skydive-cli 0.2.0-beta.615 → 0.2.0-beta.624

package/dist/js/{boot-BJZrdTk0.mjs → boot-CI6nXtmu.mjs}

@@ -1,25 +1,25 @@
 #!/usr/bin/env node
-import { C as setActiveWorkspace, S as listWorkspaces, a as WORDMARK, b as getActiveWorkspaceId, c as applyTheme, d as noColorRequested, f as theme, g as themeVersion, h as themeModeFromColorFgBg, i as MARK_CELLS, l as findTheme, m as themeMode, n as buildCrashReport, p as themeForMode, r as writeCrashReport, s as DEFAULT_THEME_ID, t as installCrashHandler, u as monoTheme, v as themesForMode } from "./install-B5sKLfRc.mjs";
-import { E as getSavedTheme, F as resolveWebUrl, R as saveTheme, S as getConfigPath, T as getReviewStateDir, c as cardActionErrorMessage, d as reconcileMaskedInput, f as resolveConnectUrl, i as resolveAgent, l as parseExternalOauthConnectParams, m as specKeyFor, p as parseConnectCard, s as MASK_CHAR, u as parseOauthConnectParams, v as DEFAULT_API_URL, y as DEFAULT_APP_URL } from "./print-CNIvmpqW.mjs";
+import { C as setActiveWorkspace, S as listWorkspaces, a as WORDMARK, b as getActiveWorkspaceId, c as applyTheme, d as noColorRequested, f as theme, g as themeVersion, h as themeModeFromColorFgBg, i as MARK_CELLS, l as findTheme, m as themeMode, n as buildCrashReport, p as themeForMode, r as writeCrashReport, s as DEFAULT_THEME_ID, t as installCrashHandler, u as monoTheme, v as themesForMode } from "./install-DKTnh1gy.mjs";
+import { L as saveTheme, P as resolveWebUrl, T as getSavedTheme, c as cardActionErrorMessage, d as reconcileMaskedInput, f as resolveConnectUrl, i as resolveAgent, l as parseExternalOauthConnectParams, m as specKeyFor, p as parseConnectCard, s as MASK_CHAR, u as parseOauthConnectParams, v as DEFAULT_API_URL, w as getReviewStateDir, x as getConfigPath, y as DEFAULT_APP_URL } from "./print-DaPpTqxu.mjs";
 import { a as errorMessage, i as sendErrorMessage, n as createRestClient, o as isRecord, r as errorDetail, t as HttpError } from "./rest-Q5yl_b2-.mjs";
-import "./api-CLTp-mKM.mjs";
-import { t as SandboxStream } from "./client-BVOAwU8M.mjs";
-import { t as PortalClient } from "./client-BigvBsPk.mjs";
-import { t as runRawPtyPassthrough } from "./raw-pty-Dbi2kb9v.mjs";
+import { t as PortalClient } from "./client-DT9bWi1D.mjs";
+import { d as makeLineParser, f as parseDaemonMessage, l as daemonPaths, n as ensureDaemonRunning, s as LOCAL_PROTOCOL_VERSION, u as encodeLine } from "./daemon-DfMgVlYE.mjs";
+import { t as SandboxStream } from "./client-DfcJFEbh.mjs";
+import { t as runRawPtyPassthrough } from "./raw-pty-BcjbTjHJ.mjs";
 import * as os$1 from "node:os";
 import { homedir, platform, release, tmpdir } from "node:os";
 import path, { basename, extname, isAbsolute, join, win32 } from "node:path";
 import { z } from "zod";
 import open from "open";
 import { execFile, spawn } from "node:child_process";
-import { createHash } from "node:crypto";
+import { createHash, randomUUID } from "node:crypto";
 import { constants } from "node:fs";
+import { connect, createConnection } from "node:net";
+import { access, appendFile, mkdir, mkdtemp, readFile, readdir, rename, rm, stat, unlink, writeFile } from "node:fs/promises";
 import { MarkdownRenderable, RenderableEvents, StyledText, SyntaxStyle, createCliRenderer, decodePasteBytes, detectLinks, fg, link } from "@opentui/core";
 import { createRoot, extend, useKeyboard, usePaste, useRenderer, useTerminalDimensions } from "@opentui/react";
 import { createContext, memo, useCallback, useContext, useEffect, useMemo, useRef, useState } from "react";
 import { create } from "zustand";
-import { connect, createConnection } from "node:net";
-import { access, appendFile, mkdir, mkdtemp, readFile, readdir, rename, rm, stat, unlink, writeFile } from "node:fs/promises";
 import { Fragment, jsx, jsxs } from "@opentui/react/jsx-runtime";
 import fuzzysort from "fuzzysort";
 import { fileURLToPath } from "node:url";
@@ -228,23 +228,222 @@ async function resolveInitialScreen({ rest, agentSelector, conversationId, newCo
 	};
 }
 
