skydive-cli 0.2.0-beta.615 → 0.2.0-beta.624

package/dist/js/bin.mjs

@@ -1,10 +1,11 @@
 #!/usr/bin/env node
-import { C as setActiveWorkspace, S as listWorkspaces, T as version, _ as themes, b as getActiveWorkspaceId, o as brandHelpArt, t as installCrashHandler, w as name, x as getSessionIdentity, y as ensureActiveOrganization } from "./install-B5sKLfRc.mjs";
-import { A as getUpdateCheckDisabled, C as getLastSeenVersion, D as getShareMachineDefault, I as saveConfig, L as saveSession, M as resolveConfig, N as resolveManagementAuth, O as getStoredApiKeyId, P as resolveSession, S as getConfigPath, _ as API_KEY_PREFIX, b as DEFAULT_WEB_URL, g as API_KEY_FAMILY_PREFIX, h as API_KEYS_URL, i as resolveAgent, j as resolveAppUrl, k as getStoredApiKeyWorkspaceName, v as DEFAULT_API_URL, w as getPromptHistoryPath, x as deleteConfig, z as setLastSeenVersion } from "./print-CNIvmpqW.mjs";
+import { C as setActiveWorkspace, S as listWorkspaces, T as version, _ as themes, b as getActiveWorkspaceId, o as brandHelpArt, t as installCrashHandler, w as name, x as getSessionIdentity, y as ensureActiveOrganization } from "./install-DKTnh1gy.mjs";
+import { A as resolveAppUrl, C as getPromptHistoryPath, D as getStoredApiKeyId, E as getShareMachineDefault, F as saveConfig, I as saveSession, M as resolveManagementAuth, N as resolveSession, O as getStoredApiKeyWorkspaceName, R as setLastSeenVersion, S as getLastSeenVersion, _ as API_KEY_PREFIX, b as deleteConfig, g as API_KEY_FAMILY_PREFIX, h as API_KEYS_URL, i as resolveAgent, j as resolveConfig, k as getUpdateCheckDisabled, v as DEFAULT_API_URL, x as getConfigPath } from "./print-DaPpTqxu.mjs";
 import { n as printError, r as printTable, t as output } from "./output-DYzzdXYV.mjs";
 import { n as createRestClient } from "./rest-Q5yl_b2-.mjs";
-import { a as registerPortalDevice, c as machineIdentity, n as findThisDevice, o as revokePortalAccess, r as grantPortalAccess, t as fetchPortalDevices } from "./api-CLTp-mKM.mjs";
-import { t as SandboxStream } from "./client-BVOAwU8M.mjs";
+import { a as registerPortalDevice, i as grantPortalAccess, n as fetchPortalDevices, o as revokePortalAccess, r as findThisDevice, s as machineIdentity } from "./client-DT9bWi1D.mjs";
+import { c as PORTAL_DAEMON_FLAG, i as queryDaemonStatus, l as daemonPaths, n as ensureDaemonRunning, o as stopDaemon } from "./daemon-DfMgVlYE.mjs";
+import { t as SandboxStream } from "./client-DfcJFEbh.mjs";
 import { hideBin } from "yargs/helpers";
 import yargs from "yargs";
 import { hostname } from "node:os";
@@ -16,7 +17,9 @@ import { spawn, spawnSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import fs from "node:fs";
 import zlib from "node:zlib";
+import fsp from "node:fs/promises";
 import semver from "semver";
+import { createInterface } from "node:readline";
 
 //#region src/types.ts
 const NON_INTERACTIVE_ENV_VARS = [
@@ -1195,7 +1198,7 @@ const importCommand = {
 				process.exit(1);
 			}
 		}
-		const { runChat } = await import("./boot-BJZrdTk0.mjs");
+		const { runChat } = await import("./boot-CI6nXtmu.mjs");
 		await runChat({
 			appUrl,
 			sessionToken: session.value.sessionToken,
@@ -1222,7 +1225,7 @@ async function runImportPrintMode({ argv, appUrl }) {
 		printError(`${session.error.message} For non-interactive use, run \`skydive auth login --web\` first, or set SKYDIVE_SESSION_TOKEN.`);
 		process.exit(1);
 	}
-	const { connectMachineShare } = await import("./print-share-rM8kNeEw.mjs");
+	const { connectMachineShare } = await import("./print-share-D8Nn1qFq.mjs");
 	const machineShare = await connectMachineShare({
 		appUrl,
 		sessionToken: session.value.sessionToken,
@@ -1230,7 +1233,7 @@ async function runImportPrintMode({ argv, appUrl }) {
 	});
 	const extra = (argv.print ?? "").trim();
 	const prompt = buildImportSeedPrompt(process.cwd()) + (extra ? `\n\nAdditional instructions: ${extra}` : "");
-	const { runPrint } = await import("./print-nefugWMx.mjs");
+	const { runPrint } = await import("./print-CB6L_1YB.mjs");
 	try {
 		const result = await runPrint({
 			appUrl,
@@ -1511,7 +1514,7 @@ const chatCommand = {
 			printError(`Unknown theme "${themeId}". Valid themes: ${themes.map((t) => t.id).join(", ")}`);
 			process.exit(1);
 		}
-		const { runChat } = await import("./boot-BJZrdTk0.mjs");
+		const { runChat } = await import("./boot-CI6nXtmu.mjs");
 		await runChat({
 			appUrl,
 			sessionToken: session.value.sessionToken,
@@ -1548,7 +1551,7 @@ async function runPrintMode({ argv, appUrl }) {
 		printError(`${session.error.message} For non-interactive use, run \`skydive auth login\` first, or set SKYDIVE_SESSION_TOKEN.`);
 		process.exit(1);
 	}
-	const { runPrint, readStdin } = await import("./print-nefugWMx.mjs");
+	const { runPrint, readStdin } = await import("./print-CB6L_1YB.mjs");
 	let prompt = (argv.print ?? "").trim();
 	if (!prompt) {
 		if (process.stdin.isTTY) {
@@ -1563,7 +1566,7 @@ async function runPrintMode({ argv, appUrl }) {
 	}
 	let machineShare = null;
 	if (resolveShareMachine(argv)) {
-		const { connectMachineShare } = await import("./print-share-rM8kNeEw.mjs");
+		const { connectMachineShare } = await import("./print-share-D8Nn1qFq.mjs");
 		machineShare = await connectMachineShare({
