skydive-cli 0.4.1-beta.5 → 0.5.0-beta.1

package/dist/js/bin.mjs

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
-import { C as ensureActiveOrganization, D as setActiveWorkspace, E as listWorkspaces, O as name, T as getSessionIdentity, a as installCrashHandler, k as version, t as maybeStartProfiling, u as brandHelpArt, w as getActiveWorkspaceId, x as themes } from "./profiler-BoEx7ARj.mjs";
+import { C as ensureActiveOrganization, D as setActiveWorkspace, E as listWorkspaces, O as name, T as getSessionIdentity, a as installCrashHandler, k as version, t as maybeStartProfiling, u as brandHelpArt, w as getActiveWorkspaceId, x as themes } from "./profiler-DHQhmoSF.mjs";
 import { A as getStoredApiKeyWorkspaceName, C as getLastSeenVersion, F as resolveManagementAuth, I as resolveSession, M as resolveAppUrl, N as resolveChatAuth, O as getShareMachineDefault, P as resolveConfig, R as saveConfig, S as getConfigPath, T as getPromptHistoryPath, V as setLastSeenVersion, _ as API_KEY_PREFIX, b as PREFERENCES, g as API_KEY_FAMILY_PREFIX, h as API_KEYS_URL, i as resolveAgent, j as getUpdateCheckDisabled, k as getStoredApiKeyId, v as DEFAULT_API_URL, w as getPreference, x as deleteConfig, z as saveSession } from "./print-CbayCa87.mjs";
 import { n as printError, r as printTable, t as output } from "./output-DYzzdXYV.mjs";
 import { t as HttpError } from "./http-error-DzyrsLAZ.mjs";
 import { t as createRestClient } from "./rest-BY2nADw5.mjs";
 import "./billing-blocked-2wju4gC_.mjs";
-import { a as registerPortalDevice, c as resolveMachineIdentity, i as grantPortalAccess, n as fetchPortalDevices, o as revokePortalAccess, r as findThisDevice } from "./client-DaZyQfQ-.mjs";
-import { i as queryDaemonStatus, l as PORTAL_DAEMON_FLAG, n as ensureDaemonRunning, s as stopDaemon, u as daemonPaths } from "./daemon-DpqP-4tS.mjs";
+import { a as registerPortalDevice, c as resolveMachineIdentity, i as grantPortalAccess, n as fetchPortalDevices, o as revokePortalAccess, r as findThisDevice } from "./client-Dd5sMXPv.mjs";
+import { i as queryDaemonStatus, l as PORTAL_DAEMON_FLAG, n as ensureDaemonRunning, s as stopDaemon, u as daemonPaths } from "./daemon-C6yadKp2.mjs";
 import { t as SandboxStream } from "./client-Cn2af31H.mjs";
 import { hideBin } from "yargs/helpers";
 import yargs from "yargs";
@@ -1516,7 +1516,7 @@ const importCommand = {
 				process.exit(1);
 			}
 		}
-		const { runChat } = await import("./boot-BMxgenOa.mjs");
+		const { runChat } = await import("./boot-BvmABDme.mjs");
 		await runChat({
 			appUrl,
 			sessionToken: session.value.sessionToken,
@@ -1543,7 +1543,7 @@ async function runImportPrintMode({ argv, appUrl }) {
 		printError(`${session.error.message} For non-interactive use, run \`skydive auth login --web\` first, or set SKYDIVE_SESSION_TOKEN.`);
 		process.exit(1);
 	}
-	const { connectMachineShare } = await import("./print-share-Jgn0lqGr.mjs");
+	const { connectMachineShare } = await import("./print-share-C1LPsgTP.mjs");
 	const machineShare = await connectMachineShare({
 		appUrl,
 		sessionToken: session.value.sessionToken,
@@ -1928,7 +1928,7 @@ const chatCommand = {
 			sessionToken: auth.value.token,
 			agentSelector: argv.agent ?? null
 		});
-		const { runChat } = await import("./boot-BMxgenOa.mjs");
+		const { runChat } = await import("./boot-BvmABDme.mjs");
 		await runChat({
 			appUrl: auth.value.appUrl,
 			sessionToken: auth.value.token,
@@ -2020,7 +2020,7 @@ async function runPrintMode({ argv, appUrl }) {
 			process.exit(1);
 		}
 	} else {
-		const { connectMachineShare } = await import("./print-share-Jgn0lqGr.mjs");
+		const { connectMachineShare } = await import("./print-share-C1LPsgTP.mjs");
 		machineShare = await connectMachineShare({
 			appUrl: auth.value.appUrl,
 			sessionToken: auth.value.token,
@@ -2287,7 +2287,7 @@ const switchCommand = {
 				printError("The workspace picker needs the Bun runtime and it could not be set up automatically. Pass a workspace slug instead, or install Bun and retry.");
 				process.exit(1);
 			}
-			const { runWorkspacePicker } = await import("./boot-BMxgenOa.mjs");
+			const { runWorkspacePicker } = await import("./boot-BvmABDme.mjs");
 			await runWorkspacePicker(session);
 			return;
 		}
@@ -2366,7 +2366,7 @@ const openCommand = {
 		const agent = argv.agent ? resolveAgent((await fetchPortalDevices(session)).agents, argv.agent) : null;
 		const cwd = argv.cwd ? path.resolve(argv.cwd) : process.cwd();
 		const { machineName } = await resolveMachineIdentity();
-		const { PortalDaemonClient } = await import("./daemon-client-TQuXEURW.mjs");
+		const { PortalDaemonClient } = await import("./daemon-client-CgziZU3X.mjs");
 		let lastLine = "";
 		let signalConnected;
 		const connected = new Promise((resolve) => {
@@ -4169,7 +4169,7 @@ if (process.argv.includes(UPDATE_WORKER_FLAG)) {
 	process.exit(0);
 }
 if (process.argv.includes(PORTAL_DAEMON_FLAG)) {
-	const { runPortalDaemon } = await import("./daemon-BKVPOhzU.mjs");
+	const { runPortalDaemon } = await import("./daemon-XCciQ1mS.mjs");
 	runPortalDaemon(process.argv);
 } else runCli();
 function runCli() {

