skydive-cli 0.1.0

package/dist/js/bin.mjs

@@ -0,0 +1,2221 @@
+#!/usr/bin/env node
+import { hideBin } from "yargs/helpers";
+import yargs from "yargs";
+import { createInterface } from "node:readline";
+import path from "node:path";
+import Conf from "conf";
+import { err, ok } from "neverthrow";
+import { z } from "zod";
+import open from "open";
+import { spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import fs from "node:fs";
+import zlib from "node:zlib";
+
+//#region package.json
+var version$1 = "0.1.0";
+
+//#endregion
+//#region src/types.ts
+const NON_INTERACTIVE_ENV_VARS = [
+	"CI",
+	"CLAUDECODE",
+	"CODEX",
+	"OPENCLAW"
+];
+function isNonInteractive() {
+	return NON_INTERACTIVE_ENV_VARS.some((key) => process.env[key]);
+}
+
+//#endregion
+//#region src/config.ts
+/** Default host for the public management API (`/v1`, API-key auth). */
+const DEFAULT_API_URL = "https://api.skydive.com";
+/**
+* Default origin for the interactive chat client (`skydive chat`).
+*
+* The API host that serves better-auth (`/api/auth/*`) and the internal tRPC
+* API (`/api/v1/trpc`) that chat streams over. We target the API host
+* directly (not the web front door) because chat opens a WebSocket and
+* authenticates with a bearer token on the upgrade request. Same host as
+* `DEFAULT_API_URL`; override with `--api-url` / `SKYDIVE_APP_URL` for local
+* dev or while the DNS record is still being provisioned.
+*/
+const DEFAULT_APP_URL = "https://api.skydive.com";
+/** Web front door, for pages opened in the user's browser. */
+const DEFAULT_WEB_URL = "https://skydive.com";
+/**
+* Origin for browser-facing links (e.g. opening a conversation's web page).
+* The app origin is the API host, which serves no web UI in production, so
+* map the default to the web front door. Overridden origins (local dev,
+* previews) serve both and pass through unchanged.
+*/
+function resolveWebUrl(appUrl) {
+	return appUrl === DEFAULT_APP_URL ? DEFAULT_WEB_URL : appUrl;
+}
+/** Prefix on every Skydive API key. Kept in sync with the API's
+* `API_KEY_PREFIX` (`apps/anyone/api/src/lib/api-key.ts`); the CLI is a
+* standalone published package so it can't import the backend constant. */
+const API_KEY_PREFIX = "sky_live_";
+/** Where users mint and copy API keys. Shown in the login prompt. */
+const API_KEYS_URL = "skydive.com/account";
+const store = new Conf({
+	projectName: process.env["SKYDIVE_CONFIG_NAME"] ?? "skydive",
+	projectSuffix: "",
+	configFileMode: 384
+});
+function resolveConfig(opts) {
+	const apiKey = process.env["SKYDIVE_API_KEY"] ?? store.get("apiKey");
+	const apiUrl = process.env["SKYDIVE_API_URL"] ?? opts.apiUrl ?? store.get("apiUrl") ?? DEFAULT_API_URL;
+	if (!apiKey) return err({ message: "Not authenticated. Run `skydive auth login` first." });
+	return ok({
+		apiKey,
+		apiUrl
+	});
+}
+/**
+* Resolve the bearer credential for the management API (`agents` / `keys` /
+* `secrets`). Prefers an API key (`SKYDIVE_API_KEY` env, then stored), and
+* falls back to the `--web` chat session token: the server's `/v1` gate routes
+* any non-`sky_` bearer through the signed-in session, so a device login alone
+* is enough to run management commands — no separate API key required.
+*/
+function resolveManagementAuth(opts) {
+	const apiUrl = process.env["SKYDIVE_API_URL"] ?? opts.apiUrl ?? store.get("apiUrl") ?? DEFAULT_API_URL;
+	const apiKey = process.env["SKYDIVE_API_KEY"] ?? store.get("apiKey");
+	if (apiKey) return ok({
+		token: apiKey,
+		apiUrl,
+		kind: "api-key"
+	});
+	const sessionToken = process.env["SKYDIVE_SESSION_TOKEN"] ?? store.get("sessionToken");
+	if (sessionToken) return ok({
+		token: sessionToken,
+		apiUrl,
+		kind: "session"
+	});
+	return err({ message: "Not authenticated. Run `skydive auth login` (API key) or `skydive auth login --web`." });
+}
+function saveConfig(config) {
+	store.set("apiKey", config.apiKey);
+	store.set("apiUrl", config.apiUrl);
+}
+function deleteConfig() {
+	store.clear();
+}
+function getConfigPath() {
+	return store.path;
+}
+/**
+* Where the chat TUI persists its prompt history (up-arrow recall). Kept
+* beside the config file so all CLI state lives in one directory.
+*/
+function getPromptHistoryPath() {
+	return path.join(path.dirname(store.path), "prompt-history.jsonl");
+}
+/**
+* Resolve the chat/auth origin. Precedence: `SKYDIVE_APP_URL` env > explicit
+* `--api-url` style override > stored value > `SKYDIVE_API_URL` env >
+* `DEFAULT_APP_URL`.
+*
+* The `SKYDIVE_API_URL` fallback matters for previews: the device/`--web`
+* flow and chat hit the same api service as the management API, so pointing
+* `SKYDIVE_API_URL` at a preview stack is enough — you don't also have to set
+* `SKYDIVE_APP_URL`. Otherwise auth would silently fall through to prod
+* (`DEFAULT_APP_URL`) and hand back a prod verification URL.
+*/
+function resolveAppUrl(opts) {
+	return process.env["SKYDIVE_APP_URL"] ?? opts.appUrl ?? store.get("appUrl") ?? process.env["SKYDIVE_API_URL"] ?? DEFAULT_APP_URL;
+}
+function resolveSession(opts) {
+	const sessionToken = process.env["SKYDIVE_SESSION_TOKEN"] ?? store.get("sessionToken");
+	const appUrl = resolveAppUrl(opts);
+	if (!sessionToken) return err({ message: "Not signed in for chat. Run `skydive chat` to sign in." });
+	return ok({
+		sessionToken,
+		appUrl
+	});
+}
+function saveSession(session) {
+	store.set("sessionToken", session.sessionToken);
+	store.set("sessionObtainedAt", (/* @__PURE__ */ new Date()).toISOString());
+	store.set("appUrl", session.appUrl);
+}
+function getSavedTheme(mode) {
+	return store.get(mode === "dark" ? "themeDark" : "themeLight");
+}
+function saveTheme(mode, themeId) {
+	store.set(mode === "dark" ? "themeDark" : "themeLight", themeId);
+}
+
+//#endregion
+//#region src/api-client.ts
+const USER_AGENT = `skydive-cli/${version$1}`;
+const AgentSchema = z.object({
+	id: z.string(),
+	name: z.string(),
+	url: z.string().nullable(),
+	description: z.string().nullable(),
+	model: z.string().nullable(),
+	gitUrl: z.string()
+});
+const ListAgentsResponseSchema = z.object({
+	agents: z.array(AgentSchema),
+	count: z.number(),
+	nextCursor: z.string().nullable()
+});
+const AgentResponseSchema = z.object({ agent: AgentSchema });
+const ApiKeySchema = z.object({
+	id: z.string(),
+	name: z.string(),
+	prefix: z.string(),
+	lastUsedAt: z.string().nullable(),
+	createdAt: z.string()
+});
+const CreatedApiKeySchema = ApiKeySchema.extend({ key: z.string() });
+const ListApiKeysResponseSchema = z.object({ keys: z.array(ApiKeySchema) });
+const ListSecretKeysResponseSchema = z.object({ keys: z.array(z.string()) });
+const SetSecretResponseSchema = z.object({ key: z.string() });
+var SkydiveApiClient = class {
+	baseUrl;
+	token;
+	constructor(config) {
+		this.baseUrl = `${config.apiUrl.replace(/\/$/, "")}/v1`;
+		this.token = config.token;
+	}
+	async listAgents(params) {
+		const query = new URLSearchParams();
+		if (params.scope) query.set("scope", params.scope);
+		if (params.limit) query.set("limit", String(params.limit));
+		if (params.cursor) query.set("cursor", params.cursor);
+		const qs = query.toString();
+		return this.request({
+			method: "GET",
+			path: `/agents${qs ? `?${qs}` : ""}`,
+			schema: ListAgentsResponseSchema
+		});
+	}
+	async getAgent(id) {
+		return this.request({
+			method: "GET",
+			path: `/agents/${encodeURIComponent(id)}`,
+			schema: AgentResponseSchema
+		}).then((r) => r.map((res) => res.agent));
+	}
+	async createAgent(params) {
+		return this.request({
+			method: "POST",
+			path: "/agents",
+			body: params,
+			schema: AgentResponseSchema
+		}).then((r) => r.map((res) => res.agent));
+	}
+	async listKeys(agentId) {
+		return this.request({
+			method: "GET",
+			path: `/agents/${encodeURIComponent(agentId)}/api-keys`,
+			schema: ListApiKeysResponseSchema
+		}).then((r) => r.map((res) => res.keys));
+	}
+	async createKey(agentId, name) {
+		return this.request({
+			method: "POST",
+			path: `/agents/${encodeURIComponent(agentId)}/api-keys`,
+			body: { name },
+			schema: CreatedApiKeySchema
+		});
+	}
+	async revokeKey(agentId, id) {
+		return this.request({
+			method: "DELETE",
+			path: `/agents/${encodeURIComponent(agentId)}/api-keys/${encodeURIComponent(id)}`
+		});
+	}
+	async listSecrets(agentId) {
+		return this.request({
+			method: "GET",
+			path: `/agents/${encodeURIComponent(agentId)}/secrets`,
+			schema: ListSecretKeysResponseSchema
+		}).then((r) => r.map((res) => res.keys));
+	}
+	async setSecret(agentId, key, value) {
+		return this.request({
+			method: "PUT",
+			path: `/agents/${encodeURIComponent(agentId)}/secrets/${encodeURIComponent(key)}`,
+			body: { value },
+			schema: SetSecretResponseSchema
+		}).then((r) => r.map((res) => res.key));
+	}
+	async deleteSecret(agentId, key) {
+		return this.request({
+			method: "DELETE",
+			path: `/agents/${encodeURIComponent(agentId)}/secrets/${encodeURIComponent(key)}`
+		});
+	}
+	async request(params) {
+		const url = `${this.baseUrl}${params.path}`;
+		const headers = {
+			authorization: `Bearer ${this.token}`,
+			"user-agent": USER_AGENT
+		};
+		if (params.body) headers["content-type"] = "application/json";
+		let response;
+		try {
