skydive-cli 0.5.0-beta.30 → 0.5.0-beta.31

package/CHANGELOG.md

@@ -11,7 +11,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - `/search` (alias `/find`) in the chat TUI — opens the conversation picker with its search field focused, so "find a conversation" has a discoverable command instead of being a feature you had to know the bare picker already had. Pass a query inline (`/search billing deep dive`) and the picker opens already narrowed to the matches; bare `/search` opens it ready for you to type. The search runs server-side across conversation titles, message bodies, and participant names, the same search the picker exposes.
 - First run in a workspace with no agents now sets you up automatically: instead of dropping you on an empty agent picker, `skydive` creates your first agent for you (with a suggested name and avatar, mirroring the web onboarding flow) and then offers to have it learn how you already work — reading the other coding agents set up on your machine (Claude Code, Cursor, Codex, and more), the same import that `skydive import` runs, with a plan shown first and credentials never copied. Decline and you go straight into the new agent's chat. You can replay this flow anytime with `skydive --onboarding` (or `SKYDIVE_FORCE_ONBOARDING=1`), even in a workspace that already has agents.
-- `/computer` (alias `/stats`) in the chat TUI — a snapshot of the agent's sandbox drawn as colored bar graphs: CPU load (scaled to core count), memory, swap (when present), and disk usage, plus uptime and process count. Bars turn amber past 75%% and red past 90%% so a glance tells you whether the box is under pressure. The card keeps itself current quietly (a slow background refresh, no flicker or "updating" chrome); only the most recent card refreshes, and it silently stops while you're scrolled up (no wasted polls on a card you're not looking at) and resumes at the bottom. Stats are read over the same relay `skydive sandbox` uses, so it's gated on EDIT access to the agent like the other sandbox commands.
+- `/computer` (alias `/stats`) in the chat TUI — a snapshot of the agent's sandbox drawn as colored bar graphs: CPU, memory, and disk usage. Bars turn amber past 75%% and red past 90%% so a glance tells you whether the box is under pressure. The numbers come from the Skydive API (the same live resource sample the web computer view reads), not by connecting to the sandbox — so the card shows instantly, never waking or hanging on a box that isn't running: when the agent has no live sandbox it simply reads "no sandbox running". The card keeps itself current quietly (a slow background refresh, no flicker or "updating" chrome); only the most recent card refreshes, and it silently stops while you're scrolled up (no wasted polls on a card you're not looking at) and resumes at the bottom.
 - `skydive fs` — a namespace for working with the files on an agent's computer (its sandbox) from your own machine. Its first subcommand, `skydive fs edit <path>`, reads a remote file down over the same relay `skydive sandbox` uses, opens it in your local editor (`$VISUAL`/`$EDITOR`, override with `--editor`, defaults to `vi`), and writes your changes back atomically when you save and close — so you can edit a remote file as if it were local without opening the chat TUI. A path that doesn't exist yet is created on save; no changes means nothing is written. Access is gated on EDIT permission for the agent, exactly like `skydive sandbox`. (A first-class `fs` relay channel and `skydive fs mount` land in follow-ups.)
 
 ## [0.4.0] - 2026-08-07

package/dist/js/bin.mjs

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
-import { A as takenAliasNames, B as name, D as dedupeAliasName, E as aliasActivationHint, F as getActiveWorkspaceId, I as getSessionIdentity, L as listWorkspaces, M as defaultInstallEnv, N as detectShell, O as installAgentAlias, P as ensureActiveOrganization, R as resolveWorkspaceId, S as themes, T as machineOsFromPlatform, V as version, a as installCrashHandler, j as SUPPORTED_SHELLS, k as slugifyAliasName, t as maybeStartProfiling, u as brandHelpArt, w as buildImportSeedPrompt, z as setActiveWorkspace } from "./profiler-BoO7ldO0.mjs";
-import { A as getShareMachineDefault, C as getConfigPath, D as getPromptHistoryPath, E as getPreference, F as resolveAppUrl, H as saveSession, I as resolveChatAuth, L as resolveConfig, M as getStoredApiKeyWorkspaceName, N as getUpdateCheckDisabled, R as resolveManagementAuth, S as deleteConfig, T as getLastSeenVersion, V as saveConfig, W as setLastSeenVersion, _ as API_KEY_FAMILY_PREFIX, g as API_KEYS_URL, i as resolveAgent$1, j as getStoredApiKeyId, v as API_KEY_PREFIX, w as getDefaultAgent, x as PREFERENCES, y as DEFAULT_API_URL, z as resolveSession } from "./print-DYiQC5IW.mjs";
+import { A as takenAliasNames, B as name, D as dedupeAliasName, E as aliasActivationHint, F as getActiveWorkspaceId, I as getSessionIdentity, L as listWorkspaces, M as defaultInstallEnv, N as detectShell, O as installAgentAlias, P as ensureActiveOrganization, R as resolveWorkspaceId, S as themes, T as machineOsFromPlatform, V as version, a as installCrashHandler, j as SUPPORTED_SHELLS, k as slugifyAliasName, t as maybeStartProfiling, u as brandHelpArt, w as buildImportSeedPrompt, z as setActiveWorkspace } from "./profiler-BVbYs_Yg.mjs";
+import { A as getShareMachineDefault, C as getConfigPath, D as getPromptHistoryPath, E as getPreference, F as resolveAppUrl, H as saveSession, I as resolveChatAuth, L as resolveConfig, M as getStoredApiKeyWorkspaceName, N as getUpdateCheckDisabled, R as resolveManagementAuth, S as deleteConfig, T as getLastSeenVersion, V as saveConfig, W as setLastSeenVersion, _ as API_KEY_FAMILY_PREFIX, g as API_KEYS_URL, i as resolveAgent$1, j as getStoredApiKeyId, v as API_KEY_PREFIX, w as getDefaultAgent, x as PREFERENCES, y as DEFAULT_API_URL, z as resolveSession } from "./print-C_TnQSPg.mjs";
 import { n as printError, r as printTable, t as output } from "./output-DYzzdXYV.mjs";
 import { t as HttpError } from "./http-error-DzyrsLAZ.mjs";
-import { t as createRestClient } from "./rest-xXfqT4SX.mjs";
+import { t as createRestClient } from "./rest-CgfbKXst.mjs";
 import "./billing-blocked-2wju4gC_.mjs";
 import { r as resolveMachineIdentity } from "./client-DbqRBquD.mjs";
-import { i as queryDaemonStatus, l as PORTAL_DAEMON_FLAG, n as ensureDaemonRunning, s as stopDaemon, u as daemonPaths } from "./daemon-DuxaUuek.mjs";
+import { i as queryDaemonStatus, l as PORTAL_DAEMON_FLAG, n as ensureDaemonRunning, s as stopDaemon, u as daemonPaths } from "./daemon-BTyg329O.mjs";
 import { i as grantPortalAccess, n as fetchPortalDevices, o as registerPortalDevice, r as findThisDevice, s as revokePortalAccess } from "./api-DG5W6iwx.mjs";
 import { t as SandboxStream } from "./client-c4c5MmgN.mjs";
 import { hideBin } from "yargs/helpers";
@@ -1584,7 +1584,7 @@ const importCommand = {
 				process.exit(1);
 			}
 		}
-		const { runChat } = await import("./boot-0-dpPM1_.mjs");
+		const { runChat } = await import("./boot-iaVSnd7h.mjs");
 		await runChat({
 			appUrl,
 			sessionToken: session.value.sessionToken,
@@ -1622,7 +1622,7 @@ async function runImportPrintMode({ argv, appUrl }) {
 	});
 	const extra = (argv.print ?? "").trim();
 	const prompt = buildImportSeedPrompt(process.cwd(), machineOsFromPlatform(process.platform)) + (extra ? `\n\nAdditional instructions: ${extra}` : "");
-	const { runPrint } = await import("./print-CQkXZ02a.mjs");
+	const { runPrint } = await import("./print-DACzRUwQ.mjs");
 	try {
 		const result = await runPrint({
 			appUrl,
@@ -2029,7 +2029,7 @@ const chatCommand = {
 			sessionToken: auth.value.token,
 			agentSelector: argv.agent ?? null
 		});
-		const { runChat } = await import("./boot-0-dpPM1_.mjs");
+		const { runChat } = await import("./boot-iaVSnd7h.mjs");
 		await runChat({
 			appUrl: auth.value.appUrl,
 			sessionToken: auth.value.token,
@@ -2113,7 +2113,7 @@ async function runPrintMode({ argv, appUrl }) {
 		printError(`${auth.error.message} For non-interactive use, run \`skydive auth login\` first, or set SKYDIVE_API_KEY / SKYDIVE_SESSION_TOKEN.`);
 		process.exit(1);
 	}
-	const { runPrint, readStdin } = await import("./print-CQkXZ02a.mjs");
+	const { runPrint, readStdin } = await import("./print-DACzRUwQ.mjs");
 	const workspaceId = await resolveWorkspaceFlag({
 		appUrl,
 		sessionToken: auth.value.token,
@@ -2208,7 +2208,7 @@ const getCommand$1 = {
 			printError(`${auth.error.message} Run \`skydive auth login\` first, or set SKYDIVE_API_KEY / SKYDIVE_SESSION_TOKEN.`);
 			process.exit(1);
 		}
-		const { messageGet } = await import("./print-CQkXZ02a.mjs");
+		const { messageGet } = await import("./print-DACzRUwQ.mjs");
 		try {
 			const result = await messageGet({
 				appUrl: auth.value.appUrl,
@@ -2411,7 +2411,7 @@ const switchCommand = {
 				printError("The workspace picker needs the Bun runtime and it could not be set up automatically. Pass a workspace slug instead, or install Bun and retry.");
 				process.exit(1);
 			}
-			const { runWorkspacePicker } = await import("./boot-0-dpPM1_.mjs");
+			const { runWorkspacePicker } = await import("./boot-iaVSnd7h.mjs");
 			await runWorkspacePicker(session);
 			return;
 		}
@@ -2490,7 +2490,7 @@ const openCommand = {
 		const agent = argv.agent ? resolveAgent$1((await fetchPortalDevices(session)).agents, argv.agent) : null;
 		const cwd = argv.cwd ? path.resolve(argv.cwd) : process.cwd();
 		const { machineName } = await resolveMachineIdentity(null);
-		const { PortalDaemonClient } = await import("./daemon-client-LJdnM_nE.mjs");
+		const { PortalDaemonClient } = await import("./daemon-client-C7emKKlj.mjs");
 		let lastLine = "";
 		let signalConnected;
 		const connected = new Promise((resolve) => {
@@ -2800,8 +2800,8 @@ const sandboxCommand = {
 	}).example("skydive sandbox --agent grace", "Live terminal (Ctrl-] detaches)").example("skydive sandbox --agent grace -- tail -n 50 /tmp/harness.log", "One-shot command (use `--` so its flags reach the sandbox)").example("skydive sandbox --agent grace -- sh -c 'ls /tmp | wc -l'", "Shell features go through an explicit `sh -c`"),
 	handler: async (argv) => {
 		const session = requireSession(argv);
-		const { createRestClient } = await import("./rest-DSpGS5XU.mjs");
-		const { resolveAgent } = await import("./print-CQkXZ02a.mjs");
+		const { createRestClient } = await import("./rest-VV5nc-Mn.mjs");
+		const { resolveAgent } = await import("./print-DACzRUwQ.mjs");
 		const client = createRestClient({
 			appUrl: session.appUrl,
 			sessionToken: session.sessionToken
@@ -2958,8 +2958,8 @@ const fsEditCommand = {
 	handler: async (argv) => {
 		const session = requireSession(argv);
 		const remotePath = argv.path;
-		const { createRestClient } = await import("./rest-DSpGS5XU.mjs");
-		const { resolveAgent } = await import("./print-CQkXZ02a.mjs");
+		const { createRestClient } = await import("./rest-VV5nc-Mn.mjs");
+		const { resolveAgent } = await import("./print-DACzRUwQ.mjs");
 		const client = createRestClient({
 			appUrl: session.appUrl,
 			sessionToken: session.sessionToken
@@ -4193,7 +4193,7 @@ function setupUpdateCheck(argv) {
 
