skydive-cli 0.5.0-beta.8 → 0.5.0

package/dist/js/{rest-I3imNduB.mjs → rest-B9__Zsuk.mjs}

@@ -1,9 +1,14 @@
 #!/usr/bin/env node
-import { t as HttpError } from "./http-error-DzyrsLAZ.mjs";
-import { a as billingBlockedOutcomeSchema } from "./billing-blocked-2wju4gC_.mjs";
+import { t as HttpError } from "./http-error-BF2NZZE3.mjs";
+import { a as billingBlockedOutcomeSchema } from "./billing-blocked-D3l5kJlX.mjs";
 import { z } from "zod";
 import { createParser } from "eventsource-parser";
 
+//#region package.json
+var name = "skydive-cli";
+var version = "0.5.0";
+
+//#endregion
 //#region src/chat/util.ts
 /** Narrowing helper for the many `unknown` payloads the chat stream and
 * tool inputs/outputs carry. A type predicate (not an `as` cast), so call
@@ -18,8 +23,24 @@ function errorMessage(err) {
 
 //#endregion
 //#region src/chat/api/rest.ts
+const CLI_VERSION_HEADER = "x-skydive-cli-version";
 const ERROR_DETAIL_MAX_BODY = 2e3;
 /**
+* Pull the filename out of a `Content-Disposition` header. Handles the
+* RFC 5987 `filename*=UTF-8''...` form (percent-decoded) and the plain
+* quoted/bare `filename=` form, preferring the extended form when both are
+* present (the API emits both for non-ASCII names). Returns '' when the header
+* is absent or carries no filename, so callers fall back to a cached name.
+*/
+function filenameFromContentDisposition(header) {
+	if (!header) return "";
+	const extended = /filename\*=(?:UTF-8'')?([^;]+)/i.exec(header);
+	if (extended?.[1]) try {
+		return decodeURIComponent(extended[1].trim().replace(/^"|"$/g, ""));
+	} catch (_error) {}
+	return /filename="?([^";]+)"?/i.exec(header)?.[1]?.trim() ?? "";
+}
+/**
 * Fullest renderable text for a thrown value. `HttpError.message` clips the
 * response body to 200 chars (it flows into logs and one-line UIs); the
 * transcript renders errors collapsed to a single line, so it can afford the
@@ -104,7 +125,8 @@ const MAX_STREAM_RECONNECTS = 5;
 function createRestClient({ appUrl, sessionToken, workspaceId }) {
 	const baseHeaders = {
 		authorization: `Bearer ${sessionToken}`,
-		accept: "application/json"
+		accept: "application/json",
+		[CLI_VERSION_HEADER]: version
 	};
 	if (workspaceId) baseHeaders["x-workspace-id"] = workspaceId;
 	async function get(path, schema) {
@@ -124,6 +146,13 @@ function createRestClient({ appUrl, sessionToken, workspaceId }) {
 		if (!res.ok) throw new HttpError(res.status, await res.text().catch(() => ""));
 		return schema.parse(await res.json());
 	}
+	/**
+	* The agent PATCH is a merge: only the keys present are written, so each
+	* caller sends exactly the settings it means to change.
+	*/
+	function patchAgent(agentId, body) {
+		return post(`/api/v1/agents/${encodeURIComponent(agentId)}`, body, updateAgentResponseSchema, "PATCH");
+	}
 	async function del(path) {
 		const res = await fetch(`${appUrl}${path}`, {
 			method: "DELETE",
@@ -140,7 +169,8 @@ function createRestClient({ appUrl, sessionToken, workspaceId }) {
 			try {
 				const headers = {
 					authorization: `Bearer ${sessionToken}`,
-					accept: "text/event-stream"
+					accept: "text/event-stream",
+					[CLI_VERSION_HEADER]: version
 				};
 				if (workspaceId) headers["x-workspace-id"] = workspaceId;
 				if (lastEventId) headers["last-event-id"] = lastEventId;
@@ -214,9 +244,19 @@ function createRestClient({ appUrl, sessionToken, workspaceId }) {
 			return all;
 		},
 		createAgent: async ({ name }) => {
-			const { agent } = await post("/api/v1/agents", { name }, createAgentResponseSchema);
+			const { agent } = await post("/api/v1/agents", name == null ? {} : { name }, createAgentResponseSchema);
 			return agent;
 		},
