skydive-cli 0.2.0-beta.613 → 0.2.0-beta.615

package/dist/js/{api-BGWcPuik.mjs → api-CLTp-mKM.mjs}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { t as HttpError } from "./rest-DMpigwmN.mjs";
+import { t as HttpError } from "./rest-Q5yl_b2-.mjs";
 import os from "node:os";
 import { z } from "zod";
 

package/dist/js/bin.mjs

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
-import { A as deleteConfig, B as resolveAppUrl, C as setActiveWorkspace, D as DEFAULT_API_URL, E as API_KEY_PREFIX, G as saveConfig, H as resolveManagementAuth, I as getShareMachineDefault, J as setLastSeenVersion, K as saveSession, L as getStoredApiKeyId, M as getLastSeenVersion, N as getPromptHistoryPath, R as getStoredApiKeyWorkspaceName, S as listWorkspaces, T as API_KEY_FAMILY_PREFIX, U as resolveSession, V as resolveConfig, X as version, Y as name, _ as themes, b as getActiveWorkspaceId, j as getConfigPath, k as DEFAULT_WEB_URL, o as brandHelpArt, t as installCrashHandler, w as API_KEYS_URL, x as getSessionIdentity, y as ensureActiveOrganization, z as getUpdateCheckDisabled } from "./install-D1uhYunw.mjs";
-import { n as printError, r as printTable, t as output } from "./output-B4cW10Ph.mjs";
-import { n as createRestClient } from "./rest-DMpigwmN.mjs";
-import { i as resolveAgent } from "./print-6Bm51XhR.mjs";
-import { a as registerPortalDevice, c as machineIdentity, n as findThisDevice, o as revokePortalAccess, r as grantPortalAccess, t as fetchPortalDevices } from "./api-BGWcPuik.mjs";
+import { C as setActiveWorkspace, S as listWorkspaces, T as version, _ as themes, b as getActiveWorkspaceId, o as brandHelpArt, t as installCrashHandler, w as name, x as getSessionIdentity, y as ensureActiveOrganization } from "./install-B5sKLfRc.mjs";
+import { A as getUpdateCheckDisabled, C as getLastSeenVersion, D as getShareMachineDefault, I as saveConfig, L as saveSession, M as resolveConfig, N as resolveManagementAuth, O as getStoredApiKeyId, P as resolveSession, S as getConfigPath, _ as API_KEY_PREFIX, b as DEFAULT_WEB_URL, g as API_KEY_FAMILY_PREFIX, h as API_KEYS_URL, i as resolveAgent, j as resolveAppUrl, k as getStoredApiKeyWorkspaceName, v as DEFAULT_API_URL, w as getPromptHistoryPath, x as deleteConfig, z as setLastSeenVersion } from "./print-CNIvmpqW.mjs";
+import { n as printError, r as printTable, t as output } from "./output-DYzzdXYV.mjs";
+import { n as createRestClient } from "./rest-Q5yl_b2-.mjs";
+import { a as registerPortalDevice, c as machineIdentity, n as findThisDevice, o as revokePortalAccess, r as grantPortalAccess, t as fetchPortalDevices } from "./api-CLTp-mKM.mjs";
 import { t as SandboxStream } from "./client-BVOAwU8M.mjs";
 import { hideBin } from "yargs/helpers";
 import yargs from "yargs";
@@ -1195,7 +1195,7 @@ const importCommand = {
 				process.exit(1);
 			}
 		}
-		const { runChat } = await import("./boot-BnaFkGl4.mjs");
+		const { runChat } = await import("./boot-BJZrdTk0.mjs");
 		await runChat({
 			appUrl,
 			sessionToken: session.value.sessionToken,
@@ -1222,7 +1222,7 @@ async function runImportPrintMode({ argv, appUrl }) {
 		printError(`${session.error.message} For non-interactive use, run \`skydive auth login --web\` first, or set SKYDIVE_SESSION_TOKEN.`);
 		process.exit(1);
 	}
-	const { connectMachineShare } = await import("./print-share-DE_dkZX7.mjs");
+	const { connectMachineShare } = await import("./print-share-rM8kNeEw.mjs");
 	const machineShare = await connectMachineShare({
 		appUrl,
 		sessionToken: session.value.sessionToken,
@@ -1230,7 +1230,7 @@ async function runImportPrintMode({ argv, appUrl }) {
 	});
 	const extra = (argv.print ?? "").trim();
 	const prompt = buildImportSeedPrompt(process.cwd()) + (extra ? `\n\nAdditional instructions: ${extra}` : "");
-	const { runPrint } = await import("./print-qXJymvuF.mjs");
+	const { runPrint } = await import("./print-nefugWMx.mjs");
 	try {
 		const result = await runPrint({
 			appUrl,
@@ -1511,7 +1511,7 @@ const chatCommand = {
 			printError(`Unknown theme "${themeId}". Valid themes: ${themes.map((t) => t.id).join(", ")}`);
 			process.exit(1);
 		}
-		const { runChat } = await import("./boot-BnaFkGl4.mjs");
+		const { runChat } = await import("./boot-BJZrdTk0.mjs");
 		await runChat({
 			appUrl,
 			sessionToken: session.value.sessionToken,
@@ -1548,7 +1548,7 @@ async function runPrintMode({ argv, appUrl }) {
 		printError(`${session.error.message} For non-interactive use, run \`skydive auth login\` first, or set SKYDIVE_SESSION_TOKEN.`);
 		process.exit(1);
 	}
-	const { runPrint, readStdin } = await import("./print-qXJymvuF.mjs");
+	const { runPrint, readStdin } = await import("./print-nefugWMx.mjs");
 	let prompt = (argv.print ?? "").trim();
 	if (!prompt) {
 		if (process.stdin.isTTY) {
@@ -1563,7 +1563,7 @@ async function runPrintMode({ argv, appUrl }) {
 	}
 	let machineShare = null;
 	if (resolveShareMachine(argv)) {
-		const { connectMachineShare } = await import("./print-share-DE_dkZX7.mjs");
+		const { connectMachineShare } = await import("./print-share-rM8kNeEw.mjs");
 		machineShare = await connectMachineShare({
 			appUrl,
 			sessionToken: session.value.sessionToken,
@@ -1622,7 +1622,7 @@ const getCommand = {
 			printError(`${session.error.message} Run \`skydive auth login\` first, or set SKYDIVE_SESSION_TOKEN.`);
 			process.exit(1);
 		}
-		const { messageGet } = await import("./print-qXJymvuF.mjs");
+		const { messageGet } = await import("./print-nefugWMx.mjs");
 		try {
 			const result = await messageGet({
 				appUrl,
@@ -1819,7 +1819,7 @@ const switchCommand = {
 				printError("The workspace picker needs the Bun runtime and it could not be set up automatically. Pass a workspace slug instead, or install Bun and retry.");
 				process.exit(1);
 			}
-			const { runWorkspacePicker } = await import("./boot-BnaFkGl4.mjs");
+			const { runWorkspacePicker } = await import("./boot-BJZrdTk0.mjs");
 			await runWorkspacePicker(session);
 			return;
 		}
@@ -1897,7 +1897,7 @@ const openCommand = {
 		const agent = argv.agent ? resolveAgent((await fetchPortalDevices(session)).agents, argv.agent) : null;
 		const cwd = argv.cwd ? path.resolve(argv.cwd) : process.cwd();
 		const { machineName } = machineIdentity();
-		const { PortalClient } = await import("./client-BRfmlbgI.mjs");
+		const { PortalClient } = await import("./client-D6UUwESi.mjs");
 		let lastLine = "";
 		let signalConnected;
 		const connected = new Promise((resolve) => {
@@ -2069,8 +2069,8 @@ const sandboxCommand = {
 	}).example("skydive sandbox --agent grace", "Live terminal (Ctrl-] detaches)").example("skydive sandbox --agent grace -- tail -n 50 /tmp/harness.log", "One-shot command (use `--` so its flags reach the sandbox)").example("skydive sandbox --agent grace -- sh -c 'ls /tmp | wc -l'", "Shell features go through an explicit `sh -c`"),
 	handler: async (argv) => {
 		const session = requireSession(argv);
-		const { createRestClient } = await import("./rest-C3RySrPa.mjs");
-		const { resolveAgent } = await import("./print-qXJymvuF.mjs");
+		const { createRestClient } = await import("./rest-CBROy0L-.mjs");
+		const { resolveAgent } = await import("./print-nefugWMx.mjs");
 		const client = createRestClient({
 			appUrl: session.appUrl,
 			sessionToken: session.sessionToken