+//#endregion
+//#region src/chat/portal/daemon-client.ts
+var PortalDaemonClient = class {
+	sessionId = randomUUID();
+	socket = null;
+	disposed = false;
+	reconnectTimer = null;
+	lastBind = null;
+	wantEnabled = false;
+	pendingGrants = /* @__PURE__ */ new Set();
+	grantedAgentIds = /* @__PURE__ */ new Set();
+	constructor(opts) {
+		this.opts = opts;
+	}
+	/** Spawn the daemon if needed and attach. Idempotent. */
+	async start() {
+		if (this.disposed) return;
+		await ensureDaemonRunning(this.opts.appUrl);
+		this.connect();
+	}
+	connect() {
+		if (this.disposed) return;
+		const { socketPath } = daemonPaths(this.opts.appUrl);
+		const socket = connect(socketPath);
+		socket.setEncoding("utf8");
+		this.socket = socket;
+		const parse = makeLineParser();
+		socket.on("connect", () => {
+			this.send({
+				t: "hello",
+				v: LOCAL_PROTOCOL_VERSION,
+				sessionId: this.sessionId,
+				token: this.opts.sessionToken
+			});
+			if (this.wantEnabled) this.send({ t: "enable" });
+			if (this.lastBind) this.send({
+				t: "bind",
+				sessionId: this.sessionId,
+				conversationId: this.lastBind.conversationId,
+				cwd: this.lastBind.cwd
+			});
+			for (const agentId of this.pendingGrants) this.send({
+				t: "grant",
+				agentId
+			});
+		});
+		socket.on("data", (chunk) => {
+			for (const line of parse(chunk)) {
+				const msg = parseDaemonMessage(line);
+				if (msg) this.onMessage(msg);
+			}
+		});
+		const onClose = () => {
+			if (this.socket === socket) this.socket = null;
+			this.scheduleReconnect();
+		};
+		socket.on("close", onClose);
+		socket.on("error", onClose);
+	}
+	scheduleReconnect() {
+		if (this.disposed || this.reconnectTimer) return;
+		this.reconnectTimer = setTimeout(() => {
+			this.reconnectTimer = null;
+			this.start();
+		}, 500);
+		this.reconnectTimer.unref();
+	}
+	onMessage(msg) {
+		if (msg.t === "state") {
+			this.grantedAgentIds = new Set(msg.grantedAgentIds);
+			this.opts.onState({
+				status: msg.status,
+				machineName: msg.machineName,
+				friendlyName: msg.friendlyName,
+				error: msg.error,
+				grantedAgentIds: msg.grantedAgentIds
+			});
+		}
+	}
+	/** Whether this agent is currently authorized on the machine (last daemon state). */
+	isGranted(agentId) {
+		return this.grantedAgentIds.has(agentId);
+	}
+	/** Whether the user has turned machine sharing on from this CLI. */
+	isEnabled() {
+		return this.wantEnabled;
+	}
+	send(msg) {
+		if (this.socket?.writable) this.socket.write(encodeLine(msg));
+	}
+	/** Turn machine sharing on (the daemon connects the portal). */
+	enable() {
+		this.wantEnabled = true;
+		this.send({ t: "enable" });
+	}
+	/** Turn machine sharing off. */
+	disable() {
+		this.wantEnabled = false;
+		this.send({ t: "disable" });
+	}
+	/** Register / update this conversation's working directory for exec routing. */
+	bind(conversationId, cwd) {
+		this.lastBind = {
+			conversationId,
+			cwd
+		};
+		this.send({
+			t: "bind",
+			sessionId: this.sessionId,
+			conversationId,
+			cwd
+		});
+	}
+	/**
