skydive-cli 0.3.0 → 0.4.0

package/dist/js/bin.mjs

@@ -1,11 +1,12 @@
 #!/usr/bin/env node
-import { C as setActiveWorkspace, S as listWorkspaces, T as version, _ as themes, b as getActiveWorkspaceId, o as brandHelpArt, t as installCrashHandler, w as name, x as getSessionIdentity, y as ensureActiveOrganization } from "./install-CMYBFvR2.mjs";
-import { A as resolveAppUrl, C as getPromptHistoryPath, D as getStoredApiKeyId, E as getShareMachineDefault, F as saveConfig, I as saveSession, M as resolveManagementAuth, N as resolveSession, O as getStoredApiKeyWorkspaceName, R as setLastSeenVersion, S as getLastSeenVersion, _ as API_KEY_PREFIX, b as deleteConfig, g as API_KEY_FAMILY_PREFIX, h as API_KEYS_URL, i as resolveAgent, j as resolveConfig, k as getUpdateCheckDisabled, v as DEFAULT_API_URL, x as getConfigPath } from "./print-Cd-bVSEJ.mjs";
+import { C as setActiveWorkspace, S as listWorkspaces, T as version, _ as themes, b as getActiveWorkspaceId, o as brandHelpArt, t as installCrashHandler, w as name, x as getSessionIdentity, y as ensureActiveOrganization } from "./install-Ba-UTi-l.mjs";
+import { A as getStoredApiKeyWorkspaceName, C as getLastSeenVersion, F as resolveManagementAuth, I as resolveSession, M as resolveAppUrl, N as resolveChatAuth, O as getShareMachineDefault, P as resolveConfig, R as saveConfig, S as getConfigPath, T as getPromptHistoryPath, V as setLastSeenVersion, _ as API_KEY_PREFIX, b as PREFERENCES, g as API_KEY_FAMILY_PREFIX, h as API_KEYS_URL, i as resolveAgent, j as getUpdateCheckDisabled, k as getStoredApiKeyId, v as DEFAULT_API_URL, w as getPreference, x as deleteConfig, z as saveSession } from "./print-X2N5wJ5l.mjs";
 import { n as printError, r as printTable, t as output } from "./output-DYzzdXYV.mjs";
-import { n as createRestClient, t as HttpError } from "./rest-BlN_uWmL.mjs";
-import { a as registerPortalDevice, i as grantPortalAccess, n as fetchPortalDevices, o as revokePortalAccess, r as findThisDevice, s as machineIdentity } from "./client-Dc7GZ3PG.mjs";
-import { c as PORTAL_DAEMON_FLAG, i as queryDaemonStatus, l as daemonPaths, n as ensureDaemonRunning, o as stopDaemon } from "./daemon-Co4CtpXZ.mjs";
-import { t as SandboxStream } from "./client-DfcJFEbh.mjs";
+import { n as createRestClient, t as HttpError } from "./rest-imDZZGQA.mjs";
+import "./billing-blocked-CwfG1BTR.mjs";
+import { a as registerPortalDevice, i as grantPortalAccess, n as fetchPortalDevices, o as revokePortalAccess, r as findThisDevice, s as machineIdentity } from "./client-CKzK-12y.mjs";
+import { c as PORTAL_DAEMON_FLAG, i as queryDaemonStatus, l as daemonPaths, n as ensureDaemonRunning, o as stopDaemon } from "./daemon-CaFz7Wtw.mjs";
+import { t as SandboxStream } from "./client-D8s9vY4p.mjs";
 import { hideBin } from "yargs/helpers";
 import yargs from "yargs";
 import os, { hostname } from "node:os";
@@ -72,31 +73,24 @@ var SkydiveApiClient = class {
 		this.authKind = config.kind;
 	}
 	/**
-	* List agents in the caller's workspace, following the server's cursor
-	* until `limit` is satisfied. The endpoint caps one page at
-	* {@link MAX_AGENT_PAGE}, so a larger limit takes several requests —
-	* callers just ask for what they want. `hasMore` reports whether the
-	* roster continues past what was returned.
+	* List one page of agents in the caller's workspace. The server caps a
+	* page at {@link MAX_AGENT_PAGE}, so `limit` is clamped to that. Callers
+	* page forward by passing the returned `nextCursor` back in as `cursor`;
+	* `nextCursor` is null once the roster is exhausted.
