skydive-cli 0.5.0-beta.5 → 0.5.0-beta.7

package/dist/js/bin.mjs

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
-import { C as ensureActiveOrganization, D as setActiveWorkspace, E as listWorkspaces, O as name, T as getSessionIdentity, a as installCrashHandler, k as version, t as maybeStartProfiling, u as brandHelpArt, w as getActiveWorkspaceId, x as themes } from "./profiler-LLaIFZgn.mjs";
-import { A as getStoredApiKeyWorkspaceName, C as getLastSeenVersion, F as resolveManagementAuth, I as resolveSession, M as resolveAppUrl, N as resolveChatAuth, O as getShareMachineDefault, P as resolveConfig, R as saveConfig, S as getConfigPath, T as getPromptHistoryPath, V as setLastSeenVersion, _ as API_KEY_PREFIX, b as PREFERENCES, g as API_KEY_FAMILY_PREFIX, h as API_KEYS_URL, i as resolveAgent, j as getUpdateCheckDisabled, k as getStoredApiKeyId, v as DEFAULT_API_URL, w as getPreference, x as deleteConfig, z as saveSession } from "./print-CbayCa87.mjs";
+import { C as ensureActiveOrganization, D as setActiveWorkspace, E as listWorkspaces, O as name, T as getSessionIdentity, a as installCrashHandler, k as version, t as maybeStartProfiling, u as brandHelpArt, w as getActiveWorkspaceId, x as themes } from "./profiler-wvJ7kT6W.mjs";
+import { A as getStoredApiKeyWorkspaceName, C as getLastSeenVersion, F as resolveManagementAuth, I as resolveSession, M as resolveAppUrl, N as resolveChatAuth, O as getShareMachineDefault, P as resolveConfig, R as saveConfig, S as getConfigPath, T as getPromptHistoryPath, V as setLastSeenVersion, _ as API_KEY_PREFIX, b as PREFERENCES, g as API_KEY_FAMILY_PREFIX, h as API_KEYS_URL, i as resolveAgent, j as getUpdateCheckDisabled, k as getStoredApiKeyId, v as DEFAULT_API_URL, w as getPreference, x as deleteConfig, z as saveSession } from "./print-BpuyEfWX.mjs";
 import { n as printError, r as printTable, t as output } from "./output-DYzzdXYV.mjs";
 import { t as HttpError } from "./http-error-DzyrsLAZ.mjs";
-import { t as createRestClient } from "./rest-BY2nADw5.mjs";
+import { t as createRestClient } from "./rest-I3imNduB.mjs";
 import "./billing-blocked-2wju4gC_.mjs";
-import { a as registerPortalDevice, c as resolveMachineIdentity, i as grantPortalAccess, n as fetchPortalDevices, o as revokePortalAccess, r as findThisDevice } from "./client-Dd5sMXPv.mjs";
-import { i as queryDaemonStatus, l as PORTAL_DAEMON_FLAG, n as ensureDaemonRunning, s as stopDaemon, u as daemonPaths } from "./daemon-BhArnzeW.mjs";
+import { a as registerPortalDevice, c as resolveMachineIdentity, i as grantPortalAccess, n as fetchPortalDevices, o as revokePortalAccess, r as findThisDevice } from "./client-CmEF9zrz.mjs";
+import { i as queryDaemonStatus, l as PORTAL_DAEMON_FLAG, n as ensureDaemonRunning, s as stopDaemon, u as daemonPaths } from "./daemon-DXuENdsx.mjs";
 import { t as SandboxStream } from "./client-Cn2af31H.mjs";
 import { hideBin } from "yargs/helpers";
 import yargs from "yargs";
@@ -1516,7 +1516,7 @@ const importCommand = {
 				process.exit(1);
 			}
 		}
-		const { runChat } = await import("./boot-Brwh0it_.mjs");
+		const { runChat } = await import("./boot-odaKymWy.mjs");
 		await runChat({
 			appUrl,
 			sessionToken: session.value.sessionToken,
@@ -1543,7 +1543,7 @@ async function runImportPrintMode({ argv, appUrl }) {
 		printError(`${session.error.message} For non-interactive use, run \`skydive auth login --web\` first, or set SKYDIVE_SESSION_TOKEN.`);
 		process.exit(1);
 	}
-	const { connectMachineShare } = await import("./print-share-uwUG16Ov.mjs");
+	const { connectMachineShare } = await import("./print-share-D9RczQx8.mjs");
 	const machineShare = await connectMachineShare({
 		appUrl,
 		sessionToken: session.value.sessionToken,
@@ -1551,7 +1551,7 @@ async function runImportPrintMode({ argv, appUrl }) {
 	});
 	const extra = (argv.print ?? "").trim();
 	const prompt = buildImportSeedPrompt(process.cwd()) + (extra ? `\n\nAdditional instructions: ${extra}` : "");
-	const { runPrint } = await import("./print-ba_0hiV9.mjs");
+	const { runPrint } = await import("./print-Wakr3GJd.mjs");
 	try {
 		const result = await runPrint({
 			appUrl,
@@ -1928,7 +1928,7 @@ const chatCommand = {
 			sessionToken: auth.value.token,
 			agentSelector: argv.agent ?? null
 		});
-		const { runChat } = await import("./boot-Brwh0it_.mjs");
+		const { runChat } = await import("./boot-odaKymWy.mjs");
 		await runChat({
 			appUrl: auth.value.appUrl,
 			sessionToken: auth.value.token,
@@ -1995,7 +1995,7 @@ async function runPrintMode({ argv, appUrl }) {
 		printError(`${auth.error.message} For non-interactive use, run \`skydive auth login\` first, or set SKYDIVE_API_KEY / SKYDIVE_SESSION_TOKEN.`);
 		process.exit(1);
 	}
-	const { runPrint, readStdin } = await import("./print-ba_0hiV9.mjs");
+	const { runPrint, readStdin } = await import("./print-Wakr3GJd.mjs");
