skydive-cli 0.5.0-beta.2 → 0.5.0-beta.21

package/CHANGELOG.md

@@ -9,6 +9,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
+- First run in a workspace with no agents now sets you up automatically: instead of dropping you on an empty agent picker, `skydive` creates your first agent for you (with a suggested name and avatar, mirroring the web onboarding flow) and then offers to have it learn how you already work — reading the other coding agents set up on your machine (Claude Code, Cursor, Codex, and more), the same import that `skydive import` runs, with a plan shown first and credentials never copied. Decline and you go straight into the new agent's chat. You can replay this flow anytime with `skydive --onboarding` (or `SKYDIVE_FORCE_ONBOARDING=1`), even in a workspace that already has agents.
+- `/computer` (alias `/stats`) in the chat TUI — a snapshot of the agent's sandbox drawn as colored bar graphs: CPU load (scaled to core count), memory, swap (when present), and disk usage, plus uptime and process count. Bars turn amber past 75%% and red past 90%% so a glance tells you whether the box is under pressure. The card keeps itself current quietly (a slow background refresh, no flicker or "updating" chrome); only the most recent card refreshes, and it silently stops while you're scrolled up (no wasted polls on a card you're not looking at) and resumes at the bottom. Stats are read over the same relay `skydive sandbox` uses, so it's gated on EDIT access to the agent like the other sandbox commands.
 - `skydive fs` — a namespace for working with the files on an agent's computer (its sandbox) from your own machine. Its first subcommand, `skydive fs edit <path>`, reads a remote file down over the same relay `skydive sandbox` uses, opens it in your local editor (`$VISUAL`/`$EDITOR`, override with `--editor`, defaults to `vi`), and writes your changes back atomically when you save and close — so you can edit a remote file as if it were local without opening the chat TUI. A path that doesn't exist yet is created on save; no changes means nothing is written. Access is gated on EDIT permission for the agent, exactly like `skydive sandbox`. (A first-class `fs` relay channel and `skydive fs mount` land in follow-ups.)
 
 ## [0.4.0] - 2026-08-07

package/README.md

@@ -261,6 +261,16 @@ internal API. On launch it walks you through:
    formatting, collapsed reasoning, and rich rendering of tool calls
    (`bash`, `edit`/`write` diffs, `read`, `grep`/`glob`).
 
+The chat TUI remembers the last agent you talked to: every conversation it
+opens records that agent as your default, and the next bare `skydive chat`
+drops straight into a new conversation with it — no picker. An explicit
+`--agent` or `--resume` still wins for that invocation, and the conversation
+it opens sets the default like any other. You can also seed or override the
+default by hand with `skydive config set defaultAgent <id|slug|name>`. A
+stored value that no longer matches (renamed or archived agent) falls back
+to the agent picker with a notice, and picking an agent there heals it
+automatically.
+
 You can change conversation without leaving chat. `/conversation` (aliases
 `/conversations`, `/conv`) reopens the conversation list, and
 `/conversation <id>` — an id, its `/c/<id>` link, or a pasted
@@ -463,10 +473,11 @@ skydive config path                 # print the config.json location
 
 Editable keys:
 
-| Key                   | Type    | Effect                                                                                                                                                                                                                          |
-| --------------------- | ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `shareMachineDefault` | boolean | When `true`, `skydive chat` (TUI and `-p`) shares this machine over the portal on launch, as if `--share-machine` were passed. An explicit `--share-machine`/`--no-share-machine` overrides it per invocation. Default `false`. |
-| `updateCheck`         | boolean | When `false`, disables the daily background update check and its "Update available" notice. The persistent equivalent of setting `SKYDIVE_NO_UPDATE_CHECK` (or `NO_UPDATE_NOTIFIER`) in the environment. Default `true`.        |
+| Key                   | Type    | Effect                                                                                                                                                                                                                                                                                                                                                                                     |
+| --------------------- | ------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `shareMachineDefault` | boolean | When `true`, `skydive chat` (TUI and `-p`) shares this machine over the portal on launch, as if `--share-machine` were passed. An explicit `--share-machine`/`--no-share-machine` overrides it per invocation. Default `false`.                                                                                                                                                            |
+| `updateCheck`         | boolean | When `false`, disables the daily background update check and its "Update available" notice. The persistent equivalent of setting `SKYDIVE_NO_UPDATE_CHECK` (or `NO_UPDATE_NOTIFIER`) in the environment. Default `true`.                                                                                                                                                                   |
+| `defaultAgent`        | string  | Agent (id, slug, or name) a bare `skydive chat` opens a new conversation with, skipping the agent picker. Maintained automatically: every conversation the chat TUI opens records its agent here (last used wins). `skydive config set defaultAgent` seeds or overrides it; an explicit `--agent`/`--resume` wins per invocation; a value that no longer matches falls back to the picker. |
 
 The remaining keys (`apiKey`, `apiUrl`, `sessionToken`, `appUrl`, `themeDark`,
 `themeLight`, …) are credentials or flow-managed state — leave them to the