package/dist/js/{boot-BMxgenOa.mjs → boot-BvmABDme.mjs}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
-import { D as setActiveWorkspace, E as listWorkspaces, S as themesForMode, _ as themeForMode, a as installCrashHandler, b as themeVersion, c as MARK_CELLS, d as DEFAULT_THEME_ID, f as applyTheme, g as theme, h as noColorRequested, i as writeArtifact, l as WORDMARK, m as monoTheme, n as profilingEnabled, o as buildCrashReport, p as findTheme, r as record, s as writeCrashReport, v as themeMode, w as getActiveWorkspaceId, y as themeModeFromColorFgBg } from "./profiler-BoEx7ARj.mjs";
+import { D as setActiveWorkspace, E as listWorkspaces, S as themesForMode, _ as themeForMode, a as installCrashHandler, b as themeVersion, c as MARK_CELLS, d as DEFAULT_THEME_ID, f as applyTheme, g as theme, h as noColorRequested, i as writeArtifact, l as WORDMARK, m as monoTheme, n as profilingEnabled, o as buildCrashReport, p as findTheme, r as record, s as writeCrashReport, v as themeMode, w as getActiveWorkspaceId, y as themeModeFromColorFgBg } from "./profiler-DHQhmoSF.mjs";
 import { B as saveTheme, D as getSavedTheme, E as getReviewStateDir, L as resolveWebUrl, S as getConfigPath, c as cardActionErrorMessage, d as reconcileMaskedInput, f as resolveConnectUrl, i as resolveAgent, l as parseExternalOauthConnectParams, m as specKeyFor, p as parseConnectCard, s as MASK_CHAR, u as parseOauthConnectParams, v as DEFAULT_API_URL, y as DEFAULT_APP_URL } from "./print-CbayCa87.mjs";
 import { t as HttpError } from "./http-error-DzyrsLAZ.mjs";
 import { a as isRecord, i as errorMessage, n as errorDetail, r as sendErrorMessage, t as createRestClient } from "./rest-BY2nADw5.mjs";
 import { i as billingBlockedOutcomeFromSendResponse } from "./billing-blocked-2wju4gC_.mjs";
-import { t as PortalClient } from "./client-DaZyQfQ-.mjs";
-import "./daemon-DpqP-4tS.mjs";
+import { t as PortalClient } from "./client-Dd5sMXPv.mjs";
+import "./daemon-C6yadKp2.mjs";
 import { t as SandboxStream } from "./client-Cn2af31H.mjs";
-import { t as PortalDaemonClient } from "./daemon-client-F7gX12Mp.mjs";
+import { t as PortalDaemonClient } from "./daemon-client-Rr6PJvRg.mjs";
 import { t as runRawPtyPassthrough } from "./raw-pty-B6mAroiI.mjs";
 import * as os$1 from "node:os";
 import { homedir, platform, release, tmpdir } from "node:os";
@@ -109,6 +109,7 @@ const initialPortalUi = {
 	machineName: null,
 	error: null,
 	grantedAgentIds: [],
+	declinedAgentIds: [],
 	prompt: null
 };
 function initialChatTitle(screen) {
@@ -181,12 +182,13 @@ const useStore = create((set, get) => ({
 		chatTitle: null
 	}),
 	setPortalClient: (portalClient) => set({ portalClient }),
-	syncPortal: ({ status, machineName, error, grantedAgentIds }) => set((state) => ({ portal: {
+	syncPortal: ({ status, machineName, error, grantedAgentIds, declinedAgentIds }) => set((state) => ({ portal: {
 		...state.portal,
 		status,
 		machineName,
 		error,
-		grantedAgentIds
+		grantedAgentIds,
+		declinedAgentIds
 	} })),
 	setPortalPrompt: (prompt) => set((state) => ({ portal: {
 		...state.portal,
@@ -317,14 +319,18 @@ function createPortalClient(opts) {
 	if (portalDaemonDisabled()) {
 		const client = new PortalClient({
 			appUrl: opts.appUrl,
-			sessionToken: opts.sessionToken,
+			credentials: () => ({
+				sessionToken: opts.sessionToken,
+				deviceToken: null
+			}),
 			resolveCwd: () => process.cwd(),
 			onState: (state) => opts.onState({
 				status: state.status,
 				machineName: state.machineName,
 				friendlyName: state.friendlyName,
 				error: state.error,
-				grantedAgentIds: state.grantedAgentIds
+				grantedAgentIds: state.grantedAgentIds,
+				declinedAgentIds: []
 			})
 		});
 		return {
@@ -332,6 +338,9 @@ function createPortalClient(opts) {
 			enable: () => client.enable(),
 			disable: () => client.disable(),
 			grantAgent: (agentId) => client.grantAgent(agentId),
+			decline: (_agentId, declined) => {
+				if (declined && client.grantedAgentIds().length === 0) client.disable();
+			},
 			isGranted: (agentId) => client.isGranted(agentId),
 			bind: () => {},
 			dispose: () => client.dispose()
@@ -370,7 +379,8 @@ function usePortal({ appUrl, sessionToken, shareMachine, enabled = true }) {
 				status: state.status,
 				machineName: state.machineName,
 				error: state.error,
-				grantedAgentIds: state.grantedAgentIds
+				grantedAgentIds: state.grantedAgentIds,
+				declinedAgentIds: state.declinedAgentIds
 			})
 		});
 		setPortalClient(client);
@@ -11255,6 +11265,7 @@ function ChatScreen({ agent, conversation }) {
 		}
 		if (portal.status === "off") {
 			declinedRef.current.delete(agent.id);
+			portalClient.decline(agent.id, false);
 			portalClient.enable();
 			if (conversationId) portalClient.bind(conversationId, shellSessionRef.current?.cwd ?? process.cwd());
 		} else {
@@ -11288,9 +11299,14 @@ function ChatScreen({ agent, conversation }) {
 	]);
 	const declineGrant = useCallback(() => {
 		declinedRef.current.add(agent.id);
+		portalClient?.decline(agent.id, true);
 		setPortalPrompt(null);
 		useStore.getState().showToast({ message: "kept this machine private" });
-	}, [agent.id, setPortalPrompt]);
+	}, [
+		portalClient,
+		agent.id,
+		setPortalPrompt
+	]);
 	const openPortalAccess = useCallback(() => {
 		if (!portalClient) {
 			useStore.getState().showToast({ message: useStore.getState().authKind === "api-key" ? "local access needs a browser session; run `skydive auth login --web`" : "local access is unavailable in this session" });
@@ -11299,6 +11315,7 @@ function ChatScreen({ agent, conversation }) {
 		switch (portal.status) {
 			case "off":
 				declinedRef.current.delete(agent.id);
+				portalClient.decline(agent.id, false);
 				portalClient.enable();
 				useStore.getState().showToast({ message: "enabling local access on this machine…" });
 				break;
@@ -11311,6 +11328,7 @@ function ChatScreen({ agent, conversation }) {
 					break;
 				}
 				declinedRef.current.delete(agent.id);
+				portalClient.decline(agent.id, false);
 				setPortalPrompt({
 					agentId: agent.id,
 					agentName: agent.name
@@ -11515,6 +11533,7 @@ function ChatScreen({ agent, conversation }) {
 	useEffect(() => {
 		if (!portalClient || portal.status !== "connected") return;
 		if (portal.grantedAgentIds.includes(agent.id)) return;
+		if (portal.declinedAgentIds.includes(agent.id)) return;
 		if (declinedRef.current.has(agent.id)) return;
 		if (portal.prompt?.agentId === agent.id) return;
 		setPortalPrompt({
@@ -11532,6 +11551,7 @@ function ChatScreen({ agent, conversation }) {
 		portalClient,
 		portal.status,
 		portal.grantedAgentIds,
+		portal.declinedAgentIds,
 		portal.prompt,
 		agent.id,
 		agent.name,

