrl
-	});
-}
-/**
-* Resolve the bearer credential for the management API (`agents` / `keys` /
-* `secrets`). Prefers an API key (`SKYDIVE_API_KEY` env, then stored), and
-* falls back to the `--web` chat session token: the server's `/v1` gate routes
-* any non-`sky_` bearer through the signed-in session, so a device login alone
-* is enough to run management commands — no separate API key required.
-*/
-function resolveManagementAuth(opts) {
-	const apiUrl = process.env["SKYDIVE_API_URL"] ?? opts.apiUrl ?? store.get("apiUrl") ?? DEFAULT_API_URL;
-	const apiKey = process.env["SKYDIVE_API_KEY"] ?? store.get("apiKey");
-	if (apiKey) return ok({
-		token: apiKey,
-		apiUrl,
-		kind: "api-key"
-	});
-	const sessionToken = process.env["SKYDIVE_SESSION_TOKEN"] ?? store.get("sessionToken");
-	if (sessionToken) return ok({
-		token: sessionToken,
-		apiUrl,
-		kind: "session"
-	});
-	return err({ message: "Not authenticated. Run `skydive auth login` (API key) or `skydive auth login --web`." });
-}
-function saveConfig(config) {
-	store.set("apiKey", config.apiKey);
-	store.set("apiUrl", config.apiUrl);
-}
-function deleteConfig() {
-	store.clear();
-}
-function getConfigPath() {
-	return store.path;
-}
-/**
-* Where the chat TUI persists its prompt history (up-arrow recall). Kept
-* beside the config file so all CLI state lives in one directory.
-*/
-function getPromptHistoryPath() {
-	return path.join(path.dirname(store.path), "prompt-history.jsonl");
-}
-/**
-* Resolve the chat/auth origin. Precedence: `SKYDIVE_APP_URL` env > explicit
-* `--api-url` style override > stored value > `SKYDIVE_API_URL` env >
-* `DEFAULT_APP_URL`.
-*
-* The `SKYDIVE_API_URL` fallback matters for previews: the device/`--web`
-* flow and chat hit the same api service as the management API, so pointing
-* `SKYDIVE_API_URL` at a preview stack is enough — you don't also have to set
-* `SKYDIVE_APP_URL`. Otherwise auth would silently fall through to prod
-* (`DEFAULT_APP_URL`) and hand back a prod verification URL.
-*/
-function resolveAppUrl(opts) {
-	return process.env["SKYDIVE_APP_URL"] ?? opts.appUrl ?? store.get("appUrl") ?? process.env["SKYDIVE_API_URL"] ?? DEFAULT_APP_URL;
-}
-function resolveSession(opts) {
-	const sessionToken = process.env["SKYDIVE_SESSION_TOKEN"] ?? store.get("sessionToken");
-	const appUrl = resolveAppUrl(opts);
-	if (!sessionToken) return err({ message: "Not signed in for chat. Run `skydive chat` to sign in." });
-	return ok({
-		sessionToken,
-		appUrl
-	});
-}
-function saveSession(session) {
-	store.set("sessionToken", session.sessionToken);
-	store.set("sessionObtainedAt", (/* @__PURE__ */ new Date()).toISOString());
-	store.set("appUrl", session.appUrl);
-}
-function getSavedTheme(mode) {
-	return store.get(mode === "dark" ? "themeDark" : "themeLight");
-}
-function saveTheme(mode, themeId) {
-	store.set(mode === "dark" ? "themeDark" : "themeLight", themeId);
-}
-
 //#endregion
 //#region src/api-client.ts
-const USER_AGENT = `skydive-cli/${version$1}`;
+const USER_AGENT = `skydive-cli/${version}`;
+/** Largest page `/v1/agents` will return, enforced server-side. */
+const MAX_AGENT_PAGE = 100;
 const AgentSchema = z.object({
 	id: z.string(),
 	name: z.string(),
@@ -179,20 +67,38 @@ const SetSecretResponseSchema = z.object({ key: z.string() });
 var SkydiveApiClient = class {
 	baseUrl;
 	token;
+	authKind;
 	constructor(config) {
 		this.baseUrl = `${config.apiUrl.replace(/\/$/, "")}/v1`;
 		this.token = config.token;
-	}
+		this.authKind = config.kind;
+	}
+	/**
+	* List agents in the caller's workspace, following the server's cursor
+	* until `limit` is satisfied. The endpoint caps one page at
+	* {@link MAX_AGENT_PAGE}, so a larger limit takes several requests —
+	* callers just ask for what they want. `hasMore` reports whether the
+	* roster continues past what was returned.
+	*/
 	async listAgents(params) {
-		const query = new URLSearchParams();
-		if (params.scope) query.set("scope", params.scope);
-		if (params.limit) query.set("limit", String(params.limit));
-		if (params.cursor) query.set("cursor", params.cursor);
-		const qs = query.toString();
-		return this.request({
-			method: "GET",
-			path: `/agents${qs ? `?${qs}` : ""}`,
-			schema: ListAgentsResponseSchema
+		const agents = [];
+		let cursor = null;
+		do {
+			const query = new URLSearchParams({ limit: String(Math.min(MAX_AGENT_PAGE, params.limit - agents.length)) });
+			if (params.scope) query.set("scope", params.scope);
+			if (cursor) query.set("cursor", cursor);
+			const page = await this.request({
+				method: "GET",
+				path: `/agents?${query.toString()}`,
+				schema: ListAgentsResponseSchema
+			});
+			if (page.isErr()) return err(page.error);
+			agents.push(...page.value.agents);
+			cursor = page.value.nextCursor;
+		} while (cursor && agents.length < params.limit);
+		return ok({
+			agents,
+			hasMore: cursor !== null
 		});
 	}
 	async getAgent(id) {
@@ -279,6 +185,7 @@ var SkydiveApiClient = class {
 				if (body.error && typeof body.error === "string") message = body.error;
 				else if (body.error?.message) message = body.error.message;
 			} catch {}
+			if (response.status === 401 && this.authKind === "session") message = `${message} — your chat session may have expired. Run \`skydive auth login\`.`;
 			return err({
 				message,
 				status: response.status
@@ -318,7 +225,8 @@ const tokenSuccessSchema = z.object({
 	access_token: z.string(),
 	token_type: z.string().optional(),
 	expires_in: z.number().int().optional(),
-	refresh_token: z.string().optional()
+	refresh_token: z.string().optional(),
+	scope: z.string().optional()
 });
 const tokenErrorSchema = z.object({
 	error: z.enum([
@@ -333,6 +241,18 @@ const tokenErrorSchema = z.object({
 	error_description: z.string().optional()
 });
 const GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
+const WORKSPACE_SCOPE_PREFIX = "workspace:";
+/**
+* Extract the workspace (organization) id the user chose on the /device
+* approval page from the token response's `scope`. Scope is space-delimited
+* per RFC 6749; anything else in it is ignored. Returns null when no
+* workspace was chosen (older server, or the picker didn't load).
+*/
+function parseWorkspaceScope(scope) {
+	if (!scope) return null;
+	const entry = scope.split(" ").find((part) => part.startsWith(WORKSPACE_SCOPE_PREFIX));
+	return entry ? entry.slice(10) || null : null;
+}
 async function requestDeviceCode({ appUrl, signal }) {
 	const res = await fetch(`${appUrl}/api/auth/device/code`, {
 		method: "POST",
@@ -372,7 +292,8 @@ async function pollDeviceToken({ appUrl, deviceCode, currentIntervalMs, signal }
 		return {
 			kind: "success",
 			accessToken: parsed.data.access_token,
-			refreshToken: parsed.data.refresh_token ?? null
+			refreshToken: parsed.data.refresh_token ?? null,
+			workspaceId: parseWorkspaceScope(parsed.data.scope)
 		};
 	}
 	const parsed = tokenErrorSchema.safeParse(body);
@@ -398,83 +319,6 @@ async function pollDeviceToken({ appUrl, deviceCode, currentIntervalMs, signal }
 	}
 }
 
-//#endregion
-//#region src/auth/organization.ts
-const workspaceSchema = z.object({
-	id: z.string(),
-	name: z.string(),
-	slug: z.string()
-});
-function authHeaders(sessionToken) {
-	return { authorization: `Bearer ${sessionToken}` };
-}
-async function listWorkspaces({ appUrl, sessionToken }) {
-	try {
-		const res = await fetch(`${appUrl}/api/auth/organization/list`, { headers: authHeaders(sessionToken) });
-		if (!res.ok) return err({ message: `failed to list workspaces (${res.status})` });
-		const parsed = z.array(workspaceSchema).safeParse(await res.json());
-		if (!parsed.success) return err({ message: "unexpected workspace list response" });
-		return ok(parsed.data);
-	} catch (e) {
-		return err({ message: e instanceof Error ? e.message : String(e) });
-	}
-}
-/** The workspace bound to the current session, or `null` if none is set. */
-async function getActiveWorkspaceId({ appUrl, sessionToken }) {
-	try {
-		const res = await fetch(`${appUrl}/api/auth/get-session?disableCookieCache=true`, { headers: authHeaders(sessionToken) });
-		if (!res.ok) return err({ message: `failed to read session (${res.status})` });
-		const parsed = z.object({ session: z.object({ activeOrganizationId: z.string().nullable().optional() }).nullable().optional() }).nullable().safeParse(await res.json());
-		if (!parsed.success) return err({ message: "unexpected session response" });
-		return ok(parsed.data?.session?.activeOrganizationId ?? null);
-	} catch (e) {
-		return err({ message: e instanceof Error ? e.message : String(e) });
-	}
-}
-async function setActiveWorkspace({ appUrl, sessionToken, organizationId }) {
-	try {
-		const res = await fetch(`${appUrl}/api/auth/organization/set-active`, {
-			method: "POST",
-			headers: {
-				...authHeaders(sessionToken),
-				"content-type": "application/json"
-			},
-			body: JSON.stringify({ organizationId })
-		});
-		if (!res.ok) return err({ message: `failed to set active workspace (${res.status})` });
-		return ok(void 0);
-	} catch (e) {
-		return err({ message: e instanceof Error ? e.message : String(e) });
-	}
-}
-/**
-* Ensures the session has an active workspace. The device flow issues a
-* session without one (unlike a normal web sign-in, which sets it), so the
-* internal API rejects every request with "no active organization" until we
-* set it. Picks the account's first workspace by join order — run `skydive
-* workspace list` + `skydive workspace switch` afterward if that's the wrong
-* one (e.g. a personal workspace joined before a shared team workspace).
-*/
-async function ensureActiveOrganization({ appUrl, sessionToken }) {
-	const workspaces = await listWorkspaces({
-		appUrl,
-		sessionToken
-	});
-	if (workspaces.isErr()) return err(workspaces.error);
-	const workspace = workspaces.value[0];
-	if (!workspace) return err({ message: "your account has no organization yet" });
-	const setResult = await setActiveWorkspace({
-		appUrl,
-		sessionToken,
-		organizationId: workspace.id
-	});
-	if (setResult.isErr()) return err(setResult.error);
-	return ok({
-		organizationId: workspace.id,
-		name: workspace.name
-	});
-}
-
 //#endregion
 //#region src/auth/device-login.ts
 const DEFAULT_INTERVAL_MS = 5e3;
@@ -509,11 +353,19 @@ async function loginWithDevice({ appUrl, openBrowser = true }) {
 		});
 		switch (result.kind) {
 			case "success": {
-				const org = await ensureActiveOrganization({
+				let activated = false;
+				if (result.workspaceId) activated = (await setActiveWorkspace({
 					appUrl,
-					sessionToken: result.accessToken
-				});
-				if (org.isErr()) return err({ message: org.error.message });
+					sessionToken: result.accessToken,
+					organizationId: result.workspaceId
+				})).isOk();
+				if (!activated) {
+					const org = await ensureActiveOrganization({
+						appUrl,
+						sessionToken: result.accessToken
+					});
+					if (org.isErr()) return err({ message: org.error.message });
+				}
 				saveSession({
 					sessionToken: result.accessToken,
 					appUrl
@@ -546,131 +398,266 @@ function sleep(ms) {
 }
 
 //#endregion
-//#region src/output.ts
-function output(argv, data) {
-	if (argv.json) {
-		console.log(JSON.stringify(data, null, 2));
-		return;
-	}
-	if (typeof data === "string") {
-		console.log(data);
-		return;
+//#region src/auth/mint-key.ts
+const mintedKeySchema = z.object({
+	id: z.string(),
+	name: z.string(),
+	prefix: z.string(),
+	key: z.string()
+});
+/**
+* Mint an org-scoped (account-level) API key off a fresh device-flow session,
+* so `auth login` ends with a durable machine credential the way
+* `doppler login` does. Calls the same internal endpoint the web settings page
+* uses; no `agentId` is sent, so the key is account-level, not agent-bound.
+*
+* Scopes are `use` + `edit` because the management commands the key powers
+* (`agents create`, `keys create`, `secrets set`) are edit-tier operations.
+*/
+async function mintCliApiKey({ appUrl, sessionToken, name }) {
+	try {
+		const res = await fetch(`${appUrl}/api/v1/api-keys`, {
+			method: "POST",
+			headers: {
+				authorization: `Bearer ${sessionToken}`,
+				"content-type": "application/json"
+			},
+			body: JSON.stringify({
+				name,
+				scopes: ["use", "edit"]
+			})
+		});
+		if (!res.ok) return err({ message: `failed to mint API key (${res.status})` });
+		const parsed = mintedKeySchema.safeParse(await res.json());
+		if (!parsed.success) return err({ message: "unexpected mint response" });
+		return ok(parsed.data);
+	} catch (e) {
+		return err({ message: e instanceof Error ? e.message : String(e) });
 	}
-	console.log(JSON.stringify(data, null, 2));
 }
-function printTable(headers, rows) {
-	const widths = headers.map((h, i) => Math.max(h.length, ...rows.map((r) => (r[i] ?? "").length)));
-	const pad = (s, w) => s.padEnd(w);
-	const line = (cells) => cells.map((c, i) => pad(c, widths[i] ?? 0)).join("  ");
-	console.log(line(headers));
-	console.log(widths.map((w) => "-".repeat(w)).join("  "));
-	for (const row of rows) console.log(line(row));
+const keyListSchema = z.object({ keys: z.array(z.object({
+	id: z.string(),
+	name: z.string(),
+	agentId: z.string().nullish()
+})) });
+/**
+* Revoke every active account-level key with the given name. Login calls this
+* before minting so repeated logins from the same machine + workspace replace
+* their key instead of piling up indistinguishable rows (`logout`'s revoke is
+* best-effort, and login-without-logout is the normal case — a wiped
+* container, an expired session). Agent-scoped keys are never touched even on
+* a name collision.
+*/
+async function revokeKeysByName({ appUrl, sessionToken, name }) {
+	try {
+		const res = await fetch(`${appUrl}/api/v1/api-keys`, { headers: { authorization: `Bearer ${sessionToken}` } });
+		if (!res.ok) return err({ message: `failed to list API keys (${res.status})` });
+		const parsed = keyListSchema.safeParse(await res.json());
+		if (!parsed.success) return err({ message: "unexpected key list response" });
+		const matches = parsed.data.keys.filter((key) => key.name === name && !key.agentId);
+		const failures = (await Promise.all(matches.map((key) => revokeApiKey({
+			appUrl,
+			token: sessionToken,
+			id: key.id
+		})))).filter((result) => result.isErr());
+		if (failures.length > 0) return err({ message: `failed to revoke ${failures.length} of ${matches.length} existing keys` });
+		return ok(matches.length);
+	} catch (e) {
+		return err({ message: e instanceof Error ? e.message : String(e) });
+	}
 }
-function printError(message) {
-	console.error(`Error: ${message}`);
+/**
+* Revoke an API key by id. Used by `auth logout` to clean up the key that
+* login auto-minted, so signing out on a machine doesn't leave a live
+* credential behind. `token` may be a session bearer or an API key — the
+* server accepts both on this route.
