skydive-cli 0.6.0-beta.15 → 0.6.0-beta.154

package/dist/js/bin.mjs

@@ -1,27 +1,27 @@
 #!/usr/bin/env node
-import { c as version, s as name, t as createRestClient } from "./rest-Benrf1yZ.mjs";
-import { A as getPromptHistoryPath, B as resolveConfig, D as getDefaultAgent, E as getConfigPath, F as getStoredApiKeyWorkspaceName, G as saveSession, H as resolveSession$1, I as getUpdateCheckDisabled, N as getShareMachineDefault, O as getLastSeenVersion, P as getStoredApiKeyId, R as resolveAppUrl, S as DEFAULT_API_URL, T as deleteConfig, V as resolveManagementAuth, W as saveConfig, b as API_KEY_FAMILY_PREFIX, i as resolveAgent$1, k as getPreference, q as setLastSeenVersion, w as PREFERENCES, x as API_KEY_PREFIX, y as API_KEYS_URL, z as resolveChatAuth } from "./print-C_xW32a6.mjs";
-import { A as installAgentAlias, B as resolveWorkspaceId, D as machineOsFromPlatform, E as buildImportSeedPrompt, F as detectShell, I as ensureActiveOrganization, L as getActiveWorkspaceId, M as takenAliasNames, N as SUPPORTED_SHELLS, O as aliasActivationHint, P as defaultInstallEnv, R as getSessionIdentity, V as setActiveWorkspace, c as getAutomaticLogsDir, j as slugifyAliasName, k as dedupeAliasName, l as maybeStartProfiling, o as brandHelpArt, t as installCrashHandler, u as profileDir, w as themes, z as listWorkspaces } from "./install-Fo1riO1w.mjs";
+import { c as version, s as name, t as createRestClient } from "./rest-Bqz92FKU.mjs";
+import { A as getPreference, B as resolveChatAuth, C as DEFAULT_API_URL, D as getConfigPath, E as deleteConfig, F as getStoredApiKeyId, G as saveConfig, H as resolveManagementAuth, I as getStoredApiKeyWorkspaceName, J as setLastSeenVersion, K as saveSession, L as getUpdateCheckDisabled, O as getDefaultAgent, P as getShareMachineDefault, S as API_KEY_PREFIX, T as PREFERENCES, U as resolveSession$1, V as resolveConfig, b as API_KEYS_URL, i as resolveAgent$1, j as getPromptHistoryPath, k as getLastSeenVersion, x as API_KEY_FAMILY_PREFIX, z as resolveAppUrl } from "./print-KIdHOW60.mjs";
+import { A as aliasActivationHint, B as getSessionIdentity, E as themes, F as SUPPORTED_SHELLS, H as resolveWorkspaceId, I as defaultInstallEnv, L as detectShell, M as installAgentAlias, N as slugifyAliasName, O as buildImportSeedPrompt, P as takenAliasNames, R as ensureActiveOrganization, U as setActiveWorkspace, V as listWorkspaces, c as brandHelpArt, d as maybeStartProfiling, f as profileDir, j as dedupeAliasName, k as machineOsFromPlatform, t as installCrashHandler, u as getAutomaticLogsDir, z as getActiveWorkspaceId } from "./install-AaZqKYZR.mjs";
 import { n as printError, r as printTable, t as output } from "./output-C9mb3sUB.mjs";
 import { t as HttpError } from "./http-error-BF2NZZE3.mjs";
 import "./billing-blocked-D3l5kJlX.mjs";
-import { a as resolveMachineIdentity } from "./client-7decrdm4.mjs";
+import { s as resolveMachineIdentity } from "./client-r-o8dD4w.mjs";
 import "./tls-cert-Rua2oV7n.mjs";
 import { i as grantPortalAccess, n as fetchPortalDevices, o as registerPortalDevice, r as findThisDevice, s as revokePortalAccess } from "./api-BFQ4PQDA.mjs";
-import { d as daemonPaths, i as queryDaemonStatus, n as ensureDaemonRunning, s as stopDaemon, u as PORTAL_DAEMON_FLAG } from "./daemon-5HHkFtaF.mjs";
-import { a as encodeFsRequest, i as decodeFsResponse, n as SANDBOX_STREAM_PATH, r as streamSpecToQuery, t as SandboxStream } from "./client-l6orYfqq.mjs";
+import { d as daemonPaths, i as queryDaemonStatus, n as ensureDaemonRunning, s as stopDaemon, u as PORTAL_DAEMON_FLAG } from "./daemon-KcZ0CrBB.mjs";
+import { a as FS_MAX_BLOB_BYTES, i as streamSpecToQuery, n as DEFAULT_EXEC_TIMEOUT_MS, o as decodeFsResponse, r as SANDBOX_STREAM_PATH, s as encodeFsRequest, t as SandboxStream } from "./client-Cxk3khQu.mjs";
 import { hideBin } from "yargs/helpers";
 import yargs from "yargs";
 import { hostname, tmpdir } from "node:os";
 import path, { join } from "node:path";
 import { err, ok } from "neverthrow";
+import fsp, { mkdtemp, open, readFile, rm, stat, writeFile } from "node:fs/promises";
 import { z } from "zod";
-import open from "open";
+import open$1 from "open";
 import fs from "node:fs";
 import { spawn, spawnSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import zlib from "node:zlib";
-import fsp, { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
 import { WebSocket } from "ws";
 import semver from "semver";
 import { createInterface } from "node:readline";
@@ -51,7 +51,9 @@ const AgentSchema = z.object({
 	url: z.string().nullable(),
 	description: z.string().nullable(),
 	model: z.string().nullable(),
-	gitUrl: z.string()
+	gitUrl: z.string(),
+	createdByUserId: z.string().nullable().optional(),
+	createdAt: z.string().nullable().optional()
 });
 const ListAgentsResponseSchema = z.object({
 	agents: z.array(AgentSchema),
@@ -69,7 +71,47 @@ const ApiKeySchema = z.object({
 const CreatedApiKeySchema = ApiKeySchema.extend({ key: z.string() });
 const ListApiKeysResponseSchema = z.object({ keys: z.array(ApiKeySchema) });
 const ListSecretKeysResponseSchema = z.object({ keys: z.array(z.string()) });
+const GitTokenSchema = z.object({
+	id: z.string(),
+	token: z.string(),
+	cloneUrl: z.string(),
+	remoteUrl: z.string(),
+	permissions: z.string(),
+	label: z.string().nullable()
+});
+const ListedGitTokenSchema = z.object({
+	id: z.string(),
+	permissions: z.string(),
+	label: z.string().nullable(),
+	lastUsedAt: z.string().nullable(),
+	createdAt: z.string()
+});
+const ListGitTokensResponseSchema = z.object({ tokens: z.array(ListedGitTokenSchema) });
 const SetSecretResponseSchema = z.object({ key: z.string() });
+const AvatarPresignResponseSchema = z.object({
+	uploadUrl: z.string(),
+	ttlSeconds: z.number()
+});
+const AvatarCommitResponseSchema = z.object({ avatarUrl: z.string() });
+/** Same cap the server enforces at avatar commit; enforced client-side too so
+* oversized files fail before the presign/PUT round-trip. */
+const MAX_AGENT_AVATAR_BYTES = 5 * 1024 * 1024;
+/**
+* Sniff an agent-avatar media type from file magic bytes. Kept in sync with
+* the api's commit sniff — `apps/anyone/api/src/lib/agent-avatar.ts`
+* `sniffAvatarMediaType` — so the declared type always matches what the
+* server accepts; the CLI deliberately has no @createinc/anyone-* deps (and
+* no barrel imports, see the CLI bundle rules), so this stays a local copy.
+* If you add a type here, add it there too or the server 415s at commit.
+* null means the file is not an avatar-acceptable raster and the server
+* would reject it.
+*/
+function sniffAgentAvatarMediaType(bytes) {
+	if (bytes.byteLength >= 8 && bytes[0] === 137 && bytes[1] === 80 && bytes[2] === 78 && bytes[3] === 71) return "image/png";
+	if (bytes.byteLength >= 3 && bytes[0] === 255 && bytes[1] === 216 && bytes[2] === 255) return "image/jpeg";
+	if (bytes.byteLength >= 12 && bytes[0] === 82 && bytes[1] === 73 && bytes[2] === 70 && bytes[3] === 70 && bytes[8] === 87 && bytes[9] === 69 && bytes[10] === 66 && bytes[11] === 80) return "image/webp";
+	return null;
+}
 var SkydiveApiClient = class {
 	baseUrl;
 	token;
@@ -159,6 +201,99 @@ var SkydiveApiClient = class {
 			path: `/agents/${encodeURIComponent(agentId)}/secrets/${encodeURIComponent(key)}`
 		});
 	}
+	async listGitTokens(agentId) {
+		return this.request({
+			method: "GET",
+			path: `/agents/${encodeURIComponent(agentId)}/git-tokens`,
+			schema: ListGitTokensResponseSchema
+		}).then((r) => r.map((res) => res.tokens));
+	}
+	async createGitToken(agentId, params) {
+		return this.request({
+			method: "POST",
+			path: `/agents/${encodeURIComponent(agentId)}/git-tokens`,
+			body: params,
+			schema: GitTokenSchema
+		});
+	}
+	async revokeGitToken(agentId, tokenId) {
+		return this.request({
+			method: "DELETE",
+			path: `/agents/${encodeURIComponent(agentId)}/git-tokens/${encodeURIComponent(tokenId)}`
+		});
+	}
+	/**
+	* Set an agent's avatar photo, driving the server's presigned-PUT flow end
+	* to end: read the local file, sniff its raster type, presign, PUT the bytes
+	* straight to storage, then commit. Returns the versioned avatar URL the
+	* server stored.