 			appUrl,
 			sessionToken: session.value.sessionToken,
@@ -1622,7 +1625,7 @@ const getCommand = {
 			printError(`${session.error.message} Run \`skydive auth login\` first, or set SKYDIVE_SESSION_TOKEN.`);
 			process.exit(1);
 		}
-		const { messageGet } = await import("./print-nefugWMx.mjs");
+		const { messageGet } = await import("./print-CB6L_1YB.mjs");
 		try {
 			const result = await messageGet({
 				appUrl,
@@ -1819,7 +1822,7 @@ const switchCommand = {
 				printError("The workspace picker needs the Bun runtime and it could not be set up automatically. Pass a workspace slug instead, or install Bun and retry.");
 				process.exit(1);
 			}
-			const { runWorkspacePicker } = await import("./boot-BJZrdTk0.mjs");
+			const { runWorkspacePicker } = await import("./boot-CI6nXtmu.mjs");
 			await runWorkspacePicker(session);
 			return;
 		}
@@ -1897,7 +1900,7 @@ const openCommand = {
 		const agent = argv.agent ? resolveAgent((await fetchPortalDevices(session)).agents, argv.agent) : null;
 		const cwd = argv.cwd ? path.resolve(argv.cwd) : process.cwd();
 		const { machineName } = machineIdentity();
-		const { PortalClient } = await import("./client-D6UUwESi.mjs");
+		const { PortalClient } = await import("./client-CKlIpyAb.mjs");
 		let lastLine = "";
 		let signalConnected;
 		const connected = new Promise((resolve) => {
@@ -1906,7 +1909,7 @@ const openCommand = {
 		const client = new PortalClient({
 			appUrl: session.appUrl,
 			sessionToken: session.sessionToken,
-			cwd,
+			resolveCwd: () => cwd,
 			onState: (state) => {
 				if (state.status === "connected") signalConnected();
 				const line = state.status === "error" ? `portal: connection error: ${state.error ?? "unknown"} — retrying` : `portal: ${state.status}`;
@@ -2021,10 +2024,111 @@ function buildDeviceTable(devices, agents, thisMachineName) {
 		])
 	};
 }
+/**
+* `skydive portal daemon <cmd>` — operator control of the per-host portal daemon
+* (the process that owns the single portal connection and routes exec per
+* conversation). Distinct from the agent-facing `platform portal`: this manages
+* the local daemon a human runs, so it lives on the skydive CLI only.
+*/
+const daemonStatusCommand = {
+	command: "status",
+	describe: "Show the portal daemon: running state, connection, and routing map",
+	handler: async (argv) => {
+		const status = await queryDaemonStatus(requireSession(argv).appUrl);
+		if (argv.json) {
+			output(argv, status ?? { running: false });
+			return;
+		}
+		if (!status) {
+			console.log("portal daemon: not running");
+			return;
+		}
+		const cwdCount = Object.keys(status.cwds).length;
+		console.log(`portal daemon: running (pid ${status.pid})`);
+		console.log(`  app:        ${status.appUrl}`);
+		console.log(`  connection: ${status.portal.status}${status.portal.error ? ` (${status.portal.error})` : ""}`);
+		if (status.portal.machineName) console.log(`  machine:    ${status.portal.friendlyName}`);
+		console.log(`  attached:   ${status.clientCount} CLI session(s)`);
+		console.log(`  granted:    ${status.portal.grantedAgentIds.length} agent(s)`);
+		console.log(`  routing:    ${cwdCount} conversation(s)`);
+	}
+};
+const daemonStopCommand = {
+	command: "stop",
+	describe: "Stop the portal daemon, cutting every attached session and live exec/tunnel",
+	handler: async (argv) => {
+		const result = await stopDaemon(requireSession(argv).appUrl);
+		if (argv.json) {
+			output(argv, { result });
+			return;
+		}
+		console.log(result === "not-running" ? "portal daemon: not running" : result === "failed" ? "portal daemon: could not be stopped" : `portal daemon: stopped${result === "killed" ? " (force-killed)" : ""}`);
+	}
+};
+const daemonStartCommand = {
+	command: "start",
+	describe: "Start the portal daemon if it is not already running",
+	handler: async (argv) => {
+		const session = requireSession(argv);
+		await ensureDaemonRunning(session.appUrl);
+		const status = await queryDaemonStatus(session.appUrl);
+		if (argv.json) {
+			output(argv, {
+				running: !!status,
+				pid: status?.pid ?? null
+			});
+			return;
+		}
+		console.log(status ? `portal daemon: running (pid ${status.pid})` : "portal daemon: failed to start");
+	}
+};
+const daemonRestartCommand = {
+	command: "restart",
+	describe: "Stop and restart the portal daemon (e.g. to pick up a new build)",
+	handler: async (argv) => {
+		const session = requireSession(argv);
+		await stopDaemon(session.appUrl);
+		await ensureDaemonRunning(session.appUrl);
+		const status = await queryDaemonStatus(session.appUrl);
+		if (argv.json) {
+			output(argv, {
+				running: !!status,
+				pid: status?.pid ?? null
+			});
+			return;
+		}
+		console.log(status ? `portal daemon: restarted (pid ${status.pid})` : "portal daemon: failed to restart");
+	}
+};
+const daemonLogsCommand = {
+	command: "logs",
+	describe: "Print the portal daemon's log",
+	builder: (y) => y.option("follow", {
+		alias: "f",
+		type: "boolean",
+		default: false,
+		describe: "Follow the log (like tail -f)"
+	}),
+	handler: async (argv) => {
+		const { logPath } = daemonPaths(requireSession(argv).appUrl);
+		const child = spawn("tail", argv.follow === true ? ["-f", logPath] : [
+			"-n",
+			"200",