+		createOnboardingConversation: async ({ agentId, projectDir, os }) => {
+			const result = await post(`/api/v1/agents/${encodeURIComponent(agentId)}/onboarding-conversation`, {
+				projectDir,
+				os
+			}, onboardingConversationResponseSchema);
+			return {
+				conversationId: result.conversationId,
+				runId: result.runId
+			};
+		},
 		getAgent: async ({ agentId }) => {
 			const { agent } = await get(`/api/v1/agents/${encodeURIComponent(agentId)}`, getAgentResponseSchema);
 			return agent;
@@ -233,9 +273,31 @@ function createRestClient({ appUrl, sessionToken, workspaceId }) {
 			const { models } = await get("/api/v1/models", listModelsResponseSchema);
 			return models;
 		},
-		updateAgentModel: async ({ agentId, model }) => {
-			const { agent } = await post(`/api/v1/agents/${encodeURIComponent(agentId)}`, { model }, updateAgentResponseSchema, "PATCH");
-			return { model: agent.model ?? null };
+		listModelEfforts: async () => {
+			const { modelConfigOverrides } = await get("/api/v1/models/preferred", modelEffortPreferencesResponseSchema);
+			const efforts = {};
+			for (const [modelId, config] of Object.entries(modelConfigOverrides ?? {})) if (config.thinkingLevel) efforts[modelId] = config.thinkingLevel;
+			return efforts;
+		},
+		setModelEffort: async ({ modelId, thinkingLevel }) => {
+			await post("/api/v1/models/config", {
+				modelId,
+				config: { thinkingLevel }
+			}, z.unknown(), "PATCH");
+		},
+		updateAgentModel: async ({ agentId, model, thinkingLevel }) => {
+			const { agent } = await patchAgent(agentId, {
+				model,
+				thinkingLevel
+			});
+			return {
+				model: agent.model ?? null,
+				thinkingLevel: agent.thinkingLevel ?? null
+			};
+		},
+		updateAgentEffort: async ({ agentId, thinkingLevel }) => {
+			const { agent } = await patchAgent(agentId, { thinkingLevel });
+			return { thinkingLevel: agent.thinkingLevel ?? null };
 		},
 		listConversations: async ({ agentId, limit, channels, archived, query, onPage }) => {
 			const trimmedQuery = query?.trim();
@@ -260,9 +322,17 @@ function createRestClient({ appUrl, sessionToken, workspaceId }) {
 			} while (cursor && all.length < maxConversations);
 			return limit ? all.slice(0, limit) : all;
 		},
-		listMessages: async ({ conversationId }) => {
-			const { messages } = await get(`/api/v1/conversations/${encodeURIComponent(conversationId)}/messages`, listMessagesResponseSchema);
-			return messages;
+		listMessages: async ({ conversationId, limit, before }) => {
+			const params = new URLSearchParams();
+			if (limit !== void 0) params.set("limit", String(limit));
+			if (before !== void 0) params.set("before", before);
+			const query = params.toString();
+			const { messages, hasMore, nextBefore } = await get(`/api/v1/conversations/${encodeURIComponent(conversationId)}/messages${query ? `?${query}` : ""}`, listMessagesResponseSchema);
+			return {
+				messages,
+				hasMore: hasMore ?? false,
+				nextBefore: nextBefore ?? null
+			};
 		},
 		listWorkspaceFiles: async ({ agentId }) => {
 			const { files } = await get(`/api/v1/workspace-files?${new URLSearchParams({ agentId }).toString()}`, listWorkspaceFilesResponseSchema);
@@ -289,6 +359,13 @@ function createRestClient({ appUrl, sessionToken, workspaceId }) {
 			const { result } = await get(`/api/v1/trpc/v2.subagentTasks.list?input=${encodeURIComponent(JSON.stringify({ conversationId }))}`, subagentTasksResponseSchema);
 			return new Map(result.data.subagentTasks.map((task) => [task.id, task]));
 		},
+		computeLiveStats: async (agentId) => {
+			const { stats } = await get(`/api/v1/compute/live-stats?agentId=${encodeURIComponent(agentId)}`, liveStatsResponseSchema);
+			return stats;
+		},