+	*/
+	async setAgentAvatar(params) {
+		const prefix = Buffer.alloc(16);
+		let sniffBytes;
+		try {
+			const handle = await open(params.filePath, "r");
+			try {
+				const { bytesRead } = await handle.read(prefix, 0, prefix.byteLength, 0);
+				sniffBytes = prefix.subarray(0, bytesRead);
+			} finally {
+				await handle.close();
+			}
+		} catch (e) {
+			return err({
+				message: `Cannot read ${params.filePath}: ${e instanceof Error ? e.message : String(e)}`,
+				status: null
+			});
+		}
+		const mediaType = sniffAgentAvatarMediaType(sniffBytes);
+		if (!mediaType) return err({
+			message: "Not an avatar the server accepts: it must be a PNG, JPEG, or WebP image.",
+			status: null
+		});
+		let bytes;
+		try {
+			bytes = await readFile(params.filePath);
+		} catch (e) {
+			return err({
+				message: `Cannot read ${params.filePath}: ${e instanceof Error ? e.message : String(e)}`,
+				status: null
+			});
+		}
+		if (bytes.byteLength > MAX_AGENT_AVATAR_BYTES) return err({
+			message: "image exceeds 5 MB",
+			status: null
+		});
+		const presign = await this.request({
+			method: "POST",
+			path: `/agents/${encodeURIComponent(params.agentId)}/avatar/presign`,
+			body: { mediaType },
+			schema: AvatarPresignResponseSchema
+		});
+		if (presign.isErr()) return err(presign.error);
+		const put = await fetch(presign.value.uploadUrl, {
+			method: "PUT",
+			headers: { "content-type": mediaType },
+			body: new Uint8Array(bytes)
+		});
+		if (!put.ok) return err({
+			message: `Avatar upload failed: HTTP ${put.status}`,
+			status: put.status
+		});
+		return this.request({
+			method: "POST",
+			path: `/agents/${encodeURIComponent(params.agentId)}/avatar`,
+			body: { mediaType },
+			schema: AvatarCommitResponseSchema
+		});
+	}
+	/** Remove an agent's uploaded avatar photo; the generated preset takes
+	* over. Idempotent server-side — removing an agent with no photo succeeds. */
+	async deleteAgentAvatar(agentId) {
+		return this.request({
+			method: "DELETE",
+			path: `/agents/${encodeURIComponent(agentId)}/avatar`
+		});
+	}
 	async request(params) {
 		const url = `${this.baseUrl}${params.path}`;
 		const headers = {
@@ -187,7 +322,7 @@ var SkydiveApiClient = class {
 				const body = await response.json();
 				if (body.error && typeof body.error === "string") message = body.error;
 				else if (body.error?.message) message = body.error.message;
-			} catch {}
+			} catch (_error) {}
 			if (response.status === 401 && this.authKind === "session") message = `${message}. Your chat session may have expired. Run \`skydive auth login\`.`;
 			return err({
 				message,
@@ -198,7 +333,7 @@ var SkydiveApiClient = class {
 		let body;
 		try {
 			body = await response.json();
-		} catch {
+		} catch (_error) {
 			return err({
 				message: "Invalid JSON response",
 				status: response.status
@@ -343,7 +478,7 @@ async function loginWithDevice({ appUrl, openBrowser = true }) {
 	const verificationUrl = code.verification_uri_complete ?? code.verification_uri;
 	process.stderr.write(`\nTo sign in, open:\n  ${verificationUrl}\n`);
 	process.stderr.write(`and enter the code: ${formatUserCode(code.user_code)}\n\n`);
-	if (openBrowser) await open(verificationUrl).catch(() => void 0);
+	if (openBrowser) await open$1(verificationUrl).catch(() => void 0);
 	process.stderr.write("Waiting for approval…\n");
 	let intervalMs = (code.interval ?? 5) * 1e3 || DEFAULT_INTERVAL_MS;
 	const expiresAt = Date.now() + code.expires_in * 1e3;
@@ -580,6 +715,7 @@ async function runBrowserLogin(argv) {
 	if (identity?.activeWorkspaceName) console.log(`  Workspace: ${identity.activeWorkspaceName}`);
 	if (minted.isOk()) console.log(`  API key:   ${minted.value.prefix}… (${minted.value.name})`);
 	console.log(`  Config:    ${getConfigPath()}`);
+	console.log("  Git:       to push to an agent repo from this machine, run `skydive agents git token create <agent>`");
 }
 /** CI / headless path: validate and persist an existing key, no browser. */
 async function runApiKeyLogin(argv, apiKey) {
@@ -1025,6 +1161,40 @@ function requireManagementClient(argv, opts = {}) {
 		...opts.workspaceId ? { workspaceId: opts.workspaceId } : {}
 	});
 }
+/**
+* Resolve an agent-targeting command's agent selector (id or name) against
+* the management roster, returning the id, or exit with the candidate list.
+*
+* `secrets` and `keys` historically took a raw `--agent-id` and hit
+* `/agents/<value>/...` directly, so a name 404'd "agent not found" for a
+* perfectly real agent, while `sandbox`/`fs`/`portal` resolved the same
+* string happily (ANY-8977). Reads one page (the same 100 `skydive agents
+* list` shows), so the error's candidates are what the user was looking at.
+*/
+async function resolveTargetAgentId(client, selector) {
+	if (!selector) {
+		printError("Missing --agent <id or name>. Run `skydive agents list` for candidates.");
+		process.exit(1);
+	}
+	const { resolveAgent } = await import("./print-ClmJYG9P.mjs");
+	const result = await client.listAgents({
+		scope: "org",
+		limit: 100
+	});
+	if (result.isErr()) {
+		printError(result.error.message);
+		process.exit(1);
+	}
+	try {
+		return resolveAgent(result.value.agents.map((agent) => ({
+			id: agent.id,
+			name: agent.name
+		})), selector).id;
+	} catch (error) {
+		printError(error instanceof Error ? error.message : String(error));
+		process.exit(1);
+	}
+}
 /** Resolve the session (see {@link requireSession}) and build a REST client. */
 function requireRestClient(argv) {
 	const auth = resolveChatAuth({ appUrl: resolveAppUrl({ appUrl: argv["api-url"] }) });
@@ -1038,6 +1208,171 @@ function requireRestClient(argv) {
 	});
 }
 
+//#endregion
+//#region src/auth/git-credentials.ts
+/**
+* Laptop-side git credentials for an agent's repo.
+*
+* The in-sandbox push path (`git -> in-sandbox credential helper -> daemon ->
+* /git-credentials route -> git storage`) mints a short-lived credential per
+* push, which only works inside the sandbox. From a laptop, the supported
+* path is a git-proxy token: `POST /v1/agents/:agentId/git-tokens` returns a
+* long-lived `skdv_…` token plus a tokenless remote URL on the git-proxy
+* host. This module holds the pure logic for naming the token. The command
+* prints the values and changes nothing on the machine: what to do with the
+* token (credential store, remotes) is left to the user's own tools.
+*/
+/** Label stamped on the git-proxy token a machine mints for itself, so the
+* token is identifiable in `git token list` and on the web settings page. */
+function gitTokenLabel() {
+	return `CLI git (${hostname()})`;
+}
+
+//#endregion
+//#region src/commands/git-setup.ts
+/** Create one read_write git-proxy token for the agent and print it. The
+* API returns the ready-to-use tokenless remote URL, so the CLI does no URL
+* parsing. The command's job ends at the credential: it changes nothing on
+* this machine (no git config writes, no credential-store plumbing) — what
+* to do with the token is the caller's tool's business. The label is
+* metadata only, so a re-run accumulates rather than revokes. */
+const gitTokenCreateCommand = {
+	command: "create <agent>",
+	describe: "Create a git token to push to the agent's repo from your machine",
+	builder: (y) => y.positional("agent", {
+		type: "string",
+		demandOption: true,
+		describe: "Agent ID or name (see `skydive agents list`)"
+	}),
+	handler: async (argv) => {
+		const client = requireManagementClient(argv);
+		const agent = await resolveAgent(client, argv.agent);
+		const created = await client.createGitToken(agent.id, {
+			permissions: "read_write",
+			label: gitTokenLabel()
+		});
+		if (created.isErr()) {
+			printError(`Could not create a git token: ${created.error.message}`);
+			process.exit(1);
+		}
+		const { token, remoteUrl } = created.value;
+		if (argv.json) {
+			output(argv, {
+				agentId: agent.id,
+				agentName: agent.name,
+				remoteUrl,
+				tokenLabel: created.value.label,
+				token
+			});
+			return;
+		}
+		if (argv.quiet) {
+			console.log(token);
+			return;
+		}
+		console.log(`Git token for ${agent.name} (read_write).`);
+		console.log(`  Token:  ${token}`);
+		console.log(`  Remote: ${remoteUrl}  (password is the token)`);
+		console.log("  Nothing was written to git on this machine; pipe these into whatever manages your credentials.");
+	}
+};
+/** List the agent's git tokens (id, label, permissions, last use) so a revoke
+* has an id to take. Token values only come back from creating. */
+const gitTokenListCommand = {
+	command: "list <agent>",
+	describe: "List the agent's git tokens",
+	builder: (y) => y.positional("agent", {
+		type: "string",
+		demandOption: true,
+		describe: "Agent ID or name (see `skydive agents list`)"
+	}),
+	handler: async (argv) => {
+		const client = requireManagementClient(argv);
+		const agent = await resolveAgent(client, argv.agent);
+		const listed = await client.listGitTokens(agent.id);
+		if (listed.isErr()) {
+			printError(`Could not list this agent's git tokens: ${listed.error.message}`);
+			process.exit(1);
+		}
+		if (argv.json) {
+			output(argv, {
+				agentId: agent.id,
+				agentName: agent.name,
+				tokens: listed.value
+			});
+			return;
+		}
+		if (argv.quiet) {
+			for (const token of listed.value) console.log(token.id);
+			return;
+		}
+		if (listed.value.length === 0) {
+			console.log(`No git tokens for ${agent.name}.`);
+			return;
+		}
+		printTable([
+			"ID",
+			"Label",
+			"Permissions",
+			"Last used"
+		], listed.value.map((t) => [
+			t.id,
+			t.label ?? "",
+			t.permissions,
+			t.lastUsedAt ?? "never"
+		]));
+	}
+};
+/** Revoke one git token by id (run `git token list` for the ids). */
+const gitTokenRevokeCommand = {
+	command: "revoke <agent> <token-id>",
+	describe: "Revoke one of the agent's git tokens by id",
+	builder: (y) => y.positional("agent", {
+		type: "string",
+		demandOption: true,
+		describe: "Agent ID or name (see `skydive agents list`)"
+	}).positional("token-id", {
+		type: "string",
+		demandOption: true,
+		describe: "Token id (see `skydive agents git token list`)"
+	}),
+	handler: async (argv) => {
+		const client = requireManagementClient(argv);
+		const agent = await resolveAgent(client, argv.agent);
+		const revoked = await client.revokeGitToken(agent.id, argv["token-id"]);
+		if (revoked.isErr()) {
+			printError(`Could not revoke git token ${argv["token-id"]}: ${revoked.error.message}`);
+			process.exit(1);
+		}
+		console.log(`Revoked git token ${argv["token-id"]} for ${agent.name}.`);
+	}
+};
+const gitTokenCommand = {
+	command: "token <command>",
+	describe: "Create, list, or revoke git-proxy tokens for an agent's repo",
+	builder: (y) => y.command(gitTokenCreateCommand).command(gitTokenListCommand).command(gitTokenRevokeCommand).demandCommand(1, "Specify a subcommand: create, list, revoke"),
+	handler: () => {}
+};
+/**
+* `skydive agents git` — git access to an agent's repo from your own machine.