+	* Authorize one agent to run commands on this machine. Resolves once the
+	* request is sent to the daemon (the daemon performs the grant and pushes the
+	* updated state); kept async so it's a drop-in for the old in-process client's
+	* awaited `grantAgent`.
+	*/
+	grantAgent(agentId) {
+		this.pendingGrants.add(agentId);
+		this.send({
+			t: "grant",
+			agentId
+		});
+		return Promise.resolve();
+	}
+	/** Detach this CLI. The daemon keeps running for other clients. */
+	dispose() {
+		this.disposed = true;
+		if (this.reconnectTimer) {
+			clearTimeout(this.reconnectTimer);
+			this.reconnectTimer = null;
+		}
+		this.send({
+			t: "bye",
+			sessionId: this.sessionId
+		});
+		try {
+			this.socket?.destroy();
+		} catch (_error) {}
+		this.socket = null;
+	}
+};
+
+//#endregion
+//#region src/chat/portal/create-portal-client.ts
+/**
+* Escape hatch: setting `SKYDIVE_NO_DAEMON` (to any non-empty value)
+* makes the CLI bypass the portal daemon and open the portal connection
+* in-process, the pre-daemon behavior. This is a LOCAL env switch, not a remote
+* flag: it takes effect on the next CLI start and lets a user (or us) fall back
+* instantly if the daemon misbehaves in the wild, without shipping a new build.
+* The daemon is the default because it fixes the multi-process presence flap.
+*/
+function portalDaemonDisabled() {
+	return !!process.env.SKYDIVE_NO_DAEMON;
+}
+/**
+* Build the portal client the app should use: the daemon client by default, or
+* the in-process `PortalClient` when the kill switch is set. The in-process
+* client always runs exec in the launch cwd (it has no conversation map), which
+* is the exact pre-daemon behavior.
+*/
+function createPortalClient(opts) {
+	if (portalDaemonDisabled()) {
+		const client = new PortalClient({
+			appUrl: opts.appUrl,
+			sessionToken: opts.sessionToken,
+			resolveCwd: () => process.cwd(),
+			onState: (state) => opts.onState({
+				status: state.status,
+				machineName: state.machineName,
+				friendlyName: state.friendlyName,
+				error: state.error,
+				grantedAgentIds: state.grantedAgentIds
+			})
+		});
+		return {
+			start: () => Promise.resolve(),
+			enable: () => client.enable(),
+			disable: () => client.disable(),
+			grantAgent: (agentId) => client.grantAgent(agentId),
+			isGranted: (agentId) => client.isGranted(agentId),
+			bind: () => {},
+			dispose: () => client.dispose()
+		};
+	}
+	return new PortalDaemonClient(opts);
+}
+
 //#endregion
 //#region src/chat/portal/use-portal.ts
 /**
-* Owns the `PortalClient` lifecycle for the app session and keeps the store in
-* sync with its status. Constructed once from the resolved session; disabling
-* happens on unmount so quitting the TUI drops presence and kills any children.
+* Owns the portal DAEMON CLIENT lifecycle for the app session and keeps the
+* store in sync with the daemon's status.
+*
+* The CLI no longer opens the portal connection itself: it attaches to a
+* per-host daemon (spawned on demand) that owns the single portal WebSocket, so
+* multiple `skydive` processes on one machine share one portal identity instead