package/dist/js/api-DG5W6iwx.mjs

@@ -0,0 +1,131 @@
+#!/usr/bin/env node
+import { t as HttpError } from "./http-error-DzyrsLAZ.mjs";
+import { z } from "zod";
+
+//#region ../portal-daemon/src/api.ts
+/**
+* The portal's session-authed REST surface, shared by `PortalClient` (the
+* TUI/`portal open` connection) and the `skydive portal` management
+* commands, so the endpoint contracts and response schemas live in exactly
+* one place.
+*/
+const deviceSchema = z.object({
+	id: z.string(),
+	machineName: z.string(),
+	friendlyName: z.string(),
+	connected: z.boolean(),
+	lastSeen: z.string().nullable(),
+	grantedAgentIds: z.array(z.string())
+});
+const devicesResponseSchema = z.object({
+	devices: z.array(deviceSchema),
+	agents: z.array(z.object({
+		id: z.string(),
+		name: z.string()
+	}))
+});
+const deviceTokenSchema = z.object({ token: z.string().min(1) });
+async function portalFetch(auth, path, init) {
+	const res = await fetch(`${auth.appUrl}${path}`, {
+		method: init.method,
+		headers: {
+			authorization: `Bearer ${auth.sessionToken}`,
+			accept: "application/json",
+			...init.body ? { "content-type": "application/json" } : {}
+		},
+		...init.body ? { body: init.body } : {}
+	});
+	if (!res.ok) {
+		const body = await res.text().catch(() => "");
+		throw new HttpError(res.status, body);
+	}
+	return res.json();
+}
+async function fetchPortalDevices(auth) {
+	const json = await portalFetch(auth, "/api/v1/portal/devices", { method: "GET" });
+	return devicesResponseSchema.parse(json);
+}
+const registerResponseSchema = z.object({ device: z.object({ id: z.string() }) });
+/**
+* Register this machine's device row without connecting. Connecting registers
+* as a side effect; this covers granting an agent on a machine that has never
+* shared yet (the grant references the device row).
+*/
+async function registerPortalDevice(auth, { machineName, friendlyName }) {
+	const json = await portalFetch(auth, "/api/v1/portal/devices", {
+		method: "POST",
+		body: JSON.stringify({
+			machineName,
+			friendlyName
+		})
+	});
+	return registerResponseSchema.parse(json).device;
+}
+/** Short-lived token the machine presents when dialing the portal WebSocket. */
+async function mintPortalDeviceToken(auth) {
+	const json = await portalFetch(auth, "/api/v1/portal/device-token", { method: "POST" });
+	return deviceTokenSchema.parse(json).token;
+}
+const forwardTargetSchema = z.object({
+	daemonOrigin: z.string().min(1),
+	token: z.string().min(1),
+	expiresInSeconds: z.number()
+});
+/**
+* Everything `portal forward` needs to dial an agent's sandbox daemon through
+* the agent-webserver edge Worker: the daemon's stable public origin and a
+* daemon auth token (canUse-gated server-side).
+*/
+async function fetchForwardTarget(auth, agentId) {
+	const json = await portalFetch(auth, "/api/v1/portal/forward-target", {
+		method: "POST",
+		body: JSON.stringify({ agentId })
+	});
+	return forwardTargetSchema.parse(json);
+}
+async function grantPortalAccess(auth, { deviceId, agentId, conversationId }) {
+	await portalFetch(auth, `/api/v1/portal/devices/${encodeURIComponent(deviceId)}/grants`, {
+		method: "POST",
+		body: JSON.stringify({
+			agentId,
+			conversationId
+		})
+	});
+}
+async function revokePortalAccess(auth, { deviceId, agentId }) {
+	await portalFetch(auth, `/api/v1/portal/devices/${encodeURIComponent(deviceId)}/grants/${encodeURIComponent(agentId)}`, { method: "DELETE" });
+}
+/**
+* The device row for a given machine identity. Matching is by `machineName`
+* equality — the stable handle the machine registers under, not the display
+* label.
+*/
+function findThisDevice(devices, machineName) {
+	return devices.find((device) => device.machineName === machineName) ?? null;
+}
+/**
+* One-time grant migration onto the merged device. Earlier CLI builds
+* registered a separate `<machineName>-cli` device, so a user's existing
+* approvals hang off that row; the merged device would start with zero grants
+* and every already-authorized agent would ask again. Copy any grant the
+* merged device is missing (the grant endpoint upserts, so re-runs are
+* no-ops). The legacy row is left in place — an old CLI build may still
+* connect under it. Returns how many grants were copied.
+*/
+async function unifyLegacyCliGrants(auth, machineName) {
+	const { devices } = await fetchPortalDevices(auth);
+	const merged = findThisDevice(devices, machineName);
+	const legacy = findThisDevice(devices, `${machineName}-cli`);
+	if (!merged || !legacy) return 0;
+	const have = new Set(merged.grantedAgentIds);
+	const missing = legacy.grantedAgentIds.filter((id) => !have.has(id));
+	for (const agentId of missing) await grantPortalAccess(auth, {
+		deviceId: merged.id,
+		agentId,
+		conversationId: null
+	});
+	return missing.length;
+}
+
+//#endregion
+export { mintPortalDeviceToken as a, unifyLegacyCliGrants as c, grantPortalAccess as i, fetchPortalDevices as n, registerPortalDevice as o, findThisDevice as r, revokePortalAccess as s, fetchForwardTarget as t };

package/dist/js/bin.mjs

@@ -1,13 +1,14 @@
 #!/usr/bin/env node
-import { C as ensureActiveOrganization, D as setActiveWorkspace, E as listWorkspaces, O as name, T as getSessionIdentity, a as installCrashHandler, k as version, t as maybeStartProfiling, u as brandHelpArt, w as getActiveWorkspaceId, x as themes } from "./profiler-y43HVmq7.mjs";
-import { A as getStoredApiKeyWorkspaceName, C as getLastSeenVersion, F as resolveManagementAuth, I as resolveSession, M as resolveAppUrl, N as resolveChatAuth, O as getShareMachineDefault, P as resolveConfig, R as saveConfig, S as getConfigPath, T as getPromptHistoryPath, V as setLastSeenVersion, _ as API_KEY_PREFIX, b as PREFERENCES, g as API_KEY_FAMILY_PREFIX, h as API_KEYS_URL, i as resolveAgent, j as getUpdateCheckDisabled, k as getStoredApiKeyId, v as DEFAULT_API_URL, w as getPreference, x as deleteConfig, z as saveSession } from "./print-CbayCa87.mjs";
+import { A as setActiveWorkspace, D as getActiveWorkspaceId, E as ensureActiveOrganization, M as version, O as getSessionIdentity, S as themes, T as machineOsFromPlatform, a as installCrashHandler, j as name, k as listWorkspaces, t as maybeStartProfiling, u as brandHelpArt, w as buildImportSeedPrompt } from "./profiler-Bl25cyUp.mjs";
+import { A as getStoredApiKeyId, B as saveConfig, C as getDefaultAgent, E as getPromptHistoryPath, F as resolveChatAuth, I as resolveConfig, L as resolveManagementAuth, M as getUpdateCheckDisabled, P as resolveAppUrl, R as resolveSession, S as getConfigPath, T as getPreference, U as setLastSeenVersion, V as saveSession, _ as API_KEY_PREFIX, b as PREFERENCES, g as API_KEY_FAMILY_PREFIX, h as API_KEYS_URL, i as resolveAgent, j as getStoredApiKeyWorkspaceName, k as getShareMachineDefault, v as DEFAULT_API_URL, w as getLastSeenVersion, x as deleteConfig } from "./print-OvYyj6Uk.mjs";
 import { n as printError, r as printTable, t as output } from "./output-DYzzdXYV.mjs";
 import { t as HttpError } from "./http-error-DzyrsLAZ.mjs";
-import { t as createRestClient } from "./rest-BY2nADw5.mjs";
+import { t as createRestClient } from "./rest-Dx6b-Nq_.mjs";
 import "./billing-blocked-2wju4gC_.mjs";
-import { a as registerPortalDevice, c as resolveMachineIdentity, i as grantPortalAccess, n as fetchPortalDevices, o as revokePortalAccess, r as findThisDevice } from "./client-Dd5sMXPv.mjs";
-import { i as queryDaemonStatus, l as PORTAL_DAEMON_FLAG, n as ensureDaemonRunning, s as stopDaemon, u as daemonPaths } from "./daemon-Bq93vOIk.mjs";
-import { t as SandboxStream } from "./client-Cn2af31H.mjs";
+import { r as resolveMachineIdentity } from "./client-DbqRBquD.mjs";
+import { i as queryDaemonStatus, l as PORTAL_DAEMON_FLAG, n as ensureDaemonRunning, s as stopDaemon, u as daemonPaths } from "./daemon-Dj9tGT12.mjs";
+import { i as grantPortalAccess, n as fetchPortalDevices, o as registerPortalDevice, r as findThisDevice, s as revokePortalAccess } from "./api-DG5W6iwx.mjs";
+import { t as SandboxStream } from "./client-c4c5MmgN.mjs";
 import { hideBin } from "yargs/helpers";
 import yargs from "yargs";
 import os, { hostname, tmpdir } from "node:os";
@@ -1462,19 +1463,6 @@ function ensureBunAndReexec(onProgress) {
 