+			logPath
+		], { stdio: "inherit" });
+		await new Promise((resolve) => child.on("close", () => resolve()));
+	}
+};
+const daemonCommand = {
+	command: "daemon",
+	describe: "Control the local portal daemon (status, stop, start, restart, logs)",
+	builder: (y) => y.command(daemonStatusCommand).command(daemonStopCommand).command(daemonStartCommand).command(daemonRestartCommand).command(daemonLogsCommand).demandCommand(1, "Specify a subcommand: status, stop, start, restart, logs"),
+	handler: () => {}
+};
 const portalCommand = {
 	command: "portal",
 	describe: "Open this machine's portal to agents and manage their access",
-	builder: (y) => y.command(openCommand).command(grantCommand).command(revokeCommand).command(statusCommand).demandCommand(1, "Specify a subcommand: open, grant, revoke, status"),
+	builder: (y) => y.command(openCommand).command(grantCommand).command(revokeCommand).command(statusCommand).command(daemonCommand).demandCommand(1, "Specify a subcommand: open, grant, revoke, status, daemon"),
 	handler: () => {}
 };
 
@@ -2070,7 +2174,7 @@ const sandboxCommand = {
 	handler: async (argv) => {
 		const session = requireSession(argv);
 		const { createRestClient } = await import("./rest-CBROy0L-.mjs");
-		const { resolveAgent } = await import("./print-nefugWMx.mjs");
+		const { resolveAgent } = await import("./print-CB6L_1YB.mjs");
 		const client = createRestClient({
 			appUrl: session.appUrl,
 			sessionToken: session.sessionToken
@@ -2139,7 +2243,7 @@ async function runPty({ session, agentId, agentName }) {
 		return 1;
 	}
 	console.error(`Connecting to ${agentName}'s sandbox… (Ctrl-] detaches)`);
-	const { runRawPtyPassthrough } = await import("./raw-pty-pspO57gT.mjs");
+	const { runRawPtyPassthrough } = await import("./raw-pty-ChUHav4d.mjs");
 	const result = await runRawPtyPassthrough({
 		stdin: process.stdin,
 		stdout: process.stdout,
@@ -2151,6 +2255,630 @@ async function runPty({ session, agentId, agentName }) {
 	return result.code;
 }
 
+//#endregion
+//#region src/update-check/manifest.ts
+/**
+* The release manifest the binary pipeline publishes
+* (`.github/workflows/release-skydive-cli-binaries.yml`) and the api serves
+* (`apps/anyone/api/src/routes/cli-releases.ts`). The update *check* only
+* needs `version` (see ./sources.ts), but the self-updater
+* (`../commands/update.ts`) needs the per-target byte pointer + integrity
+* digest too, so the full shape lives here and both consume it.
+*
+* Kept deliberately in sync with the api's `manifestSchema`: a field the api
+* validates but we drop here is fine, but a field we *require* that the api
+* doesn't emit would make every install fail — so required fields mirror the
+* api exactly (name, version, channel, per-target key/sha256/size).
+*/
+const releaseManifestSchema = z.object({
+	name: z.string().min(1),
+	version: z.string().min(1),
+	channel: z.string().min(1),
+	pubDate: z.string().optional(),
+	targets: z.record(z.object({
+		key: z.string().min(1),
+		sha256: z.string().regex(/^[0-9a-f]{64}$/),
+		size: z.number().int().positive()
+	}))
+});
+/**
+* The four release targets the pipeline builds. Named `<os>-<arch>` to match
+* the manifest's `targets` keys and the install script's `$OS-$ARCH`.
+*/
+const RELEASE_TARGETS = [
+	"darwin-arm64",
+	"darwin-x64",
+	"linux-arm64",
+	"linux-x64"
+];
+function isReleaseTarget(value) {
+	return RELEASE_TARGETS.some((target) => target === value);
+}
+/**
+* Map this host's `process.platform` / `process.arch` to a release target,
+* or null when we don't publish a binary for it. Mirrors the install
+* script's `uname -s` / `uname -m` normalization (arm64/aarch64 -> arm64,
+* x86_64/amd64 -> x64) so a CLI self-update resolves the same object a fresh
+* `curl | sh` install would.
+*/
+function hostReleaseTarget(platform, arch) {
+	const os = platform === "darwin" ? "darwin" : platform === "linux" ? "linux" : null;
+	if (!os) return null;
+	const cpu = arch === "arm64" || arch === "aarch64" ? "arm64" : arch === "x64" || arch === "x86_64" || arch === "amd64" ? "x64" : null;
+	if (!cpu) return null;
+	const target = `${os}-${cpu}`;
+	return isReleaseTarget(target) ? target : null;
+}
+function lookupTarget(manifest, platform, arch) {
+	const target = hostReleaseTarget(platform, arch);
+	if (!target) return {
+		ok: false,
+		reason: "unsupported-host",
+		target: null
+	};
+	const entry = manifest.targets[target];
+	if (!entry) return {
+		ok: false,
+		reason: "missing-from-manifest",
+		target
+	};
+	return {
+		ok: true,
+		target,
+		entry
+	};
+}
+
+//#endregion
+//#region src/update-check/versions.ts
+/** Canary builds carry a prerelease suffix (`X.Y.Z-beta.N`, synthesized in
+* CI); a plain semver is a stable release. An unparseable version defaults
+* to stable. */
+function resolveChannel(version) {
+	return (semver.prerelease(version, { loose: true })?.length ?? 0) > 0 ? "canary" : "stable";
+}
+/** npm dist-tag for a channel (see release-skydive-cli.yml). */
+function distTagForChannel(channel) {
+	return channel === "canary" ? "beta" : "latest";
+}
+/**
+* True when `candidate` is a strictly newer release than `current`, per
+* semver precedence (the `semver` package, including prerelease ordering).
