skydive-cli 0.5.0-beta.31 → 0.5.0-beta.32

package/dist/js/api-DQCaztBg.mjs

@@ -0,0 +1,315 @@
+#!/usr/bin/env node
+import { t as HttpError } from "./http-error-UHH3mVBF.mjs";
+import { z } from "zod";
+import http from "node:http";
+import http2 from "node:http2";
+
+//#region ../portal-daemon/src/tls-forward.ts
+const TLS_PORT_OFFSET = 1e4;
+const STRIP_HEADERS = new Set([
+	"connection",
+	"keep-alive",
+	"proxy-authenticate",
+	"proxy-authorization",
+	"proxy-connection",
+	"te",
+	"trailer",
+	"transfer-encoding",
+	"upgrade",
+	"http2-settings"
+]);
+/**
+* The opt-in TLS+h2 origin for a forwarded/exposed port (ANY-6872, additive
+* next to the plain listener — never a replacement). Browsers only negotiate
+* h2 over TLS, and h2's stream multiplexing is what lifts the
+* 6-connections-per-origin cap that makes unbundled dev servers crawl through
+* the tunnel; each h2 stream is converted here to an h1 request over a tunnel
+* from `acquireTunnel`. Used by BOTH tunnel surfaces: the CLI's
+* `skydive portal forward` and the desktop daemon's `platform portal expose`.
+*
+* The dev server keeps seeing `Host: localhost:<port>` — the browser's
+* authority is a public name it would reject (Vite 403s unknown hosts), and
+* "looks exactly like localhost" is the product contract. The original
+* authority travels in x-forwarded-host / x-forwarded-proto for apps that
+* want it.
+*/
+async function startTlsForward({ cert, localPort, targetPort, acquireTunnel, log }) {
+	const connectionShims = {
+		setNoDelay: () => {},
+		setKeepAlive: () => {},
+		setTimeout: () => {},
+		ref: () => {},
+		unref: () => {}
+	};
+	/**
+	* node's http client drives the tunnel: the agent's keep-alive free list
+	* gives request→request socket reuse on top of the pool's pre-paid dials,
+	* and a tunnel the daemon/dev-server side reaps while idle is evicted from
+	* the free list by its 'close' — the next request just adopts a fresh one.
+	* maxSockets mirrors the pool cap: every socket here holds an edge WS open,
+	* and ANY-6873 is the honest fix for wanting more concurrency than that.
+	*
+	* The base signature allows synchronous implementations to return the
+	* socket; this one is asynchronous, so it always uses the callback and
+	* returns undefined (the documented async contract). The agent core always
+	* passes the callback — the error branch below guards the contract anyway
+	* rather than assuming it.
+	*/
+	class TunnelAgent extends http.Agent {
+		createConnection(_options, callback) {
+			if (!callback) throw new Error("TunnelAgent.createConnection requires the async callback");
+			(async () => {
+				let tunnel;
+				try {
+					tunnel = await acquireTunnel();
+				} catch (error) {
+					callback(error instanceof Error ? error : new Error(String(error)));
+					return;
+				}
+				Object.assign(tunnel.stream, connectionShims);
+				tunnel.stream.resume();
+				callback(null, tunnel.stream);
+			})();
+		}
+	}
+	const agent = new TunnelAgent({
+		keepAlive: true,
+		maxSockets: 16
+	});
+	const server = http2.createSecureServer({
+		key: cert.key,
+		cert: cert.cert,
+		allowHTTP1: true
+	});
+	const liveSessions = /* @__PURE__ */ new Set();
+	server.on("session", (session) => {
+		liveSessions.add(session);
+		session.once("close", () => liveSessions.delete(session));
+	});
+	server.on("secureConnection", (socket) => {
+		liveSessions.add(socket);
+		socket.once("close", () => liveSessions.delete(socket));
+	});
+	server.on("request", (req, res) => {