 //#endregion
 //#region src/commands/import.ts
-/**
-* The first message of the import conversation, sent as the user. It hands
-* the real work to the agent's `import-config` skill; this text only needs
-* to establish intent, anchor the starting directory, and set the two
-* expectations the user cares about most (plan first, no credentials).
-*/
-function buildImportSeedPrompt(projectDir) {
-	return [
-		"I'm migrating from another coding agent. Import my setup from this machine.",
-		"",
-		`Use your import-config skill. I ran this from \`${projectDir}\`, so start there and in my home directory. Don't assume one tool — do the discovery sweep so you catch whatever I actually use (Claude Code, Cursor, Codex, Gemini CLI, Copilot, Windsurf, Cline, OpenCode, Aider, and any nested AGENTS.md). Show me the plan first: everything you found, what you'll bring over, where it lands in you, and anything you're leaving out (credentials especially). Then wait for my OK before committing anything.`
-	].join("\n");
-}
 const importCommand = {
 	command: "import",
 	describe: "Import your existing coding-agent setup (Claude Code, Cursor, Codex, Gemini, Copilot, and more) into an agent (opens a machine-shared chat)",
@@ -1516,7 +1504,7 @@ const importCommand = {
 				process.exit(1);
 			}
 		}
-		const { runChat } = await import("./boot-DFYFjlht.mjs");
+		const { runChat } = await import("./boot-DcQhJadu.mjs");
 		await runChat({
 			appUrl,
 			sessionToken: session.value.sessionToken,
@@ -1526,7 +1514,9 @@ const importCommand = {
 			agentSelector: argv.agent ?? null,
 			conversationId: null,
 			newConversation: false,
-			seedPrompt: buildImportSeedPrompt(process.cwd())
+			defaultAgentSelector: getDefaultAgent(),
+			forceOnboarding: false,
+			seedPrompt: buildImportSeedPrompt(process.cwd(), machineOsFromPlatform(process.platform))
 		});
 	}
 };
@@ -1543,15 +1533,15 @@ async function runImportPrintMode({ argv, appUrl }) {
 		printError(`${session.error.message} For non-interactive use, run \`skydive auth login --web\` first, or set SKYDIVE_SESSION_TOKEN.`);
 		process.exit(1);
 	}
-	const { connectMachineShare } = await import("./print-share-C1LPsgTP.mjs");
+	const { connectMachineShare } = await import("./print-share-BH9gvCls.mjs");
 	const machineShare = await connectMachineShare({
 		appUrl,
 		sessionToken: session.value.sessionToken,
 		timeoutHint: "Check `skydive portal status`, then re-run."
 	});
 	const extra = (argv.print ?? "").trim();
-	const prompt = buildImportSeedPrompt(process.cwd()) + (extra ? `\n\nAdditional instructions: ${extra}` : "");
-	const { runPrint } = await import("./print-ba_0hiV9.mjs");
+	const prompt = buildImportSeedPrompt(process.cwd(), machineOsFromPlatform(process.platform)) + (extra ? `\n\nAdditional instructions: ${extra}` : "");
+	const { runPrint } = await import("./print-C8DHKrJu.mjs");
 	try {
 		const result = await runPrint({
 			appUrl,
@@ -1877,6 +1867,10 @@ const chatCommand = {
 		type: "boolean",
 		default: false,
 		describe: "Start a fresh conversation instead of opening the conversation list. With --agent, opens a new conversation with that agent directly. Without --agent, opens a new conversation once you pick an agent (auto-picked if the account has only one). Ignored with --resume, which always continues the named conversation."
+	}).option("onboarding", {
+		type: "boolean",
+		default: false,
+		describe: "Force the first-run onboarding flow (auto-create a first agent, then offer the machine import) even when the workspace already has agents. Also settable via SKYDIVE_FORCE_ONBOARDING=1. Handy for replaying the new-user experience; ignored with -p, --resume, or --agent."
 	}).option("share-machine", {
 		type: "boolean",
 		describe: "Share this machine with the agent over the portal so it can run commands here (default-deny; in the TUI you approve per agent, with -p the flag grants the target agent for the run). Defaults to `shareMachineDefault` in the CLI config file; --no-share-machine disables for this invocation."
@@ -1928,7 +1922,7 @@ const chatCommand = {
 			sessionToken: auth.value.token,
 			agentSelector: argv.agent ?? null
 		});
-		const { runChat } = await import("./boot-DFYFjlht.mjs");
+		const { runChat } = await import("./boot-DcQhJadu.mjs");
 		await runChat({
 			appUrl: auth.value.appUrl,
 			sessionToken: auth.value.token,
@@ -1940,6 +1934,8 @@ const chatCommand = {
 			agentSelector: argv.agent ?? null,
 			conversationId: argv.conversation ?? null,
 			newConversation: resolveNewConversation(argv),
+			forceOnboarding: resolveForceOnboarding(argv),
+			defaultAgentSelector: getDefaultAgent(),
 			seedPrompt: null
 		});
 	}
@@ -1961,6 +1957,20 @@ function resolveNewConversation(argv) {
 	return argv.new === true && !argv.conversation;
 }
 /**
+* Whether to force the first-run onboarding flow: the `--onboarding` flag or
+* `SKYDIVE_FORCE_ONBOARDING` (any non-empty, non-"0"/"false" value). Lets the
+* new-user experience be replayed in a workspace that already has agents. The
+* TUI applies it only to a bare interactive launch — an explicit
+* `--agent`/`--resume`/`--new` still takes precedence.
+*/
+function resolveForceOnboarding(argv, env = process.env) {
+	if (argv.onboarding === true) return true;
+	const raw = env["SKYDIVE_FORCE_ONBOARDING"];
+	if (raw === void 0) return false;
+	const value = raw.trim().toLowerCase();
+	return value !== "" && value !== "0" && value !== "false";
+}
+/**
 * Cross-workspace `--agent <uuid>` handling shared by the TUI and -p paths:
 * on a hit in another workspace, switch to it and say so on stderr (stdout
 * may carry the -p reply/JSON envelope); when the id matches no workspace on
@@ -1995,7 +2005,7 @@ async function runPrintMode({ argv, appUrl }) {
 		printError(`${auth.error.message} For non-interactive use, run \`skydive auth login\` first, or set SKYDIVE_API_KEY / SKYDIVE_SESSION_TOKEN.`);
 		process.exit(1);
 	}
-	const { runPrint, readStdin } = await import("./print-ba_0hiV9.mjs");
+	const { runPrint, readStdin } = await import("./print-C8DHKrJu.mjs");
 	await ensureAgentWorkspace({
 		appUrl,
 		sessionToken: auth.value.token,
@@ -2020,7 +2030,7 @@ async function runPrintMode({ argv, appUrl }) {
 			process.exit(1);
 		}
 	} else {