+* of fighting over it (the flap). This hook just wires the daemon client into
+* the store; the chat screen registers each conversation's working directory via
+* `portalClient.bind(...)` so the daemon runs that conversation's exec in the
+* right place.
+*
 * `shareMachine` opts in from launch (the `--share-machine` flag); otherwise the
-* user turns sharing on from the chat screen.
+* user turns sharing on from the chat screen. Detaching on unmount leaves the
+* daemon running for any other attached CLIs.
 */
 function usePortal({ appUrl, sessionToken, shareMachine }) {
 	const syncPortal = useStore((s) => s.syncPortal);
 	const setPortalClient = useStore((s) => s.setPortalClient);
 	useEffect(() => {
-		const client = new PortalClient({
+		const client = createPortalClient({
 			appUrl,
 			sessionToken,
-			cwd: process.cwd(),
 			onState: (state) => syncPortal({
 				status: state.status,
 				machineName: state.machineName,
@@ -253,7 +452,9 @@ function usePortal({ appUrl, sessionToken, shareMachine }) {
 			})
 		});
 		setPortalClient(client);
-		if (shareMachine) client.enable();
+		client.start().then(() => {
+			if (shareMachine) client.enable();
+		});
 		return () => {
 			client.dispose();
 			setPortalClient(null);
@@ -9191,6 +9392,16 @@ function ChatScreen({ agent, conversation }) {
 		agentHost.setSession(conversationId);
 		setResumeConversation(conversationId);
 	}, [agentHost, conversationId]);
+	const bindPortalCwd = useCallback(() => {
+		if (!conversationId || !portalClient) return;
+		if (portal.status === "off") return;
+		const cwd = shellSessionRef.current?.cwd ?? process.cwd();
+		portalClient.bind(conversationId, cwd);
+	}, [
+		conversationId,
+		portalClient,
+		portal.status
+	]);
 	const scrollRef = useRef(null);
 	const composerRef = useRef(null);
 	const jumpToBottom = useCallback(() => {
@@ -9761,6 +9972,7 @@ function ChatScreen({ agent, conversation }) {
 				...m,
 				exit: exitCode
 			} : m));
+			bindPortalCwd();
 		} catch (err) {
 			appendOutput(`\n${errorMessage(err)}`);
 			exitCode = 1;
@@ -9770,7 +9982,7 @@ function ChatScreen({ agent, conversation }) {
 			} : m));
 		}
 		sendContent(formatShellContext(command, captured, exitCode), [], { echo: false });
-	}, [sendContent]);
+	}, [sendContent, bindPortalCwd]);
 	const runSandboxExec = useCallback((command) => {
 		if (!appUrl || !sessionToken) return;
 		const id = crypto.randomUUID();
@@ -10099,6 +10311,7 @@ function ChatScreen({ agent, conversation }) {
 		if (portal.status === "off") {
 			declinedRef.current.delete(agent.id);
 			portalClient.enable();
+			if (conversationId) portalClient.bind(conversationId, shellSessionRef.current?.cwd ?? process.cwd());
 		} else {
 			portalClient.disable();
 			setPortalPrompt(null);
@@ -10107,7 +10320,8 @@ function ChatScreen({ agent, conversation }) {
 		portalClient,
 		portal.status,
 		agent.id,
-		setPortalPrompt
+		setPortalPrompt,
+		conversationId
 	]);
 	const confirmGrant = useCallback(() => {
 		if (!portalClient) return;