+		const headers = {};
+		for (const [name, value] of Object.entries(req.headers)) {
+			if (name.startsWith(":") || STRIP_HEADERS.has(name)) continue;
+			if (value !== void 0) headers[name] = value;
+		}
+		headers.host = `localhost:${targetPort}`;
+		headers["x-forwarded-proto"] = "https";
+		headers["x-forwarded-host"] = cert.hostname;
+		const upstream = http.request({
+			host: "localhost",
+			port: targetPort,
+			method: req.method,
+			path: req.url,
+			headers,
+			agent
+		}, (upstreamRes) => {
+			const resHeaders = {};
+			for (const [name, value] of Object.entries(upstreamRes.headers)) {
+				if (STRIP_HEADERS.has(name)) continue;
+				if (value !== void 0) resHeaders[name] = value;
+			}
+			res.writeHead(upstreamRes.statusCode ?? 502, resHeaders);
+			upstreamRes.pipe(res);
+			upstreamRes.on("error", () => res.destroy());
+		});
+		upstream.on("error", (err) => {
+			log(`forward(tls): upstream request failed: ${err.message}`);
+			if (!res.headersSent) {
+				res.writeHead(502, { "content-type": "text/plain" });
+				res.end("portal forward: tunnel request failed");
+			} else res.destroy();
+		});
+		req.pipe(upstream);
+		req.on("error", () => upstream.destroy());
+	});
+	server.on("upgrade", (req, socket, head) => {
+		socket.pause();
+		(async () => {
+			let tunnel;
+			try {
+				tunnel = await acquireTunnel();
+			} catch (err) {
+				log(`forward(tls): upgrade tunnel failed: ${err instanceof Error ? err.message : String(err)}`);
+				socket.destroy();
+				return;
+			}
+			const lines = [`${req.method} ${req.url} HTTP/1.1`];
+			for (let i = 0; i < req.rawHeaders.length; i += 2) {
+				const name = req.rawHeaders[i];
+				const value = name?.toLowerCase() === "host" ? `localhost:${targetPort}` : req.rawHeaders[i + 1];
+				lines.push(`${name}: ${value}`);
+			}
+			tunnel.stream.write(lines.join("\r\n") + "\r\n\r\n");
+			if (head.length > 0) tunnel.stream.write(head);
+			tunnel.stream.on("error", () => socket.destroy());
+			tunnel.stream.on("close", () => socket.destroy());
+			socket.on("error", () => tunnel.stream.destroy());
+			socket.on("close", () => tunnel.stream.destroy());
+			socket.pipe(tunnel.stream).pipe(socket);
+			socket.resume();
+		})();
+	});
+	server.on("tlsClientError", (err, tlsSocket) => {
+		tlsSocket.destroy();
+		log(`forward(tls): handshake failed: ${err.message}`);
+	});
+	const preferredPort = localPort + TLS_PORT_OFFSET <= 65535 ? localPort + TLS_PORT_OFFSET : 0;
+	return {
+		port: await new Promise((resolve, reject) => {
+			const onError = (err) => {
+				if (err.code === "EADDRINUSE" && preferredPort !== 0) {
+					server.listen(0, "127.0.0.1");
+					return;
+				}
+				server.removeListener("error", onError);
+				reject(err);
+			};
+			server.on("error", onError);
+			server.on("listening", () => {
+				server.removeListener("error", onError);
+				const addr = server.address();
+				resolve(addr && typeof addr === "object" ? addr.port : preferredPort);
+			});
+			server.listen(preferredPort, "127.0.0.1");
+		}),
+		hostname: cert.hostname,
+		close: () => new Promise((resolve) => {
+			agent.destroy();
+			server.close(() => resolve());
+			for (const live of liveSessions) live.destroy();
+		})
+	};
+}
+
+//#endregion
+//#region ../portal-daemon/src/api.ts
+/**
+* The portal's session-authed REST surface, shared by `PortalClient` (the
+* TUI/`portal open` connection) and the `skydive portal` management
+* commands, so the endpoint contracts and response schemas live in exactly
+* one place.