-		const { connectMachineShare } = await import("./print-share-C1LPsgTP.mjs");
+		const { connectMachineShare } = await import("./print-share-BH9gvCls.mjs");
 		machineShare = await connectMachineShare({
 			appUrl: auth.value.appUrl,
 			sessionToken: auth.value.token,
@@ -2084,7 +2094,7 @@ const getCommand$1 = {
 			printError(`${auth.error.message} Run \`skydive auth login\` first, or set SKYDIVE_API_KEY / SKYDIVE_SESSION_TOKEN.`);
 			process.exit(1);
 		}
-		const { messageGet } = await import("./print-ba_0hiV9.mjs");
+		const { messageGet } = await import("./print-C8DHKrJu.mjs");
 		try {
 			const result = await messageGet({
 				appUrl: auth.value.appUrl,
@@ -2287,7 +2297,7 @@ const switchCommand = {
 				printError("The workspace picker needs the Bun runtime and it could not be set up automatically. Pass a workspace slug instead, or install Bun and retry.");
 				process.exit(1);
 			}
-			const { runWorkspacePicker } = await import("./boot-DFYFjlht.mjs");
+			const { runWorkspacePicker } = await import("./boot-DcQhJadu.mjs");
 			await runWorkspacePicker(session);
 			return;
 		}
@@ -2336,7 +2346,7 @@ const workspaceCommand = {
 */
 async function resolveGrantTarget(argv) {
 	const session = requireSession(argv);
-	const [{ devices, agents }, identity] = await Promise.all([fetchPortalDevices(session), resolveMachineIdentity()]);
+	const [{ devices, agents }, identity] = await Promise.all([fetchPortalDevices(session), resolveMachineIdentity(null)]);
 	return {
 		session,
 		agent: resolveAgent(agents, argv.agent),
@@ -2365,8 +2375,8 @@ const openCommand = {
 		const session = requireSession(argv);
 		const agent = argv.agent ? resolveAgent((await fetchPortalDevices(session)).agents, argv.agent) : null;
 		const cwd = argv.cwd ? path.resolve(argv.cwd) : process.cwd();
-		const { machineName } = await resolveMachineIdentity();
-		const { PortalDaemonClient } = await import("./daemon-client-srAit8Fz.mjs");
+		const { machineName } = await resolveMachineIdentity(null);
+		const { PortalDaemonClient } = await import("./daemon-client-CgpMgM8Q.mjs");
 		let lastLine = "";
 		let signalConnected;
 		const connected = new Promise((resolve) => {
@@ -2395,7 +2405,7 @@ const openCommand = {
 		client.enable();
 		await connected;
 		if (agent) {
-			await client.grantAgent(agent.id);
+			await client.grantAgent(agent.id, null);
 			console.log(`portal: granted ${agent.name} access to this machine (persists until revoked)`);
 		}
 		console.log(`portal: open. granted agents can run commands on ${machineName} as your user, cwd ${cwd}. ctrl+c to close.`);
@@ -2415,7 +2425,8 @@ const grantCommand = {
 		})).id;
 		await grantPortalAccess(session, {
 			deviceId,
-			agentId: agent.id
+			agentId: agent.id,
+			conversationId: null
 		});
 		if (argv.json) {
 			output(argv, {
@@ -2424,7 +2435,7 @@ const grantCommand = {
 			});
 			return;
 		}
-		console.log(`Granted ${agent.name} access to ${device?.friendlyName ?? friendlyName}. The agent can run commands here whenever its portal is open. Start with \`skydive portal open\`, or pass \`--share-machine\` on a \`chat -p\` run. Revoke with \`skydive portal revoke --agent ${agent.name}\`.`);
+		console.log(`Granted ${agent.name} access to ${device?.friendlyName ?? friendlyName}. The agent can run commands here whenever its portal is open. Start with \`skydive portal open\`, or pass \`--share-machine\` on a \`chat -p\` run. Revoke with \`skydive portal revoke --agent "${agent.name}"\`.`);
 	}
 };
 const revokeCommand = {
@@ -2464,7 +2475,7 @@ const statusCommand = {
 			console.log("No machines registered. Run `skydive portal open` to register this one.");
 			return;
 		}
-		const { headers, rows } = buildDeviceTable(devices, agents, (await resolveMachineIdentity()).machineName);
+		const { headers, rows } = buildDeviceTable(devices, agents, (await resolveMachineIdentity(null)).machineName);
 		printTable(headers, rows);
 	}
 };
@@ -2592,10 +2603,45 @@ const daemonCommand = {
 	builder: (y) => y.command(daemonStatusCommand).command(daemonStopCommand).command(daemonStartCommand).command(daemonRestartCommand).command(daemonLogsCommand).demandCommand(1, "Specify a subcommand: status, stop, start, restart, logs"),
 	handler: () => {}
 };
+const forwardCommand = {
+	command: "forward <port>",
+	describe: "Forward localhost:<port> to the agent sandbox's port, so a dev server running in the sandbox is reachable at http://localhost:<port> (stays in the foreground; ctrl+c to stop)",
+	builder: (y) => y.positional("port", {
+		type: "number",
+		demandOption: true,
+		describe: "Sandbox port to forward to (e.g. 3000 for a dev server)"
+	}).option("agent", {
+		type: "string",
+		describe: "Agent, by id or name (defaults when the account has one)"
+	}).option("local-port", {
+		type: "number",
+		describe: "Local port to listen on (default: same as <port>)"
+	}),
+	handler: async (argv) => {
+		const session = requireSession(argv);
+		const agent = resolveAgent((await fetchPortalDevices(session)).agents, argv.agent ?? null);
+		const targetPort = argv.port;
+		const localPort = argv["local-port"] ?? targetPort;
+		const { startForward } = await import("./forward-18QoL5dO.mjs");
+		const listener = await startForward({
+			auth: session,
+			agentId: agent.id,
+			localPort,
+			targetPort,
+			log: (msg) => console.error(msg)
+		});
+		console.log(`Forwarding http://localhost:${listener.port} -> ${agent.name}'s sandbox port ${targetPort}. ctrl+c to stop.`);
+		await new Promise((resolve) => {
+			process.once("SIGINT", () => resolve());
+			process.once("SIGTERM", () => resolve());
+		});
+		await listener.close();
+	}
+};
 const portalCommand = {
 	command: "portal",
 	describe: "Open this machine's portal to agents and manage their access",
-	builder: (y) => y.command(openCommand).command(grantCommand).command(revokeCommand).command(statusCommand).command(daemonCommand).demandCommand(1, "Specify a subcommand: open, grant, revoke, status, daemon"),
+	builder: (y) => y.command(openCommand).command(grantCommand).command(revokeCommand).command(statusCommand).command(forwardCommand).command(daemonCommand).demandCommand(1, "Specify a subcommand: open, grant, revoke, status, forward, daemon"),
 	handler: () => {}
 };
 