+* Unparseable input is never newer, so garbage from the registry can't
+* produce a notice.
+*/
+function isNewerVersion(candidate, current) {
+	if (!semver.valid(candidate, { loose: true })) return false;
+	if (!semver.valid(current, { loose: true })) return false;
+	return semver.gt(candidate, current, { loose: true });
+}
+
+//#endregion
+//#region src/update-check/install.ts
+/**
+* The self-updater for compiled-binary installs. The update *check*
+* (./index.ts) is notify-only; this is what a user-invoked `skydive update`
+* (../commands/update.ts) runs to actually replace the binary.
+*
+* package-manager installs are never self-mutated here — that's the install
+* mode's own tool's job, and silently reaching into a global npm/yarn/pnpm
+* prefix is exactly the footgun the existing notice policy avoids. The
+* command handles that mode by printing the upgrade command; this module is
+* binary-only.
+*
+* The dangerous part is replacing a running executable in place, so the flow
+* is split: a pure {@link planUpdate} decides *whether* and *what* (testable
+* with no IO), and {@link downloadAndVerify} / {@link applyBinary} do the IO
+* with integrity checks and an atomic rename.
+*/
+/** Cap so a wrong URL or a hung CDN can't wedge `skydive update` forever. */
+const DOWNLOAD_TIMEOUT_MS = 6e4;
+/**
+* Decide what `skydive update` should do, given the running version, the
+* install source, the fetched manifest (or null), and this host. Pure — no
+* network, no filesystem — so every branch is unit-testable.
+*
+* `allowSameVersion` forces a reinstall of the current version (the `--force`
+* escape hatch for a corrupt binary); `allowDowngrade` lets an explicit
+* pinned/older manifest install over a newer running binary (rollback).
+*/
+function planUpdate(opts) {
+	const { currentVersion, source, manifest, platform, arch } = opts;
+	if (source !== "binary") return {
+		kind: "unsupported-source",
+		source,
+		latestVersion: manifest?.version ?? currentVersion
+	};
+	if (!manifest) return {
+		kind: "up-to-date",
+		currentVersion
+	};
+	const newer = isNewerVersion(manifest.version, currentVersion);
+	const same = manifest.version === currentVersion;
+	if (!(newer || same && opts.allowSameVersion === true || !newer && !same && opts.allowDowngrade === true)) return {
+		kind: "up-to-date",
+		currentVersion
+	};
+	const lookup = lookupTarget(manifest, platform, arch);
+	if (!lookup.ok) return lookup.reason === "unsupported-host" ? {
+		kind: "unsupported-host",
+		platform,
+		arch
+	} : {
+		kind: "missing-from-manifest",
+		target: lookup.target,
+		version: manifest.version
+	};
+	return {
+		kind: "update",
+		target: lookup.target,
+		version: manifest.version,
+		key: lookup.entry.key,
+		sha256: lookup.entry.sha256,
+		size: lookup.entry.size
+	};
+}
+var UpdateError = class extends Error {};
+/** Read a Node errno string (`EACCES`, `EROFS`, ...) off an unknown thrown
+* value without a type assertion — the property is validated before it's read. */
+function errnoCode(error) {
+	if (error && typeof error === "object" && "code" in error) {
+		const { code } = error;
+		if (typeof code === "string") return code;
+	}
+}
+/** Lowercase hex sha256 of a buffer, for comparing against the manifest. */
+function sha256Hex(bytes) {
+	return createHash("sha256").update(bytes).digest("hex");
+}
+/**
+* Download the release object and verify its digest before it ever touches
+* the install path. Returns the raw bytes; the caller writes them atomically.
+* Throws {@link UpdateError} (with an actionable message) on any HTTP,
+* timeout, or integrity failure — never a bare fetch error.
+*/
+async function downloadAndVerify(opts) {
+	const url = `${opts.downloadBaseUrl}/${opts.key}`;
+	const doFetch = opts.fetchImpl ?? fetch;
+	const signal = opts.signal ?? AbortSignal.timeout(DOWNLOAD_TIMEOUT_MS);
+	let response;
+	try {
+		response = await doFetch(url, {
+			signal,
+			redirect: "follow"
+		});
+	} catch (error) {
+		throw new UpdateError(`download failed from ${url}: ${error instanceof Error ? error.message : String(error)}`);
+	}
+	if (!response.ok) throw new UpdateError(`download failed from ${url}: HTTP ${response.status}`);
+	const bytes = new Uint8Array(await response.arrayBuffer());
+	if (bytes.byteLength === 0) throw new UpdateError(`download from ${url} was empty`);
+	const actual = sha256Hex(bytes);
+	if (actual !== opts.expectedSha256) throw new UpdateError(`sha256 mismatch (expected ${opts.expectedSha256}, got ${actual}) — the download may be corrupt; re-run \`skydive update\``);
+	return bytes;
+}
+/**
+* Atomically replace the executable at `destPath` with `bytes`. The temp file
+* is written in the *same directory* as the target so the final `rename` is
+* atomic (rename across filesystems is not) — a crash mid-update leaves either
+* the old binary or the new one, never a truncated file.
+*
+* On a locked destination (Windows, or a read-only install dir) the rename
+* fails; we surface an actionable UpdateError instead of a raw errno. macOS
+* and Linux happily rename over a running executable (the old inode stays
+* live for the current process), which is what makes in-place self-update
+* safe here.
+*/
+async function applyBinary(destPath, bytes) {
+	const dir = path.dirname(destPath);
+	const tmp = path.join(dir, `.skydive-update-${process.pid}-${Date.now()}.tmp`);
+	try {
+		await fsp.writeFile(tmp, bytes, { mode: 493 });
+		await fsp.chmod(tmp, 493);
+		await fsp.rename(tmp, destPath);
+	} catch (error) {
+		await fsp.rm(tmp, { force: true }).catch(() => {});
+		const code = errnoCode(error);
+		if (code === "EACCES" || code === "EPERM" || code === "EROFS") throw new UpdateError(`cannot write ${destPath} (permission denied). Re-run with the right permissions, or reinstall with the install script.`);
+		throw new UpdateError(`failed to install the new binary at ${destPath}: ${error instanceof Error ? error.message : String(error)}`);
+	}
+}
+/**
+* Resolve the path of the currently running executable to overwrite. For a
+* `bun --compile` binary that's `process.execPath`; we resolve symlinks so a
+* `~/.local/bin/skydive` symlink into a versioned store updates the real
+* file, not the link. Returns null when the path can't be determined (e.g. a
+* non-binary context), which the command treats as "can't self-update".