package/dist/js/client-CKBQ8pft.mjs

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+import { t as PortalClient } from "./client-Dd5sMXPv.mjs";
+
+export { PortalClient };

package/dist/js/{client-DaZyQfQ-.mjs → client-Dd5sMXPv.mjs}

@@ -58,12 +58,18 @@ const INHERITED_ENV = [
 	"TERM",
 	"PATH"
 ];
+const DARWIN_PATH_PREPEND = ["/opt/homebrew/bin", "/usr/local/bin"];
 function buildEnv(extra) {
 	const env = {};
 	for (const key of INHERITED_ENV) {
 		const value = process.env[key];
 		if (value !== void 0) env[key] = value;
 	}
+	if (process.platform === "darwin") {
+		const current = env.PATH ? env.PATH.split(":") : [];
+		const missing = DARWIN_PATH_PREPEND.filter((dir) => !current.includes(dir));
+		if (missing.length > 0) env.PATH = [...missing, ...current].join(":");
+	}
 	if (extra) for (const [key, value] of Object.entries(extra)) env[key] = value;
 	return env;
 }
@@ -133,7 +139,8 @@ const ctrlMessageSchema = z.discriminatedUnion("t", [
 	z.object({ t: z.literal("cancel") }),
 	z.object({
 		t: z.literal("close"),
-		exitCode: z.number()
+		exitCode: z.number(),
+		frames: z.number().int().nonnegative().optional()
 	}),
 	z.object({
 		t: z.literal("error"),
@@ -277,7 +284,8 @@ var JobManager = class {
 			this.jobs.delete(id);
 			this.opts.send(encodeCtrl(id, {
 				t: "close",
-				exitCode: code ?? -1
+				exitCode: code ?? -1,
+				frames: job.seq
 			}));
 		});
 	}
@@ -428,6 +436,10 @@ var PortalClient = class {
 	isGranted(agentId) {
 		return this.granted.has(agentId);
 	}
+	/** Agents currently authorized on this machine (last known server state). */
+	grantedAgentIds() {
+		return [...this.granted];
+	}
 	enable() {
 		if (this.enabled || this.disposed) return;
 		this.enabled = true;
@@ -459,14 +471,36 @@ var PortalClient = class {
 	}
 	/** Grant one agent access to this machine (default-deny; user-initiated). */
 	async grantAgent(agentId) {
-		const deviceId = await this.ensureDeviceId();
-		await grantPortalAccess(this.opts, {
-			deviceId,
+		const auth = this.sessionAuth();
+		if (!auth) throw new Error("granting needs a signed-in CLI session on this machine (the desktop connection alone cannot manage grants)");
+		await grantPortalAccess(auth, {
+			deviceId: await this.ensureDeviceId(),
 			agentId
 		});
 		this.granted.add(agentId);
 		this.emit();
 	}
+	/** Session-authed REST auth, or null when only a device token is held. */
+	sessionAuth() {
+		const { sessionToken } = this.opts.credentials();
+		return sessionToken ? {
+			appUrl: this.opts.appUrl,
+			sessionToken
+		} : null;
+	}
+	/**
+	* The bearer token for the portal WebSocket dial: minted from the session
+	* when one is held, otherwise the pre-minted device token as-is.
+	*/
+	async wsToken() {
+		const creds = this.opts.credentials();
+		if (creds.sessionToken) return mintPortalDeviceToken({
+			appUrl: this.opts.appUrl,
+			sessionToken: creds.sessionToken
+		});
+		if (creds.deviceToken) return creds.deviceToken;
+		throw new Error("no portal credentials (not signed in)");
+	}
 	setStatus(status, error = null) {
 		this.status = status;
 		this.error = error;
@@ -491,7 +525,7 @@ var PortalClient = class {
 		while (this.enabled && !this.disposed) {
 			this.setStatus("connecting");
 			try {
-				const token = await mintPortalDeviceToken(this.opts);
+				const token = await this.wsToken();
 				await this.runConnection(token);
 				backoff = INITIAL_BACKOFF_MS;
 			} catch (err) {
@@ -545,8 +579,10 @@ var PortalClient = class {
 		throw new Error("this machine is not connected yet");
 	}
 	async refreshDevice() {
+		const auth = this.sessionAuth();
+		if (!auth) return;
 		try {
-			const { devices } = await fetchPortalDevices(this.opts);
+			const { devices } = await fetchPortalDevices(auth);
 			const mine = findThisDevice(devices, this.machineName);
 			if (!mine) return;
 			this.deviceId = mine.id;
@@ -563,9 +599,11 @@ var PortalClient = class {
 	async syncDeviceState() {
 		await this.refreshDevice();
 		if (this.legacyGrantsChecked) return;
+		const auth = this.sessionAuth();
+		if (!auth) return;
 		this.legacyGrantsChecked = true;
 		try {
-			if (await unifyLegacyCliGrants(this.opts, this.machineName) > 0) await this.refreshDevice();
+			if (await unifyLegacyCliGrants(auth, this.machineName) > 0) await this.refreshDevice();
 		} catch (_error) {}
 	}
 };