+			response = await fetch(url, {
+				method: params.method,
+				headers,
+				body: params.body ? JSON.stringify(params.body) : void 0
+			});
+		} catch (e) {
+			return err({
+				message: `Network error: ${e instanceof Error ? e.message : String(e)}`,
+				status: null
+			});
+		}
+		if (!response.ok) {
+			let message = `HTTP ${response.status}`;
+			try {
+				const body = await response.json();
+				if (body.error && typeof body.error === "string") message = body.error;
+				else if (body.error?.message) message = body.error.message;
+			} catch {}
+			return err({
+				message,
+				status: response.status
+			});
+		}
+		if (response.status === 204 || !params.schema) return ok(void 0);
+		let body;
+		try {
+			body = await response.json();
+		} catch {
+			return err({
+				message: "Invalid JSON response",
+				status: response.status
+			});
+		}
+		const parsed = params.schema.safeParse(body);
+		if (!parsed.success) return err({
+			message: `Unexpected response shape: ${parsed.error.message}`,
+			status: response.status
+		});
+		return ok(parsed.data);
+	}
+};
+
+//#endregion
+//#region src/auth/device.ts
+const CLI_CLIENT_ID = "skydive-cli";
+const deviceCodeResponseSchema = z.object({
+	device_code: z.string(),
+	user_code: z.string(),
+	verification_uri: z.string(),
+	verification_uri_complete: z.string().optional(),
+	expires_in: z.number().int().positive(),
+	interval: z.number().int().positive().optional()
+});
+const tokenSuccessSchema = z.object({
+	access_token: z.string(),
+	token_type: z.string().optional(),
+	expires_in: z.number().int().optional(),
+	refresh_token: z.string().optional()
+});
+const tokenErrorSchema = z.object({
+	error: z.enum([
+		"authorization_pending",
+		"slow_down",
+		"access_denied",
+		"expired_token",
+		"invalid_grant",
+		"invalid_request",
+		"invalid_client"
+	]),
+	error_description: z.string().optional()
+});
+const GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
+async function requestDeviceCode({ appUrl, signal }) {
+	const res = await fetch(`${appUrl}/api/auth/device/code`, {
+		method: "POST",
+		headers: { "content-type": "application/json" },
+		body: JSON.stringify({ client_id: CLI_CLIENT_ID }),
+		signal
+	});
+	if (!res.ok) throw new Error(`device/code failed: ${res.status} ${await res.text().catch(() => "")}`);
+	return deviceCodeResponseSchema.parse(await res.json());
+}
+async function pollDeviceToken({ appUrl, deviceCode, currentIntervalMs, signal }) {
+	let res;
+	try {
+		res = await fetch(`${appUrl}/api/auth/device/token`, {
+			method: "POST",
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify({
+				grant_type: GRANT_TYPE,
+				device_code: deviceCode,
+				client_id: CLI_CLIENT_ID
+			}),
+			signal
+		});
+	} catch (e) {
+		return {
+			kind: "error",
+			message: e instanceof Error ? e.message : String(e)
+		};
+	}
+	const body = await res.json().catch(() => null);
+	if (res.ok) {
+		const parsed = tokenSuccessSchema.safeParse(body);
+		if (!parsed.success) return {
+			kind: "error",
+			message: "malformed token response"
+		};
+		return {
+			kind: "success",
+			accessToken: parsed.data.access_token,
+			refreshToken: parsed.data.refresh_token ?? null
+		};
+	}
+	const parsed = tokenErrorSchema.safeParse(body);
+	if (!parsed.success) return {
+		kind: "error",
+		message: `device/token failed: ${res.status}`
+	};
+	switch (parsed.data.error) {
+		case "authorization_pending": return {
+			kind: "pending",
+			nextIntervalMs: currentIntervalMs
+		};
+		case "slow_down": return {
+			kind: "pending",
+			nextIntervalMs: currentIntervalMs + 5e3
+		};
+		case "access_denied": return { kind: "denied" };
+		case "expired_token": return { kind: "expired" };
+		default: return {
+			kind: "error",
+			message: parsed.data.error_description ?? parsed.data.error
+		};
+	}
+}
+
+//#endregion
+//#region src/auth/organization.ts
+const workspaceSchema = z.object({
+	id: z.string(),
+	name: z.string(),
+	slug: z.string()
+});
+function authHeaders(sessionToken) {
+	return { authorization: `Bearer ${sessionToken}` };
+}
+async function listWorkspaces({ appUrl, sessionToken }) {
+	try {
+		const res = await fetch(`${appUrl}/api/auth/organization/list`, { headers: authHeaders(sessionToken) });
+		if (!res.ok) return err({ message: `failed to list workspaces (${res.status})` });
+		const parsed = z.array(workspaceSchema).safeParse(await res.json());
+		if (!parsed.success) return err({ message: "unexpected workspace list response" });
+		return ok(parsed.data);
+	} catch (e) {
+		return err({ message: e instanceof Error ? e.message : String(e) });
+	}
+}
+/** The workspace bound to the current session, or `null` if none is set. */
+async function getActiveWorkspaceId({ appUrl, sessionToken }) {
+	try {
+		const res = await fetch(`${appUrl}/api/auth/get-session?disableCookieCache=true`, { headers: authHeaders(sessionToken) });
+		if (!res.ok) return err({ message: `failed to read session (${res.status})` });
+		const parsed = z.object({ session: z.object({ activeOrganizationId: z.string().nullable().optional() }).nullable().optional() }).nullable().safeParse(await res.json());
+		if (!parsed.success) return err({ message: "unexpected session response" });
+		return ok(parsed.data?.session?.activeOrganizationId ?? null);
+	} catch (e) {
+		return err({ message: e instanceof Error ? e.message : String(e) });
+	}
+}
+async function setActiveWorkspace({ appUrl, sessionToken, organizationId }) {
+	try {
+		const res = await fetch(`${appUrl}/api/auth/organization/set-active`, {
+			method: "POST",
+			headers: {
+				...authHeaders(sessionToken),
+				"content-type": "application/json"
+			},
+			body: JSON.stringify({ organizationId })
+		});
+		if (!res.ok) return err({ message: `failed to set active workspace (${res.status})` });
+		return ok(void 0);
+	} catch (e) {
+		return err({ message: e instanceof Error ? e.message : String(e) });
+	}
+}
+/**
+* Ensures the session has an active workspace. The device flow issues a
+* session without one (unlike a normal web sign-in, which sets it), so the
+* internal API rejects every request with "no active organization" until we
+* set it. Picks the account's first workspace by join order — run `skydive
+* workspace list` + `skydive workspace switch` afterward if that's the wrong
+* one (e.g. a personal workspace joined before a shared team workspace).
+*/
+async function ensureActiveOrganization({ appUrl, sessionToken }) {
+	const workspaces = await listWorkspaces({
+		appUrl,
+		sessionToken
+	});
+	if (workspaces.isErr()) return err(workspaces.error);
+	const workspace = workspaces.value[0];
+	if (!workspace) return err({ message: "your account has no organization yet" });
+	const setResult = await setActiveWorkspace({
+		appUrl,
+		sessionToken,
+		organizationId: workspace.id
+	});
+	if (setResult.isErr()) return err(setResult.error);
+	return ok({
+		organizationId: workspace.id,
+		name: workspace.name
+	});
+}
+
+//#endregion
+//#region src/auth/device-login.ts
+const DEFAULT_INTERVAL_MS = 5e3;
+/**
+* Headless device-authorization login for the chat session. Prints the
+* verification URL + user code to stderr (stdout stays clean for piping),
+* best-effort opens the browser, polls until the user approves, then
+* persists the session. Node-compatible — no TUI dependencies — so it can
+* run as a plain command or be awaited by `skydive chat` before booting the
+* interface.
+*/
+async function loginWithDevice({ appUrl, openBrowser = true }) {
+	let code;
+	try {
+		code = await requestDeviceCode({ appUrl });
+	} catch (e) {
+		return err({ message: e instanceof Error ? e.message : String(e) });
+	}
+	const verificationUrl = code.verification_uri_complete ?? code.verification_uri;
+	process.stderr.write(`\nTo sign in, open:\n  ${verificationUrl}\n`);
+	process.stderr.write(`and enter the code: ${formatUserCode(code.user_code)}\n\n`);
+	if (openBrowser) await open(verificationUrl).catch(() => void 0);
+	process.stderr.write("Waiting for approval…\n");
+	let intervalMs = (code.interval ?? 5) * 1e3 || DEFAULT_INTERVAL_MS;
+	const expiresAt = Date.now() + code.expires_in * 1e3;
+	while (Date.now() < expiresAt) {
+		await sleep(intervalMs);
+		const result = await pollDeviceToken({
+			appUrl,
+			deviceCode: code.device_code,
+			currentIntervalMs: intervalMs
+		});
+		switch (result.kind) {
+			case "success": {
+				const org = await ensureActiveOrganization({
+					appUrl,
+					sessionToken: result.accessToken
+				});
+				if (org.isErr()) return err({ message: org.error.message });
+				saveSession({
+					sessionToken: result.accessToken,
+					appUrl
+				});
+				return ok({
+					appUrl,
+					sessionToken: result.accessToken
+				});
+			}
+			case "pending":
+				intervalMs = result.nextIntervalMs;
+				break;
+			case "denied": return err({ message: "Authorization was denied." });
+			case "expired": return err({ message: "The device code expired. Please try again." });
+			case "error": break;
+		}
+	}
+	return err({ message: "Timed out waiting for authorization." });
+}
+/**
+* Insert a dash in the middle of an 8-char code so it's easier to read and
+* type. better-auth strips dashes server-side.
