skydive-cli 0.5.0-beta.13 → 0.5.0-beta.15

package/dist/js/bin.mjs

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
-import { C as ensureActiveOrganization, D as setActiveWorkspace, E as listWorkspaces, O as name, T as getSessionIdentity, a as installCrashHandler, k as version, t as maybeStartProfiling, u as brandHelpArt, w as getActiveWorkspaceId, x as themes } from "./profiler-0_q2DHpq.mjs";
+import { C as ensureActiveOrganization, D as setActiveWorkspace, E as listWorkspaces, O as name, T as getSessionIdentity, a as installCrashHandler, k as version, t as maybeStartProfiling, u as brandHelpArt, w as getActiveWorkspaceId, x as themes } from "./profiler-B97UpfHm.mjs";
 import { A as getStoredApiKeyId, B as saveConfig, C as getDefaultAgent, E as getPromptHistoryPath, F as resolveChatAuth, I as resolveConfig, L as resolveManagementAuth, M as getUpdateCheckDisabled, P as resolveAppUrl, R as resolveSession, S as getConfigPath, T as getPreference, U as setLastSeenVersion, V as saveSession, _ as API_KEY_PREFIX, b as PREFERENCES, g as API_KEY_FAMILY_PREFIX, h as API_KEYS_URL, i as resolveAgent, j as getStoredApiKeyWorkspaceName, k as getShareMachineDefault, v as DEFAULT_API_URL, w as getLastSeenVersion, x as deleteConfig } from "./print-riiY5Gly.mjs";
 import { n as printError, r as printTable, t as output } from "./output-DYzzdXYV.mjs";
 import { t as HttpError } from "./http-error-DzyrsLAZ.mjs";
 import { t as createRestClient } from "./rest-CLrHVkxh.mjs";
 import "./billing-blocked-2wju4gC_.mjs";
-import { r as resolveMachineIdentity } from "./client-DabRpc_T.mjs";
-import { i as queryDaemonStatus, l as PORTAL_DAEMON_FLAG, n as ensureDaemonRunning, s as stopDaemon, u as daemonPaths } from "./daemon-ShOaDbZe.mjs";
+import { r as resolveMachineIdentity } from "./client-DbqRBquD.mjs";
+import { i as queryDaemonStatus, l as PORTAL_DAEMON_FLAG, n as ensureDaemonRunning, s as stopDaemon, u as daemonPaths } from "./daemon-eb9dm6Ih.mjs";
 import { i as grantPortalAccess, n as fetchPortalDevices, o as registerPortalDevice, r as findThisDevice, s as revokePortalAccess } from "./api-DG5W6iwx.mjs";
 import { t as SandboxStream } from "./client-c4c5MmgN.mjs";
 import { hideBin } from "yargs/helpers";
@@ -1517,7 +1517,7 @@ const importCommand = {
 				process.exit(1);
 			}
 		}
-		const { runChat } = await import("./boot-C4OHQUCg.mjs");
+		const { runChat } = await import("./boot-DZKl8JNI.mjs");
 		await runChat({
 			appUrl,
 			sessionToken: session.value.sessionToken,
@@ -1545,7 +1545,7 @@ async function runImportPrintMode({ argv, appUrl }) {
 		printError(`${session.error.message} For non-interactive use, run \`skydive auth login --web\` first, or set SKYDIVE_SESSION_TOKEN.`);
 		process.exit(1);
 	}
-	const { connectMachineShare } = await import("./print-share-CKLPmsg0.mjs");
+	const { connectMachineShare } = await import("./print-share-BH9gvCls.mjs");
 	const machineShare = await connectMachineShare({
 		appUrl,
 		sessionToken: session.value.sessionToken,