@@ -2640,8 +2686,8 @@ const sandboxCommand = {
 	}).example("skydive sandbox --agent grace", "Live terminal (Ctrl-] detaches)").example("skydive sandbox --agent grace -- tail -n 50 /tmp/harness.log", "One-shot command (use `--` so its flags reach the sandbox)").example("skydive sandbox --agent grace -- sh -c 'ls /tmp | wc -l'", "Shell features go through an explicit `sh -c`"),
 	handler: async (argv) => {
 		const session = requireSession(argv);
-		const { createRestClient } = await import("./rest-DADJh0bi.mjs");
-		const { resolveAgent } = await import("./print-ba_0hiV9.mjs");
+		const { createRestClient } = await import("./rest-DW05dMMc.mjs");
+		const { resolveAgent } = await import("./print-C8DHKrJu.mjs");
 		const client = createRestClient({
 			appUrl: session.appUrl,
 			sessionToken: session.sessionToken
@@ -2710,7 +2756,7 @@ async function runPty({ session, agentId, agentName }) {
 		return 1;
 	}
 	console.error(`Connecting to ${agentName}'s sandbox… (Ctrl-] detaches)`);
-	const { runRawPtyPassthrough } = await import("./raw-pty-3EkG-jjH.mjs");
+	const { runRawPtyPassthrough } = await import("./raw-pty-DmdUf4_w.mjs");
 	const result = await runRawPtyPassthrough({
 		stdin: process.stdin,
 		stdout: process.stdout,
@@ -2798,8 +2844,8 @@ const fsEditCommand = {
 	handler: async (argv) => {
 		const session = requireSession(argv);
 		const remotePath = argv.path;
-		const { createRestClient } = await import("./rest-DADJh0bi.mjs");
-		const { resolveAgent } = await import("./print-ba_0hiV9.mjs");
+		const { createRestClient } = await import("./rest-DW05dMMc.mjs");
+		const { resolveAgent } = await import("./print-C8DHKrJu.mjs");
 		const client = createRestClient({
 			appUrl: session.appUrl,
 			sessionToken: session.sessionToken
@@ -3680,6 +3726,11 @@ function resolvePreference(key) {
 	}
 	return pref;
 }
+/** Human rendering of a preference value; unset string preferences (null)
+* print as empty rather than the string "null". */
+function formatValue(value) {
+	return value === null ? "" : String(value);
+}
 /** One row's worth of state for a preference, used by `list` and `get`. */
 function snapshot(pref) {
 	return {
@@ -3706,7 +3757,7 @@ const listCommand = {
 			"Description"
 		], rows.map((r) => [
 			r.key,
-			String(r.value),
+			formatValue(r.value),
 			r.source,
 			r.describe
 		]));
@@ -3727,7 +3778,7 @@ const getCommand = {
 			output(argv, snapshot(pref));
 			return;
 		}
-		console.log(String(pref.read()));
+		console.log(formatValue(pref.read()));
 	}
 };
 const setCommand = {
@@ -3745,17 +3796,16 @@ const setCommand = {
 	}),
 	handler: (argv) => {
 		const pref = resolvePreference(argv.key);
-		const parsed = pref.parse(argv.value ?? "");
-		if (parsed.isErr()) {
-			printError(`${pref.key}: ${parsed.error}`);
+		const result = pref.set(argv.value ?? "");
+		if (result.isErr()) {
+			printError(`${pref.key}: ${result.error}`);
 			process.exit(1);
 		}
-		pref.write(parsed.value);
 		if (argv.json) {
 			output(argv, snapshot(pref));
 			return;
 		}
-		if (!argv.quiet) console.log(`Set ${pref.key} = ${String(parsed.value)}`);
+		if (!argv.quiet) console.log(`Set ${pref.key} = ${formatValue(pref.read())}`);
 	}
 };
 const unsetCommand = {
@@ -3775,7 +3825,10 @@ const unsetCommand = {
 			output(argv, snapshot(pref));
 			return;
 		}
-		if (!argv.quiet) console.log(`Unset ${pref.key} (now ${String(pref.read())} by default)`);
+		if (!argv.quiet) {
+			const fallback = pref.read();
+			console.log(fallback === null ? `Unset ${pref.key}` : `Unset ${pref.key} (now ${formatValue(fallback)} by default)`);
+		}
 	}
 };
 const pathCommand = {
@@ -4026,7 +4079,7 @@ function setupUpdateCheck(argv) {
 