+*/
+function formatUserCode(code) {
+	if (code.length !== 8) return code;
+	return `${code.slice(0, 4)}-${code.slice(4)}`;
+}
+function sleep(ms) {
+	return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+//#endregion
+//#region src/output.ts
+function output(argv, data) {
+	if (argv.json) {
+		console.log(JSON.stringify(data, null, 2));
+		return;
+	}
+	if (typeof data === "string") {
+		console.log(data);
+		return;
+	}
+	console.log(JSON.stringify(data, null, 2));
+}
+function printTable(headers, rows) {
+	const widths = headers.map((h, i) => Math.max(h.length, ...rows.map((r) => (r[i] ?? "").length)));
+	const pad = (s, w) => s.padEnd(w);
+	const line = (cells) => cells.map((c, i) => pad(c, widths[i] ?? 0)).join("  ");
+	console.log(line(headers));
+	console.log(widths.map((w) => "-".repeat(w)).join("  "));
+	for (const row of rows) console.log(line(row));
+}
+function printError(message) {
+	console.error(`Error: ${message}`);
+}
+
+//#endregion
+//#region src/commands/auth.ts
+const loginCommand = {
+	command: "login",
+	describe: "Authenticate with a Skydive API key (or --web for chat)",
+	builder: (y) => y.option("api-key", {
+		type: "string",
+		describe: `API key (${API_KEY_PREFIX}...)`
+	}).option("web", {
+		type: "boolean",
+		default: false,
+		describe: "Sign in for `skydive chat` via the browser (device flow) instead of an API key"
+	}),
+	handler: async (argv) => {
+		if (argv.web) {
+			await runWebLogin(argv);
+			return;
+		}
+		let apiKey = argv["api-key"] ?? process.env["SKYDIVE_API_KEY"];
+		if (!apiKey) {
+			const rl = createInterface({
+				input: process.stdin,
+				output: process.stderr
+			});
+			apiKey = await new Promise((resolve) => {
+				rl.question(`Enter your API key (from ${API_KEYS_URL}): `, (answer) => {
+					rl.close();
+					resolve(answer.trim());
+				});
+			});
+		}
+		if (!apiKey) {
+			printError("No API key provided.");
+			process.exit(1);
+		}
+		if (!apiKey.startsWith(API_KEY_PREFIX)) {
+			printError(`API key must start with ${API_KEY_PREFIX}`);
+			process.exit(1);
+		}
+		const apiUrl = argv["api-url"] ?? DEFAULT_API_URL;
+		const result = await new SkydiveApiClient({
+			token: apiKey,
+			apiUrl
+		}).listAgents({ limit: 1 });
+		if (result.isErr()) {
+			printError(`Invalid API key or unreachable server: ${result.error.message}`);
+			process.exit(1);
+		}
+		saveConfig({
+			apiKey,
+			apiUrl
+		});
+		if (argv.json) output(argv, {
+			authenticated: true,
+			prefix: apiKey.slice(0, 12),
+			configPath: getConfigPath()
+		});
+		else if (!argv.quiet) {
+			console.log(`Authenticated successfully.`);
+			console.log(`  Key:    ${apiKey.slice(0, 12)}...`);
+			console.log(`  Config: ${getConfigPath()}`);
+		}
+	}
+};
+async function runWebLogin(argv) {
+	if (isNonInteractive()) {
+		printError("`auth login --web` needs an interactive terminal. Set SKYDIVE_SESSION_TOKEN for non-interactive use.");
+		process.exit(1);
+	}
+	const result = await loginWithDevice({ appUrl: resolveAppUrl({ appUrl: argv["api-url"] }) });
+	if (result.isErr()) {
+		printError(result.error.message);
+		process.exit(1);
+	}
+	if (argv.json) output(argv, {
+		authenticated: true,
+		mode: "session",
+		appUrl: result.value.appUrl,
+		configPath: getConfigPath()
+	});
+	else if (!argv.quiet) {
+		console.log("Signed in for chat.");
+		console.log(`  App:    ${result.value.appUrl}`);
+		console.log(`  Config: ${getConfigPath()}`);
+	}
+}
+const logoutCommand = {
+	command: "logout",
+	describe: "Clear stored credentials (API key and chat session)",
+	handler: async (argv) => {
+		deleteConfig();
+		if (argv.json) output(argv, { authenticated: false });
+		else if (!argv.quiet) console.log("Logged out.");
+	}
+};
+const statusCommand = {
+	command: "status",
+	describe: "Show current authentication state",
+	handler: async (argv) => {
+		const apiKey = resolveConfig({ apiUrl: argv["api-url"] });
+		const session = resolveSession({});
+		if (argv.json) {
+			output(argv, {
+				authenticated: apiKey.isOk(),
+				prefix: apiKey.isOk() ? apiKey.value.apiKey.slice(0, 12) : null,
+				apiUrl: apiKey.isOk() ? apiKey.value.apiUrl : null,
+				chat: {
+					authenticated: session.isOk(),
+					appUrl: session.isOk() ? session.value.appUrl : null
+				},
+				configPath: getConfigPath()
+			});
+			return;
+		}
+		if (apiKey.isErr() && session.isErr()) {
+			console.log("Not authenticated. Run `skydive auth login` (API key) or `skydive auth login --web` (chat).");
+			return;
+		}
+		if (apiKey.isOk()) {
+			console.log("API key:");
+			console.log(`  Key:    ${apiKey.value.apiKey.slice(0, 12)}...`);
+			console.log(`  API:    ${apiKey.value.apiUrl}`);
+		} else console.log("API key:      not configured.");
+		if (session.isOk()) {
+			console.log("Chat session:");
+			console.log(`  App:    ${session.value.appUrl}`);
+		} else console.log("Chat session: not signed in.");
+		console.log(`Config: ${getConfigPath()}`);
+	}
+};
+const authCommand = {
+	command: "auth",
+	describe: "Manage authentication",
+	builder: (y) => y.command(loginCommand).command(logoutCommand).command(statusCommand).demandCommand(1, "Specify a subcommand: login, logout, status"),
+	handler: () => {}
+};
+
+//#endregion
+//#region src/commands/agents.ts
+function requireClient$2(argv) {
+	const result = resolveManagementAuth({ apiUrl: argv["api-url"] });
+	if (result.isErr()) {
+		printError(result.error.message);
+		process.exit(1);
+	}
+	return new SkydiveApiClient(result.value);
+}
+const listCommand$3 = {
+	command: "list",
+	describe: "List agents",
+	builder: (y) => y.option("limit", {
+		type: "number",
+		default: 20,
+		describe: "Max results"
+	}).option("scope", {
+		type: "string",
+		choices: ["mine", "org"],
+		describe: "Filter scope"
+	}),
+	handler: async (argv) => {
+		const result = await requireClient$2(argv).listAgents({
+			limit: argv.limit,
+			scope: argv.scope
+		});
+		if (result.isErr()) {
+			printError(result.error.message);
+			process.exit(1);
+		}
+		const { agents } = result.value;
+		if (argv.json) {
+			output(argv, agents);
+			return;
+		}
+		if (agents.length === 0) {
+			console.log("No agents found.");
+			return;
+		}
+		printTable([
+			"Name",
+			"URL",
+			"Model"
+		], agents.map((a) => [
+			a.name,
+			a.url ?? "-",
+			a.model ?? "default"
+		]));
+	}
+};
+const getCommand = {
+	command: "get <id>",
+	describe: "Get agent details",
+	builder: (y) => y.positional("id", {
+		type: "string",
+		demandOption: true,
+		describe: "Agent ID"
+	}),
+	handler: async (argv) => {
+		const result = await requireClient$2(argv).getAgent(argv.id);
+		if (result.isErr()) {
+			printError(result.error.message);
+			process.exit(1);
+		}
+		const agent = result.value;
+		if (argv.json) {
+			output(argv, agent);
+			return;
+		}
+		if (argv.quiet) {
+			console.log(agent.id);
+			return;
+		}
+		console.log(`Name:        ${agent.name}`);
+		console.log(`ID:          ${agent.id}`);
+		console.log(`Model:       ${agent.model ?? "default"}`);
+		if (agent.description) console.log(`Description: ${agent.description}`);
+		if (agent.url) console.log(`Endpoint:    ${agent.url}`);
+		console.log(`Git:         ${agent.gitUrl}`);
+	}
+};
+const createCommand$1 = {
+	command: "create",
+	describe: "Create a new agent",
+	builder: (y) => y.option("name", {
+		type: "string",
+		demandOption: true,
+		describe: "Agent name"
+	}).option("model", {
+		type: "string",
+		describe: "Model to use"
+	}),
+	handler: async (argv) => {
+		const result = await requireClient$2(argv).createAgent({
+			name: argv.name,
+			model: argv.model
+		});
+		if (result.isErr()) {
+			printError(result.error.message);
+			process.exit(1);
+		}
+		const agent = result.value;
+		if (argv.json) {
+			output(argv, agent);
+			return;
+		}
+		if (argv.quiet) {
+			console.log(agent.id);
+			return;
+		}
+		console.log(`Agent created.`);