package/dist/js/{boot-BnaFkGl4.mjs → boot-BJZrdTk0.mjs}

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
-import { C as setActiveWorkspace, D as DEFAULT_API_URL, F as getSavedTheme, O as DEFAULT_APP_URL, P as getReviewStateDir, S as listWorkspaces, W as resolveWebUrl, a as WORDMARK, b as getActiveWorkspaceId, c as applyTheme, d as noColorRequested, f as theme, g as themeVersion, h as themeModeFromColorFgBg, i as MARK_CELLS, j as getConfigPath, l as findTheme, m as themeMode, n as buildCrashReport, p as themeForMode, q as saveTheme, r as writeCrashReport, s as DEFAULT_THEME_ID, t as installCrashHandler, u as monoTheme, v as themesForMode } from "./install-D1uhYunw.mjs";
-import { a as errorMessage, i as sendErrorMessage, n as createRestClient, o as isRecord, r as errorDetail, t as HttpError } from "./rest-DMpigwmN.mjs";
-import { c as cardActionErrorMessage, d as reconcileMaskedInput, f as resolveConnectUrl, i as resolveAgent, l as parseExternalOauthConnectParams, m as specKeyFor, p as parseConnectCard, s as MASK_CHAR, u as parseOauthConnectParams } from "./print-6Bm51XhR.mjs";
-import "./api-BGWcPuik.mjs";
+import { C as setActiveWorkspace, S as listWorkspaces, a as WORDMARK, b as getActiveWorkspaceId, c as applyTheme, d as noColorRequested, f as theme, g as themeVersion, h as themeModeFromColorFgBg, i as MARK_CELLS, l as findTheme, m as themeMode, n as buildCrashReport, p as themeForMode, r as writeCrashReport, s as DEFAULT_THEME_ID, t as installCrashHandler, u as monoTheme, v as themesForMode } from "./install-B5sKLfRc.mjs";
+import { E as getSavedTheme, F as resolveWebUrl, R as saveTheme, S as getConfigPath, T as getReviewStateDir, c as cardActionErrorMessage, d as reconcileMaskedInput, f as resolveConnectUrl, i as resolveAgent, l as parseExternalOauthConnectParams, m as specKeyFor, p as parseConnectCard, s as MASK_CHAR, u as parseOauthConnectParams, v as DEFAULT_API_URL, y as DEFAULT_APP_URL } from "./print-CNIvmpqW.mjs";
+import { a as errorMessage, i as sendErrorMessage, n as createRestClient, o as isRecord, r as errorDetail, t as HttpError } from "./rest-Q5yl_b2-.mjs";
+import "./api-CLTp-mKM.mjs";
 import { t as SandboxStream } from "./client-BVOAwU8M.mjs";
-import { t as PortalClient } from "./client-l3OrGKaC.mjs";
+import { t as PortalClient } from "./client-BigvBsPk.mjs";
 import { t as runRawPtyPassthrough } from "./raw-pty-Dbi2kb9v.mjs";
 import * as os$1 from "node:os";
 import { homedir, platform, release, tmpdir } from "node:os";
@@ -9623,7 +9623,7 @@ function ChatScreen({ agent, conversation }) {
 					detail: "already connected"
 				});
 			} else if (action.kind === "open_github_app") {
-				const url = resolveConnectUrl(action.url, appUrl);
+				const url = resolveConnectUrl(action.url, resolveWebUrl(appUrl));
 				await openUrlInBrowser(url);
 				updateCard(item.id, {
 					status: "launched",

package/dist/js/{client-l3OrGKaC.mjs → client-BigvBsPk.mjs}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { a as errorMessage } from "./rest-DMpigwmN.mjs";
-import { c as machineIdentity, i as mintPortalDeviceToken, l as portalWsUrl, n as findThisDevice, r as grantPortalAccess, s as buildEnv, t as fetchPortalDevices } from "./api-BGWcPuik.mjs";
+import { a as errorMessage } from "./rest-Q5yl_b2-.mjs";
+import { c as machineIdentity, i as mintPortalDeviceToken, l as portalWsUrl, n as findThisDevice, r as grantPortalAccess, s as buildEnv, t as fetchPortalDevices } from "./api-CLTp-mKM.mjs";
 import { z } from "zod";
 import { spawn } from "node:child_process";
 import { WebSocket } from "ws";

package/dist/js/client-D6UUwESi.mjs

@@ -0,0 +1,6 @@
+#!/usr/bin/env node
+import "./rest-Q5yl_b2-.mjs";
+import "./api-CLTp-mKM.mjs";
+import { t as PortalClient } from "./client-BigvBsPk.mjs";
+
+export { PortalClient };

package/dist/js/{install-D1uhYunw.mjs → install-B5sKLfRc.mjs}

@@ -1,200 +1,14 @@
 #!/usr/bin/env node
+import { S as getConfigPath } from "./print-CNIvmpqW.mjs";
 import os from "node:os";
 import path from "node:path";
-import Conf from "conf";
 import { err, ok } from "neverthrow";
 import { z } from "zod";
 import fs from "node:fs";
 