package/dist/js/{daemon-DpqP-4tS.mjs → daemon-C6yadKp2.mjs}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { s as isRecord, t as PortalClient } from "./client-DaZyQfQ-.mjs";
+import { s as isRecord, t as PortalClient } from "./client-Dd5sMXPv.mjs";
 import os from "node:os";
 import path from "node:path";
 import { z } from "zod";
@@ -47,14 +47,35 @@ const LOCAL_PROTOCOL_VERSION = 1;
 */
 const PORTAL_DAEMON_FLAG = "--skydive-internal-portal-daemon";
 /**
+* One daemon per machine requires one socket key per backend — but the prod
+* backend is reachable under three hosts: the CLI's default appUrl is
+* `https://api.skydive.com` while the desktop app carries
+* `https://skydive.com` (and the web is on www). Hashing those raw strings
+* would give each surface its own daemon, and with the merged machine
+* identity both daemons would register the SAME device — the presence
+* contention the daemon exists to prevent. Collapse the known prod aliases to
+* the CLI's canonical form (proven for both the REST surface and the WS
+* upgrade; the apex 301-redirects, which a WS upgrade cannot follow).
+* Non-prod URLs (previews, localhost) pass through untouched apart from
+* trailing-slash trimming.
+*/
+function canonicalPortalAppUrl(appUrl) {
+	const trimmed = appUrl.replace(/\/+$/, "");
+	const host = trimmed.replace(/^https?:\/\//, "").toLowerCase();
+	if (host === "skydive.com" || host === "www.skydive.com" || host === "api.skydive.com") return "https://api.skydive.com";
+	return trimmed;
+}
+/**
 * Per-user, per-app daemon socket + state paths. Scoped by OS user and a hash
-* of the appUrl so two logins or two deployments (prod vs a PR preview) get
-* distinct daemons and never share a portal identity. Kept under the OS temp
-* dir because Unix socket paths are length-limited (~104 bytes on macOS).
+* of the CANONICAL appUrl so two logins or two deployments (prod vs a PR
+* preview) get distinct daemons and never share a portal identity — while
+* every alias of one deployment (see {@link canonicalPortalAppUrl}) shares
+* one. Kept under the OS temp dir because Unix socket paths are
+* length-limited (~104 bytes on macOS).
 */
 function daemonPaths(appUrl) {
 	const user = safeSegment(os.userInfo().username || "user");
-	const app = createHash("sha256").update(appUrl).digest("hex").slice(0, 12);
+	const app = createHash("sha256").update(canonicalPortalAppUrl(appUrl)).digest("hex").slice(0, 12);
 	const dir = path.join(os.tmpdir(), `skydive-portal-${user}-${app}`);
 	return {
 		dir,
@@ -67,17 +88,30 @@ function safeSegment(value) {
 	return value.replace(/[^a-zA-Z0-9_-]/g, "").slice(0, 24) || "user";
 }
 /**
-* `hello` — a CLI attaches. `sessionId` is unique per CLI process; `token` is
-* the CLI's session token, which the daemon needs to mint the portal device
-* token (the daemon is spawned lazily and holds no session of its own). The
-* daemon uses the FIRST hello's token to connect and refreshes from later
-* hellos so a long-lived daemon can outlive the CLI that spawned it.
+* `hello` — a client attaches. `sessionId` is unique per client process.
+* `token` authenticates the daemon's portal connection; `tokenKind` says what
+* it is:
+*
+*  - `session` — a CLI session token. The daemon mints short-lived portal
+*    device tokens from it, and can call the session-authed portal REST
+*    surface (device refresh, grants).
+*  - `device` — a pre-minted portal device token (the desktop app is handed
+*    one by the web bridge and holds no session of its own). Dials the portal
+*    WebSocket directly; the session-only REST surface is unavailable until
+*    some client supplies a session token.
+*
+* The daemon uses the FIRST hello's token to connect and refreshes from later
+* hellos so a long-lived daemon can outlive the client that spawned it.
+* `tokenKind` defaults to `session` on parse: hellos from CLI builds that