+		console.log(`  Name: ${agent.name}`);
+		console.log(`  ID:   ${agent.id}`);
+		console.log(`  Git:  ${agent.gitUrl}`);
+		if (agent.url) console.log(`  API:  ${agent.url}`);
+	}
+};
+const agentsCommand = {
+	command: "agents",
+	describe: "Manage agents",
+	builder: (y) => y.command(listCommand$3).command(getCommand).command(createCommand$1).demandCommand(1, "Specify a subcommand: list, get, create"),
+	handler: () => {}
+};
+
+//#endregion
+//#region src/commands/keys.ts
+function requireClient$1(argv) {
+	const result = resolveManagementAuth({ apiUrl: argv["api-url"] });
+	if (result.isErr()) {
+		printError(result.error.message);
+		process.exit(1);
+	}
+	return new SkydiveApiClient(result.value);
+}
+const listCommand$2 = {
+	command: "list",
+	describe: "List API keys for an agent",
+	handler: async (argv) => {
+		const result = await requireClient$1(argv).listKeys(argv["agent-id"]);
+		if (result.isErr()) {
+			printError(result.error.message);
+			process.exit(1);
+		}
+		const keys = result.value;
+		if (argv.json) {
+			output(argv, keys);
+			return;
+		}
+		if (keys.length === 0) {
+			console.log("No API keys found.");
+			return;
+		}
+		printTable([
+			"Name",
+			"Prefix",
+			"Last Used",
+			"Created"
+		], keys.map((k) => [
+			k.name,
+			k.prefix,
+			k.lastUsedAt ? new Date(k.lastUsedAt).toLocaleDateString() : "Never",
+			new Date(k.createdAt).toLocaleDateString()
+		]));
+	}
+};
+const createCommand = {
+	command: "create <name>",
+	describe: "Create a new API key for an agent",
+	builder: (y) => y.positional("name", {
+		type: "string",
+		demandOption: true,
+		describe: "Key name"
+	}),
+	handler: async (argv) => {
+		const result = await requireClient$1(argv).createKey(argv["agent-id"], argv.name);
+		if (result.isErr()) {
+			printError(result.error.message);
+			process.exit(1);
+		}
+		const key = result.value;
+		if (argv.json) {
+			output(argv, key);
+			return;
+		}
+		if (argv.quiet) {
+			console.log(key.key);
+			return;
+		}
+		console.log(`API key created.`);
+		console.log(`  Name: ${key.name}`);
+		console.log(`  Key:  ${key.key}`);
+		console.log("");
+		console.log("  Save this key — it will not be shown again.");
+	}
+};
+const revokeCommand = {
+	command: "revoke <id>",
+	describe: "Revoke an API key",
+	builder: (y) => y.positional("id", {
+		type: "string",
+		demandOption: true,
+		describe: "Key ID"
+	}),
+	handler: async (argv) => {
+		const result = await requireClient$1(argv).revokeKey(argv["agent-id"], argv.id);
+		if (result.isErr()) {
+			printError(result.error.message);
+			process.exit(1);
+		}
+		if (argv.json) output(argv, {
+			revoked: true,
+			id: argv.id
+		});
+		else if (!argv.quiet) console.log(`Key ${argv.id} revoked.`);
+	}
+};
+const keysCommand = {
+	command: "keys",
+	describe: "Manage API keys for an agent",
+	builder: (y) => y.option("agent-id", {
+		type: "string",
+		demandOption: true,
+		describe: "Agent ID"
+	}).command(listCommand$2).command(createCommand).command(revokeCommand).demandCommand(1, "Specify a subcommand: list, create, revoke"),
+	handler: () => {}
+};
+
+//#endregion
+//#region src/commands/secrets.ts
+function requireClient(argv) {
+	const result = resolveManagementAuth({ apiUrl: argv["api-url"] });
+	if (result.isErr()) {
+		printError(result.error.message);
+		process.exit(1);
+	}
+	return new SkydiveApiClient(result.value);
+}
+/** Read all of stdin as UTF-8, trimming a single trailing newline. */
+async function readStdin() {
+	const chunks = [];
+	for await (const chunk of process.stdin) chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+	return Buffer.concat(chunks).toString("utf8").replace(/\n$/, "");
+}
+const listCommand$1 = {
+	command: "list",
+	describe: "List secret names for an agent (values are never shown)",
+	handler: async (argv) => {
+		const result = await requireClient(argv).listSecrets(argv["agent-id"]);
+		if (result.isErr()) {
+			printError(result.error.message);
+			process.exit(1);
+		}
+		const keys = result.value;
+		if (argv.json) {
+			output(argv, keys);
+			return;
+		}
+		if (keys.length === 0) {
+			console.log("No secrets found.");
+			return;
+		}
+		printTable(["Name"], keys.map((k) => [k]));
+	}
+};
+const setCommand = {
+	command: "set <key> [value]",
+	describe: "Set (create or overwrite) a secret. Reads value from stdin if omitted.",
+	builder: (y) => y.positional("key", {
+		type: "string",
+		demandOption: true,
+		describe: "Secret name (uppercase letters, digits, underscores)"
+	}).positional("value", {
+		type: "string",
+		describe: "Secret value. If omitted, read from stdin — keeps the value out of shell history."
+	}),
+	handler: async (argv) => {
+		let value = argv.value;
+		if (value === void 0) {
+			if (process.stdin.isTTY) {
+				printError("No value given. Pass it as an argument or pipe it on stdin, e.g. `echo -n \"$TOKEN\" | skydive secrets set MY_KEY --agent-id <id>`.");
+				process.exit(1);
+			}
+			value = await readStdin();
+		}
+		if (!value) {
+			printError("Empty secret value.");
+			process.exit(1);
+		}
+		const result = await requireClient(argv).setSecret(argv["agent-id"], argv.key, value);
+		if (result.isErr()) {
+			printError(result.error.message);
+			process.exit(1);
+		}
+		if (argv.json) output(argv, {
+			key: result.value,
+			set: true
+		});
+		else if (!argv.quiet) console.log(`Secret ${result.value} set.`);
+	}
+};
+const rmCommand = {
+	command: "rm <key>",
+	aliases: ["delete"],
+	describe: "Remove a secret from the agent",
+	builder: (y) => y.positional("key", {
+		type: "string",
+		demandOption: true,
+		describe: "Secret name"
+	}),
+	handler: async (argv) => {
+		const result = await requireClient(argv).deleteSecret(argv["agent-id"], argv.key);
+		if (result.isErr()) {
+			printError(result.error.message);
+			process.exit(1);
+		}
+		if (argv.json) output(argv, {
+			key: argv.key,
+			removed: true
+		});
+		else if (!argv.quiet) console.log(`Secret ${argv.key} removed.`);
+	}
+};
+const secretsCommand = {
+	command: "secrets",
+	describe: "Manage an agent’s secrets",
+	builder: (y) => y.option("agent-id", {
+		type: "string",
+		demandOption: true,
+		describe: "Agent ID"
+	}).command(listCommand$1).command(setCommand).command(rmCommand).demandCommand(1, "Specify a subcommand: list, set, rm"),
+	handler: () => {}
+};
+
+//#endregion
+//#region src/chat/tui/theme.ts
+const tokyonight = {
+	id: "tokyonight",
+	label: "Tokyo Night",
+	mode: "dark",
+	palette: {
+		fg: "#c0caf5",
+		muted: "#7a7a7a",
+		dim: "#565f89",
+		faint: "#3b4261",
+		surface: "#16161e",
+		accent: "#7aa2f7",
+		success: "#9ece6a",
+		warning: "#e0af68",
+		error: "#f7768e",
+		user: "#7aa2f7",
+		assistant: "#c0caf5",
+		tool: "#bb9af7",
+		reasoning: "#565f89",
+		syntaxBlue: "#7aa2f7",
+		syntaxCyan: "#7dcfff",
+		syntaxTeal: "#73daca",
+		syntaxGreen: "#9ece6a",
+		syntaxYellow: "#e0af68",
+		syntaxOrange: "#ff9e64",
+		syntaxRed: "#f7768e",
+		syntaxMagenta: "#bb9af7"
+	}
+};
+const tokyonightDay = {
+	id: "tokyonight-day",
+	label: "Tokyo Night Day",
+	mode: "light",
+	palette: {
+		fg: "#3760bf",
+		muted: "#848cb5",
+		dim: "#9da3c2",
+		faint: "#c4c8da",
+		surface: "#d0d1d8",
+		accent: "#2e7de9",
+		success: "#587539",
+		warning: "#8c6c3e",
+		error: "#f52a65",
+		user: "#2e7de9",
+		assistant: "#3760bf",
+		tool: "#9854f1",
+		reasoning: "#848cb5",
+		syntaxBlue: "#2e7de9",
+		syntaxCyan: "#007197",
+		syntaxTeal: "#118c74",
+		syntaxGreen: "#587539",
+		syntaxYellow: "#8c6c3e",
+		syntaxOrange: "#b15c00",
+		syntaxRed: "#f52a65",
+		syntaxMagenta: "#9854f1"
+	}
+};
+const catppuccinMocha = {
+	id: "catppuccin-mocha",
+	label: "Catppuccin Mocha",
+	mode: "dark",
+	palette: {
+		fg: "#cdd6f4",
+		muted: "#7f849c",
+		dim: "#6c7086",
+		faint: "#45475a",
+		surface: "#181825",
+		accent: "#89b4fa",
+		success: "#a6e3a1",
+		warning: "#f9e2af",