 //#region package.json
 var name = "skydive-cli";
-var version$1 = "0.2.0-beta.613";
-
-//#endregion
-//#region src/config.ts
-/** Default host for the public management API (`/v1`, API-key auth). */
-const DEFAULT_API_URL = "https://api.skydive.com";
-/**
-* Default origin for the interactive chat client (`skydive chat`).
-*
-* The API host that serves better-auth (`/api/auth/*`) and the internal tRPC
-* API (`/api/v1/trpc`) that chat streams over. We target the API host
-* directly (not the web front door) because chat opens a WebSocket and
-* authenticates with a bearer token on the upgrade request. Same host as
-* `DEFAULT_API_URL`; override with `--api-url` / `SKYDIVE_APP_URL` for local
-* dev or while the DNS record is still being provisioned.
-*/
-const DEFAULT_APP_URL = "https://api.skydive.com";
-/** Web front door, for pages opened in the user's browser. */
-const DEFAULT_WEB_URL = "https://skydive.com";
-/**
-* Origin for browser-facing links (e.g. opening a conversation's web page).
-* The app origin is the API host, which serves no web UI in production, so
-* map the default to the web front door. Overridden origins (local dev,
-* previews) serve both and pass through unchanged.
-*/
-function resolveWebUrl(appUrl) {
-	return appUrl === DEFAULT_APP_URL ? DEFAULT_WEB_URL : appUrl;
-}
-/** Prefix on workspace-scoped Skydive API keys. Kept in sync with the API's
-* `API_KEY_PREFIX` (`apps/anyone/api/src/lib/api-key.ts`); the CLI is a
-* standalone published package so it can't import the backend constant. */
-const API_KEY_PREFIX = "sky_live_";
-/**
-* Common prefix across all Skydive API key kinds — `sky_live_…` workspace
-* keys today, `sky_user_…` account keys when ANY-5105 lands. The CLI only
-* sanity-checks the family on `--api-key`; the server authoritatively rejects
-* a kind that can't drive a given route, with a clearer message than the
-* client could produce.
-*/
-const API_KEY_FAMILY_PREFIX = "sky_";
-/** Where users mint and copy API keys. Shown in the login prompt. */
-const API_KEYS_URL = "skydive.com/settings/account";
-const store = new Conf({
-	projectName: process.env["SKYDIVE_CONFIG_NAME"] ?? "skydive",
-	projectSuffix: "",
-	configFileMode: 384
-});
-function resolveConfig(opts) {
-	const apiKey = process.env["SKYDIVE_API_KEY"] ?? store.get("apiKey");
-	const apiUrl = process.env["SKYDIVE_API_URL"] ?? opts.apiUrl ?? store.get("apiUrl") ?? DEFAULT_API_URL;
-	if (!apiKey) return err({ message: "Not authenticated. Run `skydive auth login` first." });
-	return ok({
-		apiKey,
-		apiUrl
-	});
-}
-/**
-* Resolve the bearer credential for the management API (`agents` / `keys` /
-* `secrets`). The server's `/v1` gate accepts either an API key or the
-* device-flow session bearer, so both work — but only one of them tracks the
-* active workspace.
-*
-* An API key is pinned server-side to the organization that minted it and
-* ignores the workspace header by design, so it can never follow `skydive
-* workspace switch`. A key is also a strictly narrower credential than its
-* owner's session. So the session wins whenever there is one, and a key is
-* what's left for machines that never ran an interactive login.
-*
-* `SKYDIVE_SESSION_TOKEN=` (empty) suppresses session auth for one
-* invocation, to drive a specific organization's key while signed in.
-*/
-function resolveManagementAuth(opts) {
-	const session = resolveSession({ appUrl: opts.apiUrl });
-	if (session.isOk()) return ok({
-		token: session.value.sessionToken,
-		apiUrl: session.value.appUrl,
-		kind: "session",
-		pinnedWorkspaceName: null
-	});
-	const envKey = process.env["SKYDIVE_API_KEY"];
-	const storedKey = store.get("apiKey");
-	const apiKey = envKey ?? storedKey;
-	if (apiKey) return ok({
-		token: apiKey,
-		apiUrl: process.env["SKYDIVE_API_URL"] ?? opts.apiUrl ?? store.get("apiUrl") ?? DEFAULT_API_URL,
-		kind: "api-key",
-		pinnedWorkspaceName: !envKey && storedKey ? store.get("apiKeyWorkspaceName") ?? null : null