 	*/
 	async listAgents(params) {
-		const agents = [];
-		let cursor = null;
-		do {
-			const query = new URLSearchParams({ limit: String(Math.min(MAX_AGENT_PAGE, params.limit - agents.length)) });
-			if (params.scope) query.set("scope", params.scope);
-			if (cursor) query.set("cursor", cursor);
-			const page = await this.request({
-				method: "GET",
-				path: `/agents?${query.toString()}`,
-				schema: ListAgentsResponseSchema
-			});
-			if (page.isErr()) return err(page.error);
-			agents.push(...page.value.agents);
-			cursor = page.value.nextCursor;
-		} while (cursor && agents.length < params.limit);
+		const query = new URLSearchParams({ limit: String(Math.min(MAX_AGENT_PAGE, params.limit)) });
+		if (params.scope) query.set("scope", params.scope);
+		if (params.cursor) query.set("cursor", params.cursor);
+		const page = await this.request({
+			method: "GET",
+			path: `/agents?${query.toString()}`,
+			schema: ListAgentsResponseSchema
+		});
+		if (page.isErr()) return err(page.error);
 		return ok({
-			agents,
-			hasMore: cursor !== null
+			agents: page.value.agents,
+			nextCursor: page.value.nextCursor
 		});
 	}
 	async getAgent(id) {
@@ -1047,22 +1041,29 @@ function requireManagementClient(argv) {
 }
 /** Resolve the session (see {@link requireSession}) and build a REST client. */
 function requireRestClient(argv) {
-	const session = requireSession(argv);
+	const auth = resolveChatAuth({ appUrl: resolveAppUrl({ appUrl: argv["api-url"] }) });
+	if (auth.isErr()) {
+		printError(`${auth.error.message} Run \`skydive auth login\` first, or set SKYDIVE_API_KEY / SKYDIVE_SESSION_TOKEN.`);
+		process.exit(1);
+	}
 	return createRestClient({
-		appUrl: session.appUrl,
-		sessionToken: session.sessionToken
+		appUrl: auth.value.appUrl,
+		sessionToken: auth.value.token
 	});
 }
 
 //#endregion
 //#region src/commands/agents.ts
-const listCommand$4 = {
+const listCommand$5 = {
 	command: "list",
 	describe: "List agents in the active workspace",
 	builder: (y) => y.option("limit", {
 		type: "number",
 		default: 20,
-		describe: "Max results"
+		describe: "Results per page"
+	}).option("cursor", {
+		type: "string",
+		describe: "Page token from a previous list to fetch the next page"
 	}).option("scope", {
 		type: "string",
 		choices: ["mine", "org"],
@@ -1071,15 +1072,19 @@ const listCommand$4 = {
 	handler: async (argv) => {
 		const result = await requireManagementClient(argv).listAgents({
 			limit: argv.limit,
-			scope: argv.scope ?? null
+			scope: argv.scope ?? null,
+			cursor: argv.cursor
 		});
 		if (result.isErr()) {
 			printError(result.error.message);
 			process.exit(1);
 		}
-		const { agents, hasMore } = result.value;
+		const { agents, nextCursor } = result.value;
 		if (argv.json) {
-			output(argv, agents);
+			output(argv, {
+				agents,
+				nextCursor
+			});
 			return;
 		}
 		if (agents.length === 0) {
@@ -1088,7 +1093,7 @@ const listCommand$4 = {
 		}
 		const { headers, rows } = buildAgentTable(agents);
 		printTable(headers, rows);
-		if (hasMore && !argv.quiet) console.log(`\nShowing the ${agents.length} newest. Raise --limit to see more.`);
+		if (nextCursor && !argv.quiet) console.log(`\nMore results. Next page: --cursor ${nextCursor}`);
 	}
 };
 const DESCRIPTION_MAX = 48;
@@ -1131,7 +1136,7 @@ function truncate(value, max) {
 	if (trimmed.length <= max) return trimmed || "-";
 	return `${trimmed.slice(0, max - 1)}\u2026`;
 }
-const getCommand$1 = {
+const getCommand$2 = {
 	command: "get <id>",
 	describe: "Get agent details",
 	builder: (y) => y.positional("id", {
@@ -1201,7 +1206,7 @@ const createCommand$1 = {
 const agentsCommand = {
 	command: "agents",
 	describe: "Manage agents",
-	builder: (y) => y.command(listCommand$4).command(getCommand$1).command(createCommand$1).demandCommand(1, "Specify a subcommand: list, get, create"),
+	builder: (y) => y.command(listCommand$5).command(getCommand$2).command(createCommand$1).demandCommand(1, "Specify a subcommand: list, get, create"),
 	handler: () => {}
 };
 
@@ -1500,7 +1505,7 @@ const importCommand = {
 				process.exit(1);
 			}
 		}
-		const { runChat } = await import("./boot-HAgDg_b4.mjs");
+		const { runChat } = await import("./boot-on5ucI_Z.mjs");
 		await runChat({
 			appUrl,
 			sessionToken: session.value.sessionToken,
@@ -1527,7 +1532,7 @@ async function runImportPrintMode({ argv, appUrl }) {
 		printError(`${session.error.message} For non-interactive use, run \`skydive auth login --web\` first, or set SKYDIVE_SESSION_TOKEN.`);
 		process.exit(1);
 	}
-	const { connectMachineShare } = await import("./print-share-7qfpQtWK.mjs");
+	const { connectMachineShare } = await import("./print-share-D72CfWJk.mjs");
 	const machineShare = await connectMachineShare({
 		appUrl,
 		sessionToken: session.value.sessionToken,
@@ -1535,7 +1540,7 @@ async function runImportPrintMode({ argv, appUrl }) {
 	});
 	const extra = (argv.print ?? "").trim();
 	const prompt = buildImportSeedPrompt(process.cwd()) + (extra ? `\n\nAdditional instructions: ${extra}` : "");
-	const { runPrint } = await import("./print-CPCFci60.mjs");
+	const { runPrint } = await import("./print-BXNq9UxE.mjs");
 	try {
 		const result = await runPrint({
 			appUrl,
@@ -1559,7 +1564,7 @@ async function runImportPrintMode({ argv, appUrl }) {
 
 //#endregion
 //#region src/commands/keys.ts
-const listCommand$3 = {
+const listCommand$4 = {
