skydive-cli 0.5.0-beta.48 → 0.5.0-beta.52

package/dist/js/client-CkPQG8M1.mjs

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+import { t as PortalClient } from "./client-aFwHzCPG.mjs";
+import "./api-TwLD7ibI.mjs";
+
+export { PortalClient };

package/dist/js/{client-C2lPer4b.mjs → client-aFwHzCPG.mjs}

@@ -541,10 +541,34 @@ const DEFAULT_HEARTBEAT = {
 	maxMissed: 2,
 	wakeTickMs: 2e3,
 	wakeGapThresholdMs: 1e4,
+	netWatchTickMs: 2e3,
 	initialBackoffMs: 500,
 	maxBackoffMs: 1e4
 };
 /**
+* A cheap fingerprint of the machine's network identity: every non-internal
+* interface name plus its IPv4 addresses. When it changes, the active network
+* changed (interface came/went, DHCP handed out a new address, VPN tunnel
+* up/down) and any live socket is riding a route that no longer exists.
+* IPv6 addresses are deliberately excluded: macOS rotates temporary IPv6
+* addresses on a schedule, which would fingerprint as a "change" and cause
+* spurious reconnects — the interface NAME still captures a v6-only tunnel
+* appearing or vanishing.
+*/
+function networkFingerprint() {
+	const parts = [];
+	for (const [name, addrs] of Object.entries(os.networkInterfaces())) {
+		let external = false;
+		for (const addr of addrs ?? []) {
+			if (addr.internal) continue;
+			external = true;
+			if (addr.family === "IPv4") parts.push(`${name}/${addr.address}`);
+		}
+		if (external) parts.push(name);
+	}
+	return parts.sort().join("|");
+}
+/**
 * Shares the local machine with agents over the portal: dials OUT to the api's
 * desktop-portal WebSocket (authenticating with a short-lived device token
 * minted from the CLI session), then runs inbound `exec` directives via a
@@ -568,6 +592,9 @@ var PortalClient = class {
 	legacyGrantsChecked = false;
 	wakeWatch = null;
 	lastTick = Date.now();
+	netWatch = null;
+	netFingerprint = networkFingerprint();
+	backoffKick = null;
 	handingOff = false;
 	handoffResolve = null;
 	heartbeatConfig;
@@ -578,6 +605,7 @@ var PortalClient = class {
 			...opts.heartbeat
 		};
 		this.startWakeWatch();
+		this.startNetWatch();
 	}
 	/**
 	* Detect wake-from-sleep without an Electron/`powerMonitor` dependency (the
@@ -594,13 +622,69 @@ var PortalClient = class {
 			const now = Date.now();
 			const gap = now - this.lastTick;
 			this.lastTick = now;
-			if (gap > this.heartbeatConfig.wakeGapThresholdMs && this.ws) {
-				this.error = "woke from sleep; reconnecting portal";
-				this.ws.terminate();
-			}
+			if (gap > this.heartbeatConfig.wakeGapThresholdMs) this.forceReconnect("woke from sleep; reconnecting portal");
 		}, this.heartbeatConfig.wakeTickMs);
 		this.wakeWatch.unref?.();
 	}
+	/**
+	* Detect a network switch — the awake sibling of the wake detector. Changing
+	* Wi-Fi↔ethernet, switching SSID, or toggling a VPN kills the socket's route
+	* with no FIN/RST, so `ws` may never fire 'close' and the heartbeat's
+	* missed-pong deadline is the best case (~2 intervals), not a guarantee.
+	* Poll the network-identity fingerprint and, the moment it changes, terminate
+	* the socket so `connectLoop` redials over the new network immediately.
+	* Cheap: `os.networkInterfaces()` is one syscall-backed read per tick.
+	*/
+	startNetWatch() {
+		this.netWatch = setInterval(() => {
+			const fingerprint = networkFingerprint();
+			if (fingerprint === this.netFingerprint) return;
+			this.netFingerprint = fingerprint;
+			this.forceReconnect("network changed; reconnecting portal");
+		}, this.heartbeatConfig.netWatchTickMs);
+		this.netWatch.unref?.();
+	}
+	/**
+	* The one reaction every detector (wake, network change) converges on: make
+	* the connect loop re-evaluate NOW, whatever state it is in. With a live
+	* socket, terminate it — 'close' resolves `runConnection` and the loop
+	* redials. Between dials (backing off after a failure, e.g. while the
+	* network was down), cut the sleep short so the retry fires immediately — a
+	* dial that was pointless a moment ago is exactly right the moment the
+	* network comes back. These are per-machine local events, uncorrelated
+	* across the fleet, so the immediate retry can't herd; the backoff VALUE is
+	* untouched and still governs the next failure.
+	*/
+	forceReconnect(reason) {
+		if (this.ws) {
+			this.error = reason;
+			this.ws.terminate();
+			return;
+		}
+		this.kickBackoff();
+	}
+	kickBackoff() {
+		const kick = this.backoffKick;
+		this.backoffKick = null;
+		kick?.();
+	}
+	/** The between-redials sleep, interruptible by a detector (forceReconnect). */
+	backoffSleep(ms) {
+		return new Promise((resolve) => {
+			let done = false;
+			const finish = () => {
+				if (done) return;
+				done = true;
+				this.backoffKick = null;
+				resolve();
+			};
+			const timer = setTimeout(finish, ms);
+			this.backoffKick = () => {
+				clearTimeout(timer);
+				finish();
+			};
+		});
+	}
 	isEnabled() {
 		return this.enabled;
 	}
@@ -625,6 +709,7 @@ var PortalClient = class {
 		this.ws = null;
 		this.deviceId = null;
 		this.granted = /* @__PURE__ */ new Set();
+		this.kickBackoff();
 		this.setStatus("off");
 	}
 	/**
@@ -639,10 +724,15 @@ var PortalClient = class {
 			clearInterval(this.wakeWatch);
 			this.wakeWatch = null;
 		}
+		if (this.netWatch) {
+			clearInterval(this.netWatch);
+			this.netWatch = null;
+		}
 		this.jobs?.killAll();
 		this.jobs = null;
 		this.ws?.close();
 		this.ws = null;
+		this.kickBackoff();
 		this.finishHandoff();
 	}
 	/**
@@ -758,7 +848,7 @@ var PortalClient = class {
 				backoff = Math.min(backoff * 2, this.heartbeatConfig.maxBackoffMs);
 			}
 			if (!this.enabled || this.disposed || this.handingOff) break;
-			await sleep(Math.random() * backoff);
+			await this.backoffSleep(Math.random() * backoff);
 		}
 	}
 	runConnection(token) {
@@ -785,20 +875,21 @@ var PortalClient = class {
 			this.jobs = jobs;
 			let missed = 0;
 			const heartbeat = setInterval(() => {
-				if (ws.readyState !== WebSocket.OPEN) return;
+				if (ws.readyState !== WebSocket.OPEN && ws.readyState !== WebSocket.CONNECTING) return;
 				if (missed >= this.heartbeatConfig.maxMissed) {
-					this.error = "portal connection went silent (no pong); reconnecting";
+					this.error = ws.readyState === WebSocket.CONNECTING ? "portal handshake stalled; reconnecting" : "portal connection went silent (no pong); reconnecting";
 					ws.terminate();
 					return;
 				}
 				missed += 1;
-				ws.ping();
+				if (ws.readyState === WebSocket.OPEN) ws.ping();
 			}, this.heartbeatConfig.intervalMs);
 			const markAlive = () => {
 				missed = 0;
 				healthy = true;
 			};
 			ws.on("open", () => {
+				missed = 0;
 				this.setStatus("connected");
 				this.syncDeviceState();
 			});

