skydive-cli 0.5.0-beta.9 → 0.5.0

package/dist/js/launcher.mjs

@@ -0,0 +1,49 @@
+#!/usr/bin/env node
+import { createRequire } from "node:module";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
+
+//#region src/launcher.ts
+const PLATFORM_PACKAGES = {
+	"darwin-arm64": "skydive-cli-darwin-arm64",
+	"darwin-x64": "skydive-cli-darwin-x64",
+	"linux-x64": "skydive-cli-linux-x64",
+	"linux-arm64": "skydive-cli-linux-arm64"
+};
+const require = createRequire(import.meta.url);
+/** The compiled per-platform binary, or null if none is installed/available. */
+function resolveBinaryPath() {
+	const pkg = PLATFORM_PACKAGES[`${process.platform}-${process.arch}`];
+	if (!pkg) return null;
+	try {
+		return require.resolve(`${pkg}/bin`);
+	} catch (_error) {
+		return null;
+	}
+}
+/** The JS bundle sibling of this launcher (`dist/js/bin.mjs`). */
+function jsBundlePath() {
+	return path.join(path.dirname(fileURLToPath(import.meta.url)), "bin.mjs");
+}
+const args = process.argv.slice(2);
+const binaryPath = resolveBinaryPath();
+let child;
+if (binaryPath) {
+	const env = { ...process.env };
+	if (env["SKYDIVE_CLI_INSTALL_SOURCE"] === void 0) env["SKYDIVE_CLI_INSTALL_SOURCE"] = "package-manager";
+	child = spawnSync(binaryPath, args, {
+		stdio: "inherit",
+		env
+	});
+} else child = spawnSync(process.execPath, [jsBundlePath(), ...args], { stdio: "inherit" });
+if (child.error) {
+	const what = binaryPath ? `the platform binary (${binaryPath})` : `the CLI under Node (${process.execPath})`;
+	process.stderr.write(`skydive: failed to launch ${what}: ${child.error.message}\n`);
+	process.exit(1);
+}
+if (child.signal) process.kill(process.pid, child.signal);
+else process.exit(child.status ?? 0);
+
+//#endregion
+export {  };

package/dist/js/localhost-cert-Bn-UBUmj.mjs

@@ -0,0 +1,67 @@
+#!/usr/bin/env node
+import { r as __toESM } from "./chunk-BbwQpWto.mjs";
+import os from "node:os";
+import path from "node:path";
+import { mkdir, readFile, unlink, writeFile } from "node:fs/promises";
+
+//#region ../portal-daemon/src/localhost-cert.ts
+/**
+* Durable home for the one piece of state devcert doesn't keep for us: the
+* user's decision to skip automatic cert setup. The daemon's own state dir is
+* tmpdir-based (wiped on reboot), and re-raising a system trust prompt on
+* every `portal forward` after a decline is exactly the nagging that trains
+* people to fear the feature.
+*/
+function declineMarkerPath() {
+	return path.join(os.homedir(), ".config", "skydive-portal", "tls-declined");
+}
+async function hasDeclined() {
+	try {
+		await readFile(declineMarkerPath());
+		return true;
+	} catch (_error) {
+		return false;
+	}
+}
+async function recordDecline(reason) {
+	const marker = declineMarkerPath();
+	try {
+		await mkdir(path.dirname(marker), { recursive: true });
+		await writeFile(marker, `Automatic localhost TLS setup failed or was declined:\n${reason}\n\nDelete this file to let it try again.\n`);
+	} catch (_error) {}
+}
+/**
+* Fully automatic localhost cert: devcert generates a per-machine local CA on
+* first use, installs it into the system/browser trust stores (one OS-native
+* consent prompt, the mkcert pattern), signs a `localhost` leaf, and reuses
+* both silently on every later run. The private key never leaves the machine
+* and the CA is unique to it, so trusting it vouches only for this user's own
+* loopback.
+*
+* Every failure — the user declining the trust prompt included — degrades to
+* the plain-http origin (the product default) with one log line, and writes a
+* marker so subsequent runs don't nag. `resetLocalhostCertDecline` (or
+* deleting the marker file) re-arms it.
+*/
+function localhostCertSource(log) {
+	return async () => {
+		if (await hasDeclined()) return null;
+		try {
+			const { certificateFor } = await import("./dist-CRtjM7ba.mjs").then((m) => /* @__PURE__ */ __toESM(m.default, 1));
+			const { key, cert } = await certificateFor("localhost", { skipHostsFile: true });
+			return {
+				key: key.toString(),
+				cert: cert.toString(),
+				hostname: "localhost"
+			};
+		} catch (error) {
+			const reason = error instanceof Error ? error.message : String(error);
+			await recordDecline(reason);
+			log(`portal: automatic localhost TLS setup didn't complete (${reason}). Continuing with http only; delete ~/.config/skydive-portal/tls-declined to try again.`);
+			return null;
+		}
+	};
+}
+
+//#endregion
+export { localhostCertSource };