 //#endregion
 //#region src/changelog.generated.ts
-const CHANGELOG_MD = "# Changelog\n\nAll notable changes to the Skydive CLI are documented here.\n\nThe format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),\nand this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).\n\n## [Unreleased]\n\n### Added\n\n- `skydive fs` — a namespace for working with the files on an agent's computer (its sandbox) from your own machine. Its first subcommand, `skydive fs edit <path>`, reads a remote file down over the same relay `skydive sandbox` uses, opens it in your local editor (`$VISUAL`/`$EDITOR`, override with `--editor`, defaults to `vi`), and writes your changes back atomically when you save and close — so you can edit a remote file as if it were local without opening the chat TUI. A path that doesn't exist yet is created on save; no changes means nothing is written. Access is gated on EDIT permission for the agent, exactly like `skydive sandbox`. (A first-class `fs` relay channel and `skydive fs mount` land in follow-ups.)\n\n## [0.4.0] - 2026-08-07\n\n### Added\n\n- `skydive chat` works with API key auth: an API key alone now opens the chat TUI (and headless `chat -p`) without a browser login, using the key's pinned workspace.\n- `skydive config` command to view and set the safe, hand-editable CLI preferences (`shareMachineDefault`, `updateCheck`) without opening `config.json`. `config`/`config list` shows each key, its effective value, and whether it comes from the file or the built-in default; `config get`/`set`/`unset` read and change one key; `config path` prints the config file location. It only ever touches those preference keys, never credentials or flow-managed state.\n- Billing-blocked sends and runs now surface the server-authored recovery\n  guidance from the typed billing outcome. The chat TUI renders it as a\n  warning-toned system-notice row — live when a send is refused or a run is\n  stopped at the billing boundary, and again when reopening a conversation\n  that holds a persisted billing notice — instead of a generic error.\n  Headless `chat -p` and `messages get` print the guidance (state, recovery\n  step, and manage-billing URL) on stderr, keep any partial output already\n  streamed on stdout, and exit with code `5` (distinct from the generic `1`)\n  so scripted callers can tell a billing pause from a failure.\n- Syntax highlighting for 14 more languages in the chat transcript and file/review panes (python, bash, go, rust, c, cpp, java, ruby, css, html, json, yaml, and more) — previously only JavaScript/TypeScript rendered colored.\n\n### Changed\n\n- `skydive agent list` lists the full agent roster by default instead of a truncated page.\n\n### Fixed\n\n- Long multi-line bash tool-call commands (e.g. heredocs) are clamped with a `+N more · click to expand` tail instead of dumping their whole body into the scrollback.\n- Tool error output is clipped the same way as ok output, so a failing command no longer floods the transcript.\n- The TUI toast overlay has an opaque background instead of letting the transcript bleed through.\n\n## [0.3.0] - 2026-08-04\n\n### Added\n\n**Chat TUI**\n\n- `/fork` slash command to fork a conversation at any point and continue in a new thread.\n- `/conversation` switches threads from inside a live session.\n- `/compact` triggers manual conversation compaction.\n- `/portal` and `/copy` slash commands.\n- Archive the current conversation from the chat TUI.\n- `--new` flag on `skydive chat` to start a fresh conversation.\n- Debounced server-side conversation search in the picker, with title matches ranked first.\n- File review pane orientation toggle, and review comments in the file pane.\n- Pinned plan card controls and a jump-to-latest hint.\n- Terminal title (OSC) follows the live conversation title on every screen; inside cmux the workspace is renamed too, and linked PRs are pushed to the cmux sidebar.\n- Every participating agent shows in the conversation list; connect cards each have their own identity, and ctrl+r asks which connect card to act on.\n- Colored Skydive splash art in `skydive --help` and the TUI pickers.\n- New-agent name prefilled from the server's suggestion.\n\n**CLI & platform**\n\n- `skydive update` self-updater, with an update notice when a new version is available.\n- Shell completions for bash, zsh, and fish via `completion install`.\n- Portal daemon: one connection per host with per-conversation working directories.\n- Agent-led coding-agent import (`skydive import`).\n- Per-workspace scoping on the REST client, and cross-org `--agent <uuid>` auto-switches workspace.\n- `skydive-beta` wrapper for the canary channel.\n\n### Fixed\n\n- `skydive update` no longer claims an update is available on every npm install.\n- Chat memory is bounded (payload clamps + windowed rows) with a memory watchdog and OOM diagnostic report; transcript rows are memoized so streaming stops re-rendering the whole chat.\n- Chat-send failures map to real error messages.\n- Notification and sidebar previews use the last text block of the reply and strip inline markdown.\n- Picker rows no longer overlap when a conversation title contains a newline, tab, or control character.\n- Sending to non-web channel conversations is blocked in the TUI.\n- GitHub bot connect opens on the web front door, not api.skydive.com.\n- TUI activity counter times from the run, not the screen.\n\n## [0.2.0] - 2026-07-29\n\n### Added\n\n**Sandbox & machine access**\n\n- Standalone `skydive sandbox` command for direct access to an agent's sandbox.\n- `/sandbox` in the chat TUI — live PTY session and one-shot command execution.\n- Headless machine sharing via `skydive portal`, with self-registering portal grants.\n- `shareMachineDefault` config key for always-on portal sharing.\n\n**Chat TUI**\n\n- File pane (`ctrl+g`) with Changes and Files tabs: a shared file tree plus source viewer and a workspace browser, mouse-resizable and responsive to terminal size.\n- Agent todo list rendered in the chat TUI, above the composer, mirroring the web chat's todo card.\n- Fuzzy finder in the conversation and agent pickers.\n- Slash-command autocomplete menu.\n- Paste or drag-and-drop any file into the composer; paste clipboard images with Cmd+V.