 //#endregion
 //#region src/changelog.generated.ts
-const CHANGELOG_MD = "# Changelog\n\nAll notable changes to the Skydive CLI are documented here.\n\nThe format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),\nand this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).\n\n## [Unreleased]\n\n### Added\n\n- `/search` (alias `/find`) in the chat TUI — opens the conversation picker with its search field focused, so \"find a conversation\" has a discoverable command instead of being a feature you had to know the bare picker already had. Pass a query inline (`/search billing deep dive`) and the picker opens already narrowed to the matches; bare `/search` opens it ready for you to type. The search runs server-side across conversation titles, message bodies, and participant names, the same search the picker exposes.\n- First run in a workspace with no agents now sets you up automatically: instead of dropping you on an empty agent picker, `skydive` creates your first agent for you (with a suggested name and avatar, mirroring the web onboarding flow) and then offers to have it learn how you already work — reading the other coding agents set up on your machine (Claude Code, Cursor, Codex, and more), the same import that `skydive import` runs, with a plan shown first and credentials never copied. Decline and you go straight into the new agent's chat. You can replay this flow anytime with `skydive --onboarding` (or `SKYDIVE_FORCE_ONBOARDING=1`), even in a workspace that already has agents.\n- `/computer` (alias `/stats`) in the chat TUI — a snapshot of the agent's sandbox drawn as colored bar graphs: CPU load (scaled to core count), memory, swap (when present), and disk usage, plus uptime and process count. Bars turn amber past 75%% and red past 90%% so a glance tells you whether the box is under pressure. The card keeps itself current quietly (a slow background refresh, no flicker or \"updating\" chrome); only the most recent card refreshes, and it silently stops while you're scrolled up (no wasted polls on a card you're not looking at) and resumes at the bottom. Stats are read over the same relay `skydive sandbox` uses, so it's gated on EDIT access to the agent like the other sandbox commands.\n- `skydive fs` — a namespace for working with the files on an agent's computer (its sandbox) from your own machine. Its first subcommand, `skydive fs edit <path>`, reads a remote file down over the same relay `skydive sandbox` uses, opens it in your local editor (`$VISUAL`/`$EDITOR`, override with `--editor`, defaults to `vi`), and writes your changes back atomically when you save and close — so you can edit a remote file as if it were local without opening the chat TUI. A path that doesn't exist yet is created on save; no changes means nothing is written. Access is gated on EDIT permission for the agent, exactly like `skydive sandbox`. (A first-class `fs` relay channel and `skydive fs mount` land in follow-ups.)\n\n## [0.4.0] - 2026-08-07\n\n### Added\n\n- `skydive chat` works with API key auth: an API key alone now opens the chat TUI (and headless `chat -p`) without a browser login, using the key's pinned workspace.\n- `skydive config` command to view and set the safe, hand-editable CLI preferences (`shareMachineDefault`, `updateCheck`) without opening `config.json`. `config`/`config list` shows each key, its effective value, and whether it comes from the file or the built-in default; `config get`/`set`/`unset` read and change one key; `config path` prints the config file location. It only ever touches those preference keys, never credentials or flow-managed state.\n- Billing-blocked sends and runs now surface the server-authored recovery\n  guidance from the typed billing outcome. The chat TUI renders it as a\n  warning-toned system-notice row — live when a send is refused or a run is\n  stopped at the billing boundary, and again when reopening a conversation\n  that holds a persisted billing notice — instead of a generic error.\n  Headless `chat -p` and `messages get` print the guidance (state, recovery\n  step, and manage-billing URL) on stderr, keep any partial output already\n  streamed on stdout, and exit with code `5` (distinct from the generic `1`)\n  so scripted callers can tell a billing pause from a failure.\n- Syntax highlighting for 14 more languages in the chat transcript and file/review panes (python, bash, go, rust, c, cpp, java, ruby, css, html, json, yaml, and more) — previously only JavaScript/TypeScript rendered colored.\n\n### Changed\n\n- `skydive agent list` lists the full agent roster by default instead of a truncated page.\n\n### Fixed\n\n- Long multi-line bash tool-call commands (e.g. heredocs) are clamped with a `+N more · click to expand` tail instead of dumping their whole body into the scrollback.\n- Tool error output is clipped the same way as ok output, so a failing command no longer floods the transcript.\n- The TUI toast overlay has an opaque background instead of letting the transcript bleed through.\n\n## [0.3.0] - 2026-08-04\n\n### Added\n\n**Chat TUI**\n\n- `/fork` slash command to fork a conversation at any point and continue in a new thread.\n- `/conversation` switches threads from inside a live session.\n- `/compact` triggers manual conversation compaction.\n- `/portal` and `/copy` slash commands.\n- Archive the current conversation from the chat TUI.\n- `--new` flag on `skydive chat` to start a fresh conversation.\n- Debounced server-side conversation search in the picker, with title matches ranked first.\n- File review pane orientation toggle, and review comments in the file pane.\n- Pinned plan card controls and a jump-to-latest hint.\n- Terminal title (OSC) follows the live conversation title on every screen; inside cmux the workspace is renamed too, and linked PRs are pushed to the cmux sidebar.\n- Every participating agent shows in the conversation list; connect cards each have their own identity, and ctrl+r asks which connect card to act on.\n- Colored Skydive splash art in `skydive --help` and the TUI pickers.\n- New-agent name prefilled from the server's suggestion.\n\n**CLI & platform**\n\n- `skydive update` self-updater, with an update notice when a new version is available.\n- Shell completions for bash, zsh, and fish via `completion install`.\n- Portal daemon: one connection per host with per-conversation working directories.\n- Agent-led coding-agent import (`skydive import`).\n- Per-workspace scoping on the REST client, and cross-org `--agent <uuid>` auto-switches workspace.\n- `skydive-beta` wrapper for the canary channel.\n\n### Fixed\n\n- `skydive update` no longer claims an update is available on every npm install.\n- Chat memory is bounded (payload clamps + windowed rows) with a memory watchdog and OOM diagnostic report; transcript rows are memoized so streaming stops re-rendering the whole chat.\n- Chat-send failures map to real error messages.\n- Notification and sidebar previews use the last text block of the reply and strip inline markdown.\n- Picker rows no longer overlap when a conversation title contains a newline, tab, or control character.\n- Sending to non-web channel conversations is blocked in the TUI.\n- GitHub bot connect opens on the web front door, not api.skydive.com.\n- TUI activity counter times from the run, not the screen.\n\n## [0.2.0] - 2026-07-29\n\n### Added\n\n**Sandbox & machine access**\n\n- Standalone `skydive sandbox` command for direct access to an agent's sandbox.\n- `/sandbox` in the chat TUI — live PTY session and one-shot command execution.\n- Headless machine sharing via `skydive portal`, with self-registering portal grants.\n- `shareMachineDefault` config key for always-on portal sharing.\n\n**Chat TUI**\n\n- File pane (`ctrl+g`) with Changes and Files tabs: a shared file tree plus source viewer and a workspace browser, mouse-resizable and responsive to terminal size.\n- Agent todo list rendered in the chat TUI, above the composer, mirroring the web chat's todo card.\n- Fuzzy finder in the conversation and agent pickers.\n- Slash-command autocomplete menu.\n- Paste or drag-and-drop any file into the composer; paste clipboard images with Cmd+V.\n- Run local shell commands with `!` in the composer.\n- Conversation recaps, streamed live title updates, and per-agent attribution on assistant turns.\n- Working timer rolls up into minutes and hours.\n- Conversation picker paginates past 50 conversations and shows only your own conversations.\n- Esc leaves a live run; typing `exit` quits the chat.\n- Cursor Dark theme.\n- Picker rows no longer overlap when a conversation title contains a newline, tab, or control character.\n\n**Headless & scripting**\n\n- Resume a conversation by id.\n- `conversations list` and `conversations show` for transcript reads.\n- `messages get`, with run recovery keyed on message id.\n- Connect cards surface in headless `-p` mode so a driving agent never gets stuck.\n\n**Authentication**\n\n- `skydive auth login` via the browser now auto-mints an API key, so one login yields both a chat session and a usable management credential. Management commands announce the key's pinned workspace when it drives them, so a workspace mismatch is visible at use time.\n- Workspace picker on the device authorization page.\n- Account and workspace identity shown in `auth status`.\n\n**Platform**\n\n- Standalone binary builds compiling the CLI into a per-target executable.\n- Interactive workspace switcher; management commands follow the active workspace.\n- Terminal host integrations and agent notifications.\n\n### Fixed\n\n- Transcript errors collapse to one line, click to expand (REST and portal errors keep their full body).\n- Dragged/pasted image file paths attach the file instead of inserting path text, including macOS paths with literal parentheses.\n- Bare URLs in chat markdown are hyperlinked so they survive text wrap.\n- Composer draft is preserved across TUI overlays.\n- Relative connect links resolve before opening the browser.\n- Numbered markdown headings render colored in the TUI.\n- Chat transcript pages by 75% of a screen; picker rows stay on one line.\n- Run starts push to the TUI over the conversation stream.\n- Security: remediated high-severity dependency findings and cleared tar/shell-quote CVEs.\n\n## [0.1.0] - 2026-07-21\n\nInitial public release: `skydive chat` TUI, agent and conversation management,\ndevice authorization, and headless `-p` mode.\n";