-	});
-	return err({ message: "Not authenticated. Run `skydive auth login`." });
-}
-function saveConfig(config) {
-	store.set("apiKey", config.apiKey);
-	store.set("apiUrl", config.apiUrl);
-	if (config.apiKeyId) store.set("apiKeyId", config.apiKeyId);
-	else store.delete("apiKeyId");
-	if (config.workspaceName) store.set("apiKeyWorkspaceName", config.workspaceName);
-	else store.delete("apiKeyWorkspaceName");
-}
-/** Server-side id of the auto-minted key, if login minted one. */
-function getStoredApiKeyId() {
-	return store.get("apiKeyId") ?? null;
-}
-/** Workspace the auto-minted key is pinned to, if login recorded one. */
-function getStoredApiKeyWorkspaceName() {
-	return store.get("apiKeyWorkspaceName") ?? null;
-}
-function deleteConfig() {
-	store.clear();
-}
-function getConfigPath() {
-	return store.path;
-}
-/**
-* Where the chat TUI persists its prompt history (up-arrow recall). Kept
-* beside the config file so all CLI state lives in one directory.
-*/
-function getLastSeenVersion() {
-	return store.get("lastSeenVersion");
-}
-function setLastSeenVersion(version) {
-	store.set("lastSeenVersion", version);
-}
-function getPromptHistoryPath() {
-	return path.join(path.dirname(store.path), "prompt-history.jsonl");
-}
-/**
-* Where the chat TUI persists pending review comments — one JSON file per
-* conversation, so a pending comment survives conversation switches and
-* process death. Kept beside the config file like prompt history.
-*/
-function getReviewStateDir() {
-	return path.join(path.dirname(store.path), "review");
-}
-/**
-* Resolve the chat/auth origin. Precedence: `SKYDIVE_APP_URL` env > explicit
-* `--api-url` style override > stored value > `SKYDIVE_API_URL` env >
-* `DEFAULT_APP_URL`.
-*
-* The `SKYDIVE_API_URL` fallback matters for previews: the device/`--web`
-* flow and chat hit the same api service as the management API, so pointing
-* `SKYDIVE_API_URL` at a preview stack is enough — you don't also have to set
-* `SKYDIVE_APP_URL`. Otherwise auth would silently fall through to prod
-* (`DEFAULT_APP_URL`) and hand back a prod verification URL.
-*/
-function resolveAppUrl(opts) {
-	return process.env["SKYDIVE_APP_URL"] ?? opts.appUrl ?? store.get("appUrl") ?? process.env["SKYDIVE_API_URL"] ?? DEFAULT_APP_URL;
-}
-function resolveSession(opts) {
-	const sessionToken = process.env["SKYDIVE_SESSION_TOKEN"] ?? store.get("sessionToken");
-	const appUrl = resolveAppUrl(opts);
-	if (!sessionToken) return err({ message: "Not signed in for chat. Run `skydive chat` to sign in." });
-	return ok({
-		sessionToken,
-		appUrl
-	});
-}
-function saveSession(session) {
-	store.set("sessionToken", session.sessionToken);
-	store.set("sessionObtainedAt", (/* @__PURE__ */ new Date()).toISOString());
-	store.set("appUrl", session.appUrl);
-}
-function getSavedTheme(mode) {
-	return store.get(mode === "dark" ? "themeDark" : "themeLight");
-}
-function saveTheme(mode, themeId) {
-	store.set(mode === "dark" ? "themeDark" : "themeLight", themeId);
-}
-/**
-* Whether `skydive chat` should enable portal machine sharing on launch
-* without `--share-machine`. Set by hand-editing `shareMachineDefault` in
-* config.json — deliberately no CLI command (kept off the API surface).
-* Sharing only makes the machine reachable — agents still need a
-* (persistent) grant to run anything, so this default skips the per-session
-* enable step, not the consent step.
-*/
-function getShareMachineDefault() {
-	return store.get("shareMachineDefault") ?? false;
-}
-/**
-* Whether the update check is disabled via config.json (`"updateCheck":
-* false`). The persistent counterpart to the SKYDIVE_NO_UPDATE_CHECK /
-* NO_UPDATE_NOTIFIER env opt-outs; like shareMachineDefault, set by editing
-* config.json — deliberately no CLI command.
-*/
-function getUpdateCheckDisabled() {
-	return store.get("updateCheck") === false;
-}
+var version$1 = "0.2.0-beta.615";
 