package/dist/js/{print-Wakr3GJd.mjs → print-Bx8qUC9U.mjs}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { a as runPrint, i as resolveAgent, n as messageGet, o as toPrintError, r as readStdin, t as collectRunText } from "./print-BpuyEfWX.mjs";
-import "./rest-I3imNduB.mjs";
-import "./billing-blocked-2wju4gC_.mjs";
+import "./rest-B9__Zsuk.mjs";
+import { a as runPrint, i as resolveAgent, n as messageGet, o as toPrintError, r as readStdin, t as collectRunText } from "./print-D_UEjdSw.mjs";
+import "./billing-blocked-D3l5kJlX.mjs";
 
 export { messageGet, readStdin, resolveAgent, runPrint };

package/dist/js/{print-BpuyEfWX.mjs → print-D_UEjdSw.mjs}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import { t as HttpError } from "./http-error-DzyrsLAZ.mjs";
-import { a as isRecord, i as errorMessage, r as sendErrorMessage, t as createRestClient } from "./rest-I3imNduB.mjs";
-import { i as billingBlockedOutcomeFromSendResponse, n as BillingBlockedError } from "./billing-blocked-2wju4gC_.mjs";
+import { a as errorMessage, i as sendErrorMessage, o as isRecord, t as createRestClient } from "./rest-B9__Zsuk.mjs";
+import { t as HttpError } from "./http-error-BF2NZZE3.mjs";
+import { i as billingBlockedOutcomeFromSendResponse, n as BillingBlockedError } from "./billing-blocked-D3l5kJlX.mjs";
 import path from "node:path";
 import Conf from "conf";
 import { err, ok } from "neverthrow";
@@ -21,8 +21,13 @@ const DEFAULT_API_URL = typeof SKYDIVE_BUILD_API_URL === "string" ? SKYDIVE_BUIL
 * dev or while the DNS record is still being provisioned.
 */
 const DEFAULT_APP_URL = DEFAULT_API_URL;
+/** The production web front door. Also the marker for "this is a production
+* build": anything else means a preview or local stack baked its own origin
+* in, and callers that reference production-only hosts (the `skydive.sh`
+* installer in update-check/notice.ts) fall back to origin-relative URLs. */
+const PRODUCTION_WEB_URL = "https://skydive.com";
 /** Web front door, for pages opened in the user's browser. */
-const DEFAULT_WEB_URL = typeof SKYDIVE_BUILD_WEB_URL === "string" ? SKYDIVE_BUILD_WEB_URL : "https://skydive.com";
+const DEFAULT_WEB_URL = typeof SKYDIVE_BUILD_WEB_URL === "string" ? SKYDIVE_BUILD_WEB_URL : PRODUCTION_WEB_URL;
 function resolveWebUrl(appUrl) {
 	if (appUrl == null) return appUrl;
 	return appUrl === DEFAULT_APP_URL ? DEFAULT_WEB_URL : appUrl;
@@ -40,7 +45,7 @@ const API_KEY_PREFIX = "sky_live_";
 */
 const API_KEY_FAMILY_PREFIX = "sky_";
 /** Where users mint and copy API keys. Shown in the login prompt. */
-const API_KEYS_URL = "skydive.com/settings/account";
+const API_KEYS_URL = "skydive.com/settings/workspace";
 const store = new Conf({
 	projectName: process.env["SKYDIVE_CONFIG_NAME"] ?? "skydive",
 	projectSuffix: "",
@@ -213,6 +218,32 @@ function saveUpdateCheck(value) {
 	}
 	store.set("updateCheck", value);
 }
+/**
+* Agent a bare `skydive chat` (no --agent/--resume) opens a new conversation
+* with. Any selector `--agent` accepts works: an id, or a unique
+* case-insensitive slug/name, resolved against the active workspace's roster
+* at launch. Null when unset (the launch falls back to the agent picker).
+* A hand-edited blank value counts as unset rather than as a selector no
+* agent could ever match.
+*/
+function getDefaultAgent() {
+	const value = store.get("defaultAgent")?.trim();
+	return value ? value : null;
+}
+function saveDefaultAgent(value) {
+	store.set("defaultAgent", value);
+}
+/**
+* Remember the agent the chat TUI just opened a conversation with, so the
+* next bare `skydive chat` returns to it (last used wins). Records the id —
+* stable across renames, unlike a slug/name selector. Skips the write when
+* the value already matches: this runs on every chat-screen entry, and an
+* unchanged default shouldn't rewrite config.json.
+*/
+function recordDefaultAgent(agentId) {
+	if (getDefaultAgent() === agentId) return;
+	store.set("defaultAgent", agentId);
+}
 function parseBoolean(raw) {
 	const v = raw.trim().toLowerCase();
 	if ([
@@ -229,25 +260,40 @@ function parseBoolean(raw) {
 	].includes(v)) return ok(false);
 	return err(`Expected a boolean (true/false), got "${raw}".`);
 }
-const PREFERENCES = [{
-	key: "shareMachineDefault",
-	type: "boolean",
-	describe: "Share this machine over the portal on `skydive chat` launch, as if --share-machine were passed. Default false.",
-	read: () => getShareMachineDefault(),
-	isSet: () => store.has("shareMachineDefault"),
-	parse: parseBoolean,