package/dist/js/{daemon-B57zYVAN.mjs → daemon-CORAITjj.mjs}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import "./client-C2lPer4b.mjs";
-import { a as runPortalDaemon, c as stopDaemonForHandoff, i as queryDaemonStatus, n as ensureDaemonRunning, o as startPortalDaemon, r as isDaemonListening, s as stopDaemon, t as PortalDaemon } from "./daemon-B7Wv4P6W.mjs";
+import "./client-aFwHzCPG.mjs";
+import { a as runPortalDaemon, c as stopDaemonForHandoff, i as queryDaemonStatus, n as ensureDaemonRunning, o as startPortalDaemon, r as isDaemonListening, s as stopDaemon, t as PortalDaemon } from "./daemon-uzpOdRPL.mjs";
 import "./tls-cert-CV-pwxVN.mjs";
 import "./api-TwLD7ibI.mjs";
 

package/dist/js/{daemon-client-Btr9rmKl.mjs → daemon-client-Cfi66Xy9.mjs}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { d as daemonPaths, f as encodeLine, l as LOCAL_PROTOCOL_VERSION, m as parseDaemonMessage, n as ensureDaemonRunning, p as makeLineParser } from "./daemon-B7Wv4P6W.mjs";
+import { d as daemonPaths, f as encodeLine, l as LOCAL_PROTOCOL_VERSION, m as parseDaemonMessage, n as ensureDaemonRunning, p as makeLineParser } from "./daemon-uzpOdRPL.mjs";
 import { randomUUID } from "node:crypto";
 import { connect } from "node:net";
 