+const CHANGELOG_MD = "# Changelog\n\nAll notable changes to the Skydive CLI are documented here.\n\nThe format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),\nand this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).\n\n## [Unreleased]\n\n### Added\n\n- `/search` (alias `/find`) in the chat TUI — opens the conversation picker with its search field focused, so \"find a conversation\" has a discoverable command instead of being a feature you had to know the bare picker already had. Pass a query inline (`/search billing deep dive`) and the picker opens already narrowed to the matches; bare `/search` opens it ready for you to type. The search runs server-side across conversation titles, message bodies, and participant names, the same search the picker exposes.\n- First run in a workspace with no agents now sets you up automatically: instead of dropping you on an empty agent picker, `skydive` creates your first agent for you (with a suggested name and avatar, mirroring the web onboarding flow) and then offers to have it learn how you already work — reading the other coding agents set up on your machine (Claude Code, Cursor, Codex, and more), the same import that `skydive import` runs, with a plan shown first and credentials never copied. Decline and you go straight into the new agent's chat. You can replay this flow anytime with `skydive --onboarding` (or `SKYDIVE_FORCE_ONBOARDING=1`), even in a workspace that already has agents.\n- `/computer` (alias `/stats`) in the chat TUI — a snapshot of the agent's sandbox drawn as colored bar graphs: CPU, memory, and disk usage. Bars turn amber past 75%% and red past 90%% so a glance tells you whether the box is under pressure. The numbers come from the Skydive API (the same live resource sample the web computer view reads), not by connecting to the sandbox — so the card shows instantly, never waking or hanging on a box that isn't running: when the agent has no live sandbox it simply reads \"no sandbox running\". The card keeps itself current quietly (a slow background refresh, no flicker or \"updating\" chrome); only the most recent card refreshes, and it silently stops while you're scrolled up (no wasted polls on a card you're not looking at) and resumes at the bottom.\n- `skydive fs` — a namespace for working with the files on an agent's computer (its sandbox) from your own machine. Its first subcommand, `skydive fs edit <path>`, reads a remote file down over the same relay `skydive sandbox` uses, opens it in your local editor (`$VISUAL`/`$EDITOR`, override with `--editor`, defaults to `vi`), and writes your changes back atomically when you save and close — so you can edit a remote file as if it were local without opening the chat TUI. A path that doesn't exist yet is created on save; no changes means nothing is written. Access is gated on EDIT permission for the agent, exactly like `skydive sandbox`. (A first-class `fs` relay channel and `skydive fs mount` land in follow-ups.)\n\n## [0.4.0] - 2026-08-07\n\n### Added\n\n- `skydive chat` works with API key auth: an API key alone now opens the chat TUI (and headless `chat -p`) without a browser login, using the key's pinned workspace.\n- `skydive config` command to view and set the safe, hand-editable CLI preferences (`shareMachineDefault`, `updateCheck`) without opening `config.json`. `config`/`config list` shows each key, its effective value, and whether it comes from the file or the built-in default; `config get`/`set`/`unset` read and change one key; `config path` prints the config file location. It only ever touches those preference keys, never credentials or flow-managed state.\n- Billing-blocked sends and runs now surface the server-authored recovery\n  guidance from the typed billing outcome. The chat TUI renders it as a\n  warning-toned system-notice row — live when a send is refused or a run is\n  stopped at the billing boundary, and again when reopening a conversation\n  that holds a persisted billing notice — instead of a generic error.\n  Headless `chat -p` and `messages get` print the guidance (state, recovery\n  step, and manage-billing URL) on stderr, keep any partial output already\n  streamed on stdout, and exit with code `5` (distinct from the generic `1`)\n  so scripted callers can tell a billing pause from a failure.\n- Syntax highlighting for 14 more languages in the chat transcript and file/review panes (python, bash, go, rust, c, cpp, java, ruby, css, html, json, yaml, and more) — previously only JavaScript/TypeScript rendered colored.\n\n### Changed\n\n- `skydive agent list` lists the full agent roster by default instead of a truncated page.\n\n### Fixed\n\n- Long multi-line bash tool-call commands (e.g. heredocs) are clamped with a `+N more · click to expand` tail instead of dumping their whole body into the scrollback.\n- Tool error output is clipped the same way as ok output, so a failing command no longer floods the transcript.\n- The TUI toast overlay has an opaque background instead of letting the transcript bleed through.\n\n## [0.3.0] - 2026-08-04\n\n### Added\n\n**Chat TUI**\n\n- `/fork` slash command to fork a conversation at any point and continue in a new thread.\n- `/conversation` switches threads from inside a live session.\n- `/compact` triggers manual conversation compaction.\n- `/portal` and `/copy` slash commands.\n- Archive the current conversation from the chat TUI.\n- `--new` flag on `skydive chat` to start a fresh conversation.\n- Debounced server-side conversation search in the picker, with title matches ranked first.\n- File review pane orientation toggle, and review comments in the file pane.\n- Pinned plan card controls and a jump-to-latest hint.\n- Terminal title (OSC) follows the live conversation title on every screen; inside cmux the workspace is renamed too, and linked PRs are pushed to the cmux sidebar.\n- Every participating agent shows in the conversation list; connect cards each have their own identity, and ctrl+r asks which connect card to act on.\n- Colored Skydive splash art in `skydive --help` and the TUI pickers.\n- New-agent name prefilled from the server's suggestion.\n\n**CLI & platform**\n\n- `skydive update` self-updater, with an update notice when a new version is available.\n- Shell completions for bash, zsh, and fish via `completion install`.\n- Portal daemon: one connection per host with per-conversation working directories.\n- Agent-led coding-agent import (`skydive import`).\n- Per-workspace scoping on the REST client, and cross-org `--agent <uuid>` auto-switches workspace.\n- `skydive-beta` wrapper for the canary channel.\n\n### Fixed\n\n- `skydive update` no longer claims an update is available on every npm install.\n- Chat memory is bounded (payload clamps + windowed rows) with a memory watchdog and OOM diagnostic report; transcript rows are memoized so streaming stops re-rendering the whole chat.\n- Chat-send failures map to real error messages.\n- Notification and sidebar previews use the last text block of the reply and strip inline markdown.\n- Picker rows no longer overlap when a conversation title contains a newline, tab, or control character.\n- Sending to non-web channel conversations is blocked in the TUI.\n- GitHub bot connect opens on the web front door, not api.skydive.com.\n- TUI activity counter times from the run, not the screen.\n\n## [0.2.0] - 2026-07-29\n\n### Added\n\n**Sandbox & machine access**\n\n- Standalone `skydive sandbox` command for direct access to an agent's sandbox.\n- `/sandbox` in the chat TUI — live PTY session and one-shot command execution.\n- Headless machine sharing via `skydive portal`, with self-registering portal grants.\n- `shareMachineDefault` config key for always-on portal sharing.\n\n**Chat TUI**\n\n- File pane (`ctrl+g`) with Changes and Files tabs: a shared file tree plus source viewer and a workspace browser, mouse-resizable and responsive to terminal size.\n- Agent todo list rendered in the chat TUI, above the composer, mirroring the web chat's todo card.\n- Fuzzy finder in the conversation and agent pickers.\n- Slash-command autocomplete menu.\n- Paste or drag-and-drop any file into the composer; paste clipboard images with Cmd+V.\n- Run local shell commands with `!` in the composer.\n- Conversation recaps, streamed live title updates, and per-agent attribution on assistant turns.\n- Working timer rolls up into minutes and hours.\n- Conversation picker paginates past 50 conversations and shows only your own conversations.\n- Esc leaves a live run; typing `exit` quits the chat.\n- Cursor Dark theme.\n- Picker rows no longer overlap when a conversation title contains a newline, tab, or control character.\n\n**Headless & scripting**\n\n- Resume a conversation by id.\n- `conversations list` and `conversations show` for transcript reads.\n- `messages get`, with run recovery keyed on message id.\n- Connect cards surface in headless `-p` mode so a driving agent never gets stuck.\n\n**Authentication**\n\n- `skydive auth login` via the browser now auto-mints an API key, so one login yields both a chat session and a usable management credential. Management commands announce the key's pinned workspace when it drives them, so a workspace mismatch is visible at use time.\n- Workspace picker on the device authorization page.\n- Account and workspace identity shown in `auth status`.\n\n**Platform**\n\n- Standalone binary builds compiling the CLI into a per-target executable.\n- Interactive workspace switcher; management commands follow the active workspace.\n- Terminal host integrations and agent notifications.\n\n### Fixed\n\n- Transcript errors collapse to one line, click to expand (REST and portal errors keep their full body).\n- Dragged/pasted image file paths attach the file instead of inserting path text, including macOS paths with literal parentheses.\n- Bare URLs in chat markdown are hyperlinked so they survive text wrap.\n- Composer draft is preserved across TUI overlays.\n- Relative connect links resolve before opening the browser.\n- Numbered markdown headings render colored in the TUI.\n- Chat transcript pages by 75% of a screen; picker rows stay on one line.\n- Run starts push to the TUI over the conversation stream.\n- Security: remediated high-severity dependency findings and cleared tar/shell-quote CVEs.\n\n## [0.1.0] - 2026-07-21\n\nInitial public release: `skydive chat` TUI, agent and conversation management,\ndevice authorization, and headless `-p` mode.\n";
 