+*/
+function resolveSelfPath(execPath = process.execPath) {
+	if (!execPath) return null;
+	try {
+		return fs.realpathSync(execPath);
+	} catch (_error) {
+		return execPath;
+	}
+}
+
+//#endregion
+//#region src/update-check/sources.ts
+function resolveInstallSource() {
+	return typeof SKYDIVE_CLI_INSTALL_SOURCE === "string" && SKYDIVE_CLI_INSTALL_SOURCE === "binary" ? "binary" : "package-manager";
+}
+const NPM_REGISTRY_URL = "https://registry.npmjs.org";
+const npmDistTagsSchema = z.record(z.string(), z.unknown());
+const binaryManifestSchema = z.object({ version: z.unknown().optional() });
+/** npm dist-tags for the published package (`skydive-cli`). */
+const npmReleaseSource = {
+	async fetchLatestVersion(channel, { signal }) {
+		const response = await fetch(`${NPM_REGISTRY_URL}/-/package/${name}/dist-tags`, {
+			signal,
+			headers: { accept: "application/json" }
+		});
+		if (!response.ok) return null;
+		const tags = npmDistTagsSchema.safeParse(await response.json());
+		if (!tags.success) return null;
+		const version = tags.data[distTagForChannel(channel)];
+		return typeof version === "string" ? version : null;
+	},
+	async fetchManifest() {
+		return null;
+	}
+};
+/**
+* Release CDN (CloudFront over the releases bucket, infra: CliReleasesCdn).
+* Serves the channel pointers the release workflow uploads
+* (`channels/{stable,canary}.json`, cached max-age=60) alongside the
+* binaries. The daily poll goes here, not to the api, so a fleet of
+* installed binaries puts no load on — and takes no dependency on — the api.
+*/
+const RELEASE_CDN_URL = "https://dl.skydive.com";
+/** Channel manifest on the release CDN, for compiled binaries. The same
+* document the api's channel route serves (see
+* apps/anyone/api/src/routes/cli-releases.ts, which reads it from the
+* bucket this CDN fronts). */
+const binaryReleaseSource = {
+	async fetchLatestVersion(channel, { signal }) {
+		const response = await fetch(`${RELEASE_CDN_URL}/channels/${channel}.json`, {
+			signal,
+			headers: { accept: "application/json" }
+		});
+		if (!response.ok) return null;
+		const manifest = binaryManifestSchema.safeParse(await response.json());
+		if (!manifest.success) return null;
+		return typeof manifest.data.version === "string" ? manifest.data.version : null;
+	},
+	async fetchManifest(channel, { signal }) {
+		const response = await fetch(`${RELEASE_CDN_URL}/channels/${channel}.json`, {
+			signal,
+			headers: { accept: "application/json" }
+		});
+		if (!response.ok) return null;
+		const manifest = releaseManifestSchema.safeParse(await response.json());
+		return manifest.success ? manifest.data : null;
+	}
+};
+function releaseSourceForInstall(source) {
+	return source === "binary" ? binaryReleaseSource : npmReleaseSource;
+}
+
+//#endregion
+//#region src/update-check/notice.ts
+/** The install-mode-specific action line. A package-manager install is never
+* self-mutated — we only tell the user what to run. A binary install has a
+* built-in self-updater (`skydive update`, ../commands/update.ts), so that's
+* the action; the curl re-install stays the documented fallback. */
+function renderUpdateCommand(channel, source) {
+	if (source === "binary") return channel === "canary" ? "skydive update --channel canary" : "skydive update";
+	return `npm install -g ${name}@${distTagForChannel(channel)}`;
+}
+function renderUpdateNotice(opts) {
+	return `\nUpdate available: ${opts.currentVersion} \u2192 ${opts.latestVersion}\nRun ${renderUpdateCommand(opts.channel, opts.source)}\n`;
+}
+/**
+* Whether this invocation may print the notice. Pure so it's testable; the
+* inputs are raw pre-yargs argv (parsing hasn't happened when this runs) and
+* stderr's TTY-ness. `--json`/`--quiet` go to stdout, and the notice goes to
+* stderr — but scripts commonly capture 2>&1, so machine-readable modes
+* suppress it entirely rather than risk corrupting piped output.
+*/
+function shouldNotify(opts) {
+	if (!opts.stderrIsTTY) return false;
+	if (opts.argv.includes("--json") || opts.argv.includes("--quiet")) return false;
+	return true;
+}
+
+//#endregion
+//#region src/update-check/package-manager.ts
+const KNOWN = [
+	"npm",
+	"yarn",
+	"pnpm",
+	"bun"
+];
+function isKnown(value) {
+	return KNOWN.some((m) => m === value);
+}
+/**
+* Parse the manager name out of an `npm_config_user_agent` string. npm, yarn,
+* pnpm and bun all set it to `"<manager>/<version> ..."` when they spawn a
+* script, which is the most reliable signal for how *this* process was
+* launched. Returns null when the var is absent or unrecognized.
+*/
+function parseUserAgent(userAgent) {
+	if (!userAgent) return null;
+	const name = userAgent.trim().split("/")[0]?.toLowerCase();
+	return name && isKnown(name) ? name : null;
+}
+/**
+* Best-effort detection of the manager that owns this install. Order of
+* signals, most to least reliable:
+*   1. `npm_config_user_agent` — set by the manager that spawned us.