@@ -1930,7 +1930,7 @@ const chatCommand = {
 			sessionToken: auth.value.token,
 			agentSelector: argv.agent ?? null
 		});
-		const { runChat } = await import("./boot-C4OHQUCg.mjs");
+		const { runChat } = await import("./boot-DZKl8JNI.mjs");
 		await runChat({
 			appUrl: auth.value.appUrl,
 			sessionToken: auth.value.token,
@@ -2023,7 +2023,7 @@ async function runPrintMode({ argv, appUrl }) {
 			process.exit(1);
 		}
 	} else {
-		const { connectMachineShare } = await import("./print-share-CKLPmsg0.mjs");
+		const { connectMachineShare } = await import("./print-share-BH9gvCls.mjs");
 		machineShare = await connectMachineShare({
 			appUrl: auth.value.appUrl,
 			sessionToken: auth.value.token,
@@ -2290,7 +2290,7 @@ const switchCommand = {
 				printError("The workspace picker needs the Bun runtime and it could not be set up automatically. Pass a workspace slug instead, or install Bun and retry.");
 				process.exit(1);
 			}
-			const { runWorkspacePicker } = await import("./boot-C4OHQUCg.mjs");
+			const { runWorkspacePicker } = await import("./boot-DZKl8JNI.mjs");
 			await runWorkspacePicker(session);
 			return;
 		}
@@ -2339,7 +2339,7 @@ const workspaceCommand = {
 */
 async function resolveGrantTarget(argv) {
 	const session = requireSession(argv);
-	const [{ devices, agents }, identity] = await Promise.all([fetchPortalDevices(session), resolveMachineIdentity()]);
+	const [{ devices, agents }, identity] = await Promise.all([fetchPortalDevices(session), resolveMachineIdentity(null)]);
 	return {
 		session,
 		agent: resolveAgent(agents, argv.agent),
@@ -2368,8 +2368,8 @@ const openCommand = {
 		const session = requireSession(argv);
 		const agent = argv.agent ? resolveAgent((await fetchPortalDevices(session)).agents, argv.agent) : null;
 		const cwd = argv.cwd ? path.resolve(argv.cwd) : process.cwd();
-		const { machineName } = await resolveMachineIdentity();
-		const { PortalDaemonClient } = await import("./daemon-client-D_MeDMpn.mjs");
+		const { machineName } = await resolveMachineIdentity(null);
+		const { PortalDaemonClient } = await import("./daemon-client-Bemq-pLd.mjs");
 		let lastLine = "";
 		let signalConnected;
 		const connected = new Promise((resolve) => {
@@ -2468,7 +2468,7 @@ const statusCommand = {
 			console.log("No machines registered. Run `skydive portal open` to register this one.");
 			return;
 		}
-		const { headers, rows } = buildDeviceTable(devices, agents, (await resolveMachineIdentity()).machineName);
+		const { headers, rows } = buildDeviceTable(devices, agents, (await resolveMachineIdentity(null)).machineName);
 		printTable(headers, rows);
 	}
 };
@@ -4215,7 +4215,7 @@ if (process.argv.includes(UPDATE_WORKER_FLAG)) {
 	process.exit(0);
 }
 if (process.argv.includes(PORTAL_DAEMON_FLAG)) {
-	const { runPortalDaemon } = await import("./daemon-BfqJZ_M4.mjs");
+	const { runPortalDaemon } = await import("./daemon-Djei8xaW.mjs");
 	runPortalDaemon(process.argv);
 } else runCli();
 function runCli() {