+*/
+async function revokeApiKey({ appUrl, token, id }) {
+	try {
+		const res = await fetch(`${appUrl}/api/v1/api-keys/${id}`, {
+			method: "DELETE",
+			headers: { authorization: `Bearer ${token}` }
+		});
+		if (!res.ok && res.status !== 404) return err({ message: `failed to revoke API key (${res.status})` });
+		return ok(void 0);
+	} catch (e) {
+		return err({ message: e instanceof Error ? e.message : String(e) });
+	}
 }
 
 //#endregion
 //#region src/commands/auth.ts
 const loginCommand = {
 	command: "login",
-	describe: "Authenticate with a Skydive API key (or --web for chat)",
+	describe: "Sign in via the browser (use --api-key for CI / headless)",
 	builder: (y) => y.option("api-key", {
 		type: "string",
-		describe: `API key (${API_KEY_PREFIX}...)`
+		describe: `Skip the browser and authenticate with an existing API key (${API_KEY_PREFIX}...)`
 	}).option("web", {
 		type: "boolean",
 		default: false,
-		describe: "Sign in for `skydive chat` via the browser (device flow) instead of an API key"
+		hidden: true,
+		describe: "Deprecated: browser sign-in is now the default"
 	}),
 	handler: async (argv) => {
-		if (argv.web) {
-			await runWebLogin(argv);
+		if (argv["api-key"]) {
+			await runApiKeyLogin(argv, argv["api-key"]);
 			return;
 		}
-		let apiKey = argv["api-key"] ?? process.env["SKYDIVE_API_KEY"];
-		if (!apiKey) {
-			const rl = createInterface({
-				input: process.stdin,
-				output: process.stderr
-			});
-			apiKey = await new Promise((resolve) => {
-				rl.question(`Enter your API key (from ${API_KEYS_URL}): `, (answer) => {
-					rl.close();
-					resolve(answer.trim());
-				});
-			});
-		}
-		if (!apiKey) {
-			printError("No API key provided.");
-			process.exit(1);
-		}
-		if (!apiKey.startsWith(API_KEY_PREFIX)) {
-			printError(`API key must start with ${API_KEY_PREFIX}`);
-			process.exit(1);
-		}
-		const apiUrl = argv["api-url"] ?? DEFAULT_API_URL;
-		const result = await new SkydiveApiClient({
-			token: apiKey,
-			apiUrl
-		}).listAgents({ limit: 1 });
-		if (result.isErr()) {
-			printError(`Invalid API key or unreachable server: ${result.error.message}`);
-			process.exit(1);
+		if (isNonInteractive()) {
+			const envKey = process.env["SKYDIVE_API_KEY"];
+			if (envKey) {
+				await runApiKeyLogin(argv, envKey);
+				return;
+			}
 		}
-		saveConfig({
-			apiKey,
-			apiUrl
-		});
-		if (argv.json) output(argv, {
+		await runBrowserLogin(argv);
+	}
+};
+/**
+* Browser sign-in, shaped like `doppler login`: open the approval page with a
+* short code, wait for the user to approve, then automatically mint an API
+* key for this machine. One flow yields both credentials — the session (chat,
+* workspace-following management calls) and a durable `sky_live_…` key that
+* keeps headless/management use working after the session expires.
+*
+* Deliberately no TTY requirement: the flow only prints the verification URL
+* + code and polls, so it also works from a non-interactive shell — an agent
+* driving the CLI relays the URL to its human, who approves in any browser
+* (the auto-open is best-effort). The cost is that an unattended run with no
+* key configured waits out the device code's expiry instead of failing fast.
+*/
+async function runBrowserLogin(argv) {
+	const appUrl = resolveAppUrl({ appUrl: argv["api-url"] });
+	const login = await loginWithDevice({ appUrl });
+	if (login.isErr()) {
+		printError(login.error.message);
+		process.exit(1);
+	}
+	const { sessionToken } = login.value;
+	const identity = (await getSessionIdentity({
+		appUrl,
+		sessionToken
+	})).unwrapOr(null);
+	const keyName = identity?.activeWorkspaceName ? `CLI (${hostname()}) — ${identity.activeWorkspaceName}` : `CLI (${hostname()})`;
+	const replaced = await revokeKeysByName({
+		appUrl,
+		sessionToken,
+		name: keyName
+	});
+	if (replaced.isErr()) process.stderr.write(`Warning: could not revoke this machine's previous API key (${replaced.error.message}); minting a new one anyway.\n`);
+	const minted = await mintCliApiKey({
+		appUrl,
+		sessionToken,
+		name: keyName
+	});
+	if (minted.isOk()) saveConfig({
+		apiKey: minted.value.key,
+		apiUrl: appUrl,
+		apiKeyId: minted.value.id,
+		workspaceName: identity?.activeWorkspaceName ?? null
+	});
+	else process.stderr.write(`Warning: signed in, but could not mint an API key (${minted.error.message}). Management commands will use your session; run \`skydive auth login\` again to retry.
+`);
+	if (argv.json) {
+		output(argv, {
 			authenticated: true,
-			prefix: apiKey.slice(0, 12),
+			mode: "browser",
+			appUrl,
+			prefix: minted.isOk() ? minted.value.prefix : null,
+			email: identity?.email ?? null,
+			workspaceName: identity?.activeWorkspaceName ?? null,
 			configPath: getConfigPath()
 		});
-		else if (!argv.quiet) {
-			console.log(`Authenticated successfully.`);
-			console.log(`  Key:    ${apiKey.slice(0, 12)}...`);
-			console.log(`  Config: ${getConfigPath()}`);
-		}
+		return;
 	}
-};
-async function runWebLogin(argv) {
-	if (isNonInteractive()) {
-		printError("`auth login --web` needs an interactive terminal. Set SKYDIVE_SESSION_TOKEN for non-interactive use.");
+	if (argv.quiet) return;
+	const who = identity?.name ?? identity?.email;
+	console.log(who ? `Welcome, ${who}!` : "Signed in.");
+	if (identity?.activeWorkspaceName) console.log(`  Workspace: ${identity.activeWorkspaceName}`);
+	if (minted.isOk()) console.log(`  API key:   ${minted.value.prefix}… (${minted.value.name})`);
+	console.log(`  Config:    ${getConfigPath()}`);
+}
+/** CI / headless path: validate and persist an existing key, no browser. */
+async function runApiKeyLogin(argv, apiKey) {
+	if (!apiKey.startsWith(API_KEY_FAMILY_PREFIX)) {
+		printError(`API key must start with ${API_KEY_FAMILY_PREFIX}`);
 		process.exit(1);
 	}
-	const result = await loginWithDevice({ appUrl: resolveAppUrl({ appUrl: argv["api-url"] }) });
+	const apiUrl = argv["api-url"] ?? DEFAULT_API_URL;
+	const result = await new SkydiveApiClient({
+		token: apiKey,
+		apiUrl,
+		kind: "api-key"
+	}).listAgents({
+		limit: 1,
+		scope: null
+	});
 	if (result.isErr()) {
-		printError(result.error.message);
+		printError(`Invalid API key or unreachable server: ${result.error.message}`);
 		process.exit(1);
 	}
+	saveConfig({
+		apiKey,
+		apiUrl,
+		apiKeyId: null,
+		workspaceName: null
+	});
 	if (argv.json) output(argv, {
 		authenticated: true,
-		mode: "session",
-		appUrl: result.value.appUrl,
+		prefix: apiKey.slice(0, 12),
 		configPath: getConfigPath()
 	});
 	else if (!argv.quiet) {
-		console.log("Signed in for chat.");
-		console.log(`  App:    ${result.value.appUrl}`);
+		console.log(`Authenticated successfully.`);
+		console.log(`  Key:    ${apiKey.slice(0, 12)}...`);
 		console.log(`  Config: ${getConfigPath()}`);
 	}
 }
 const logoutCommand = {
 	command: "logout",
-	describe: "Clear stored credentials (API key and chat session)",
+	describe: "Revoke the auto-minted API key and clear stored credentials",
 	handler: async (argv) => {
+		const keyId = getStoredApiKeyId();
+		let keyRevoked = false;
+		if (keyId) {
+			const session = resolveSession({ appUrl: argv["api-url"] });
+			const config = resolveConfig({ apiUrl: argv["api-url"] });
+			const credential = session.isOk() ? {
+				appUrl: session.value.appUrl,
+				token: session.value.sessionToken
+			} : config.isOk() ? {
+				appUrl: config.value.apiUrl,
+				token: config.value.apiKey
+			} : null;
+			if (credential) {
+				const revoked = await revokeApiKey({
+					...credential,
+					id: keyId
+				});
+				keyRevoked = revoked.isOk();
+				if (revoked.isErr()) process.stderr.write(`Warning: could not revoke this machine's API key (${revoked.error.message}). Revoke it manually at ${API_KEYS_URL}.\n`);
+			}
+		}
 		deleteConfig();
-		if (argv.json) output(argv, { authenticated: false });
-		else if (!argv.quiet) console.log("Logged out.");
+		if (argv.json) output(argv, {
+			authenticated: false,
+			keyRevoked
+		});
+		else if (!argv.quiet) console.log(keyRevoked ? "Logged out. API key revoked." : "Logged out.");
 	}
 };
-const statusCommand = {
+const statusCommand$1 = {
 	command: "status",
 	describe: "Show current authentication state",
 	handler: async (argv) => {
 		const apiKey = resolveConfig({ apiUrl: argv["api-url"] });
 		const session = resolveSession({});
+		const management = resolveManagementAuth({ apiUrl: argv["api-url"] });
+		const identity = session.isOk() ? (await getSessionIdentity({
+			appUrl: session.value.appUrl,
+			sessionToken: session.value.sessionToken
+		})).unwrapOr(null) : null;
 		if (argv.json) {
 			output(argv, {
 				authenticated: apiKey.isOk(),
@@ -678,48 +665,100 @@ const statusCommand = {
 				apiUrl: apiKey.isOk() ? apiKey.value.apiUrl : null,
 				chat: {
 					authenticated: session.isOk(),
-					appUrl: session.isOk() ? session.value.appUrl : null
+					appUrl: session.isOk() ? session.value.appUrl : null,
+					email: identity?.email ?? null,
+					name: identity?.name ?? null,
+					workspaceId: identity?.activeWorkspaceId ?? null,
+					workspaceName: identity?.activeWorkspaceName ?? null
 				},
+				managementAuth: management.isOk() ? management.value.kind : null,
+				keyWorkspaceName: getStoredApiKeyWorkspaceName(),
 				configPath: getConfigPath()
 			});
 			return;
 		}
 		if (apiKey.isErr() && session.isErr()) {
-			console.log("Not authenticated. Run `skydive auth login` (API key) or `skydive auth login --web` (chat).");
+			console.log("Not authenticated. Run `skydive auth login`.");
 			return;
 		}
 		if (apiKey.isOk()) {
 			console.log("API key:");
 			console.log(`  Key:    ${apiKey.value.apiKey.slice(0, 12)}...`);
 			console.log(`  API:    ${apiKey.value.apiUrl}`);
+			const pinned = getStoredApiKeyWorkspaceName();
+			if (pinned) console.log(`  Space:  ${pinned} (the key always acts here)`);
 		} else console.log("API key:      not configured.");
 		if (session.isOk()) {
 			console.log("Chat session:");
 			console.log(`  App:    ${session.value.appUrl}`);
+			if (identity?.email || identity?.name) {
+				const who = identity.email ?? identity.name;
+				const suffix = identity.email && identity.name ? ` (${identity.name})` : "";
+				console.log(`  User:   ${who}${suffix}`);
+			}
+			if (identity?.activeWorkspaceName || identity?.activeWorkspaceId) {
+				const ws = identity.activeWorkspaceName ?? identity.activeWorkspaceId;
+				console.log(`  Space:  ${ws}`);
+			}
 		} else console.log("Chat session: not signed in.");
+		if (management.isOk()) {
+			const via = management.value.kind === "session" ? "chat session (follows `workspace switch`)" : management.value.pinnedWorkspaceName ? `API key (always acts in "${management.value.pinnedWorkspaceName}")` : "API key (always acts in the workspace it was created in)";
+			console.log(`Management commands use: ${via}`);
+		}
 		console.log(`Config: ${getConfigPath()}`);
 	}
 };
 const authCommand = {
 	command: "auth",
 	describe: "Manage authentication",
-	builder: (y) => y.command(loginCommand).command(logoutCommand).command(statusCommand).demandCommand(1, "Specify a subcommand: login, logout, status"),
+	builder: (y) => y.command(loginCommand).command(logoutCommand).command(statusCommand$1).demandCommand(1, "Specify a subcommand: login, logout, status"),
 	handler: () => {}
 };
 
 //#endregion
-//#region src/commands/agents.ts
-function requireClient$2(argv) {
-	const result = resolveManagementAuth({ apiUrl: argv["api-url"] });
-	if (result.isErr()) {
-		printError(result.error.message);
+//#region src/commands/session.ts
+/**
+* Resolve the signed-in chat session or exit with a friendly hint. Shared by
+* every command that talks to the authenticated REST API so the
+* resolve-or-exit block isn't copy-pasted per command.
+*/
+function requireSession(argv) {
+	const session = resolveSession({ appUrl: resolveAppUrl({ appUrl: argv["api-url"] }) });
+	if (session.isErr()) {
+		printError(`${session.error.message} Run \`skydive auth login\` first, or set SKYDIVE_SESSION_TOKEN.`);
 		process.exit(1);
 	}
-	return new SkydiveApiClient(result.value);
+	return session.value;
 }
-const listCommand$3 = {
+/**
+* Resolve the management-API credential (see
+* {@link resolveManagementAuth}) or exit with a friendly hint, then build the
+* `/v1` client. Shared by `agents`, `keys` and `secrets`.
+*/
+function requireManagementClient(argv) {
+	const auth = resolveManagementAuth({ apiUrl: argv["api-url"] });
+	if (auth.isErr()) {
+		printError(auth.error.message);
+		process.exit(1);
+	}
+	if (auth.value.kind === "api-key" && auth.value.pinnedWorkspaceName) process.stderr.write(`Using this machine's API key, which always acts in the "${auth.value.pinnedWorkspaceName}" workspace (even after \`workspace switch\`). Run \`skydive auth login\` to change that.
+`);
+	return new SkydiveApiClient(auth.value);
+}
+/** Resolve the session (see {@link requireSession}) and build a REST client. */
+function requireRestClient(argv) {
+	const session = requireSession(argv);
+	return createRestClient({
+		appUrl: session.appUrl,
+		sessionToken: session.sessionToken
+	});
+}
+
+//#endregion
+//#region src/commands/agents.ts
+const listCommand$4 = {
 	command: "list",
-	describe: "List agents",
+	describe: "List agents in the active workspace",
 	builder: (y) => y.option("limit", {
 		type: "number",
 		default: 20,
@@ -730,15 +769,15 @@ const listCommand$3 = {
 		describe: "Filter scope"
 	}),
 	handler: async (argv) => {
-		const result = await requireClient$2(argv).listAgents({
+		const result = await requireManagementClient(argv).listAgents({
 			limit: argv.limit,
-			scope: argv.scope
+			scope: argv.scope ?? null
 		});
 		if (result.isErr()) {
 			printError(result.error.message);
 			process.exit(1);
 		}
-		const { agents } = result.value;
+		const { agents, hasMore } = result.value;
 		if (argv.json) {
 			output(argv, agents);
 			return;
@@ -747,18 +786,52 @@ const listCommand$3 = {
 			console.log("No agents found.");
 			return;
 		}
-		printTable([
+		const { headers, rows } = buildAgentTable(agents);
+		printTable(headers, rows);
+		if (hasMore && !argv.quiet) console.log(`\nShowing the ${agents.length} newest. Raise --limit to see more.`);
+	}
+};
+const DESCRIPTION_MAX = 48;
+/**
+* Build the `agents list` table. A Description column is added only when at
+* least one agent actually has a description, so an all-empty column doesn't
+* add noise for accounts that never set them. Descriptions can be long, so
+* they are truncated to keep one verbose agent from blowing out the width.