+		restartAgent: async (agentId) => {
+			await post(`/api/v1/agents/${encodeURIComponent(agentId)}/restart`, {}, z.object({ ok: z.boolean() }));
+		},
 		uploadAttachment: async ({ agentId, fileName, mediaType, data }) => {
 			const size = data.byteLength;
 			const presign = await post("/api/v1/attachments/presign", {
@@ -316,6 +393,17 @@ function createRestClient({ appUrl, sessionToken, workspaceId }) {
 				sizeBytes: finalized.sizeBytes ?? size
 			};
 		},
+		downloadAttachment: async ({ attachmentId }) => {
+			const res = await fetch(`${appUrl}/api/v1/attachments/${encodeURIComponent(attachmentId)}/download?disposition=inline`, { headers: baseHeaders });
+			if (!res.ok) throw new HttpError(res.status, await res.text().catch(() => ""));
+			const data = new Uint8Array(await res.arrayBuffer());
+			const mediaType = res.headers.get("content-type") ?? "application/octet-stream";
+			return {
+				data,
+				fileName: filenameFromContentDisposition(res.headers.get("content-disposition")),
+				mediaType
+			};
+		},
 		forkConversation: async ({ conversationId }) => {
 			const { conversation } = await post(`/api/v1/conversations/${encodeURIComponent(conversationId)}/fork`, {}, forkConversationResponseSchema);
 			return conversation;
@@ -329,6 +417,9 @@ function createRestClient({ appUrl, sessionToken, workspaceId }) {
 		setConversationArchived: async ({ conversationId, archived }) => {
 			await post(`/api/v1/conversations/${encodeURIComponent(conversationId)}/archive`, { archived }, z.object({ archived: z.boolean() }));
 		},
+		markConversationRead: async ({ conversationId }) => {
+			await post(`/api/v1/conversations/${encodeURIComponent(conversationId)}/read`, {}, z.object({ read: z.boolean() }));
+		},
 		renameConversation: async ({ conversationId, title }) => {
 			await post(`/api/v1/conversations/${encodeURIComponent(conversationId)}`, { title }, z.object({ conversation: z.object({ id: z.string() }) }), "PATCH");
 		},
@@ -350,6 +441,7 @@ function createRestClient({ appUrl, sessionToken, workspaceId }) {
 			const { authorizationUrl } = await post("/api/v1/external-oauth/connect", input, externalOauthConnectResponseSchema);
 			return { authorizationUrl: authorizationUrl ?? null };
 		},
+		decideComputeRequest: async ({ requestId, decision }) => post(`/api/v1/compute-requests/${encodeURIComponent(requestId)}/decision`, { decision }, computeDecisionResponseSchema),
 		fulfillCredential: async ({ url, body }) => {
 			const target = new URL(url, appUrl).toString();
 			const res = await fetch(target, {
@@ -383,6 +475,7 @@ function createRestClient({ appUrl, sessionToken, workspaceId }) {
 						headers: {
 							authorization: `Bearer ${sessionToken}`,
 							accept: "text/event-stream",
+							[CLI_VERSION_HEADER]: version,
 							...workspaceId ? { "x-workspace-id": workspaceId } : {}
 						},
 						signal
@@ -434,23 +527,34 @@ const agentSummarySchema = z.object({
 	createdAt: z.string(),
 	creatorName: z.string().nullable().optional(),
 	model: z.string().nullable().optional(),
-	modelLocked: z.boolean().optional()
+	modelLocked: z.boolean().optional(),
+	thinkingLevel: z.string().nullable().optional()
 });
 const platformModelSchema = z.object({
 	id: z.string(),
 	displayName: z.string(),
 	providerDisplay: z.string().optional(),
 	reasoning: z.boolean().optional(),
-	compliant: z.boolean().optional()
+	compliant: z.boolean().optional(),
+	thinkingLevels: z.array(z.string()).optional(),
+	thinkingLevelLabels: z.record(z.string(), z.string()).optional()
 }).passthrough();
 const listModelsResponseSchema = z.object({ models: z.array(platformModelSchema) });
-const updateAgentResponseSchema = z.object({ agent: z.object({ model: z.string().nullable().optional() }).passthrough() });