 	command: "list",
 	describe: "List API keys for an agent",
 	handler: async (argv) => {
@@ -1648,7 +1653,7 @@ const keysCommand = {
 		type: "string",
 		demandOption: true,
 		describe: "Agent ID"
-	}).command(listCommand$3).command(createCommand).command(revokeCommand$1).demandCommand(1, "Specify a subcommand: list, create, revoke"),
+	}).command(listCommand$4).command(createCommand).command(revokeCommand$1).demandCommand(1, "Specify a subcommand: list, create, revoke"),
 	handler: () => {}
 };
 
@@ -1660,7 +1665,7 @@ async function readStdin() {
 	for await (const chunk of process.stdin) chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
 	return Buffer.concat(chunks).toString("utf8").replace(/\n$/, "");
 }
-const listCommand$2 = {
+const listCommand$3 = {
 	command: "list",
 	describe: "List secret names for an agent (values are never shown)",
 	handler: async (argv) => {
@@ -1681,7 +1686,7 @@ const listCommand$2 = {
 		printTable(["Name"], keys.map((k) => [k]));
 	}
 };
-const setCommand = {
+const setCommand$1 = {
 	command: "set <key> [value]",
 	describe: "Set (create or overwrite) a secret. Reads value from stdin if omitted.",
 	builder: (y) => y.positional("key", {
@@ -1746,7 +1751,7 @@ const secretsCommand = {
 		type: "string",
 		demandOption: true,
 		describe: "Agent ID"
-	}).command(listCommand$2).command(setCommand).command(rmCommand).demandCommand(1, "Specify a subcommand: list, set, rm"),
+	}).command(listCommand$3).command(setCommand$1).command(rmCommand).demandCommand(1, "Specify a subcommand: list, set, rm"),
 	handler: () => {}
 };
 
@@ -1885,10 +1890,10 @@ const chatCommand = {
 			printError(`chat needs the Bun runtime and it couldn't be set up automatically (no network, an unsupported platform, or a failed download). Install Bun (https://bun.sh) and run chat under it, e.g. \`bun ${process.argv[1] ?? "skydive"} chat\`, or point SKYDIVE_BUN_PATH at an existing bun binary. For a non-interactive one-shot that runs under Node, use \`chat -p "<prompt>"\`.`);
 			process.exit(1);
 		}
-		let session = resolveSession({ appUrl });
-		if (session.isErr()) {
+		let auth = resolveChatAuth({ appUrl });
+		if (auth.isErr()) {
 			if (isNonInteractive()) {
-				printError("Not signed in for chat and no interactive terminal. Run `skydive auth login`, or set SKYDIVE_SESSION_TOKEN.");
+				printError("Not signed in and no interactive terminal. Run `skydive auth login`, or set SKYDIVE_API_KEY / SKYDIVE_SESSION_TOKEN.");
 				process.exit(1);
 			}
 			const login = await loginWithDevice({ appUrl });
@@ -1896,8 +1901,8 @@ const chatCommand = {
 				printError(login.error.message);
 				process.exit(1);
 			}
-			session = resolveSession({ appUrl });
-			if (session.isErr()) {
+			auth = resolveChatAuth({ appUrl });
+			if (auth.isErr()) {
 				printError("Signed in, but no session was stored.");
 				process.exit(1);
 			}
@@ -1909,13 +1914,14 @@ const chatCommand = {
 		}
 		await ensureAgentWorkspace({
 			appUrl,
-			sessionToken: session.value.sessionToken,
+			sessionToken: auth.value.token,
 			agentSelector: argv.agent ?? null
 		});
-		const { runChat } = await import("./boot-HAgDg_b4.mjs");
+		const { runChat } = await import("./boot-on5ucI_Z.mjs");
 		await runChat({
-			appUrl,
-			sessionToken: session.value.sessionToken,
+			appUrl: auth.value.appUrl,
+			sessionToken: auth.value.token,
+			authKind: auth.value.kind,
 			shareMachine: resolveShareMachine(argv),
 			promptHistoryPath: getPromptHistoryPath(),
 			theme: themeId,
@@ -1973,15 +1979,15 @@ async function ensureAgentWorkspace({ appUrl, sessionToken, agentSelector }) {
 	process.exit(1);
 }
 async function runPrintMode({ argv, appUrl }) {
-	const session = resolveSession({ appUrl });
-	if (session.isErr()) {
-		printError(`${session.error.message} For non-interactive use, run \`skydive auth login\` first, or set SKYDIVE_SESSION_TOKEN.`);
+	const auth = resolveChatAuth({ appUrl });
+	if (auth.isErr()) {
+		printError(`${auth.error.message} For non-interactive use, run \`skydive auth login\` first, or set SKYDIVE_API_KEY / SKYDIVE_SESSION_TOKEN.`);
 		process.exit(1);
 	}
-	const { runPrint, readStdin } = await import("./print-CPCFci60.mjs");
+	const { runPrint, readStdin } = await import("./print-BXNq9UxE.mjs");
 	await ensureAgentWorkspace({
 		appUrl,
-		sessionToken: session.value.sessionToken,
+		sessionToken: auth.value.token,
 		agentSelector: argv.agent ?? null
 	});
 	let prompt = (argv.print ?? "").trim();
@@ -1997,18 +2003,23 @@ async function runPrintMode({ argv, appUrl }) {
 		}
 	}
 	let machineShare = null;
-	if (resolveShareMachine(argv)) {
-		const { connectMachineShare } = await import("./print-share-7qfpQtWK.mjs");
+	if (resolveShareMachine(argv)) if (auth.value.kind === "api-key") {
+		if (argv["share-machine"] === true) {
+			printError("Machine sharing needs a browser session (API keys cannot grant local access). Run `skydive auth login --web` first, or re-run with --no-share-machine.");
+			process.exit(1);
+		}
+	} else {
+		const { connectMachineShare } = await import("./print-share-D72CfWJk.mjs");
 		machineShare = await connectMachineShare({
-			appUrl,
-			sessionToken: session.value.sessionToken,
+			appUrl: auth.value.appUrl,
+			sessionToken: auth.value.token,
 			timeoutHint: "Re-run with --no-share-machine (or unset `shareMachineDefault` in the CLI config), or check `skydive portal status`."