+*/
+function buildAgentTable(agents) {
+	if (agents.some((a) => (a.description ?? "").trim().length > 0)) return {
+		headers: [
 			"Name",
+			"Description",
 			"URL",
 			"Model"
-		], agents.map((a) => [
+		],
+		rows: agents.map((a) => [
 			a.name,
+			truncate(a.description ?? "", DESCRIPTION_MAX),
 			a.url ?? "-",
 			a.model ?? "default"
-		]));
-	}
-};
-const getCommand = {
+		])
+	};
+	return {
+		headers: [
+			"Name",
+			"URL",
+			"Model"
+		],
+		rows: agents.map((a) => [
+			a.name,
+			a.url ?? "-",
+			a.model ?? "default"
+		])
+	};
+}
+function truncate(value, max) {
+	const trimmed = value.trim();
+	if (trimmed.length <= max) return trimmed || "-";
+	return `${trimmed.slice(0, max - 1)}\u2026`;
+}
+const getCommand$1 = {
 	command: "get <id>",
 	describe: "Get agent details",
 	builder: (y) => y.positional("id", {
@@ -767,7 +840,7 @@ const getCommand = {
 		describe: "Agent ID"
 	}),
 	handler: async (argv) => {
-		const result = await requireClient$2(argv).getAgent(argv.id);
+		const result = await requireManagementClient(argv).getAgent(argv.id);
 		if (result.isErr()) {
 			printError(result.error.message);
 			process.exit(1);
@@ -801,7 +874,7 @@ const createCommand$1 = {
 		describe: "Model to use"
 	}),
 	handler: async (argv) => {
-		const result = await requireClient$2(argv).createAgent({
+		const result = await requireManagementClient(argv).createAgent({
 			name: argv.name,
 			model: argv.model
 		});
@@ -828,905 +901,51 @@ const createCommand$1 = {
 const agentsCommand = {
 	command: "agents",
 	describe: "Manage agents",
-	builder: (y) => y.command(listCommand$3).command(getCommand).command(createCommand$1).demandCommand(1, "Specify a subcommand: list, get, create"),
+	builder: (y) => y.command(listCommand$4).command(getCommand$1).command(createCommand$1).demandCommand(1, "Specify a subcommand: list, get, create"),
 	handler: () => {}
 };
 
 //#endregion
-//#region src/commands/keys.ts
-function requireClient$1(argv) {
-	const result = resolveManagementAuth({ apiUrl: argv["api-url"] });
-	if (result.isErr()) {
-		printError(result.error.message);
-		process.exit(1);
-	}
-	return new SkydiveApiClient(result.value);
-}
-const listCommand$2 = {
-	command: "list",
-	describe: "List API keys for an agent",
-	handler: async (argv) => {
-		const result = await requireClient$1(argv).listKeys(argv["agent-id"]);
-		if (result.isErr()) {
-			printError(result.error.message);
-			process.exit(1);
-		}
-		const keys = result.value;
-		if (argv.json) {
-			output(argv, keys);
-			return;
-		}
-		if (keys.length === 0) {
-			console.log("No API keys found.");
-			return;
-		}
-		printTable([
-			"Name",
-			"Prefix",
-			"Last Used",
-			"Created"
-		], keys.map((k) => [
-			k.name,
-			k.prefix,
-			k.lastUsedAt ? new Date(k.lastUsedAt).toLocaleDateString() : "Never",
-			new Date(k.createdAt).toLocaleDateString()
-		]));
-	}
-};
-const createCommand = {
-	command: "create <name>",
-	describe: "Create a new API key for an agent",
-	builder: (y) => y.positional("name", {
-		type: "string",
-		demandOption: true,
-		describe: "Key name"
-	}),
-	handler: async (argv) => {
-		const result = await requireClient$1(argv).createKey(argv["agent-id"], argv.name);
-		if (result.isErr()) {
-			printError(result.error.message);
-			process.exit(1);
-		}
-		const key = result.value;
-		if (argv.json) {
-			output(argv, key);
-			return;
-		}
-		if (argv.quiet) {
-			console.log(key.key);
-			return;
-		}
-		console.log(`API key created.`);
-		console.log(`  Name: ${key.name}`);
-		console.log(`  Key:  ${key.key}`);
-		console.log("");
-		console.log("  Save this key — it will not be shown again.");
-	}
-};
-const revokeCommand = {
-	command: "revoke <id>",
-	describe: "Revoke an API key",
-	builder: (y) => y.positional("id", {
-		type: "string",
-		demandOption: true,
-		describe: "Key ID"
-	}),
-	handler: async (argv) => {
-		const result = await requireClient$1(argv).revokeKey(argv["agent-id"], argv.id);
-		if (result.isErr()) {
-			printError(result.error.message);
-			process.exit(1);
-		}
-		if (argv.json) output(argv, {
-			revoked: true,
-			id: argv.id
-		});
-		else if (!argv.quiet) console.log(`Key ${argv.id} revoked.`);
-	}
-};
-const keysCommand = {
-	command: "keys",
-	describe: "Manage API keys for an agent",
-	builder: (y) => y.option("agent-id", {
-		type: "string",
-		demandOption: true,
-		describe: "Agent ID"
-	}).command(listCommand$2).command(createCommand).command(revokeCommand).demandCommand(1, "Specify a subcommand: list, create, revoke"),
-	handler: () => {}
-};
-
-//#endregion
-//#region src/commands/secrets.ts
-function requireClient(argv) {
-	const result = resolveManagementAuth({ apiUrl: argv["api-url"] });
-	if (result.isErr()) {
-		printError(result.error.message);
-		process.exit(1);
-	}
-	return new SkydiveApiClient(result.value);
-}
-/** Read all of stdin as UTF-8, trimming a single trailing newline. */
-async function readStdin() {
-	const chunks = [];
-	for await (const chunk of process.stdin) chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
-	return Buffer.concat(chunks).toString("utf8").replace(/\n$/, "");
-}
-const listCommand$1 = {
-	command: "list",
-	describe: "List secret names for an agent (values are never shown)",
-	handler: async (argv) => {
-		const result = await requireClient(argv).listSecrets(argv["agent-id"]);
-		if (result.isErr()) {
-			printError(result.error.message);
-			process.exit(1);
-		}
-		const keys = result.value;
-		if (argv.json) {
-			output(argv, keys);
-			return;
-		}
-		if (keys.length === 0) {
-			console.log("No secrets found.");
-			return;
-		}
-		printTable(["Name"], keys.map((k) => [k]));
-	}
-};
-const setCommand = {
-	command: "set <key> [value]",
-	describe: "Set (create or overwrite) a secret. Reads value from stdin if omitted.",
-	builder: (y) => y.positional("key", {
-		type: "string",
-		demandOption: true,
-		describe: "Secret name (uppercase letters, digits, underscores)"
-	}).positional("value", {
-		type: "string",
-		describe: "Secret value. If omitted, read from stdin — keeps the value out of shell history."
-	}),
-	handler: async (argv) => {
-		let value = argv.value;
-		if (value === void 0) {
-			if (process.stdin.isTTY) {
-				printError("No value given. Pass it as an argument or pipe it on stdin, e.g. `echo -n \"$TOKEN\" | skydive secrets set MY_KEY --agent-id <id>`.");
-				process.exit(1);
-			}
-			value = await readStdin();
-		}
-		if (!value) {
-			printError("Empty secret value.");
-			process.exit(1);
-		}
-		const result = await requireClient(argv).setSecret(argv["agent-id"], argv.key, value);
-		if (result.isErr()) {
-			printError(result.error.message);
-			process.exit(1);
-		}
-		if (argv.json) output(argv, {
-			key: result.value,
-			set: true
-		});
-		else if (!argv.quiet) console.log(`Secret ${result.value} set.`);
-	}
-};
-const rmCommand = {
-	command: "rm <key>",
-	aliases: ["delete"],
-	describe: "Remove a secret from the agent",
-	builder: (y) => y.positional("key", {
-		type: "string",
-		demandOption: true,
-		describe: "Secret name"
-	}),
-	handler: async (argv) => {
-		const result = await requireClient(argv).deleteSecret(argv["agent-id"], argv.key);
-		if (result.isErr()) {
-			printError(result.error.message);
-			process.exit(1);
-		}
-		if (argv.json) output(argv, {
-			key: argv.key,
-			removed: true
-		});
-		else if (!argv.quiet) console.log(`Secret ${argv.key} removed.`);
-	}
-};
-const secretsCommand = {
-	command: "secrets",
-	describe: "Manage an agent’s secrets",
-	builder: (y) => y.option("agent-id", {
-		type: "string",
-		demandOption: true,
-		describe: "Agent ID"
-	}).command(listCommand$1).command(setCommand).command(rmCommand).demandCommand(1, "Specify a subcommand: list, set, rm"),
-	handler: () => {}
-};
-
-//#endregion
-//#region src/chat/tui/theme.ts
-const tokyonight = {
-	id: "tokyonight",
-	label: "Tokyo Night",
-	mode: "dark",
-	palette: {
-		fg: "#c0caf5",
-		muted: "#7a7a7a",
-		dim: "#565f89",
-		faint: "#3b4261",
-		surface: "#16161e",
-		accent: "#7aa2f7",
-		success: "#9ece6a",
-		warning: "#e0af68",
-		error: "#f7768e",
-		user: "#7aa2f7",
-		assistant: "#c0caf5",
-		tool: "#bb9af7",
-		reasoning: "#565f89",
-		syntaxBlue: "#7aa2f7",
-		syntaxCyan: "#7dcfff",
-		syntaxTeal: "#73daca",
-		syntaxGreen: "#9ece6a",
-		syntaxYellow: "#e0af68",
-		syntaxOrange: "#ff9e64",
-		syntaxRed: "#f7768e",
-		syntaxMagenta: "#bb9af7"
-	}
-};
-const tokyonightDay = {
-	id: "tokyonight-day",
-	label: "Tokyo Night Day",
-	mode: "light",
-	palette: {
-		fg: "#3760bf",
-		muted: "#848cb5",
-		dim: "#9da3c2",
-		faint: "#c4c8da",
-		surface: "#d0d1d8",
-		accent: "#2e7de9",
-		success: "#587539",
-		warning: "#8c6c3e",
-		error: "#f52a65",
-		user: "#2e7de9",
-		assistant: "#3760bf",
-		tool: "#9854f1",
-		reasoning: "#848cb5",
-		syntaxBlue: "#2e7de9",
-		syntaxCyan: "#007197",
-		syntaxTeal: "#118c74",
-		syntaxGreen: "#587539",
-		syntaxYellow: "#8c6c3e",
-		syntaxOrange: "#b15c00",
-		syntaxRed: "#f52a65",
-		syntaxMagenta: "#9854f1"
-	}
-};
-const catppuccinMocha = {
-	id: "catppuccin-mocha",
-	label: "Catppuccin Mocha",
-	mode: "dark",
-	palette: {
-		fg: "#cdd6f4",
-		muted: "#7f849c",
-		dim: "#6c7086",
-		faint: "#45475a",
-		surface: "#181825",
-		accent: "#89b4fa",
-		success: "#a6e3a1",
-		warning: "#f9e2af",
-		error: "#f38ba8",
-		user: "#89b4fa",
-		assistant: "#cdd6f4",
-		tool: "#cba6f7",
-		reasoning: "#6c7086",
-		syntaxBlue: "#89b4fa",
-		syntaxCyan: "#89dceb",
-		syntaxTeal: "#94e2d5",
-		syntaxGreen: "#a6e3a1",
-		syntaxYellow: "#f9e2af",
-		syntaxOrange: "#fab387",
-		syntaxRed: "#f38ba8",
-		syntaxMagenta: "#cba6f7"
-	}
-};
-const catppuccinLatte = {
-	id: "catppuccin-latte",
-	label: "Catppuccin Latte",
-	mode: "light",
-	palette: {
-		fg: "#4c4f69",
-		muted: "#8c8fa1",
-		dim: "#9ca0b0",
-		faint: "#bcc0cc",
-		surface: "#e6e9ef",
-		accent: "#1e66f5",
-		success: "#40a02b",
-		warning: "#df8e1d",
-		error: "#d20f39",
-		user: "#1e66f5",
-		assistant: "#4c4f69",
-		tool: "#8839ef",
-		reasoning: "#9ca0b0",
-		syntaxBlue: "#1e66f5",
-		syntaxCyan: "#04a5e5",
-		syntaxTeal: "#179299",
-		syntaxGreen: "#40a02b",
-		syntaxYellow: "#df8e1d",
-		syntaxOrange: "#fe640b",
-		syntaxRed: "#d20f39",
-		syntaxMagenta: "#8839ef"
-	}
-};
-const gruvboxDark = {
-	id: "gruvbox-dark",
-	label: "Gruvbox Dark",
-	mode: "dark",
-	palette: {
-		fg: "#ebdbb2",
-		muted: "#928374",
-		dim: "#7c6f64",
-		faint: "#504945",
-		surface: "#1d2021",
-		accent: "#83a598",
-		success: "#b8bb26",
-		warning: "#fabd2f",
-		error: "#fb4934",
-		user: "#83a598",
-		assistant: "#ebdbb2",
-		tool: "#d3869b",
-		reasoning: "#7c6f64",
-		syntaxBlue: "#83a598",
-		syntaxCyan: "#8ec07c",
-		syntaxTeal: "#8ec07c",
-		syntaxGreen: "#b8bb26",
-		syntaxYellow: "#fabd2f",
-		syntaxOrange: "#fe8019",
-		syntaxRed: "#fb4934",
-		syntaxMagenta: "#d3869b"
-	}
-};
-const gruvboxLight = {
-	id: "gruvbox-light",
-	label: "Gruvbox Light",
-	mode: "light",
-	palette: {
-		fg: "#3c3836",
-		muted: "#928374",
-		dim: "#a89984",
-		faint: "#d5c4a1",
-		surface: "#ebdbb2",
-		accent: "#076678",
-		success: "#79740e",
-		warning: "#b57614",
-		error: "#9d0006",
-		user: "#076678",
-		assistant: "#3c3836",
-		tool: "#8f3f71",
-		reasoning: "#a89984",
-		syntaxBlue: "#076678",
-		syntaxCyan: "#427b58",
-		syntaxTeal: "#427b58",
-		syntaxGreen: "#79740e",
-		syntaxYellow: "#b57614",
-		syntaxOrange: "#af3a03",
-		syntaxRed: "#9d0006",
-		syntaxMagenta: "#8f3f71"
-	}
-};
-const solarizedDark = {
-	id: "solarized-dark",
-	label: "Solarized Dark",
-	mode: "dark",
-	palette: {
-		fg: "#93a1a1",
-		muted: "#586e75",
-		dim: "#586e75",
-		faint: "#073642",
-		surface: "#00212b",
-		accent: "#268bd2",
-		success: "#859900",
-		warning: "#b58900",
-		error: "#dc322f",
-		user: "#268bd2",
-		assistant: "#93a1a1",
-		tool: "#6c71c4",
-		reasoning: "#586e75",
-		syntaxBlue: "#268bd2",
-		syntaxCyan: "#2aa198",
-		syntaxTeal: "#2aa198",
-		syntaxGreen: "#859900",
-		syntaxYellow: "#b58900",
-		syntaxOrange: "#cb4b16",
-		syntaxRed: "#dc322f",
-		syntaxMagenta: "#6c71c4"
-	}
-};
-const solarizedLight = {
-	id: "solarized-light",
-	label: "Solarized Light",
-	mode: "light",
-	palette: {
-		fg: "#657b83",
-		muted: "#839496",
-		dim: "#93a1a1",
-		faint: "#eee8d5",
-		surface: "#eee8d5",
-		accent: "#268bd2",
-		success: "#859900",
-		warning: "#b58900",
-		error: "#dc322f",
-		user: "#268bd2",
-		assistant: "#657b83",
-		tool: "#6c71c4",
-		reasoning: "#93a1a1",
-		syntaxBlue: "#268bd2",
-		syntaxCyan: "#2aa198",
-		syntaxTeal: "#2aa198",
-		syntaxGreen: "#859900",
-		syntaxYellow: "#b58900",
-		syntaxOrange: "#cb4b16",
-		syntaxRed: "#dc322f",
-		syntaxMagenta: "#6c71c4"
-	}
-};
-const nord = {
-	id: "nord",
-	label: "Nord",
-	mode: "dark",
-	palette: {
-		fg: "#d8dee9",
-		muted: "#616e88",
-		dim: "#4c566a",
-		faint: "#3b4252",
-		surface: "#272c36",
-		accent: "#88c0d0",
-		success: "#a3be8c",
-		warning: "#ebcb8b",
-		error: "#bf616a",
-		user: "#88c0d0",
-		assistant: "#d8dee9",
-		tool: "#b48ead",
-		reasoning: "#4c566a",
-		syntaxBlue: "#81a1c1",
-		syntaxCyan: "#88c0d0",
-		syntaxTeal: "#8fbcbb",
-		syntaxGreen: "#a3be8c",
-		syntaxYellow: "#ebcb8b",
-		syntaxOrange: "#d08770",
-		syntaxRed: "#bf616a",
-		syntaxMagenta: "#b48ead"
-	}
-};
-const dracula = {
-	id: "dracula",
-	label: "Dracula",
-	mode: "dark",
-	palette: {
-		fg: "#f8f8f2",
-		muted: "#6272a4",
-		dim: "#6272a4",
-		faint: "#44475a",
-		surface: "#21222c",
-		accent: "#bd93f9",
-		success: "#50fa7b",
-		warning: "#ffb86c",
-		error: "#ff5555",
-		user: "#bd93f9",
-		assistant: "#f8f8f2",
-		tool: "#ff79c6",
-		reasoning: "#6272a4",
-		syntaxBlue: "#bd93f9",
-		syntaxCyan: "#8be9fd",
-		syntaxTeal: "#8be9fd",
-		syntaxGreen: "#50fa7b",
-		syntaxYellow: "#f1fa8c",
-		syntaxOrange: "#ffb86c",
-		syntaxRed: "#ff5555",
-		syntaxMagenta: "#ff79c6"
-	}
-};