 //#endregion
 //#region src/whats-new.ts
@@ -4336,7 +4336,7 @@ if (process.argv.includes(UPDATE_WORKER_FLAG)) {
 	process.exit(0);
 }
 if (process.argv.includes(PORTAL_DAEMON_FLAG)) {
-	const { runPortalDaemon } = await import("./daemon-Ce8WLdGI.mjs");
+	const { runPortalDaemon } = await import("./daemon-SPQgtsbW.mjs");
 	runPortalDaemon(process.argv);
 } else runCli();
 function runCli() {

package/dist/js/{boot-0-dpPM1_.mjs → boot-iaVSnd7h.mjs}

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
-import { A as takenAliasNames, C as themesForMode, D as dedupeAliasName, E as aliasActivationHint, F as getActiveWorkspaceId, L as listWorkspaces, N as detectShell, O as installAgentAlias, T as machineOsFromPlatform, _ as theme, a as installCrashHandler, b as themeModeFromColorFgBg, c as MARK_CELLS, d as splashFitsWidth, f as DEFAULT_THEME_ID, g as noColorRequested, h as monoTheme, i as writeArtifact, k as slugifyAliasName, l as WORDMARK, m as findTheme, n as profilingEnabled, o as buildCrashReport, p as applyTheme, r as record, s as writeCrashReport, v as themeForMode, x as themeVersion, y as themeMode, z as setActiveWorkspace } from "./profiler-BoO7ldO0.mjs";
-import { B as resolveWebUrl, C as getConfigPath, O as getReviewStateDir, P as recordDefaultAgent, U as saveTheme, b as DEFAULT_APP_URL, c as cardActionErrorMessage, d as reconcileMaskedInput, f as resolveConnectUrl, h as specKeyFor, i as resolveAgent, k as getSavedTheme, l as parseExternalOauthConnectParams, m as parseConnectCard, p as computeSettledLabel, s as MASK_CHAR, u as parseOauthConnectParams, y as DEFAULT_API_URL } from "./print-DYiQC5IW.mjs";
+import { A as takenAliasNames, C as themesForMode, D as dedupeAliasName, E as aliasActivationHint, F as getActiveWorkspaceId, L as listWorkspaces, N as detectShell, O as installAgentAlias, T as machineOsFromPlatform, _ as theme, a as installCrashHandler, b as themeModeFromColorFgBg, c as MARK_CELLS, d as splashFitsWidth, f as DEFAULT_THEME_ID, g as noColorRequested, h as monoTheme, i as writeArtifact, k as slugifyAliasName, l as WORDMARK, m as findTheme, n as profilingEnabled, o as buildCrashReport, p as applyTheme, r as record, s as writeCrashReport, v as themeForMode, x as themeVersion, y as themeMode, z as setActiveWorkspace } from "./profiler-BVbYs_Yg.mjs";
+import { B as resolveWebUrl, C as getConfigPath, O as getReviewStateDir, P as recordDefaultAgent, U as saveTheme, b as DEFAULT_APP_URL, c as cardActionErrorMessage, d as reconcileMaskedInput, f as resolveConnectUrl, h as specKeyFor, i as resolveAgent, k as getSavedTheme, l as parseExternalOauthConnectParams, m as parseConnectCard, p as computeSettledLabel, s as MASK_CHAR, u as parseOauthConnectParams, y as DEFAULT_API_URL } from "./print-C_TnQSPg.mjs";
 import { t as HttpError } from "./http-error-DzyrsLAZ.mjs";
-import { a as isRecord, i as errorMessage, n as errorDetail, r as sendErrorMessage, t as createRestClient } from "./rest-xXfqT4SX.mjs";
+import { a as isRecord, i as errorMessage, n as errorDetail, r as sendErrorMessage, t as createRestClient } from "./rest-CgfbKXst.mjs";
 import { i as billingBlockedOutcomeFromSendResponse } from "./billing-blocked-2wju4gC_.mjs";
 import { t as PortalClient } from "./client-DbqRBquD.mjs";
-import "./daemon-DuxaUuek.mjs";
+import "./daemon-BTyg329O.mjs";
 import "./api-DG5W6iwx.mjs";
 import { t as SandboxStream } from "./client-c4c5MmgN.mjs";
-import { t as PortalDaemonClient } from "./daemon-client-C4heMWTq.mjs";
+import { t as PortalDaemonClient } from "./daemon-client--A_yMKq6.mjs";
 import { t as runRawPtyPassthrough } from "./raw-pty-DY4KelZW.mjs";
 import * as os$1 from "node:os";
 import { homedir, platform, release, tmpdir } from "node:os";
@@ -4805,28 +4805,38 @@ function useConversationContext() {
 /**
 * `/computer`: a live snapshot of the agent's sandbox as a set of bar graphs.
 *
-* The CLI runs on the USER's machine, so it can't read the sandbox's `/proc`
-* directly — it runs one small, portable shell command over the sandbox-exec
-* stream (`SandboxStream`, mode `exec`) and parses the output here. Everything
-* in this module is pure so the parse + layout are unit-testable without a
-* sandbox or a renderer.
+* The numbers come from the api, NOT from the CLI reaching into the sandbox.
+* The worker's fleet metrics sweep already samples every live box's CPU /
+* memory / disk from the provider and stores the latest per-sandbox snapshot;
+* the CLI reads that back over one plain REST call (`collectSandboxStats`). So
+* there is no exec into the box and no cold-start wake — when the agent has no
+* running sandbox the api answers "no snapshot" immediately instead of the card
+* hanging on a stream that never replies.
 *
-* The command reads `/proc` and `df` only (no tools that might be missing from
-* a minimal image), emitting a tagged, tab-separated block. The leading
-* `SKYDIVE_STATS_V1` sentinel lets the parser find the block even when a shell
-* rc file prints a banner first, and versions the wire shape.
+* Everything in this module is pure so the layout math is unit-testable without
+* an api or a renderer.
 */
-const SANDBOX_STATS_SENTINEL = "SKYDIVE_STATS_V1";
 /**
 * How often the live `/computer` card refreshes its snapshot, in ms.
 * Deliberately slow: the card is a background health readout, not a `top`, so
-* it refreshes quietly every 30s rather than flickering every second.
+* it refreshes quietly every 30s rather than flickering every second. Also
+* comfortably slower than the worker's ~60s sweep cadence, so we never poll for
+* a sample that can't have changed.
 */
 const COMPUTER_POLL_INTERVAL_MS = 3e4;
 /**
+* A snapshot older than this is stale enough that we no longer present it as
+* "current". The api sample carries the provider's measurement time; the sweep