package/dist/js/daemon-client-DJPW9cRp.mjs

@@ -0,0 +1,8 @@
+#!/usr/bin/env node
+import "./client-aFwHzCPG.mjs";
+import "./daemon-uzpOdRPL.mjs";
+import "./tls-cert-CV-pwxVN.mjs";
+import "./api-TwLD7ibI.mjs";
+import { t as PortalDaemonClient } from "./daemon-client-Cfi66Xy9.mjs";
+
+export { PortalDaemonClient };

package/dist/js/{daemon-B7Wv4P6W.mjs → daemon-uzpOdRPL.mjs}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { n as isRecord, t as PortalClient } from "./client-C2lPer4b.mjs";
+import { n as isRecord, t as PortalClient } from "./client-aFwHzCPG.mjs";
 import { t as defaultTlsCertSource } from "./tls-cert-CV-pwxVN.mjs";
 import os from "node:os";
 import path from "node:path";
@@ -21,7 +21,7 @@ import { access, appendFile, mkdir, readFile, unlink, writeFile } from "node:fs/
 * the commit time of the built tree is one monotonic clock they share.
 */
 function portalDaemonBuild() {
-	return "1787070117";
+	return "1787166259";
 }
 /**
 * Whether a client carrying `mine` should replace a running daemon carrying

package/dist/js/{install-BOtarTEl.mjs → install-BBplm-Zp.mjs}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { s as version$1 } from "./rest-B-dizrBw.mjs";
-import { w as getConfigPath } from "./print-SD_y9CTF.mjs";
+import { s as version$1 } from "./rest-DkuT5_oX.mjs";
+import { w as getConfigPath } from "./print-DR6Gas-M.mjs";
 import os from "node:os";
 import path from "node:path";
 import { err, ok } from "neverthrow";

package/dist/js/{print-ejS3eAZz.mjs → print-Cuao6LN6.mjs}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import "./rest-B-dizrBw.mjs";
-import { a as runPrint, i as resolveAgent, n as messageGet, o as toPrintError, r as readStdin, t as collectRunText } from "./print-SD_y9CTF.mjs";
+import "./rest-DkuT5_oX.mjs";
+import { a as runPrint, i as resolveAgent, n as messageGet, o as toPrintError, r as readStdin, t as collectRunText } from "./print-DR6Gas-M.mjs";
 import "./billing-blocked-D3l5kJlX.mjs";
 
 export { messageGet, readStdin, resolveAgent, runPrint };

package/dist/js/{print-SD_y9CTF.mjs → print-DR6Gas-M.mjs}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { a as isRecord, i as errorMessage, r as sendErrorMessage, t as createRestClient } from "./rest-B-dizrBw.mjs";
+import { a as isRecord, i as errorMessage, r as sendErrorMessage, t as createRestClient } from "./rest-DkuT5_oX.mjs";
 import { t as HttpError } from "./http-error-BF2NZZE3.mjs";
 import { i as billingBlockedOutcomeFromSendResponse, n as BillingBlockedError } from "./billing-blocked-D3l5kJlX.mjs";
 import path from "node:path";
@@ -40,7 +40,7 @@ const API_KEY_PREFIX = "sky_live_";
 */
 const API_KEY_FAMILY_PREFIX = "sky_";
 /** Where users mint and copy API keys. Shown in the login prompt. */
-const API_KEYS_URL = "skydive.com/settings/account";
+const API_KEYS_URL = "skydive.com/settings/workspace";
 const store = new Conf({
 	projectName: process.env["SKYDIVE_CONFIG_NAME"] ?? "skydive",
 	projectSuffix: "",
@@ -425,9 +425,9 @@ function parseDesktopHandoffCard(rootEl) {
 	if (!agentId) return null;
 	const agentName = optionalString(props.agentName) ?? "This agent";
 	return {
-		title: `Let ${agentName} use your computer?`,
+		title: `Let ${agentName} run commands on your machine?`,
 		subtitle: null,
-		description: `Approving shares this machine with ${agentName} while you're signed in. Revoke anytime: skydive portal revoke --agent "${agentName}"`,
+		description: `Approving opens the portal to ${agentName} while you're signed in. Revoke anytime: skydive portal revoke --agent "${agentName}"`,
 		fields: [],
 		button: {
 			label: "Approve",
@@ -785,7 +785,7 @@ function formatConnectCard(card) {
 			lines.push(`Provide credential (${card.action.fields.join(", ") || "value"}) at: ${card.action.url}`);
 			break;
 		case "approve_portal":
-			lines.push(`Approve local-machine access for agent ${card.action.agentId} in the TUI or web app.`);
+			lines.push(`Approve portal access to this machine for agent ${card.action.agentId} in the TUI or web app.`);
 			break;
 		case "decide_compute":
 			lines.push("Approve or deny this compute increase in the interactive TUI or web app.");