+		error: "#f38ba8",
+		user: "#89b4fa",
+		assistant: "#cdd6f4",
+		tool: "#cba6f7",
+		reasoning: "#6c7086",
+		syntaxBlue: "#89b4fa",
+		syntaxCyan: "#89dceb",
+		syntaxTeal: "#94e2d5",
+		syntaxGreen: "#a6e3a1",
+		syntaxYellow: "#f9e2af",
+		syntaxOrange: "#fab387",
+		syntaxRed: "#f38ba8",
+		syntaxMagenta: "#cba6f7"
+	}
+};
+const catppuccinLatte = {
+	id: "catppuccin-latte",
+	label: "Catppuccin Latte",
+	mode: "light",
+	palette: {
+		fg: "#4c4f69",
+		muted: "#8c8fa1",
+		dim: "#9ca0b0",
+		faint: "#bcc0cc",
+		surface: "#e6e9ef",
+		accent: "#1e66f5",
+		success: "#40a02b",
+		warning: "#df8e1d",
+		error: "#d20f39",
+		user: "#1e66f5",
+		assistant: "#4c4f69",
+		tool: "#8839ef",
+		reasoning: "#9ca0b0",
+		syntaxBlue: "#1e66f5",
+		syntaxCyan: "#04a5e5",
+		syntaxTeal: "#179299",
+		syntaxGreen: "#40a02b",
+		syntaxYellow: "#df8e1d",
+		syntaxOrange: "#fe640b",
+		syntaxRed: "#d20f39",
+		syntaxMagenta: "#8839ef"
+	}
+};
+const gruvboxDark = {
+	id: "gruvbox-dark",
+	label: "Gruvbox Dark",
+	mode: "dark",
+	palette: {
+		fg: "#ebdbb2",
+		muted: "#928374",
+		dim: "#7c6f64",
+		faint: "#504945",
+		surface: "#1d2021",
+		accent: "#83a598",
+		success: "#b8bb26",
+		warning: "#fabd2f",
+		error: "#fb4934",
+		user: "#83a598",
+		assistant: "#ebdbb2",
+		tool: "#d3869b",
+		reasoning: "#7c6f64",
+		syntaxBlue: "#83a598",
+		syntaxCyan: "#8ec07c",
+		syntaxTeal: "#8ec07c",
+		syntaxGreen: "#b8bb26",
+		syntaxYellow: "#fabd2f",
+		syntaxOrange: "#fe8019",
+		syntaxRed: "#fb4934",
+		syntaxMagenta: "#d3869b"
+	}
+};
+const gruvboxLight = {
+	id: "gruvbox-light",
+	label: "Gruvbox Light",
+	mode: "light",
+	palette: {
+		fg: "#3c3836",
+		muted: "#928374",
+		dim: "#a89984",
+		faint: "#d5c4a1",
+		surface: "#ebdbb2",
+		accent: "#076678",
+		success: "#79740e",
+		warning: "#b57614",
+		error: "#9d0006",
+		user: "#076678",
+		assistant: "#3c3836",
+		tool: "#8f3f71",
+		reasoning: "#a89984",
+		syntaxBlue: "#076678",
+		syntaxCyan: "#427b58",
+		syntaxTeal: "#427b58",
+		syntaxGreen: "#79740e",
+		syntaxYellow: "#b57614",
+		syntaxOrange: "#af3a03",
+		syntaxRed: "#9d0006",
+		syntaxMagenta: "#8f3f71"
+	}
+};
+const solarizedDark = {
+	id: "solarized-dark",
+	label: "Solarized Dark",
+	mode: "dark",
+	palette: {
+		fg: "#93a1a1",
+		muted: "#586e75",
+		dim: "#586e75",
+		faint: "#073642",
+		surface: "#00212b",
+		accent: "#268bd2",
+		success: "#859900",
+		warning: "#b58900",
+		error: "#dc322f",
+		user: "#268bd2",
+		assistant: "#93a1a1",
+		tool: "#6c71c4",
+		reasoning: "#586e75",
+		syntaxBlue: "#268bd2",
+		syntaxCyan: "#2aa198",
+		syntaxTeal: "#2aa198",
+		syntaxGreen: "#859900",
+		syntaxYellow: "#b58900",
+		syntaxOrange: "#cb4b16",
+		syntaxRed: "#dc322f",
+		syntaxMagenta: "#6c71c4"
+	}
+};
+const solarizedLight = {
+	id: "solarized-light",
+	label: "Solarized Light",
+	mode: "light",
+	palette: {
+		fg: "#657b83",
+		muted: "#839496",
+		dim: "#93a1a1",
+		faint: "#eee8d5",
+		surface: "#eee8d5",
+		accent: "#268bd2",
+		success: "#859900",
+		warning: "#b58900",
+		error: "#dc322f",
+		user: "#268bd2",
+		assistant: "#657b83",
+		tool: "#6c71c4",
+		reasoning: "#93a1a1",
+		syntaxBlue: "#268bd2",
+		syntaxCyan: "#2aa198",
+		syntaxTeal: "#2aa198",
+		syntaxGreen: "#859900",
+		syntaxYellow: "#b58900",
+		syntaxOrange: "#cb4b16",
+		syntaxRed: "#dc322f",
+		syntaxMagenta: "#6c71c4"
+	}
+};
+const nord = {
+	id: "nord",
+	label: "Nord",
+	mode: "dark",
+	palette: {
+		fg: "#d8dee9",
+		muted: "#616e88",
+		dim: "#4c566a",
+		faint: "#3b4252",
+		surface: "#272c36",
+		accent: "#88c0d0",
+		success: "#a3be8c",
+		warning: "#ebcb8b",
+		error: "#bf616a",
+		user: "#88c0d0",
+		assistant: "#d8dee9",
+		tool: "#b48ead",
+		reasoning: "#4c566a",
+		syntaxBlue: "#81a1c1",
+		syntaxCyan: "#88c0d0",
+		syntaxTeal: "#8fbcbb",
+		syntaxGreen: "#a3be8c",
+		syntaxYellow: "#ebcb8b",
+		syntaxOrange: "#d08770",
+		syntaxRed: "#bf616a",
+		syntaxMagenta: "#b48ead"
+	}
+};
+const dracula = {
+	id: "dracula",
+	label: "Dracula",
+	mode: "dark",
+	palette: {
+		fg: "#f8f8f2",
+		muted: "#6272a4",
+		dim: "#6272a4",
+		faint: "#44475a",
+		surface: "#21222c",
+		accent: "#bd93f9",
+		success: "#50fa7b",
+		warning: "#ffb86c",
+		error: "#ff5555",
+		user: "#bd93f9",
+		assistant: "#f8f8f2",
+		tool: "#ff79c6",
+		reasoning: "#6272a4",
+		syntaxBlue: "#bd93f9",
+		syntaxCyan: "#8be9fd",
+		syntaxTeal: "#8be9fd",
+		syntaxGreen: "#50fa7b",
+		syntaxYellow: "#f1fa8c",
+		syntaxOrange: "#ffb86c",
+		syntaxRed: "#ff5555",
+		syntaxMagenta: "#ff79c6"
+	}
+};
+const oneDark = {
+	id: "one-dark",
+	label: "One Dark",
+	mode: "dark",
+	palette: {
+		fg: "#abb2bf",
+		muted: "#5c6370",
+		dim: "#5c6370",
+		faint: "#3e4451",
+		surface: "#21252b",
+		accent: "#61afef",
+		success: "#98c379",
+		warning: "#e5c07b",
+		error: "#e06c75",
+		user: "#61afef",
+		assistant: "#abb2bf",
+		tool: "#c678dd",
+		reasoning: "#5c6370",
+		syntaxBlue: "#61afef",
+		syntaxCyan: "#56b6c2",
+		syntaxTeal: "#56b6c2",
+		syntaxGreen: "#98c379",
+		syntaxYellow: "#e5c07b",
+		syntaxOrange: "#d19a66",
+		syntaxRed: "#e06c75",
+		syntaxMagenta: "#c678dd"
+	}
+};
+const oneLight = {
+	id: "one-light",
+	label: "One Light",
+	mode: "light",
+	palette: {
+		fg: "#383a42",
+		muted: "#a0a1a7",
+		dim: "#a0a1a7",
+		faint: "#e5e5e6",
+		surface: "#f0f0f1",
+		accent: "#4078f2",
+		success: "#50a14f",
+		warning: "#c18401",
+		error: "#e45649",
+		user: "#4078f2",
+		assistant: "#383a42",
+		tool: "#a626a4",
+		reasoning: "#a0a1a7",
+		syntaxBlue: "#4078f2",
+		syntaxCyan: "#0184bc",
+		syntaxTeal: "#0184bc",
+		syntaxGreen: "#50a14f",
+		syntaxYellow: "#c18401",
+		syntaxOrange: "#986801",
+		syntaxRed: "#e45649",
+		syntaxMagenta: "#a626a4"
+	}
+};
+const rosePine = {
+	id: "rose-pine",
+	label: "Rosé Pine",
+	mode: "dark",
+	palette: {
+		fg: "#e0def4",
+		muted: "#908caa",
+		dim: "#6e6a86",
+		faint: "#403d52",
+		surface: "#16141f",
+		accent: "#c4a7e7",
+		success: "#9ccfd8",
+		warning: "#f6c177",
+		error: "#eb6f92",
+		user: "#c4a7e7",
+		assistant: "#e0def4",
+		tool: "#ebbcba",
+		reasoning: "#908caa",
+		syntaxBlue: "#9ccfd8",
+		syntaxCyan: "#9ccfd8",
+		syntaxTeal: "#31748f",
+		syntaxGreen: "#31748f",
+		syntaxYellow: "#f6c177",
+		syntaxOrange: "#ebbcba",
+		syntaxRed: "#eb6f92",
+		syntaxMagenta: "#c4a7e7"
+	}
+};
+const rosePineDawn = {
+	id: "rose-pine-dawn",
+	label: "Rosé Pine Dawn",
+	mode: "light",
+	palette: {
+		fg: "#575279",
+		muted: "#797593",
+		dim: "#9893a5",
+		faint: "#cecacd",
+		surface: "#f2e9e1",
+		accent: "#907aa9",
+		success: "#56949f",
+		warning: "#ea9d34",
+		error: "#b4637a",
+		user: "#907aa9",
+		assistant: "#575279",
+		tool: "#d7827e",
+		reasoning: "#9893a5",
+		syntaxBlue: "#56949f",
+		syntaxCyan: "#56949f",
+		syntaxTeal: "#286983",
+		syntaxGreen: "#286983",
+		syntaxYellow: "#ea9d34",
+		syntaxOrange: "#d7827e",
+		syntaxRed: "#b4637a",
+		syntaxMagenta: "#907aa9"
+	}
+};
+const everforestDark = {
+	id: "everforest-dark",
+	label: "Everforest Dark",
+	mode: "dark",
+	palette: {
+		fg: "#d3c6aa",
+		muted: "#859289",
+		dim: "#7a8478",
+		faint: "#414b50",
+		surface: "#232a2e",
+		accent: "#7fbbb3",
+		success: "#a7c080",
+		warning: "#dbbc7f",
+		error: "#e67e80",
+		user: "#7fbbb3",
+		assistant: "#d3c6aa",
+		tool: "#d699b6",
+		reasoning: "#7a8478",
+		syntaxBlue: "#7fbbb3",
+		syntaxCyan: "#83c092",
+		syntaxTeal: "#83c092",
+		syntaxGreen: "#a7c080",
+		syntaxYellow: "#dbbc7f",
+		syntaxOrange: "#e69875",
+		syntaxRed: "#e67e80",
+		syntaxMagenta: "#d699b6"
+	}
+};
+const everforestLight = {
+	id: "everforest-light",
+	label: "Everforest Light",
+	mode: "light",
+	palette: {
+		fg: "#5c6a72",
+		muted: "#939f91",
+		dim: "#a6b0a0",
+		faint: "#e0dcc7",
+		surface: "#f4f0d9",
+		accent: "#3a94c5",
+		success: "#8da101",
+		warning: "#dfa000",
+		error: "#f85552",
+		user: "#3a94c5",
+		assistant: "#5c6a72",