 		});
 	}
 	try {
 		const result = await runPrint({
-			appUrl,
-			sessionToken: session.value.sessionToken,
+			appUrl: auth.value.appUrl,
+			sessionToken: auth.value.token,
 			prompt,
 			agentSelector: argv.agent ?? null,
 			conversationId: argv.conversation ?? null,
@@ -2018,6 +2029,12 @@ async function runPrintMode({ argv, appUrl }) {
 		});
 		if (argv.json) output(argv, result);
 	} catch (error) {
+		const { BillingBlockedError, BILLING_BLOCKED_EXIT_CODE, billingBlockedJsonResult } = await import("./billing-blocked-euid6MN9.mjs");
+		if (error instanceof BillingBlockedError) {
+			if (argv.json) output(argv, billingBlockedJsonResult(error, null));
+			printError(error.message);
+			process.exit(BILLING_BLOCKED_EXIT_CODE);
+		}
 		printError(error instanceof Error ? error.message : String(error));
 		process.exit(1);
 	} finally {
@@ -2042,7 +2059,7 @@ async function runPrintMode({ argv, appUrl }) {
 * Message ids are the currency of this API: `chat -p --json` reports the
 * `messageId` and this command consumes it. Run ids stay server-side.
 */
-const getCommand = {
+const getCommand$1 = {
 	command: "get <message-id>",
 	describe: "Fetch a message by id and print the reply (recovers a timed-out -p)",
 	builder: (y) => y.positional("message-id", {
@@ -2051,22 +2068,27 @@ const getCommand = {
 		describe: "Message id (the `messageId` from a prior `chat -p --json`)"
 	}),
 	handler: async (argv) => {
-		const appUrl = resolveAppUrl({ appUrl: argv["api-url"] });
-		const session = resolveSession({ appUrl });
-		if (session.isErr()) {
-			printError(`${session.error.message} Run \`skydive auth login\` first, or set SKYDIVE_SESSION_TOKEN.`);
+		const auth = resolveChatAuth({ appUrl: resolveAppUrl({ appUrl: argv["api-url"] }) });
+		if (auth.isErr()) {
+			printError(`${auth.error.message} Run \`skydive auth login\` first, or set SKYDIVE_API_KEY / SKYDIVE_SESSION_TOKEN.`);
 			process.exit(1);
 		}
-		const { messageGet } = await import("./print-CPCFci60.mjs");
+		const { messageGet } = await import("./print-BXNq9UxE.mjs");
 		try {
 			const result = await messageGet({
-				appUrl,
-				sessionToken: session.value.sessionToken,
+				appUrl: auth.value.appUrl,
+				sessionToken: auth.value.token,
 				messageId: argv["message-id"],
 				json: argv.json
 			});
 			if (argv.json) output(argv, result);
 		} catch (error) {
+			const { BillingBlockedError, BILLING_BLOCKED_EXIT_CODE, billingBlockedJsonResult } = await import("./billing-blocked-euid6MN9.mjs");
+			if (error instanceof BillingBlockedError) {
+				if (argv.json) output(argv, billingBlockedJsonResult(error, argv["message-id"]));
+				printError(error.message);
+				process.exit(BILLING_BLOCKED_EXIT_CODE);
+			}
 			printError(error instanceof Error ? error.message : String(error));
 			process.exit(1);
 		}
@@ -2075,7 +2097,7 @@ const getCommand = {
 const messagesCommand = {
 	command: "messages",
 	describe: "Inspect chat messages and re-fetch agent replies",
-	builder: (y) => y.command(getCommand).demandCommand(1, "Specify a subcommand: get"),
+	builder: (y) => y.command(getCommand$1).demandCommand(1, "Specify a subcommand: get"),
 	handler: () => {}
 };
 
@@ -2098,7 +2120,7 @@ function messageToText(message) {
 	}
 	return chunks.join("\n").trim();
 }
-const listCommand$1 = {
+const listCommand$2 = {
 	command: "list",
 	describe: "List an agent's conversations",
 	builder: (y) => y.option("agent", {
@@ -2188,7 +2210,7 @@ const conversationsCommand = {
 	command: "conversations",
 	aliases: ["conv"],
 	describe: "List and read agent conversations",
-	builder: (y) => y.command(listCommand$1).command(showCommand).demandCommand(1, "Specify a subcommand: list, show"),
+	builder: (y) => y.command(listCommand$2).command(showCommand).demandCommand(1, "Specify a subcommand: list, show"),
 	handler: () => {}
 };
 
@@ -2230,7 +2252,7 @@ async function runList(argv, { hint }) {
 	]));
 	if (hint && !argv.quiet) console.log("\nRun `skydive workspace switch` to pick a workspace, or pass its slug directly.");
 }
-const listCommand = {
+const listCommand$1 = {
 	command: "list",
 	describe: "List workspaces on your account",
 	handler: (argv) => runList(argv, { hint: false })
@@ -2254,7 +2276,7 @@ const switchCommand = {
 				printError("The workspace picker needs the Bun runtime and it could not be set up automatically. Pass a workspace slug instead, or install Bun and retry.");
 				process.exit(1);
 			}
-			const { runWorkspacePicker } = await import("./boot-HAgDg_b4.mjs");
+			const { runWorkspacePicker } = await import("./boot-on5ucI_Z.mjs");
 			await runWorkspacePicker(session);
 			return;
 		}
@@ -2287,7 +2309,7 @@ const switchCommand = {
 const workspaceCommand = {
 	command: "workspace",
 	describe: "List or switch the workspace all `skydive` commands act on",
-	builder: (y) => y.command(listCommand).command(switchCommand),
+	builder: (y) => y.command(listCommand$1).command(switchCommand),
 	handler: (argv) => runList(argv, { hint: true })
 };
 
@@ -2332,7 +2354,7 @@ const openCommand = {
 		const agent = argv.agent ? resolveAgent((await fetchPortalDevices(session)).agents, argv.agent) : null;
 		const cwd = argv.cwd ? path.resolve(argv.cwd) : process.cwd();
 		const { machineName } = machineIdentity();
-		const { PortalClient } = await import("./client-DuwxEDG4.mjs");
+		const { PortalClient } = await import("./client-D6apKmV0.mjs");
 		let lastLine = "";
 		let signalConnected;
 		const connected = new Promise((resolve) => {
@@ -2605,8 +2627,8 @@ const sandboxCommand = {