+const modelEffortPreferencesResponseSchema = z.object({ modelConfigOverrides: z.record(z.string(), z.object({ thinkingLevel: z.string().optional() })).optional() });
+const updateAgentResponseSchema = z.object({ agent: z.object({
+	model: z.string().nullable().optional(),
+	thinkingLevel: z.string().nullable().optional()
+}).passthrough() });
 const listAgentsResponseSchema = z.object({
 	agents: z.array(agentSummarySchema),
 	nextCursor: z.string().nullable().optional(),
 	totalCount: z.number().nullable().optional()
 });
 const createAgentResponseSchema = z.object({ agent: agentSummarySchema });
+const onboardingConversationResponseSchema = z.object({
+	conversationId: z.string(),
+	runId: z.string().nullable()
+});
 const getAgentResponseSchema = z.object({ agent: agentSummarySchema });
 const agentSuggestionSchema = z.object({ name: z.string() });
 const suggestAgentResponseSchema = z.object({ suggestion: agentSuggestionSchema.nullable() });
@@ -469,6 +573,7 @@ const conversationSummarySchema = z.object({
 	channel: z.string().nullable(),
 	channelLabel: z.string().nullable(),
 	viewerArchivedAt: z.string().nullable().optional(),
+	unread: z.boolean().optional(),
 	agent: conversationAgentSchema,
 	agents: z.array(conversationAgentSchema).optional()
 });
@@ -479,7 +584,8 @@ const conversationDetailSchema = z.object({
 	createdAt: z.string(),
 	updatedAt: z.string(),
 	channel: z.string().nullable(),
-	channelLabel: z.string().nullable()
+	channelLabel: z.string().nullable(),
+	parentConversationId: z.string().uuid().nullable().optional()
 });
 const conversationTitleSchema = z.object({
 	id: z.string().uuid(),
@@ -527,10 +633,27 @@ const subagentTaskSnapshotSchema = z.object({
 	status: z.string(),
 	title: z.string().nullable(),
 	createdAt: z.string(),
-	completedAt: z.string().nullable()
+	completedAt: z.string().nullable(),
+	childConversationId: z.string().nullish(),
+	childRunStartedAt: z.string().nullish(),
+	contextTokens: z.number().nullish(),
+	latestActivity: z.string().nullish()
 });
 const subagentTasksResponseSchema = z.object({ result: z.object({ data: z.object({ subagentTasks: z.array(subagentTaskSnapshotSchema) }) }) });
-const listMessagesResponseSchema = z.object({ messages: z.array(uiMessageSchema) });
+const liveStatsResponseSchema = z.object({ stats: z.object({
+	sampledAt: z.number(),
+	cpuUsedPct: z.number(),
+	cpuCount: z.number(),
+	memUsedBytes: z.number(),
+	memTotalBytes: z.number(),
+	diskUsedBytes: z.number(),
+	diskTotalBytes: z.number()
+}).nullable() });
+const listMessagesResponseSchema = z.object({
+	messages: z.array(uiMessageSchema),
+	hasMore: z.boolean().optional(),
+	nextBefore: z.string().nullish()
+});
 const workspaceFileSchema = z.object({
 	id: z.string(),
 	path: z.string(),
@@ -564,6 +687,7 @@ const finalizeResponseSchema = z.object({
 });
 const oauthConnectResponseSchema = z.object({ connectLink: z.string() }).passthrough();
 const externalOauthConnectResponseSchema = z.object({ authorizationUrl: z.string().optional() }).passthrough();
+const computeDecisionResponseSchema = z.object({ status: z.string() }).passthrough();
 const runStreamEventSchema = z.union([z.object({
 	kind: z.literal("chunk"),
 	chunk: z.record(z.unknown())
@@ -584,7 +708,8 @@ const conversationStreamEventSchema = z.discriminatedUnion("kind", [
 		kind: z.literal("agent"),
 		id: z.string(),
 		model: z.string().nullable(),
-		modelLocked: z.boolean()
+		modelLocked: z.boolean(),
+		thinkingLevel: z.string().nullish()
 	}),
 	z.object({
 		kind: z.literal("run"),
@@ -602,4 +727,4 @@ const conversationStreamEventSchema = z.discriminatedUnion("kind", [
 ]);
 