+		tool: "#df69ba",
+		reasoning: "#a6b0a0",
+		syntaxBlue: "#3a94c5",
+		syntaxCyan: "#35a77c",
+		syntaxTeal: "#35a77c",
+		syntaxGreen: "#8da101",
+		syntaxYellow: "#dfa000",
+		syntaxOrange: "#f57d26",
+		syntaxRed: "#f85552",
+		syntaxMagenta: "#df69ba"
+	}
+};
+const githubDark = {
+	id: "github-dark",
+	label: "GitHub Dark",
+	mode: "dark",
+	palette: {
+		fg: "#c9d1d9",
+		muted: "#8b949e",
+		dim: "#6e7681",
+		faint: "#30363d",
+		surface: "#161b22",
+		accent: "#58a6ff",
+		success: "#3fb950",
+		warning: "#d29922",
+		error: "#f85149",
+		user: "#58a6ff",
+		assistant: "#c9d1d9",
+		tool: "#bc8cff",
+		reasoning: "#6e7681",
+		syntaxBlue: "#58a6ff",
+		syntaxCyan: "#39c5cf",
+		syntaxTeal: "#39c5cf",
+		syntaxGreen: "#3fb950",
+		syntaxYellow: "#d29922",
+		syntaxOrange: "#db6d28",
+		syntaxRed: "#f85149",
+		syntaxMagenta: "#bc8cff"
+	}
+};
+const githubLight = {
+	id: "github-light",
+	label: "GitHub Light",
+	mode: "light",
+	palette: {
+		fg: "#24292f",
+		muted: "#57606a",
+		dim: "#8c959f",
+		faint: "#d0d7de",
+		surface: "#f6f8fa",
+		accent: "#0969da",
+		success: "#1a7f37",
+		warning: "#9a6700",
+		error: "#cf222e",
+		user: "#0969da",
+		assistant: "#24292f",
+		tool: "#8250df",
+		reasoning: "#8c959f",
+		syntaxBlue: "#0969da",
+		syntaxCyan: "#1b7c83",
+		syntaxTeal: "#1b7c83",
+		syntaxGreen: "#1a7f37",
+		syntaxYellow: "#9a6700",
+		syntaxOrange: "#bc4c00",
+		syntaxRed: "#cf222e",
+		syntaxMagenta: "#8250df"
+	}
+};
+const kanagawa = {
+	id: "kanagawa",
+	label: "Kanagawa",
+	mode: "dark",
+	palette: {
+		fg: "#dcd7ba",
+		muted: "#727169",
+		dim: "#54546d",
+		faint: "#363646",
+		surface: "#16161d",
+		accent: "#7e9cd8",
+		success: "#98bb6c",
+		warning: "#e6c384",
+		error: "#e46876",
+		user: "#7e9cd8",
+		assistant: "#dcd7ba",
+		tool: "#957fb8",
+		reasoning: "#727169",
+		syntaxBlue: "#7e9cd8",
+		syntaxCyan: "#7aa89f",
+		syntaxTeal: "#7aa89f",
+		syntaxGreen: "#98bb6c",
+		syntaxYellow: "#e6c384",
+		syntaxOrange: "#ffa066",
+		syntaxRed: "#e46876",
+		syntaxMagenta: "#957fb8"
+	}
+};
+const themes = [
+	tokyonight,
+	tokyonightDay,
+	catppuccinMocha,
+	catppuccinLatte,
+	gruvboxDark,
+	gruvboxLight,
+	solarizedDark,
+	solarizedLight,
+	nord,
+	dracula,
+	oneDark,
+	oneLight,
+	rosePine,
+	rosePineDawn,
+	everforestDark,
+	everforestLight,
+	githubDark,
+	githubLight,
+	kanagawa
+];
+const DEFAULT_THEME_ID = {
+	dark: tokyonight.id,
+	light: tokyonightDay.id
+};
+/** All-undefined palette for NO_COLOR: every fg/bg falls back to the
+* terminal's own defaults, so nothing emits color. Not listed in `themes` —
+* it's forced, never picked. */
+const monoTheme = {
+	id: "mono",
+	label: "No color",
+	mode: "dark",
+	palette: {
+		fg: void 0,
+		muted: void 0,
+		dim: void 0,
+		faint: void 0,
+		surface: void 0,
+		accent: void 0,
+		success: void 0,
+		warning: void 0,
+		error: void 0,
+		user: void 0,
+		assistant: void 0,
+		tool: void 0,
+		reasoning: void 0,
+		syntaxBlue: void 0,
+		syntaxCyan: void 0,
+		syntaxTeal: void 0,
+		syntaxGreen: void 0,
+		syntaxYellow: void 0,
+		syntaxOrange: void 0,
+		syntaxRed: void 0,
+		syntaxMagenta: void 0
+	}
+};
+function themesForMode(mode) {
+	return themes.filter((t) => t.mode === mode);
+}
+function findTheme(id) {
+	if (id === monoTheme.id) return monoTheme;
+	return themes.find((t) => t.id === id);
+}
+/**
+* The saved theme to use for a mode: the persisted pick if it exists *and*
+* still matches the mode (a stale/renamed id falls back), else the default.
+*/
+function themeForMode(mode, savedId) {
+	if (savedId) {
+		const saved = findTheme(savedId);
+		if (saved && saved.mode === mode) return saved;
+	}
+	return findTheme(DEFAULT_THEME_ID[mode]) ?? tokyonight;
+}
+/** https://no-color.org — any non-empty value disables color output. */
+function noColorRequested(env = process.env) {
+	const v = env["NO_COLOR"];
+	return v !== void 0 && v !== "";
+}
+/**
+* Fallback light/dark sniff for terminals that never answer the OSC 10/11
+* query: `COLORFGBG` is "<fg>;<bg>" (sometimes "<fg>;default;<bg>") with
+* ANSI palette indexes. Background 7/15 (white/bright white) means a light
+* terminal; anything else we call dark. Returns null when unset/unparsable.
+*/
+function themeModeFromColorFgBg(env = process.env) {
+	const raw = env["COLORFGBG"];
+	if (!raw) return null;
+	const parts = raw.split(";");
+	const bg = parts[parts.length - 1];
+	if (bg === void 0 || !/^\d+$/.test(bg)) return null;
+	const idx = Number(bg);
+	return idx === 7 || idx === 15 ? "light" : "dark";
+}
+/** Single source of truth for colors. Mutated in place by `applyTheme` so
+* existing `theme.fg`-style reads across the TUI stay valid. */
+const theme = { ...tokyonight.palette };
+let version = 0;
+function themeVersion() {
+	return version;
+}
+let mode = tokyonight.mode;
+function themeMode() {
+	return mode;
+}
+function applyTheme(def) {
+	Object.assign(theme, def.palette);
+	mode = def.mode;
+	version++;
+}
+
+//#endregion
+//#region src/chat/bun-runtime.ts
+/**
+* The chat TUI renders through OpenTUI, whose native core is Bun-first (its
+* FFI/native-module loading needs the Bun runtime; the Node path requires an
+* experimental `node:ffi` only present in very new Node). Rather than make the
+* user install Bun by hand, the CLI provisions a private, pinned Bun the first
+* time `chat` runs and transparently re-execs itself under it. Every other
+* command still runs under whatever Node the CLI was launched with — Bun is
+* only ever fetched for `chat`.
+*/
+/**
+* Bun release the CLI pins. Bump deliberately: the download is integrity-checked
+* against this exact release's published `SHASUMS256.txt`, and the cached binary
+* is keyed by version so bumping here transparently re-provisions on next `chat`.
+*/
+const PINNED_BUN_VERSION = "1.3.14";
+const BUN_RELEASE_BASE = process.env["SKYDIVE_BUN_RELEASE_BASE"] ?? "https://github.com/oven-sh/bun/releases/download";
+/** Guard env var: set on the child so a re-exec can never recurse. */
+const REEXEC_GUARD = "SKYDIVE_BUN_REEXEC";
+function isBun() {
+	return typeof process !== "undefined" && "bun" in process.versions;
+}
+/**
+* Map the current platform/arch to Bun's release asset basename (without the
+* `.zip`). Returns null on platforms Bun doesn't publish a build for, so the
+* caller can fall back to the manual-install message instead of a 404.
+*
+* We deliberately pick the portable (non-`baseline`, non-`musl`) x64 builds;
+* the baseline variant only matters for pre-2013 CPUs and isn't worth
+* auto-detecting here. If that ever bites someone, `SKYDIVE_BUN_PATH` lets them
+* point at their own Bun.
+*/
+function bunAssetTarget(platform = process.platform, arch = process.arch) {
+	const a = arch === "arm64" ? "aarch64" : arch === "x64" ? "x64" : null;
+	if (!a) return null;
+	switch (platform) {
+		case "linux": return `bun-linux-${a}`;
+		case "darwin": return `bun-darwin-${a}`;
+		case "win32": return a === "x64" ? "bun-windows-x64" : null;
+		default: return null;
+	}
+}
+/** Directory holding CLI-managed binaries, beside the config file. */
+function binDir() {
+	return path.join(path.dirname(getConfigPath()), "bin");
+}
+/** Absolute path to the version-pinned cached Bun (may not exist yet). */
+function cachedBunPath(version = PINNED_BUN_VERSION) {
+	const exe = process.platform === "win32" ? "bun.exe" : "bun";
+	return path.join(binDir(), `bun-${version}`, exe);
+}
+function isExecutableFile(p) {
+	try {
+		if (!fs.statSync(p).isFile()) return false;
+		if (process.platform !== "win32") fs.accessSync(p, fs.constants.X_OK);
+		return true;
+	} catch {
+		return false;
+	}
+}
+/**
+* Locate a usable Bun without downloading. Order:
+*   1. `SKYDIVE_BUN_PATH` (explicit override / air-gapped installs)
+*   2. the version-pinned cache this CLI manages
+*   3. `bun` already on PATH
+* Returns null if none is usable.