+*/
+const deviceSchema = z.object({
+	id: z.string(),
+	machineName: z.string(),
+	friendlyName: z.string(),
+	connected: z.boolean(),
+	lastSeen: z.string().nullable(),
+	grantedAgentIds: z.array(z.string())
+});
+const devicesResponseSchema = z.object({
+	devices: z.array(deviceSchema),
+	agents: z.array(z.object({
+		id: z.string(),
+		name: z.string()
+	}))
+});
+const deviceTokenSchema = z.object({ token: z.string().min(1) });
+async function portalFetch(auth, path, init) {
+	const res = await fetch(`${auth.appUrl}${path}`, {
+		method: init.method,
+		headers: {
+			authorization: `Bearer ${auth.sessionToken}`,
+			accept: "application/json",
+			...init.body ? { "content-type": "application/json" } : {}
+		},
+		...init.body ? { body: init.body } : {}
+	});
+	if (!res.ok) {
+		const body = await res.text().catch(() => "");
+		throw new HttpError(res.status, body);
+	}
+	return res.json();
+}
+async function fetchPortalDevices(auth) {
+	const json = await portalFetch(auth, "/api/v1/portal/devices", { method: "GET" });
+	return devicesResponseSchema.parse(json);
+}
+const registerResponseSchema = z.object({ device: z.object({ id: z.string() }) });
+/**
+* Register this machine's device row without connecting. Connecting registers
+* as a side effect; this covers granting an agent on a machine that has never
+* shared yet (the grant references the device row).
+*/
+async function registerPortalDevice(auth, { machineName, friendlyName }) {
+	const json = await portalFetch(auth, "/api/v1/portal/devices", {
+		method: "POST",
+		body: JSON.stringify({
+			machineName,
+			friendlyName
+		})
+	});
+	return registerResponseSchema.parse(json).device;
+}
+/** Short-lived token the machine presents when dialing the portal WebSocket. */
+async function mintPortalDeviceToken(auth) {
+	const json = await portalFetch(auth, "/api/v1/portal/device-token", { method: "POST" });
+	return deviceTokenSchema.parse(json).token;
+}
+const forwardTargetSchema = z.object({
+	daemonOrigin: z.string().min(1),
+	token: z.string().min(1),
+	expiresInSeconds: z.number()
+});
+/**
+* Everything `portal forward` needs to dial an agent's sandbox daemon through
+* the agent-webserver edge Worker: the daemon's stable public origin and a
+* daemon auth token (canUse-gated server-side).
+*/
+async function fetchForwardTarget(auth, agentId) {
+	const json = await portalFetch(auth, "/api/v1/portal/forward-target", {
+		method: "POST",
+		body: JSON.stringify({ agentId })
+	});
+	return forwardTargetSchema.parse(json);
+}
+async function grantPortalAccess(auth, { deviceId, agentId, conversationId }) {
+	await portalFetch(auth, `/api/v1/portal/devices/${encodeURIComponent(deviceId)}/grants`, {
+		method: "POST",
+		body: JSON.stringify({
+			agentId,
+			conversationId
+		})
+	});
+}
+async function revokePortalAccess(auth, { deviceId, agentId }) {
+	await portalFetch(auth, `/api/v1/portal/devices/${encodeURIComponent(deviceId)}/grants/${encodeURIComponent(agentId)}`, { method: "DELETE" });
+}
+/**
+* The device row for a given machine identity. Matching is by `machineName`
+* equality — the stable handle the machine registers under, not the display
+* label.
+*/
+function findThisDevice(devices, machineName) {
+	return devices.find((device) => device.machineName === machineName) ?? null;
+}
+/**
+* One-time grant migration onto the merged device. Earlier CLI builds
+* registered a separate `<machineName>-cli` device, so a user's existing
+* approvals hang off that row; the merged device would start with zero grants
+* and every already-authorized agent would ask again. Copy any grant the
+* merged device is missing (the grant endpoint upserts, so re-runs are
+* no-ops). The legacy row is left in place — an old CLI build may still
+* connect under it. Returns how many grants were copied.