 	}).example("skydive sandbox --agent grace", "Live terminal (Ctrl-] detaches)").example("skydive sandbox --agent grace -- tail -n 50 /tmp/harness.log", "One-shot command (use `--` so its flags reach the sandbox)").example("skydive sandbox --agent grace -- sh -c 'ls /tmp | wc -l'", "Shell features go through an explicit `sh -c`"),
 	handler: async (argv) => {
 		const session = requireSession(argv);
-		const { createRestClient } = await import("./rest-CDTXCmUb.mjs");
-		const { resolveAgent } = await import("./print-CPCFci60.mjs");
+		const { createRestClient } = await import("./rest-Br2eFTlj.mjs");
+		const { resolveAgent } = await import("./print-BXNq9UxE.mjs");
 		const client = createRestClient({
 			appUrl: session.appUrl,
 			sessionToken: session.sessionToken
@@ -2675,7 +2697,7 @@ async function runPty({ session, agentId, agentName }) {
 		return 1;
 	}
 	console.error(`Connecting to ${agentName}'s sandbox… (Ctrl-] detaches)`);
-	const { runRawPtyPassthrough } = await import("./raw-pty-ChUHav4d.mjs");
+	const { runRawPtyPassthrough } = await import("./raw-pty-t5DC-e1T.mjs");
 	const result = await runRawPtyPassthrough({
 		stdin: process.stdin,
 		stdout: process.stdout,
@@ -3356,10 +3378,146 @@ const updateCommand = {
 	}
 };
 
+//#endregion
+//#region src/commands/config.ts
+/**
+* Resolve a preference key or exit 1 with a clear message. `choices` on each
+* positional already rejects unknown keys through yargs' own validation
+* (routing to the top-level `.fail()` handler), so this is a defensive guard
+* that also narrows the type. It follows the CLI's convention of
+* `printError` + `process.exit(1)` rather than throwing, because a throw from
+* an async yargs handler rejects `parseAsync` instead of being caught by
+* `.fail()`. `process.exit` returns `never`, so callers can treat the result
+* as always defined.
+*/
+function resolvePreference(key) {
+	const pref = getPreference(key ?? "");
+	if (!pref) {
+		printError(`Unknown preference "${key}". Run \`skydive config list\` to see editable keys.`);
+		process.exit(1);
+	}
+	return pref;
+}
+/** One row's worth of state for a preference, used by `list` and `get`. */
+function snapshot(pref) {
+	return {
+		key: pref.key,
+		value: pref.read(),
+		source: pref.isSet() ? "set" : "default",
+		describe: pref.describe
+	};
+}
+const listCommand = {
+	command: "list",
+	aliases: ["ls"],
+	describe: "Show every editable preference, its value, and its source",
+	handler: (argv) => {
+		const rows = PREFERENCES.map(snapshot);
+		if (argv.json) {
+			output(argv, rows);
+			return;
+		}
+		printTable([
+			"Key",
+			"Value",
+			"Source",
+			"Description"
+		], rows.map((r) => [
+			r.key,
+			String(r.value),
+			r.source,
+			r.describe
+		]));
+	}
+};
+const getCommand = {
+	command: "get <key>",
+	describe: "Print the effective value of one preference",
+	builder: (y) => y.positional("key", {
+		type: "string",
+		demandOption: true,
+		choices: PREFERENCES.map((p) => p.key),
+		describe: "Preference key"
+	}),
+	handler: (argv) => {
+		const pref = resolvePreference(argv.key);
+		if (argv.json) {
+			output(argv, snapshot(pref));
+			return;
+		}
+		console.log(String(pref.read()));
+	}
+};
+const setCommand = {
+	command: "set <key> <value>",
+	describe: "Set a preference (e.g. `config set updateCheck false`)",
+	builder: (y) => y.positional("key", {
+		type: "string",
+		demandOption: true,
+		choices: PREFERENCES.map((p) => p.key),
+		describe: "Preference key"
+	}).positional("value", {
+		type: "string",
+		demandOption: true,
+		describe: "New value"
+	}),
+	handler: (argv) => {
+		const pref = resolvePreference(argv.key);
+		const parsed = pref.parse(argv.value ?? "");
+		if (parsed.isErr()) {
+			printError(`${pref.key}: ${parsed.error}`);
+			process.exit(1);
+		}
+		pref.write(parsed.value);
+		if (argv.json) {
+			output(argv, snapshot(pref));
+			return;
+		}
+		if (!argv.quiet) console.log(`Set ${pref.key} = ${String(parsed.value)}`);
+	}
+};
+const unsetCommand = {
+	command: "unset <key>",
+	aliases: ["reset"],
+	describe: "Remove a preference, reverting it to the built-in default",
+	builder: (y) => y.positional("key", {
+		type: "string",
+		demandOption: true,
+		choices: PREFERENCES.map((p) => p.key),
+		describe: "Preference key"
+	}),
+	handler: (argv) => {
+		const pref = resolvePreference(argv.key);
+		pref.clear();
+		if (argv.json) {
+			output(argv, snapshot(pref));
+			return;
+		}
+		if (!argv.quiet) console.log(`Unset ${pref.key} (now ${String(pref.read())} by default)`);
+	}
+};
+const pathCommand = {
+	command: "path",
+	describe: "Print the on-disk config file path",
+	handler: (argv) => {
+		if (argv.json) {
+			output(argv, { path: getConfigPath() });
+			return;
+		}
+		console.log(getConfigPath());
+	}
+};
+const configCommand = {
+	command: "config",
+	describe: "View and set CLI preferences (safe, hand-editable keys only)",
+	builder: (y) => y.command(listCommand).command(getCommand).command(setCommand).command(unsetCommand).command(pathCommand),
+	handler: (argv) => listCommand.handler(argv)
+};
+
 //#endregion
 //#region src/cli.ts
 function createCli(argv) {