+* The in-sandbox push path (git -> in-sandbox credential helper -> daemon ->
+* git storage) only works inside the sandbox; from a laptop, the supported
+* path is a git-proxy token via the same routes the web settings page uses:
+*
+*   - `git token create <agent>`      create a token and print it.
+*   - `git token list <agent>`        list the agent's tokens by id.
+*   - `git token revoke <agent> <id>` revoke one token.
+*
+* The command's job ends at the credential: it changes nothing on this
+* machine — what to do with the token is the caller's tool's business.
+*/
+const gitCommand = {
+	command: "git <command>",
+	describe: "Git access to an agent's repo from your machine",
+	builder: (y) => y.command(gitTokenCommand).demandCommand(1, "Specify a subcommand: token"),
+	handler: () => {}
+};
+
 //#endregion
 //#region src/commands/agents.ts
 const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
@@ -1065,7 +1400,7 @@ async function resolveAgent(client, selector) {
 	if (matches.length === 0) throw new Error(`No agent named "${selector}". Pass an id, or run \`skydive agents list\`.`);
 	throw new Error(`Multiple agents named "${selector}". Pass the id instead:\n${matches.map((a) => `  ${a.name}  ${a.id}`).join("\n")}`);
 }
-const listCommand$6 = {
+const listCommand$7 = {
 	command: "list",
 	describe: "List agents in the active workspace",
 	builder: (y) => y.option("limit", {
@@ -1286,10 +1621,76 @@ const aliasCommand = {
 		console.log(aliasActivationHint(result));
 	}
 };
+const avatarSetCommand = {
+	command: "set <agent>",
+	describe: "Set an agent's avatar photo (PNG, JPEG, or WebP, max 5 MB)",
+	builder: (y) => y.positional("agent", {
+		type: "string",
+		demandOption: true,
+		describe: "Agent id or name to set the avatar on"
+	}).option("file", {
+		type: "string",
+		demandOption: true,
+		describe: "Path to the image file to upload"
+	}).example("skydive agents avatar set Ripple --file avatar.png", "upload a photo"),
+	handler: async (argv) => {
+		const client = requireManagementClient(argv);
+		const agent = await resolveAgent(client, argv.agent);
+		const result = await client.setAgentAvatar({
+			agentId: agent.id,
+			filePath: argv.file
+		});
+		if (result.isErr()) {
+			printError(result.error.message);
+			process.exit(1);
+		}
+		if (argv.json) {
+			output(argv, {
+				agent: agent.id,
+				avatarUrl: result.value.avatarUrl
+			});
+			return;
+		}
+		if (argv.quiet) {
+			console.log(result.value.avatarUrl);
+			return;
+		}
+		console.log(`Avatar set for ${agent.name}.`);
+	}
+};
+const avatarRemoveCommand = {
+	command: "remove <agent>",
+	describe: "Remove an agent's uploaded avatar (the generated preset takes over)",
+	builder: (y) => y.positional("agent", {
+		type: "string",
+		demandOption: true,
+		describe: "Agent id or name to remove the avatar from"
+	}),
+	handler: async (argv) => {
+		const client = requireManagementClient(argv);
+		const agent = await resolveAgent(client, argv.agent);
+		const result = await client.deleteAgentAvatar(agent.id);
+		if (result.isErr()) {
+			printError(result.error.message);
+			process.exit(1);
+		}
+		if (argv.json) {
+			output(argv, { agent: agent.id });
+			return;
+		}
+		console.log(`Avatar removed for ${agent.name}.`);
+	}
+};
+const avatarCommand = {
+	command: "avatar",
+	describe: "Manage an agent's avatar photo",
+	builder: (y) => y.command(avatarSetCommand).command(avatarRemoveCommand).demandCommand(1, "Specify a subcommand: set, remove"),
+	handler: () => {}
+};
 const agentsCommand = {
 	command: "agents",
 	describe: "Manage agents",
-	builder: (y) => y.command(listCommand$6).command(getCommand$2).command(createCommand$1).command(aliasCommand).demandCommand(1, "Specify a subcommand: list, get, create, alias"),
+	builder: (y) => y.command(listCommand$7).command(getCommand$2).command(createCommand$1).command(aliasCommand).command(gitCommand).command(avatarCommand).demandCommand(1, "Specify a subcommand: list, get, create, alias, git, avatar"),
 	handler: () => {}
 };
 
@@ -1359,7 +1760,7 @@ function isExecutableFile(p) {
 		if (!fs.statSync(p).isFile()) return false;
 		if (process.platform !== "win32") fs.accessSync(p, fs.constants.X_OK);
 		return true;
-	} catch {
+	} catch (_error) {
 		return false;
 	}
 }
@@ -1584,7 +1985,7 @@ const importCommand = {
 				process.exit(1);
 			}
 		}
-		const { runChat } = await import("./boot-D5_QVvwk.mjs");
+		const { runChat } = await import("./boot-DENbHF_1.mjs");
 		await runChat({
 			appUrl,
 			sessionToken: session.value.sessionToken,
@@ -1614,7 +2015,7 @@ async function runImportPrintMode({ argv, appUrl }) {
 		printError(`${session.error.message} For non-interactive use, run \`skydive auth login --web\` first, or set SKYDIVE_SESSION_TOKEN.`);
 		process.exit(1);
 	}
-	const { connectMachineShare } = await import("./print-share-ooQ3IrUT.mjs");
+	const { connectMachineShare } = await import("./print-share-DyV94dRt.mjs");
 	const machineShare = await connectMachineShare({
 		appUrl,
 		sessionToken: session.value.sessionToken,
@@ -1622,7 +2023,7 @@ async function runImportPrintMode({ argv, appUrl }) {
 	});
 	const extra = (argv.print ?? "").trim();
 	const prompt = buildImportSeedPrompt(process.cwd(), machineOsFromPlatform(process.platform)) + (extra ? `\n\nAdditional instructions: ${extra}` : "");
-	const { runPrint } = await import("./print-sWlw3B6z.mjs");
+	const { runPrint } = await import("./print-ClmJYG9P.mjs");
 	try {
 		const result = await runPrint({
 			appUrl,
@@ -1646,11 +2047,13 @@ async function runImportPrintMode({ argv, appUrl }) {
 
 //#endregion
 //#region src/commands/keys.ts
-const listCommand$5 = {
+const listCommand$6 = {
 	command: "list",
 	describe: "List API keys for an agent",
 	handler: async (argv) => {
-		const result = await requireManagementClient(argv).listKeys(argv["agent-id"]);
+		const client = requireManagementClient(argv);
+		const agentId = await resolveTargetAgentId(client, argv.agent ?? argv["agent-id"]);
+		const result = await client.listKeys(agentId);
 		if (result.isErr()) {
 			printError(result.error.message);
 			process.exit(1);
@@ -1686,7 +2089,9 @@ const createCommand = {
 		describe: "Key name"
 	}),
 	handler: async (argv) => {
-		const result = await requireManagementClient(argv).createKey(argv["agent-id"], argv.name);
+		const client = requireManagementClient(argv);
+		const agentId = await resolveTargetAgentId(client, argv.agent ?? argv["agent-id"]);
+		const result = await client.createKey(agentId, argv.name);
 		if (result.isErr()) {
 			printError(result.error.message);
 			process.exit(1);
@@ -1716,7 +2121,9 @@ const revokeCommand$1 = {
 		describe: "Key ID"
 	}),
 	handler: async (argv) => {
-		const result = await requireManagementClient(argv).revokeKey(argv["agent-id"], argv.id);
+		const client = requireManagementClient(argv);
+		const agentId = await resolveTargetAgentId(client, argv.agent ?? argv["agent-id"]);
+		const result = await client.revokeKey(agentId, argv.id);
 		if (result.isErr()) {
 			printError(result.error.message);
 			process.exit(1);
@@ -1731,11 +2138,13 @@ const revokeCommand$1 = {
 const keysCommand = {
 	command: "keys",
 	describe: "Manage API keys for an agent",
-	builder: (y) => y.option("agent-id", {
+	builder: (y) => y.option("agent", {
 		type: "string",
-		demandOption: true,
-		describe: "Agent ID"
-	}).command(listCommand$5).command(createCommand).command(revokeCommand$1).demandCommand(1, "Specify a subcommand: list, create, revoke"),
+		describe: "Target agent, by id or name (e.g. --agent my-agent)"
+	}).option("agent-id", {
+		type: "string",
+		describe: "Target agent id (legacy; prefer --agent)"
+	}).command(listCommand$6).command(createCommand).command(revokeCommand$1).demandCommand(1, "Specify a subcommand: list, create, revoke"),
 	handler: () => {}
 };
 
@@ -1747,11 +2156,13 @@ async function readStdin() {
 	for await (const chunk of process.stdin) chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
 	return Buffer.concat(chunks).toString("utf8").replace(/\n$/, "");
 }
-const listCommand$4 = {
+const listCommand$5 = {
 	command: "list",
 	describe: "List secret names for an agent (values are never shown)",
 	handler: async (argv) => {
-		const result = await requireManagementClient(argv).listSecrets(argv["agent-id"]);
+		const client = requireManagementClient(argv);
+		const agentId = await resolveTargetAgentId(client, argv.agent ?? argv["agent-id"]);
+		const result = await client.listSecrets(agentId);
 		if (result.isErr()) {
 			printError(result.error.message);
 			process.exit(1);
@@ -1792,7 +2203,9 @@ const setCommand$1 = {
 			printError("Empty secret value.");
 			process.exit(1);
 		}
-		const result = await requireManagementClient(argv).setSecret(argv["agent-id"], argv.key, value);
+		const client = requireManagementClient(argv);
+		const agentId = await resolveTargetAgentId(client, argv.agent ?? argv["agent-id"]);
+		const result = await client.setSecret(agentId, argv.key, value);
 		if (result.isErr()) {
 			printError(result.error.message);
 			process.exit(1);
@@ -1814,7 +2227,9 @@ const rmCommand = {
 		describe: "Secret name"
 	}),
 	handler: async (argv) => {
-		const result = await requireManagementClient(argv).deleteSecret(argv["agent-id"], argv.key);
+		const client = requireManagementClient(argv);
+		const agentId = await resolveTargetAgentId(client, argv.agent ?? argv["agent-id"]);
+		const result = await client.deleteSecret(agentId, argv.key);
 		if (result.isErr()) {
 			printError(result.error.message);
 			process.exit(1);
@@ -1829,11 +2244,13 @@ const rmCommand = {
 const secretsCommand = {