+*/
+async function unifyLegacyCliGrants(auth, machineName) {
+	const { devices } = await fetchPortalDevices(auth);
+	const merged = findThisDevice(devices, machineName);
+	const legacy = findThisDevice(devices, `${machineName}-cli`);
+	if (!merged || !legacy) return 0;
+	const have = new Set(merged.grantedAgentIds);
+	const missing = legacy.grantedAgentIds.filter((id) => !have.has(id));
+	for (const agentId of missing) await grantPortalAccess(auth, {
+		deviceId: merged.id,
+		agentId,
+		conversationId: null
+	});
+	return missing.length;
+}
+
+//#endregion
+export { mintPortalDeviceToken as a, unifyLegacyCliGrants as c, grantPortalAccess as i, startTlsForward as l, fetchPortalDevices as n, registerPortalDevice as o, findThisDevice as r, revokePortalAccess as s, fetchForwardTarget as t };

package/dist/js/{billing-blocked-Dgu5-oDy.mjs → billing-blocked-SE6tySLd.mjs}

@@ -1,4 +1,4 @@
 #!/usr/bin/env node
-import { a as billingBlockedOutcomeSchema, i as billingBlockedOutcomeFromSendResponse, n as BillingBlockedError, r as billingBlockedJsonResult, t as BILLING_BLOCKED_EXIT_CODE } from "./billing-blocked-2wju4gC_.mjs";
+import { a as billingBlockedOutcomeSchema, i as billingBlockedOutcomeFromSendResponse, n as BillingBlockedError, r as billingBlockedJsonResult, t as BILLING_BLOCKED_EXIT_CODE } from "./billing-blocked-D3l5kJlX.mjs";
 
 export { BILLING_BLOCKED_EXIT_CODE, BillingBlockedError, billingBlockedJsonResult };

package/dist/js/bin.mjs

@@ -1,14 +1,15 @@
 #!/usr/bin/env node
-import { A as takenAliasNames, B as name, D as dedupeAliasName, E as aliasActivationHint, F as getActiveWorkspaceId, I as getSessionIdentity, L as listWorkspaces, M as defaultInstallEnv, N as detectShell, O as installAgentAlias, P as ensureActiveOrganization, R as resolveWorkspaceId, S as themes, T as machineOsFromPlatform, V as version, a as installCrashHandler, j as SUPPORTED_SHELLS, k as slugifyAliasName, t as maybeStartProfiling, u as brandHelpArt, w as buildImportSeedPrompt, z as setActiveWorkspace } from "./profiler-BVbYs_Yg.mjs";
-import { A as getShareMachineDefault, C as getConfigPath, D as getPromptHistoryPath, E as getPreference, F as resolveAppUrl, H as saveSession, I as resolveChatAuth, L as resolveConfig, M as getStoredApiKeyWorkspaceName, N as getUpdateCheckDisabled, R as resolveManagementAuth, S as deleteConfig, T as getLastSeenVersion, V as saveConfig, W as setLastSeenVersion, _ as API_KEY_FAMILY_PREFIX, g as API_KEYS_URL, i as resolveAgent$1, j as getStoredApiKeyId, v as API_KEY_PREFIX, w as getDefaultAgent, x as PREFERENCES, y as DEFAULT_API_URL, z as resolveSession } from "./print-C_TnQSPg.mjs";
-import { n as printError, r as printTable, t as output } from "./output-DYzzdXYV.mjs";
-import { t as HttpError } from "./http-error-DzyrsLAZ.mjs";
-import { t as createRestClient } from "./rest-CgfbKXst.mjs";
-import "./billing-blocked-2wju4gC_.mjs";
-import { r as resolveMachineIdentity } from "./client-DbqRBquD.mjs";
-import { i as queryDaemonStatus, l as PORTAL_DAEMON_FLAG, n as ensureDaemonRunning, s as stopDaemon, u as daemonPaths } from "./daemon-BTyg329O.mjs";
-import { i as grantPortalAccess, n as fetchPortalDevices, o as registerPortalDevice, r as findThisDevice, s as revokePortalAccess } from "./api-DG5W6iwx.mjs";
-import { t as SandboxStream } from "./client-c4c5MmgN.mjs";
+import { A as takenAliasNames, B as name, D as dedupeAliasName, E as aliasActivationHint, F as getActiveWorkspaceId, I as getSessionIdentity, L as listWorkspaces, M as defaultInstallEnv, N as detectShell, O as installAgentAlias, P as ensureActiveOrganization, R as resolveWorkspaceId, S as themes, T as machineOsFromPlatform, V as version, a as installCrashHandler, j as SUPPORTED_SHELLS, k as slugifyAliasName, t as maybeStartProfiling, u as brandHelpArt, w as buildImportSeedPrompt, z as setActiveWorkspace } from "./profiler-CJMnC90G.mjs";