-	return yargs(argv).scriptName("skydive").usage("$0 <command> [options]").parserConfiguration({ "populate--": true }).example("skydive auth login", "Store your API key").example("skydive chat", "Open the interactive chat TUI (prod)").example("skydive chat --api-url http://localhost:4500", "Chat against a local dev API").example("skydive agents list", "List your agents").example("skydive completion install", "Set up TAB completion for your shell").example("skydive keys create \"my-key\"", "Create an API key").example("skydive secrets set OPENAI_API_KEY --agent-id <id>", "Set a secret (value from stdin)").example("skydive workspace list", "List workspaces on your account").example("skydive workspace switch acme-team", "Switch the workspace all `skydive` commands act on").example("skydive portal open --agent grace", "Open the portal to this machine for an agent, headless (no TUI)").option("json", {
+	return yargs(argv).scriptName("skydive").usage("$0 <command> [options]").parserConfiguration({ "populate--": true }).example("skydive auth login", "Store your API key").example("skydive chat", "Open the interactive chat TUI (prod)").example("skydive chat --api-url http://localhost:4500", "Chat against a local dev API").example("skydive agents list", "List your agents").example("skydive completion install", "Set up TAB completion for your shell").example("skydive keys create \"my-key\"", "Create an API key").example("skydive secrets set OPENAI_API_KEY --agent-id <id>", "Set a secret (value from stdin)").example("skydive workspace list", "List workspaces on your account").example("skydive config set updateCheck false", "Disable the daily update check").example("skydive workspace switch acme-team", "Switch the workspace all `skydive` commands act on").example("skydive portal open --agent grace", "Open the portal to this machine for an agent, headless (no TUI)").option("json", {
 		type: "boolean",
 		default: false,
 		global: true,
@@ -3373,7 +3531,7 @@ function createCli(argv) {
 		type: "string",
 		global: true,
 		describe: "Override API base URL"
-	}).command(authCommand).command(chatCommand).command(messagesCommand).command(conversationsCommand).command(agentsCommand).command(importCommand).command(keysCommand).command(secretsCommand).command(workspaceCommand).command(portalCommand).command(sandboxCommand).command(updateCommand).command(completionCommand).demandCommand(1, "Specify a command. Run --help for usage.").strict().wrap(null).version(version).alias("v", "version").alias("h", "help").help().fail((msg, err) => {
+	}).command(authCommand).command(chatCommand).command(messagesCommand).command(conversationsCommand).command(agentsCommand).command(importCommand).command(keysCommand).command(secretsCommand).command(workspaceCommand).command(portalCommand).command(sandboxCommand).command(updateCommand).command(configCommand).command(completionCommand).demandCommand(1, "Specify a command. Run --help for usage.").strict().wrap(null).version(version).alias("v", "version").alias("h", "help").help().fail((msg, err) => {
 		printError(err ? err instanceof Error ? err.message : String(err) : msg ?? "Unknown error");
 		process.exit(1);
 	});
@@ -3586,7 +3744,7 @@ function setupUpdateCheck(argv) {
 
 //#endregion
 //#region src/changelog.generated.ts
-const CHANGELOG_MD = "# Changelog\n\nAll notable changes to the Skydive CLI are documented here.\n\nThe format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),\nand this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).\n\n## [Unreleased]\n\n## [0.3.0] - 2026-08-04\n\n### Added\n\n**Chat TUI**\n\n- `/fork` slash command to fork a conversation at any point and continue in a new thread.\n- `/conversation` switches threads from inside a live session.\n- `/compact` triggers manual conversation compaction.\n- `/portal` and `/copy` slash commands.\n- Archive the current conversation from the chat TUI.\n- `--new` flag on `skydive chat` to start a fresh conversation.\n- Debounced server-side conversation search in the picker, with title matches ranked first.\n- File review pane orientation toggle, and review comments in the file pane.\n- Pinned plan card controls and a jump-to-latest hint.\n- Terminal title (OSC) follows the live conversation title on every screen; inside cmux the workspace is renamed too, and linked PRs are pushed to the cmux sidebar.\n- Every participating agent shows in the conversation list; connect cards each have their own identity, and ctrl+r asks which connect card to act on.\n- Colored Skydive splash art in `skydive --help` and the TUI pickers.\n- New-agent name prefilled from the server's suggestion.\n\n**CLI & platform**\n\n- `skydive update` self-updater, with an update notice when a new version is available.\n- Shell completions for bash, zsh, and fish via `completion install`.\n- Portal daemon: one connection per host with per-conversation working directories.\n- Agent-led coding-agent import (`skydive import`).\n- Per-workspace scoping on the REST client, and cross-org `--agent <uuid>` auto-switches workspace.\n- `skydive-beta` wrapper for the canary channel.\n\n### Fixed\n\n- `skydive update` no longer claims an update is available on every npm install.\n- Chat memory is bounded (payload clamps + windowed rows) with a memory watchdog and OOM diagnostic report; transcript rows are memoized so streaming stops re-rendering the whole chat.\n- Chat-send failures map to real error messages.\n- Notification and sidebar previews use the last text block of the reply and strip inline markdown.\n- Picker rows no longer overlap when a conversation title contains a newline, tab, or control character.\n- Sending to non-web channel conversations is blocked in the TUI.\n- GitHub bot connect opens on the web front door, not api.skydive.com.\n- TUI activity counter times from the run, not the screen.\n\n## [0.2.0] - 2026-07-29\n\n### Added\n\n**Sandbox & machine access**\n\n- Standalone `skydive sandbox` command for direct access to an agent's sandbox.