-	write: (value) => saveShareMachineDefault(value),
-	clear: () => store.delete("shareMachineDefault")
-}, {
-	key: "updateCheck",
-	type: "boolean",
-	describe: "Run the daily background update check and its \"Update available\" notice. Set false to disable. Default true.",
-	read: () => !getUpdateCheckDisabled(),
-	isSet: () => store.has("updateCheck"),
-	parse: parseBoolean,
-	write: (value) => saveUpdateCheck(value),
-	clear: () => store.delete("updateCheck")
-}];
+const PREFERENCES = [
+	{
+		key: "shareMachineDefault",
+		type: "boolean",
+		describe: "Share this machine over the portal on `skydive chat` launch, as if --share-machine were passed. Default false.",
+		read: () => getShareMachineDefault(),
+		isSet: () => store.has("shareMachineDefault"),
+		set: (raw) => parseBoolean(raw).map(saveShareMachineDefault),
+		clear: () => store.delete("shareMachineDefault")
+	},
+	{
+		key: "updateCheck",
+		type: "boolean",
+		describe: "Run the daily background update check and its \"Update available\" notice. Set false to disable. Default true.",
+		read: () => !getUpdateCheckDisabled(),
+		isSet: () => store.has("updateCheck"),
+		set: (raw) => parseBoolean(raw).map(saveUpdateCheck),
+		clear: () => store.delete("updateCheck")
+	},
+	{
+		key: "defaultAgent",
+		type: "string",
+		describe: "Agent (id, slug, or name) a bare `skydive chat` opens a new conversation with, skipping the agent picker. Unset by default.",
+		read: () => getDefaultAgent(),
+		isSet: () => getDefaultAgent() !== null,
+		set: (raw) => {
+			const value = raw.trim();
+			if (!value) return err("Expected an agent id, slug, or name (use `config unset defaultAgent` to clear it).");
+			saveDefaultAgent(value);
+			return ok(void 0);
+		},
+		clear: () => store.delete("defaultAgent")
+	}
+];
 function getPreference(key) {
 	return PREFERENCES.find((p) => p.key === key);
 }
@@ -324,6 +370,50 @@ function parseButton(element) {
 function specKeyFor(spec) {
 	return stableStringify(spec) ?? crypto.randomUUID();
 }
+const COMPUTE_TIER_NAMES = {
+	small: "Lite",
+	large: "Standard",
+	xlarge: "Pro",
+	xxlarge: "Max",
+	xxxlarge: "Ultra"
+};
+function computeTierLabel(tier, memoryGb) {
+	const name = typeof tier === "string" ? COMPUTE_TIER_NAMES[tier] ?? null : null;
+	const memory = Number(memoryGb);
+	const memoryLabel = Number.isFinite(memory) && memory > 0 ? `${Math.round(memory)} GB` : null;
+	if (name && memoryLabel) return `${name} (${memoryLabel})`;
+	if (name) return name;
+	if (memoryLabel) return memoryLabel;
+	return typeof tier === "string" && tier ? tier : "unknown tier";
+}
+/**
+* The card line for a settled decision, shared by the spec parser (a settled
+* re-emission) and the chat screen (the decision POST's response, which on
+* `alreadyDecided` reports whatever decision actually stuck). Wording follows
+* the web card's chips (Upgraded / Kept current / Withdrawn).
+*/
+/**
+* The full status domain the api emits on a compute request. Anything else —
+* missing, or a value this CLI predates — returns null so the caller can
+* refuse it instead of guessing at unknown semantics.
+*/
+function parseComputeRequestStatus(value) {
+	switch (value) {
+		case "pending":
+		case "approved":
+		case "denied":
+		case "cancelled": return value;
+		default: return null;
+	}
+}
+function computeSettledLabel(status) {
+	switch (status) {
+		case "approved": return "upgraded";
+		case "denied": return "kept the current tier";
+		case "cancelled": return "withdrawn";
+		default: return null;
+	}
+}
 /**
 * The `platform portal request` consent card. The server emits one
 * DesktopHandoffCard spec for every surface (api routes/portal.ts): the web
@@ -340,9 +430,9 @@ function parseDesktopHandoffCard(rootEl) {
 	if (!agentId) return null;
 	const agentName = optionalString(props.agentName) ?? "This agent";
 	return {
-		title: `Let ${agentName} use your computer?`,
+		title: `Let ${agentName} run commands on your machine?`,
 		subtitle: null,
-		description: `Approving shares this machine with ${agentName} while you're signed in. Revoke anytime: skydive portal revoke --agent "${agentName}"`,
+		description: `Approving opens the portal to ${agentName} while you're signed in. Revoke anytime: skydive portal revoke --agent "${agentName}"`,
 		fields: [],
 		button: {
 			label: "Approve",
@@ -353,7 +443,111 @@ function parseDesktopHandoffCard(rootEl) {
 				conversationId: optionalString(props.conversationId)
 			}
 		},
-		state: {}
+		state: {},
+		computeRequestId: null,
+		settled: null,
+		questions: []