 //#endregion
-export { isRecord as a, errorMessage as i, errorDetail as n, sendErrorMessage as r, createRestClient as t };
+export { errorMessage as a, version as c, sendErrorMessage as i, errorDetail as n, isRecord as o, filenameFromContentDisposition as r, name as s, createRestClient as t };

package/dist/js/rest-Dc0EEok3.mjs

@@ -0,0 +1,6 @@
+#!/usr/bin/env node
+import { i as sendErrorMessage, n as errorDetail, r as filenameFromContentDisposition, t as createRestClient } from "./rest-B9__Zsuk.mjs";
+import { t as HttpError } from "./http-error-BF2NZZE3.mjs";
+import "./billing-blocked-D3l5kJlX.mjs";
+
+export { createRestClient };

package/dist/js/tls-cert-BpCaD5AT.mjs

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+import { n as envTlsCertSource, r as warnOnRebindProtection, t as defaultTlsCertSource } from "./tls-cert-Rua2oV7n.mjs";
+
+export { defaultTlsCertSource };

package/dist/js/tls-cert-Rua2oV7n.mjs

@@ -0,0 +1,67 @@
+#!/usr/bin/env node
+import { readFile } from "node:fs/promises";
+import dns from "node:dns";
+
+//#region ../portal-daemon/src/tls-cert.ts
+/**
+* File-backed cert source, configured by environment:
+* SKYDIVE_PORTAL_TLS_KEY / SKYDIVE_PORTAL_TLS_CERT (PEM file paths) and
+* SKYDIVE_PORTAL_TLS_HOST (the name the cert covers). All three or nothing —
+* a partial configuration is reported once and treated as absent, so a typo
+* degrades to today's behavior instead of a crash loop.
+*/
+function envTlsCertSource(env, log) {
+	return async () => {
+		const keyPath = env.SKYDIVE_PORTAL_TLS_KEY;
+		const certPath = env.SKYDIVE_PORTAL_TLS_CERT;
+		const hostname = env.SKYDIVE_PORTAL_TLS_HOST;
+		if (!keyPath && !certPath && !hostname) return null;
+		if (!keyPath || !certPath || !hostname) {
+			log("forward: SKYDIVE_PORTAL_TLS_KEY, SKYDIVE_PORTAL_TLS_CERT and SKYDIVE_PORTAL_TLS_HOST must all be set to enable the TLS origin; continuing with http only");
+			return null;
+		}
+		try {
+			const [key, cert] = await Promise.all([readFile(keyPath, "utf8"), readFile(certPath, "utf8")]);
+			return {
+				key,
+				cert,
+				hostname
+			};
+		} catch (err) {
+			log(`forward: could not read TLS key/cert (${err instanceof Error ? err.message : String(err)}); continuing with http only`);
+			return null;
+		}
+	};
+}
+/**
+* The default cert source for both tunnel surfaces: an explicit env/file
+* configuration wins (BYO cert — also the escape hatch for machines where the
+* trust prompt is unwanted, e.g. CI), otherwise the fully automatic
+* devcert-backed localhost source.
+*/
+function defaultTlsCertSource(env, log) {
+	const fromEnv = envTlsCertSource(env, log);
+	return async () => {
+		if (env.SKYDIVE_PORTAL_TLS_KEY || env.SKYDIVE_PORTAL_TLS_CERT || env.SKYDIVE_PORTAL_TLS_HOST) return fromEnv();
+		const { localhostCertSource } = await import("./localhost-cert-Bn-UBUmj.mjs");
+		return localhostCertSource(log)();
+	};
+}
+/**
+* Detect resolver-level DNS rebind protection: some routers/resolvers refuse
+* public names that answer with loopback addresses (Plex documents this exact
+* failure for *.plex.direct). The https origin simply won't resolve for such
+* users — warn with the cause, and leave the http origin (unaffected) as the
+* fallback. Never fatal: the browser may use a different resolver than the
+* OS, so we start the listener regardless.
+*/
+async function warnOnRebindProtection(hostname, log) {
+	try {
+		if (!(await dns.promises.lookup(hostname, { all: true })).some((a) => a.address === "127.0.0.1" || a.address === "::1")) log(`forward: ${hostname} did not resolve to 127.0.0.1 — a resolver on this network may block public names pointing at loopback (DNS rebind protection). The https origin may not work here; http://localhost is unaffected.`);
+	} catch (error) {
+		log(`forward: ${hostname} did not resolve (${error instanceof Error ? error.message : String(error)}) — a resolver on this network may block public names pointing at loopback (DNS rebind protection). The https origin may not work here; http://localhost is unaffected.`);
+	}
+}
+
+//#endregion
+export { envTlsCertSource as n, warnOnRebindProtection as r, defaultTlsCertSource as t };