package/dist/js/client-CKlIpyAb.mjs

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+import "./rest-Q5yl_b2-.mjs";
+import { t as PortalClient } from "./client-DT9bWi1D.mjs";
+
+export { PortalClient };

package/dist/js/{client-BigvBsPk.mjs → client-DT9bWi1D.mjs}

@@ -1,10 +1,66 @@
 #!/usr/bin/env node
-import { a as errorMessage } from "./rest-Q5yl_b2-.mjs";
-import { c as machineIdentity, i as mintPortalDeviceToken, l as portalWsUrl, n as findThisDevice, r as grantPortalAccess, s as buildEnv, t as fetchPortalDevices } from "./api-CLTp-mKM.mjs";
+import { a as errorMessage, t as HttpError } from "./rest-Q5yl_b2-.mjs";
+import os from "node:os";
 import { z } from "zod";
 import { spawn } from "node:child_process";
 import { WebSocket } from "ws";
 
+//#region src/chat/portal/machine.ts
+/**
+* Identity this machine registers under when the CLI shares it via the portal.
+*
+* The `-cli` suffix / `(CLI)` label keep a CLI-shared machine a DISTINCT portal
+* device from the same host's Skydive Desktop app. `portal_device` is unique on
+* (org, user, machineName), and directives route to whichever socket holds the
+* device — if the CLI and desktop registered the same name they'd share a
+* device row and both execute every directive. Distinct names also make the
+* grant UI unambiguous about which surface is being authorized.
+*/
+function machineIdentity() {
+	const host = (os.hostname() || "machine").trim().replace(/\.local$/i, "") || "machine";
+	return {
+		machineName: `${host}-cli`,
+		friendlyName: `${host} (CLI)`
+	};
+}
+const INHERITED_ENV = [
+	"HOME",
+	"USER",
+	"LOGNAME",
+	"SHELL",
+	"LANG",
+	"LC_ALL",
+	"TMPDIR",
+	"TERM",
+	"PATH"
+];
+function buildEnv(extra) {
+	const env = {};
+	for (const key of INHERITED_ENV) {
+		const value = process.env[key];
+		if (value !== void 0) env[key] = value;
+	}
+	if (extra) for (const [key, value] of Object.entries(extra)) env[key] = value;
+	return env;
+}
+/**
+* Build the desktop-portal WebSocket URL from the chat origin. Mirrors the Rust
+* desktop client: http→ws, https→wss, scheme-less defaults to wss, and the
+* machine/label ride as query pairs (percent-encoded by URL).
+*/
+function portalWsUrl(appUrl, machine, label) {
+	const base = appUrl.replace(/\/+$/, "");
+	let wsBase;
+	if (base.startsWith("https://")) wsBase = `wss://${base.slice(8)}`;
+	else if (base.startsWith("http://")) wsBase = `ws://${base.slice(7)}`;
+	else wsBase = `wss://${base}`;
+	const url = new URL(`${wsBase}/api/v1/portal/desktop`);
+	url.searchParams.set("machine", machine);
+	url.searchParams.set("label", label);
+	return url.toString();
+}
+
+//#endregion
 //#region ../portal-protocol/src/index.ts
 const MAX_WS_FRAME_BYTES = 16 * 1024 * 1024;
 const T_DATA = 1;
@@ -31,7 +87,8 @@ const ctrlMessageSchema = z.discriminatedUnion("t", [
 	z.object({
 		t: z.literal("open"),
 		argv: z.array(z.string()),
-		env: z.record(z.string()).nullable()
+		env: z.record(z.string()).nullable(),
+		conversationId: z.string().nullable().optional()
 	}),
 	z.object({ t: z.literal("stdin_eof") }),
 	z.object({ t: z.literal("pause") }),
@@ -103,7 +160,7 @@ var JobManager = class {
 	handleCtrl(id, msg) {
 		switch (msg.t) {
 			case "open":
-				this.startJob(id, msg.argv, msg.env);
+				this.startJob(id, msg.argv, msg.env, msg.conversationId ?? null);
 				return;
 			case "stdin_eof":
 				this.jobs.get(id)?.child.stdin.end();
@@ -133,7 +190,7 @@ var JobManager = class {
 			job.child.stderr.resume();
 		}
 	}
-	startJob(id, argv, env) {
+	startJob(id, argv, env, conversationId) {
 		const [program, ...args] = argv;
 		if (!program) {
 			this.opts.send(encodeCtrl(id, {
@@ -145,7 +202,7 @@ var JobManager = class {
 		let child;
 		try {
 			child = spawn(program, args, {
-				cwd: this.opts.cwd,
+				cwd: this.opts.resolveCwd(conversationId),
 				env: buildEnv(env),
 				stdio: [
 					"pipe",
@@ -194,6 +251,89 @@ var JobManager = class {
 	}
 };
 