+* that writes it runs ~every 60s and the Redis key TTLs at 5 min, so a sample
+* this old means the box likely stopped reporting (paused / gone). The card
+* treats it as "no current snapshot" rather than drawing minutes-old bars as if
+* they were live.
+*/
+const COMPUTER_STATS_STALE_MS = 5 * 6e4;
+/**
 * Whether a `/computer` card should refresh right now. Pure so the gating is
 * unit-testable. A card refreshes only when it is the most recent `/computer`
-* in the transcript (`isLatest`), the session can reach the sandbox
+* in the transcript (`isLatest`), the session can reach the api
 * (`canCollect`), and the transcript is at the bottom (`!scrolledUp`) — while
 * you're scrolled up reading something else it quietly stops (no wasted polls),
 * and resumes when you scroll back down. Older cards freeze regardless, so a
@@ -4836,180 +4846,6 @@ const COMPUTER_POLL_INTERVAL_MS = 3e4;
 function shouldPollComputer(opts) {
 	return opts.isLatest && opts.canCollect && !opts.scrolledUp;
 }
-/**
-* The command run in the sandbox to collect the snapshot. `sh`-portable, reads
-* only `/proc` and `df`. Each metric is one `key<TAB>value` line so the parser
-* never has to positionally align anything.
-*
-* The `port` lines enumerate LISTEN sockets the sandbox user's own processes
-* hold: one awk pass maps socket inodes from /proc/net/tcp{,6} to pids via
-* /proc/<pid>/fd, then a shell loop attaches each pid's cmdline. Platform
-* daemons run as root, so their /proc/<pid>/fd is unreadable here and they
-* never emit a line — the "user's servers only" filter falls out of
-* permissions rather than a curated list. Hex address:port is left for the
-* parser to decode (strtonum is gawk-only).
-*/
-const SANDBOX_STATS_COMMAND = [
-	`printf '${SANDBOX_STATS_SENTINEL}\\n'`,
-	`printf 'nproc\\t%s\\n' "$(nproc 2>/dev/null || echo 1)"`,
-	`printf 'loadavg\\t%s\\n' "$(cut -d' ' -f1-3 /proc/loadavg)"`,
-	`printf 'uptime\\t%s\\n' "$(cut -d' ' -f1 /proc/uptime)"`,
-	`awk '/^MemTotal:/{t=$2}/^MemAvailable:/{a=$2}END{printf "mem_total_kb\\t%d\\nmem_avail_kb\\t%d\\n",t,a}' /proc/meminfo`,
-	`awk '/^SwapTotal:/{t=$2}/^SwapFree:/{f=$2}END{printf "swap_total_kb\\t%d\\nswap_free_kb\\t%d\\n",t,f}' /proc/meminfo`,
-	`df -Pk / | awk 'NR==2{printf "disk_total_kb\\t%d\\ndisk_used_kb\\t%d\\n",$2,$3}'`,
-	`printf 'procs\\t%s\\n' "$(ls -1 /proc 2>/dev/null | grep -c '^[0-9]\\+$')"`,
-	`ls -l /proc/[0-9]*/fd 2>/dev/null | awk 'BEGIN { while ((getline l < "/proc/net/tcp") > 0) { split(l,f," "); if (f[4]=="0A") want[f[10]]=f[2] } close("/proc/net/tcp"); while ((getline l < "/proc/net/tcp6") > 0) { split(l,f," "); if (f[4]=="0A") want[f[10]]=f[2] } close("/proc/net/tcp6") } $0 ~ "^/proc/[0-9]+/fd:$" { pid=substr($0,7,length($0)-10) } match($0, /socket:\\[[0-9]+\\]/) { ino=substr($0,RSTART+8,RLENGTH-9); if (ino in want && !(ino in done)) { done[ino]=1; print want[ino] "\\t" pid } }' | while read addr pid; do cl=$(head -c 200 "/proc/$pid/cmdline" 2>/dev/null | tr "\\0" " "); printf 'port\\t%s\\t%s\\t%s\\n' "$addr" "$pid" "$cl"; done`
-].join(" ; ");
-const KB = 1024;
-const HIDDEN_PORTS = new Set([
-	38994,
-	49983,
-	38996
-]);
-const V6_LOOPBACK_HEX = "00000000000000000000000001000000";
-/**
-* Whether a /proc/net/tcp{,6} local-address hex field is a loopback bind.
-* v4 words are little-endian, so 127.0.0.1 is `0100007F` — the first octet
-* (127) is the LAST byte pair. Covers v4-mapped v6 (`::ffff:127.x.y.z`) via
-* the same tail check.
-*/
-function isLoopbackHex(addrHex) {
-	const hex = addrHex.toUpperCase();
-	if (hex.length === 8) return hex.slice(6) === "7F";
-	if (hex.length === 32) {
-		if (hex === V6_LOOPBACK_HEX) return true;
-		return hex.startsWith("0000000000000000FFFF0000") && hex.slice(30) === "7F";
-	}
-	return false;
-}
-const RUNTIME_NAMES = new Set([
-	"node",
-	"bun",
-	"deno",
-	"python",
-	"python3",
-	"sh",
-	"bash"
-]);
-const FLAGS_WITH_VALUE = new Set([
-	"--require",
-	"-r",
-	"--import",
-	"--loader",
-	"--experimental-loader"
-]);
-/**
-* A short display name from a raw cmdline: basename of argv[0], plus — when
-* argv[0] is a bare runtime — the basename of the first non-flag argument with
-* its extension dropped (`node …/vite/bin/vite.js` → `node vite`).
-*/
-function processDisplayName(cmdline) {
-	const argv = cmdline.trim().split(/\s+/).filter(Boolean);
-	const first = argv[0];
-	if (first === void 0) return null;
-	const base = (p) => p.split("/").pop() ?? p;
-	const name = base(first);
-	if (!RUNTIME_NAMES.has(name)) return name;
-	let script;
-	for (let i = 1; i < argv.length; i += 1) {
-		const arg = argv[i];
-		if (arg === void 0) break;
-		if (FLAGS_WITH_VALUE.has(arg)) {
-			i += 1;
-			continue;
-		}
-		if (arg.startsWith("-")) continue;
-		script = arg;
-		break;
-	}
-	if (!script) return name;
-	return `${name} ${base(script).replace(/\.(?:mjs|cjs|js|ts|tsx|py)$/, "")}`;
-}
-/**
-* Fold the collector's `port` lines (one per listen socket) into one entry
-* per port: v4/v6 binds of the same server dedupe, `loopbackOnly` only when
-* every bind is loopback, and the hidden platform ports drop out.
-*/
-function parsePortLines(lines) {
-	const byPort = /* @__PURE__ */ new Map();
-	for (const line of lines) {
-		const port = Number.parseInt(line.portHex, 16);
-		if (!Number.isFinite(port) || port <= 0 || HIDDEN_PORTS.has(port)) continue;
-		const entry = byPort.get(port);
-		if (entry) entry.loopback.push(isLoopbackHex(line.addrHex));
-		else byPort.set(port, {
-			loopback: [isLoopbackHex(line.addrHex)],
-			cmdline: line.cmdline
-		});
-	}
-	return [...byPort.entries()].map(([port, entry]) => ({
-		port,
-		loopbackOnly: entry.loopback.every(Boolean),
-		process: entry.cmdline ? processDisplayName(entry.cmdline) : null
-	})).sort((a, b) => a.port - b.port);
-}
-/**