package/dist/js/{boot-C4OHQUCg.mjs → boot-DZKl8JNI.mjs}

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
-import { D as setActiveWorkspace, E as listWorkspaces, S as themesForMode, _ as themeForMode, a as installCrashHandler, b as themeVersion, c as MARK_CELLS, d as DEFAULT_THEME_ID, f as applyTheme, g as theme, h as noColorRequested, i as writeArtifact, l as WORDMARK, m as monoTheme, n as profilingEnabled, o as buildCrashReport, p as findTheme, r as record, s as writeCrashReport, v as themeMode, w as getActiveWorkspaceId, y as themeModeFromColorFgBg } from "./profiler-0_q2DHpq.mjs";
+import { D as setActiveWorkspace, E as listWorkspaces, S as themesForMode, _ as themeForMode, a as installCrashHandler, b as themeVersion, c as MARK_CELLS, d as DEFAULT_THEME_ID, f as applyTheme, g as theme, h as noColorRequested, i as writeArtifact, l as WORDMARK, m as monoTheme, n as profilingEnabled, o as buildCrashReport, p as findTheme, r as record, s as writeCrashReport, v as themeMode, w as getActiveWorkspaceId, y as themeModeFromColorFgBg } from "./profiler-B97UpfHm.mjs";
 import { D as getReviewStateDir, H as saveTheme, N as recordDefaultAgent, O as getSavedTheme, S as getConfigPath, c as cardActionErrorMessage, d as reconcileMaskedInput, f as resolveConnectUrl, i as resolveAgent, l as parseExternalOauthConnectParams, m as specKeyFor, p as parseConnectCard, s as MASK_CHAR, u as parseOauthConnectParams, v as DEFAULT_API_URL, y as DEFAULT_APP_URL, z as resolveWebUrl } from "./print-riiY5Gly.mjs";
 import { t as HttpError } from "./http-error-DzyrsLAZ.mjs";
 import { a as isRecord, i as errorMessage, n as errorDetail, r as sendErrorMessage, t as createRestClient } from "./rest-CLrHVkxh.mjs";
 import { i as billingBlockedOutcomeFromSendResponse } from "./billing-blocked-2wju4gC_.mjs";
-import { t as PortalClient } from "./client-DabRpc_T.mjs";
-import "./daemon-ShOaDbZe.mjs";
+import { t as PortalClient } from "./client-DbqRBquD.mjs";
+import "./daemon-eb9dm6Ih.mjs";
 import "./api-DG5W6iwx.mjs";
 import { t as SandboxStream } from "./client-c4c5MmgN.mjs";
-import { t as PortalDaemonClient } from "./daemon-client-BVAlyN7x.mjs";
+import { t as PortalDaemonClient } from "./daemon-client-N8rvGusv.mjs";
 import { t as runRawPtyPassthrough } from "./raw-pty-DY4KelZW.mjs";
 import * as os$1 from "node:os";
 import { homedir, platform, release, tmpdir } from "node:os";
@@ -386,6 +386,8 @@ function createPortalClient(opts) {
 				deviceToken: null
 			}),
 			resolveCwd: () => process.cwd(),
+			persistedMachineName: null,
+			onMachineName: () => {},
 			onState: (state) => opts.onState({
 				status: state.status,
 				machineName: state.machineName,
@@ -1078,42 +1080,133 @@ function createAgentHost({ renderer, notifications }) {
 * take the one host we can identify unambiguously (github.com, incl. `www.`),
 * which covers the common product case; GHES stays the native badge's job.
 *
-* Only the `/pull/<n>` form (not `/issues/`, not a bare `#123` — ambiguous with
-* issues without local repo context we don't have). A trailing path/query/
-* fragment (e.g. `/files`, `#discussion`) is allowed but not captured into the
-* canonical URL. Also matches inside markdown links, backticks, and trailing
-* punctuation.
-*/
-const PR_URL_RE = /https?:\/\/(?:www\.)?github\.com\/([\w.-]+)\/([\w.-]+)\/pull\/(\d+)/gi;
-/**
-* Extracts every distinct GitHub PR referenced in a block of text, in first-seen
-* order, de-duplicated by **repo-qualified identity** (`owner/repo#number`) —
-* NOT by number, since `#42` can exist in many repos. Each ref carries a
-* canonicalized URL (scheme + host + `/owner/repo/pull/number`, no trailing
-* path/query/fragment) so the same PR linked twice with different fragments
-* collapses to one pill.
-*/
-function extractPullRequests(text, options) {
-	const requireCompleteNumber = options?.requireCompleteNumber ?? true;
-	const byKey = /* @__PURE__ */ new Map();
-	for (const match of text.matchAll(PR_URL_RE)) {
+* Only the `/pull/<n>` form (not `/issues/`). A trailing path/query/fragment
+* (e.g. `/files`, `#discussion`) is allowed but not captured into the canonical
+* URL. Also matches inside markdown links, backticks, and trailing punctuation.
+*
+* The `https://` (and `www.`) prefix is optional: agents and people routinely
+* write a bare `github.com/o/r/pull/7`, and that should link a PR the same way
+* the full URL does. To keep a bare host from matching inside a longer hostname
+* (`mygithub.com/...`, `notgithub.com/...`), a protocol-less match must be
+* preceded by a start-of-string or a non-host character (anything but a word
+* char or `.`) — a leading boundary the `(?:^|[^\w.])` group asserts and