+//#endregion
+//#region src/chat/portal/api.ts
+/**
+* The portal's session-authed REST surface, shared by `PortalClient` (the
+* TUI/`portal open` connection) and the `skydive portal` management
+* commands, so the endpoint contracts and response schemas live in exactly
+* one place.
+*/
+const deviceSchema = z.object({
+	id: z.string(),
+	machineName: z.string(),
+	friendlyName: z.string(),
+	connected: z.boolean(),
+	lastSeen: z.string().nullable(),
+	grantedAgentIds: z.array(z.string())
+});
+const devicesResponseSchema = z.object({
+	devices: z.array(deviceSchema),
+	agents: z.array(z.object({
+		id: z.string(),
+		name: z.string()
+	}))
+});
+const deviceTokenSchema = z.object({ token: z.string().min(1) });
+async function portalFetch(auth, path, init) {
+	const res = await fetch(`${auth.appUrl}${path}`, {
+		method: init.method,
+		headers: {
+			authorization: `Bearer ${auth.sessionToken}`,
+			accept: "application/json",
+			...init.body ? { "content-type": "application/json" } : {}
+		},
+		...init.body ? { body: init.body } : {}
+	});
+	if (!res.ok) {
+		const body = await res.text().catch(() => "");
+		throw new HttpError(res.status, body);
+	}
+	return res.json();
+}
+async function fetchPortalDevices(auth) {
+	const json = await portalFetch(auth, "/api/v1/portal/devices", { method: "GET" });
+	return devicesResponseSchema.parse(json);
+}
+const registerResponseSchema = z.object({ device: z.object({ id: z.string() }) });
+/**
+* Register this machine's device row without connecting. Connecting registers
+* as a side effect; this covers granting an agent on a machine that has never
+* shared yet (the grant references the device row).
+*/
+async function registerPortalDevice(auth, { machineName, friendlyName }) {
+	const json = await portalFetch(auth, "/api/v1/portal/devices", {
+		method: "POST",
+		body: JSON.stringify({
+			machineName,
+			friendlyName
+		})
+	});
+	return registerResponseSchema.parse(json).device;
+}
+/** Short-lived token the machine presents when dialing the portal WebSocket. */
+async function mintPortalDeviceToken(auth) {
+	const json = await portalFetch(auth, "/api/v1/portal/device-token", { method: "POST" });
+	return deviceTokenSchema.parse(json).token;
+}
+async function grantPortalAccess(auth, { deviceId, agentId }) {
+	await portalFetch(auth, `/api/v1/portal/devices/${encodeURIComponent(deviceId)}/grants`, {
+		method: "POST",
+		body: JSON.stringify({ agentId })
+	});
+}
+async function revokePortalAccess(auth, { deviceId, agentId }) {
+	await portalFetch(auth, `/api/v1/portal/devices/${encodeURIComponent(deviceId)}/grants/${encodeURIComponent(agentId)}`, { method: "DELETE" });
+}
+/**
+* The device row for a given machine identity. Matching is by `machineName`
+* equality — the stable per-surface handle (`<host>-cli` vs the desktop's
+* `<host>`), not the display label.
+*/
+function findThisDevice(devices, machineName) {
+	return devices.find((device) => device.machineName === machineName) ?? null;
+}
+
 //#endregion
 //#region src/chat/portal/client.ts
 const INITIAL_BACKOFF_MS = 500;
@@ -309,7 +449,7 @@ var PortalClient = class {
 			});
 			this.ws = ws;
 			const jobs = new JobManager({
-				cwd: this.opts.cwd,
+				resolveCwd: this.opts.resolveCwd,
 				send: (frame) => {
 					if (ws.readyState === WebSocket.OPEN) ws.send(frame);
 				}
@@ -363,4 +503,4 @@ function sleep(ms) {
 }
 
 //#endregion
-export { PortalClient as t };
+export { registerPortalDevice as a, grantPortalAccess as i, fetchPortalDevices as n, revokePortalAccess as o, findThisDevice as r, machineIdentity as s, PortalClient as t };

package/dist/js/daemon-CqhMYzpN.mjs

@@ -0,0 +1,6 @@
+#!/usr/bin/env node
+import "./rest-Q5yl_b2-.mjs";
+import "./client-DT9bWi1D.mjs";
+import { a as runPortalDaemon, i as queryDaemonStatus, n as ensureDaemonRunning, o as stopDaemon, r as isDaemonListening, t as PortalDaemon } from "./daemon-DfMgVlYE.mjs";
+
+export { runPortalDaemon };