\n- `/sandbox` in the chat TUI — live PTY session and one-shot command execution.\n- Headless machine sharing via `skydive portal`, with self-registering portal grants.\n- `shareMachineDefault` config key for always-on portal sharing.\n\n**Chat TUI**\n\n- File pane (`ctrl+g`) with Changes and Files tabs: a shared file tree plus source viewer and a workspace browser, mouse-resizable and responsive to terminal size.\n- Agent todo list rendered in the chat TUI, above the composer, mirroring the web chat's todo card.\n- Fuzzy finder in the conversation and agent pickers.\n- Slash-command autocomplete menu.\n- Paste or drag-and-drop any file into the composer; paste clipboard images with Cmd+V.\n- Run local shell commands with `!` in the composer.\n- Conversation recaps, streamed live title updates, and per-agent attribution on assistant turns.\n- Working timer rolls up into minutes and hours.\n- Conversation picker paginates past 50 conversations and shows only your own conversations.\n- Esc leaves a live run; typing `exit` quits the chat.\n- Cursor Dark theme.\n- Picker rows no longer overlap when a conversation title contains a newline, tab, or control character.\n\n**Headless & scripting**\n\n- Resume a conversation by id.\n- `conversations list` and `conversations show` for transcript reads.\n- `messages get`, with run recovery keyed on message id.\n- Connect cards surface in headless `-p` mode so a driving agent never gets stuck.\n\n**Authentication**\n\n- `skydive auth login` via the browser now auto-mints an API key, so one login yields both a chat session and a usable management credential. Management commands announce the key's pinned workspace when it drives them, so a workspace mismatch is visible at use time.\n- Workspace picker on the device authorization page.\n- Account and workspace identity shown in `auth status`.\n\n**Platform**\n\n- Standalone binary builds compiling the CLI into a per-target executable.\n- Interactive workspace switcher; management commands follow the active workspace.\n- Terminal host integrations and agent notifications.\n\n### Fixed\n\n- Transcript errors collapse to one line, click to expand (REST and portal errors keep their full body).\n- Dragged/pasted image file paths attach the file instead of inserting path text, including macOS paths with literal parentheses.\n- Bare URLs in chat markdown are hyperlinked so they survive text wrap.\n- Composer draft is preserved across TUI overlays.\n- Relative connect links resolve before opening the browser.\n- Numbered markdown headings render colored in the TUI.\n- Chat transcript pages by 75% of a screen; picker rows stay on one line.\n- Run starts push to the TUI over the conversation stream.\n- Security: remediated high-severity dependency findings and cleared tar/shell-quote CVEs.\n\n## [0.1.0] - 2026-07-21\n\nInitial public release: `skydive chat` TUI, agent and conversation management,\ndevice authorization, and headless `-p` mode.\n";
+const CHANGELOG_MD = "# Changelog\n\nAll notable changes to the Skydive CLI are documented here.\n\nThe format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),\nand this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).\n\n## [Unreleased]\n\n## [0.4.0] - 2026-08-07\n\n### Added\n\n- `skydive chat` works with API key auth: an API key alone now opens the chat TUI (and headless `chat -p`) without a browser login, using the key's pinned workspace.\n- `skydive config` command to view and set the safe, hand-editable CLI preferences (`shareMachineDefault`, `updateCheck`) without opening `config.json`. `config`/`config list` shows each key, its effective value, and whether it comes from the file or the built-in default; `config get`/`set`/`unset` read and change one key; `config path` prints the config file location. It only ever touches those preference keys, never credentials or flow-managed state.\n- Billing-blocked sends and runs now surface the server-authored recovery\n  guidance from the typed billing outcome. The chat TUI renders it as a\n  warning-toned system-notice row — live when a send is refused or a run is\n  stopped at the billing boundary, and again when reopening a conversation\n  that holds a persisted billing notice — instead of a generic error.\n  Headless `chat -p` and `messages get` print the guidance (state, recovery\n  step, and manage-billing URL) on stderr, keep any partial output already\n  streamed on stdout, and exit with code `5` (distinct from the generic `1`)\n  so scripted callers can tell a billing pause from a failure.\n- Syntax highlighting for 14 more languages in the chat transcript and file/review panes (python, bash, go, rust, c, cpp, java, ruby, css, html, json, yaml, and more) — previously only JavaScript/TypeScript rendered colored.\n\n### Changed\n\n- `skydive agent list` lists the full agent roster by default instead of a truncated page.\n\n### Fixed\n\n- Long multi-line bash tool-call commands (e.g. heredocs) are clamped with a `+N more · click to expand` tail instead of dumping their whole body into the scrollback.\n- Tool error output is clipped the same way as ok output, so a failing command no longer floods the transcript.\n- The TUI toast overlay has an opaque background instead of letting the transcript bleed through.\n\n## [0.3.0] - 2026-08-04\n\n### Added\n\n**Chat TUI**\n\n- `/fork` slash command to fork a conversation at any point and continue in a new thread.\n- `/conversation` switches threads from inside a live session.\n- `/compact` triggers manual conversation compaction.