 	await ensureAgentWorkspace({
 		appUrl,
 		sessionToken: auth.value.token,
@@ -2020,7 +2020,7 @@ async function runPrintMode({ argv, appUrl }) {
 			process.exit(1);
 		}
 	} else {
-		const { connectMachineShare } = await import("./print-share-uwUG16Ov.mjs");
+		const { connectMachineShare } = await import("./print-share-D9RczQx8.mjs");
 		machineShare = await connectMachineShare({
 			appUrl: auth.value.appUrl,
 			sessionToken: auth.value.token,
@@ -2084,7 +2084,7 @@ const getCommand$1 = {
 			printError(`${auth.error.message} Run \`skydive auth login\` first, or set SKYDIVE_API_KEY / SKYDIVE_SESSION_TOKEN.`);
 			process.exit(1);
 		}
-		const { messageGet } = await import("./print-ba_0hiV9.mjs");
+		const { messageGet } = await import("./print-Wakr3GJd.mjs");
 		try {
 			const result = await messageGet({
 				appUrl: auth.value.appUrl,
@@ -2287,7 +2287,7 @@ const switchCommand = {
 				printError("The workspace picker needs the Bun runtime and it could not be set up automatically. Pass a workspace slug instead, or install Bun and retry.");
 				process.exit(1);
 			}
-			const { runWorkspacePicker } = await import("./boot-Brwh0it_.mjs");
+			const { runWorkspacePicker } = await import("./boot-odaKymWy.mjs");
 			await runWorkspacePicker(session);
 			return;
 		}
@@ -2366,7 +2366,7 @@ const openCommand = {
 		const agent = argv.agent ? resolveAgent((await fetchPortalDevices(session)).agents, argv.agent) : null;
 		const cwd = argv.cwd ? path.resolve(argv.cwd) : process.cwd();
 		const { machineName } = await resolveMachineIdentity();
-		const { PortalDaemonClient } = await import("./daemon-client-D8bNXTxu.mjs");
+		const { PortalDaemonClient } = await import("./daemon-client-B3Yzyd46.mjs");
 		let lastLine = "";
 		let signalConnected;
 		const connected = new Promise((resolve) => {
@@ -2395,7 +2395,7 @@ const openCommand = {
 		client.enable();
 		await connected;
 		if (agent) {
-			await client.grantAgent(agent.id);
+			await client.grantAgent(agent.id, null);
 			console.log(`portal: granted ${agent.name} access to this machine (persists until revoked)`);
 		}
 		console.log(`portal: open. granted agents can run commands on ${machineName} as your user, cwd ${cwd}. ctrl+c to close.`);
@@ -2415,7 +2415,8 @@ const grantCommand = {
 		})).id;
 		await grantPortalAccess(session, {
 			deviceId,
-			agentId: agent.id
+			agentId: agent.id,
+			conversationId: null
 		});
 		if (argv.json) {
 			output(argv, {
@@ -2424,7 +2425,7 @@ const grantCommand = {
 			});
 			return;
 		}
-		console.log(`Granted ${agent.name} access to ${device?.friendlyName ?? friendlyName}. The agent can run commands here whenever its portal is open. Start with \`skydive portal open\`, or pass \`--share-machine\` on a \`chat -p\` run. Revoke with \`skydive portal revoke --agent ${agent.name}\`.`);
+		console.log(`Granted ${agent.name} access to ${device?.friendlyName ?? friendlyName}. The agent can run commands here whenever its portal is open. Start with \`skydive portal open\`, or pass \`--share-machine\` on a \`chat -p\` run. Revoke with \`skydive portal revoke --agent "${agent.name}"\`.`);
 	}
 };
 const revokeCommand = {
@@ -2640,8 +2641,8 @@ const sandboxCommand = {
 	}).example("skydive sandbox --agent grace", "Live terminal (Ctrl-] detaches)").example("skydive sandbox --agent grace -- tail -n 50 /tmp/harness.log", "One-shot command (use `--` so its flags reach the sandbox)").example("skydive sandbox --agent grace -- sh -c 'ls /tmp | wc -l'", "Shell features go through an explicit `sh -c`"),
 	handler: async (argv) => {
 		const session = requireSession(argv);
-		const { createRestClient } = await import("./rest-DADJh0bi.mjs");
-		const { resolveAgent } = await import("./print-ba_0hiV9.mjs");
+		const { createRestClient } = await import("./rest-D29qNkto.mjs");
+		const { resolveAgent } = await import("./print-Wakr3GJd.mjs");
 		const client = createRestClient({
 			appUrl: session.appUrl,
 			sessionToken: session.sessionToken
@@ -2798,8 +2799,8 @@ const fsEditCommand = {
 	handler: async (argv) => {
 		const session = requireSession(argv);
 		const remotePath = argv.path;
-		const { createRestClient } = await import("./rest-DADJh0bi.mjs");
-		const { resolveAgent } = await import("./print-ba_0hiV9.mjs");
+		const { createRestClient } = await import("./rest-D29qNkto.mjs");
+		const { resolveAgent } = await import("./print-Wakr3GJd.mjs");
 		const client = createRestClient({
 			appUrl: session.appUrl,
 			sessionToken: session.sessionToken
@@ -4169,7 +4170,7 @@ if (process.argv.includes(UPDATE_WORKER_FLAG)) {
 	process.exit(0);
 }
 if (process.argv.includes(PORTAL_DAEMON_FLAG)) {
-	const { runPortalDaemon } = await import("./daemon-CjzrUvXx.mjs");
+	const { runPortalDaemon } = await import("./daemon-DUkLMp3w.mjs");
 	runPortalDaemon(process.argv);
 } else runCli();
 function runCli() {