package/dist/js/{print-share-D20YvVbb.mjs → print-share-BypBUrNh.mjs}

@@ -14,7 +14,7 @@ import { n as printError } from "./output-C9mb3sUB.mjs";
 * the reply (and to --json).
 */
 async function connectMachineShare({ appUrl, sessionToken, timeoutHint }) {
-	const { PortalClient } = await import("./client-CSKr4Swa.mjs");
+	const { PortalClient } = await import("./client-CkPQG8M1.mjs");
 	const { defaultTlsCertSource } = await import("./tls-cert-CLgSQALB.mjs");
 	let signalConnected;
 	const connected = new Promise((resolve) => {
@@ -40,7 +40,7 @@ async function connectMachineShare({ appUrl, sessionToken, timeoutHint }) {
 	machineShare.enable();
 	if (await Promise.race([connected.then(() => false), new Promise((resolve) => setTimeout(() => resolve(true), 3e4).unref())])) {
 		machineShare.dispose();
-		printError(`Could not connect the portal within 30s. Machine sharing is unavailable (network, or the portal kill switch is off). ${timeoutHint ?? "Check `skydive portal status`."}`);
+		printError(`Could not connect the portal within 30s. The portal is unavailable (network, or the portal kill switch is off). ${timeoutHint ?? "Check `skydive portal status`."}`);
 		process.exit(1);
 	}
 	return machineShare;

package/dist/js/{rest-Cz-aN-ME.mjs → rest-CJkBP2Jz.mjs}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { n as errorDetail, r as sendErrorMessage, t as createRestClient } from "./rest-B-dizrBw.mjs";
+import { n as errorDetail, r as sendErrorMessage, t as createRestClient } from "./rest-DkuT5_oX.mjs";
 import { t as HttpError } from "./http-error-BF2NZZE3.mjs";
 import "./billing-blocked-D3l5kJlX.mjs";
 

package/dist/js/{rest-B-dizrBw.mjs → rest-DkuT5_oX.mjs}

@@ -6,7 +6,7 @@ import { createParser } from "eventsource-parser";
 
 //#region package.json
 var name = "skydive-cli";
-var version = "0.5.0-beta.48";
+var version = "0.5.0-beta.52";
 
 //#endregion
 //#region src/chat/util.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skydive-cli",
-  "version": "0.5.0-beta.48",
+  "version": "0.5.0-beta.52",
   "description": "Skydive CLI — cloud agents from the command line",
   "homepage": "https://skydive.com",
   "license": "MIT",
@@ -69,9 +69,9 @@
   },
   "//optionalDependencies": "The per-platform binary packages (skydive-cli-<os>-<arch>) are INTENTIONALLY not committed here. They are published by release-skydive-cli-binaries.yml and injected — pinned to the exact version being published — into the published launcher's optionalDependencies at release time (scripts/prepare-platform-packages.mjs --pin-version, run in release-skydive-cli.yml). Committing them would make `yarn install` try to resolve versions that only exist post-publish, breaking local dev and CI. npm installs of a published skydive-cli still get them (os/cpu-gated); the launcher (src/launcher.ts) resolves and execs the matching one. Local dev never needs them: it runs the JS bundle or `build:binary` directly.",
   "optionalDependencies": {
-    "skydive-cli-darwin-arm64": "0.5.0-beta.48",
-    "skydive-cli-darwin-x64": "0.5.0-beta.48",
-    "skydive-cli-linux-x64": "0.5.0-beta.48",
-    "skydive-cli-linux-arm64": "0.5.0-beta.48"
+    "skydive-cli-darwin-arm64": "0.5.0-beta.52",
+    "skydive-cli-darwin-x64": "0.5.0-beta.52",
+    "skydive-cli-linux-x64": "0.5.0-beta.52",
+    "skydive-cli-linux-arm64": "0.5.0-beta.52"
   }
 }

package/dist/js/client-CSKr4Swa.mjs

@@ -1,5 +0,0 @@
-#!/usr/bin/env node
-import { t as PortalClient } from "./client-C2lPer4b.mjs";
-import "./api-TwLD7ibI.mjs";
-
-export { PortalClient };

package/dist/js/daemon-client-DL3eNr6N.mjs

@@ -1,8 +0,0 @@
-#!/usr/bin/env node
-import "./client-C2lPer4b.mjs";
-import "./daemon-B7Wv4P6W.mjs";
-import "./tls-cert-CV-pwxVN.mjs";
-import "./api-TwLD7ibI.mjs";
-import { t as PortalDaemonClient } from "./daemon-client-Btr9rmKl.mjs";
-
-export { PortalDaemonClient };