\n- Run local shell commands with `!` in the composer.\n- Conversation recaps, streamed live title updates, and per-agent attribution on assistant turns.\n- Working timer rolls up into minutes and hours.\n- Conversation picker paginates past 50 conversations and shows only your own conversations.\n- Esc leaves a live run; typing `exit` quits the chat.\n- Cursor Dark theme.\n- Picker rows no longer overlap when a conversation title contains a newline, tab, or control character.\n\n**Headless & scripting**\n\n- Resume a conversation by id.\n- `conversations list` and `conversations show` for transcript reads.\n- `messages get`, with run recovery keyed on message id.\n- Connect cards surface in headless `-p` mode so a driving agent never gets stuck.\n\n**Authentication**\n\n- `skydive auth login` via the browser now auto-mints an API key, so one login yields both a chat session and a usable management credential. Management commands announce the key's pinned workspace when it drives them, so a workspace mismatch is visible at use time.\n- Workspace picker on the device authorization page.\n- Account and workspace identity shown in `auth status`.\n\n**Platform**\n\n- Standalone binary builds compiling the CLI into a per-target executable.\n- Interactive workspace switcher; management commands follow the active workspace.\n- Terminal host integrations and agent notifications.\n\n### Fixed\n\n- Transcript errors collapse to one line, click to expand (REST and portal errors keep their full body).\n- Dragged/pasted image file paths attach the file instead of inserting path text, including macOS paths with literal parentheses.\n- Bare URLs in chat markdown are hyperlinked so they survive text wrap.\n- Composer draft is preserved across TUI overlays.\n- Relative connect links resolve before opening the browser.\n- Numbered markdown headings render colored in the TUI.\n- Chat transcript pages by 75% of a screen; picker rows stay on one line.\n- Run starts push to the TUI over the conversation stream.\n- Security: remediated high-severity dependency findings and cleared tar/shell-quote CVEs.\n\n## [0.1.0] - 2026-07-21\n\nInitial public release: `skydive chat` TUI, agent and conversation management,\ndevice authorization, and headless `-p` mode.\n";
+const CHANGELOG_MD = "# Changelog\n\nAll notable changes to the Skydive CLI are documented here.\n\nThe format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),\nand this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).\n\n## [Unreleased]\n\n### Added\n\n- First run in a workspace with no agents now sets you up automatically: instead of dropping you on an empty agent picker, `skydive` creates your first agent for you (with a suggested name and avatar, mirroring the web onboarding flow) and then offers to have it learn how you already work — reading the other coding agents set up on your machine (Claude Code, Cursor, Codex, and more), the same import that `skydive import` runs, with a plan shown first and credentials never copied. Decline and you go straight into the new agent's chat. You can replay this flow anytime with `skydive --onboarding` (or `SKYDIVE_FORCE_ONBOARDING=1`), even in a workspace that already has agents.\n- `/computer` (alias `/stats`) in the chat TUI — a snapshot of the agent's sandbox drawn as colored bar graphs: CPU load (scaled to core count), memory, swap (when present), and disk usage, plus uptime and process count. Bars turn amber past 75%% and red past 90%% so a glance tells you whether the box is under pressure. The card keeps itself current quietly (a slow background refresh, no flicker or \"updating\" chrome); only the most recent card refreshes, and it silently stops while you're scrolled up (no wasted polls on a card you're not looking at) and resumes at the bottom. Stats are read over the same relay `skydive sandbox` uses, so it's gated on EDIT access to the agent like the other sandbox commands.\n- `skydive fs` — a namespace for working with the files on an agent's computer (its sandbox) from your own machine. Its first subcommand, `skydive fs edit <path>`, reads a remote file down over the same relay `skydive sandbox` uses, opens it in your local editor (`$VISUAL`/`$EDITOR`, override with `--editor`, defaults to `vi`), and writes your changes back atomically when you save and close — so you can edit a remote file as if it were local without opening the chat TUI. A path that doesn't exist yet is created on save; no changes means nothing is written. Access is gated on EDIT permission for the agent, exactly like `skydive sandbox`. (A first-class `fs` relay channel and `skydive fs mount` land in follow-ups.)\n\n## [0.4.0] - 2026-08-07\n\n### Added\n\n- `skydive chat` works with API key auth: an API key alone now opens the chat TUI (and headless `chat -p`) without a browser login, using the key's pinned workspace.\n- `skydive config` command to view and set the safe, hand-editable CLI preferences (`shareMachineDefault`, `updateCheck`) without opening `config.json`. `config`/`config list` shows each key, its effective value, and whether it comes from the file or the built-in default; `config get`/`set`/`unset` read and change one key; `config path` prints the config file location. It only ever touches those preference keys, never credentials or flow-managed state.\n- Billing-blocked sends and runs now surface the server-authored recovery\n  guidance from the typed billing outcome. The chat TUI renders it as a\n  warning-toned system-notice row — live when a send is refused or a run is\n  stopped at the billing boundary, and again when reopening a conversation\n  that holds a persisted billing notice — instead of a generic error.\n  Headless `chat -p` and `messages get` print the guidance (state, recovery\n  step, and manage-billing URL) on stderr, keep any partial output already\n  streamed on stdout, and exit with code `5` (distinct from the generic `1`)\n  so scripted callers can tell a billing pause from a failure.\n- Syntax highlighting for 14 more languages in the chat transcript and file/review panes (python, bash, go, rust, c, cpp, java, ruby, css, html, json, yaml, and more) — previously only JavaScript/TypeScript rendered colored.\n\n### Changed\n\n- `skydive agent list` lists the full agent roster by default instead of a truncated page.