package/package.json

@@ -1,18 +1,19 @@
 {
   "name": "skydive-cli",
-  "version": "0.5.0-beta.8",
+  "version": "0.5.0",
   "description": "Skydive CLI — cloud agents from the command line",
   "homepage": "https://skydive.com",
   "license": "MIT",
   "bin": {
-    "skydive": "./dist/js/bin.mjs"
+    "skydive": "./dist/js/launcher.mjs"
   },
   "files": [
     "dist"
   ],
   "type": "module",
   "exports": {
-    "./bin": "./dist/js/bin.mjs"
+    "./bin": "./dist/js/bin.mjs",
+    "./launcher": "./dist/js/launcher.mjs"
   },
   "publishConfig": {
     "access": "public",
@@ -41,7 +42,7 @@
     "react-devtools-core": "^7.0.1",
     "safe-stable-stringify": "^2.3.1",
     "semver": "^7.7.4",
-    "shell-quote": "1.9.0",
+    "tar": "7.5.21",
     "web-tree-sitter": "0.25.10",
     "ws": "^8.21.0",
     "yargs": "^17.7.2",
@@ -66,5 +67,12 @@
   "engines": {
     "bun": ">=1.3.14",
     "node": ">=20.0.0"
+  },
+  "//optionalDependencies": "The per-platform binary packages (skydive-cli-<os>-<arch>) are INTENTIONALLY not committed here. They are published by release-skydive-cli-binaries.yml and injected — pinned to the exact version being published — into the published launcher's optionalDependencies at release time (scripts/prepare-platform-packages.mjs --pin-version, run in release-skydive-cli.yml). Committing them would make `yarn install` try to resolve versions that only exist post-publish, breaking local dev and CI. npm installs of a published skydive-cli still get them (os/cpu-gated); the launcher (src/launcher.ts) resolves and execs the matching one. Local dev never needs them: it runs the JS bundle or `build:binary` directly.",
+  "optionalDependencies": {
+    "skydive-cli-darwin-arm64": "0.5.0",
+    "skydive-cli-darwin-x64": "0.5.0",
+    "skydive-cli-linux-x64": "0.5.0",
+    "skydive-cli-linux-arm64": "0.5.0"
   }
 }