+*   2. the executable path — a global bin under a `pnpm`/`yarn`/`bun` store
+*      names the manager even when we weren't spawned by it (e.g. the user
+*      typed `skydive` directly).
+* Falls back to `npm`, the documented default install path, so the command we
+* show is always runnable — the prompt still lets the user decline and copy a
+* different one.
+*/
+function detectPackageManager(opts) {
+	const fromUa = parseUserAgent(opts.env["npm_config_user_agent"]);
+	if (fromUa) return fromUa;
+	const exec = opts.execPath.toLowerCase();
+	if (exec.includes("pnpm")) return "pnpm";
+	if (exec.includes("yarn")) return "yarn";
+	if (exec.includes("bun")) return "bun";
+	return "npm";
+}
+/**
+* The global-install command (as argv) for a manager + channel. Each manager's
+* global-add spelling differs; the version target is the channel's dist-tag
+* (`latest`/`beta`), matching what the release workflow publishes.
+*/
+function installCommand(manager, channel) {
+	const spec = `${name}@${distTagForChannel(channel)}`;
+	switch (manager) {
+		case "npm": return [
+			"npm",
+			"install",
+			"-g",
+			spec
+		];
+		case "pnpm": return [
+			"pnpm",
+			"add",
+			"-g",
+			spec
+		];
+		case "bun": return [
+			"bun",
+			"add",
+			"-g",
+			spec
+		];
+		case "yarn": return [
+			"yarn",
+			"global",
+			"add",
+			spec
+		];
+	}
+}
+/** The command as a copy-pasteable string for prompts and notices. */
+function installCommandString(manager, channel) {
+	return installCommand(manager, channel).join(" ");
+}
+
+//#endregion
+//#region src/update-check/pm-update.ts
+/**
+* The interactive upgrade path for a package-manager install: instead of only
+* printing "run npm install -g …", offer to run it now, and on confirm run
+* that exact command and relaunch the CLI on the new version.
+*
+* We never silently mutate a package-manager install (the manager owns it),
+* but an explicit prompt the user answers with a keypress is honest consent —
+* and it runs the *same* command we detected + display, so what you approve is
+* what executes. Non-interactive contexts (no TTY, --json/--quiet, CI) skip
+* the prompt entirely and fall back to the printed notice.
+*/
+/** Whether it's safe to show an interactive prompt at all. */
+function canPromptInteractively(opts) {
+	if (opts.json || opts.quiet) return false;
+	if (!opts.stdinIsTTY || !opts.stdoutIsTTY) return false;
+	if (opts.env["CI"] || opts.env["SKYDIVE_NO_UPDATE_CHECK"]) return false;
+	return true;
+}
+/**
+* Interpret a raw prompt answer. Default (empty / Enter) is **yes** — the
+* prompt renders `[Y/n]`, so a bare Enter accepts. Anything starting with `n`
+* (case-insensitive) is no; any other non-empty input is treated as no too,
+* so a fat-fingered answer never runs an install the user didn't mean.
+*/
+function interpretYesNo(answer) {
+	const a = answer.trim().toLowerCase();
+	if (a === "") return true;
+	return a === "y" || a === "yes";
+}
+/** Ask a `[Y/n]` question on the TTY and resolve to the boolean answer. */
+async function promptYesNo(question) {
+	const rl = createInterface({
+		input: process.stdin,
+		output: process.stdout
+	});
+	try {
+		return interpretYesNo(await new Promise((resolve) => {
+			rl.question(question, resolve);
+		}));
+	} finally {
+		rl.close();
+	}
+}
+/**
+* Offer + run the package-manager upgrade. Returns a result the caller turns
+* into output and an exit/relaunch decision — kept separate from the actual
+* relaunch so it's testable without re-execing the test runner.
+*/
+async function offerPackageManagerUpdate(opts) {
+	const manager = detectPackageManager({
+		env: opts.env,
+		execPath: opts.execPath
+	});
+	const command = installCommand(manager, opts.channel);
+	const commandStr = installCommandString(manager, opts.channel);
+	if (!opts.interactive) return { status: "skipped-noninteractive" };
+	if (!await (opts.ask ?? promptYesNo)(`Update available: ${opts.currentVersion} \u2192 ${opts.latestVersion}\nRun \`${commandStr}\` now? [Y/n] `)) return { status: "declined" };
+	const { status } = (opts.run ?? ((cmd) => {
+		const [bin, ...args] = cmd;
+		return { status: spawnSync(bin ?? "", args, { stdio: "inherit" }).status };
+	}))(command);
+	if (status !== 0) return {
+		status: "failed",
+		code: status,
+		command: commandStr
+	};
+	return {
+		status: "installed",
+		command: commandStr
+	};
+}
+/**
+* Relaunch the CLI after a successful in-place upgrade so the user lands back
+* on their command running the new version. Uses the same interpreter + argv
+* the current process was launched with; detaches so the parent can exit
+* cleanly. Never throws — a failed relaunch just means the user re-runs
+* manually, which the caller's message covers.
+*/
+function relaunchCli(argv = process.argv) {
+	try {
+		const [, script, ...rest] = argv;
+		spawn(process.execPath, script ? [script, ...rest] : rest, { stdio: "inherit" }).on("exit", (code) => process.exit(code ?? 0));
+	} catch (_error) {
+		process.exit(0);
+	}
+}
+
+//#endregion
+//#region src/commands/update.ts
+/**
+* `skydive update` — the user-invoked self-updater the update *check*
+* (../update-check/index.ts) has always pointed at. Notify-only remains the
+* automatic behavior; this is the explicit "do it now" action.
+*
+* Binary installs self-update in place (download -> verify sha256 -> atomic
+* replace); package-manager installs are never self-mutated (the notice
+* policy) — we print the exact upgrade command instead. `--check` is a dry
+* run; `--force` reinstalls the current version (repair a corrupt binary).