+	};
+}
+/**
+* The `platform compute request` approval card. The web renders it as the
+* Approve/Deny "More compute requested" card; here it maps onto a
+* decide_compute button (ctrl+r opens the y/n decision prompt). Without this
+* the spec is not a Card, parses to null, and the request is silently
+* dropped — the user never sees it and the agent waits on a decision the
+* terminal can't give (ANY-6653). A settled spec (the decision route re-emits
+* the card with its final status) parses to a button-less resolved card. A
+* status this CLI doesn't know also parses to null — rendering it as pending
+* would offer a decision on a request in a state we can't represent.
+*/
+function parseComputeRequestCard(rootEl) {
+	const props = isRecord(rootEl.props) ? rootEl.props : {};
+	const requestId = optionalString(props.requestId);
+	if (!requestId) return null;
+	const status = parseComputeRequestStatus(props.status);
+	if (status === null) return null;
+	const agentName = optionalString(props.agentName) ?? "This agent";
+	const from = computeTierLabel(props.fromTier, props.fromMemoryGb);
+	const to = computeTierLabel(props.requestedTier, props.requestedMemoryGb);
+	const settled = computeSettledLabel(status);
+	return {
+		title: "More compute requested",
+		subtitle: `${agentName}: ${from} → ${to}`,
+		description: optionalString(props.reason),
+		fields: [],
+		button: settled ? null : {
+			label: "Decide",
+			action: {
+				kind: "decide_compute",
+				requestId
+			}
+		},
+		state: {},
+		computeRequestId: requestId,
+		settled,
+		questions: []
+	};
+}
+function readQuestionOptions(raw) {
+	if (!Array.isArray(raw)) return [];
+	return raw.flatMap((o) => {
+		if (!isRecord(o)) return [];
+		const label = optionalString(o.label);
+		if (!label) return [];
+		return [{ label }];
+	});
+}
+function readQuestionEntries(raw) {
+	if (!Array.isArray(raw)) return [];
+	return raw.flatMap((q) => {
+		if (!isRecord(q)) return [];
+		const question = optionalString(q.question);
+		if (!question) return [];
+		const options = readQuestionOptions(q.options);
+		if (options.length < 2) return [];
+		return [{
+			question,
+			options,
+			multiSelect: Boolean(q.multiSelect)
+		}];
+	});
+}
+/**
+* The `platform ask` form. The web renders it as an interactive picker; here
+* it maps onto an answer_question button so ctrl+r (and letter shortcuts)
+* open an in-TUI picker. The composed answer is sent as a normal user
+* message — same non-blocking model as the web card. Without this the spec
+* is not a Card, parses to null, and the question is silently dropped.
+*/
+/** Compose the user-message body the web card also sends. */
+function composeQuestionAnswer(questions, answers) {
+	if (questions.length === 1) return (answers[0] ?? []).join(", ");
+	return questions.map((q, i) => `${q.question} → ${(answers[i] ?? []).join(", ")}`).join("\n");
+}
+function parseQuestionCard(rootEl) {
+	const props = isRecord(rootEl.props) ? rootEl.props : {};
+	const cardId = optionalString(props.cardId);
+	if (!cardId) return null;
+	const questions = readQuestionEntries(props.questions);
+	if (questions.length === 0) return null;
+	const settled = (props.status === "answered" ? "answered" : "pending") === "answered" ? optionalString(props.answerSummary) ?? "answered" : null;
+	const only = questions.length === 1 ? questions[0] : void 0;
+	return {
+		title: only ? only.question : "Questions",
+		subtitle: null,
+		description: null,
+		fields: [],
+		button: settled ? null : {
+			label: "Answer",
+			action: {
+				kind: "answer_question",
+				cardId
+			}
+		},
+		state: {},
+		computeRequestId: null,
+		settled,
+		questions
 	};
 }
 function parseConnectCard(spec) {
@@ -363,6 +557,8 @@ function parseConnectCard(spec) {
 	const rootEl = elements[root];
 	if (!isRecord(rootEl)) return null;
 	if (rootEl.type === "DesktopHandoffCard") return parseDesktopHandoffCard(rootEl);
+	if (rootEl.type === "ComputeRequestCard") return parseComputeRequestCard(rootEl);
+	if (rootEl.type === "QuestionCard") return parseQuestionCard(rootEl);
 	if (rootEl.type !== "Card") return null;
 	const rootProps = isRecord(rootEl.props) ? rootEl.props : {};
 	const title = optionalString(rootProps.title);
@@ -401,7 +597,10 @@ function parseConnectCard(spec) {
 			label: preferred.label,
 			action: preferred.action
 		} : null,
-		state: isRecord(spec.state) ? spec.state : {}
+		state: isRecord(spec.state) ? spec.state : {},
+		computeRequestId: null,
+		settled: null,
+		questions: []
 	};
 }
 