-const oneDark = {
-	id: "one-dark",
-	label: "One Dark",
-	mode: "dark",
-	palette: {
-		fg: "#abb2bf",
-		muted: "#5c6370",
-		dim: "#5c6370",
-		faint: "#3e4451",
-		surface: "#21252b",
-		accent: "#61afef",
-		success: "#98c379",
-		warning: "#e5c07b",
-		error: "#e06c75",
-		user: "#61afef",
-		assistant: "#abb2bf",
-		tool: "#c678dd",
-		reasoning: "#5c6370",
-		syntaxBlue: "#61afef",
-		syntaxCyan: "#56b6c2",
-		syntaxTeal: "#56b6c2",
-		syntaxGreen: "#98c379",
-		syntaxYellow: "#e5c07b",
-		syntaxOrange: "#d19a66",
-		syntaxRed: "#e06c75",
-		syntaxMagenta: "#c678dd"
-	}
-};
-const oneLight = {
-	id: "one-light",
-	label: "One Light",
-	mode: "light",
-	palette: {
-		fg: "#383a42",
-		muted: "#a0a1a7",
-		dim: "#a0a1a7",
-		faint: "#e5e5e6",
-		surface: "#f0f0f1",
-		accent: "#4078f2",
-		success: "#50a14f",
-		warning: "#c18401",
-		error: "#e45649",
-		user: "#4078f2",
-		assistant: "#383a42",
-		tool: "#a626a4",
-		reasoning: "#a0a1a7",
-		syntaxBlue: "#4078f2",
-		syntaxCyan: "#0184bc",
-		syntaxTeal: "#0184bc",
-		syntaxGreen: "#50a14f",
-		syntaxYellow: "#c18401",
-		syntaxOrange: "#986801",
-		syntaxRed: "#e45649",
-		syntaxMagenta: "#a626a4"
-	}
-};
-const rosePine = {
-	id: "rose-pine",
-	label: "Rosé Pine",
-	mode: "dark",
-	palette: {
-		fg: "#e0def4",
-		muted: "#908caa",
-		dim: "#6e6a86",
-		faint: "#403d52",
-		surface: "#16141f",
-		accent: "#c4a7e7",
-		success: "#9ccfd8",
-		warning: "#f6c177",
-		error: "#eb6f92",
-		user: "#c4a7e7",
-		assistant: "#e0def4",
-		tool: "#ebbcba",
-		reasoning: "#908caa",
-		syntaxBlue: "#9ccfd8",
-		syntaxCyan: "#9ccfd8",
-		syntaxTeal: "#31748f",
-		syntaxGreen: "#31748f",
-		syntaxYellow: "#f6c177",
-		syntaxOrange: "#ebbcba",
-		syntaxRed: "#eb6f92",
-		syntaxMagenta: "#c4a7e7"
-	}
-};
-const rosePineDawn = {
-	id: "rose-pine-dawn",
-	label: "Rosé Pine Dawn",
-	mode: "light",
-	palette: {
-		fg: "#575279",
-		muted: "#797593",
-		dim: "#9893a5",
-		faint: "#cecacd",
-		surface: "#f2e9e1",
-		accent: "#907aa9",
-		success: "#56949f",
-		warning: "#ea9d34",
-		error: "#b4637a",
-		user: "#907aa9",
-		assistant: "#575279",
-		tool: "#d7827e",
-		reasoning: "#9893a5",
-		syntaxBlue: "#56949f",
-		syntaxCyan: "#56949f",
-		syntaxTeal: "#286983",
-		syntaxGreen: "#286983",
-		syntaxYellow: "#ea9d34",
-		syntaxOrange: "#d7827e",
-		syntaxRed: "#b4637a",
-		syntaxMagenta: "#907aa9"
-	}
-};
-const everforestDark = {
-	id: "everforest-dark",
-	label: "Everforest Dark",
-	mode: "dark",
-	palette: {
-		fg: "#d3c6aa",
-		muted: "#859289",
-		dim: "#7a8478",
-		faint: "#414b50",
-		surface: "#232a2e",
-		accent: "#7fbbb3",
-		success: "#a7c080",
-		warning: "#dbbc7f",
-		error: "#e67e80",
-		user: "#7fbbb3",
-		assistant: "#d3c6aa",
-		tool: "#d699b6",
-		reasoning: "#7a8478",
-		syntaxBlue: "#7fbbb3",
-		syntaxCyan: "#83c092",
-		syntaxTeal: "#83c092",
-		syntaxGreen: "#a7c080",
-		syntaxYellow: "#dbbc7f",
-		syntaxOrange: "#e69875",
-		syntaxRed: "#e67e80",
-		syntaxMagenta: "#d699b6"
-	}
-};
-const everforestLight = {
-	id: "everforest-light",
-	label: "Everforest Light",
-	mode: "light",
-	palette: {
-		fg: "#5c6a72",
-		muted: "#939f91",
-		dim: "#a6b0a0",
-		faint: "#e0dcc7",
-		surface: "#f4f0d9",
-		accent: "#3a94c5",
-		success: "#8da101",
-		warning: "#dfa000",
-		error: "#f85552",
-		user: "#3a94c5",
-		assistant: "#5c6a72",
-		tool: "#df69ba",
-		reasoning: "#a6b0a0",
-		syntaxBlue: "#3a94c5",
-		syntaxCyan: "#35a77c",
-		syntaxTeal: "#35a77c",
-		syntaxGreen: "#8da101",
-		syntaxYellow: "#dfa000",
-		syntaxOrange: "#f57d26",
-		syntaxRed: "#f85552",
-		syntaxMagenta: "#df69ba"
-	}
-};
-const githubDark = {
-	id: "github-dark",
-	label: "GitHub Dark",
-	mode: "dark",
-	palette: {
-		fg: "#c9d1d9",
-		muted: "#8b949e",
-		dim: "#6e7681",
-		faint: "#30363d",
-		surface: "#161b22",
-		accent: "#58a6ff",
-		success: "#3fb950",
-		warning: "#d29922",
-		error: "#f85149",
-		user: "#58a6ff",
-		assistant: "#c9d1d9",
-		tool: "#bc8cff",
-		reasoning: "#6e7681",
-		syntaxBlue: "#58a6ff",
-		syntaxCyan: "#39c5cf",
-		syntaxTeal: "#39c5cf",
-		syntaxGreen: "#3fb950",
-		syntaxYellow: "#d29922",
-		syntaxOrange: "#db6d28",
-		syntaxRed: "#f85149",
-		syntaxMagenta: "#bc8cff"
-	}
-};
-const githubLight = {
-	id: "github-light",
-	label: "GitHub Light",
-	mode: "light",
-	palette: {
-		fg: "#24292f",
-		muted: "#57606a",
-		dim: "#8c959f",
-		faint: "#d0d7de",
-		surface: "#f6f8fa",
-		accent: "#0969da",
-		success: "#1a7f37",
-		warning: "#9a6700",
-		error: "#cf222e",
-		user: "#0969da",
-		assistant: "#24292f",
-		tool: "#8250df",
-		reasoning: "#8c959f",
-		syntaxBlue: "#0969da",
-		syntaxCyan: "#1b7c83",
-		syntaxTeal: "#1b7c83",
-		syntaxGreen: "#1a7f37",
-		syntaxYellow: "#9a6700",
-		syntaxOrange: "#bc4c00",
-		syntaxRed: "#cf222e",
-		syntaxMagenta: "#8250df"
-	}
-};
-const kanagawa = {
-	id: "kanagawa",
-	label: "Kanagawa",
-	mode: "dark",
-	palette: {
-		fg: "#dcd7ba",
-		muted: "#727169",
-		dim: "#54546d",
-		faint: "#363646",
-		surface: "#16161d",
-		accent: "#7e9cd8",
-		success: "#98bb6c",
-		warning: "#e6c384",
-		error: "#e46876",
-		user: "#7e9cd8",
-		assistant: "#dcd7ba",
-		tool: "#957fb8",
-		reasoning: "#727169",
-		syntaxBlue: "#7e9cd8",
-		syntaxCyan: "#7aa89f",
-		syntaxTeal: "#7aa89f",
-		syntaxGreen: "#98bb6c",
-		syntaxYellow: "#e6c384",
-		syntaxOrange: "#ffa066",
-		syntaxRed: "#e46876",
-		syntaxMagenta: "#957fb8"
-	}
-};
-const themes = [
-	tokyonight,
-	tokyonightDay,
-	catppuccinMocha,
-	catppuccinLatte,
-	gruvboxDark,
-	gruvboxLight,
-	solarizedDark,
-	solarizedLight,
-	nord,
-	dracula,
-	oneDark,
-	oneLight,
-	rosePine,
-	rosePineDawn,
-	everforestDark,
-	everforestLight,
-	githubDark,
-	githubLight,
-	kanagawa
-];
-const DEFAULT_THEME_ID = {
-	dark: tokyonight.id,
-	light: tokyonightDay.id
-};
-/** All-undefined palette for NO_COLOR: every fg/bg falls back to the
-* terminal's own defaults, so nothing emits color. Not listed in `themes` —
-* it's forced, never picked. */
-const monoTheme = {
-	id: "mono",
-	label: "No color",
-	mode: "dark",
-	palette: {
-		fg: void 0,
-		muted: void 0,
-		dim: void 0,
-		faint: void 0,
-		surface: void 0,
-		accent: void 0,
-		success: void 0,
-		warning: void 0,
-		error: void 0,
-		user: void 0,
-		assistant: void 0,
-		tool: void 0,
-		reasoning: void 0,
-		syntaxBlue: void 0,
-		syntaxCyan: void 0,
-		syntaxTeal: void 0,
-		syntaxGreen: void 0,
-		syntaxYellow: void 0,
-		syntaxOrange: void 0,
-		syntaxRed: void 0,
-		syntaxMagenta: void 0
-	}
-};
-function themesForMode(mode) {
-	return themes.filter((t) => t.mode === mode);
-}
-function findTheme(id) {
-	if (id === monoTheme.id) return monoTheme;
-	return themes.find((t) => t.id === id);
-}
-/**
-* The saved theme to use for a mode: the persisted pick if it exists *and*
-* still matches the mode (a stale/renamed id falls back), else the default.
-*/
-function themeForMode(mode, savedId) {
-	if (savedId) {
-		const saved = findTheme(savedId);
-		if (saved && saved.mode === mode) return saved;
-	}
-	return findTheme(DEFAULT_THEME_ID[mode]) ?? tokyonight;
-}
-/** https://no-color.org — any non-empty value disables color output. */
-function noColorRequested(env = process.env) {
-	const v = env["NO_COLOR"];
-	return v !== void 0 && v !== "";
-}
-/**
-* Fallback light/dark sniff for terminals that never answer the OSC 10/11
-* query: `COLORFGBG` is "<fg>;<bg>" (sometimes "<fg>;default;<bg>") with
-* ANSI palette indexes. Background 7/15 (white/bright white) means a light
-* terminal; anything else we call dark. Returns null when unset/unparsable.
-*/
-function themeModeFromColorFgBg(env = process.env) {
-	const raw = env["COLORFGBG"];
-	if (!raw) return null;
-	const parts = raw.split(";");
-	const bg = parts[parts.length - 1];
-	if (bg === void 0 || !/^\d+$/.test(bg)) return null;
-	const idx = Number(bg);
-	return idx === 7 || idx === 15 ? "light" : "dark";
-}
-/** Single source of truth for colors. Mutated in place by `applyTheme` so
-* existing `theme.fg`-style reads across the TUI stay valid. */
-const theme = { ...tokyonight.palette };
-let version = 0;
-function themeVersion() {
-	return version;
-}
-let mode = tokyonight.mode;
-function themeMode() {
-	return mode;
-}
-function applyTheme(def) {
-	Object.assign(theme, def.palette);
-	mode = def.mode;
-	version++;
-}
-
-//#endregion
-//#region src/chat/bun-runtime.ts
-/**
-* The chat TUI renders through OpenTUI, whose native core is Bun-first (its
-* FFI/native-module loading needs the Bun runtime; the Node path requires an
-* experimental `node:ffi` only present in very new Node). Rather than make the
-* user install Bun by hand, the CLI provisions a private, pinned Bun the first
-* time `chat` runs and transparently re-execs itself under it. Every other
-* command still runs under whatever Node the CLI was launched with — Bun is
-* only ever fetched for `chat`.
-*/
-/**
-* Bun release the CLI pins. Bump deliberately: the download is integrity-checked
-* against this exact release's published `SHASUMS256.txt`, and the cached binary
-* is keyed by version so bumping here transparently re-provisions on next `chat`.
-*/
-const PINNED_BUN_VERSION = "1.3.14";
-const BUN_RELEASE_BASE = process.env["SKYDIVE_BUN_RELEASE_BASE"] ?? "https://github.com/oven-sh/bun/releases/download";
-/** Guard env var: set on the child so a re-exec can never recurse. */
-const REEXEC_GUARD = "SKYDIVE_BUN_REEXEC";
-function isBun() {
-	return typeof process !== "undefined" && "bun" in process.versions;
-}
-/**
-* Map the current platform/arch to Bun's release asset basename (without the
-* `.zip`). Returns null on platforms Bun doesn't publish a build for, so the
-* caller can fall back to the manual-install message instead of a 404.
-*
-* We deliberately pick the portable (non-`baseline`, non-`musl`) x64 builds;
-* the baseline variant only matters for pre-2013 CPUs and isn't worth
-* auto-detecting here. If that ever bites someone, `SKYDIVE_BUN_PATH` lets them
-* point at their own Bun.
-*/
-function bunAssetTarget(platform = process.platform, arch = process.arch) {
-	const a = arch === "arm64" ? "aarch64" : arch === "x64" ? "x64" : null;
-	if (!a) return null;
-	switch (platform) {
-		case "linux": return `bun-linux-${a}`;
-		case "darwin": return `bun-darwin-${a}`;
-		case "win32": return a === "x64" ? "bun-windows-x64" : null;
-		default: return null;
+//#region src/chat/bun-runtime.ts
+/**
+* The chat TUI renders through OpenTUI, whose native core is Bun-first (its
+* FFI/native-module loading needs the Bun runtime; the Node path requires an
+* experimental `node:ffi` only present in very new Node). Rather than make the
+* user install Bun by hand, the CLI provisions a private, pinned Bun the first
+* time `chat` runs and transparently re-execs itself under it. Every other
+* command still runs under whatever Node the CLI was launched with — Bun is
+* only ever fetched for `chat`.
+*/
+/**
+* Bun release the CLI pins. Bump deliberately: the download is integrity-checked
+* against this exact release's published `SHASUMS256.txt`, and the cached binary
+* is keyed by version so bumping here transparently re-provisions on next `chat`.
+*/
+const PINNED_BUN_VERSION = "1.3.14";
+const BUN_RELEASE_BASE = process.env["SKYDIVE_BUN_RELEASE_BASE"] ?? "https://github.com/oven-sh/bun/releases/download";
+/** Guard env var: set on the child so a re-exec can never recurse. */
+const REEXEC_GUARD = "SKYDIVE_BUN_REEXEC";
+function isBun() {
+	return typeof process !== "undefined" && "bun" in process.versions;
+}
+/**
+* Map the current platform/arch to Bun's release asset basename (without the
+* `.zip`). Returns null on platforms Bun doesn't publish a build for, so the
+* caller can fall back to the manual-install message instead of a 404.
+*
+* We deliberately pick the portable (non-`baseline`, non-`musl`) x64 builds;
+* the baseline variant only matters for pre-2013 CPUs and isn't worth
+* auto-detecting here. If that ever bites someone, `SKYDIVE_BUN_PATH` lets them
+* point at their own Bun.
+*/
+function bunAssetTarget(platform = process.platform, arch = process.arch) {
+	const a = arch === "arm64" ? "aarch64" : arch === "x64" ? "x64" : null;
+	if (!a) return null;
+	switch (platform) {
+		case "linux": return `bun-linux-${a}`;
+		case "darwin": return `bun-darwin-${a}`;
+		case "win32": return a === "x64" ? "bun-windows-x64" : null;
+		default: return null;
 	}
 }
 /** Directory holding CLI-managed binaries, beside the config file. */
@@ -1842,88 +1061,393 @@ function extractBunFromZip(zip, target) {
 	}
 	throw new Error(`bun binary not found in release zip for ${target}`);
 }
-/**
-* Download, verify, and cache the pinned Bun for this platform. Returns the
-* path to the cached executable, or null if Bun can't be provisioned (no
-* network, unsupported platform, checksum mismatch) — the caller then prints
-* the manual-install guidance. Never throws for the expected failure modes.
-*/
-async function downloadBun(onProgress) {
-	const target = bunAssetTarget();
-	if (!target) return null;
-	const assetName = `${target}.zip`;
-	const dest = cachedBunPath();
-	try {
-		onProgress?.(`Fetching Bun v${PINNED_BUN_VERSION} (one-time setup)…`);
-		const url = `${BUN_RELEASE_BASE}/bun-v${PINNED_BUN_VERSION}/${assetName}`;
-		const [zipRes, want] = await Promise.all([fetchOk(url), expectedSha256(PINNED_BUN_VERSION, assetName)]);
-		const zip = Buffer.from(await zipRes.arrayBuffer());
-		const got = sha256(zip);
-		if (got !== want) {
-			onProgress?.(`Bun download failed integrity check (expected ${want}, got ${got}).`);
-			return null;
+/**
+* Download, verify, and cache the pinned Bun for this platform. Returns the
+* path to the cached executable, or null if Bun can't be provisioned (no
+* network, unsupported platform, checksum mismatch) — the caller then prints
+* the manual-install guidance. Never throws for the expected failure modes.