+* consumes. The consumed boundary char is outside the captured groups, so it
+* never leaks into owner/repo. `matchAll` won't overlap, but the boundary is a
+* single delimiter (space, `(`, `[`, etc.) between PRs in practice, so distinct
+* back-to-back URLs still each match.
+*/
+const PR_URL_RE = /(?:^|[^\w.])(?:https?:\/\/)?(?:www\.)?github\.com\/([\w.-]+)\/([\w.-]+)\/pull\/(\d+)/gi;
+/**
+* Matches a bare, human-style PR reference `#<n>` — the way people (and LLMs)
+* name a PR in prose ("opened #20858", "landed #42"). Requires a non-word
+* boundary before the `#` so a fragment tail like `/pull/7#discussion_r5` or a
+* hex color `#20858` embedded in a word doesn't count, and captures the digits
+* up to a word boundary. We only harvest these from **assistant prose**, never
+* from tool output, because `#N` is exactly the relevance signal we're after:
+* the agent chose to talk about this PR.
+*/
+const PR_HASH_RE = /(?:^|[^\w#/])#(\d+)\b/g;
+/**
+* Every full `/pull/<n>` github.com URL in `urlText`, keyed by number to the
+* candidate refs for that number. A number can map to more than one repo, so we
+* keep all candidates; a bare `#N` label can't say which repo, but the pill's
+* own URL does. Deduped by repo-qualified identity (`owner/repo#number`) so the
+* same PR linked twice — even with a different trailing path/fragment —
+* collapses to one ref.
+*
+* `deferTrailingNumber` guards the streaming truncation case: when true, a URL
+* whose number runs to the very end of `urlText` is skipped because the next
+* delta may extend those digits (`.../pull/19` now, `.../pull/19739` later).
+* Only the still-growing PROSE buffer sets this; settled tool output is always
+* complete, so its URLs are harvested with the guard off.
+*/
+function urlsByNumber(urlText, deferTrailingNumber, byNumber) {
+	for (const match of urlText.matchAll(PR_URL_RE)) {
 		const owner = match[1];
 		const repo = match[2];
 		const numberText = match[3];
 		if (!owner || !repo || !numberText) continue;
-		if (requireCompleteNumber) {
-			if (match.index + match[0].length >= text.length) continue;
+		if (deferTrailingNumber) {
+			if (match.index + match[0].length >= urlText.length) continue;
 		}
 		const number = Number.parseInt(numberText, 10);
 		if (!Number.isFinite(number) || number <= 0) continue;
-		const key = `${owner.toLowerCase()}/${repo.toLowerCase()}#${number}`;
-		if (byKey.has(key)) continue;
-		byKey.set(key, {
+		const ref = {
 			number,
-			key,
+			key: `${owner.toLowerCase()}/${repo.toLowerCase()}#${number}`,
 			url: `https://github.com/${owner}/${repo}/pull/${number}`
-		});
+		};
+		const existing = byNumber.get(number);
+		if (existing) {
+			if (!existing.some((r) => r.key === ref.key)) existing.push(ref);
+		} else byNumber.set(number, [ref]);
 	}
+}
+/** Every human-style `#N` named in `proseText` — the relevance signal. */
+function hashNumbers(proseText) {
+	const numbers = /* @__PURE__ */ new Set();
+	for (const match of proseText.matchAll(PR_HASH_RE)) {
+		const numberText = match[1];
+		if (!numberText) continue;
+		const number = Number.parseInt(numberText, 10);
+		if (Number.isFinite(number) && number > 0) numbers.add(number);
+	}
+	return numbers;
+}
+/**
+* The relevance contract, in one place.
+*
+* A GitHub PR URL is cheap to emit and shows up in bulk any time a tool dumps
+* PRs the conversation isn't actually about — `gh pr list`, `gh pr status`, a
+* `gh search` — printing dozens of `/pull/N` URLs the agent never discusses.
+* Pinning a sidebar pill for every one of those is noise.
+*
+* So a PR is surfaced only when BOTH hold:
+*   1. a fully-qualified `github.com/<o>/<r>/pull/<n>` URL exists — this may
+*      come from the assistant's prose OR from tool output (a `gh pr create`
+*      that printed the URL the agent then referenced by number), and
+*   2. the **assistant's prose** names the number as a human-style `#<n>`.
+*
+* The `#N` in prose is the intent signal — "the agent is talking about this
+* PR", as opposed to "a tool happened to list it". The full URL (from wherever)
+* proves the PR is real and pins down its repo + canonical link. A URL with no
+* `#N` in prose (the whole of a `gh pr list` dump) is dropped; a `#N` with no
+* matching URL anywhere (a bare issue-style ref) is dropped.
+*
+* `proseText` is the assistant's prose alone (the only source of the `#N`
+* relevance signal); `urlOnlyText` is settled tool output that may carry full
+* PR URLs but no `#N` intent. URLs are harvested from both; `#N` from prose
+* only.
+*/
+function collectRelevant(proseText, urlOnlyText, options, byKey) {
+	const byNumber = /* @__PURE__ */ new Map();
+	urlsByNumber(proseText, options.requireCompleteNumber, byNumber);