@@ -542,6 +741,20 @@ function summarizeConnectCard(card, appUrl) {
 				agentId: act.agentId
 			}
 		};
+		case "decide_compute": return {
+			...base,
+			action: {
+				kind: "decide_compute",
+				requestId: act.requestId
+			}
+		};
+		case "answer_question": return {
+			...base,
+			action: {
+				kind: "answer_question",
+				questions: card.questions.map((q) => q.question)
+			}
+		};
 		default: return {
 			...base,
 			action: { kind: "unsupported" }
@@ -551,14 +764,16 @@ function summarizeConnectCard(card, appUrl) {
 /**
 * Parse a `data-anyone-render-spec` stream chunk into a connect-card summary,
 * or null if the chunk isn't a connect card (other render specs — training,
-* deep-learn, compute-request — parse to null, same as the TUI).
+* deep-learn — parse to null, same as the TUI). A card that arrives already
+* settled (a compute request's decided re-emission) is an FYI, not an action,
+* so it stays out of the "[action needed]" stream too.
 */
 function connectCardFromChunk(chunk, appUrl) {
 	if (chunk["type"] !== "data-anyone-render-spec") return null;
 	const data = chunk["data"];
 	if (!isRecord(data)) return null;
 	const card = parseConnectCard(data["spec"]);
-	if (!card) return null;
+	if (!card || card.settled !== null) return null;
 	return summarizeConnectCard(card, appUrl);
 }
 /** Render a connect-card summary as a human-readable action block. */
@@ -575,7 +790,13 @@ function formatConnectCard(card) {
 			lines.push(`Provide credential (${card.action.fields.join(", ") || "value"}) at: ${card.action.url}`);
 			break;
 		case "approve_portal":
-			lines.push(`Approve local-machine access for agent ${card.action.agentId} in the TUI or web app.`);
+			lines.push(`Approve portal access to this machine for agent ${card.action.agentId} in the TUI or web app.`);
+			break;
+		case "decide_compute":
+			lines.push("Approve or deny this compute increase in the interactive TUI or web app.");
+			break;
+		case "answer_question":
+			lines.push(`Answer in the interactive TUI or web app: ${card.action.questions.join("; ")}`);
 			break;
 		case "unsupported":
 			lines.push("Open this conversation in the web app to continue.");
@@ -597,10 +818,11 @@ function formatConnectCard(card) {
 * disambiguate: an `--agent` selector must match exactly one agent, and
 * when it's omitted we only auto-pick if the account has exactly one.
 */
-async function runPrint({ appUrl, sessionToken, prompt, agentSelector, conversationId, json, machineShare, grantTargetAgent }) {
+async function runPrint({ appUrl, sessionToken, workspaceId, prompt, agentSelector, conversationId, json, machineShare, grantTargetAgent }) {
 	const client = createRestClient({
 		appUrl,
-		sessionToken
+		sessionToken,
+		workspaceId
 	});
 	const agent = resolveAgent(await client.listAgents({
 		scope: "org",
@@ -692,7 +914,7 @@ async function collectRunText({ client, appUrl, target, onText, messageIdForHint
 	const onEvent = (event) => {
 		if (event.kind === "finished") {
 			if (event.outcome) billingBlocked = event.outcome;
-			if (event.error) streamError = event.error;
+			if (event.error && streamError === null) streamError = event.error;
 			return;
 		}
 		const chunk = event.chunk;
@@ -795,4 +1017,4 @@ async function readStdin() {
 }
 