+*/
+function findExistingBun() {
+	const override = process.env["SKYDIVE_BUN_PATH"];
+	if (override && isExecutableFile(override)) return override;
+	const cached = cachedBunPath();
+	if (isExecutableFile(cached)) return cached;
+	const onPath = resolveBunOnPath();
+	if (onPath) return onPath;
+	return null;
+}
+/** `which`/`where` for bun, without spawning a shell. */
+function resolveBunOnPath() {
+	const pathVar = process.env["PATH"] ?? "";
+	if (!pathVar) return null;
+	const exts = process.platform === "win32" ? (process.env["PATHEXT"] ?? ".EXE").split(";") : [""];
+	for (const dir of pathVar.split(path.delimiter)) {
+		if (!dir) continue;
+		for (const ext of exts) {
+			const candidate = path.join(dir, `bun${ext}`);
+			if (isExecutableFile(candidate)) return candidate;
+		}
+	}
+	return null;
+}
+async function fetchOk(url) {
+	const res = await fetch(url, {
+		headers: { "user-agent": "skydive-cli" },
+		redirect: "follow"
+	});
+	if (!res.ok) throw new Error(`GET ${url} -> ${res.status} ${res.statusText}`);
+	return res;
+}
+/**
+* Look up the published SHA-256 for `assetName` in the pinned release's
+* `SHASUMS256.txt`. Verifying against the release's own manifest keeps
+* integrity checking correct across version bumps without hardcoding a hash
+* per platform.
+*/
+async function expectedSha256(version, assetName) {
+	const url = `${BUN_RELEASE_BASE}/bun-v${version}/SHASUMS256.txt`;
+	const text = await (await fetchOk(url)).text();
+	for (const line of text.split("\n")) {
+		const [sum, name] = line.trim().split(/\s+/);
+		if (name === assetName && sum) return sum.toLowerCase();
+	}
+	throw new Error(`${assetName} not found in ${url}`);
+}
+function sha256(buf) {
+	return createHash("sha256").update(buf).digest("hex");
+}
+/**
+* Extract the single `bun` executable from a Bun release zip buffer. The zip
+* lays the binary out as `<target>/bun` (or `bun.exe` on Windows). Implemented
+* without a zip dependency by parsing the central directory — Bun's release zips
+* use a streaming data descriptor, so the *local* file header carries zeroed
+* sizes; the central directory is the only place with correct sizes/offsets.
+*/
+function extractBunFromZip(zip, target) {
+	const exeName = process.platform === "win32" ? "bun.exe" : "bun";
+	let eocd = -1;
+	for (let i = zip.length - 22; i >= 0; i--) if (zip.readUInt32LE(i) === 101010256) {
+		eocd = i;
+		break;
+	}
+	if (eocd < 0) throw new Error("release zip has no end-of-central-directory");
+	const entryCount = zip.readUInt16LE(eocd + 10);
+	let off = zip.readUInt32LE(eocd + 16);
+	for (let n = 0; n < entryCount; n++) {
+		if (zip.readUInt32LE(off) !== 33639248) throw new Error("malformed central directory in release zip");
+		const method = zip.readUInt16LE(off + 10);
+		const compSize = zip.readUInt32LE(off + 20);
+		const nameLen = zip.readUInt16LE(off + 28);
+		const extraLen = zip.readUInt16LE(off + 30);
+		const commentLen = zip.readUInt16LE(off + 32);
+		const localHeaderOffset = zip.readUInt32LE(off + 42);
+		const name = zip.toString("utf8", off + 46, off + 46 + nameLen);
+		if (name === `${target}/${exeName}` || name === exeName) {
+			const lNameLen = zip.readUInt16LE(localHeaderOffset + 26);
+			const lExtraLen = zip.readUInt16LE(localHeaderOffset + 28);
+			const dataStart = localHeaderOffset + 30 + lNameLen + lExtraLen;
+			const data = zip.subarray(dataStart, dataStart + compSize);
+			if (method === 0) return Buffer.from(data);
+			if (method === 8) return zlib.inflateRawSync(data);
+			throw new Error(`unsupported zip compression method ${method}`);
+		}
+		off += 46 + nameLen + extraLen + commentLen;
+	}
+	throw new Error(`bun binary not found in release zip for ${target}`);
+}
+/**
+* Download, verify, and cache the pinned Bun for this platform. Returns the
+* path to the cached executable, or null if Bun can't be provisioned (no
+* network, unsupported platform, checksum mismatch) — the caller then prints
+* the manual-install guidance. Never throws for the expected failure modes.
+*/
+async function downloadBun(onProgress) {
+	const target = bunAssetTarget();
+	if (!target) return null;
+	const assetName = `${target}.zip`;
+	const dest = cachedBunPath();
+	try {
+		onProgress?.(`Fetching Bun v${PINNED_BUN_VERSION} (one-time setup)…`);
+		const url = `${BUN_RELEASE_BASE}/bun-v${PINNED_BUN_VERSION}/${assetName}`;
+		const [zipRes, want] = await Promise.all([fetchOk(url), expectedSha256(PINNED_BUN_VERSION, assetName)]);
+		const zip = Buffer.from(await zipRes.arrayBuffer());
+		const got = sha256(zip);
+		if (got !== want) {
+			onProgress?.(`Bun download failed integrity check (expected ${want}, got ${got}).`);
+			return null;
+		}
+		const bin = extractBunFromZip(zip, target);
+		fs.mkdirSync(path.dirname(dest), { recursive: true });
+		const tmp = path.join(path.dirname(dest), `.bun.tmp-${process.pid}-${Date.now()}`);
+		fs.writeFileSync(tmp, bin, { mode: 493 });
+		if (process.platform !== "win32") fs.chmodSync(tmp, 493);
+		fs.renameSync(tmp, dest);
+		return dest;
+	} catch (e) {
+		onProgress?.(`Could not download Bun automatically: ${e instanceof Error ? e.message : String(e)}`);
+		return null;
+	}
+}
+/**
+* Ensure a usable Bun exists: already running under Bun, found on disk/PATH, or
+* freshly downloaded and cached. Pure resolution — does not re-exec.
+*/
+async function resolveBun(onProgress) {
+	if (isBun()) return { kind: "already-bun" };
+	const existing = findExistingBun();
+	if (existing) return {
+		kind: "found",
+		bunPath: existing
+	};
+	const downloaded = await downloadBun(onProgress);
+	if (downloaded) return {
+		kind: "found",
+		bunPath: downloaded
+	};
+	return { kind: "unavailable" };
+}
+/**
+* The heart of the transparent-Bun story. Called by `chat` before it touches
+* OpenTUI:
+*   - Under Bun already, or if a re-exec guard is set: return 'proceed'.
+*   - Otherwise resolve/provision Bun and re-exec this exact CLI invocation
+*     under it (inheriting stdio + argv), then exit with the child's code.
+*   - If Bun can't be provisioned: return 'unavailable' so the caller prints
+*     the existing manual-install message.
+*
+* Returns 'proceed' only when it's safe to load OpenTUI in this process.
+*/
+function ensureBunAndReexec(onProgress) {
+	if (isBun() || process.env[REEXEC_GUARD] === "1") return Promise.resolve("proceed");
+	return resolveBun(onProgress).then((resolution) => {
+		if (resolution.kind === "already-bun") return "proceed";
+		if (resolution.kind === "unavailable") return "unavailable";
+		const argv = process.argv.slice(1);
+		const result = spawnSync(resolution.bunPath, argv, {
+			stdio: "inherit",
+			env: {
+				...process.env,
+				[REEXEC_GUARD]: "1"
+			}
+		});
+		if (result.error) {
+			onProgress?.(`Failed to launch chat under Bun (${resolution.bunPath}): ${result.error.message}`);
+			return "unavailable";
+		}
+		process.exit(result.status ?? 0);
+	});
+}
+
+//#endregion
+//#region src/commands/chat.ts
+const chatCommand = {
+	command: "chat",
+	describe: "Open the interactive chat TUI, or -p for a one-shot",
+	builder: (y) => y.option("print", {
+		alias: "p",
+		type: "string",
+		describe: "Non-interactive: send one prompt, print the reply, and exit (like `claude -p`). Reads the prompt from stdin if given no value. Runs under Node — no Bun required."
+	}).option("agent", {
+		type: "string",
+		describe: "Target agent, by id, slug, or name. With -p, the agent to send the one-shot prompt to. Without -p, pre-selects the agent and opens its conversation list, skipping the agent picker. Optional when the account has exactly one agent."
+	}).option("conversation", {
+		type: "string",
+		describe: "For -p: continue an existing conversation by id instead of starting a new one."