+import { A as getShareMachineDefault, C as getConfigPath, D as getPromptHistoryPath, E as getPreference, F as resolveAppUrl, H as saveSession, I as resolveChatAuth, L as resolveConfig, M as getStoredApiKeyWorkspaceName, N as getUpdateCheckDisabled, R as resolveManagementAuth, S as deleteConfig, T as getLastSeenVersion, V as saveConfig, W as setLastSeenVersion, _ as API_KEY_FAMILY_PREFIX, g as API_KEYS_URL, i as resolveAgent$1, j as getStoredApiKeyId, v as API_KEY_PREFIX, w as getDefaultAgent, x as PREFERENCES, y as DEFAULT_API_URL, z as resolveSession } from "./print-Clgq46GU.mjs";
+import { n as printError, r as printTable, t as output } from "./output-wY0VQDea.mjs";
+import { t as HttpError } from "./http-error-UHH3mVBF.mjs";
+import { t as createRestClient } from "./rest-C6E4mS2A.mjs";
+import "./billing-blocked-D3l5kJlX.mjs";
+import { r as resolveMachineIdentity } from "./client-d6K9qm6B.mjs";
+import { i as queryDaemonStatus, l as PORTAL_DAEMON_FLAG, n as ensureDaemonRunning, s as stopDaemon, u as daemonPaths } from "./daemon-CxFxH36O.mjs";
+import "./tls-cert-CV-pwxVN.mjs";
+import { i as grantPortalAccess, n as fetchPortalDevices, o as registerPortalDevice, r as findThisDevice, s as revokePortalAccess } from "./api-DQCaztBg.mjs";
+import { t as SandboxStream } from "./client-BTQ1fwzM.mjs";
 import { hideBin } from "yargs/helpers";
 import yargs from "yargs";
 import { hostname, tmpdir } from "node:os";
@@ -1584,7 +1585,7 @@ const importCommand = {
 				process.exit(1);
 			}
 		}
-		const { runChat } = await import("./boot-iaVSnd7h.mjs");
+		const { runChat } = await import("./boot-yyXrIeVy.mjs");
 		await runChat({
 			appUrl,
 			sessionToken: session.value.sessionToken,
@@ -1614,7 +1615,7 @@ async function runImportPrintMode({ argv, appUrl }) {
 		printError(`${session.error.message} For non-interactive use, run \`skydive auth login --web\` first, or set SKYDIVE_SESSION_TOKEN.`);
 		process.exit(1);
 	}
-	const { connectMachineShare } = await import("./print-share-BH9gvCls.mjs");
+	const { connectMachineShare } = await import("./print-share-BBy3OTno.mjs");
 	const machineShare = await connectMachineShare({
 		appUrl,
 		sessionToken: session.value.sessionToken,
@@ -1622,7 +1623,7 @@ async function runImportPrintMode({ argv, appUrl }) {
 	});
 	const extra = (argv.print ?? "").trim();
 	const prompt = buildImportSeedPrompt(process.cwd(), machineOsFromPlatform(process.platform)) + (extra ? `\n\nAdditional instructions: ${extra}` : "");
-	const { runPrint } = await import("./print-DACzRUwQ.mjs");
+	const { runPrint } = await import("./print-B9djx8GU.mjs");
 	try {
 		const result = await runPrint({
 			appUrl,
@@ -2029,7 +2030,7 @@ const chatCommand = {
 			sessionToken: auth.value.token,
 			agentSelector: argv.agent ?? null
 		});
-		const { runChat } = await import("./boot-iaVSnd7h.mjs");
+		const { runChat } = await import("./boot-yyXrIeVy.mjs");
 		await runChat({
 			appUrl: auth.value.appUrl,
 			sessionToken: auth.value.token,
@@ -2113,7 +2114,7 @@ async function runPrintMode({ argv, appUrl }) {
 		printError(`${auth.error.message} For non-interactive use, run \`skydive auth login\` first, or set SKYDIVE_API_KEY / SKYDIVE_SESSION_TOKEN.`);
 		process.exit(1);
 	}
-	const { runPrint, readStdin } = await import("./print-DACzRUwQ.mjs");
+	const { runPrint, readStdin } = await import("./print-B9djx8GU.mjs");
 	const workspaceId = await resolveWorkspaceFlag({
 		appUrl,
 		sessionToken: auth.value.token,
@@ -2143,7 +2144,7 @@ async function runPrintMode({ argv, appUrl }) {
 			process.exit(1);