+* predate the field are session-token clients by definition, and the default
+* keeps them attaching to a newer daemon.
 */
 const clientHelloSchema = z.object({
 	t: z.literal("hello"),
 	v: z.number(),
 	sessionId: z.string().min(1),
-	token: z.string().min(1)
+	token: z.string().min(1),
+	tokenKind: z.enum(["session", "device"]).default("session")
 });
 /**
 * `bind` — associate a conversation with a working directory. Sent on chat
@@ -109,6 +143,20 @@ const clientGrantSchema = z.object({
 	t: z.literal("grant"),
 	agentId: z.string().min(1)
 });
+/**
+* `decline` — the user answered no to an agent's request for this machine
+* (`declined: true`), or re-opened the door for it (`declined: false`).
+*
+* The daemon holds this because a decline is about the MACHINE, not one
+* terminal: every attached CLI raises its own grant prompt off the daemon's
+* shared state, so a per-process no would be re-asked by every other open
+* conversation and by the next `skydive` launch.
+*/
+const clientDeclineSchema = z.object({
+	t: z.literal("decline"),
+	agentId: z.string().min(1),
+	declined: z.boolean()
+});
 /** `bye` — a CLI detaches cleanly (its conversations drop from the map). */
 const clientByeSchema = z.object({
 	t: z.literal("bye"),
@@ -133,6 +181,7 @@ const clientMessageSchema = z.discriminatedUnion("t", [
 	clientDisableSchema,
 	clientCwdSchema,
 	clientGrantSchema,
+	clientDeclineSchema,
 	clientByeSchema,
 	clientStatusSchema,
 	clientShutdownSchema
@@ -152,7 +201,8 @@ const daemonStateSchema = z.object({
 	machineName: z.string(),
 	friendlyName: z.string(),
 	error: z.string().nullable(),
-	grantedAgentIds: z.array(z.string())
+	grantedAgentIds: z.array(z.string()),
+	declinedAgentIds: z.array(z.string()).default([])
 });
 /** `hello_ok` — the daemon accepts an attach and reports its protocol version. */
 const daemonHelloOkSchema = z.object({
@@ -180,7 +230,8 @@ const daemonStatusResultSchema = z.object({
 		machineName: z.string(),
 		friendlyName: z.string(),
 		error: z.string().nullable(),
-		grantedAgentIds: z.array(z.string())
+		grantedAgentIds: z.array(z.string()),
+		declinedAgentIds: z.array(z.string()).default([])
 	}),
 	clientCount: z.number(),
 	cwds: z.record(z.string(), z.string())
@@ -254,18 +305,21 @@ function parseDaemonMessage(line) {
 /** Grace period after the last client detaches before the daemon exits. */
 const IDLE_SHUTDOWN_MS = 3e4;
 var PortalDaemon = class {
+	appUrl;
 	paths;
 	server = null;
 	client = null;
 	lastState = null;
 	conns = /* @__PURE__ */ new Set();
 	cwds = /* @__PURE__ */ new Map();
+	declined = /* @__PURE__ */ new Set();
 	fallbackCwd;
 	idleTimer = null;
 	sessionToken = null;
+	deviceToken = null;
 	constructor(appUrl) {
-		this.appUrl = appUrl;
-		this.paths = daemonPaths(appUrl);
+		this.appUrl = canonicalPortalAppUrl(appUrl);
+		this.paths = daemonPaths(this.appUrl);
 		this.fallbackCwd = process.env.HOME ?? process.cwd();
 	}
 	/** Start listening. Rejects if the socket is already held by another daemon. */
@@ -319,13 +373,14 @@ var PortalDaemon = class {
 		switch (msg.t) {
 			case "hello":
 				conn.sessionId = msg.sessionId;
-				this.sessionToken = msg.token;
+				if (msg.tokenKind === "device") this.deviceToken = msg.token;
+				else this.sessionToken = msg.token;
 				this.ensureClient();
 				this.send(conn, {
 					t: "hello_ok",
 					v: LOCAL_PROTOCOL_VERSION
 				});
-				if (this.lastState) this.send(conn, stateMessage(this.lastState));
+				if (this.lastState) this.send(conn, stateMessage(this.lastState, this.declined));
 				return;
 			case "bind":
 				conn.conversations.add(msg.conversationId);
@@ -342,10 +397,19 @@ var PortalDaemon = class {
 				for (const other of this.conns) other.wantsShare = false;
 				this.client?.disable();
 				return;
+			case "decline":
+				if (msg.declined) {