-* Parse the collector's output into `SandboxStats`, or return null when the
-* block is absent or malformed (so the caller can show the raw output as an
-* error instead of a broken graph). Tolerant of extra lines before the
-* sentinel (shell banners) and of a missing swap section (swap totals default
-* to 0, which the renderer treats as "no swap").
-*/
-function parseSandboxStats(raw) {
-	const start = raw.indexOf(SANDBOX_STATS_SENTINEL);
-	if (start === -1) return null;
-	const fields = /* @__PURE__ */ new Map();
-	const portLines = [];
-	for (const line of raw.slice(start).split("\n")) {
-		const tab = line.indexOf("	");
-		if (tab === -1) continue;
-		const key = line.slice(0, tab).trim();
-		if (key === "port") {
-			const parts = line.split("	");
-			const [addrHex = "", portHex = ""] = (parts[1] ?? "").split(":");
-			if (addrHex && portHex) portLines.push({
-				addrHex,
-				portHex,
-				cmdline: parts.slice(3).join(" ").trim()
-			});
-			continue;
-		}
-		fields.set(key, line.slice(tab + 1).trim());
-	}
-	const num = (key) => {
-		const v = fields.get(key);
-		if (v === void 0) return null;
-		const n = Number(v);
-		return Number.isFinite(n) ? n : null;
-	};
-	const load = (fields.get("loadavg") ?? "").split(/\s+/).map(Number).filter((n) => Number.isFinite(n));
-	const nproc = num("nproc");
-	const uptime = num("uptime");
-	const memTotal = num("mem_total_kb");
-	const memAvail = num("mem_avail_kb");
-	const diskTotal = num("disk_total_kb");
-	const diskUsed = num("disk_used_kb");
-	const procs = num("procs");
-	const [load1, load5, load15] = load;
-	if (nproc === null || uptime === null || memTotal === null || memAvail === null || diskTotal === null || diskUsed === null || procs === null || load1 === void 0 || load5 === void 0 || load15 === void 0) return null;
-	return {
-		nproc: Math.max(1, Math.round(nproc)),
-		loadavg: [
-			load1,
-			load5,
-			load15
-		],
-		uptimeSeconds: uptime,
-		memTotalBytes: memTotal * KB,
-		memAvailBytes: memAvail * KB,
-		swapTotalBytes: (num("swap_total_kb") ?? 0) * KB,
-		swapFreeBytes: (num("swap_free_kb") ?? 0) * KB,
-		diskTotalBytes: diskTotal * KB,
-		diskUsedBytes: diskUsed * KB,
-		procs: Math.round(procs),
-		ports: parsePortLines(portLines)
-	};
-}
 function severityFor(fraction) {
 	if (fraction >= .9) return "crit";
 	if (fraction >= .75) return "warn";
@@ -5019,52 +4855,29 @@ const GiB = 1024 * 1024 * 1024;
 function gb(bytes) {
 	return (bytes / GiB).toFixed(1);
 }
-/** `120050` seconds -> `1d 9h 20m`. Always at least `0m`. */
-function formatUptime(seconds) {
-	const total = Math.max(0, Math.floor(seconds));
-	const d = Math.floor(total / 86400);
-	const h = Math.floor(total % 86400 / 3600);
-	const m = Math.floor(total % 3600 / 60);
-	const parts = [];
-	if (d > 0) parts.push(`${d}d`);
-	if (h > 0 || d > 0) parts.push(`${h}h`);
-	parts.push(`${m}m`);
-	return parts.join(" ");
-}
 /**
 * Reduce a snapshot to the ordered list of gauges the `/computer` card draws:
-* CPU load (normalized to core count), memory, swap (only when the box has
-* any), and disk. Load can exceed 1.0 (oversubscribed CPU) — the bar clamps
-* but the caption shows the true number so that's still legible.
+* CPU utilization, memory, and disk — the three signals the api's live-stats
+* read carries. CPU is a provider-measured utilization percent (already
+* normalized across cores), so it maps straight to a 0..1 bar; the caption
+* shows the vCPU count for context.
 */
 function toGauges(stats) {
 	const gauges = [];
-	const load1 = stats.loadavg[0];
-	const loadFraction = load1 / stats.nproc;
+	const cpuFraction = stats.cpuUsedPct / 100;
 	gauges.push({
-		label: "cpu load",
-		fraction: loadFraction,
-		detail: `${load1.toFixed(2)} / ${stats.nproc} cores`,
-		severity: severityFor(loadFraction)
+		label: "cpu",
+		fraction: cpuFraction,
+		detail: `${stats.cpuUsedPct.toFixed(0)}% · ${stats.cpuCount} vCPU`,
+		severity: severityFor(cpuFraction)
 	});
-	const memUsed = Math.max(0, stats.memTotalBytes - stats.memAvailBytes);
-	const memFraction = stats.memTotalBytes > 0 ? memUsed / stats.memTotalBytes : 0;
+	const memFraction = stats.memTotalBytes > 0 ? stats.memUsedBytes / stats.memTotalBytes : 0;
 	gauges.push({
 		label: "memory",
 		fraction: memFraction,
-		detail: `${gb(memUsed)} / ${gb(stats.memTotalBytes)} GB`,
+		detail: `${gb(stats.memUsedBytes)} / ${gb(stats.memTotalBytes)} GB`,
 		severity: severityFor(memFraction)
 	});
-	if (stats.swapTotalBytes > 0) {
-		const swapUsed = Math.max(0, stats.swapTotalBytes - stats.swapFreeBytes);
-		const swapFraction = swapUsed / stats.swapTotalBytes;
-		gauges.push({
-			label: "swap",
-			fraction: swapFraction,
-			detail: `${gb(swapUsed)} / ${gb(stats.swapTotalBytes)} GB`,
-			severity: severityFor(swapFraction)
-		});
-	}
 	const diskFraction = stats.diskTotalBytes > 0 ? stats.diskUsedBytes / stats.diskTotalBytes : 0;
 	gauges.push({
 		label: "disk",
@@ -5100,29 +4913,18 @@ function renderBar(fraction, width) {
 	const filled = "█".repeat(Math.min(full, cells)) + partial;
 	return (filled + "░".repeat(Math.max(0, cells - filled.length))).slice(0, cells);
 }
-/** How many port rows the card draws before folding the rest into `+N more`. */
-const MAX_PORT_ROWS = 8;
-const WELL_KNOWN_PORTS = new Map([[3e3, "agent harness"], [3001, "agent webserver"]]);
-/**
-* Reduce the snapshot's ports to drawable rows. The well-known note wins over
-* `local only` — a loopback-bound 3001 being unreachable is a distinct problem
-* the gauges' error path already surfaces, and one annotation per row keeps
-* the table scannable.
-*/
-function toPortRows(ports) {
-	return ports.map((p) => ({
-		port: p.port,
-		process: p.process ?? "?",
-		note: WELL_KNOWN_PORTS.get(p.port) ?? (p.loopbackOnly ? "local only" : null)
-	}));
-}
 