 //#endregion
 //#region src/auth/organization.ts
@@ -1243,4 +1057,4 @@ function printFatalNotice(file, memory) {
 }
 
 //#endregion
-export { deleteConfig as A, resolveAppUrl as B, setActiveWorkspace as C, DEFAULT_API_URL as D, API_KEY_PREFIX as E, getSavedTheme as F, saveConfig as G, resolveManagementAuth as H, getShareMachineDefault as I, setLastSeenVersion as J, saveSession as K, getStoredApiKeyId as L, getLastSeenVersion as M, getPromptHistoryPath as N, DEFAULT_APP_URL as O, getReviewStateDir as P, getStoredApiKeyWorkspaceName as R, listWorkspaces as S, API_KEY_FAMILY_PREFIX as T, resolveSession as U, resolveConfig as V, resolveWebUrl as W, version$1 as X, name as Y, themes as _, WORDMARK as a, getActiveWorkspaceId as b, applyTheme as c, noColorRequested as d, theme as f, themeVersion as g, themeModeFromColorFgBg as h, MARK_CELLS as i, getConfigPath as j, DEFAULT_WEB_URL as k, findTheme as l, themeMode as m, buildCrashReport as n, brandHelpArt as o, themeForMode as p, saveTheme as q, writeCrashReport as r, DEFAULT_THEME_ID as s, installCrashHandler as t, monoTheme as u, themesForMode as v, API_KEYS_URL as w, getSessionIdentity as x, ensureActiveOrganization as y, getUpdateCheckDisabled as z };
+export { setActiveWorkspace as C, listWorkspaces as S, version$1 as T, themes as _, WORDMARK as a, getActiveWorkspaceId as b, applyTheme as c, noColorRequested as d, theme as f, themeVersion as g, themeModeFromColorFgBg as h, MARK_CELLS as i, findTheme as l, themeMode as m, buildCrashReport as n, brandHelpArt as o, themeForMode as p, writeCrashReport as r, DEFAULT_THEME_ID as s, installCrashHandler as t, monoTheme as u, themesForMode as v, name as w, getSessionIdentity as x, ensureActiveOrganization as y };