\n\n### Fixed\n\n- Long multi-line bash tool-call commands (e.g. heredocs) are clamped with a `+N more · click to expand` tail instead of dumping their whole body into the scrollback.\n- Tool error output is clipped the same way as ok output, so a failing command no longer floods the transcript.\n- The TUI toast overlay has an opaque background instead of letting the transcript bleed through.\n\n## [0.3.0] - 2026-08-04\n\n### Added\n\n**Chat TUI**\n\n- `/fork` slash command to fork a conversation at any point and continue in a new thread.\n- `/conversation` switches threads from inside a live session.\n- `/compact` triggers manual conversation compaction.\n- `/portal` and `/copy` slash commands.\n- Archive the current conversation from the chat TUI.\n- `--new` flag on `skydive chat` to start a fresh conversation.\n- Debounced server-side conversation search in the picker, with title matches ranked first.\n- File review pane orientation toggle, and review comments in the file pane.\n- Pinned plan card controls and a jump-to-latest hint.\n- Terminal title (OSC) follows the live conversation title on every screen; inside cmux the workspace is renamed too, and linked PRs are pushed to the cmux sidebar.\n- Every participating agent shows in the conversation list; connect cards each have their own identity, and ctrl+r asks which connect card to act on.\n- Colored Skydive splash art in `skydive --help` and the TUI pickers.\n- New-agent name prefilled from the server's suggestion.\n\n**CLI & platform**\n\n- `skydive update` self-updater, with an update notice when a new version is available.\n- Shell completions for bash, zsh, and fish via `completion install`.\n- Portal daemon: one connection per host with per-conversation working directories.\n- Agent-led coding-agent import (`skydive import`).\n- Per-workspace scoping on the REST client, and cross-org `--agent <uuid>` auto-switches workspace.\n- `skydive-beta` wrapper for the canary channel.\n\n### Fixed\n\n- `skydive update` no longer claims an update is available on every npm install.\n- Chat memory is bounded (payload clamps + windowed rows) with a memory watchdog and OOM diagnostic report; transcript rows are memoized so streaming stops re-rendering the whole chat.\n- Chat-send failures map to real error messages.\n- Notification and sidebar previews use the last text block of the reply and strip inline markdown.\n- Picker rows no longer overlap when a conversation title contains a newline, tab, or control character.\n- Sending to non-web channel conversations is blocked in the TUI.\n- GitHub bot connect opens on the web front door, not api.skydive.com.\n- TUI activity counter times from the run, not the screen.\n\n## [0.2.0] - 2026-07-29\n\n### Added\n\n**Sandbox & machine access**\n\n- Standalone `skydive sandbox` command for direct access to an agent's sandbox.\n- `/sandbox` in the chat TUI — live PTY session and one-shot command execution.\n- Headless machine sharing via `skydive portal`, with self-registering portal grants.\n- `shareMachineDefault` config key for always-on portal sharing.\n\n**Chat TUI**\n\n- File pane (`ctrl+g`) with Changes and Files tabs: a shared file tree plus source viewer and a workspace browser, mouse-resizable and responsive to terminal size.\n- Agent todo list rendered in the chat TUI, above the composer, mirroring the web chat's todo card.\n- Fuzzy finder in the conversation and agent pickers.\n- Slash-command autocomplete menu.\n- Paste or drag-and-drop any file into the composer; paste clipboard images with Cmd+V.\n- Run local shell commands with `!` in the composer.\n- Conversation recaps, streamed live title updates, and per-agent attribution on assistant turns.\n- Working timer rolls up into minutes and hours.\n- Conversation picker paginates past 50 conversations and shows only your own conversations.\n- Esc leaves a live run; typing `exit` quits the chat.\n- Cursor Dark theme.\n- Picker rows no longer overlap when a conversation title contains a newline, tab, or control character.\n\n**Headless & scripting**\n\n- Resume a conversation by id.\n- `conversations list` and `conversations show` for transcript reads.\n- `messages get`, with run recovery keyed on message id.\n- Connect cards surface in headless `-p` mode so a driving agent never gets stuck.\n\n**Authentication**\n\n- `skydive auth login` via the browser now auto-mints an API key, so one login yields both a chat session and a usable management credential. Management commands announce the key's pinned workspace when it drives them, so a workspace mismatch is visible at use time.\n- Workspace picker on the device authorization page.\n- Account and workspace identity shown in `auth status`.\n\n**Platform**\n\n- Standalone binary builds compiling the CLI into a per-target executable.\n- Interactive workspace switcher; management commands follow the active workspace.\n- Terminal host integrations and agent notifications.\n\n### Fixed\n\n- Transcript errors collapse to one line, click to expand (REST and portal errors keep their full body).\n- Dragged/pasted image file paths attach the file instead of inserting path text, including macOS paths with literal parentheses.\n- Bare URLs in chat markdown are hyperlinked so they survive text wrap.\n- Composer draft is preserved across TUI overlays.\n- Relative connect links resolve before opening the browser.\n- Numbered markdown headings render colored in the TUI.\n- Chat transcript pages by 75% of a screen; picker rows stay on one line.\n- Run starts push to the TUI over the conversation stream.\n- Security: remediated high-severity dependency findings and cleared tar/shell-quote CVEs.\n\n## [0.1.0] - 2026-07-21\n\nInitial public release: `skydive chat` TUI, agent and conversation management,\ndevice authorization, and headless `-p` mode.\n";
 
 //#endregion
 //#region src/whats-new.ts
@@ -4169,7 +4222,7 @@ if (process.argv.includes(UPDATE_WORKER_FLAG)) {
 	process.exit(0);
 }
 if (process.argv.includes(PORTAL_DAEMON_FLAG)) {
-	const { runPortalDaemon } = await import("./daemon-DDBIumf1.mjs");
+	const { runPortalDaemon } = await import("./daemon-C6tZH1dO.mjs");
 	runPortalDaemon(process.argv);
 } else runCli();
 function runCli() {