+*/
+const FETCH_TIMEOUT_MS$1 = 15e3;
+function normalizeChannel(raw, currentVersion) {
+	if (raw === "stable" || raw === "canary") return raw;
+	return resolveChannel(currentVersion);
+}
+/** Human-readable line for a plan outcome. Pure so the handler stays thin. */
+function describePlan(plan, channel, isCheck) {
+	switch (plan.kind) {
+		case "up-to-date": return `Already on the latest ${channel} release (${plan.currentVersion}).`;
+		case "unsupported-source": return `This is a ${plan.source} install, so update through your package manager:\n  ${renderUpdateCommand(channel, plan.source)}`;
+		case "unsupported-host": return `No Skydive binary is published for ${plan.platform}/${plan.arch}.`;
+		case "missing-from-manifest": return `The ${channel} ${plan.version} release has no binary for your platform (${plan.target}).`;
+		case "update": return isCheck ? `Update available: ${version} \u2192 ${plan.version} (${channel}, ${plan.target}).\nRun \`skydive update\` to install it.` : `Updating ${version} \u2192 ${plan.version} (${channel}, ${plan.target})...`;
+	}
+}
+const updateCommand = {
+	command: "update",
+	describe: "Update the Skydive CLI to the latest release",
+	builder: (y) => y.option("channel", {
+		type: "string",
+		choices: ["stable", "canary"],
+		describe: "Release channel to update to (default: this build's channel)"
+	}).option("check", {
+		type: "boolean",
+		default: false,
+		describe: "Only report whether an update is available; don't install"
+	}).option("force", {
+		type: "boolean",
+		default: false,
+		describe: "Reinstall the current version even if already up to date (repairs a corrupt binary)"
+	}).example("skydive update", "Install the latest release").example("skydive update --check", "See if an update is available").example("skydive update --channel canary", "Switch to the canary line"),
+	handler: async (argv) => {
+		const currentVersion = version;
+		const source = resolveInstallSource();
+		const channel = normalizeChannel(argv.channel, currentVersion);
+		const manifest = await releaseSourceForInstall(source).fetchManifest(channel, { signal: AbortSignal.timeout(FETCH_TIMEOUT_MS$1) }).catch(() => null);
+		if (source === "binary" && manifest === null) {
+			if (argv.json) {
+				output(argv, {
+					status: "unavailable",
+					channel,
+					currentVersion
+				});
+				return;
+			}
+			throw new UpdateError(`couldn't reach the ${channel} release channel — check your connection and try again.`);
+		}
+		const plan = planUpdate({
+			currentVersion,
+			source,
+			manifest,
+			platform: process.platform,
+			arch: process.arch,
+			allowSameVersion: argv.force
+		});
+		if (argv.json) {
+			output(argv, {
+				plan,
+				channel,
+				currentVersion,
+				dryRun: argv.check
+			});
+			return;
+		}
+		if (plan.kind === "unsupported-source" && !argv.check) {
+			const interactive = canPromptInteractively({
+				stdinIsTTY: Boolean(process.stdin.isTTY),
+				stdoutIsTTY: Boolean(process.stdout.isTTY),
+				json: argv.json,
+				quiet: argv.quiet,
+				env: process.env
+			});
+			const result = await offerPackageManagerUpdate({
+				channel,
+				currentVersion,
+				latestVersion: plan.latestVersion,
+				env: process.env,
+				execPath: process.execPath,
+				interactive
+			});
+			switch (result.status) {
+				case "installed":
+					console.log(`Updated via \`${result.command}\`. Relaunching \`skydive\`...`);
+					relaunchCli();
+					return;
+				case "failed": throw new UpdateError(`\`${result.command}\` exited with code ${result.code ?? "unknown"}. Try running it yourself.`);
+				case "declined":
+					console.log(describePlan(plan, channel, false));
+					return;
+				case "skipped-noninteractive":
+					console.log(describePlan(plan, channel, false));
+					return;
+			}
+		}
+		if (plan.kind !== "update" || argv.check) {
+			console.log(describePlan(plan, channel, argv.check));
+			return;
+		}
+		const selfPath = resolveSelfPath();
+		if (!selfPath) throw new UpdateError("couldn't determine this binary's path to replace it — reinstall with the install script instead.");
+		console.log(describePlan(plan, channel, false));
+		await applyBinary(selfPath, await downloadAndVerify({
+			downloadBaseUrl: RELEASE_CDN_URL,
+			key: plan.key,
+			expectedSha256: plan.sha256
+		}));
+		console.log(`Updated to ${plan.version}. Run \`skydive --version\` to confirm.`);
+	}
+};
+
 //#endregion
 //#region src/cli.ts
 function createCli(argv) {
@@ -2168,7 +2896,7 @@ function createCli(argv) {
 		type: "string",
 		global: true,
 		describe: "Override API base URL"
-	}).command(authCommand).command(chatCommand).command(messagesCommand).command(conversationsCommand).command(agentsCommand).command(importCommand).command(keysCommand).command(secretsCommand).command(workspaceCommand).command(portalCommand).command(sandboxCommand).demandCommand(1, "Specify a command. Run --help for usage.").strict().wrap(null).version(version).alias("v", "version").alias("h", "help").help().fail((msg, err) => {
+	}).command(authCommand).command(chatCommand).command(messagesCommand).command(conversationsCommand).command(agentsCommand).command(importCommand).command(keysCommand).command(secretsCommand).command(workspaceCommand).command(portalCommand).command(sandboxCommand).command(updateCommand).demandCommand(1, "Specify a command. Run --help for usage.").strict().wrap(null).version(version).alias("v", "version").alias("h", "help").help().fail((msg, err) => {
 		printError(err ? err instanceof Error ? err.message : String(err) : msg ?? "Unknown error");
 		process.exit(1);
 	});
@@ -2280,100 +3008,6 @@ function isCheckDue(lastCheckedAt, now = Date.now()) {
 	return now - then >= CHECK_INTERVAL_MS;
 }
 
-//#endregion
-//#region src/update-check/versions.ts
-/** Canary builds carry a prerelease suffix (`X.Y.Z-beta.N`, synthesized in
-* CI); a plain semver is a stable release. An unparseable version defaults
-* to stable. */
-function resolveChannel(version) {
-	return (semver.prerelease(version, { loose: true })?.length ?? 0) > 0 ? "canary" : "stable";
-}
-/** npm dist-tag for a channel (see release-skydive-cli.yml). */
-function distTagForChannel(channel) {
-	return channel === "canary" ? "beta" : "latest";
-}
-/**
-* True when `candidate` is a strictly newer release than `current`, per
-* semver precedence (the `semver` package, including prerelease ordering).