package/dist/js/{print-6Bm51XhR.mjs → print-CNIvmpqW.mjs}

@@ -1,7 +1,191 @@
 #!/usr/bin/env node
-import { a as errorMessage, i as sendErrorMessage, n as createRestClient, o as isRecord, t as HttpError } from "./rest-DMpigwmN.mjs";
+import { a as errorMessage, i as sendErrorMessage, n as createRestClient, o as isRecord, t as HttpError } from "./rest-Q5yl_b2-.mjs";
+import path from "node:path";
+import Conf from "conf";
+import { err, ok } from "neverthrow";
 import stableStringify from "safe-stable-stringify";
 
+//#region src/config.ts
+/** Default host for the public management API (`/v1`, API-key auth). */
+const DEFAULT_API_URL = "https://api.skydive.com";
+/**
+* Default origin for the interactive chat client (`skydive chat`).
+*
+* The API host that serves better-auth (`/api/auth/*`) and the internal tRPC
+* API (`/api/v1/trpc`) that chat streams over. We target the API host
+* directly (not the web front door) because chat opens a WebSocket and
+* authenticates with a bearer token on the upgrade request. Same host as
+* `DEFAULT_API_URL`; override with `--api-url` / `SKYDIVE_APP_URL` for local
+* dev or while the DNS record is still being provisioned.
+*/
+const DEFAULT_APP_URL = "https://api.skydive.com";
+/** Web front door, for pages opened in the user's browser. */
+const DEFAULT_WEB_URL = "https://skydive.com";
+function resolveWebUrl(appUrl) {
+	if (appUrl == null) return appUrl;
+	return appUrl === DEFAULT_APP_URL ? DEFAULT_WEB_URL : appUrl;
+}
+/** Prefix on workspace-scoped Skydive API keys. Kept in sync with the API's
+* `API_KEY_PREFIX` (`apps/anyone/api/src/lib/api-key.ts`); the CLI is a
+* standalone published package so it can't import the backend constant. */
+const API_KEY_PREFIX = "sky_live_";
+/**
+* Common prefix across all Skydive API key kinds — `sky_live_…` workspace
+* keys today, `sky_user_…` account keys when ANY-5105 lands. The CLI only
+* sanity-checks the family on `--api-key`; the server authoritatively rejects
+* a kind that can't drive a given route, with a clearer message than the
+* client could produce.
+*/
+const API_KEY_FAMILY_PREFIX = "sky_";
+/** Where users mint and copy API keys. Shown in the login prompt. */
+const API_KEYS_URL = "skydive.com/settings/account";
+const store = new Conf({
+	projectName: process.env["SKYDIVE_CONFIG_NAME"] ?? "skydive",
+	projectSuffix: "",
+	configFileMode: 384
+});
+function resolveConfig(opts) {
+	const apiKey = process.env["SKYDIVE_API_KEY"] ?? store.get("apiKey");
+	const apiUrl = process.env["SKYDIVE_API_URL"] ?? opts.apiUrl ?? store.get("apiUrl") ?? DEFAULT_API_URL;
+	if (!apiKey) return err({ message: "Not authenticated. Run `skydive auth login` first." });
+	return ok({
+		apiKey,
+		apiUrl
+	});
+}
+/**
+* Resolve the bearer credential for the management API (`agents` / `keys` /
+* `secrets`). The server's `/v1` gate accepts either an API key or the
+* device-flow session bearer, so both work — but only one of them tracks the
+* active workspace.
+*
+* An API key is pinned server-side to the organization that minted it and
+* ignores the workspace header by design, so it can never follow `skydive
+* workspace switch`. A key is also a strictly narrower credential than its
+* owner's session. So the session wins whenever there is one, and a key is
+* what's left for machines that never ran an interactive login.
+*
+* `SKYDIVE_SESSION_TOKEN=` (empty) suppresses session auth for one
+* invocation, to drive a specific organization's key while signed in.
+*/
+function resolveManagementAuth(opts) {
+	const session = resolveSession({ appUrl: opts.apiUrl });
+	if (session.isOk()) return ok({
+		token: session.value.sessionToken,
+		apiUrl: session.value.appUrl,
+		kind: "session",
+		pinnedWorkspaceName: null
+	});
+	const envKey = process.env["SKYDIVE_API_KEY"];
+	const storedKey = store.get("apiKey");
+	const apiKey = envKey ?? storedKey;
+	if (apiKey) return ok({
+		token: apiKey,
+		apiUrl: process.env["SKYDIVE_API_URL"] ?? opts.apiUrl ?? store.get("apiUrl") ?? DEFAULT_API_URL,
+		kind: "api-key",
+		pinnedWorkspaceName: !envKey && storedKey ? store.get("apiKeyWorkspaceName") ?? null : null
+	});
+	return err({ message: "Not authenticated. Run `skydive auth login`." });
+}
+function saveConfig(config) {
+	store.set("apiKey", config.apiKey);
+	store.set("apiUrl", config.apiUrl);
+	if (config.apiKeyId) store.set("apiKeyId", config.apiKeyId);