+					this.declined.add(msg.agentId);
+					if ((this.lastState?.grantedAgentIds.length ?? 0) === 0) this.client?.disable();
+				} else this.declined.delete(msg.agentId);
+				this.persistState();
+				this.broadcastState();
+				return;
 			case "cwd":
 				this.fallbackCwd = msg.cwd;
 				return;
 			case "grant":
+				this.declined.delete(msg.agentId);
 				this.ensureClient();
 				this.client?.grantAgent(msg.agentId).catch((error) => {
 					this.logError("grantAgent failed", error);
@@ -375,14 +439,17 @@ var PortalDaemon = class {
 	}
 	/** Create the single PortalClient the first time a client needs the portal. */
 	ensureClient() {
-		if (this.client || !this.sessionToken) return;
+		if (this.client || !this.sessionToken && !this.deviceToken) return;
 		this.client = new PortalClient({
 			appUrl: this.appUrl,
-			sessionToken: this.sessionToken,
+			credentials: () => ({
+				sessionToken: this.sessionToken,
+				deviceToken: this.deviceToken
+			}),
 			resolveCwd: (conversationId) => this.resolveCwd(conversationId),
 			onState: (state) => {
 				this.lastState = state;
-				this.broadcast(stateMessage(state));
+				this.broadcastState();
 			}
 		});
 	}
@@ -400,6 +467,11 @@ var PortalDaemon = class {
 	broadcast(msg) {
 		for (const conn of this.conns) this.send(conn, msg);
 	}
+	/** Push the current portal state (plus the machine's declines) to every CLI. */
+	broadcastState() {
+		if (!this.lastState) return;
+		this.broadcast(stateMessage(this.lastState, this.declined));
+	}
 	armIdleTimer() {
 		this.clearIdleTimer();
 		this.idleTimer = setTimeout(() => this.shutdown(), IDLE_SHUTDOWN_MS);
@@ -417,6 +489,13 @@ var PortalDaemon = class {
 		const line = `${(/* @__PURE__ */ new Date()).toISOString()} ${context}: ${message}\n`;
 		appendFile(this.paths.logPath, line).catch((_error) => {});
 	}
+	/** Close the listener without exiting the process (tests own the process). */
+	stopForTest() {
+		this.clearIdleTimer();
+		this.client?.dispose();
+		this.server?.close();
+		this.server = null;
+	}
 	shutdown() {
 		if (this.conns.size > 0) return;
 		this.client?.dispose();
@@ -436,7 +515,8 @@ var PortalDaemon = class {
 				machineName: portal?.machineName ?? "",
 				friendlyName: portal?.friendlyName ?? "",
 				error: portal?.error ?? null,
-				grantedAgentIds: portal?.grantedAgentIds ?? []
+				grantedAgentIds: portal?.grantedAgentIds ?? [],
+				declinedAgentIds: [...this.declined]
 			},
 			clientCount: [...this.conns].filter((c) => c.sessionId !== null).length,
 			cwds: Object.fromEntries(this.cwds)
@@ -462,13 +542,17 @@ var PortalDaemon = class {
 			const parsed = JSON.parse(raw);
 			if (isRecord(parsed) && parsed.version === LOCAL_PROTOCOL_VERSION && isRecord(parsed.cwds)) {
 				for (const [id, cwd] of Object.entries(parsed.cwds)) if (typeof cwd === "string") this.cwds.set(id, cwd);
+				if (Array.isArray(parsed.declined)) {
+					for (const id of parsed.declined) if (typeof id === "string") this.declined.add(id);
+				}
 			}
 		} catch (_error) {}
 	}
 	persistState() {
 		const state = {
 			version: LOCAL_PROTOCOL_VERSION,
-			cwds: Object.fromEntries(this.cwds)
+			cwds: Object.fromEntries(this.cwds),
+			declined: [...this.declined]
 		};
 		writeFile(this.paths.statePath, JSON.stringify(state)).catch((error) => {
 			this.logError("persistState failed", error);
@@ -615,14 +699,15 @@ async function stopDaemon(appUrl) {
 	}
 	return await isDaemonListening(socketPath) ? "failed" : "stopped";
 }
-function stateMessage(state) {
+function stateMessage(state, declined) {
 	return {
 		t: "state",
 		status: state.status,
 		machineName: state.machineName,
 		friendlyName: state.friendlyName,
 		error: state.error,
-		grantedAgentIds: state.grantedAgentIds
+		grantedAgentIds: state.grantedAgentIds,
+		declinedAgentIds: [...declined]
 	};
 }
 function sleep(ms) {