 		}
 	} else {
-		const { connectMachineShare } = await import("./print-share-BH9gvCls.mjs");
+		const { connectMachineShare } = await import("./print-share-BBy3OTno.mjs");
 		machineShare = await connectMachineShare({
 			appUrl: auth.value.appUrl,
 			sessionToken: auth.value.token,
@@ -2164,7 +2165,7 @@ async function runPrintMode({ argv, appUrl }) {
 		});
 		if (argv.json) output(argv, result);
 	} catch (error) {
-		const { BillingBlockedError, BILLING_BLOCKED_EXIT_CODE, billingBlockedJsonResult } = await import("./billing-blocked-Dgu5-oDy.mjs");
+		const { BillingBlockedError, BILLING_BLOCKED_EXIT_CODE, billingBlockedJsonResult } = await import("./billing-blocked-SE6tySLd.mjs");
 		if (error instanceof BillingBlockedError) {
 			if (argv.json) output(argv, billingBlockedJsonResult(error, null));
 			printError(error.message);
@@ -2208,7 +2209,7 @@ const getCommand$1 = {
 			printError(`${auth.error.message} Run \`skydive auth login\` first, or set SKYDIVE_API_KEY / SKYDIVE_SESSION_TOKEN.`);
 			process.exit(1);
 		}
-		const { messageGet } = await import("./print-DACzRUwQ.mjs");
+		const { messageGet } = await import("./print-B9djx8GU.mjs");
 		try {
 			const result = await messageGet({
 				appUrl: auth.value.appUrl,
@@ -2218,7 +2219,7 @@ const getCommand$1 = {
 			});
 			if (argv.json) output(argv, result);
 		} catch (error) {
-			const { BillingBlockedError, BILLING_BLOCKED_EXIT_CODE, billingBlockedJsonResult } = await import("./billing-blocked-Dgu5-oDy.mjs");
+			const { BillingBlockedError, BILLING_BLOCKED_EXIT_CODE, billingBlockedJsonResult } = await import("./billing-blocked-SE6tySLd.mjs");
 			if (error instanceof BillingBlockedError) {
 				if (argv.json) output(argv, billingBlockedJsonResult(error, argv["message-id"]));
 				printError(error.message);
@@ -2411,7 +2412,7 @@ const switchCommand = {
 				printError("The workspace picker needs the Bun runtime and it could not be set up automatically. Pass a workspace slug instead, or install Bun and retry.");
 				process.exit(1);
 			}
-			const { runWorkspacePicker } = await import("./boot-iaVSnd7h.mjs");
+			const { runWorkspacePicker } = await import("./boot-yyXrIeVy.mjs");
 			await runWorkspacePicker(session);
 			return;
 		}
@@ -2490,7 +2491,7 @@ const openCommand = {
 		const agent = argv.agent ? resolveAgent$1((await fetchPortalDevices(session)).agents, argv.agent) : null;
 		const cwd = argv.cwd ? path.resolve(argv.cwd) : process.cwd();
 		const { machineName } = await resolveMachineIdentity(null);
-		const { PortalDaemonClient } = await import("./daemon-client-C7emKKlj.mjs");
+		const { PortalDaemonClient } = await import("./daemon-client-1Qfc_Y3J.mjs");
 		let lastLine = "";
 		let signalConnected;
 		const connected = new Promise((resolve) => {
@@ -2736,15 +2737,19 @@ const forwardCommand = {
 		const agent = resolveAgent$1((await fetchPortalDevices(session)).agents, argv.agent ?? null);
 		const targetPort = argv.port;
 		const localPort = argv["local-port"] ?? targetPort;
-		const { startForward } = await import("./forward-DL6DYqyc.mjs");
+		const { startForward } = await import("./forward-zwB55Bls.mjs");
+		const { defaultTlsCertSource } = await import("./tls-cert-CLgSQALB.mjs");
+		const log = (msg) => console.error(msg);
 		const listener = await startForward({
 			auth: session,
 			agentId: agent.id,
 			localPort,
 			targetPort,
-			log: (msg) => console.error(msg)
+			tlsCertSource: defaultTlsCertSource(process.env, log),
+			log
 		});
 		console.log(`Forwarding http://localhost:${listener.port} -> ${agent.name}'s sandbox port ${targetPort}. ctrl+c to stop.`);
+		if (listener.tls) console.log(`           https://${listener.tls.hostname}:${listener.tls.port} (TLS — browsers negotiate HTTP/2 here, which loads module-heavy dev servers much faster)`);