package/dist/js/{boot-Brwh0it_.mjs → boot-odaKymWy.mjs}

@@ -1,13 +1,13 @@
 #!/usr/bin/env node
-import { D as setActiveWorkspace, E as listWorkspaces, S as themesForMode, _ as themeForMode, a as installCrashHandler, b as themeVersion, c as MARK_CELLS, d as DEFAULT_THEME_ID, f as applyTheme, g as theme, h as noColorRequested, i as writeArtifact, l as WORDMARK, m as monoTheme, n as profilingEnabled, o as buildCrashReport, p as findTheme, r as record, s as writeCrashReport, v as themeMode, w as getActiveWorkspaceId, y as themeModeFromColorFgBg } from "./profiler-LLaIFZgn.mjs";
-import { B as saveTheme, D as getSavedTheme, E as getReviewStateDir, L as resolveWebUrl, S as getConfigPath, c as cardActionErrorMessage, d as reconcileMaskedInput, f as resolveConnectUrl, i as resolveAgent, l as parseExternalOauthConnectParams, m as specKeyFor, p as parseConnectCard, s as MASK_CHAR, u as parseOauthConnectParams, v as DEFAULT_API_URL, y as DEFAULT_APP_URL } from "./print-CbayCa87.mjs";
+import { D as setActiveWorkspace, E as listWorkspaces, S as themesForMode, _ as themeForMode, a as installCrashHandler, b as themeVersion, c as MARK_CELLS, d as DEFAULT_THEME_ID, f as applyTheme, g as theme, h as noColorRequested, i as writeArtifact, l as WORDMARK, m as monoTheme, n as profilingEnabled, o as buildCrashReport, p as findTheme, r as record, s as writeCrashReport, v as themeMode, w as getActiveWorkspaceId, y as themeModeFromColorFgBg } from "./profiler-wvJ7kT6W.mjs";
+import { B as saveTheme, D as getSavedTheme, E as getReviewStateDir, L as resolveWebUrl, S as getConfigPath, c as cardActionErrorMessage, d as reconcileMaskedInput, f as resolveConnectUrl, i as resolveAgent, l as parseExternalOauthConnectParams, m as specKeyFor, p as parseConnectCard, s as MASK_CHAR, u as parseOauthConnectParams, v as DEFAULT_API_URL, y as DEFAULT_APP_URL } from "./print-BpuyEfWX.mjs";
 import { t as HttpError } from "./http-error-DzyrsLAZ.mjs";
-import { a as isRecord, i as errorMessage, n as errorDetail, r as sendErrorMessage, t as createRestClient } from "./rest-BY2nADw5.mjs";
+import { a as isRecord, i as errorMessage, n as errorDetail, r as sendErrorMessage, t as createRestClient } from "./rest-I3imNduB.mjs";
 import { i as billingBlockedOutcomeFromSendResponse } from "./billing-blocked-2wju4gC_.mjs";
-import { t as PortalClient } from "./client-Dd5sMXPv.mjs";
-import "./daemon-BhArnzeW.mjs";
+import { t as PortalClient } from "./client-CmEF9zrz.mjs";
+import "./daemon-DXuENdsx.mjs";
 import { t as SandboxStream } from "./client-Cn2af31H.mjs";
-import { t as PortalDaemonClient } from "./daemon-client-DcuD4v12.mjs";
+import { t as PortalDaemonClient } from "./daemon-client-DM8RYJDz.mjs";
 import { t as runRawPtyPassthrough } from "./raw-pty-B6mAroiI.mjs";
 import * as os$1 from "node:os";
 import { homedir, platform, release, tmpdir } from "node:os";
@@ -228,20 +228,31 @@ const useStore = create((set, get) => ({
 * `--agent`. When both are given, the conversation wins (it pins the agent
 * anyway).
 *
+* None of these paths load the whole org agent roster. The only decision that
+* needs every candidate is disambiguating a fuzzy name/slug selector; an id
+* (or the `--resume` conversation's agentId) is exact and resolves with a
+* single `getAgent`, and `--new` with no selector only needs "exactly one
+* agent, or not", which a two-row page answers. A large org must never sit on
+* the `connecting…` splash while the roster streams in.
+*
 * Kept out of the React component so it's unit-testable under Node (the
 * component itself can't render without Bun + OpenTUI).
 */
+/** A selector that is a bare uuid is an exact agent id: it can be resolved
+* with a single `getAgent` fetch, so no boot path that carries one needs the
+* org roster. A name/slug selector is the only case that can be ambiguous and
+* therefore still needs the full candidate list to disambiguate. */
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 async function resolveInitialScreen({ rest, agentSelector, conversationId, newConversation }) {
 	if (conversationId) {
-		const [conversation, agents] = await Promise.all([rest.getConversation({ conversationId }).catch((err) => {
+		const conversation = await rest.getConversation({ conversationId }).catch((err) => {
 			if (err instanceof HttpError && err.status === 404) throw new Error(`No conversation with id ${conversationId}. It may have been deleted, or belong to another workspace.`);
 			throw err;
-		}), rest.listAgents({
-			scope: "org",
-			onPage: null
-		})]);
-		const agent = agents.find((a) => a.id === conversation.agentId);
-		if (!agent) throw new Error(`Conversation ${conversationId} belongs to an agent you can't access.`);
+		});
+		const agent = await rest.getAgent({ agentId: conversation.agentId }).catch((err) => {
+			if (err instanceof HttpError && (err.status === 404 || err.status === 403)) throw new Error(`Conversation ${conversationId} belongs to an agent you can't access.`);
+			throw err;
+		});
 		return {
 			kind: "chat",
 			agent,
@@ -263,12 +274,32 @@ async function resolveInitialScreen({ rest, agentSelector, conversationId, newCo
 		};
 	}
 	if (!agentSelector && !newConversation) return { kind: "agent-picker" };
-	const agents = await rest.listAgents({
-		scope: "org",
-		onPage: null
-	});
+	if (agentSelector && UUID_RE.test(agentSelector)) {
+		const agent = await rest.getAgent({ agentId: agentSelector }).catch((err) => {
+			if (err instanceof HttpError && (err.status === 404 || err.status === 403)) throw new Error(`No agent with id ${agentSelector}. It may not exist, or belong to another workspace.`);
+			throw err;
+		});
+		if (newConversation) return {
+			kind: "chat",
+			agent,