package/dist/js/{daemon-BKVPOhzU.mjs → daemon-XCciQ1mS.mjs}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import "./client-DaZyQfQ-.mjs";
-import { a as runPortalDaemon, i as queryDaemonStatus, n as ensureDaemonRunning, o as startPortalDaemon, r as isDaemonListening, s as stopDaemon, t as PortalDaemon } from "./daemon-DpqP-4tS.mjs";
+import "./client-Dd5sMXPv.mjs";
+import { a as runPortalDaemon, i as queryDaemonStatus, n as ensureDaemonRunning, o as startPortalDaemon, r as isDaemonListening, s as stopDaemon, t as PortalDaemon } from "./daemon-C6yadKp2.mjs";
 
 export { runPortalDaemon };

package/dist/js/daemon-client-CgziZU3X.mjs

@@ -0,0 +1,6 @@
+#!/usr/bin/env node
+import "./client-Dd5sMXPv.mjs";
+import "./daemon-C6yadKp2.mjs";
+import { t as PortalDaemonClient } from "./daemon-client-Rr6PJvRg.mjs";
+
+export { PortalDaemonClient };

package/dist/js/{daemon-client-F7gX12Mp.mjs → daemon-client-Rr6PJvRg.mjs}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { c as LOCAL_PROTOCOL_VERSION, d as encodeLine, f as makeLineParser, n as ensureDaemonRunning, p as parseDaemonMessage, u as daemonPaths } from "./daemon-DpqP-4tS.mjs";
+import { c as LOCAL_PROTOCOL_VERSION, d as encodeLine, f as makeLineParser, n as ensureDaemonRunning, p as parseDaemonMessage, u as daemonPaths } from "./daemon-C6yadKp2.mjs";
 import { randomUUID } from "node:crypto";
 import { connect } from "node:net";
 