 		await new Promise((resolve) => {
 			process.once("SIGINT", () => resolve());
 			process.once("SIGTERM", () => resolve());
@@ -2800,8 +2805,8 @@ const sandboxCommand = {
 	}).example("skydive sandbox --agent grace", "Live terminal (Ctrl-] detaches)").example("skydive sandbox --agent grace -- tail -n 50 /tmp/harness.log", "One-shot command (use `--` so its flags reach the sandbox)").example("skydive sandbox --agent grace -- sh -c 'ls /tmp | wc -l'", "Shell features go through an explicit `sh -c`"),
 	handler: async (argv) => {
 		const session = requireSession(argv);
-		const { createRestClient } = await import("./rest-VV5nc-Mn.mjs");
-		const { resolveAgent } = await import("./print-DACzRUwQ.mjs");
+		const { createRestClient } = await import("./rest-CaWUSrnH.mjs");
+		const { resolveAgent } = await import("./print-B9djx8GU.mjs");
 		const client = createRestClient({
 			appUrl: session.appUrl,
 			sessionToken: session.sessionToken
@@ -2870,7 +2875,7 @@ async function runPty({ session, agentId, agentName }) {
 		return 1;
 	}
 	console.error(`Connecting to ${agentName}'s sandbox… (Ctrl-] detaches)`);
-	const { runRawPtyPassthrough } = await import("./raw-pty-DmdUf4_w.mjs");
+	const { runRawPtyPassthrough } = await import("./raw-pty-g3kATVQe.mjs");
 	const result = await runRawPtyPassthrough({
 		stdin: process.stdin,
 		stdout: process.stdout,
@@ -2958,8 +2963,8 @@ const fsEditCommand = {
 	handler: async (argv) => {
 		const session = requireSession(argv);
 		const remotePath = argv.path;
-		const { createRestClient } = await import("./rest-VV5nc-Mn.mjs");
-		const { resolveAgent } = await import("./print-DACzRUwQ.mjs");
+		const { createRestClient } = await import("./rest-CaWUSrnH.mjs");
+		const { resolveAgent } = await import("./print-B9djx8GU.mjs");
 		const client = createRestClient({
 			appUrl: session.appUrl,
 			sessionToken: session.sessionToken
@@ -4336,7 +4341,7 @@ if (process.argv.includes(UPDATE_WORKER_FLAG)) {
 	process.exit(0);
 }
 if (process.argv.includes(PORTAL_DAEMON_FLAG)) {
-	const { runPortalDaemon } = await import("./daemon-SPQgtsbW.mjs");
+	const { runPortalDaemon } = await import("./daemon-Btd2436i.mjs");
 	runPortalDaemon(process.argv);
 } else runCli();
 function runCli() {

package/dist/js/{boot-iaVSnd7h.mjs → boot-yyXrIeVy.mjs}

@@ -1,15 +1,16 @@
 #!/usr/bin/env node
-import { A as takenAliasNames, C as themesForMode, D as dedupeAliasName, E as aliasActivationHint, F as getActiveWorkspaceId, L as listWorkspaces, N as detectShell, O as installAgentAlias, T as machineOsFromPlatform, _ as theme, a as installCrashHandler, b as themeModeFromColorFgBg, c as MARK_CELLS, d as splashFitsWidth, f as DEFAULT_THEME_ID, g as noColorRequested, h as monoTheme, i as writeArtifact, k as slugifyAliasName, l as WORDMARK, m as findTheme, n as profilingEnabled, o as buildCrashReport, p as applyTheme, r as record, s as writeCrashReport, v as themeForMode, x as themeVersion, y as themeMode, z as setActiveWorkspace } from "./profiler-BVbYs_Yg.mjs";
-import { B as resolveWebUrl, C as getConfigPath, O as getReviewStateDir, P as recordDefaultAgent, U as saveTheme, b as DEFAULT_APP_URL, c as cardActionErrorMessage, d as reconcileMaskedInput, f as resolveConnectUrl, h as specKeyFor, i as resolveAgent, k as getSavedTheme, l as parseExternalOauthConnectParams, m as parseConnectCard, p as computeSettledLabel, s as MASK_CHAR, u as parseOauthConnectParams, y as DEFAULT_API_URL } from "./print-C_TnQSPg.mjs";
-import { t as HttpError } from "./http-error-DzyrsLAZ.mjs";
-import { a as isRecord, i as errorMessage, n as errorDetail, r as sendErrorMessage, t as createRestClient } from "./rest-CgfbKXst.mjs";