+			conversation: {
+				kind: "new",
+				agentId: agent.id,
+				nonce: crypto.randomUUID()
+			}
+		};
+		return {
+			kind: "conversation-picker",
+			agent
+		};
+	}
 	if (!agentSelector && newConversation) {
-		const only = agents.length === 1 ? agents[0] : null;
+		const firstTwo = await rest.listAgents({
+			scope: "org",
+			onPage: null,
+			limit: 2
+		});
+		const only = firstTwo.length === 1 ? firstTwo[0] : null;
 		if (!only) return { kind: "agent-picker" };
 		return {
 			kind: "chat",
@@ -280,7 +311,10 @@ async function resolveInitialScreen({ rest, agentSelector, conversationId, newCo
 			}
 		};
 	}
-	const agent = resolveAgent(agents, agentSelector);
+	const agent = resolveAgent(await rest.listAgents({
+		scope: "org",
+		onPage: null
+	}), agentSelector);
 	if (newConversation) return {
 		kind: "chat",
 		agent,
@@ -337,7 +371,7 @@ function createPortalClient(opts) {
 			start: () => Promise.resolve(),
 			enable: () => client.enable(),
 			disable: () => client.disable(),
-			grantAgent: (agentId) => client.grantAgent(agentId),
+			grantAgent: (agentId, conversationId) => client.grantAgent(agentId, conversationId),
 			decline: (_agentId, declined) => {
 				if (declined && client.grantedAgentIds().length === 0) client.disable();
 			},
@@ -10163,6 +10197,7 @@ function ChatScreen({ agent, conversation }) {
 	const portalClient = useStore((s) => s.portalClient);
 	const setPortalPrompt = useStore((s) => s.setPortalPrompt);
 	const declinedRef = useRef(/* @__PURE__ */ new Set());
+	const grantInFlightRef = useRef(/* @__PURE__ */ new Set());
 	const grantPrompt = portal.prompt && portal.prompt.agentId === agent.id ? portal.prompt : null;
 	const isShared = portal.status !== "off";
 	const initialConversationId = isNewConversation(conversation) ? null : conversation.id;
@@ -10615,12 +10650,14 @@ function ChatScreen({ agent, conversation }) {
 		});
 		(async () => {
 			if (autoGrantMachine && portalClient && portalStatus === "connected" && !portalClient.isGranted(agent.id)) try {
-				await portalClient.grantAgent(agent.id);
+				grantInFlightRef.current.add(agent.id);
+				await portalClient.grantAgent(agent.id, null);
 				useStore.getState().showToast({
-					message: `Shared this machine with ${agent.name} for the import. The grant persists. Revoke anytime: skydive portal revoke --agent ${agent.name}`,
+					message: `Shared this machine with ${agent.name} for the import. The grant persists. Revoke anytime: skydive portal revoke --agent "${agent.name}"`,
 					durationMs: 1e4
 				});
 			} catch (err) {
+				grantInFlightRef.current.delete(agent.id);
 				useStore.getState().showToast({
 					message: `Couldn't grant machine access automatically (${errorMessage(err)}). The agent will ask in chat instead.`,
 					variant: "warning"
@@ -10684,9 +10721,12 @@ function ChatScreen({ agent, conversation }) {
 				if (!portalClient) throw new Error("portal is unavailable in this session");
 				const justEnabled = portal.status === "off";
 				if (justEnabled) portalClient.enable();
+				grantInFlightRef.current.add(action.agentId);
+				if (useStore.getState().portal.prompt?.agentId === action.agentId) setPortalPrompt(null);
 				try {
-					await portalClient.grantAgent(action.agentId);
+					await portalClient.grantAgent(action.agentId, action.conversationId);
 				} catch (grantErr) {
+					grantInFlightRef.current.delete(action.agentId);
 					if (justEnabled) portalClient.disable();
 					throw grantErr;
 				}
@@ -10747,7 +10787,8 @@ function ChatScreen({ agent, conversation }) {
 		appUrl,
 		updateCard,
 		portalClient,
-		portal.status
+		portal.status,
+		setPortalPrompt
 	]);
 	const promptForCards = useCallback(() => {
 		const targets = itemsRef.current.filter(isActionableCard);
@@ -11290,19 +11331,24 @@ function ChatScreen({ agent, conversation }) {
 		if (!portalClient) return;
 		const agentName = agent.name;
 		setPortalPrompt(null);
-		portalClient.grantAgent(agent.id).then(() => useStore.getState().showToast({
+		grantInFlightRef.current.add(agent.id);
+		portalClient.grantAgent(agent.id, conversationId).then(() => useStore.getState().showToast({
 			variant: "success",
 			message: `shared this machine with ${agentName}`
-		})).catch((err) => setItems((prev) => [...prev, {
-			kind: "error",
-			id: crypto.randomUUID(),
-			text: `couldn't share machine: ${errorDetail(err)}`
-		}]));
+		})).catch((err) => {
+			grantInFlightRef.current.delete(agent.id);
+			setItems((prev) => [...prev, {
+				kind: "error",
+				id: crypto.randomUUID(),
+				text: `couldn't share machine: ${errorDetail(err)}`
+			}]);
+		});
 	}, [
 		portalClient,
 		agent.id,
 		agent.name,
-		setPortalPrompt
+		setPortalPrompt,
+		conversationId
 	]);
 	const declineGrant = useCallback(() => {
 		declinedRef.current.add(agent.id);
@@ -11542,6 +11588,7 @@ function ChatScreen({ agent, conversation }) {
 		if (portal.grantedAgentIds.includes(agent.id)) return;
 		if (portal.declinedAgentIds.includes(agent.id)) return;
 		if (declinedRef.current.has(agent.id)) return;
+		if (grantInFlightRef.current.has(agent.id)) return;
 		if (portal.prompt?.agentId === agent.id) return;
 		setPortalPrompt({
 			agentId: agent.id,
@@ -11565,6 +11612,14 @@ function ChatScreen({ agent, conversation }) {
 		setPortalPrompt,
 		agentHost
 	]);
+	useEffect(() => {
+		for (const agentId of portal.grantedAgentIds) grantInFlightRef.current.delete(agentId);
+		if (portal.prompt && portal.grantedAgentIds.includes(portal.prompt.agentId)) setPortalPrompt(null);
+	}, [
+		portal.grantedAgentIds,
+		portal.prompt,
+		setPortalPrompt
+	]);
 	useKeyboard((key) => {
 		if (reviewOpen) {
 			if (key.name === "g" && key.ctrl) {