+*/
+async function downloadBun(onProgress) {
+	const target = bunAssetTarget();
+	if (!target) return null;
+	const assetName = `${target}.zip`;
+	const dest = cachedBunPath();
+	try {
+		onProgress?.(`Fetching Bun v${PINNED_BUN_VERSION} (one-time setup)…`);
+		const url = `${BUN_RELEASE_BASE}/bun-v${PINNED_BUN_VERSION}/${assetName}`;
+		const [zipRes, want] = await Promise.all([fetchOk(url), expectedSha256(PINNED_BUN_VERSION, assetName)]);
+		const zip = Buffer.from(await zipRes.arrayBuffer());
+		const got = sha256(zip);
+		if (got !== want) {
+			onProgress?.(`Bun download failed integrity check (expected ${want}, got ${got}).`);
+			return null;
+		}
+		const bin = extractBunFromZip(zip, target);
+		fs.mkdirSync(path.dirname(dest), { recursive: true });
+		const tmp = path.join(path.dirname(dest), `.bun.tmp-${process.pid}-${Date.now()}`);
+		fs.writeFileSync(tmp, bin, { mode: 493 });
+		if (process.platform !== "win32") fs.chmodSync(tmp, 493);
+		fs.renameSync(tmp, dest);
+		return dest;
+	} catch (e) {
+		onProgress?.(`Could not download Bun automatically: ${e instanceof Error ? e.message : String(e)}`);
+		return null;
+	}
+}
+/**
+* Ensure a usable Bun exists: already running under Bun, found on disk/PATH, or
+* freshly downloaded and cached. Pure resolution — does not re-exec.
+*/
+async function resolveBun(onProgress) {
+	if (isBun()) return { kind: "already-bun" };
+	const existing = findExistingBun();
+	if (existing) return {
+		kind: "found",
+		bunPath: existing
+	};
+	const downloaded = await downloadBun(onProgress);
+	if (downloaded) return {
+		kind: "found",
+		bunPath: downloaded
+	};
+	return { kind: "unavailable" };
+}
+/**
+* The heart of the transparent-Bun story. Called by `chat` before it touches
+* OpenTUI:
+*   - Under Bun already, or if a re-exec guard is set: return 'proceed'.
+*   - Otherwise resolve/provision Bun and re-exec this exact CLI invocation
+*     under it (inheriting stdio + argv), then exit with the child's code.
+*   - If Bun can't be provisioned: return 'unavailable' so the caller prints
+*     the existing manual-install message.
+*
+* Returns 'proceed' only when it's safe to load OpenTUI in this process.
+*/
+function ensureBunAndReexec(onProgress) {
+	if (isBun() || process.env[REEXEC_GUARD] === "1") return Promise.resolve("proceed");
+	return resolveBun(onProgress).then((resolution) => {
+		if (resolution.kind === "already-bun") return "proceed";
+		if (resolution.kind === "unavailable") return "unavailable";
+		const argv = process.argv.slice(1);
+		const result = spawnSync(resolution.bunPath, argv, {
+			stdio: "inherit",
+			env: {
+				...process.env,
+				[REEXEC_GUARD]: "1"
+			}
+		});
+		if (result.error) {
+			onProgress?.(`Failed to launch chat under Bun (${resolution.bunPath}): ${result.error.message}`);
+			return "unavailable";
+		}
+		process.exit(result.status ?? 0);
+	});
+}
+
+//#endregion
+//#region src/commands/import.ts
+/**
+* The first message of the import conversation, sent as the user. It hands
+* the real work to the agent's `import-config` skill; this text only needs
+* to establish intent, anchor the starting directory, and set the two
+* expectations the user cares about most (plan first, no credentials).
+*/
+function buildImportSeedPrompt(projectDir) {
+	return [
+		"I'm migrating from another coding agent — import my setup from this machine.",
+		"",
+		`Use your import-config skill. I ran this from \`${projectDir}\`, so start there (and my home directory) when you inventory what I have. Show me the plan first — what you'll bring over, where it lands in you, and anything you're leaving out (credentials especially) — and wait for my OK before committing anything.`
+	].join("\n");
+}
+const importCommand = {
+	command: "import",
+	describe: "Import your Claude Code / Cursor / OpenCode setup into an agent (opens a machine-shared chat)",
+	builder: (y) => y.option("agent", {
+		type: "string",
+		describe: "Target agent, by id, slug, or name. Optional: with one agent on the account it is auto-picked; otherwise the agent picker opens first (interactive) or resolution follows the -p rules."
+	}).option("print", {
+		alias: "p",
+		type: "string",
+		describe: "Non-interactive: send the import request as a one-shot, print the agent's plan, and exit (drivable from scripts or another coding agent). An optional value adds extra instructions to the request. The agent still waits for approval — continue the printed conversation with `skydive chat -p \"go ahead\" --resume <id> --share-machine`. Runs under Node."
+	}).example("skydive import", "Import from the current directory").example("skydive import --agent kit", "Import into a specific agent, skipping the picker").example("skydive import -p --agent kit", "One-shot: print the agent's import plan and exit"),
+	handler: async (argv) => {
+		const appUrl = resolveAppUrl({ appUrl: argv["api-url"] });
+		if (argv.print !== void 0) {
+			await runImportPrintMode({
+				argv,
+				appUrl
+			});
+			return;
+		}
+		if (isNonInteractive()) {
+			printError("import without -p is an interactive chat session and needs a terminal. For scripts (or driving this from another agent), use `skydive import -p --agent <agent>`.");
+			process.exit(1);
+		}
+		if (await ensureBunAndReexec((msg) => process.stderr.write(`${msg}\n`)) === "unavailable") {
+			printError(`import needs the Bun runtime and it couldn't be set up automatically. Install Bun (https://bun.sh) and run \`bun ${process.argv[1] ?? "skydive"} import\`, point SKYDIVE_BUN_PATH at an existing bun binary, or use the non-interactive \`import -p\` (runs under Node).`);
+			process.exit(1);
+		}
+		let session = resolveSession({ appUrl });
+		if (session.isErr()) {
+			const login = await loginWithDevice({ appUrl });
+			if (login.isErr()) {
+				printError(login.error.message);
+				process.exit(1);
+			}
+			session = resolveSession({ appUrl });
+			if (session.isErr()) {
+				printError("Signed in, but no session was stored.");
+				process.exit(1);
+			}
+		}
+		const { runChat } = await import("./boot-CQLDUeZ9.mjs");
+		await runChat({
+			appUrl,
+			sessionToken: session.value.sessionToken,
+			shareMachine: true,
+			promptHistoryPath: getPromptHistoryPath(),
+			notifications: true,
+			agentSelector: argv.agent ?? null,
+			conversationId: null,
+			seedPrompt: buildImportSeedPrompt(process.cwd())
+		});
+	}
+};
+/**
+* `import -p`: the same seeded, machine-shared request as the TUI flow, as a
+* one-shot print run (no TTY, no Bun). The agent's reply is its import plan —
+* per the import-config skill it must NOT commit anything until approved, so
+* the caller reviews the plan and continues the conversation
+* (`chat -p "go ahead" --resume <id> --share-machine`) to apply it.
+*/
+async function runImportPrintMode({ argv, appUrl }) {
+	const session = resolveSession({ appUrl });
+	if (session.isErr()) {
+		printError(`${session.error.message} For non-interactive use, run \`skydive auth login --web\` first, or set SKYDIVE_SESSION_TOKEN.`);
+		process.exit(1);
+	}
+	const { connectMachineShare } = await import("./print-share-D7OSxvE2.mjs");
+	const machineShare = await connectMachineShare({
+		appUrl,
+		sessionToken: session.value.sessionToken,
+		timeoutHint: "Check `skydive portal status`, then re-run."
+	});
+	const extra = (argv.print ?? "").trim();
+	const prompt = buildImportSeedPrompt(process.cwd()) + (extra ? `\n\nAdditional instructions: ${extra}` : "");
+	const { runPrint } = await import("./print-B6AO13SA.mjs");
+	try {
+		const result = await runPrint({
+			appUrl,
+			sessionToken: session.value.sessionToken,
+			prompt,
+			agentSelector: argv.agent ?? null,
+			conversationId: null,
+			json: argv.json,
+			machineShare,
+			grantTargetAgent: true
+		});
+		if (argv.json) output(argv, result);
+		else console.error(`\nTo approve or adjust this plan: skydive chat -p "<your answer>" --agent ${result.agentId} --resume ${result.conversationId} --share-machine`);
+	} catch (error) {
+		printError(error instanceof Error ? error.message : String(error));
+		process.exit(1);
+	} finally {
+		machineShare.dispose();
+	}
+}
+
+//#endregion
+//#region src/commands/keys.ts
+const listCommand$3 = {
+	command: "list",
+	describe: "List API keys for an agent",
+	handler: async (argv) => {
+		const result = await requireManagementClient(argv).listKeys(argv["agent-id"]);
+		if (result.isErr()) {
+			printError(result.error.message);
+			process.exit(1);
+		}
+		const keys = result.value;
+		if (argv.json) {
+			output(argv, keys);
+			return;
+		}
+		if (keys.length === 0) {
+			console.log("No API keys found.");
+			return;
+		}
+		printTable([
+			"Name",
+			"Prefix",
+			"Last Used",
+			"Created"
+		], keys.map((k) => [
+			k.name,
+			k.prefix,
+			k.lastUsedAt ? new Date(k.lastUsedAt).toLocaleDateString() : "Never",
+			new Date(k.createdAt).toLocaleDateString()
+		]));
+	}
+};
+const createCommand = {
+	command: "create <name>",
+	describe: "Create a new API key for an agent",
+	builder: (y) => y.positional("name", {
+		type: "string",
+		demandOption: true,
+		describe: "Key name"
+	}),
+	handler: async (argv) => {
+		const result = await requireManagementClient(argv).createKey(argv["agent-id"], argv.name);
+		if (result.isErr()) {
+			printError(result.error.message);
+			process.exit(1);
+		}
+		const key = result.value;
+		if (argv.json) {
+			output(argv, key);
+			return;
+		}
+		if (argv.quiet) {
+			console.log(key.key);
+			return;
+		}
+		console.log(`API key created.`);
+		console.log(`  Name: ${key.name}`);
+		console.log(`  Key:  ${key.key}`);
+		console.log("");
+		console.log("  Save this key — it will not be shown again.");
+	}
+};
+const revokeCommand$1 = {
+	command: "revoke <id>",
+	describe: "Revoke an API key",
+	builder: (y) => y.positional("id", {
+		type: "string",
+		demandOption: true,
+		describe: "Key ID"
+	}),
+	handler: async (argv) => {
+		const result = await requireManagementClient(argv).revokeKey(argv["agent-id"], argv.id);
+		if (result.isErr()) {
+			printError(result.error.message);
+			process.exit(1);
+		}
+		if (argv.json) output(argv, {
+			revoked: true,
+			id: argv.id
+		});
+		else if (!argv.quiet) console.log(`Key ${argv.id} revoked.`);
+	}
+};
+const keysCommand = {
+	command: "keys",
+	describe: "Manage API keys for an agent",
+	builder: (y) => y.option("agent-id", {
+		type: "string",
+		demandOption: true,
+		describe: "Agent ID"
+	}).command(listCommand$3).command(createCommand).command(revokeCommand$1).demandCommand(1, "Specify a subcommand: list, create, revoke"),
+	handler: () => {}
+};
+
+//#endregion
+//#region src/commands/secrets.ts
+/** Read all of stdin as UTF-8, trimming a single trailing newline. */
+async function readStdin() {
+	const chunks = [];
+	for await (const chunk of process.stdin) chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+	return Buffer.concat(chunks).toString("utf8").replace(/\n$/, "");
+}
+const listCommand$2 = {
+	command: "list",
+	describe: "List secret names for an agent (values are never shown)",
+	handler: async (argv) => {
+		const result = await requireManagementClient(argv).listSecrets(argv["agent-id"]);
+		if (result.isErr()) {
+			printError(result.error.message);
+			process.exit(1);
 		}
-		const bin = extractBunFromZip(zip, target);
-		fs.mkdirSync(path.dirname(dest), { recursive: true });
-		const tmp = path.join(path.dirname(dest), `.bun.tmp-${process.pid}-${Date.now()}`);
-		fs.writeFileSync(tmp, bin, { mode: 493 });
-		if (process.platform !== "win32") fs.chmodSync(tmp, 493);
-		fs.renameSync(tmp, dest);
-		return dest;
-	} catch (e) {
-		onProgress?.(`Could not download Bun automatically: ${e instanceof Error ? e.message : String(e)}`);
-		return null;
+		const keys = result.value;
+		if (argv.json) {
+			output(argv, keys);
+			return;
+		}
+		if (keys.length === 0) {
+			console.log("No secrets found.");
+			return;
+		}
+		printTable(["Name"], keys.map((k) => [k]));
 	}
-}
-/**
-* Ensure a usable Bun exists: already running under Bun, found on disk/PATH, or
-* freshly downloaded and cached. Pure resolution — does not re-exec.
-*/
-async function resolveBun(onProgress) {
-	if (isBun()) return { kind: "already-bun" };
-	const existing = findExistingBun();
-	if (existing) return {
-		kind: "found",
-		bunPath: existing
-	};
-	const downloaded = await downloadBun(onProgress);
-	if (downloaded) return {
-		kind: "found",
-		bunPath: downloaded
-	};
-	return { kind: "unavailable" };
-}
-/**
-* The heart of the transparent-Bun story. Called by `chat` before it touches
-* OpenTUI:
-*   - Under Bun already, or if a re-exec guard is set: return 'proceed'.
-*   - Otherwise resolve/provision Bun and re-exec this exact CLI invocation
-*     under it (inheriting stdio + argv), then exit with the child's code.
-*   - If Bun can't be provisioned: return 'unavailable' so the caller prints
-*     the existing manual-install message.
-*
-* Returns 'proceed' only when it's safe to load OpenTUI in this process.
-*/
-function ensureBunAndReexec(onProgress) {
-	if (isBun() || process.env[REEXEC_GUARD] === "1") return Promise.resolve("proceed");
-	return resolveBun(onProgress).then((resolution) => {
-		if (resolution.kind === "already-bun") return "proceed";
-		if (resolution.kind === "unavailable") return "unavailable";
-		const argv = process.argv.slice(1);
-		const result = spawnSync(resolution.bunPath, argv, {
-			stdio: "inherit",
-			env: {
-				...process.env,
-				[REEXEC_GUARD]: "1"
+};
+const setCommand = {
+	command: "set <key> [value]",
+	describe: "Set (create or overwrite) a secret. Reads value from stdin if omitted.",
+	builder: (y) => y.positional("key", {
+		type: "string",
+		demandOption: true,
+		describe: "Secret name (uppercase letters, digits, underscores)"
+	}).positional("value", {
+		type: "string",
+		describe: "Secret value. If omitted, read from stdin — keeps the value out of shell history."
+	}),
+	handler: async (argv) => {
+		let value = argv.value;
+		if (value === void 0) {
+			if (process.stdin.isTTY) {
+				printError("No value given. Pass it as an argument or pipe it on stdin, e.g. `echo -n \"$TOKEN\" | skydive secrets set MY_KEY --agent-id <id>`.");
+				process.exit(1);
 			}
+			value = await readStdin();
+		}
+		if (!value) {
+			printError("Empty secret value.");
+			process.exit(1);
+		}
+		const result = await requireManagementClient(argv).setSecret(argv["agent-id"], argv.key, value);
+		if (result.isErr()) {
+			printError(result.error.message);
+			process.exit(1);
+		}
+		if (argv.json) output(argv, {
+			key: result.value,
+			set: true
 		});
-		if (result.error) {
-			onProgress?.(`Failed to launch chat under Bun (${resolution.bunPath}): ${result.error.message}`);
-			return "unavailable";
+		else if (!argv.quiet) console.log(`Secret ${result.value} set.`);
+	}
+};
+const rmCommand = {
+	command: "rm <key>",
+	aliases: ["delete"],
+	describe: "Remove a secret from the agent",
+	builder: (y) => y.positional("key", {
+		type: "string",
+		demandOption: true,
+		describe: "Secret name"
+	}),
+	handler: async (argv) => {
+		const result = await requireManagementClient(argv).deleteSecret(argv["agent-id"], argv.key);
+		if (result.isErr()) {
+			printError(result.error.message);
+			process.exit(1);
 		}
-		process.exit(result.status ?? 0);
-	});
-}
+		if (argv.json) output(argv, {
+			key: argv.key,
+			removed: true
+		});
+		else if (!argv.quiet) console.log(`Secret ${argv.key} removed.`);
+	}
+};
+const secretsCommand = {
+	command: "secrets",
+	describe: "Manage an agent’s secrets",
+	builder: (y) => y.option("agent-id", {
+		type: "string",
+		demandOption: true,
+		describe: "Agent ID"
+	}).command(listCommand$2).command(setCommand).command(rmCommand).demandCommand(1, "Specify a subcommand: list, set, rm"),
+	handler: () => {}
+};
 
 //#endregion
 //#region src/commands/chat.ts
@@ -1938,12 +1462,12 @@ const chatCommand = {
 		type: "string",
 		describe: "Target agent, by id, slug, or name. With -p, the agent to send the one-shot prompt to. Without -p, pre-selects the agent and opens its conversation list, skipping the agent picker. Optional when the account has exactly one agent."