-* Unparseable input is never newer, so garbage from the registry can't
-* produce a notice.
-*/
-function isNewerVersion(candidate, current) {
-	if (!semver.valid(candidate, { loose: true })) return false;
-	if (!semver.valid(current, { loose: true })) return false;
-	return semver.gt(candidate, current, { loose: true });
-}
-
-//#endregion
-//#region src/update-check/notice.ts
-/** The install-mode-specific action line. A package-manager install is never
-* self-mutated — we only tell the user what to run. */
-function renderUpdateCommand(channel, source) {
-	if (source === "binary") return `curl -fsSL ${DEFAULT_WEB_URL}/api/v1/cli/install.sh | ${channel === "canary" ? "SKYDIVE_CHANNEL=canary " : ""}sh`;
-	return `npm install -g ${name}@${distTagForChannel(channel)}`;
-}
-function renderUpdateNotice(opts) {
-	return `\nUpdate available: ${opts.currentVersion} \u2192 ${opts.latestVersion}\nRun ${renderUpdateCommand(opts.channel, opts.source)}\n`;
-}
-/**
-* Whether this invocation may print the notice. Pure so it's testable; the
-* inputs are raw pre-yargs argv (parsing hasn't happened when this runs) and
-* stderr's TTY-ness. `--json`/`--quiet` go to stdout, and the notice goes to
-* stderr — but scripts commonly capture 2>&1, so machine-readable modes
-* suppress it entirely rather than risk corrupting piped output.
-*/
-function shouldNotify(opts) {
-	if (!opts.stderrIsTTY) return false;
-	if (opts.argv.includes("--json") || opts.argv.includes("--quiet")) return false;
-	return true;
-}
-
-//#endregion
-//#region src/update-check/sources.ts
-function resolveInstallSource() {
-	return typeof SKYDIVE_CLI_INSTALL_SOURCE === "string" && SKYDIVE_CLI_INSTALL_SOURCE === "binary" ? "binary" : "package-manager";
-}
-const NPM_REGISTRY_URL = "https://registry.npmjs.org";
-const npmDistTagsSchema = z.record(z.string(), z.unknown());
-const binaryManifestSchema = z.object({ version: z.unknown().optional() });
-/** npm dist-tags for the published package (`skydive-cli`). */
-const npmReleaseSource = { async fetchLatestVersion(channel, { signal }) {
-	const response = await fetch(`${NPM_REGISTRY_URL}/-/package/${name}/dist-tags`, {
-		signal,
-		headers: { accept: "application/json" }
-	});
-	if (!response.ok) return null;
-	const tags = npmDistTagsSchema.safeParse(await response.json());
-	if (!tags.success) return null;
-	const version = tags.data[distTagForChannel(channel)];
-	return typeof version === "string" ? version : null;
-} };
-/**
-* Release CDN (CloudFront over the releases bucket, infra: CliReleasesCdn).
-* Serves the channel pointers the release workflow uploads
-* (`channels/{stable,canary}.json`, cached max-age=60) alongside the
-* binaries. The daily poll goes here, not to the api, so a fleet of
-* installed binaries puts no load on — and takes no dependency on — the api.
-*/
-const RELEASE_CDN_URL = "https://dl.skydive.com";
-/** Channel manifest on the release CDN, for compiled binaries. The same
-* document the api's channel route serves (see
-* apps/anyone/api/src/routes/cli-releases.ts, which reads it from the
-* bucket this CDN fronts). */
-const binaryReleaseSource = { async fetchLatestVersion(channel, { signal }) {
-	const response = await fetch(`${RELEASE_CDN_URL}/channels/${channel}.json`, {
-		signal,
-		headers: { accept: "application/json" }
-	});
-	if (!response.ok) return null;
-	const manifest = binaryManifestSchema.safeParse(await response.json());
-	if (!manifest.success) return null;
-	return typeof manifest.data.version === "string" ? manifest.data.version : null;
-} };
-function releaseSourceForInstall(source) {
-	return source === "binary" ? binaryReleaseSource : npmReleaseSource;
-}
-
 //#endregion
 //#region src/update-check/index.ts
 /**
@@ -2616,12 +3250,18 @@ if (process.argv.includes(UPDATE_WORKER_FLAG)) {
 	await runUpdateCheckWorker();
 	process.exit(0);
 }
-maybePrintWhatsNew();
-setupUpdateCheck(hideBin(process.argv));
-const resolved = resolveArgv(hideBin(process.argv));
-const raw = hideBin(process.argv);
-if ((raw.includes("--help") || raw.includes("-h")) && !raw.some((a) => !a.startsWith("-")) && !raw.includes("--json") && !raw.includes("--quiet")) process.stdout.write(brandHelpArt());
-createCli(resolved).parse();
+if (process.argv.includes(PORTAL_DAEMON_FLAG)) {
+	const { runPortalDaemon } = await import("./daemon-CqhMYzpN.mjs");
+	runPortalDaemon(process.argv);
+} else runCli();
+function runCli() {
+	maybePrintWhatsNew();
+	setupUpdateCheck(hideBin(process.argv));
+	const resolved = resolveArgv(hideBin(process.argv));
+	const raw = hideBin(process.argv);
+	if ((raw.includes("--help") || raw.includes("-h")) && !raw.some((a) => !a.startsWith("-")) && !raw.includes("--json") && !raw.includes("--quiet")) process.stdout.write(brandHelpArt());
+	createCli(resolved).parse();
+}
 
 //#endregion
 export {  };