package/dist/js/client-CGwes_WT.mjs

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+import { t as PortalClient } from "./client-CmEF9zrz.mjs";
+
+export { PortalClient };

package/dist/js/{client-Dd5sMXPv.mjs → client-CmEF9zrz.mjs}

@@ -361,10 +361,13 @@ async function mintPortalDeviceToken(auth) {
 	const json = await portalFetch(auth, "/api/v1/portal/device-token", { method: "POST" });
 	return deviceTokenSchema.parse(json).token;
 }
-async function grantPortalAccess(auth, { deviceId, agentId }) {
+async function grantPortalAccess(auth, { deviceId, agentId, conversationId }) {
 	await portalFetch(auth, `/api/v1/portal/devices/${encodeURIComponent(deviceId)}/grants`, {
 		method: "POST",
-		body: JSON.stringify({ agentId })
+		body: JSON.stringify({
+			agentId,
+			conversationId
+		})
 	});
 }
 async function revokePortalAccess(auth, { deviceId, agentId }) {
@@ -396,7 +399,8 @@ async function unifyLegacyCliGrants(auth, machineName) {
 	const missing = legacy.grantedAgentIds.filter((id) => !have.has(id));
 	for (const agentId of missing) await grantPortalAccess(auth, {
 		deviceId: merged.id,
-		agentId
+		agentId,
+		conversationId: null
 	});
 	return missing.length;
 }
@@ -469,13 +473,19 @@ var PortalClient = class {
 		this.ws?.close();
 		this.ws = null;
 	}
-	/** Grant one agent access to this machine (default-deny; user-initiated). */
-	async grantAgent(agentId) {
+	/**
+	* Grant one agent access to this machine (default-deny; user-initiated).
+	* `conversationId` is the conversation whose run asked (null when the grant
+	* is not answering an in-chat request) — the server uses it to wake the
+	* waiting agent.
+	*/
+	async grantAgent(agentId, conversationId) {
 		const auth = this.sessionAuth();
 		if (!auth) throw new Error("granting needs a signed-in CLI session on this machine (the desktop connection alone cannot manage grants)");
 		await grantPortalAccess(auth, {
 			deviceId: await this.ensureDeviceId(),
-			agentId
+			agentId,
+			conversationId
 		});
 		this.granted.add(agentId);
 		this.emit();