+	if (urlOnlyText) urlsByNumber(urlOnlyText, false, byNumber);
+	if (byNumber.size === 0) return;
+	const named = hashNumbers(proseText);
+	if (named.size === 0) return;
+	for (const [number, refs] of byNumber) {
+		if (!named.has(number)) continue;
+		for (const ref of refs) if (!byKey.has(ref.key)) byKey.set(ref.key, ref);
+	}
+}
+/**
+* Extracts every distinct GitHub PR that is both linked (a full `/pull/<n>`
+* URL) AND named (`#<n>`), de-duplicated by **repo-qualified identity**
+* (`owner/repo#number`) — NOT by number, since `#42` can exist in many repos.
+*
+* The two-argument form takes the URL pool and the prose separately, so a URL
+* from tool output can satisfy the link requirement while the `#N` stays a
+* prose-only signal. The one-argument form (prose only) is the common case: it
+* requires the URL to be in the same prose that names it.
+*
+* See {@link collectRelevant} for the contract.
+*/
+function extractPullRequests(proseText, options) {
+	const requireCompleteNumber = options?.requireCompleteNumber ?? true;
+	const urlOnly = options?.urlOnlyText ?? "";
+	const byKey = /* @__PURE__ */ new Map();
+	collectRelevant(proseText, urlOnly, { requireCompleteNumber }, byKey);
 	return [...byKey.values()];
 }
 /**
@@ -1152,28 +1245,34 @@ function stringifyToolOutput(value) {
 }
 /**
 * A streaming PR scanner: fed run chunks as they stream, it reports each
-* distinct PR the moment its URL is seen, exactly once, without ever rescanning
-* the transcript. Two sources feed it:
+* distinct PR the moment BOTH conditions hold — a full `/pull/<n>` URL has been
+* seen (in prose OR tool output) AND the assistant's prose names it `#<n>` —
+* exactly once, without ever rescanning the transcript.
 *
-* - **Assistant text** (`text-delta`): accumulated per part id (a URL can split
-*   across two deltas) and only the current part's buffer is scanned, so cost
-*   is bounded by one text block, not the whole scrollback.
-* - **Tool output** (`tool-output-available`): the settled output of a tool
-*   call (e.g. `gh pr create` stdout) arrives whole, not delta-streamed, so we
-*   flatten and scan it in one pass. This catches PRs a tool printed that the
-*   agent never restated in prose — the common case for an opened PR.
+* Two sources feed it, with different roles:
+* - **Assistant text** (`text-delta`): the ONLY source of the `#N` relevance
+*   signal, and also a source of URLs. Accumulated per part id (a URL or `#N`
+*   can split across two deltas); only the current part's buffer is scanned.
+* - **Tool output** (`tool-output-available`): a URL-only source. A
+*   `gh pr create` prints the URL the agent then references by number, so the
+*   URL for a #N mention often lives here, not in the prose. Tool output can
+*   NEVER originate a pill on its own — a `gh pr list` dump (URLs, no `#N`)
+*   stays silent — but it satisfies the URL half for a PR the prose names.
 *
 * `onPullRequest` fires once per never-before-seen PR (keyed by
-* `owner/repo#number`) for the life of the scanner, regardless of which source
-* it came from. Construct one per run (or per conversation) and feed it the
-* same chunks the transcript reducer sees.
+* `owner/repo#number`). Construct one per run (or per conversation) and feed it
+* the same chunks the transcript reducer sees. See {@link collectRelevant}.
 */
 function createPullRequestScanner(onPullRequest) {
 	let text = "";
 	let lastPartId;
+	let toolUrlText = "";
 	const seen = /* @__PURE__ */ new Set();
-	const report = (buffer, final) => {
-		for (const pr of extractPullRequests(buffer, { requireCompleteNumber: !final })) {
+	const report = (final) => {
+		for (const pr of extractPullRequests(text, {
+			requireCompleteNumber: !final,
+			urlOnlyText: toolUrlText
+		})) {
 			if (seen.has(pr.key)) continue;
 			seen.add(pr.key);
 			onPullRequest(pr);
@@ -1183,7 +1282,8 @@ function createPullRequestScanner(onPullRequest) {
 		if (chunk["type"] === "tool-output-available") {
 			const outputText = stringifyToolOutput(chunk["output"]);
 			if (!outputText.includes("/pull/")) return;
-			report(outputText, true);
+			toolUrlText += `\n${outputText}`;
+			report(true);
 			return;
 		}
 		if (chunk["type"] !== "text-delta") return;
@@ -1191,13 +1291,12 @@ function createPullRequestScanner(onPullRequest) {
 		if (!delta) return;
 		const partId = typeof chunk["id"] === "string" ? chunk["id"] : void 0;
 		if (partId && lastPartId && partId !== lastPartId) {
-			if (text.includes("/pull/")) report(text, true);
+			report(true);
 			text = "";
 		}
 		text += delta;
 		lastPartId = partId ?? lastPartId;
-		if (!text.includes("/pull/")) return;
-		report(text, false);
+		report(false);
 	} };
 }
 