 	command: "secrets",
 	describe: "Manage an agent’s secrets",
-	builder: (y) => y.option("agent-id", {
+	builder: (y) => y.option("agent", {
 		type: "string",
-		demandOption: true,
-		describe: "Agent ID"
-	}).command(listCommand$4).command(setCommand$1).command(rmCommand).demandCommand(1, "Specify a subcommand: list, set, rm"),
+		describe: "Target agent, by id or name (e.g. --agent my-agent)"
+	}).option("agent-id", {
+		type: "string",
+		describe: "Target agent id (legacy; prefer --agent)"
+	}).command(listCommand$5).command(setCommand$1).command(rmCommand).demandCommand(1, "Specify a subcommand: list, set, rm"),
 	handler: () => {}
 };
 
@@ -2029,7 +2446,7 @@ const chatCommand = {
 			sessionToken: auth.value.token,
 			agentSelector: argv.agent ?? null
 		});
-		const { runChat } = await import("./boot-D5_QVvwk.mjs");
+		const { runChat } = await import("./boot-DENbHF_1.mjs");
 		await runChat({
 			appUrl: auth.value.appUrl,
 			sessionToken: auth.value.token,
@@ -2113,7 +2530,7 @@ async function runPrintMode({ argv, appUrl }) {
 		printError(`${auth.error.message} For non-interactive use, run \`skydive auth login\` first, or set SKYDIVE_API_KEY / SKYDIVE_SESSION_TOKEN.`);
 		process.exit(1);
 	}
-	const { runPrint, readStdin } = await import("./print-sWlw3B6z.mjs");
+	const { runPrint, readStdin } = await import("./print-ClmJYG9P.mjs");
 	const workspaceId = await resolveWorkspaceFlag({
 		appUrl,
 		sessionToken: auth.value.token,
@@ -2143,7 +2560,7 @@ async function runPrintMode({ argv, appUrl }) {
 			process.exit(1);
 		}
 	} else {
-		const { connectMachineShare } = await import("./print-share-ooQ3IrUT.mjs");
+		const { connectMachineShare } = await import("./print-share-DyV94dRt.mjs");
 		machineShare = await connectMachineShare({
 			appUrl: auth.value.appUrl,
 			sessionToken: auth.value.token,
@@ -2208,7 +2625,7 @@ const getCommand$1 = {
 			printError(`${auth.error.message} Run \`skydive auth login\` first, or set SKYDIVE_API_KEY / SKYDIVE_SESSION_TOKEN.`);
 			process.exit(1);
 		}
-		const { messageGet } = await import("./print-sWlw3B6z.mjs");
+		const { messageGet } = await import("./print-ClmJYG9P.mjs");
 		try {
 			const result = await messageGet({
 				appUrl: auth.value.appUrl,
@@ -2255,7 +2672,7 @@ function messageToText(message) {
 	}
 	return chunks.join("\n").trim();
 }
-const listCommand$3 = {
+const listCommand$4 = {
 	command: "list",
 	describe: "List an agent's conversations",
 	builder: (y) => y.option("agent", {
@@ -2345,7 +2762,7 @@ const conversationsCommand = {
 	command: "conversations",
 	aliases: ["conv"],
 	describe: "List and read agent conversations",
-	builder: (y) => y.command(listCommand$3).command(showCommand).demandCommand(1, "Specify a subcommand: list, show"),
+	builder: (y) => y.command(listCommand$4).command(showCommand).demandCommand(1, "Specify a subcommand: list, show"),
 	handler: () => {}
 };
 
@@ -2387,7 +2804,7 @@ async function runList(argv, { hint }) {
 	]));
 	if (hint && !argv.quiet) console.log("\nRun `skydive workspace switch` to pick a workspace, or pass its slug directly.");
 }
-const listCommand$2 = {
+const listCommand$3 = {
 	command: "list",
 	describe: "List workspaces on your account",
 	handler: (argv) => runList(argv, { hint: false })
@@ -2411,7 +2828,7 @@ const switchCommand = {
 				printError("The workspace picker needs the Bun runtime and it could not be set up automatically. Pass a workspace slug instead, or install Bun and retry.");
 				process.exit(1);
 			}
-			const { runWorkspacePicker } = await import("./boot-D5_QVvwk.mjs");
+			const { runWorkspacePicker } = await import("./boot-DENbHF_1.mjs");
 			await runWorkspacePicker(session);
 			return;
 		}
@@ -2444,7 +2861,7 @@ const switchCommand = {
 const workspaceCommand = {
 	command: "workspace",
 	describe: "List or switch the workspace all `skydive` commands act on",
-	builder: (y) => y.command(listCommand$2).command(switchCommand),
+	builder: (y) => y.command(listCommand$3).command(switchCommand),
 	handler: (argv) => runList(argv, { hint: true })
 };
 
@@ -2490,7 +2907,7 @@ const openCommand = {
 		const agent = argv.agent ? resolveAgent$1((await fetchPortalDevices(session)).agents, argv.agent) : null;
 		const cwd = argv.cwd ? path.resolve(argv.cwd) : process.cwd();
 		const { machineName } = await resolveMachineIdentity(null);
-		const { PortalDaemonClient } = await import("./daemon-client-CkU1-t5_.mjs");
+		const { PortalDaemonClient } = await import("./daemon-client-DG7VEYbY.mjs");
 		let lastLine = "";
 		let signalConnected;
 		const connected = new Promise((resolve) => {
@@ -2844,11 +3261,14 @@ const sandboxCommand = {
 		type: "string",
 		array: true,
 		describe: "Command to run one-shot (streams output, exits with its exit code). Omit for a live interactive terminal. Put it after `--` if it has flags of its own."
+	}).option("timeout", {
+		type: "number",
+		describe: `One-shot commands: kill the command after this many seconds. Without it the server default (~${Math.round(DEFAULT_EXEC_TIMEOUT_MS / 6e4)} min) applies.`
 	}).example("skydive sandbox --agent grace", "Live terminal (Ctrl-] detaches)").example("skydive sandbox --agent grace -- tail -n 50 /tmp/harness.log", "One-shot command (use `--` so its flags reach the sandbox)").example("skydive sandbox --agent grace -- sh -c 'ls /tmp | wc -l'", "Shell features go through an explicit `sh -c`"),
 	handler: async (argv) => {
 		const session = requireSession(argv);
-		const { createRestClient } = await import("./rest-8DCRRen0.mjs");
-		const { resolveAgent } = await import("./print-sWlw3B6z.mjs");
+		const { createRestClient } = await import("./rest-DnbZKhDh.mjs");
+		const { resolveAgent } = await import("./print-ClmJYG9P.mjs");
 		const client = createRestClient({
 			appUrl: session.appUrl,
 			sessionToken: session.sessionToken
@@ -2864,10 +3284,20 @@ const sandboxCommand = {
 			process.exit(1);
 		}
 		const command = joinCommandWords([...argv.command ?? [], ...argv["--"] ?? []]);
+		if (argv.timeout !== void 0 && !command) {
+			printError("--timeout applies to a one-shot command; pass one after `--`.");
+			process.exit(1);
+		}
+		if (argv.timeout !== void 0 && (!Number.isFinite(argv.timeout) || argv.timeout <= 0)) {
+			printError("--timeout must be a positive number of seconds.");
+			process.exit(1);
+		}
+		const timeoutMs = argv.timeout !== void 0 ? Math.round(argv.timeout * 1e3) : void 0;
 		const code = command ? await runExec({
 			session,
 			agentId: agent.id,
-			command
+			command,
+			timeoutMs
 		}) : await runPty({
 			session,
 			agentId: agent.id,
@@ -2877,18 +3307,19 @@ const sandboxCommand = {
 	}
 };
 /** One-shot exec: stream output to stdout, resolve to the command's exit code. */
-function runExec({ session, agentId, command }) {
+function runExec({ session, agentId, command, timeoutMs }) {
 	console.error("Connecting to the sandbox…");
 	return new Promise((resolve) => {
 		const finish = (code) => {
 			process.stdout.write("", () => resolve(code));
 		};
-		SandboxStream.open({
+		const stream = SandboxStream.open({
 			mode: "exec",
 			appUrl: session.appUrl,
 			sessionToken: session.sessionToken,
 			agentId,
 			command,
+			...timeoutMs !== void 0 ? { timeoutMs } : {},
 			onEvent: (e) => {
 				switch (e.type) {
 					case "data":
@@ -2906,10 +3337,45 @@ function runExec({ session, agentId, command }) {
 						finish(1);
 						break;
 				}
+				stopStdinForwarding();
 			}
 		});
+		forwardStdinToStream({
+			stdin: process.stdin,
+			stream
+		});
 	});
 }
+const STDIN_EOF_INPUT = new Uint8Array(0);
+let forwardingStdin = null;
+/**
+* Forward the caller's stdin into the sandbox stream as INPUT frames (one per
+* stdin chunk; an empty payload marks end-of-stdin so the remote command gets
+* a real EOF — `sh -c 'cat > file'` finishes instead of hanging). Nothing is
+* forwarded when stdin is already closed (no pipe, nothing piped in), which
+* keeps the plain scripted case exactly where it was.
+*/
+function forwardStdinToStream({ stdin, stream }) {
+	if (stdin.readableEnded || stdin.destroyed) return;
+	const onData = (chunk) => stream.sendInput(new Uint8Array(chunk));
+	const onEnd = () => stream.sendInput(STDIN_EOF_INPUT);
+	forwardingStdin = {
+		stdin,
+		onData,
+		onEnd
+	};
+	stdin.on("data", onData);
+	stdin.once("end", onEnd);
+	stdin.resume();
+}
+/** Stop forwarding stdin (on a terminal stream event) without killing reads. */
+function stopStdinForwarding() {
+	const current = forwardingStdin;
+	if (!current) return;
+	forwardingStdin = null;
+	current.stdin.off("data", current.onData);
+	current.stdin.off("end", current.onEnd);
+}
 /** Live terminal on the caller's real TTY. */
 async function runPty({ session, agentId, agentName }) {
 	if (!process.stdin.isTTY || !process.stdout.isTTY) {
@@ -2917,7 +3383,7 @@ async function runPty({ session, agentId, agentName }) {
 		return 1;
 	}
 	console.error(`Connecting to ${agentName}'s sandbox… (Ctrl-] detaches)`);
-	const { runRawPtyPassthrough } = await import("./raw-pty-DRZuf1oW.mjs");
+	const { runRawPtyPassthrough } = await import("./raw-pty-BJIs_xjQ.mjs");
 	const result = await runRawPtyPassthrough({
 		stdin: process.stdin,
 		stdout: process.stdout,
@@ -3088,6 +3554,53 @@ function resolveEditor(override, env, platform = process.platform) {
 	};
 }
 /**
+* Resolve the target agent and open the multiplexed fs channel to its
+* sandbox. Shared by every `fs` subcommand. A failed agent listing or a
+* failed upgrade (expired session, an agent the caller can't edit, or the
+* `sandbox-fs-enabled` kill switch) exits here before any file work.