 //#endregion
-export { getStoredApiKeyWorkspaceName as A, saveTheme as B, getLastSeenVersion as C, getSavedTheme as D, getReviewStateDir as E, resolveManagementAuth as F, resolveSession as I, resolveWebUrl as L, resolveAppUrl as M, resolveChatAuth as N, getShareMachineDefault as O, resolveConfig as P, saveConfig as R, getConfigPath as S, getPromptHistoryPath as T, setLastSeenVersion as V, API_KEY_PREFIX as _, runPrint as a, PREFERENCES as b, cardActionErrorMessage as c, reconcileMaskedInput as d, resolveConnectUrl as f, API_KEY_FAMILY_PREFIX as g, API_KEYS_URL as h, resolveAgent as i, getUpdateCheckDisabled as j, getStoredApiKeyId as k, parseExternalOauthConnectParams as l, specKeyFor as m, messageGet as n, toPrintError as o, parseConnectCard as p, readStdin as r, MASK_CHAR as s, collectRunText as t, parseOauthConnectParams as u, DEFAULT_API_URL as v, getPreference as w, deleteConfig as x, DEFAULT_APP_URL as y, saveSession as z };
+export { getSavedTheme as A, resolveSession as B, deleteConfig as C, getPreference as D, getLastSeenVersion as E, recordDefaultAgent as F, setLastSeenVersion as G, saveConfig as H, resolveAppUrl as I, resolveChatAuth as L, getStoredApiKeyId as M, getStoredApiKeyWorkspaceName as N, getPromptHistoryPath as O, getUpdateCheckDisabled as P, resolveConfig as R, PREFERENCES as S, getDefaultAgent as T, saveSession as U, resolveWebUrl as V, saveTheme as W, API_KEYS_URL as _, runPrint as a, DEFAULT_API_URL as b, cardActionErrorMessage as c, reconcileMaskedInput as d, resolveConnectUrl as f, specKeyFor as g, parseConnectCard as h, resolveAgent as i, getShareMachineDefault as j, getReviewStateDir as k, parseExternalOauthConnectParams as l, computeSettledLabel as m, messageGet as n, toPrintError as o, composeQuestionAnswer as p, readStdin as r, MASK_CHAR as s, collectRunText as t, parseOauthConnectParams as u, API_KEY_FAMILY_PREFIX as v, getConfigPath as w, DEFAULT_APP_URL as x, API_KEY_PREFIX as y, resolveManagementAuth as z };