+	else store.delete("apiKeyId");
+	if (config.workspaceName) store.set("apiKeyWorkspaceName", config.workspaceName);
+	else store.delete("apiKeyWorkspaceName");
+}
+/** Server-side id of the auto-minted key, if login minted one. */
+function getStoredApiKeyId() {
+	return store.get("apiKeyId") ?? null;
+}
+/** Workspace the auto-minted key is pinned to, if login recorded one. */
+function getStoredApiKeyWorkspaceName() {
+	return store.get("apiKeyWorkspaceName") ?? null;
+}
+function deleteConfig() {
+	store.clear();
+}
+function getConfigPath() {
+	return store.path;
+}
+/**
+* Where the chat TUI persists its prompt history (up-arrow recall). Kept
+* beside the config file so all CLI state lives in one directory.
+*/
+function getLastSeenVersion() {
+	return store.get("lastSeenVersion");
+}
+function setLastSeenVersion(version) {
+	store.set("lastSeenVersion", version);
+}
+function getPromptHistoryPath() {
+	return path.join(path.dirname(store.path), "prompt-history.jsonl");
+}
+/**
+* Where the chat TUI persists pending review comments — one JSON file per
+* conversation, so a pending comment survives conversation switches and
+* process death. Kept beside the config file like prompt history.
+*/
+function getReviewStateDir() {
+	return path.join(path.dirname(store.path), "review");
+}
+/**
+* Resolve the chat/auth origin. Precedence: `SKYDIVE_APP_URL` env > explicit
+* `--api-url` style override > stored value > `SKYDIVE_API_URL` env >
+* `DEFAULT_APP_URL`.
+*
+* The `SKYDIVE_API_URL` fallback matters for previews: the device/`--web`
+* flow and chat hit the same api service as the management API, so pointing
+* `SKYDIVE_API_URL` at a preview stack is enough — you don't also have to set
+* `SKYDIVE_APP_URL`. Otherwise auth would silently fall through to prod
+* (`DEFAULT_APP_URL`) and hand back a prod verification URL.
+*/
+function resolveAppUrl(opts) {
+	return process.env["SKYDIVE_APP_URL"] ?? opts.appUrl ?? store.get("appUrl") ?? process.env["SKYDIVE_API_URL"] ?? DEFAULT_APP_URL;
+}
+function resolveSession(opts) {
+	const sessionToken = process.env["SKYDIVE_SESSION_TOKEN"] ?? store.get("sessionToken");
+	const appUrl = resolveAppUrl(opts);
+	if (!sessionToken) return err({ message: "Not signed in for chat. Run `skydive chat` to sign in." });
+	return ok({
+		sessionToken,
+		appUrl
+	});
+}
+function saveSession(session) {
+	store.set("sessionToken", session.sessionToken);
+	store.set("sessionObtainedAt", (/* @__PURE__ */ new Date()).toISOString());
+	store.set("appUrl", session.appUrl);
+}
+function getSavedTheme(mode) {
+	return store.get(mode === "dark" ? "themeDark" : "themeLight");
+}
+function saveTheme(mode, themeId) {
+	store.set(mode === "dark" ? "themeDark" : "themeLight", themeId);
+}
+/**
+* Whether `skydive chat` should enable portal machine sharing on launch
+* without `--share-machine`. Set by hand-editing `shareMachineDefault` in
+* config.json — deliberately no CLI command (kept off the API surface).
+* Sharing only makes the machine reachable — agents still need a
+* (persistent) grant to run anything, so this default skips the per-session
+* enable step, not the consent step.
+*/
+function getShareMachineDefault() {
+	return store.get("shareMachineDefault") ?? false;
+}
+/**
+* Whether the update check is disabled via config.json (`"updateCheck":
+* false`). The persistent counterpart to the SKYDIVE_NO_UPDATE_CHECK /
+* NO_UPDATE_NOTIFIER env opt-outs; like shareMachineDefault, set by editing
+* config.json — deliberately no CLI command.
+*/
+function getUpdateCheckDisabled() {
+	return store.get("updateCheck") === false;
+}
+
+//#endregion
 //#region src/chat/tui/chat/card.ts
 const urlActionKinds = [
 	"open_oauth",
@@ -227,14 +411,20 @@ function summarizeConnectCard(card, appUrl) {
 	const act = button.action;
 	switch (act.kind) {
 		case "open_oauth":
-		case "open_external_oauth":
-		case "open_github_app": return {
+		case "open_external_oauth": return {
 			...base,
 			action: {
 				kind: "open_url",
 				url: resolveConnectUrl(act.url, appUrl)
 			}
 		};
+		case "open_github_app": return {
+			...base,
+			action: {
+				kind: "open_url",
+				url: resolveConnectUrl(act.url, resolveWebUrl(appUrl))
+			}
+		};
 		case "submit_credential": return {
 			...base,
 			action: {
@@ -487,4 +677,4 @@ async function readStdin() {
 }
 