+*/
+async function openAgentFs(session, agentSelector) {
+	const { createRestClient } = await import("./rest-DnbZKhDh.mjs");
+	const { resolveAgent } = await import("./print-ClmJYG9P.mjs");
+	let agent;
+	try {
+		agent = resolveAgent(await createRestClient({
+			appUrl: session.appUrl,
+			sessionToken: session.sessionToken
+		}).listAgents({
+			scope: "org",
+			onPage: null
+		}), agentSelector);
+	} catch (error) {
+		printError(error instanceof Error ? error.message : String(error));
+		process.exit(1);
+	}
+	let fs;
+	try {
+		fs = await SandboxFsClient.connect({
+			appUrl: session.appUrl,
+			sessionToken: session.sessionToken,
+			agentId: agent.id
+		});
+	} catch (error) {
+		printError(`Could not open the sandbox filesystem channel: ${error instanceof Error ? error.message : String(error)}`);
+		process.exit(1);
+	}
+	return {
+		agent,
+		fs
+	};
+}
+/**
+* The oversized-file error for `fs put` and `fs cp`. The fs channel's write
+* op is whole-file only (no offset or append), so the CLI cannot chunk a
+* file larger than the relay's per-write cap — the web Files tab is the path
+* for those.
+*/
+function oversizeWriteError(label, size) {
+	return `${label} is ${size} bytes, over the ${Math.floor(FS_MAX_BLOB_BYTES / (1024 * 1024))}MB per-write cap of the sandbox filesystem channel. Upload larger files through the Files tab in the web app instead.`;
+}
+/**
 * `skydive fs edit <path>` — edit a file that lives on the agent's computer
 * (its sandbox) with your LOCAL editor. It reads the remote file down over the
 * multiplexed `fs` sandbox-stream channel, opens it in `$EDITOR`, and writes
@@ -3119,33 +3632,7 @@ const fsEditCommand = {
 	handler: async (argv) => {
 		const session = requireSession(argv);
 		const remotePath = argv.path;
-		const { createRestClient } = await import("./rest-8DCRRen0.mjs");
-		const { resolveAgent } = await import("./print-sWlw3B6z.mjs");
-		const client = createRestClient({
-			appUrl: session.appUrl,
-			sessionToken: session.sessionToken
-		});
-		let agent;
-		try {
-			agent = resolveAgent(await client.listAgents({
-				scope: "org",
-				onPage: null
-			}), argv.agent ?? null);
-		} catch (error) {
-			printError(error instanceof Error ? error.message : String(error));
-			process.exit(1);
-		}
-		let fs;
-		try {
-			fs = await SandboxFsClient.connect({
-				appUrl: session.appUrl,
-				sessionToken: session.sessionToken,
-				agentId: agent.id
-			});
-		} catch (error) {
-			printError(`Could not open the sandbox filesystem channel: ${error instanceof Error ? error.message : String(error)}`);
-			process.exit(1);
-		}
+		const { agent, fs } = await openAgentFs(session, argv.agent ?? null);
 		const cleanup = async (dir) => {
 			await rm(dir, {
 				recursive: true,
@@ -3210,21 +3697,157 @@ function openEditor(override, file) {
 	});
 }
 /**
+* Upload a local file to a path on the agent's sandbox in one `write` op.
+* The relay caps a single write's payload at {@link FS_MAX_BLOB_BYTES} and the
+* write op is whole-file only (no offset/append), so a larger file is
+* rejected up front with a pointer to the web Files tab rather than a
+* truncated or partial upload.
+*/
+const fsPutCommand = {
+	command: "put <agent> <local-file> <remote-path>",
+	describe: "Copy a file from your machine onto the agent's sandbox",
+	builder: (y) => y.positional("agent", {
+		type: "string",
+		demandOption: true,
+		describe: "Target agent, by id, slug, or name"
+	}).positional("local-file", {
+		type: "string",
+		demandOption: true,
+		describe: "Path of the file on your machine to upload"
+	}).positional("remote-path", {
+		type: "string",
+		demandOption: true,
+		describe: "Absolute or sandbox-relative path to write it to"
+	}).example("skydive fs put grace ./report.pdf /home/user/Downloads/report.pdf", "Upload a local file to the sandbox"),
+	handler: async (argv) => {
+		const { fs } = await openAgentFs(requireSession(argv), argv.agent ?? null);
+		try {
+			const localStat = await stat(argv["local-file"]);
+			if (localStat.isDirectory()) {
+				printError(`${argv["local-file"]} is a directory; fs put copies a single file.`);
+				process.exit(1);
+			}
+			if (localStat.size > FS_MAX_BLOB_BYTES) {
+				printError(oversizeWriteError(argv["local-file"], localStat.size));
+				process.exit(1);
+			}
+			const bytes = await readFile(argv["local-file"]);
+			await fs.write(argv["remote-path"], new Uint8Array(bytes));
+			fs.close();
+		} catch (error) {
+			fs.close();
+			printError(error instanceof Error ? error.message : String(error));
+			process.exit(1);
+		}
+	}
+};
+/**
+* Download a file from the agent's sandbox to a local path. Reads are
+* range-based, so a file of any size comes down in chunks of
+* {@link FS_MAX_BLOB_BYTES}; the chunks are concatenated into one local
+* write. Silent on success so it composes in scripts (exit code carries the
+* result).
+*/
+const fsGetCommand = {
+	command: "get <agent> <remote-path> <local-path>",
+	describe: "Copy a file from the agent's sandbox onto your machine",
+	builder: (y) => y.positional("agent", {
+		type: "string",
+		demandOption: true,
+		describe: "Target agent, by id, slug, or name"
+	}).positional("remote-path", {
+		type: "string",
+		demandOption: true,
+		describe: "Absolute or sandbox-relative path of the file to download"
+	}).positional("local-path", {
+		type: "string",
+		demandOption: true,
+		describe: "Path on your machine to write it to"
+	}).example("skydive fs get grace /home/user/.self/soul.md ./soul.md", "Download a file from the sandbox"),
+	handler: async (argv) => {
+		const { fs } = await openAgentFs(requireSession(argv), argv.agent ?? null);
+		try {
+			const remoteStat = await fs.stat(argv["remote-path"]);
+			if (remoteStat.type === "dir") {
+				printError(`${argv["remote-path"]} is a directory; fs get copies a single file.`);
+				process.exit(1);
+			}
+			const chunks = [];
+			for (let offset = 0; offset < remoteStat.size; offset += FS_MAX_BLOB_BYTES) chunks.push(await fs.read(argv["remote-path"], {
+				offset,
+				length: FS_MAX_BLOB_BYTES
+			}));
+			await writeFile(argv["local-path"], Buffer.concat(chunks));
+			fs.close();
+		} catch (error) {
+			fs.close();
+			printError(error instanceof Error ? error.message : String(error));
+			process.exit(1);
+		}
+	}
+};
+/**
+* Copy a file from one sandbox path to another, via one read and one write.
+* Same per-write cap as `fs put`: the write op is whole-file only, so a
+* source larger than {@link FS_MAX_BLOB_BYTES} is rejected up front.
+*/
+const fsCpCommand = {
+	command: "cp <agent> <src> <dst>",
+	describe: "Copy a file to another path inside the agent's sandbox",
+	builder: (y) => y.positional("agent", {
+		type: "string",
+		demandOption: true,
+		describe: "Target agent, by id, slug, or name"
+	}).positional("src", {
+		type: "string",
+		demandOption: true,
+		describe: "Absolute or sandbox-relative path of the file to copy"
+	}).positional("dst", {
+		type: "string",
+		demandOption: true,
+		describe: "Absolute or sandbox-relative path to copy it to"
+	}).example("skydive fs cp grace /tmp/notes.md /home/user/.self/notes.md", "Copy a file within the sandbox"),
+	handler: async (argv) => {
+		const { fs } = await openAgentFs(requireSession(argv), argv.agent ?? null);
+		try {
+			const srcStat = await fs.stat(argv.src);
+			if (srcStat.type === "dir") {
+				printError(`${argv.src} is a directory; fs cp copies a single file.`);
+				process.exit(1);
+			}
+			if (srcStat.size > FS_MAX_BLOB_BYTES) {
+				printError(oversizeWriteError(argv.src, srcStat.size));
+				process.exit(1);
+			}
+			const bytes = await fs.read(argv.src, null);
+			await fs.write(argv.dst, bytes);
+			fs.close();
+		} catch (error) {
+			fs.close();
+			printError(error instanceof Error ? error.message : String(error));
+			process.exit(1);
+		}
+	}
+};
+/**
 * `skydive fs` — work with the files on an agent's computer (its sandbox) from
 * your own machine. The namespace for filesystem access:
 *
-*   - `fs edit <path>`  edit one remote file with your local editor (shipped).
+*   - `fs edit <path>`  edit one remote file with your local editor.
+*   - `fs put ...`      upload a local file to the sandbox.
+*   - `fs get ...`      download a sandbox file to your machine.
+*   - `fs cp ...`       copy a file within the sandbox.
 *   - `fs mount <dir>`  mount the whole sandbox filesystem locally (coming in a
 *                       later PR, on the same first-class `fs` relay channel).
 *
 * Grouping these under one command keeps the file surface discoverable and
-* leaves room to grow (`fs ls`, `fs cat`, `fs pull`) without adding more
-* top-level commands.
+* leaves room to grow (`fs ls`, `fs cat`) without adding more top-level
+* commands.
 */
 const fsCommand = {
 	command: "fs <command>",
 	describe: "Work with the files on an agent's computer (its sandbox)",
-	builder: (y) => y.command(fsEditCommand).demandCommand(1, "Specify a subcommand: edit"),
+	builder: (y) => y.command(fsEditCommand).command(fsPutCommand).command(fsGetCommand).command(fsCpCommand).demandCommand(1, "Specify a subcommand: edit, put, get, cp"),
 	handler: () => {}
 };
 
@@ -3782,7 +4405,8 @@ async function offerPackageManagerUpdate(opts) {
 function relaunchCli(argv = process.argv) {
 	try {
 		const [, script, ...rest] = argv;
-		spawn(process.execPath, script ? [script, ...rest] : rest, { stdio: "inherit" }).on("exit", (code) => process.exit(code ?? 0));
+		const args = script?.startsWith("/$bunfs/") ? rest : script ? [script, ...rest] : rest;
+		spawn(process.execPath, args, { stdio: "inherit" }).on("exit", (code) => process.exit(code ?? 0));
 	} catch (_error) {
 		process.exit(0);
 	}
@@ -3951,7 +4575,7 @@ function snapshot(pref) {
 		describe: pref.describe
 	};
 }
-const listCommand$1 = {
+const listCommand$2 = {
 	command: "list",
 	aliases: ["ls"],
 	describe: "Show every editable preference, its value, and its source",
@@ -4056,8 +4680,162 @@ const pathCommand$1 = {
 const configCommand = {
 	command: "config",
 	describe: "View and set CLI preferences (safe, hand-editable keys only)",
-	builder: (y) => y.command(listCommand$1).command(getCommand).command(setCommand).command(unsetCommand).command(pathCommand$1),
-	handler: (argv) => listCommand$1.handler(argv)
+	builder: (y) => y.command(listCommand$2).command(getCommand).command(setCommand).command(unsetCommand).command(pathCommand$1),
+	handler: (argv) => listCommand$2.handler(argv)
+};
+
+//#endregion
+//#region src/commands/proxy.ts
+/**
+* `skydive proxy skip-list` — manage the sandbox egress proxy's custom skip
+* list. The agent-visible verbs are `skip-list add <host…>` / `skip-list
+* remove <host…>`; a bare `skip-list` lists what is currently skipped.