package/dist/js/{print-share-CKLPmsg0.mjs → print-share-Cz0EO2RK.mjs}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { n as printError } from "./output-DYzzdXYV.mjs";
+import { n as printError } from "./output-C9mb3sUB.mjs";
 
 //#region src/chat/print-share.ts
 /**
@@ -14,7 +14,8 @@ import { n as printError } from "./output-DYzzdXYV.mjs";
 * the reply (and to --json).
 */
 async function connectMachineShare({ appUrl, sessionToken, timeoutHint }) {
-	const { PortalClient } = await import("./client-BuU34IVE.mjs");
+	const { PortalClient } = await import("./client-Ct0-JZSS.mjs");
+	const { defaultTlsCertSource } = await import("./tls-cert-BpCaD5AT.mjs");
 	let signalConnected;
 	const connected = new Promise((resolve) => {
 		signalConnected = resolve;
@@ -26,6 +27,11 @@ async function connectMachineShare({ appUrl, sessionToken, timeoutHint }) {
 			deviceToken: null
 		}),
 		resolveCwd: () => process.cwd(),
+		tlsCertSource: defaultTlsCertSource(process.env, (msg) => {
+			console.error(msg);
+		}),
+		persistedMachineName: null,
+		onMachineName: () => {},
 		onState: (state) => {
 			if (state.status === "connected") signalConnected();
 			if (state.status === "error") console.error(`portal: connection error: ${state.error ?? "unknown"}; retrying`);
@@ -34,7 +40,7 @@ async function connectMachineShare({ appUrl, sessionToken, timeoutHint }) {
 	machineShare.enable();
 	if (await Promise.race([connected.then(() => false), new Promise((resolve) => setTimeout(() => resolve(true), 3e4).unref())])) {
 		machineShare.dispose();
-		printError(`Could not connect the portal within 30s. Machine sharing is unavailable (network, or the portal kill switch is off). ${timeoutHint ?? "Check `skydive portal status`."}`);
+		printError(`Could not connect the portal within 30s. The portal is unavailable (network, or the portal kill switch is off). ${timeoutHint ?? "Check `skydive portal status`."}`);
 		process.exit(1);
 	}
 	return machineShare;

package/dist/js/raw-pty-Ci2qFR9F.mjs

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+import "./client-Btq6bMzX.mjs";
+import { t as runRawPtyPassthrough } from "./raw-pty-D5PhKZSl.mjs";
+
+export { runRawPtyPassthrough };

package/dist/js/{raw-pty-DY4KelZW.mjs → raw-pty-D5PhKZSl.mjs}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { t as SandboxStream } from "./client-c4c5MmgN.mjs";
+import { t as SandboxStream } from "./client-Btq6bMzX.mjs";
 
 //#region src/chat/sandbox/raw-pty.ts
 /**