 //#endregion
 //#region src/chat/tui/chunks/computer.tsx
 /**
 * Renders the `/computer` card: a snapshot of the agent's sandbox as a stack of
-* colored bar graphs (cpu load, memory, swap, disk) plus a footer of scalar
-* facts (uptime, process count).
+* colored bar graphs (cpu, memory, disk).
+*
+* The numbers come from the api, not from reaching into the box: the card polls
+* `collectSandboxStats` (injected via context), which reads the live resource
+* sample the worker's fleet sweep already stores. So there's no exec and no
+* cold-start wake — when the agent has no running sandbox the read returns
+* "no snapshot" at once and the card shows an idle line instead of hanging.
 *
 * The card keeps itself current in place rather than making the user re-run the
 * command — but quietly: it refreshes on a slow interval with no "updating"
@@ -5130,9 +4932,8 @@ function toPortRows(ports) {
 * recent `/computer` card refreshes (older ones freeze at their last snapshot),
 * and the latest one silently stops while the transcript is scrolled up (no
 * wasted polls on a card you're not looking at) and resumes at the bottom — the
-* pause is never rendered. The refresh uses the same sandbox-exec relay
-* `/sandbox` uses, injected via context; the parse/layout math lives in
-* `sandbox-stats.ts` and this component only draws.
+* pause is never rendered. The parse/layout math lives in `sandbox-stats.ts` and
+* this component only draws.
 */
 function ComputerItem({ item }) {
 	const { collectSandboxStats, latestComputerId, scrolledUp } = useConversationContext();
@@ -5143,7 +4944,8 @@ function ComputerItem({ item }) {
 	});
 	const [stats, setStats] = useState(item.stats);
 	const [error, setError] = useState(item.error);
-	const hasStats = useRef(item.stats !== null);
+	const hasResolved = useRef(item.stats !== null || item.state !== "loading");
+	const [idle, setIdle] = useState(item.state !== "loading" && item.stats === null && item.error === null);
 	useEffect(() => {
 		if (!live || !collectSandboxStats) return;
 		let cancelled = false;
@@ -5156,11 +4958,12 @@ function ComputerItem({ item }) {
 			inFlight = null;
 			if (cancelled) return;
 			if (result.ok) {
-				hasStats.current = true;
+				hasResolved.current = true;
 				setStats(result.stats);
 				setError(null);
+				setIdle(result.stats === null);
 			} else if (!("aborted" in result)) {
-				if (!hasStats.current) setError(result.error);
+				if (!hasResolved.current) setError(result.error);
 			}
 			if (!cancelled) timer = setTimeout(tick, COMPUTER_POLL_INTERVAL_MS);
 		};
@@ -5171,43 +4974,26 @@ function ComputerItem({ item }) {
 			inFlight?.abort();
 		};
 	}, [live, collectSandboxStats]);
-	if (stats === null && error === null) return /* @__PURE__ */ jsx(Shell, { children: /* @__PURE__ */ jsx("text", {
+	if (stats === null && error === null && !idle) return /* @__PURE__ */ jsx(Shell, { children: /* @__PURE__ */ jsx("text", {
 		fg: theme.dim,
 		children: "reading sandbox stats…"
 	}) });
-	if (stats === null) return /* @__PURE__ */ jsx(Shell, { children: /* @__PURE__ */ jsxs("text", {
+	if (stats === null && error !== null) return /* @__PURE__ */ jsx(Shell, { children: /* @__PURE__ */ jsxs("text", {
 		fg: theme.error,
-		children: ["couldn't read sandbox stats", error ? `: ${error}` : ""]
+		children: ["couldn't read sandbox stats: ", error]
+	}) });
+	if (stats === null) return /* @__PURE__ */ jsx(Shell, { children: /* @__PURE__ */ jsx("text", {
+		fg: theme.dim,
+		children: "no sandbox running"
 	}) });
 	const gauges = toGauges(stats);
-	const portRows = toPortRows(stats.ports);
-	const labelWidth = Math.max(5, ...gauges.map((g) => g.label.length));
+	const labelWidth = Math.max(...gauges.map((g) => g.label.length));
 	const barWidth = 24;
-	return /* @__PURE__ */ jsxs(Shell, { children: [
-		gauges.map((g) => /* @__PURE__ */ jsx(GaugeRow, {
-			gauge: g,
-			labelWidth,
-			barWidth
-		}, g.label)),
-		/* @__PURE__ */ jsx(PortsSection, {
-			rows: portRows,
-			labelWidth
-		}),
-		/* @__PURE__ */ jsxs("text", {
-			fg: theme.dim,
-			children: [
-				`${"uptime".padEnd(labelWidth)}  `,
-				/* @__PURE__ */ jsx("span", {
-					fg: theme.muted,
-					children: formatUptime(stats.uptimeSeconds)
-				}),
-				/* @__PURE__ */ jsx("span", {
-					fg: theme.dim,
-					children: `  ·  ${stats.procs} processes`
-				})
-			]
-		})
-	] });
+	return /* @__PURE__ */ jsx(Shell, { children: gauges.map((g) => /* @__PURE__ */ jsx(GaugeRow, {
+		gauge: g,
+		labelWidth,
+		barWidth
+	}, g.label)) });
 }
 /** The card frame: a bold `computer` title over the graph rows. */
 function Shell({ children }) {
@@ -5255,42 +5041,6 @@ function GaugeRow({ gauge, labelWidth, barWidth }) {
 		})
 	] });
 }
-/**
-* The listening-ports table: one row per port the sandbox user's processes
-* hold, first row carrying the `ports` gutter label to line up with the
-* gauges. Folds past MAX_PORT_ROWS into a `+N more` line so a busy box can't
-* flood the transcript.
-*/
-function PortsSection({ rows, labelWidth }) {
-	if (rows.length === 0) return null;
-	const shown = rows.slice(0, MAX_PORT_ROWS);
-	const folded = rows.length - shown.length;
-	const gutter = " ".repeat(labelWidth);
-	return /* @__PURE__ */ jsxs(Fragment, { children: [shown.map((row, i) => /* @__PURE__ */ jsxs("text", { children: [
-		/* @__PURE__ */ jsx("span", {
-			fg: theme.muted,
-			children: `${i === 0 ? "ports".padEnd(labelWidth) : gutter}  `
-		}),
-		/* @__PURE__ */ jsx("span", {
-			fg: theme.fg,
-			children: String(row.port).padStart(5)
-		}),
-		/* @__PURE__ */ jsx("span", {
-			fg: theme.muted,
-			children: `  ${row.process}`
-		}),
-		row.note ? /* @__PURE__ */ jsx("span", {
-			fg: theme.dim,
-			children: `  · ${row.note}`
-		}) : null
-	] }, row.port)), folded > 0 ? /* @__PURE__ */ jsxs("text", { children: [/* @__PURE__ */ jsx("span", {
-		fg: theme.muted,
-		children: `${gutter}  `
-	}), /* @__PURE__ */ jsx("span", {
-		fg: theme.dim,
-		children: `+${folded} more`
-	})] }) : null] });
-}
 