package/dist/js/api-DG5W6iwx.mjs

@@ -1,131 +0,0 @@
-#!/usr/bin/env node
-import { t as HttpError } from "./http-error-DzyrsLAZ.mjs";
-import { z } from "zod";
-
-//#region ../portal-daemon/src/api.ts
-/**
-* The portal's session-authed REST surface, shared by `PortalClient` (the
-* TUI/`portal open` connection) and the `skydive portal` management
-* commands, so the endpoint contracts and response schemas live in exactly
-* one place.
-*/
-const deviceSchema = z.object({
-	id: z.string(),
-	machineName: z.string(),
-	friendlyName: z.string(),
-	connected: z.boolean(),
-	lastSeen: z.string().nullable(),
-	grantedAgentIds: z.array(z.string())
-});
-const devicesResponseSchema = z.object({
-	devices: z.array(deviceSchema),
-	agents: z.array(z.object({
-		id: z.string(),
-		name: z.string()
-	}))
-});
-const deviceTokenSchema = z.object({ token: z.string().min(1) });
-async function portalFetch(auth, path, init) {
-	const res = await fetch(`${auth.appUrl}${path}`, {
-		method: init.method,
-		headers: {
-			authorization: `Bearer ${auth.sessionToken}`,
-			accept: "application/json",
-			...init.body ? { "content-type": "application/json" } : {}
-		},
-		...init.body ? { body: init.body } : {}
-	});
-	if (!res.ok) {
-		const body = await res.text().catch(() => "");
-		throw new HttpError(res.status, body);
-	}
-	return res.json();
-}
-async function fetchPortalDevices(auth) {
-	const json = await portalFetch(auth, "/api/v1/portal/devices", { method: "GET" });
-	return devicesResponseSchema.parse(json);
-}
-const registerResponseSchema = z.object({ device: z.object({ id: z.string() }) });
-/**
-* Register this machine's device row without connecting. Connecting registers
-* as a side effect; this covers granting an agent on a machine that has never
-* shared yet (the grant references the device row).
-*/
-async function registerPortalDevice(auth, { machineName, friendlyName }) {
-	const json = await portalFetch(auth, "/api/v1/portal/devices", {
-		method: "POST",
-		body: JSON.stringify({
-			machineName,
-			friendlyName
-		})
-	});
-	return registerResponseSchema.parse(json).device;
-}
-/** Short-lived token the machine presents when dialing the portal WebSocket. */
-async function mintPortalDeviceToken(auth) {
-	const json = await portalFetch(auth, "/api/v1/portal/device-token", { method: "POST" });
-	return deviceTokenSchema.parse(json).token;
-}
-const forwardTargetSchema = z.object({
-	daemonOrigin: z.string().min(1),
-	token: z.string().min(1),
-	expiresInSeconds: z.number()
-});
-/**
-* Everything `portal forward` needs to dial an agent's sandbox daemon through
-* the agent-webserver edge Worker: the daemon's stable public origin and a
-* daemon auth token (canUse-gated server-side).
-*/
-async function fetchForwardTarget(auth, agentId) {
-	const json = await portalFetch(auth, "/api/v1/portal/forward-target", {
-		method: "POST",
-		body: JSON.stringify({ agentId })
-	});
-	return forwardTargetSchema.parse(json);
-}
-async function grantPortalAccess(auth, { deviceId, agentId, conversationId }) {
-	await portalFetch(auth, `/api/v1/portal/devices/${encodeURIComponent(deviceId)}/grants`, {
-		method: "POST",
-		body: JSON.stringify({
-			agentId,
-			conversationId
-		})
-	});
-}
-async function revokePortalAccess(auth, { deviceId, agentId }) {
-	await portalFetch(auth, `/api/v1/portal/devices/${encodeURIComponent(deviceId)}/grants/${encodeURIComponent(agentId)}`, { method: "DELETE" });
-}
-/**
-* The device row for a given machine identity. Matching is by `machineName`
-* equality — the stable handle the machine registers under, not the display
-* label.
-*/
-function findThisDevice(devices, machineName) {
-	return devices.find((device) => device.machineName === machineName) ?? null;
-}
-/**
-* One-time grant migration onto the merged device. Earlier CLI builds
-* registered a separate `<machineName>-cli` device, so a user's existing
-* approvals hang off that row; the merged device would start with zero grants
-* and every already-authorized agent would ask again. Copy any grant the
-* merged device is missing (the grant endpoint upserts, so re-runs are
-* no-ops). The legacy row is left in place — an old CLI build may still
-* connect under it. Returns how many grants were copied.
-*/
-async function unifyLegacyCliGrants(auth, machineName) {
-	const { devices } = await fetchPortalDevices(auth);
-	const merged = findThisDevice(devices, machineName);
-	const legacy = findThisDevice(devices, `${machineName}-cli`);
-	if (!merged || !legacy) return 0;
-	const have = new Set(merged.grantedAgentIds);
-	const missing = legacy.grantedAgentIds.filter((id) => !have.has(id));
-	for (const agentId of missing) await grantPortalAccess(auth, {
-		deviceId: merged.id,
-		agentId,
-		conversationId: null
-	});
-	return missing.length;
-}
-
-//#endregion
-export { mintPortalDeviceToken as a, unifyLegacyCliGrants as c, grantPortalAccess as i, fetchPortalDevices as n, registerPortalDevice as o, findThisDevice as r, revokePortalAccess as s, fetchForwardTarget as t };

package/dist/js/client-BuU34IVE.mjs

@@ -1,5 +0,0 @@
-#!/usr/bin/env node
-import { t as PortalClient } from "./client-DabRpc_T.mjs";
-import "./api-DG5W6iwx.mjs";
-
-export { PortalClient };