@@ -10884,10 +10983,13 @@ function ChatScreen({ agent, conversation }) {
 					text: recapText
 				});
 				setItems(loaded);
+				const toolUrlText = loaded.map((item) => item.kind === "tool" && item.output?.kind === "ok" ? stringifyToolOutput(item.output.value) : "").join("\n");
 				for (const item of loaded) {
-					const text = item.kind === "assistant-text" ? item.text : item.kind === "tool" && item.output?.kind === "ok" ? stringifyToolOutput(item.output.value) : null;
-					if (text === null) continue;
-					for (const pr of extractPullRequests(text, { requireCompleteNumber: false })) {
+					if (item.kind !== "assistant-text") continue;
+					for (const pr of extractPullRequests(item.text, {
+						requireCompleteNumber: false,
+						urlOnlyText: toolUrlText
+					})) {
 						if (reportedPrsRef.current.has(pr.key)) continue;
 						reportedPrsRef.current.set(pr.key, pr);
 						setPrLinks((prev) => [...prev, pr]);

package/dist/js/{client-DabRpc_T.mjs → client-DbqRBquD.mjs}

@@ -2,11 +2,14 @@
 import { a as mintPortalDeviceToken, c as unifyLegacyCliGrants, i as grantPortalAccess, n as fetchPortalDevices, r as findThisDevice } from "./api-DG5W6iwx.mjs";
 import os from "node:os";
 import { z } from "zod";
-import { execFile, spawn } from "node:child_process";
+import * as childProcess from "node:child_process";
+import { spawn } from "node:child_process";
 import net from "node:net";
 import { WebSocket, createWebSocketStream } from "ws";
 
 //#region ../portal-daemon/src/machine.ts
+const SCUTIL_TIMEOUT_MS = 2e3;
+const SCUTIL_ATTEMPTS = 3;
 /**
 * Identity this machine registers under on the portal.
 *
@@ -15,38 +18,74 @@ import { WebSocket, createWebSocketStream } from "ws";
 * row, so a grant applies to the machine no matter which surface the user
 * shared from. The name must therefore match what the desktop app registers —
 * on macOS that is `scutil --get LocalHostName` (the Rust client's own
-* derivation, stabler than the network-assigned hostname), with the plain
-* hostname as the fallback for other platforms or a failed read.
+* derivation, stabler than the network-assigned hostname).
+*
+* The machine name is a durable IDENTITY, not a fresh network reading: every
+* grant hangs off the device row keyed by this name, so if it changes the
+* device flips to a brand-new row with ZERO grants and every agent re-prompts
+* across every open CLI. `os.hostname()` is NOT durable — macOS rewrites it
+* from DHCP/DNS per network — so it must never be allowed to silently replace
+* a name we already registered under. Resolution order:
+*
+*   1. `scutil --get LocalHostName` (retried) — the stable, correct source.
+*   2. `previous` — the name we last successfully registered under, persisted
+*      by the daemon. Preferred over the volatile hostname so a transient
+*      `scutil` failure keeps our existing identity (and grants) intact.
+*   3. `os.hostname()` — last resort for a machine that has NEVER resolved a
+*      name (first run, non-macOS, scutil permanently unavailable).
 *
 * Historically the CLI suffixed `-cli` to keep a device distinct from the
 * desktop's; `unifyLegacyCliGrants` migrates grants off those rows.
 */
-async function resolveMachineIdentity() {
-	const fallback = fallbackHost();
-	if (process.platform !== "darwin") return {
-		machineName: fallback,
-		friendlyName: fallback
+async function resolveMachineIdentity(previous) {
+	const persisted = previous?.trim() || null;
+	if (process.platform !== "darwin") {
+		const machineName = persisted ?? fallbackHost();
+		return {
+			machineName,
+			friendlyName: machineName,
+			machineNameSource: persisted ? "persisted" : "hostname-fallback"
+		};
+	}
+	const local = await scutilRead("LocalHostName");
+	if (local) return {
+		machineName: local,
+		friendlyName: await scutilRead("ComputerName") ?? local,
+		machineNameSource: "scutil"
+	};
+	if (persisted) return {
+		machineName: persisted,
+		friendlyName: persisted,
+		machineNameSource: "persisted"
 	};
-	const local = await scutilRead("LocalHostName") ?? fallback;
+	const fallback = fallbackHost();
 	return {
-		machineName: local,
-		friendlyName: await scutilRead("ComputerName") ?? local
+		machineName: fallback,
+		friendlyName: fallback,
+		machineNameSource: "hostname-fallback"
 	};
 }
 function fallbackHost() {
 	return (os.hostname() || "machine").trim().replace(/\.local$/i, "") || "machine";
 }
 function scutilRead(key) {
-	return new Promise((resolve) => {
-		execFile("/usr/sbin/scutil", ["--get", key], { timeout: 2e3 }, (error, stdout) => {
-			if (error) {
-				resolve(null);
-				return;
-			}
-			const value = stdout.trim();
-			resolve(value.length > 0 ? value : null);
+	return attempt(0);
+	function attempt(n) {
+		return new Promise((resolve) => {
+			childProcess.execFile("/usr/sbin/scutil", ["--get", key], { timeout: SCUTIL_TIMEOUT_MS }, (error, stdout) => {
+				if (error) {
+					if (n + 1 < SCUTIL_ATTEMPTS) {
+						resolve(attempt(n + 1));
+						return;
+					}
+					resolve(null);
+					return;
+				}
+				const value = stdout.trim();
+				resolve(value.length > 0 ? value : null);
+			});
 		});
-	});
+	}
 }
 const INHERITED_ENV = [
 	"HOME",
@@ -550,9 +589,10 @@ var PortalClient = class {
 	}
 	async connectLoop() {
 		if (!this.machineName) {
-			const identity = await resolveMachineIdentity();
+			const identity = await resolveMachineIdentity(this.opts.persistedMachineName);
 			this.machineName = identity.machineName;
 			this.friendlyName = identity.friendlyName;
+			this.opts.onMachineName(identity.machineName, identity.machineNameSource);
 		}
 		let backoff = INITIAL_BACKOFF_MS;
 		while (this.enabled && !this.disposed) {