+	}).option("share-machine", {
+		type: "boolean",
+		default: false,
+		describe: "Share this machine with the agent over the portal so it can run commands here (default-deny; you approve per agent)"
+	}).option("theme", {
+		type: "string",
+		describe: `Pin a colorscheme (disables automatic light/dark switching). One of: ${themes.map((t) => t.id).join(", ")}. Defaults to following the terminal background; also settable via SKYDIVE_THEME.`
+	}).option("notify", {
+		type: "boolean",
+		default: true,
+		describe: "Show a desktop notification when a run finishes or needs your input while this terminal is unfocused (use --no-notify to disable)"
+	}).example("skydive chat -p \"summarize my open PRs\" --agent grace", "One-shot, non-interactive").example("echo \"what changed today?\" | skydive chat -p --agent grace", "Read the prompt from stdin").example("skydive chat --agent grace", "Open Grace's conversation list in the TUI (skips the agent picker)"),
+	handler: async (argv) => {
+		const appUrl = resolveAppUrl({ appUrl: argv["api-url"] });
+		if (argv.print !== void 0) {
+			await runPrintMode({
+				argv,
+				appUrl
+			});
+			return;
+		}
+		if (await ensureBunAndReexec((msg) => process.stderr.write(`${msg}\n`)) === "unavailable") {
+			printError(`chat needs the Bun runtime and it couldn't be set up automatically (no network, an unsupported platform, or a failed download). Install Bun (https://bun.sh) and run chat under it, e.g. \`bun ${process.argv[1] ?? "skydive"} chat\`, or point SKYDIVE_BUN_PATH at an existing bun binary. For a non-interactive one-shot that runs under Node, use \`chat -p "<prompt>"\`.`);
+			process.exit(1);
+		}
+		let session = resolveSession({ appUrl });
+		if (session.isErr()) {
+			if (isNonInteractive()) {
+				printError("Not signed in for chat and no interactive terminal. Run `skydive auth login --web`, or set SKYDIVE_SESSION_TOKEN.");
+				process.exit(1);
+			}
+			const login = await loginWithDevice({ appUrl });
+			if (login.isErr()) {
+				printError(login.error.message);
+				process.exit(1);
+			}
+			session = resolveSession({ appUrl });
+			if (session.isErr()) {
+				printError("Signed in, but no session was stored.");
+				process.exit(1);
+			}
+		}
+		const themeId = argv.theme ?? process.env["SKYDIVE_THEME"] ?? void 0;
+		if (themeId !== void 0 && !themes.some((t) => t.id === themeId)) {
+			printError(`Unknown theme "${themeId}". Valid themes: ${themes.map((t) => t.id).join(", ")}`);
+			process.exit(1);
+		}
+		const { runChat } = await import("./boot-ChlVx-ts.mjs");
+		await runChat({
+			appUrl,
+			sessionToken: session.value.sessionToken,
+			shareMachine: argv["share-machine"],
+			promptHistoryPath: getPromptHistoryPath(),
+			theme: themeId,
+			notifications: argv.notify,
+			agentSelector: argv.agent ?? null
+		});
+	}
+};
+async function runPrintMode({ argv, appUrl }) {
+	const session = resolveSession({ appUrl });
+	if (session.isErr()) {
+		printError(`${session.error.message} For non-interactive use, run \`skydive auth login --web\` first, or set SKYDIVE_SESSION_TOKEN.`);
+		process.exit(1);
+	}
+	const { runPrint, readStdin } = await import("./print-BHbFMxQv.mjs").then((n) => n.t);
+	let prompt = (argv.print ?? "").trim();
+	if (!prompt) {
+		if (process.stdin.isTTY) {
+			printError("No prompt given. Pass it inline (`-p \"your prompt\"`) or pipe it on stdin.");
+			process.exit(1);
+		}
+		prompt = (await readStdin()).trim();
+		if (!prompt) {
+			printError("Empty prompt on stdin.");
+			process.exit(1);
+		}
+	}
+	try {
+		const result = await runPrint({
+			appUrl,
+			sessionToken: session.value.sessionToken,
+			prompt,
+			agentSelector: argv.agent ?? null,
+			conversationId: argv.conversation ?? null,
+			json: argv.json
+		});
+		if (argv.json) output(argv, result);
+	} catch (error) {
+		printError(error instanceof Error ? error.message : String(error));
+		process.exit(1);
+	}
+}
+
+//#endregion
+//#region src/commands/workspace.ts
+function requireSession(argv) {
+	const session = resolveSession({ appUrl: argv["api-url"] });
+	if (session.isErr()) {
+		printError("Not signed in for chat. Run `skydive auth login --web` first.");
+		process.exit(1);
+	}
+	return session.value;
+}
+/**
+* List the account's workspaces, marking the active one. Shared by the `list`
+* subcommand and the bare `workspace` invocation. When `hint` is true (the bare
+* invocation), a follow-up line points at `workspace switch` so a user who ran
+* `workspace` on its own learns how to change context. The hint is suppressed
+* under --json and --quiet so machine/scripted output stays clean.
+*/
+async function runList(argv, { hint }) {
+	const session = requireSession(argv);
+	const [workspaces, activeId] = await Promise.all([listWorkspaces(session), getActiveWorkspaceId(session)]);
+	if (workspaces.isErr()) {
+		printError(workspaces.error.message);
+		process.exit(1);
+	}
+	if (activeId.isErr()) {
+		printError(activeId.error.message);
+		process.exit(1);
+	}
+	if (argv.json) {
+		output(argv, workspaces.value.map((w) => ({
+			...w,
+			active: w.id === activeId.value
+		})));
+		return;
+	}
+	printTable([
+		"",
+		"Name",
+		"Slug"
+	], workspaces.value.map((w) => [
+		w.id === activeId.value ? "*" : "",
+		w.name,
+		w.slug
+	]));
+	if (hint && !argv.quiet) console.log("\nRun `skydive workspace switch <slug>` to switch which workspace `skydive chat` uses.");
+}
+const listCommand = {
+	command: "list",
+	describe: "List workspaces on your account",
+	handler: (argv) => runList(argv, { hint: false })
+};
+const switchCommand = {
+	command: "switch <workspace>",
+	describe: "Switch which workspace `skydive chat` uses",
+	builder: (y) => y.positional("workspace", {
+		type: "string",
+		demandOption: true,
+		describe: "Workspace slug, name, or ID"
+	}),
+	handler: async (argv) => {
+		const session = requireSession(argv);
+		const workspaces = await listWorkspaces(session);
+		if (workspaces.isErr()) {
+			printError(workspaces.error.message);
+			process.exit(1);
+		}
+		const needle = argv.workspace.toLowerCase();
+		const match = workspaces.value.find((w) => w.id === argv.workspace) ?? workspaces.value.find((w) => w.slug.toLowerCase() === needle) ?? workspaces.value.find((w) => w.name.toLowerCase() === needle);
+		if (!match) {
+			printError(`No workspace matches "${argv.workspace}". Run \`skydive workspace list\` to see available workspaces.`);
+			process.exit(1);
+		}
+		const result = await setActiveWorkspace({
+			...session,
+			organizationId: match.id
+		});
+		if (result.isErr()) {
+			printError(result.error.message);
+			process.exit(1);
+		}
+		if (argv.json) output(argv, {
+			switched: true,
+			workspace: match
+		});
+		else if (!argv.quiet) console.log(`Switched to workspace: ${match.name} (${match.slug})`);
+	}
+};
+const workspaceCommand = {
+	command: "workspace",
+	describe: "List or switch which workspace `skydive chat` uses",
+	builder: (y) => y.command(listCommand).command(switchCommand),
+	handler: (argv) => runList(argv, { hint: true })
+};
+
+//#endregion
+//#region src/cli.ts
+function createCli(argv) {
+	return yargs(argv).scriptName("skydive").usage("$0 <command> [options]").example("skydive auth login", "Store your API key").example("skydive chat", "Open the interactive chat TUI (prod)").example("skydive chat --api-url http://localhost:4500", "Chat against a local dev API").example("skydive agents list", "List your agents").example("skydive keys create \"my-key\"", "Create an API key").example("skydive secrets set OPENAI_API_KEY --agent-id <id>", "Set a secret (value from stdin)").example("skydive workspace list", "List workspaces on your account").example("skydive workspace switch acme-team", "Switch which workspace `skydive chat` uses").option("json", {
+		type: "boolean",
+		default: false,
+		global: true,
+		describe: "Output as JSON"
+	}).option("quiet", {
+		type: "boolean",
+		default: false,
+		global: true,
+		describe: "Print only primary value"
+	}).option("api-url", {
+		type: "string",
+		global: true,
+		describe: "Override API base URL"
+	}).command(authCommand).command(chatCommand).command(agentsCommand).command(keysCommand).command(secretsCommand).command(workspaceCommand).demandCommand(1, "Specify a command. Run --help for usage.").strict().wrap(null).version(version$1).alias("v", "version").alias("h", "help").help().fail((msg, err) => {
+		printError(err ? err instanceof Error ? err.message : String(err) : msg ?? "Unknown error");
+		process.exit(1);
+	});
+}
+
+//#endregion
+//#region src/default-command.ts
+const TOP_LEVEL_FLAGS = new Set([
+	"-h",
+	"--help",
+	"-v",
+	"--version"
+]);
+const VALUE_FLAGS = new Set([
+	"--print",
+	"-p",
+	"--agent",
+	"--conversation",
+	"--theme",
+	"--api-url"
+]);
+/**
+* True when `args` contains a bare positional (a subcommand token or a stray
+* argument) — i.e. a non-dash token that is NOT the value of a preceding
+* value-taking flag. `skydive --agent grace` has no positional (`grace` is the
+* value of `--agent`); `skydive agents` does.
+*/
+function hasPositional(args) {
+	let expectValue = false;
+	for (const a of args) {
+		if (expectValue) {
+			expectValue = false;
+			continue;
+		}
+		if (a.startsWith("-")) {
+			if (!a.includes("=") && VALUE_FLAGS.has(a)) expectValue = true;
+			continue;
+		}
+		return true;
+	}
+	return false;
+}
+/**
+* Decide whether a bare `skydive` invocation (no subcommand) should default to
+* the interactive chat TUI. True only when it's safe to take over the terminal:
+* no command/positional present, not a top-level help/version request, not a
+* known non-interactive env (CI, coding agents), and both stdin and stdout are
+* real TTYs. Everything else falls through to yargs so scripted/piped use gets
+* the normal "specify a command" behavior instead of hanging on a prompt.
+*/
+function shouldDefaultToChat(args, tty, nonInteractive = isNonInteractive()) {
+	if (hasPositional(args)) return false;
+	if (args.some((a) => TOP_LEVEL_FLAGS.has(a))) return false;
+	if (nonInteractive) return false;
+	return tty.stdinIsTTY && tty.stdoutIsTTY;
+}
+/**
+* Given the raw args (post-`hideBin`), return the args yargs should parse,
+* prepending `chat` when a bare interactive invocation should open the TUI.
+*/
+function resolveArgv(args, tty = {
+	stdinIsTTY: Boolean(process.stdin.isTTY),
+	stdoutIsTTY: Boolean(process.stdout.isTTY)
+}) {
+	return shouldDefaultToChat(args, tty) ? ["chat", ...args] : args;
+}
+
+//#endregion
+//#region src/bin.ts
+createCli(resolveArgv(hideBin(process.argv))).parse();
+
+//#endregion
+export { noColorRequested as a, themeMode as c, themesForMode as d, DEFAULT_API_URL as f, saveTheme as g, resolveWebUrl as h, monoTheme as i, themeModeFromColorFgBg as l, getSavedTheme as m, applyTheme as n, theme as o, DEFAULT_APP_URL as p, findTheme as r, themeForMode as s, DEFAULT_THEME_ID as t, themeVersion as u };