-import { i as billingBlockedOutcomeFromSendResponse } from "./billing-blocked-2wju4gC_.mjs";
-import { t as PortalClient } from "./client-DbqRBquD.mjs";
-import "./daemon-BTyg329O.mjs";
-import "./api-DG5W6iwx.mjs";
-import { t as SandboxStream } from "./client-c4c5MmgN.mjs";
-import { t as PortalDaemonClient } from "./daemon-client--A_yMKq6.mjs";
-import { t as runRawPtyPassthrough } from "./raw-pty-DY4KelZW.mjs";
+import { A as takenAliasNames, C as themesForMode, D as dedupeAliasName, E as aliasActivationHint, F as getActiveWorkspaceId, L as listWorkspaces, N as detectShell, O as installAgentAlias, T as machineOsFromPlatform, _ as theme, a as installCrashHandler, b as themeModeFromColorFgBg, c as MARK_CELLS, d as splashFitsWidth, f as DEFAULT_THEME_ID, g as noColorRequested, h as monoTheme, i as writeArtifact, k as slugifyAliasName, l as WORDMARK, m as findTheme, n as profilingEnabled, o as buildCrashReport, p as applyTheme, r as record, s as writeCrashReport, v as themeForMode, x as themeVersion, y as themeMode, z as setActiveWorkspace } from "./profiler-CJMnC90G.mjs";
+import { B as resolveWebUrl, C as getConfigPath, O as getReviewStateDir, P as recordDefaultAgent, U as saveTheme, b as DEFAULT_APP_URL, c as cardActionErrorMessage, d as reconcileMaskedInput, f as resolveConnectUrl, h as specKeyFor, i as resolveAgent, k as getSavedTheme, l as parseExternalOauthConnectParams, m as parseConnectCard, p as computeSettledLabel, s as MASK_CHAR, u as parseOauthConnectParams, y as DEFAULT_API_URL } from "./print-Clgq46GU.mjs";
+import { t as HttpError } from "./http-error-UHH3mVBF.mjs";
+import { a as isRecord, i as errorMessage, n as errorDetail, r as sendErrorMessage, t as createRestClient } from "./rest-C6E4mS2A.mjs";
+import { i as billingBlockedOutcomeFromSendResponse } from "./billing-blocked-D3l5kJlX.mjs";
+import { t as PortalClient } from "./client-d6K9qm6B.mjs";
+import "./daemon-CxFxH36O.mjs";
+import { t as defaultTlsCertSource } from "./tls-cert-CV-pwxVN.mjs";
+import "./api-DQCaztBg.mjs";
+import { t as SandboxStream } from "./client-BTQ1fwzM.mjs";
+import { t as PortalDaemonClient } from "./daemon-client-Br1NlkRp.mjs";
+import { t as runRawPtyPassthrough } from "./raw-pty-B9Bue8gg.mjs";
 import * as os$1 from "node:os";
 import { homedir, platform, release, tmpdir } from "node:os";
 import path, { basename, extname, isAbsolute, join, win32 } from "node:path";
@@ -396,6 +397,9 @@ function createPortalClient(opts) {
 				deviceToken: null
 			}),
 			resolveCwd: () => process.cwd(),
+			tlsCertSource: defaultTlsCertSource(process.env, (msg) => {
+				console.error(msg);
+			}),
 			persistedMachineName: null,
 			onMachineName: () => {},
 			onState: (state) => opts.onState({

package/dist/js/chunk-BbwQpWto.mjs

@@ -0,0 +1,33 @@
+#!/usr/bin/env node
+import { createRequire } from "node:module";
+
+//#region \0rolldown/runtime.js
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __commonJSMin = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
+var __copyProps = (to, from, except, desc) => {
+	if (from && typeof from === "object" || typeof from === "function") {
+		for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
+			key = keys[i];
+			if (!__hasOwnProp.call(to, key) && key !== except) {
+				__defProp(to, key, {
+					get: ((k) => from[k]).bind(null, key),
+					enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+				});
+			}
+		}
+	}
+	return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
+	value: mod,
+	enumerable: true
+}) : target, mod));
+var __require = /* @__PURE__ */ createRequire(import.meta.url);
+
+//#endregion
+export { __require as n, __toESM as r, __commonJSMin as t };