package/dist/js/client-hH2PJL8y.mjs

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+import { t as PortalClient } from "./client-DbqRBquD.mjs";
+import "./api-DG5W6iwx.mjs";
+
+export { PortalClient };

package/dist/js/{daemon-BfqJZ_M4.mjs → daemon-Djei8xaW.mjs}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import "./client-DabRpc_T.mjs";
-import { a as runPortalDaemon, i as queryDaemonStatus, n as ensureDaemonRunning, o as startPortalDaemon, r as isDaemonListening, s as stopDaemon, t as PortalDaemon } from "./daemon-ShOaDbZe.mjs";
+import "./client-DbqRBquD.mjs";
+import { a as runPortalDaemon, i as queryDaemonStatus, n as ensureDaemonRunning, o as startPortalDaemon, r as isDaemonListening, s as stopDaemon, t as PortalDaemon } from "./daemon-eb9dm6Ih.mjs";
 import "./api-DG5W6iwx.mjs";
 
 export { runPortalDaemon };

package/dist/js/daemon-client-Bemq-pLd.mjs

@@ -0,0 +1,7 @@
+#!/usr/bin/env node
+import "./client-DbqRBquD.mjs";
+import "./daemon-eb9dm6Ih.mjs";
+import "./api-DG5W6iwx.mjs";
+import { t as PortalDaemonClient } from "./daemon-client-N8rvGusv.mjs";
+
+export { PortalDaemonClient };

package/dist/js/{daemon-client-BVAlyN7x.mjs → daemon-client-N8rvGusv.mjs}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { c as LOCAL_PROTOCOL_VERSION, d as encodeLine, f as makeLineParser, n as ensureDaemonRunning, p as parseDaemonMessage, u as daemonPaths } from "./daemon-ShOaDbZe.mjs";
+import { c as LOCAL_PROTOCOL_VERSION, d as encodeLine, f as makeLineParser, n as ensureDaemonRunning, p as parseDaemonMessage, u as daemonPaths } from "./daemon-eb9dm6Ih.mjs";
 import { randomUUID } from "node:crypto";
 import { connect } from "node:net";
 