 //#endregion
-export { runPrint as a, cardActionErrorMessage as c, reconcileMaskedInput as d, resolveConnectUrl as f, resolveAgent as i, parseExternalOauthConnectParams as l, specKeyFor as m, messageGet as n, toPrintError as o, parseConnectCard as p, readStdin as r, MASK_CHAR as s, collectRunText as t, parseOauthConnectParams as u };
+export { getUpdateCheckDisabled as A, getLastSeenVersion as C, getShareMachineDefault as D, getSavedTheme as E, resolveWebUrl as F, saveConfig as I, saveSession as L, resolveConfig as M, resolveManagementAuth as N, getStoredApiKeyId as O, resolveSession as P, saveTheme as R, getConfigPath as S, getReviewStateDir as T, API_KEY_PREFIX as _, runPrint as a, DEFAULT_WEB_URL as b, cardActionErrorMessage as c, reconcileMaskedInput as d, resolveConnectUrl as f, API_KEY_FAMILY_PREFIX as g, API_KEYS_URL as h, resolveAgent as i, resolveAppUrl as j, getStoredApiKeyWorkspaceName as k, parseExternalOauthConnectParams as l, specKeyFor as m, messageGet as n, toPrintError as o, parseConnectCard as p, readStdin as r, MASK_CHAR as s, collectRunText as t, parseOauthConnectParams as u, DEFAULT_API_URL as v, getPromptHistoryPath as w, deleteConfig as x, DEFAULT_APP_URL as y, setLastSeenVersion as z };

package/dist/js/{print-qXJymvuF.mjs → print-nefugWMx.mjs}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import "./rest-DMpigwmN.mjs";
-import { a as runPrint, i as resolveAgent, n as messageGet, o as toPrintError, r as readStdin, t as collectRunText } from "./print-6Bm51XhR.mjs";
+import { a as runPrint, i as resolveAgent, n as messageGet, o as toPrintError, r as readStdin, t as collectRunText } from "./print-CNIvmpqW.mjs";
+import "./rest-Q5yl_b2-.mjs";
 
 export { messageGet, readStdin, resolveAgent, runPrint };

package/dist/js/{print-share-DE_dkZX7.mjs → print-share-rM8kNeEw.mjs}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { n as printError } from "./output-B4cW10Ph.mjs";
+import { n as printError } from "./output-DYzzdXYV.mjs";
 
 //#region src/chat/print-share.ts
 /**
@@ -14,7 +14,7 @@ import { n as printError } from "./output-B4cW10Ph.mjs";
 * the reply (and to --json).
 */
 async function connectMachineShare({ appUrl, sessionToken, timeoutHint }) {
-	const { PortalClient } = await import("./client-BRfmlbgI.mjs");
+	const { PortalClient } = await import("./client-D6UUwESi.mjs");
 	let signalConnected;
 	const connected = new Promise((resolve) => {
 		signalConnected = resolve;

package/dist/js/{rest-C3RySrPa.mjs → rest-CBROy0L-.mjs}

@@ -1,4 +1,4 @@
 #!/usr/bin/env node
-import { i as sendErrorMessage, n as createRestClient, r as errorDetail, t as HttpError } from "./rest-DMpigwmN.mjs";
+import { i as sendErrorMessage, n as createRestClient, r as errorDetail, t as HttpError } from "./rest-Q5yl_b2-.mjs";
 
 export { createRestClient };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skydive-cli",
-  "version": "0.2.0-beta.613",
+  "version": "0.2.0-beta.615",
   "description": "Skydive CLI — cloud agents from the command line",
   "homepage": "https://skydive.com",
   "license": "MIT",

package/dist/js/client-BRfmlbgI.mjs

@@ -1,6 +0,0 @@
-#!/usr/bin/env node
-import "./rest-DMpigwmN.mjs";
-import "./api-BGWcPuik.mjs";
-import { t as PortalClient } from "./client-l3OrGKaC.mjs";
-
-export { PortalClient };