package/dist/js/{daemon-CjzrUvXx.mjs → daemon-DUkLMp3w.mjs}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import "./client-Dd5sMXPv.mjs";
-import { a as runPortalDaemon, i as queryDaemonStatus, n as ensureDaemonRunning, o as startPortalDaemon, r as isDaemonListening, s as stopDaemon, t as PortalDaemon } from "./daemon-BhArnzeW.mjs";
+import "./client-CmEF9zrz.mjs";
+import { a as runPortalDaemon, i as queryDaemonStatus, n as ensureDaemonRunning, o as startPortalDaemon, r as isDaemonListening, s as stopDaemon, t as PortalDaemon } from "./daemon-DXuENdsx.mjs";
 
 export { runPortalDaemon };

package/dist/js/{daemon-BhArnzeW.mjs → daemon-DXuENdsx.mjs}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { s as isRecord, t as PortalClient } from "./client-Dd5sMXPv.mjs";
+import { s as isRecord, t as PortalClient } from "./client-CmEF9zrz.mjs";
 import os from "node:os";
 import path from "node:path";
 import { z } from "zod";
@@ -20,7 +20,7 @@ import { access, appendFile, mkdir, readFile, unlink, writeFile } from "node:fs/
 * the commit time of the built tree is one monotonic clock they share.
 */
 function portalDaemonBuild() {
-	return "1786586981";
+	return "1786590033";
 }
 /**
 * Whether a client carrying `mine` should replace a running daemon carrying
@@ -175,10 +175,18 @@ const clientCwdSchema = z.object({
 	t: z.literal("cwd"),
 	cwd: z.string().min(1)
 });
-/** `grant` — authorize one agent to reach this machine (user-initiated). */
+/**
+* `grant` — authorize one agent to reach this machine (user-initiated).
+* `conversationId` names the conversation whose run asked for access (the
+* in-chat approval card); the grant carries it upstream so the server wakes
+* the waiting agent. Defaults to null on parse so hellos from CLI builds that
+* predate the field keep granting against a newer daemon — they just skip the
+* wake, same as before the field existed.
+*/
 const clientGrantSchema = z.object({
 	t: z.literal("grant"),
-	agentId: z.string().min(1)
+	agentId: z.string().min(1),
+	conversationId: z.string().nullish().default(null)
 });
 /**
 * `decline` — the user answered no to an agent's request for this machine
@@ -455,7 +463,7 @@ var PortalDaemon = class {
 			case "grant":
 				this.declined.delete(msg.agentId);
 				this.ensureClient();
-				this.client?.grantAgent(msg.agentId).catch((error) => {
+				this.client?.grantAgent(msg.agentId, msg.conversationId).catch((error) => {
 					this.logError("grantAgent failed", error);
 				});
 				return;

package/dist/js/daemon-client-B3Yzyd46.mjs

@@ -0,0 +1,6 @@
+#!/usr/bin/env node
+import "./client-CmEF9zrz.mjs";
+import "./daemon-DXuENdsx.mjs";
+import { t as PortalDaemonClient } from "./daemon-client-DM8RYJDz.mjs";
+
+export { PortalDaemonClient };

package/dist/js/{daemon-client-DcuD4v12.mjs → daemon-client-DM8RYJDz.mjs}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { c as LOCAL_PROTOCOL_VERSION, d as encodeLine, f as makeLineParser, n as ensureDaemonRunning, p as parseDaemonMessage, u as daemonPaths } from "./daemon-BhArnzeW.mjs";
+import { c as LOCAL_PROTOCOL_VERSION, d as encodeLine, f as makeLineParser, n as ensureDaemonRunning, p as parseDaemonMessage, u as daemonPaths } from "./daemon-DXuENdsx.mjs";
 import { randomUUID } from "node:crypto";
 import { connect } from "node:net";
 
@@ -12,7 +12,7 @@ var PortalDaemonClient = class {
 	lastBind = null;
 	fallbackCwd = null;
 	wantEnabled = false;
-	pendingGrants = /* @__PURE__ */ new Set();
+	pendingGrants = /* @__PURE__ */ new Map();
 	pendingDeclines = /* @__PURE__ */ new Map();
 	grantedAgentIds = /* @__PURE__ */ new Set();
 	constructor(opts) {
@@ -50,9 +50,10 @@ var PortalDaemonClient = class {
 				conversationId: this.lastBind.conversationId,
 				cwd: this.lastBind.cwd
 			});
-			for (const agentId of this.pendingGrants) this.send({
+			for (const [agentId, conversationId] of this.pendingGrants) this.send({
 				t: "grant",
-				agentId
+				agentId,
+				conversationId
 			});
 			for (const [agentId, declined] of this.pendingDeclines) this.send({
 				t: "decline",
@@ -157,13 +158,16 @@ var PortalDaemonClient = class {
 	* Authorize one agent to run commands on this machine. Resolves once the
 	* request is sent to the daemon (the daemon performs the grant and pushes the
 	* updated state); kept async so it's a drop-in for the old in-process client's
-	* awaited `grantAgent`.
+	* awaited `grantAgent`. `conversationId` names the conversation whose run
+	* asked, so the grant can wake the waiting agent; null when the grant is not
+	* answering an in-chat request.
 	*/
-	grantAgent(agentId) {
-		this.pendingGrants.add(agentId);
+	grantAgent(agentId, conversationId) {
+		this.pendingGrants.set(agentId, conversationId);
 		this.send({
 			t: "grant",
-			agentId
+			agentId,
+			conversationId
 		});
 		return Promise.resolve();
 	}

package/dist/js/{print-CbayCa87.mjs → print-BpuyEfWX.mjs}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { t as HttpError } from "./http-error-DzyrsLAZ.mjs";
-import { a as isRecord, i as errorMessage, r as sendErrorMessage, t as createRestClient } from "./rest-BY2nADw5.mjs";
+import { a as isRecord, i as errorMessage, r as sendErrorMessage, t as createRestClient } from "./rest-I3imNduB.mjs";
 import { i as billingBlockedOutcomeFromSendResponse, n as BillingBlockedError } from "./billing-blocked-2wju4gC_.mjs";
 import path from "node:path";
 import Conf from "conf";
@@ -9,7 +9,7 @@ import stableStringify from "safe-stable-stringify";
 