@@ -13,6 +13,7 @@ var PortalDaemonClient = class {
 	fallbackCwd = null;
 	wantEnabled = false;
 	pendingGrants = /* @__PURE__ */ new Set();
+	pendingDeclines = /* @__PURE__ */ new Map();
 	grantedAgentIds = /* @__PURE__ */ new Set();
 	constructor(opts) {
 		this.opts = opts;
@@ -35,7 +36,8 @@ var PortalDaemonClient = class {
 				t: "hello",
 				v: LOCAL_PROTOCOL_VERSION,
 				sessionId: this.sessionId,
-				token: this.opts.sessionToken
+				token: this.opts.sessionToken,
+				tokenKind: "session"
 			});
 			if (this.wantEnabled) this.send({ t: "enable" });
 			if (this.fallbackCwd) this.send({
@@ -52,6 +54,11 @@ var PortalDaemonClient = class {
 				t: "grant",
 				agentId
 			});
+			for (const [agentId, declined] of this.pendingDeclines) this.send({
+				t: "decline",
+				agentId,
+				declined
+			});
 		});
 		socket.on("data", (chunk) => {
 			for (const line of parse(chunk)) {
@@ -82,7 +89,8 @@ var PortalDaemonClient = class {
 				machineName: msg.machineName,
 				friendlyName: msg.friendlyName,
 				error: msg.error,
-				grantedAgentIds: msg.grantedAgentIds
+				grantedAgentIds: msg.grantedAgentIds,
+				declinedAgentIds: msg.declinedAgentIds
 			});
 		}
 	}
@@ -108,6 +116,19 @@ var PortalDaemonClient = class {
 		this.send({ t: "disable" });
 	}
 	/**
+	* Record that the user said no (or yes again) to one agent on this machine.
+	* The daemon owns the answer, so every attached CLI stops asking — and it
+	* closes the share when nothing else is granted.
+	*/
+	decline(agentId, declined) {
+		this.pendingDeclines.set(agentId, declined);
+		this.send({
+			t: "decline",
+			agentId,
+			declined
+		});
+	}
+	/**
 	* Set the directory an exec runs in when the daemon can't place its
 	* conversation. `skydive portal open` shares one directory and has no
 	* conversation of its own, so this is how it routes.

package/dist/js/{print-share-Jgn0lqGr.mjs → print-share-C1LPsgTP.mjs}

@@ -14,14 +14,17 @@ import { n as printError } from "./output-DYzzdXYV.mjs";
 * the reply (and to --json).
 */
 async function connectMachineShare({ appUrl, sessionToken, timeoutHint }) {
-	const { PortalClient } = await import("./client-BsTDaKa2.mjs");
+	const { PortalClient } = await import("./client-CKBQ8pft.mjs");
 	let signalConnected;
 	const connected = new Promise((resolve) => {
 		signalConnected = resolve;
 	});
 	const machineShare = new PortalClient({
 		appUrl,
-		sessionToken,
+		credentials: () => ({
+			sessionToken,
+			deviceToken: null
+		}),
 		resolveCwd: () => process.cwd(),
 		onState: (state) => {
 			if (state.status === "connected") signalConnected();

package/dist/js/{profiler-BoEx7ARj.mjs → profiler-DHQhmoSF.mjs}

@@ -8,7 +8,7 @@ import fs from "node:fs";
 
 //#region package.json
 var name = "skydive-cli";
-var version$1 = "0.4.1-beta.5";
+var version$1 = "0.5.0-beta.1";
 
 //#endregion
 //#region src/auth/organization.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skydive-cli",
-  "version": "0.4.1-beta.5",
+  "version": "0.5.0-beta.1",
   "description": "Skydive CLI — cloud agents from the command line",
   "homepage": "https://skydive.com",
   "license": "MIT",

package/dist/js/client-BsTDaKa2.mjs

@@ -1,4 +0,0 @@
-#!/usr/bin/env node
-import { t as PortalClient } from "./client-DaZyQfQ-.mjs";
-
-export { PortalClient };

package/dist/js/daemon-client-TQuXEURW.mjs

@@ -1,6 +0,0 @@
-#!/usr/bin/env node
-import "./client-DaZyQfQ-.mjs";
-import "./daemon-DpqP-4tS.mjs";
-import { t as PortalDaemonClient } from "./daemon-client-F7gX12Mp.mjs";
-
-export { PortalDaemonClient };