 //#endregion
 //#region src/chat/tui/chunks/index.tsx
@@ -7042,55 +6792,45 @@ function formatShare(share) {
 
 //#endregion
 //#region src/chat/sandbox/collect-stats.ts
+/**
+* Drop a snapshot the api hasn't refreshed recently: the sweep that writes it
+* runs ~every 60s, so a sample older than {@link COMPUTER_STATS_STALE_MS} means
+* the box stopped reporting (paused / gone) and its numbers are no longer live.
+* Presenting it as current would be a lie, so treat it as "no snapshot".
+*/
+function freshOrNull(stats, now) {
+	if (!stats) return null;
+	return now - stats.sampledAt <= COMPUTER_STATS_STALE_MS ? stats : null;
+}
 function collectSandboxStats(cfg) {
-	const open = cfg.open ?? SandboxStream.open;
-	const dec = new TextDecoder();
-	let buffer = "";
-	let settled = false;
-	let stream = null;
+	let aborted = false;
 	let resolveRef = null;
+	let settled = false;
+	const settle = (r) => {
+		if (settled) return;
+		settled = true;
+		resolveRef?.(r);
+	};
 	return {
 		result: new Promise((resolve) => {
 			resolveRef = resolve;
-			const settle = (r) => {
-				if (settled) return;
-				settled = true;
-				resolve(r);
-			};
-			stream = open({
-				mode: "exec",
-				appUrl: cfg.appUrl,
-				sessionToken: cfg.sessionToken,
-				agentId: cfg.agentId,
-				command: SANDBOX_STATS_COMMAND,
-				onEvent: (e) => {
-					if (e.type === "data") buffer += dec.decode(e.bytes);
-					else if (e.type === "error") settle({
-						ok: false,
-						error: e.message
-					});
-					else if (e.type === "exit") {
-						const stats = parseSandboxStats(buffer);
-						if (stats) settle({
-							ok: true,
-							stats
-						});
-						else settle({
-							ok: false,
-							error: e.code === 0 ? "unexpected output from the sandbox" : `sandbox command exited ${e.code}`
-						});
-					} else if (e.type === "close") settle({
-						ok: false,
-						error: e.failure ?? "connection closed before the snapshot finished"
-					});
-				}
+			cfg.read().then((stats) => {
+				if (aborted) return;
+				settle({
+					ok: true,
+					stats: freshOrNull(stats, cfg.now())
+				});
+			}).catch((err) => {
+				if (aborted) return;
+				settle({
+					ok: false,
+					error: err instanceof Error ? err.message : String(err)
+				});
 			});
 		}),
 		abort: () => {
-			if (settled) return;
-			settled = true;
-			stream?.close();
-			resolveRef?.({
+			aborted = true;
+			settle({
 				ok: false,
 				aborted: true,
 				error: "aborted"
@@ -13123,17 +12863,12 @@ function ChatScreen({ agent, conversation }) {
 		return null;
 	}, [items]);
 	const boundCollectSandboxStats = useMemo(() => {
-		if (!appUrl || !sessionToken) return null;
+		if (!rest) return null;
 		return () => collectSandboxStats({
-			appUrl,
-			sessionToken,
-			agentId: agent.id
+			read: () => rest.computeLiveStats(),
+			now: () => Date.now()
 		});
-	}, [
-		appUrl,
-		sessionToken,
-		agent.id
-	]);
+	}, [rest]);
 	const conversationContext = useMemo(() => ({
 		rest,
 		conversationId,

package/dist/js/{daemon-DuxaUuek.mjs → daemon-BTyg329O.mjs}

@@ -20,7 +20,7 @@ import { access, appendFile, mkdir, readFile, unlink, writeFile } from "node:fs/
 * the commit time of the built tree is one monotonic clock they share.
 */
 function portalDaemonBuild() {
-	return "1786755327";
+	return "1786761220";
 }
 /**
 * Whether a client carrying `mine` should replace a running daemon carrying

package/dist/js/{daemon-Ce8WLdGI.mjs → daemon-SPQgtsbW.mjs}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import "./client-DbqRBquD.mjs";
-import { a as runPortalDaemon, i as queryDaemonStatus, n as ensureDaemonRunning, o as startPortalDaemon, r as isDaemonListening, s as stopDaemon, t as PortalDaemon } from "./daemon-DuxaUuek.mjs";
+import { a as runPortalDaemon, i as queryDaemonStatus, n as ensureDaemonRunning, o as startPortalDaemon, r as isDaemonListening, s as stopDaemon, t as PortalDaemon } from "./daemon-BTyg329O.mjs";
 import "./api-DG5W6iwx.mjs";
 
 export { runPortalDaemon };

package/dist/js/{daemon-client-C4heMWTq.mjs → daemon-client--A_yMKq6.mjs}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { c as LOCAL_PROTOCOL_VERSION, d as encodeLine, f as makeLineParser, n as ensureDaemonRunning, p as parseDaemonMessage, u as daemonPaths } from "./daemon-DuxaUuek.mjs";
+import { c as LOCAL_PROTOCOL_VERSION, d as encodeLine, f as makeLineParser, n as ensureDaemonRunning, p as parseDaemonMessage, u as daemonPaths } from "./daemon-BTyg329O.mjs";
 import { randomUUID } from "node:crypto";
 import { connect } from "node:net";
 

package/dist/js/daemon-client-C7emKKlj.mjs

@@ -0,0 +1,7 @@
+#!/usr/bin/env node
+import "./client-DbqRBquD.mjs";
+import "./daemon-BTyg329O.mjs";
+import "./api-DG5W6iwx.mjs";
+import { t as PortalDaemonClient } from "./daemon-client--A_yMKq6.mjs";
+
+export { PortalDaemonClient };

package/dist/js/{print-DYiQC5IW.mjs → print-C_TnQSPg.mjs}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { t as HttpError } from "./http-error-DzyrsLAZ.mjs";
-import { a as isRecord, i as errorMessage, r as sendErrorMessage, t as createRestClient } from "./rest-xXfqT4SX.mjs";
+import { a as isRecord, i as errorMessage, r as sendErrorMessage, t as createRestClient } from "./rest-CgfbKXst.mjs";
 import { i as billingBlockedOutcomeFromSendResponse, n as BillingBlockedError } from "./billing-blocked-2wju4gC_.mjs";
 import path from "node:path";
 import Conf from "conf";

package/dist/js/{print-CQkXZ02a.mjs → print-DACzRUwQ.mjs}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { a as runPrint, i as resolveAgent, n as messageGet, o as toPrintError, r as readStdin, t as collectRunText } from "./print-DYiQC5IW.mjs";
-import "./rest-xXfqT4SX.mjs";
+import { a as runPrint, i as resolveAgent, n as messageGet, o as toPrintError, r as readStdin, t as collectRunText } from "./print-C_TnQSPg.mjs";
+import "./rest-CgfbKXst.mjs";
 import "./billing-blocked-2wju4gC_.mjs";
 
 export { messageGet, readStdin, resolveAgent, runPrint };

package/dist/js/{profiler-BoO7ldO0.mjs → profiler-BVbYs_Yg.mjs}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { C as getConfigPath } from "./print-DYiQC5IW.mjs";
+import { C as getConfigPath } from "./print-C_TnQSPg.mjs";
 import os from "node:os";
 import path from "node:path";
 import { err, ok } from "neverthrow";
@@ -8,7 +8,7 @@ import fs from "node:fs";
 
 //#region package.json
 var name = "skydive-cli";
-var version$1 = "0.5.0-beta.30";
+var version$1 = "0.5.0-beta.31";
 
 //#endregion
 //#region src/auth/organization.ts

package/dist/js/{rest-xXfqT4SX.mjs → rest-CgfbKXst.mjs}

@@ -299,6 +299,10 @@ function createRestClient({ appUrl, sessionToken, workspaceId }) {
 			const { result } = await get(`/api/v1/trpc/v2.subagentTasks.list?input=${encodeURIComponent(JSON.stringify({ conversationId }))}`, subagentTasksResponseSchema);
 			return new Map(result.data.subagentTasks.map((task) => [task.id, task]));
 		},
+		computeLiveStats: async () => {
+			const { stats } = await get("/api/v1/compute/live-stats", liveStatsResponseSchema);
+			return stats;
+		},
 		uploadAttachment: async ({ agentId, fileName, mediaType, data }) => {
 			const size = data.byteLength;
 			const presign = await post("/api/v1/attachments/presign", {
@@ -549,6 +553,15 @@ const subagentTaskSnapshotSchema = z.object({
 	completedAt: z.string().nullable()
 });
 const subagentTasksResponseSchema = z.object({ result: z.object({ data: z.object({ subagentTasks: z.array(subagentTaskSnapshotSchema) }) }) });
+const liveStatsResponseSchema = z.object({ stats: z.object({
+	sampledAt: z.number(),
+	cpuUsedPct: z.number(),
+	cpuCount: z.number(),
+	memUsedBytes: z.number(),
+	memTotalBytes: z.number(),
+	diskUsedBytes: z.number(),
+	diskTotalBytes: z.number()
+}).nullable() });
 const listMessagesResponseSchema = z.object({ messages: z.array(uiMessageSchema) });
 const workspaceFileSchema = z.object({
 	id: z.string(),

package/dist/js/{rest-DSpGS5XU.mjs → rest-VV5nc-Mn.mjs}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { t as HttpError } from "./http-error-DzyrsLAZ.mjs";
-import { n as errorDetail, r as sendErrorMessage, t as createRestClient } from "./rest-xXfqT4SX.mjs";
+import { n as errorDetail, r as sendErrorMessage, t as createRestClient } from "./rest-CgfbKXst.mjs";
 import "./billing-blocked-2wju4gC_.mjs";
 
 export { createRestClient };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skydive-cli",
-  "version": "0.5.0-beta.30",
+  "version": "0.5.0-beta.31",
   "description": "Skydive CLI — cloud agents from the command line",
   "homepage": "https://skydive.com",
   "license": "MIT",

package/dist/js/daemon-client-LJdnM_nE.mjs

@@ -1,7 +0,0 @@
-#!/usr/bin/env node
-import "./client-DbqRBquD.mjs";
-import "./daemon-DuxaUuek.mjs";
-import "./api-DG5W6iwx.mjs";
-import { t as PortalDaemonClient } from "./daemon-client-C4heMWTq.mjs";
-
-export { PortalDaemonClient };