 //#region src/config.ts
 /** Default host for the public management API (`/v1`, API-key auth). */
-const DEFAULT_API_URL = "https://api.skydive.com";
+const DEFAULT_API_URL = typeof SKYDIVE_BUILD_API_URL === "string" ? SKYDIVE_BUILD_API_URL : "https://api.skydive.com";
 /**
 * Default origin for the interactive chat client (`skydive chat`).
 *
@@ -20,9 +20,9 @@ const DEFAULT_API_URL = "https://api.skydive.com";
 * `DEFAULT_API_URL`; override with `--api-url` / `SKYDIVE_APP_URL` for local
 * dev or while the DNS record is still being provisioned.
 */
-const DEFAULT_APP_URL = "https://api.skydive.com";
+const DEFAULT_APP_URL = DEFAULT_API_URL;
 /** Web front door, for pages opened in the user's browser. */
-const DEFAULT_WEB_URL = "https://skydive.com";
+const DEFAULT_WEB_URL = typeof SKYDIVE_BUILD_WEB_URL === "string" ? SKYDIVE_BUILD_WEB_URL : "https://skydive.com";
 function resolveWebUrl(appUrl) {
 	if (appUrl == null) return appUrl;
 	return appUrl === DEFAULT_APP_URL ? DEFAULT_WEB_URL : appUrl;
@@ -282,14 +282,15 @@ function parseButton(element) {
 	const params = isRecord(press.params) ? press.params : {};
 	const primary = props.variant === "primary";
 	if (press.action === "approve_portal_access") {
-		const agentId = params.agentId;
-		if (typeof agentId !== "string" || !agentId) return null;
+		const agentId = optionalString(params.agentId);
+		if (!agentId) return null;
 		return {
 			label,
 			action: {
 				kind: "grant_portal",
 				agentId,
-				deviceId: typeof params.deviceId === "string" && params.deviceId ? params.deviceId : null
+				deviceId: optionalString(params.deviceId),
+				conversationId: optionalString(params.conversationId)
 			},
 			primary
 		};
@@ -323,12 +324,46 @@ function parseButton(element) {
 function specKeyFor(spec) {
 	return stableStringify(spec) ?? crypto.randomUUID();
 }
+/**
+* The `platform portal request` consent card. The server emits one
+* DesktopHandoffCard spec for every surface (api routes/portal.ts): the web
+* renders it as the "continue in the Skydive desktop app" handoff, but this
+* terminal's own portal daemon can provide the machine, so here it maps onto
+* the existing grant_portal approval instead of a pointer to the app. Without
+* this the spec is not a Card, parses to null, and the request is silently
+* dropped — `platform portal request` looks desktop-only from the CLI
+* (ANY-6521).
+*/
+function parseDesktopHandoffCard(rootEl) {
+	const props = isRecord(rootEl.props) ? rootEl.props : {};
+	const agentId = optionalString(props.agentId);
+	if (!agentId) return null;
+	const agentName = optionalString(props.agentName) ?? "This agent";
+	return {
+		title: `Let ${agentName} use your computer?`,
+		subtitle: null,
+		description: `Approving shares this machine with ${agentName} while you're signed in. Revoke anytime: skydive portal revoke --agent "${agentName}"`,
+		fields: [],
+		button: {
+			label: "Approve",
+			action: {
+				kind: "grant_portal",
+				agentId,
+				deviceId: optionalString(props.deviceId),
+				conversationId: optionalString(props.conversationId)
+			}
+		},
+		state: {}
+	};
+}
 function parseConnectCard(spec) {
 	if (!isRecord(spec)) return null;
 	const { root, elements } = spec;
 	if (typeof root !== "string" || !isRecord(elements)) return null;
 	const rootEl = elements[root];
-	if (!isRecord(rootEl) || rootEl.type !== "Card") return null;
+	if (!isRecord(rootEl)) return null;
+	if (rootEl.type === "DesktopHandoffCard") return parseDesktopHandoffCard(rootEl);
+	if (rootEl.type !== "Card") return null;
 	const rootProps = isRecord(rootEl.props) ? rootEl.props : {};
 	const title = optionalString(rootProps.title);
 	if (!title) return null;
@@ -572,7 +607,7 @@ async function runPrint({ appUrl, sessionToken, prompt, agentSelector, conversat
 		onPage: null
 	}), agentSelector);
 	if (machineShare) {
-		if (!machineShare.isGranted(agent.id) && grantTargetAgent) await machineShare.grantAgent(agent.id);
+		if (!machineShare.isGranted(agent.id) && grantTargetAgent) await machineShare.grantAgent(agent.id, null);
 		if (machineShare.isGranted(agent.id)) console.error(`portal: shared this machine with ${agent.name} for this run (grant persists until revoked)`);
 		else console.error(`portal: this machine is shared (shareMachineDefault), but ${agent.name} has no grant. Approve its request, or run \`skydive portal grant --agent ${agent.name}\`.`);
 	}