\n- `/portal` and `/copy` slash commands.\n- Archive the current conversation from the chat TUI.\n- `--new` flag on `skydive chat` to start a fresh conversation.\n- Debounced server-side conversation search in the picker, with title matches ranked first.\n- File review pane orientation toggle, and review comments in the file pane.\n- Pinned plan card controls and a jump-to-latest hint.\n- Terminal title (OSC) follows the live conversation title on every screen; inside cmux the workspace is renamed too, and linked PRs are pushed to the cmux sidebar.\n- Every participating agent shows in the conversation list; connect cards each have their own identity, and ctrl+r asks which connect card to act on.\n- Colored Skydive splash art in `skydive --help` and the TUI pickers.\n- New-agent name prefilled from the server's suggestion.\n\n**CLI & platform**\n\n- `skydive update` self-updater, with an update notice when a new version is available.\n- Shell completions for bash, zsh, and fish via `completion install`.\n- Portal daemon: one connection per host with per-conversation working directories.\n- Agent-led coding-agent import (`skydive import`).\n- Per-workspace scoping on the REST client, and cross-org `--agent <uuid>` auto-switches workspace.\n- `skydive-beta` wrapper for the canary channel.\n\n### Fixed\n\n- `skydive update` no longer claims an update is available on every npm install.\n- Chat memory is bounded (payload clamps + windowed rows) with a memory watchdog and OOM diagnostic report; transcript rows are memoized so streaming stops re-rendering the whole chat.\n- Chat-send failures map to real error messages.\n- Notification and sidebar previews use the last text block of the reply and strip inline markdown.\n- Picker rows no longer overlap when a conversation title contains a newline, tab, or control character.\n- Sending to non-web channel conversations is blocked in the TUI.\n- GitHub bot connect opens on the web front door, not api.skydive.com.\n- TUI activity counter times from the run, not the screen.\n\n## [0.2.0] - 2026-07-29\n\n### Added\n\n**Sandbox & machine access**\n\n- Standalone `skydive sandbox` command for direct access to an agent's sandbox.\n- `/sandbox` in the chat TUI — live PTY session and one-shot command execution.\n- Headless machine sharing via `skydive portal`, with self-registering portal grants.\n- `shareMachineDefault` config key for always-on portal sharing.\n\n**Chat TUI**\n\n- File pane (`ctrl+g`) with Changes and Files tabs: a shared file tree plus source viewer and a workspace browser, mouse-resizable and responsive to terminal size.\n- Agent todo list rendered in the chat TUI, above the composer, mirroring the web chat's todo card.\n- Fuzzy finder in the conversation and agent pickers.\n- Slash-command autocomplete menu.\n- Paste or drag-and-drop any file into the composer; paste clipboard images with Cmd+V.\n- Run local shell commands with `!` in the composer.\n- Conversation recaps, streamed live title updates, and per-agent attribution on assistant turns.\n- Working timer rolls up into minutes and hours.\n- Conversation picker paginates past 50 conversations and shows only your own conversations.\n- Esc leaves a live run; typing `exit` quits the chat.\n- Cursor Dark theme.\n- Picker rows no longer overlap when a conversation title contains a newline, tab, or control character.\n\n**Headless & scripting**\n\n- Resume a conversation by id.\n- `conversations list` and `conversations show` for transcript reads.\n- `messages get`, with run recovery keyed on message id.\n- Connect cards surface in headless `-p` mode so a driving agent never gets stuck.\n\n**Authentication**\n\n- `skydive auth login` via the browser now auto-mints an API key, so one login yields both a chat session and a usable management credential. Management commands announce the key's pinned workspace when it drives them, so a workspace mismatch is visible at use time.\n- Workspace picker on the device authorization page.\n- Account and workspace identity shown in `auth status`.\n\n**Platform**\n\n- Standalone binary builds compiling the CLI into a per-target executable.\n- Interactive workspace switcher; management commands follow the active workspace.\n- Terminal host integrations and agent notifications.\n\n### Fixed\n\n- Transcript errors collapse to one line, click to expand (REST and portal errors keep their full body).\n- Dragged/pasted image file paths attach the file instead of inserting path text, including macOS paths with literal parentheses.\n- Bare URLs in chat markdown are hyperlinked so they survive text wrap.\n- Composer draft is preserved across TUI overlays.\n- Relative connect links resolve before opening the browser.\n- Numbered markdown headings render colored in the TUI.\n- Chat transcript pages by 75% of a screen; picker rows stay on one line.\n- Run starts push to the TUI over the conversation stream.\n- Security: remediated high-severity dependency findings and cleared tar/shell-quote CVEs.\n\n## [0.1.0] - 2026-07-21\n\nInitial public release: `skydive chat` TUI, agent and conversation management,\ndevice authorization, and headless `-p` mode.\n";
 
 //#endregion
 //#region src/whats-new.ts
@@ -3728,7 +3886,7 @@ if (process.argv.includes(UPDATE_WORKER_FLAG)) {
 	process.exit(0);
 }
 if (process.argv.includes(PORTAL_DAEMON_FLAG)) {
-	const { runPortalDaemon } = await import("./daemon-Ch_MSDmQ.mjs");
+	const { runPortalDaemon } = await import("./daemon-BADmpJAs.mjs");
 	runPortalDaemon(process.argv);
 } else runCli();
 function runCli() {