 	}).option("conversation", {
+		alias: "resume",
 		type: "string",
-		describe: "For -p: continue an existing conversation by id instead of starting a new one."
+		describe: "Continue an existing conversation by id. With -p, the one-shot lands in that conversation; without -p, the TUI opens directly into it (the agent is resolved from the conversation, no --agent needed)."
 	}).option("share-machine", {
 		type: "boolean",
-		default: false,
-		describe: "Share this machine with the agent over the portal so it can run commands here (default-deny; you approve per agent)"
+		describe: "Share this machine with the agent over the portal so it can run commands here (default-deny; in the TUI you approve per agent, with -p the flag grants the target agent for the run). Defaults to `shareMachineDefault` in the CLI config file; --no-share-machine disables for this invocation."
 	}).option("theme", {
 		type: "string",
 		describe: `Pin a colorscheme (disables automatic light/dark switching). One of: ${themes.map((t) => t.id).join(", ")}. Defaults to following the terminal background; also settable via SKYDIVE_THEME.`
@@ -1951,7 +1475,7 @@ const chatCommand = {
 		type: "boolean",
 		default: true,
 		describe: "Show a desktop notification when a run finishes or needs your input while this terminal is unfocused (use --no-notify to disable)"
-	}).example("skydive chat -p \"summarize my open PRs\" --agent grace", "One-shot, non-interactive").example("echo \"what changed today?\" | skydive chat -p --agent grace", "Read the prompt from stdin").example("skydive chat --agent grace", "Open Grace's conversation list in the TUI (skips the agent picker)"),
+	}).example("skydive chat -p \"summarize my open PRs\" --agent grace", "One-shot, non-interactive").example("echo \"what changed today?\" | skydive chat -p --agent grace", "Read the prompt from stdin").example("skydive chat --agent grace", "Open Grace's conversation list in the TUI (skips the agent picker)").example("skydive chat --resume 0197e0f3-…", "Reopen a previous conversation in the TUI (the id is printed when you quit a chat)"),
 	handler: async (argv) => {
 		const appUrl = resolveAppUrl({ appUrl: argv["api-url"] });
 		if (argv.print !== void 0) {
@@ -1968,7 +1492,7 @@ const chatCommand = {
 		let session = resolveSession({ appUrl });
 		if (session.isErr()) {
 			if (isNonInteractive()) {
-				printError("Not signed in for chat and no interactive terminal. Run `skydive auth login --web`, or set SKYDIVE_SESSION_TOKEN.");
+				printError("Not signed in for chat and no interactive terminal. Run `skydive auth login`, or set SKYDIVE_SESSION_TOKEN.");
 				process.exit(1);
 			}
 			const login = await loginWithDevice({ appUrl });
@@ -1982,68 +1506,250 @@ const chatCommand = {
 				process.exit(1);
 			}
 		}
-		const themeId = argv.theme ?? process.env["SKYDIVE_THEME"] ?? void 0;
-		if (themeId !== void 0 && !themes.some((t) => t.id === themeId)) {
-			printError(`Unknown theme "${themeId}". Valid themes: ${themes.map((t) => t.id).join(", ")}`);
-			process.exit(1);
+		const themeId = argv.theme ?? process.env["SKYDIVE_THEME"] ?? void 0;
+		if (themeId !== void 0 && !themes.some((t) => t.id === themeId)) {
+			printError(`Unknown theme "${themeId}". Valid themes: ${themes.map((t) => t.id).join(", ")}`);
+			process.exit(1);
+		}
+		const { runChat } = await import("./boot-CQLDUeZ9.mjs");
+		await runChat({
+			appUrl,
+			sessionToken: session.value.sessionToken,
+			shareMachine: resolveShareMachine(argv),
+			promptHistoryPath: getPromptHistoryPath(),
+			theme: themeId,
+			notifications: argv.notify,
+			agentSelector: argv.agent ?? null,
+			conversationId: argv.conversation ?? null,
+			seedPrompt: null
+		});
+	}
+};
+/**
+* Whether this invocation shares the machine: an explicit
+* --share-machine/--no-share-machine wins; otherwise fall back to the
+* persisted `shareMachineDefault` config value.
+*/
+function resolveShareMachine(argv) {
+	return argv["share-machine"] ?? getShareMachineDefault();
+}
+async function runPrintMode({ argv, appUrl }) {
+	const session = resolveSession({ appUrl });
+	if (session.isErr()) {
+		printError(`${session.error.message} For non-interactive use, run \`skydive auth login\` first, or set SKYDIVE_SESSION_TOKEN.`);
+		process.exit(1);
+	}
+	const { runPrint, readStdin } = await import("./print-B6AO13SA.mjs");
+	let prompt = (argv.print ?? "").trim();
+	if (!prompt) {
+		if (process.stdin.isTTY) {
+			printError("No prompt given. Pass it inline (`-p \"your prompt\"`) or pipe it on stdin.");
+			process.exit(1);
+		}
+		prompt = (await readStdin()).trim();
+		if (!prompt) {
+			printError("Empty prompt on stdin.");
+			process.exit(1);
+		}
+	}
+	let machineShare = null;
+	if (resolveShareMachine(argv)) {
+		const { connectMachineShare } = await import("./print-share-D7OSxvE2.mjs");
+		machineShare = await connectMachineShare({
+			appUrl,
+			sessionToken: session.value.sessionToken,
+			timeoutHint: "Re-run with --no-share-machine (or unset `shareMachineDefault` in the CLI config), or check `skydive portal status`."
+		});
+	}
+	try {
+		const result = await runPrint({
+			appUrl,
+			sessionToken: session.value.sessionToken,
+			prompt,
+			agentSelector: argv.agent ?? null,
+			conversationId: argv.conversation ?? null,
+			json: argv.json,
+			machineShare,
+			grantTargetAgent: argv["share-machine"] === true
+		});
+		if (argv.json) output(argv, result);
+	} catch (error) {
+		printError(error instanceof Error ? error.message : String(error));
+		process.exit(1);
+	} finally {
+		machineShare?.dispose();
+	}
+}
+
+//#endregion
+//#region src/commands/messages.ts
+/**
+* `skydive messages get <messageId>` re-attaches to an exchange by message id
+* and prints the agent's reply.
+*
+* This is the recovery path for `chat -p`: a long run's stream can drop at the
+* edge (Cloudflare 502/504) after the message was accepted, leaving the caller
+* with a messageId but no result. The agent keeps working server-side, so a
+* blind retry would double-execute an agent that may have write access.
+* Instead, fetch the finished result by message id here — the server resolves
+* the run behind the message and replays it from its persisted event log, so
+* this works whether the run is still live or already done.
+*
+* Message ids are the currency of this API: `chat -p --json` reports the
+* `messageId` and this command consumes it. Run ids stay server-side.
+*/
+const getCommand = {
+	command: "get <message-id>",
+	describe: "Fetch a message by id and print the reply (recovers a timed-out -p)",
+	builder: (y) => y.positional("message-id", {
+		type: "string",
+		demandOption: true,
+		describe: "Message id (the `messageId` from a prior `chat -p --json`)"
+	}),
+	handler: async (argv) => {
+		const appUrl = resolveAppUrl({ appUrl: argv["api-url"] });
+		const session = resolveSession({ appUrl });
+		if (session.isErr()) {
+			printError(`${session.error.message} Run \`skydive auth login\` first, or set SKYDIVE_SESSION_TOKEN.`);
+			process.exit(1);
+		}
+		const { messageGet } = await import("./print-B6AO13SA.mjs");
+		try {
+			const result = await messageGet({
+				appUrl,
+				sessionToken: session.value.sessionToken,
+				messageId: argv["message-id"],
+				json: argv.json
+			});
+			if (argv.json) output(argv, result);
+		} catch (error) {
+			printError(error instanceof Error ? error.message : String(error));
+			process.exit(1);
+		}
+	}
+};
+const messagesCommand = {
+	command: "messages",
+	describe: "Inspect chat messages and re-fetch agent replies",
+	builder: (y) => y.command(getCommand).demandCommand(1, "Specify a subcommand: get"),
+	handler: () => {}
+};
+
+//#endregion
+//#region src/commands/conversations.ts
+/**
+* Flatten a UiMessage's parts into plain text for the non-JSON view. Text and
+* reasoning parts are concatenated; tool calls are summarized to one line so a
+* transcript stays readable without the rich TUI rendering. This is a
+* lossy-but-legible view; `--json` carries the full structured parts for a
+* driving agent that wants everything.
+*/
+function messageToText(message) {
+	const chunks = [];
+	for (const part of message.parts) if (part.type === "text" && typeof part.text === "string") chunks.push(part.text);
+	else if (part.type === "reasoning" && typeof part.text === "string") chunks.push(part.text);
+	else if (part.type === "dynamic-tool" && "toolName" in part) {
+		const toolName = typeof part.toolName === "string" ? part.toolName : "tool";
+		chunks.push(`[tool: ${toolName}]`);
+	}
+	return chunks.join("\n").trim();
+}
+const listCommand$1 = {
+	command: "list",
+	describe: "List an agent's conversations",
+	builder: (y) => y.option("agent", {
+		type: "string",
+		describe: "Agent whose conversations to list, by id, slug, or name. Optional when the account has exactly one agent."
+	}).option("limit", {
+		type: "number",
+		describe: "Max conversations to return"
+	}),
+	handler: async (argv) => {
+		const client = requireRestClient(argv);
+		const agent = resolveAgent(await client.listAgents({
+			scope: "org",
+			onPage: null
+		}), argv.agent ?? null);
+		const conversations = await client.listConversations({
+			agentId: agent.id,
+			limit: argv.limit,
+			onPage: null
+		});
+		if (argv.json) {
+			output(argv, conversations);
+			return;
+		}
+		if (conversations.length === 0) {
+			console.log("No conversations found.");
+			return;
 		}
-		const { runChat } = await import("./boot-ChlVx-ts.mjs");
-		await runChat({
-			appUrl,
-			sessionToken: session.value.sessionToken,
-			shareMachine: argv["share-machine"],
-			promptHistoryPath: getPromptHistoryPath(),
-			theme: themeId,
-			notifications: argv.notify,
-			agentSelector: argv.agent ?? null
-		});
+		printTable([
+			"ID",
+			"Title",
+			"Updated",
+			"Preview"
+		], conversations.map((c) => [
+			c.id,
+			c.title ?? "-",
+			c.updatedAt,
+			(c.preview ?? "").replace(/\s+/g, " ").slice(0, 48) || "-"
+		]));
 	}
 };
-async function runPrintMode({ argv, appUrl }) {
-	const session = resolveSession({ appUrl });
-	if (session.isErr()) {
-		printError(`${session.error.message} For non-interactive use, run \`skydive auth login --web\` first, or set SKYDIVE_SESSION_TOKEN.`);
-		process.exit(1);
-	}
-	const { runPrint, readStdin } = await import("./print-BHbFMxQv.mjs").then((n) => n.t);
-	let prompt = (argv.print ?? "").trim();
-	if (!prompt) {
-		if (process.stdin.isTTY) {
-			printError("No prompt given. Pass it inline (`-p \"your prompt\"`) or pipe it on stdin.");
-			process.exit(1);
+const showCommand = {
+	command: "show <conversation-id>",
+	describe: "Print a conversation transcript",
+	builder: (y) => y.positional("conversation-id", {
+		type: "string",
+		demandOption: true,
+		describe: "Conversation id"
+	}).option("recap", {
+		type: "boolean",
+		default: false,
+		describe: "Print the conversation recap instead of the full transcript"
+	}),
+	handler: async (argv) => {
+		const client = requireRestClient(argv);
+		const conversationId = argv["conversation-id"];
+		if (argv.recap) {
+			const recap = await client.getRecap({ conversationId });
+			if (argv.json) {
+				output(argv, {
+					conversationId,
+					recap
+				});
+				return;
+			}
+			console.log(recap ?? "(no recap available)");
+			return;
 		}
-		prompt = (await readStdin()).trim();
-		if (!prompt) {
-			printError("Empty prompt on stdin.");
-			process.exit(1);
+		const messages = await client.listMessages({ conversationId });
+		if (argv.json) {
+			output(argv, messages);
+			return;
+		}
+		if (messages.length === 0) {
+			console.log("No messages in this conversation.");
+			return;
+		}
+		for (const message of messages) {
+			const text = messageToText(message);
+			if (!text) continue;
+			console.log(`\n[${message.role}]`);
+			console.log(text);
 		}
 	}
-	try {
-		const result = await runPrint({
-			appUrl,
-			sessionToken: session.value.sessionToken,
-			prompt,
-			agentSelector: argv.agent ?? null,
-			conversationId: argv.conversation ?? null,
-			json: argv.json
-		});
-		if (argv.json) output(argv, result);
-	} catch (error) {
-		printError(error instanceof Error ? error.message : String(error));
-		process.exit(1);
-	}
-}
+};
+const conversationsCommand = {
+	command: "conversations",
+	aliases: ["conv"],
+	describe: "List and read agent conversations",
+	builder: (y) => y.command(listCommand$1).command(showCommand).demandCommand(1, "Specify a subcommand: list, show"),
+	handler: () => {}
+};
 
 //#endregion
 //#region src/commands/workspace.ts
-function requireSession(argv) {
-	const session = resolveSession({ appUrl: argv["api-url"] });
-	if (session.isErr()) {
-		printError("Not signed in for chat. Run `skydive auth login --web` first.");
-		process.exit(1);
-	}
-	return session.value;
-}
 /**
 * List the account's workspaces, marking the active one. Shared by the `list`
 * subcommand and the bare `workspace` invocation. When `hint` is true (the bare
@@ -2078,7 +1784,7 @@ async function runList(argv, { hint }) {
 		w.name,
 		w.slug
 	]));
-	if (hint && !argv.quiet) console.log("\nRun `skydive workspace switch <slug>` to switch which workspace `skydive chat` uses.");
+	if (hint && !argv.quiet) console.log("\nRun `skydive workspace switch` to pick a workspace, or pass its slug directly.");
 }
 const listCommand = {
 	command: "list",
@@ -2086,15 +1792,28 @@ const listCommand = {
 	handler: (argv) => runList(argv, { hint: false })
 };
 const switchCommand = {
-	command: "switch <workspace>",
-	describe: "Switch which workspace `skydive chat` uses",
+	command: "switch [workspace]",
+	describe: "Switch the workspace all `skydive` commands act on",
 	builder: (y) => y.positional("workspace", {
 		type: "string",
-		demandOption: true,
+		demandOption: false,
 		describe: "Workspace slug, name, or ID"
 	}),
 	handler: async (argv) => {
 		const session = requireSession(argv);
+		if (!argv.workspace) {
+			if (argv.json || argv.quiet || isNonInteractive()) {
+				printError("Interactive workspace switching needs a terminal. Pass a workspace slug, name, or ID.");
+				process.exit(1);
+			}
+			if (await ensureBunAndReexec((message) => process.stderr.write(`${message}\n`)) === "unavailable") {
+				printError("The workspace picker needs the Bun runtime and it could not be set up automatically. Pass a workspace slug instead, or install Bun and retry.");
+				process.exit(1);
+			}
+			const { runWorkspacePicker } = await import("./boot-CQLDUeZ9.mjs");
+			await runWorkspacePicker(session);
+			return;
+		}
 		const workspaces = await listWorkspaces(session);
 		if (workspaces.isErr()) {
 			printError(workspaces.error.message);
@@ -2123,15 +1842,310 @@ const switchCommand = {
 };
 const workspaceCommand = {
 	command: "workspace",
-	describe: "List or switch which workspace `skydive chat` uses",
+	describe: "List or switch the workspace all `skydive` commands act on",
 	builder: (y) => y.command(listCommand).command(switchCommand),
 	handler: (argv) => runList(argv, { hint: true })
 };
 
+//#endregion
+//#region src/commands/portal.ts
+/**
+* Resolve everything a grant/revoke needs in one round trip: the devices
+* response carries both the user's machines and the org's agent roster, so
+* the `--agent` selector (id or name) resolves without a separate paginated
+* agent listing. `device` is null when this machine has no device row yet
+* (it has never shared or been registered) — grant registers on the fly,
+* revoke has nothing to remove.