package/dist/js/{print-ba_0hiV9.mjs → print-Wakr3GJd.mjs}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { a as runPrint, i as resolveAgent, n as messageGet, o as toPrintError, r as readStdin, t as collectRunText } from "./print-CbayCa87.mjs";
-import "./rest-BY2nADw5.mjs";
+import { a as runPrint, i as resolveAgent, n as messageGet, o as toPrintError, r as readStdin, t as collectRunText } from "./print-BpuyEfWX.mjs";
+import "./rest-I3imNduB.mjs";
 import "./billing-blocked-2wju4gC_.mjs";
 
 export { messageGet, readStdin, resolveAgent, runPrint };

package/dist/js/{print-share-uwUG16Ov.mjs → print-share-D9RczQx8.mjs}

@@ -14,7 +14,7 @@ import { n as printError } from "./output-DYzzdXYV.mjs";
 * the reply (and to --json).
 */
 async function connectMachineShare({ appUrl, sessionToken, timeoutHint }) {
-	const { PortalClient } = await import("./client-DZstLQ_1.mjs");
+	const { PortalClient } = await import("./client-CGwes_WT.mjs");
 	let signalConnected;
 	const connected = new Promise((resolve) => {
 		signalConnected = resolve;

package/dist/js/{profiler-LLaIFZgn.mjs → profiler-wvJ7kT6W.mjs}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { S as getConfigPath } from "./print-CbayCa87.mjs";
+import { S as getConfigPath } from "./print-BpuyEfWX.mjs";
 import os from "node:os";
 import path from "node:path";
 import { err, ok } from "neverthrow";
@@ -8,7 +8,7 @@ import fs from "node:fs";
 
 //#region package.json
 var name = "skydive-cli";
-var version$1 = "0.5.0-beta.5";
+var version$1 = "0.5.0-beta.7";
 
 //#endregion
 //#region src/auth/organization.ts

package/dist/js/{rest-DADJh0bi.mjs → rest-D29qNkto.mjs}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { t as HttpError } from "./http-error-DzyrsLAZ.mjs";
-import { n as errorDetail, r as sendErrorMessage, t as createRestClient } from "./rest-BY2nADw5.mjs";
+import { n as errorDetail, r as sendErrorMessage, t as createRestClient } from "./rest-I3imNduB.mjs";
 import "./billing-blocked-2wju4gC_.mjs";
 
 export { createRestClient };

package/dist/js/{rest-BY2nADw5.mjs → rest-I3imNduB.mjs}

@@ -193,13 +193,14 @@ function createRestClient({ appUrl, sessionToken, workspaceId }) {
 		}
 	};
 	return {
-		listAgents: async ({ scope, onPage }) => {
+		listAgents: async ({ scope, onPage, limit }) => {
 			const all = [];
 			let cursor;
-			const maxAgents = 2e3;
+			const maxAgents = limit ?? 2e3;
+			const pageSize = Math.min(100, maxAgents);
 			do {
 				const params = new URLSearchParams({
-					limit: "100",
+					limit: String(pageSize),
 					scope,
 					sort: "mine_first_usage",
 					includeStats: "false"
@@ -218,10 +219,7 @@ function createRestClient({ appUrl, sessionToken, workspaceId }) {
 		},
 		getAgent: async ({ agentId }) => {
 			const { agent } = await get(`/api/v1/agents/${encodeURIComponent(agentId)}`, getAgentResponseSchema);
-			return {
-				id: agent.id,
-				name: agent.name
-			};
+			return agent;
 		},
 		suggestAgentIdentity: async () => {
 			const { suggestion } = await get("/api/v1/agents/suggest", suggestAgentResponseSchema);
@@ -453,10 +451,7 @@ const listAgentsResponseSchema = z.object({
 	totalCount: z.number().nullable().optional()
 });
 const createAgentResponseSchema = z.object({ agent: agentSummarySchema });
-const getAgentResponseSchema = z.object({ agent: z.object({
-	id: z.string(),
-	name: z.string()
-}).passthrough() });
+const getAgentResponseSchema = z.object({ agent: agentSummarySchema });
 const agentSuggestionSchema = z.object({ name: z.string() });
 const suggestAgentResponseSchema = z.object({ suggestion: agentSuggestionSchema.nullable() });
 const conversationAgentSchema = z.object({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skydive-cli",
-  "version": "0.5.0-beta.5",
+  "version": "0.5.0-beta.7",
   "description": "Skydive CLI — cloud agents from the command line",
   "homepage": "https://skydive.com",
   "license": "MIT",

package/dist/js/client-DZstLQ_1.mjs

@@ -1,4 +0,0 @@
-#!/usr/bin/env node
-import { t as PortalClient } from "./client-Dd5sMXPv.mjs";
-
-export { PortalClient };

package/dist/js/daemon-client-D8bNXTxu.mjs

@@ -1,6 +0,0 @@
-#!/usr/bin/env node
-import "./client-Dd5sMXPv.mjs";
-import "./daemon-BhArnzeW.mjs";
-import { t as PortalDaemonClient } from "./daemon-client-DcuD4v12.mjs";
-
-export { PortalDaemonClient };