+*
+* Skipped hosts leave the sandbox RAW: the mitmproxy addon forwards them
+* without rewriting through the transparent proxy, which means NO platform
+* credential injection (that's the point — a user's own API keys go straight
+* to the provider), but also no agent rules, no content policy, no billing
+* gate, and no platform-side record of the egress.
+*
+* Config is agent-scoped runtime state: it lives in the in-sandbox daemon's
+* env and survives daemon restarts and pause/resume, but resets on a fresh
+* box (a new sandbox cold-create starts with the addon's built-in defaults
+* only). Platform control-plane hosts can never be skipped.
+*
+* Loopback-only daemon routes: this command only works INSIDE a sandbox
+* (where the egress proxy actually runs).
+*/
+const DAEMON_BASE_URL = process.env["SKYDIVE_DAEMON_URL"] ?? "http://localhost:38994";
+async function daemonFetch(path, init) {
+	try {
+		const res = await fetch(`${DAEMON_BASE_URL}${path}`, {
+			...init,
+			headers: {
+				"Content-Type": "application/json",
+				...init?.headers
+			}
+		});
+		const parsed = z.object({
+			hosts: z.array(z.string()).optional(),
+			error: z.string().optional()
+		}).safeParse(await res.json().catch((_error) => ({})));
+		const body = parsed.success ? parsed.data : {};
+		return {
+			status: res.status,
+			body
+		};
+	} catch (err) {
+		return {
+			status: 0,
+			body: { error: `Could not reach the sandbox daemon at ${DAEMON_BASE_URL}. This command only works inside a sandbox. (${err instanceof Error ? err.message : String(err)})` }
+		};
+	}
+}
+function printHosts(argv, hosts) {
+	if (argv.json) {
+		output(argv, { hosts });
+		return;
+	}
+	if (hosts.length === 0) {
+		console.log("No custom skip hosts. (Platform defaults still apply.)");
+		return;
+	}
+	printTable(["Host"], hosts.map((h) => [h]));
+}
+const listCommand$1 = {
+	command: "list",
+	aliases: ["ls"],
+	describe: "Show the custom proxy skip hosts (same as bare `skip-list`)",
+	handler: async (argv) => {
+		const { status, body } = await daemonFetch("/v1/proxy/skip-list", null);
+		if (status !== 200) {
+			printError(body.error ?? `daemon /v1/proxy/skip-list: ${status}`);
+			process.exit(1);
+		}
+		printHosts(argv, body.hosts ?? []);
+	}
+};
+const addCommand = {
+	command: "add <hosts..>",
+	describe: "Skip the proxy for exact host(s). Their traffic leaves the sandbox RAW: no platform credential injection, no agent rules, no billing gate.",
+	builder: (y) => y.positional("hosts", {
+		type: "string",
+		array: true,
+		demandOption: true,
+		describe: "One or more exact hostnames (api.example.com), no wildcards"
+	}),
+	handler: async (argv) => {
+		for (const host of argv.hosts) {
+			const { status, body } = await daemonFetch("/v1/proxy/skip-list/add", {
+				method: "POST",
+				body: JSON.stringify({ host })
+			});
+			if (status === 0) {
+				printError(body.error ?? `daemon unreachable (host ${host})`);
+				process.exitCode = 1;
+				continue;
+			}
+			if (status !== 200) {
+				printError(`${host}: ${body.error ?? status}`);
+				process.exitCode = 1;
+				continue;
+			}
+			if (argv.json) output(argv, {
+				host,
+				hosts: body.hosts ?? []
+			});
+			else console.log(`${host} is now skipped: requests to it leave the sandbox raw (no platform credential injection).`);
+		}
+	}
+};
+const removeCommand = {
+	command: "remove <hosts..>",
+	aliases: ["rm"],
+	describe: "Remove host(s) from the custom skip list",
+	builder: (y) => y.positional("hosts", {
+		type: "string",
+		array: true,
+		demandOption: true,
+		describe: "Exact hostnames to remove"
+	}),
+	handler: async (argv) => {
+		for (const host of argv.hosts) {
+			const { status, body } = await daemonFetch("/v1/proxy/skip-list/remove", {
+				method: "POST",
+				body: JSON.stringify({ host })
+			});
+			if (status === 0) {
+				printError(body.error ?? `daemon unreachable (host ${host})`);
+				process.exitCode = 1;
+				continue;
+			}
+			if (status !== 200) {
+				printError(`${host}: ${body.error ?? status}`);
+				process.exitCode = 1;
+				continue;
+			}
+			if (argv.json) output(argv, {
+				host,
+				hosts: body.hosts ?? []
+			});
+			else console.log(`${host} removed from the skip list.`);
+		}
+	}
+};
+/** `skydive proxy skip-list` — no subcommand lists; add/remove mutate. */
+const skipListCommand = {
+	command: "skip-list [command]",
+	describe: "Manage hosts that bypass the egress proxy",
+	builder: (y) => y.command(listCommand$1).command(addCommand).command(removeCommand).default("command", "list"),
+	handler: async (argv) => {
+		if (argv.command === "list" || argv.command === "ls") await listCommand$1.handler(argv);
+	}
+};
+const proxyCommand = {
+	command: "proxy <command>",
+	describe: "Inspect and configure the sandbox egress proxy",
+	builder: (y) => y.command(skipListCommand).demandCommand(1, "Run `skydive proxy skip-list`"),
+	handler: () => {}
 };
 
 //#endregion
@@ -4114,7 +4892,7 @@ async function offerIssueReport(archivePath) {
 			console.log(`File an issue: ${ISSUE_REPOSITORY_URL}`);
 			return;
 		}
-		await open(issueUrl(archivePath));
+		await open$1(issueUrl(archivePath));
 		console.log(`Attach the diagnostics archive: ${archivePath}`);
 	} finally {
 		prompt.close();
@@ -4217,7 +4995,7 @@ function createCli(argv) {
 		type: "string",
 		global: true,
 		describe: "Override API base URL"
-	}).command(authCommand).command(chatCommand).command(messagesCommand).command(conversationsCommand).command(agentsCommand).command(importCommand).command(keysCommand).command(secretsCommand).command(workspaceCommand).command(portalCommand).command(sandboxCommand).command(fsCommand).command(updateCommand).command(configCommand).command(logsCommand).command(completionCommand).demandCommand(1, "Specify a command. Run --help for usage.").strict().wrap(null).version(version).alias("v", "version").alias("h", "help").help().fail((msg, err) => {
+	}).command(authCommand).command(chatCommand).command(messagesCommand).command(conversationsCommand).command(agentsCommand).command(importCommand).command(keysCommand).command(secretsCommand).command(workspaceCommand).command(portalCommand).command(sandboxCommand).command(fsCommand).command(updateCommand).command(configCommand).command(proxyCommand).command(logsCommand).command(completionCommand).demandCommand(1, "Specify a command. Run --help for usage.").strict().wrap(null).version(version).alias("v", "version").alias("h", "help").help().fail((msg, err) => {
 		printError(err ? err instanceof Error ? err.message : String(err) : msg ?? "Unknown error");
 		process.exit(1);
 	});
@@ -4430,7 +5208,7 @@ function setupUpdateCheck(argv) {
 
 //#endregion
 //#region src/changelog.generated.ts
-const CHANGELOG_MD = "# Changelog\n\nAll notable changes to the Skydive CLI are documented here.\n\nThe format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),\nand this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).\n\n## [Unreleased]\n\n### Changed\n\n- The chat TUI status bar now always shows where the portal stands, instead of only lighting up once everything already worked. It reads `portal off`, `portal connecting`, `portal on` (open on this machine, but this agent has no grant), `portal shared` (green — this agent can run commands here), `portal error`, or `portal unavailable` when you signed in with an API key and no portal is possible. Previously the badge rendered nothing in every one of those states, so \"why can't the agent reach my machine?\" had no answer on screen.\n- One word for that feature across the whole CLI: **portal**. The footer hint is now `ctrl+t portal` / `ctrl+t close portal` (was `local access` / `revoke access`), `/status` reports a `portal` row (was `local access`), and `/share` and `/portal` describe themselves as opening the portal and granting an agent access to your machine. `/portal` used to say \"access your computer\", which collided with `/computer` — that command still means the **agent's** sandbox, and \"computer\" stays reserved for it. `--share-machine` and the `shareMachineDefault` config key are unchanged.\n- `npm i -g skydive-cli` (and yarn/pnpm/bun) now installs a tiny launcher plus one prebuilt, os/cpu-matched binary that carries its own runtime — so on the common platforms `skydive chat` and `skydive import` start instantly and **do not download a Bun runtime on first use**. On any platform without a prebuilt binary (or if the optional dependency is skipped), the CLI automatically falls back to the existing behavior: it runs under your Node and provisions Bun on first `chat`, exactly as before. Nothing about the commands, flags, config, or `SKYDIVE_*` environment variables changes, and `skydive update` still upgrades npm installs via your package manager and standalone-binary installs in place.\n\n### Added\n\n- Files an agent shares into the conversation now show as a saveable row in the chat TUI. When the agent sends you a file (a report, an export, a screenshot), it appears as a `📎` row with the filename and size and a \"click to save\" hint; clicking it downloads the file to your `~/Downloads` (falling back to your home directory) and opens it with your default app, then the row shows where it landed. Clicking a saved row again re-opens it. Previously these files were only reachable in the web app — in the terminal they were invisible.\n- `platform ask` forms now render in the chat TUI. The card lists each question with lettered options (A/B/C/D plus Other); `ctrl+r` opens a full overlay picker (one question at a time, arrows + enter, Other as a typed row — the Claude Code interaction). The answer sends as a normal message. Headless `chat -p` prints the question as an `[action needed]` block instead of dropping it.\n- Every API request now reports this install's version (`x-skydive-cli-version`) so the server can refuse features the installed CLI cannot render — `platform ask` needs the #21411 canary (`0.5.0-beta.43` or newer), not 0.4.0 and not earlier 0.5.0 betas.\n- `/search` (alias `/find`) in the chat TUI — opens the conversation picker with its search field focused, so \"find a conversation\" has a discoverable command instead of being a feature you had to know the bare picker already had. Pass a query inline (`/search billing deep dive`) and the picker opens already narrowed to the matches; bare `/search` opens it ready for you to type. The search runs server-side across conversation titles, message bodies, and participant names, the same search the picker exposes.\n- First run in a workspace with no agents now sets you up automatically: instead of dropping you on an empty agent picker, `skydive` creates your first agent for you (with a suggested name and avatar, mirroring the web onboarding flow) and then offers to have it learn how you already work — reading the other coding agents set up on your machine (Claude Code, Cursor, Codex, and more), the same import that `skydive import` runs, with a plan shown first and credentials never copied. Decline and you go straight into the new agent's chat. You can replay this flow anytime with `skydive --onboarding` (or `SKYDIVE_FORCE_ONBOARDING=1`), even in a workspace that already has agents.\n- `/computer` in the chat TUI — a snapshot of the agent's sandbox drawn as colored bar graphs: CPU, memory, and disk usage. Bars turn amber past 75%% and red past 90%% so a glance tells you whether the box is under pressure. The numbers come from the Skydive API (the same live resource sample the web computer view reads), not by connecting to the sandbox — so the card shows instantly, never waking or hanging on a box that isn't running: when the agent has no live sandbox it simply reads \"no sandbox running\". The card keeps itself current quietly (a slow background refresh, no flicker or \"updating\" chrome); only the most recent card refreshes, and it silently stops while you're scrolled up (no wasted polls on a card you're not looking at) and resumes at the bottom.