+*/
+async function resolveGrantTarget(argv) {
+	const session = requireSession(argv);
+	const { devices, agents } = await fetchPortalDevices(session);
+	return {
+		session,
+		agent: resolveAgent(agents, argv.agent),
+		device: findThisDevice(devices, machineIdentity().machineName)
+	};
+}
+function agentOption(y) {
+	return y.option("agent", {
+		type: "string",
+		demandOption: true,
+		describe: "Agent, by id or name"
+	});
+}
+const openCommand = {
+	command: "open",
+	describe: "Open the portal to this machine so granted agents can run commands here (stays in the foreground; ctrl+c to close)",
+	builder: (y) => y.option("agent", {
+		type: "string",
+		describe: "Also grant this agent (by id or name) access to the machine once connected"
+	}).option("cwd", {
+		type: "string",
+		describe: "Working directory for the agent's commands (default: the current directory)"
+	}),
+	handler: async (argv) => {
+		const session = requireSession(argv);
+		const agent = argv.agent ? resolveAgent((await fetchPortalDevices(session)).agents, argv.agent) : null;
+		const cwd = argv.cwd ? path.resolve(argv.cwd) : process.cwd();
+		const { machineName } = machineIdentity();
+		const { PortalClient } = await import("./client-D6NAkL9e.mjs");
+		let lastLine = "";
+		let signalConnected;
+		const connected = new Promise((resolve) => {
+			signalConnected = resolve;
+		});
+		const client = new PortalClient({
+			appUrl: session.appUrl,
+			sessionToken: session.sessionToken,
+			cwd,
+			onState: (state) => {
+				if (state.status === "connected") signalConnected();
+				const line = state.status === "error" ? `portal: connection error: ${state.error ?? "unknown"} — retrying` : `portal: ${state.status}`;
+				if (line === lastLine) return;
+				lastLine = line;
+				if (state.status === "error") console.error(line);
+				else if (!argv.quiet) console.log(line);
+			}
+		});
+		const stop = () => {
+			client.dispose();
+			process.exit(0);
+		};
+		process.on("SIGINT", stop);
+		process.on("SIGTERM", stop);
+		client.enable();
+		await connected;
+		if (agent) {
+			await client.grantAgent(agent.id);
+			console.log(`portal: granted ${agent.name} access to this machine (persists until revoked)`);
+		}
+		console.log(`portal: open — granted agents can run commands on ${machineName} as your user, cwd ${cwd}. ctrl+c to close.`);
+		await new Promise(() => {});
+	}
+};
+const grantCommand = {
+	command: "grant",
+	describe: "Allow an agent to run commands on this machine (persists until revoked)",
+	builder: agentOption,
+	handler: async (argv) => {
+		const { session, agent, device } = await resolveGrantTarget(argv);
+		const { machineName, friendlyName } = machineIdentity();
+		const deviceId = device ? device.id : (await registerPortalDevice(session, {
+			machineName,
+			friendlyName
+		})).id;
+		await grantPortalAccess(session, {
+			deviceId,
+			agentId: agent.id
+		});
+		if (argv.json) {
+			output(argv, {
+				deviceId,
+				agentId: agent.id
+			});
+			return;
+		}
+		console.log(`Granted ${agent.name} access to ${device?.friendlyName ?? friendlyName}. The agent can run commands here whenever its portal is open — start with \`skydive portal open\`, or pass \`--share-machine\` on a \`chat -p\` run. Revoke with \`skydive portal revoke --agent ${agent.name}\`.`);
+	}
+};
+const revokeCommand = {
+	command: "revoke",
+	describe: "Remove an agent's access to this machine",
+	builder: agentOption,
+	handler: async (argv) => {
+		const { session, agent, device } = await resolveGrantTarget(argv);
+		if (!device) throw new Error(`this machine (${machineIdentity().machineName}) isn't registered with the portal — there's nothing to revoke.`);
+		await revokePortalAccess(session, {
+			deviceId: device.id,
+			agentId: agent.id
+		});
+		if (argv.json) {
+			output(argv, {
+				deviceId: device.id,
+				agentId: agent.id
+			});
+			return;
+		}
+		console.log(`Revoked ${agent.name}'s access to ${device.friendlyName}.`);
+	}
+};
+const statusCommand = {
+	command: "status",
+	describe: "Show your portal machines, connection state, and granted agents",
+	handler: async (argv) => {
+		const { devices, agents } = await fetchPortalDevices(requireSession(argv));
+		if (argv.json) {
+			output(argv, {
+				devices,
+				agents
+			});
+			return;
+		}
+		if (devices.length === 0) {
+			console.log("No machines registered. Run `skydive portal open` to register this one.");
+			return;
+		}
+		const { headers, rows } = buildDeviceTable(devices, agents, machineIdentity().machineName);
+		printTable(headers, rows);
+	}
+};
+/**
+* Build the `portal status` table. Grant ids are shown as agent names when the
+* org roster resolves them (deleted agents fall back to the raw id), and the
+* device this CLI would register as is marked so "which row is me" doesn't
+* depend on knowing the `-cli` naming convention.
+*/
+function buildDeviceTable(devices, agents, thisMachineName) {
+	const agentNames = new Map(agents.map((a) => [a.id, a.name]));
+	return {
+		headers: [
+			"Machine",
+			"Connected",
+			"Last seen",
+			"Granted agents"
+		],
+		rows: devices.map((device) => [
+			device.machineName === thisMachineName ? `${device.friendlyName} *` : device.friendlyName,
+			device.connected ? "yes" : "no",
+			device.lastSeen ?? "-",
+			device.grantedAgentIds.length === 0 ? "-" : device.grantedAgentIds.map((id) => agentNames.get(id) ?? id).join(", ")
+		])
+	};
+}
+const portalCommand = {
+	command: "portal",
+	describe: "Open this machine's portal to agents and manage their access",
+	builder: (y) => y.command(openCommand).command(grantCommand).command(revokeCommand).command(statusCommand).demandCommand(1, "Specify a subcommand: open, grant, revoke, status"),
+	handler: () => {}
+};
+
+//#endregion
+//#region src/commands/sandbox.ts
+/** POSIX single-quote one word so the remote shell treats it as one token. */
+function shellQuote(word) {
+	if (/^[A-Za-z0-9_@%+=:,./-]+$/.test(word)) return word;
+	return `'${word.replace(/'/g, `'\\''`)}'`;
+}
+/**
+* Serialize the command words into the single shell string the relay runs.
+*
+* Words arrive already split by the caller's shell, so each must be re-quoted
+* or the remote shell re-splits any word containing spaces or metacharacters:
+* `sandbox -- sh -c 'echo hi; whoami'` would otherwise run `sh -c echo hi`
+* and then, separately, `whoami`. A pipeline still works the explicit way —
+* `sandbox -- sh -c 'ls | wc -l'` — which is what `docker`/`kubectl exec` ask
+* for too. yargs number-coerces bare numerals, so words are stringified.
+*/
+function joinCommandWords(words) {
+	return words.map(String).map(shellQuote).join(" ").trim();
+}
+/**
+* `skydive sandbox` — the standalone counterpart to the chat TUI's `/sandbox`
+* composer command (ANY-4928): a live terminal (or one-shot exec) in the
+* agent's own sandbox without opening the TUI. Runs under Node (no Bun/
+* OpenTUI): the PTY is a raw byte passthrough on the caller's real terminal.
+* The relay gates on EDIT access to the agent and the sandbox-terminal-enabled
+* kill switch, and boots the sandbox when it isn't running.
+*/
+const sandboxCommand = {
+	command: "sandbox [command..]",
+	describe: "Open a live terminal in an agent's sandbox, or run a one-shot command there",
+	builder: (y) => y.option("agent", {
+		type: "string",
+		describe: "Target agent, by id, slug, or name. Optional when the account has exactly one agent."
+	}).positional("command", {
+		type: "string",
+		array: true,
+		describe: "Command to run one-shot (streams output, exits with its exit code). Omit for a live interactive terminal. Put it after `--` if it has flags of its own."
+	}).example("skydive sandbox --agent grace", "Live terminal (Ctrl-] detaches)").example("skydive sandbox --agent grace -- tail -n 50 /tmp/harness.log", "One-shot command (use `--` so its flags reach the sandbox)").example("skydive sandbox --agent grace -- sh -c 'ls /tmp | wc -l'", "Shell features go through an explicit `sh -c`"),
+	handler: async (argv) => {
+		const session = requireSession(argv);
+		const { createRestClient } = await import("./rest-COkLEZOB.mjs");
+		const { resolveAgent } = await import("./print-B6AO13SA.mjs");
+		const client = createRestClient({
+			appUrl: session.appUrl,
+			sessionToken: session.sessionToken
+		});
+		let agent;
+		try {
+			agent = resolveAgent(await client.listAgents({
+				scope: "org",
+				onPage: null
+			}), argv.agent ?? null);
+		} catch (error) {
+			printError(error instanceof Error ? error.message : String(error));
+			process.exit(1);
+		}
+		const command = joinCommandWords([...argv.command ?? [], ...argv["--"] ?? []]);
+		const code = command ? await runExec({
+			session,
+			agentId: agent.id,
+			command
+		}) : await runPty({
+			session,
+			agentId: agent.id,
+			agentName: agent.name
+		});
+		process.exit(code);
+	}
+};
+/** One-shot exec: stream output to stdout, resolve to the command's exit code. */
+function runExec({ session, agentId, command }) {
+	console.error("Connecting to the sandbox…");
+	return new Promise((resolve) => {
+		const finish = (code) => {
+			process.stdout.write("", () => resolve(code));
+		};
+		SandboxStream.open({
+			mode: "exec",
+			appUrl: session.appUrl,
+			sessionToken: session.sessionToken,
+			agentId,
+			command,
+			onEvent: (e) => {
+				switch (e.type) {
+					case "data":
+						process.stdout.write(e.bytes);
+						break;
+					case "exit":
+						finish(e.code);
+						break;
+					case "error":
+						printError(e.message);
+						finish(1);
+						break;
+					case "close":
+						printError(e.failure ? `Could not run the command in the sandbox: ${e.failure}` : "The connection to the sandbox closed before the command finished.");
+						finish(1);
+						break;
+				}
+			}
+		});
+	});
+}
+/** Live terminal on the caller's real TTY. */
+async function runPty({ session, agentId, agentName }) {
+	if (!process.stdin.isTTY || !process.stdout.isTTY) {
+		printError("A live sandbox terminal needs an interactive TTY. For scripted use, pass a command: `skydive sandbox -- <cmd>`.");
+		return 1;
+	}
+	console.error(`Connecting to ${agentName}'s sandbox… (Ctrl-] detaches)`);
+	const { runRawPtyPassthrough } = await import("./raw-pty-2_VA1kw_.mjs");
+	const result = await runRawPtyPassthrough({
+		stdin: process.stdin,
+		stdout: process.stdout,
+		appUrl: session.appUrl,
+		sessionToken: session.sessionToken,
+		agentId
+	});
+	if (result.reason === "detach") console.error("\nDetached.");
+	return result.code;
+}
+
 //#endregion
 //#region src/cli.ts
 function createCli(argv) {
-	return yargs(argv).scriptName("skydive").usage("$0 <command> [options]").example("skydive auth login", "Store your API key").example("skydive chat", "Open the interactive chat TUI (prod)").example("skydive chat --api-url http://localhost:4500", "Chat against a local dev API").example("skydive agents list", "List your agents").example("skydive keys create \"my-key\"", "Create an API key").example("skydive secrets set OPENAI_API_KEY --agent-id <id>", "Set a secret (value from stdin)").example("skydive workspace list", "List workspaces on your account").example("skydive workspace switch acme-team", "Switch which workspace `skydive chat` uses").option("json", {
+	return yargs(argv).scriptName("skydive").usage("$0 <command> [options]").parserConfiguration({ "populate--": true }).example("skydive auth login", "Store your API key").example("skydive chat", "Open the interactive chat TUI (prod)").example("skydive chat --api-url http://localhost:4500", "Chat against a local dev API").example("skydive agents list", "List your agents").example("skydive keys create \"my-key\"", "Create an API key").example("skydive secrets set OPENAI_API_KEY --agent-id <id>", "Set a secret (value from stdin)").example("skydive workspace list", "List workspaces on your account").example("skydive workspace switch acme-team", "Switch the workspace all `skydive` commands act on").example("skydive portal open --agent grace", "Open the portal to this machine for an agent, headless (no TUI)").option("json", {
 		type: "boolean",
 		default: false,
 		global: true,
@@ -2145,7 +2159,7 @@ function createCli(argv) {
 		type: "string",
 		global: true,
 		describe: "Override API base URL"
-	}).command(authCommand).command(chatCommand).command(agentsCommand).command(keysCommand).command(secretsCommand).command(workspaceCommand).demandCommand(1, "Specify a command. Run --help for usage.").strict().wrap(null).version(version$1).alias("v", "version").alias("h", "help").help().fail((msg, err) => {
+	}).command(authCommand).command(chatCommand).command(messagesCommand).command(conversationsCommand).command(agentsCommand).command(importCommand).command(keysCommand).command(secretsCommand).command(workspaceCommand).command(portalCommand).command(sandboxCommand).demandCommand(1, "Specify a command. Run --help for usage.").strict().wrap(null).version(version).alias("v", "version").alias("h", "help").help().fail((msg, err) => {
 		printError(err ? err instanceof Error ? err.message : String(err) : msg ?? "Unknown error");
 		process.exit(1);
 	});
@@ -2164,6 +2178,7 @@ const VALUE_FLAGS = new Set([
 	"-p",
 	"--agent",
 	"--conversation",
+	"--resume",
 	"--theme",
 	"--api-url"
 ]);
@@ -2209,13 +2224,391 @@ function shouldDefaultToChat(args, tty, nonInteractive = isNonInteractive()) {
 function resolveArgv(args, tty = {
 	stdinIsTTY: Boolean(process.stdin.isTTY),
 	stdoutIsTTY: Boolean(process.stdout.isTTY)
-}) {
-	return shouldDefaultToChat(args, tty) ? ["chat", ...args] : args;
+}, nonInteractive) {
+	return shouldDefaultToChat(args, tty, nonInteractive) ? ["chat", ...args] : args;
+}
+
+//#endregion
+//#region src/update-check/cache.ts
+/**
+* The on-disk state behind the update check: a single small JSON file the
+* fast path reads synchronously on every command and the background worker
+* rewrites after a successful fetch. Every read tolerates a missing, torn,
+* or type-mangled file (each field validates independently), and a failed
+* write is silently skipped — the cache must never break a command.
+*/
+const CHECK_INTERVAL_MS = 1440 * 60 * 1e3;
+const cacheSchema = z.object({
+	lastCheckedAt: z.string().optional().catch(void 0),
+	channel: z.string().optional().catch(void 0),
+	latestVersion: z.string().optional().catch(void 0)
+});
+/** Beside config.json so all CLI state shares one directory (and the
+* `SKYDIVE_CONFIG_NAME` profile isolation). */
+function getUpdateCachePath() {
+	return path.join(path.dirname(getConfigPath()), "update-check.json");
+}
+function readUpdateCache() {
+	try {
+		const raw = fs.readFileSync(getUpdateCachePath(), "utf8");
+		return cacheSchema.parse(JSON.parse(raw));
+	} catch (_error) {
+		return {};
+	}
+}
+function writeUpdateCache(cache) {
+	try {
+		const file = getUpdateCachePath();
+		fs.mkdirSync(path.dirname(file), { recursive: true });
+		fs.writeFileSync(file, `${JSON.stringify(cache, null, 2)}\n`, { mode: 384 });
+	} catch (_error) {}
+}
+function isCheckDue(lastCheckedAt, now = Date.now()) {
+	if (!lastCheckedAt) return true;
+	const then = Date.parse(lastCheckedAt);
+	if (Number.isNaN(then)) return true;
+	if (then > now) return true;
+	return now - then >= CHECK_INTERVAL_MS;
+}
+
+//#endregion
+//#region src/update-check/versions.ts
+/** Canary builds carry a prerelease suffix (`X.Y.Z-beta.N`, synthesized in
+* CI); a plain semver is a stable release. An unparseable version defaults
+* to stable. */
+function resolveChannel(version) {
+	return (semver.prerelease(version, { loose: true })?.length ?? 0) > 0 ? "canary" : "stable";
+}
+/** npm dist-tag for a channel (see release-skydive-cli.yml). */
+function distTagForChannel(channel) {
+	return channel === "canary" ? "beta" : "latest";
+}
+/**
+* True when `candidate` is a strictly newer release than `current`, per
+* semver precedence (the `semver` package, including prerelease ordering).
+* Unparseable input is never newer, so garbage from the registry can't
+* produce a notice.