package/dist/js/{daemon-ShOaDbZe.mjs → daemon-eb9dm6Ih.mjs}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { n as isRecord, t as PortalClient } from "./client-DabRpc_T.mjs";
+import { n as isRecord, t as PortalClient } from "./client-DbqRBquD.mjs";
 import os from "node:os";
 import path from "node:path";
 import { z } from "zod";
@@ -20,7 +20,7 @@ import { access, appendFile, mkdir, readFile, unlink, writeFile } from "node:fs/
 * the commit time of the built tree is one monotonic clock they share.
 */
 function portalDaemonBuild() {
-	return "1786601366";
+	return "1786605017";
 }
 /**
 * Whether a client carrying `mine` should replace a running daemon carrying
@@ -365,6 +365,7 @@ var PortalDaemon = class {
 	conns = /* @__PURE__ */ new Set();
 	cwds = /* @__PURE__ */ new Map();
 	declined = /* @__PURE__ */ new Set();
+	persistedMachineName = null;
 	fallbackCwd;
 	idleTimer = null;
 	sessionToken = null;
@@ -499,12 +500,28 @@ var PortalDaemon = class {
 				deviceToken: this.deviceToken
 			}),
 			resolveCwd: (conversationId) => this.resolveCwd(conversationId),
+			persistedMachineName: this.persistedMachineName,
+			onMachineName: (name, source) => this.onMachineName(name, source),
 			onState: (state) => {
 				this.lastState = state;
 				this.broadcastState();
 			}
 		});
 	}
+	/**
+	* The identity resolved on connect. Persist the name so a later scutil
+	* failure reuses it instead of adopting the volatile hostname, and log the
+	* source — a `hostname-fallback` after we'd previously registered under
+	* scutil is the tell that a flap just orphaned this machine's grants.
+	*/
+	onMachineName(name, source) {
+		if (source === "hostname-fallback" && this.persistedMachineName) this.logInfo(`portal identity WARNING: fell back to hostname "${name}" but had previously registered as "${this.persistedMachineName}" — grants may be orphaned`);
+		else this.logInfo(`portal identity: "${name}" (source=${source})`);
+		if (name && name !== this.persistedMachineName) {
+			this.persistedMachineName = name;
+			this.persistState();
+		}
+	}
 	/** The cwd an exec for `conversationId` runs in. */
 	resolveCwd(conversationId) {
 		if (conversationId) {
@@ -538,7 +555,14 @@ var PortalDaemon = class {
 	/** Append a line to the daemon log file (best-effort, for post-hoc debugging). */
 	logError(context, error) {
 		const message = error instanceof Error ? error.message : String(error);
-		const line = `${(/* @__PURE__ */ new Date()).toISOString()} ${context}: ${message}\n`;
+		this.logLine(`${context}: ${message}`);
+	}
+	/** Append an informational line to the daemon log file (best-effort). */
+	logInfo(message) {
+		this.logLine(message);
+	}
+	logLine(message) {
+		const line = `${(/* @__PURE__ */ new Date()).toISOString()} ${message}\n`;
 		appendFile(this.paths.logPath, line).catch((_error) => {});
 	}
 	/** Close the listener without exiting the process (tests own the process). */
@@ -598,6 +622,7 @@ var PortalDaemon = class {
 				if (Array.isArray(parsed.declined)) {
 					for (const id of parsed.declined) if (typeof id === "string") this.declined.add(id);
 				}
+				if (typeof parsed.machineName === "string" && parsed.machineName) this.persistedMachineName = parsed.machineName;
 			}
 		} catch (_error) {}
 	}
@@ -605,7 +630,8 @@ var PortalDaemon = class {
 		const state = {
 			version: LOCAL_PROTOCOL_VERSION,
 			cwds: Object.fromEntries(this.cwds),
-			declined: [...this.declined]
+			declined: [...this.declined],
+			machineName: this.persistedMachineName ?? void 0
 		};
 		writeFile(this.paths.statePath, JSON.stringify(state)).catch((error) => {
 			this.logError("persistState failed", error);

package/dist/js/{print-share-CKLPmsg0.mjs → print-share-BH9gvCls.mjs}

@@ -14,7 +14,7 @@ import { n as printError } from "./output-DYzzdXYV.mjs";
 * the reply (and to --json).
 */
 async function connectMachineShare({ appUrl, sessionToken, timeoutHint }) {
-	const { PortalClient } = await import("./client-BuU34IVE.mjs");
+	const { PortalClient } = await import("./client-hH2PJL8y.mjs");
 	let signalConnected;
 	const connected = new Promise((resolve) => {
 		signalConnected = resolve;
@@ -26,6 +26,8 @@ async function connectMachineShare({ appUrl, sessionToken, timeoutHint }) {
 			deviceToken: null
 		}),
 		resolveCwd: () => process.cwd(),
+		persistedMachineName: null,
+		onMachineName: () => {},
 		onState: (state) => {
 			if (state.status === "connected") signalConnected();
 			if (state.status === "error") console.error(`portal: connection error: ${state.error ?? "unknown"}; retrying`);

package/dist/js/{profiler-0_q2DHpq.mjs → profiler-B97UpfHm.mjs}

@@ -8,7 +8,7 @@ import fs from "node:fs";
 
 //#region package.json
 var name = "skydive-cli";
-var version$1 = "0.5.0-beta.13";
+var version$1 = "0.5.0-beta.15";
 
 //#endregion
 //#region src/auth/organization.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skydive-cli",
-  "version": "0.5.0-beta.13",
+  "version": "0.5.0-beta.15",
   "description": "Skydive CLI — cloud agents from the command line",
   "homepage": "https://skydive.com",
   "license": "MIT",

package/dist/js/client-BuU34IVE.mjs

@@ -1,5 +0,0 @@
-#!/usr/bin/env node
-import { t as PortalClient } from "./client-DabRpc_T.mjs";
-import "./api-DG5W6iwx.mjs";
-
-export { PortalClient };

package/dist/js/daemon-client-D_MeDMpn.mjs

@@ -1,7 +0,0 @@
-#!/usr/bin/env node
-import "./client-DabRpc_T.mjs";
-import "./daemon-ShOaDbZe.mjs";
-import "./api-DG5W6iwx.mjs";
-import { t as PortalDaemonClient } from "./daemon-client-BVAlyN7x.mjs";
-
-export { PortalDaemonClient };