\n- `/computer restart` in the chat TUI — reboot the agent's sandbox from chat. It asks a `y`/`n` confirm first (the restart stops whatever run is going and brings up a fresh box), then enqueues the same restart the web \"Restart\" control does. Available to anyone with edit access to the agent; view-only members are told they can't.\n- `skydive fs` — a namespace for working with the files on an agent's computer (its sandbox) from your own machine. Its first subcommand, `skydive fs edit <path>`, reads a remote file down over the same relay `skydive sandbox` uses, opens it in your local editor (`$VISUAL`/`$EDITOR`, override with `--editor`, defaults to `vi`), and writes your changes back atomically when you save and close — so you can edit a remote file as if it were local without opening the chat TUI. A path that doesn't exist yet is created on save; no changes means nothing is written. Access is gated on EDIT permission for the agent, exactly like `skydive sandbox`. (A first-class `fs` relay channel and `skydive fs mount` land in follow-ups.)\n\n## [0.4.0] - 2026-08-07\n\n### Added\n\n- `skydive chat` works with API key auth: an API key alone now opens the chat TUI (and headless `chat -p`) without a browser login, using the key's pinned workspace.\n- `skydive config` command to view and set the safe, hand-editable CLI preferences (`shareMachineDefault`, `updateCheck`) without opening `config.json`. `config`/`config list` shows each key, its effective value, and whether it comes from the file or the built-in default; `config get`/`set`/`unset` read and change one key; `config path` prints the config file location. It only ever touches those preference keys, never credentials or flow-managed state.\n- Billing-blocked sends and runs now surface the server-authored recovery\n  guidance from the typed billing outcome. The chat TUI renders it as a\n  warning-toned system-notice row — live when a send is refused or a run is\n  stopped at the billing boundary, and again when reopening a conversation\n  that holds a persisted billing notice — instead of a generic error.\n  Headless `chat -p` and `messages get` print the guidance (state, recovery\n  step, and manage-billing URL) on stderr, keep any partial output already\n  streamed on stdout, and exit with code `5` (distinct from the generic `1`)\n  so scripted callers can tell a billing pause from a failure.\n- Syntax highlighting for 14 more languages in the chat transcript and file/review panes (python, bash, go, rust, c, cpp, java, ruby, css, html, json, yaml, and more) — previously only JavaScript/TypeScript rendered colored.\n\n### Changed\n\n- `skydive agent list` lists the full agent roster by default instead of a truncated page.\n\n### Fixed\n\n- Long multi-line bash tool-call commands (e.g. heredocs) are clamped with a `+N more · click to expand` tail instead of dumping their whole body into the scrollback.\n- Tool error output is clipped the same way as ok output, so a failing command no longer floods the transcript.\n- The TUI toast overlay has an opaque background instead of letting the transcript bleed through.\n\n## [0.3.0] - 2026-08-04\n\n### Added\n\n**Chat TUI**\n\n- `/fork` slash command to fork a conversation at any point and continue in a new thread.\n- `/conversation` switches threads from inside a live session.\n- `/compact` triggers manual conversation compaction.\n- `/portal` and `/copy` slash commands.\n- Archive the current conversation from the chat TUI.\n- `--new` flag on `skydive chat` to start a fresh conversation.\n- Debounced server-side conversation search in the picker, with title matches ranked first.\n- File review pane orientation toggle, and review comments in the file pane.\n- Pinned plan card controls and a jump-to-latest hint.\n- Terminal title (OSC) follows the live conversation title on every screen; inside cmux the workspace is renamed too, and linked PRs are pushed to the cmux sidebar.\n- Every participating agent shows in the conversation list; connect cards each have their own identity, and ctrl+r asks which connect card to act on.\n- Colored Skydive splash art in `skydive --help` and the TUI pickers.\n- New-agent name prefilled from the server's suggestion.\n\n**CLI & platform**\n\n- `skydive update` self-updater, with an update notice when a new version is available.\n- Shell completions for bash, zsh, and fish via `completion install`.\n- Portal daemon: one connection per host with per-conversation working directories.\n- Agent-led coding-agent import (`skydive import`).\n- Per-workspace scoping on the REST client, and cross-org `--agent <uuid>` auto-switches workspace.\n- `skydive-beta` wrapper for the canary channel.\n\n### Fixed\n\n- `skydive update` no longer claims an update is available on every npm install.\n- Chat memory is bounded (payload clamps + windowed rows) with a memory watchdog and OOM diagnostic report; transcript rows are memoized so streaming stops re-rendering the whole chat.\n- Chat-send failures map to real error messages.\n- Notification and sidebar previews use the last text block of the reply and strip inline markdown.\n- Picker rows no longer overlap when a conversation title contains a newline, tab, or control character.\n- Sending to non-web channel conversations is blocked in the TUI.\n- GitHub bot connect opens on the web front door, not api.skydive.com.\n- TUI activity counter times from the run, not the screen.\n\n## [0.2.0] - 2026-07-29\n\n### Added\n\n**Sandbox & machine access**\n\n- Standalone `skydive sandbox` command for direct access to an agent's sandbox.\n- `/sandbox` in the chat TUI — live PTY session and one-shot command execution.\n- Headless machine sharing via `skydive portal`, with self-registering portal grants.\n- `shareMachineDefault` config key for always-on portal sharing.\n\n**Chat TUI**\n\n- File pane (`ctrl+g`) with Changes and Files tabs: a shared file tree plus source viewer and a workspace browser, mouse-resizable and responsive to terminal size.\n- Agent todo list rendered in the chat TUI, above the composer, mirroring the web chat's todo card.\n- Fuzzy finder in the conversation and agent pickers.\n- Slash-command autocomplete menu.\n- Paste or drag-and-drop any file into the composer; paste clipboard images with Cmd+V.\n- Run local shell commands with `!` in the composer.\n- Conversation recaps, streamed live title updates, and per-agent attribution on assistant turns.\n- Working timer rolls up into minutes and hours.\n- Conversation picker paginates past 50 conversations and shows only your own conversations.\n- Esc leaves a live run; typing `exit` quits the chat.\n- Cursor Dark theme.\n- Picker rows no longer overlap when a conversation title contains a newline, tab, or control character.\n\n**Headless & scripting**\n\n- Resume a conversation by id.\n- `conversations list` and `conversations show` for transcript reads.\n- `messages get`, with run recovery keyed on message id.\n- Connect cards surface in headless `-p` mode so a driving agent never gets stuck.\n\n**Authentication**\n\n- `skydive auth login` via the browser now auto-mints an API key, so one login yields both a chat session and a usable management credential. Management commands announce the key's pinned workspace when it drives them, so a workspace mismatch is visible at use time.\n- Workspace picker on the device authorization page.\n- Account and workspace identity shown in `auth status`.\n\n**Platform**\n\n- Standalone binary builds compiling the CLI into a per-target executable.\n- Interactive workspace switcher; management commands follow the active workspace.\n- Terminal host integrations and agent notifications.\n\n### Fixed\n\n- Transcript errors collapse to one line, click to expand (REST and portal errors keep their full body).\n- Dragged/pasted image file paths attach the file instead of inserting path text, including macOS paths with literal parentheses.\n- Bare URLs in chat markdown are hyperlinked so they survive text wrap.\n- Composer draft is preserved across TUI overlays.\n- Relative connect links resolve before opening the browser.\n- Numbered markdown headings render colored in the TUI.\n- Chat transcript pages by 75% of a screen; picker rows stay on one line.\n- Run starts push to the TUI over the conversation stream.\n- Security: remediated high-severity dependency findings and cleared tar/shell-quote CVEs.\n\n## [0.1.0] - 2026-07-21\n\nInitial public release: `skydive chat` TUI, agent and conversation management,\ndevice authorization, and headless `-p` mode.\n";
+const CHANGELOG_MD = "# Changelog\n\nAll notable changes to the Skydive CLI are documented here.\n\nThe format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),\nand this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).\n\n## [Unreleased]\n\n### Added\n\n- `skydive fs put`, `fs get`, and `fs cp` — move files between your machine and an agent's sandbox without opening the chat TUI or the web app. `fs put [agent] <local-file> <remote-path>` uploads a file, `fs get [agent] <remote-path> <local-path>` downloads one, and `fs cp [agent] <src> <dst>` copies a file to another path inside the sandbox. They ride the same first-class `fs` relay channel as `fs edit` (same EDIT-permission and kill-switch gating); downloads stream in 8MB ranges so large files come down fine, while uploads and in-sandbox copies are capped at the relay's 8MB per-write limit — a bigger file is rejected up front with a pointer to the web Files tab. Silent on success so they compose in scripts; exit code carries the result.\n\n### Changed\n\n- `skydive secrets` and `skydive keys` now accept `--agent <id or name>` (the same flag every other agent-targeting command uses), resolving the name against your agent roster. They used to take only a raw `--agent-id`, so passing the name every other command accepts 404'd \"agent not found\" for a perfectly real agent; `--agent-id` still works.\n\n- `/fork` in the chat TUI now works while the agent is mid-run. It used to refuse with \"finish or cancel the run first\"; now it copies the conversation up to the last completed message and opens the copy, while the agent keeps working on the original — reopen the original to reattach, exactly as after `esc`. This matches the web \"Fork chat\" menu item, which never had the restriction.\n- The two cards pinned above the chat TUI composer — **subagents** and **plan** — can now be minimized to a single header row. Click a card's header (the `▾`/`▸` chevron shows which way it goes), or use `/subagent minimize` and `/plan minimize`; the same again, or `/plan expand`, brings the rows back. Minimized, a card keeps its label and its progress counter (`Subagents 7/10`), so a ten-task fan-out costs one row instead of ten and the rest of the terminal goes back to the transcript. `/plan expand` and `/plan collapse` keep their meaning (unfold and re-fold the completed rows the card windows away); clicking the card's _body_ still does the same, and the hints now say which surface does which.\n- Reopening a conversation whose subagents and plan are all finished now opens both pinned cards minimized to their header row (`▸ ✔ Subagents 4/4`, `▸ Plan 5/5`) instead of spending up to ten rows above the composer on finished work. A card that opens this way pops back open by itself the moment new work goes live in that conversation (a fresh fan-out, a new in-progress step); a card you minimized yourself stays minimized, as before. Work still running when you open the conversation shows its rows, exactly as it did.