+*/
+function isNewerVersion(candidate, current) {
+	if (!semver.valid(candidate, { loose: true })) return false;
+	if (!semver.valid(current, { loose: true })) return false;
+	return semver.gt(candidate, current, { loose: true });
+}
+
+//#endregion
+//#region src/update-check/notice.ts
+/** The install-mode-specific action line. A package-manager install is never
+* self-mutated — we only tell the user what to run. */
+function renderUpdateCommand(channel, source) {
+	if (source === "binary") return `curl -fsSL ${DEFAULT_WEB_URL}/api/v1/cli/install.sh | ${channel === "canary" ? "SKYDIVE_CHANNEL=canary " : ""}sh`;
+	return `npm install -g ${name}@${distTagForChannel(channel)}`;
+}
+function renderUpdateNotice(opts) {
+	return `\nUpdate available: ${opts.currentVersion} \u2192 ${opts.latestVersion}\nRun ${renderUpdateCommand(opts.channel, opts.source)}\n`;
+}
+/**
+* Whether this invocation may print the notice. Pure so it's testable; the
+* inputs are raw pre-yargs argv (parsing hasn't happened when this runs) and
+* stderr's TTY-ness. `--json`/`--quiet` go to stdout, and the notice goes to
+* stderr — but scripts commonly capture 2>&1, so machine-readable modes
+* suppress it entirely rather than risk corrupting piped output.
+*/
+function shouldNotify(opts) {
+	if (!opts.stderrIsTTY) return false;
+	if (opts.argv.includes("--json") || opts.argv.includes("--quiet")) return false;
+	return true;
+}
+
+//#endregion
+//#region src/update-check/sources.ts
+function resolveInstallSource() {
+	return typeof SKYDIVE_CLI_INSTALL_SOURCE === "string" && SKYDIVE_CLI_INSTALL_SOURCE === "binary" ? "binary" : "package-manager";
+}
+const NPM_REGISTRY_URL = "https://registry.npmjs.org";
+const npmDistTagsSchema = z.record(z.string(), z.unknown());
+const binaryManifestSchema = z.object({ version: z.unknown().optional() });
+/** npm dist-tags for the published package (`skydive-cli`). */
+const npmReleaseSource = { async fetchLatestVersion(channel, { signal }) {
+	const response = await fetch(`${NPM_REGISTRY_URL}/-/package/${name}/dist-tags`, {
+		signal,
+		headers: { accept: "application/json" }
+	});
+	if (!response.ok) return null;
+	const tags = npmDistTagsSchema.safeParse(await response.json());
+	if (!tags.success) return null;
+	const version = tags.data[distTagForChannel(channel)];
+	return typeof version === "string" ? version : null;
+} };
+/**
+* Release CDN (CloudFront over the releases bucket, infra: CliReleasesCdn).
+* Serves the channel pointers the release workflow uploads
+* (`channels/{stable,canary}.json`, cached max-age=60) alongside the
+* binaries. The daily poll goes here, not to the api, so a fleet of
+* installed binaries puts no load on — and takes no dependency on — the api.
+*/
+const RELEASE_CDN_URL = "https://dl.skydive.com";
+/** Channel manifest on the release CDN, for compiled binaries. The same
+* document the api's channel route serves (see
+* apps/anyone/api/src/routes/cli-releases.ts, which reads it from the
+* bucket this CDN fronts). */
+const binaryReleaseSource = { async fetchLatestVersion(channel, { signal }) {
+	const response = await fetch(`${RELEASE_CDN_URL}/channels/${channel}.json`, {
+		signal,
+		headers: { accept: "application/json" }
+	});
+	if (!response.ok) return null;
+	const manifest = binaryManifestSchema.safeParse(await response.json());
+	if (!manifest.success) return null;
+	return typeof manifest.data.version === "string" ? manifest.data.version : null;
+} };
+function releaseSourceForInstall(source) {
+	return source === "binary" ? binaryReleaseSource : npmReleaseSource;
+}
+
+//#endregion
+//#region src/update-check/index.ts
+/**
+* Non-blocking update check, update-notifier style: a command never waits on
+* the network. Each invocation reads a small on-disk cache (./cache.ts) and,
+* when it records a newer version for this build's channel, prints a notice
+* (./notice.ts) to stderr at process exit. Separately, at most once per
+* check interval, it spawns a short-lived detached child (this same
+* executable with {@link UPDATE_WORKER_FLAG}) that fetches release metadata
+* (./sources.ts) and rewrites the cache for *future* invocations. So a
+* notice is always one check behind — the price of never delaying a command.
+*
+* Two install modes share everything except the metadata source and the
+* suggested action (see ./sources.ts):
+*
+* - package-manager (npm/Yarn/pnpm/Bun): compare against npm dist-tags,
+*   print the install command, never self-mutate the install.
+* - compiled binary: compare against the release channel manifest served by
+*   the api, print the installer one-liner; a real `skydive update`
+*   self-updater can slot in behind the same boundary later.
+*
+* Failure policy: every path here is best-effort. Network errors, timeouts,
+* a torn cache file, an unwritable config dir — all silent. The check must
+* never break or slow a command.
+*/
+/** Hidden argv sentinel that turns an invocation into the background refresh
+* worker (see bin.ts). Namespaced so it can never collide with a real flag. */
+const UPDATE_WORKER_FLAG = "--skydive-internal-update-check";
+const FETCH_TIMEOUT_MS = 1e4;
+function isCheckDisabled(env) {
+	return Boolean(env["SKYDIVE_NO_UPDATE_CHECK"] || env["NO_UPDATE_NOTIFIER"] || env["CI"]) || getUpdateCheckDisabled();
+}
+/** A cached answer counts only if it's for this build's channel and strictly
+* newer than what's running. */
+function updateAvailable(cache, currentVersion, channel) {
+	return Boolean(cache.latestVersion && cache.channel === channel && isNewerVersion(cache.latestVersion, currentVersion));
+}
+function registerExitNotice(notice) {
+	process.once("exit", () => {
+		process.stderr.write(notice);
+	});
+}
+/** Stamp the claim before the worker spawns, so a crashing/offline worker
+* retries next interval instead of respawning on every command. */
+function claimCheckInterval(cache) {
+	writeUpdateCache({
+		...cache,
+		lastCheckedAt: (/* @__PURE__ */ new Date()).toISOString()
+	});
+}
+function spawnUpdateCheckWorker() {
+	const args = resolveInstallSource() === "binary" ? [UPDATE_WORKER_FLAG] : [...process.argv[1] ? [process.argv[1]] : [], UPDATE_WORKER_FLAG];
+	spawn(process.execPath, args, {
+		detached: true,
+		stdio: "ignore"
+	}).unref();
+}
+/**
+* The detached child's whole job: fetch the channel's current version and
+* rewrite the cache. Timeout-bounded and silent on failure by design.
+*/
+async function runUpdateCheckWorker() {
+	try {
+		const channel = resolveChannel(version);
+		const latestVersion = await releaseSourceForInstall(resolveInstallSource()).fetchLatestVersion(channel, { signal: AbortSignal.timeout(FETCH_TIMEOUT_MS) });
+		if (!latestVersion) return;
+		writeUpdateCache({
+			lastCheckedAt: (/* @__PURE__ */ new Date()).toISOString(),
+			channel,
+			latestVersion
+		});
+	} catch (_error) {}
+}
+/**
+* Called once from bin.ts before command dispatch. Synchronous — one small
+* file read; the network work happens in the detached worker.
+*/
+function setupUpdateCheck(argv) {
+	try {
+		if (isCheckDisabled(process.env)) return;
+		const currentVersion = version;
+		const channel = resolveChannel(currentVersion);
+		const cache = readUpdateCache();
+		if (updateAvailable(cache, currentVersion, channel) && shouldNotify({
+			argv,
+			stderrIsTTY: Boolean(process.stderr.isTTY)
+		})) registerExitNotice(renderUpdateNotice({
+			currentVersion,
+			latestVersion: cache.latestVersion,
+			channel,
+			source: resolveInstallSource()
+		}));
+		if (isCheckDue(cache.lastCheckedAt)) {
+			claimCheckInterval(cache);
+			spawnUpdateCheckWorker();
+		}
+	} catch (_error) {}
+}
+
+//#endregion
+//#region src/changelog.generated.ts
+const CHANGELOG_MD = "# Changelog\n\nAll notable changes to the Skydive CLI are documented here.\n\nThe format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),\nand this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).\n\n## [0.2.0] - 2026-07-29\n\n### Added\n\n**Sandbox & machine access**\n\n- Standalone `skydive sandbox` command for direct access to an agent's sandbox.\n- `/sandbox` in the chat TUI — live PTY session and one-shot command execution.\n- Headless machine sharing via `skydive portal`, with self-registering portal grants.\n- `shareMachineDefault` config key for always-on portal sharing.\n\n**Chat TUI**\n\n- File pane (`ctrl+g`) with Changes and Files tabs: a shared file tree plus source viewer and a workspace browser, mouse-resizable and responsive to terminal size.\n- Agent todo list rendered in the chat TUI, above the composer, mirroring the web chat's todo card.\n- Fuzzy finder in the conversation and agent pickers.\n- Slash-command autocomplete menu.\n- Paste or drag-and-drop any file into the composer; paste clipboard images with Cmd+V.\n- Run local shell commands with `!` in the composer.\n- Conversation recaps, streamed live title updates, and per-agent attribution on assistant turns.\n- Working timer rolls up into minutes and hours.\n- Conversation picker paginates past 50 conversations and shows only your own conversations.\n- Esc leaves a live run; typing `exit` quits the chat.\n- Cursor Dark theme.\n- Picker rows no longer overlap when a conversation title contains a newline, tab, or control character.\n\n**Headless & scripting**\n\n- Resume a conversation by id.\n- `conversations list` and `conversations show` for transcript reads.\n- `messages get`, with run recovery keyed on message id.\n- Connect cards surface in headless `-p` mode so a driving agent never gets stuck.\n\n**Authentication**\n\n- `skydive auth login` via the browser now auto-mints an API key, so one login yields both a chat session and a usable management credential. Management commands announce the key's pinned workspace when it drives them, so a workspace mismatch is visible at use time.\n- Workspace picker on the device authorization page.\n- Account and workspace identity shown in `auth status`.\n\n**Platform**\n\n- Standalone binary builds compiling the CLI into a per-target executable.\n- Interactive workspace switcher; management commands follow the active workspace.\n- Terminal host integrations and agent notifications.\n\n### Fixed\n\n- Transcript errors collapse to one line, click to expand (REST and portal errors keep their full body).\n- Dragged/pasted image file paths attach the file instead of inserting path text, including macOS paths with literal parentheses.\n- Bare URLs in chat markdown are hyperlinked so they survive text wrap.\n- Composer draft is preserved across TUI overlays.\n- Relative connect links resolve before opening the browser.\n- Numbered markdown headings render colored in the TUI.\n- Chat transcript pages by 75% of a screen; picker rows stay on one line.\n- Run starts push to the TUI over the conversation stream.\n- Security: remediated high-severity dependency findings and cleared tar/shell-quote CVEs.\n\n## [0.1.0] - 2026-07-21\n\nInitial public release: `skydive chat` TUI, agent and conversation management,\ndevice authorization, and headless `-p` mode.\n";
+
+//#endregion
+//#region src/whats-new.ts
+/**
+* Parse keep-a-changelog markdown into version sections. Recognizes
+* `## [x.y.z] - date` headings; `## [Unreleased]` and prerelease headings
+* are ignored. Order is preserved (newest first, as the file is written).
+*/
+function parseChangelog(md) {
+	const entries = [];
+	let current = null;
+	for (const line of md.split("\n")) {
+		const heading = /^## \[(\d+\.\d+\.\d+)\]/.exec(line);
+		if (heading) {
+			current = {
+				version: heading[1] ?? "",
+				body: []
+			};
+			entries.push(current);
+			continue;
+		}
+		if (line.startsWith("## ")) {
+			current = null;
+			continue;
+		}
+		if (current) current.body.push(line);
+	}
+	for (const entry of entries) {
+		while (entry.body.length > 0 && (entry.body[0] ?? "").trim() === "") entry.body.shift();
+		while (entry.body.length > 0 && (entry.body[entry.body.length - 1] ?? "").trim() === "") entry.body.pop();
+	}
+	return entries;
+}
+/**
+* Parse a semver into its numeric triple, ignoring any prerelease/build
+* suffix (`0.2.0-beta.363` -> [0, 2, 0]). Canary builds thereby count as
+* their base version, so a beta user stepping onto the stable line isn't
+* re-shown notes for features they already have. Returns null on anything
+* that isn't `x.y.z(-…)`.
+*/
+function parseVersion(v) {
+	const m = /^(\d+)\.(\d+)\.(\d+)(?:[-+].*)?$/.exec(v);
+	if (!m) return null;
+	return [
+		Number(m[1]),
+		Number(m[2]),
+		Number(m[3])
+	];
+}
+function compareVersions(a, b) {
+	const pa = parseVersion(a);
+	const pb = parseVersion(b);
+	if (!pa || !pb) return 0;
+	for (let i = 0; i < 3; i++) {
+		const da = pa[i] ?? 0;
+		const db = pb[i] ?? 0;
+		if (da !== db) return da - db;
+	}
+	return 0;
+}
+/**
+* The changelog sections a user upgrading from `lastSeen` to `current`
+* should see: every entry strictly newer than `lastSeen` and no newer than
+* `current`, oldest first (reading order).
+*/
+function entriesBetween(lastSeen, current, entries = parseChangelog(CHANGELOG_MD)) {
+	return entries.filter((e) => compareVersions(e.version, lastSeen) > 0 && compareVersions(e.version, current) <= 0).reverse();
+}
+/**
+* Render one changelog section body for the terminal: `### Group` headings
+* become `Group:` lines, `**Bold**` intro lines lose their markers, list
+* bullets become `•`, and nested bullets keep their indent.
+*/
+function renderBody(body) {
+	const lines = [];
+	for (const raw of body) {
+		const line = raw.replace(/\s+$/, "");
+		if (line.trim() === "") {
+			if (lines.length > 0 && lines[lines.length - 1] !== "") lines.push("");
+			continue;
+		}
+		const groupHeading = /^### (.+)$/.exec(line);
+		if (groupHeading) {
+			lines.push(`${groupHeading[1]}:`);
+			continue;
+		}
+		const bullet = /^(\s*)- (.*)$/.exec(line);
+		if (bullet) {
+			const indent = bullet[1] ?? "";
+			const text = bullet[2] ?? "";
+			lines.push(`${indent}  • ${text.replace(/\*\*/g, "")}`);
+			continue;
+		}
+		lines.push(line.replace(/\*\*/g, ""));
+	}
+	return lines;
+}
+/** Pure formatting, split out for tests. Returns [] when nothing to show. */
+function whatsNewLines(lastSeen, current, changelog = CHANGELOG_MD) {
+	if (!lastSeen) return [];
+	if (compareVersions(current, lastSeen) <= 0) return [];
+	const entries = entriesBetween(lastSeen, current, parseChangelog(changelog));
+	if (entries.length === 0) return [];
+	const lines = [];
+	for (const entry of entries) {
+		if (lines.length > 0) lines.push("");
+		lines.push(`What's new in skydive ${entry.version}:`);
+		lines.push("");
+		lines.push(...renderBody(entry.body));
+	}
+	return lines;
+}
+/**
+* Print the what's-new notice when appropriate and record the current
+* version. Called once from the bin entrypoint, before yargs dispatch.
+*
+* Prints to stderr and only when stderr is a TTY, so piped/scripted
+* invocations (including `--json` consumers) never see it mixed into their
+* output. Skipped entirely in known non-interactive environments (CI,
+* coding agents), where the version watermark is still advanced so a later
+* interactive run doesn't replay stale notes.
+*/
+function maybePrintWhatsNew({ stderrIsTTY = process.stderr.isTTY ?? false, nonInteractive = isNonInteractive(), currentVersion = version } = {}) {
+	try {
+		const lastSeen = getLastSeenVersion();
+		if (stderrIsTTY && !nonInteractive) {
+			const lines = whatsNewLines(lastSeen, currentVersion);
+			if (lines.length > 0) console.error(lines.join("\n") + "\n");
+		}
+		if (lastSeen !== currentVersion) setLastSeenVersion(currentVersion);
+	} catch (_error) {}
 }
 
 //#endregion
 //#region src/bin.ts
+if (process.argv.includes(UPDATE_WORKER_FLAG)) {
+	await runUpdateCheckWorker();
+	process.exit(0);
+}
+maybePrintWhatsNew();
+setupUpdateCheck(hideBin(process.argv));
 createCli(resolveArgv(hideBin(process.argv))).parse();
 
 //#endregion
-export { noColorRequested as a, themeMode as c, themesForMode as d, DEFAULT_API_URL as f, saveTheme as g, resolveWebUrl as h, monoTheme as i, themeModeFromColorFgBg as l, getSavedTheme as m, applyTheme as n, theme as o, DEFAULT_APP_URL as p, findTheme as r, themeForMode as s, DEFAULT_THEME_ID as t, themeVersion as u };
+export {  };