package/dist/js/daemon-BxU59xie.mjs

@@ -1,6 +0,0 @@
-#!/usr/bin/env node
-import "./client-DabRpc_T.mjs";
-import { a as runPortalDaemon, i as queryDaemonStatus, n as ensureDaemonRunning, o as startPortalDaemon, r as isDaemonListening, s as stopDaemon, t as PortalDaemon } from "./daemon-k2kVkJ8D.mjs";
-import "./api-DG5W6iwx.mjs";
-
-export { runPortalDaemon };

package/dist/js/daemon-client-C2BvZgKO.mjs

@@ -1,7 +0,0 @@
-#!/usr/bin/env node
-import "./client-DabRpc_T.mjs";
-import "./daemon-k2kVkJ8D.mjs";
-import "./api-DG5W6iwx.mjs";
-import { t as PortalDaemonClient } from "./daemon-client-fxf1A25Z.mjs";
-
-export { PortalDaemonClient };

package/dist/js/forward-18QoL5dO.mjs

@@ -1,68 +0,0 @@
-#!/usr/bin/env node
-import { t as fetchForwardTarget } from "./api-DG5W6iwx.mjs";
-import net from "node:net";
-import { WebSocket, createWebSocketStream } from "ws";
-
-//#region src/chat/portal/forward.ts
-const TARGET_REFRESH_SAFETY_MS = 12e4;
-/**
-* The reverse portal's client half: listen on the local machine's loopback and
-* pipe each TCP connection to the agent sandbox's daemon (`/portal/tcp`),
-* which pipes to the sandbox's own loopback. The daemon is reached through the
-* agent-webserver edge Worker (sandboxes have public ingress disabled; the
-* Worker owns boot-resolution and injects the sandbox edge-auth token), so a
-* sandbox recycle just costs the next connection a cold-start wait rather
-* than invalidating the forward.
-*/
-async function startForward({ auth, agentId, localPort, targetPort, log }) {
-	let target = await fetchForwardTarget(auth, agentId);
-	let mintedAt = Date.now();
-	async function freshTarget() {
-		const ttlMs = target.expiresInSeconds * 1e3;
-		if (Date.now() - mintedAt > ttlMs - TARGET_REFRESH_SAFETY_MS) {
-			target = await fetchForwardTarget(auth, agentId);
-			mintedAt = Date.now();
-		}
-		return target;
-	}
-	const server = net.createServer((sock) => {
-		sock.pause();
-		(async () => {
-			let resolved;
-			try {
-				resolved = await freshTarget();
-			} catch (err) {
-				log(`forward: token refresh failed: ${err instanceof Error ? err.message : String(err)}`);
-				sock.destroy();
-				return;
-			}
-			const ws = new WebSocket(`${resolved.daemonOrigin.replace(/^http/, "ws")}/portal/tcp?port=${targetPort}`, { headers: { authorization: `Bearer ${resolved.token}` } });
-			ws.on("open", () => {
-				const stream = createWebSocketStream(ws);
-				stream.on("error", () => sock.destroy());
-				sock.on("error", () => stream.destroy());
-				sock.pipe(stream).pipe(sock);
-				sock.resume();
-			});
-			ws.on("error", (err) => {
-				log(`forward: tunnel connect failed: ${err.message}`);
-				sock.destroy();
-			});
-		})();
-	});
-	await new Promise((resolve, reject) => {
-		server.once("error", reject);
-		server.listen(localPort, "127.0.0.1", () => {
-			server.removeListener("error", reject);
-			resolve();
-		});
-	});
-	const addr = server.address();
-	return {
-		port: addr && typeof addr === "object" ? addr.port : localPort,
-		close: () => new Promise((resolve) => server.close(() => resolve()))
-	};
-}
-
-//#endregion
-export { startForward };

package/dist/js/raw-pty-DmdUf4_w.mjs

@@ -1,5 +0,0 @@
-#!/usr/bin/env node
-import "./client-c4c5MmgN.mjs";
-import { t as runRawPtyPassthrough } from "./raw-pty-DY4KelZW.mjs";
-
-export { runRawPtyPassthrough };