\n\n- The chat TUI status bar now always shows where the portal stands, instead of only lighting up once everything already worked. It reads `portal off`, `portal connecting`, `portal on` (open on this machine, but this agent has no grant), `portal shared` (green — this agent can run commands here), `portal error`, or `portal unavailable` when you signed in with an API key and no portal is possible. Previously the badge rendered nothing in every one of those states, so \"why can't the agent reach my machine?\" had no answer on screen.\n- One word for that feature across the whole CLI: **portal**. The footer hint is now `ctrl+t portal` / `ctrl+t close portal` (was `local access` / `revoke access`), `/status` reports a `portal` row (was `local access`), and `/share` and `/portal` describe themselves as opening the portal and granting an agent access to your machine. `/portal` used to say \"access your computer\", which collided with `/computer` — that command still means the **agent's** sandbox, and \"computer\" stays reserved for it. `--share-machine` and the `shareMachineDefault` config key are unchanged.\n- `npm i -g skydive-cli` (and yarn/pnpm/bun) now installs a tiny launcher plus one prebuilt, os/cpu-matched binary that carries its own runtime — so on the common platforms `skydive chat` and `skydive import` start instantly and **do not download a Bun runtime on first use**. On any platform without a prebuilt binary (or if the optional dependency is skipped), the CLI automatically falls back to the existing behavior: it runs under your Node and provisions Bun on first `chat`, exactly as before. Nothing about the commands, flags, config, or `SKYDIVE_*` environment variables changes, and `skydive update` still upgrades npm installs via your package manager and standalone-binary installs in place.\n\n### Added\n\n- `skydive agents git token` — create, list, and revoke git-proxy tokens for an agent's repo from your machine. `agents git token create <agent>` prints a read_write token plus the tokenless remote URL (the same routes the web settings page uses); `… git token list <agent>` shows the agent's tokens by id, and `… git token revoke <agent> <token-id>` revokes one. The command's job ends at the credential: it writes nothing to git on your machine, so what to do with the token (credential store, remote URLs) stays with whatever tooling you already pipe credentials through. `auth login` now points at it for laptop git setup.\n- Files an agent shares into the conversation now show as a saveable row in the chat TUI. When the agent sends you a file (a report, an export, a screenshot), it appears as a `📎` row with the filename and size and a \"click to save\" hint; clicking it downloads the file to your `~/Downloads` (falling back to your home directory) and opens it with your default app, then the row shows where it landed. Clicking a saved row again re-opens it. Previously these files were only reachable in the web app — in the terminal they were invisible.\n- `platform ask` forms now render in the chat TUI. The card lists each question with lettered options (A/B/C/D plus Other); `ctrl+r` opens a full overlay picker (one question at a time, arrows + enter, Other as a typed row — the Claude Code interaction). The answer sends as a normal message. Headless `chat -p` prints the question as an `[action needed]` block instead of dropping it.\n- Every API request now reports this install's version (`x-skydive-cli-version`) so the server can refuse features the installed CLI cannot render — `platform ask` needs the #21411 canary (`0.5.0-beta.43` or newer), not 0.4.0 and not earlier 0.5.0 betas.\n- `/search` (alias `/find`) in the chat TUI — opens the conversation picker with its search field focused, so \"find a conversation\" has a discoverable command instead of being a feature you had to know the bare picker already had. Pass a query inline (`/search billing deep dive`) and the picker opens already narrowed to the matches; bare `/search` opens it ready for you to type. The search runs server-side across conversation titles, message bodies, and participant names, the same search the picker exposes.\n- First run in a workspace with no agents now sets you up automatically: instead of dropping you on an empty agent picker, `skydive` creates your first agent for you (with a suggested name and avatar, mirroring the web onboarding flow) and then offers to have it learn how you already work — reading the other coding agents set up on your machine (Claude Code, Cursor, Codex, and more), the same import that `skydive import` runs, with a plan shown first and credentials never copied. Decline and you go straight into the new agent's chat. You can replay this flow anytime with `skydive --onboarding` (or `SKYDIVE_FORCE_ONBOARDING=1`), even in a workspace that already has agents.\n- `/computer` in the chat TUI — a snapshot of the agent's sandbox drawn as colored bar graphs: CPU, memory, and disk usage. Bars turn amber past 75%% and red past 90%% so a glance tells you whether the box is under pressure. The numbers come from the Skydive API (the same live resource sample the web computer view reads), not by connecting to the sandbox — so the card shows instantly, never waking or hanging on a box that isn't running: when the agent has no live sandbox it simply reads \"no sandbox running\". The card keeps itself current quietly (a slow background refresh, no flicker or \"updating\" chrome); only the most recent card refreshes, and it silently stops while you're scrolled up (no wasted polls on a card you're not looking at) and resumes at the bottom.\n- `/computer restart` in the chat TUI — reboot the agent's sandbox from chat. It asks a `y`/`n` confirm first (the restart stops whatever run is going and brings up a fresh box), then enqueues the same restart the web \"Restart\" control does. Available to anyone with edit access to the agent; view-only members are told they can't.\n- `skydive fs` — a namespace for working with the files on an agent's computer (its sandbox) from your own machine. Its first subcommand, `skydive fs edit <path>`, reads a remote file down over the same relay `skydive sandbox` uses, opens it in your local editor (`$VISUAL`/`$EDITOR`, override with `--editor`, defaults to `vi`), and writes your changes back atomically when you save and close — so you can edit a remote file as if it were local without opening the chat TUI. A path that doesn't exist yet is created on save; no changes means nothing is written. Access is gated on EDIT permission for the agent, exactly like `skydive sandbox`. (A first-class `fs` relay channel and `skydive fs mount` land in follow-ups.)\n\n### Fixed\n\n- The chat TUI's \"finished responding\" notification no longer pings while the agent is visibly still working. It fired once per run, but one task can span several runs: a subagent finishing, a scheduled or agent-to-agent check-in, or an auto-restart retry all start a follow-up run seconds after the previous run settles, so you'd get pinged \"finished\" and open the conversation to find it still running. The ping now waits behind a short grace window - a successor run starting in that window cancels it - and cancelled or superseded runs never ping at all.\n\n## [0.4.0] - 2026-08-07\n\n### Added\n\n- `skydive chat` works with API key auth: an API key alone now opens the chat TUI (and headless `chat -p`) without a browser login, using the key's pinned workspace.\n- `skydive config` command to view and set the safe, hand-editable CLI preferences (`shareMachineDefault`, `updateCheck`) without opening `config.json`. `config`/`config list` shows each key, its effective value, and whether it comes from the file or the built-in default; `config get`/`set`/`unset` read and change one key; `config path` prints the config file location. It only ever touches those preference keys, never credentials or flow-managed state.\n- Billing-blocked sends and runs now surface the server-authored recovery\n  guidance from the typed billing outcome. The chat TUI renders it as a\n  warning-toned system-notice row — live when a send is refused or a run is\n  stopped at the billing boundary, and again when reopening a conversation\n  that holds a persisted billing notice — instead of a generic error.\n  Headless `chat -p` and `messages get` print the guidance (state, recovery\n  step, and manage-billing URL) on stderr, keep any partial output already\n  streamed on stdout, and exit with code `5` (distinct from the generic `1`)\n  so scripted callers can tell a billing pause from a failure.\n- Syntax highlighting for 14 more languages in the chat transcript and file/review panes (python, bash, go, rust, c, cpp, java, ruby, css, html, json, yaml, and more) — previously only JavaScript/TypeScript rendered colored.\n\n### Changed\n\n- `skydive agent list` lists the full agent roster by default instead of a truncated page.\n\n### Fixed\n\n- Long multi-line bash tool-call commands (e.g. heredocs) are clamped with a `+N more · click to expand` tail instead of dumping their whole body into the scrollback.\n- Tool error output is clipped the same way as ok output, so a failing command no longer floods the transcript.\n- The TUI toast overlay has an opaque background instead of letting the transcript bleed through.\n\n## [0.3.0] - 2026-08-04\n\n### Added\n\n**Chat TUI**\n\n- `/fork` slash command to fork a conversation at any point and continue in a new thread.\n- `/conversation` switches threads from inside a live session.\n- `/compact` triggers manual conversation compaction.\n- `/portal` and `/copy` slash commands.\n- Archive the current conversation from the chat TUI.\n- `--new` flag on `skydive chat` to start a fresh conversation.\n- Debounced server-side conversation search in the picker, with title matches ranked first.\n- File review pane orientation toggle, and review comments in the file pane.\n- Pinned plan card controls and a jump-to-latest hint.\n- Terminal title (OSC) follows the live conversation title on every screen; inside cmux the workspace is renamed too, and linked PRs are pushed to the cmux sidebar.\n- Every participating agent shows in the conversation list; connect cards each have their own identity, and ctrl+r asks which connect card to act on.\n- Colored Skydive splash art in `skydive --help` and the TUI pickers.\n- New-agent name prefilled from the server's suggestion.\n\n**CLI & platform**\n\n- `skydive update` self-updater, with an update notice when a new version is available.\n- Shell completions for bash, zsh, and fish via `completion install`.\n- Portal daemon: one connection per host with per-conversation working directories.\n- Agent-led coding-agent import (`skydive import`).\n- Per-workspace scoping on the REST client, and cross-org `--agent <uuid>` auto-switches workspace.\n- `skydive-beta` wrapper for the canary channel.\n\n### Fixed\n\n- `skydive update` no longer claims an update is available on every npm install.\n- Chat memory is bounded (payload clamps + windowed rows) with a memory watchdog and OOM diagnostic report; transcript rows are memoized so streaming stops re-rendering the whole chat.\n- Chat-send failures map to real error messages.\n- Notification and sidebar previews use the last text block of the reply and strip inline markdown.\n- Picker rows no longer overlap when a conversation title contains a newline, tab, or control character.\n- Sending to non-web channel conversations is blocked in the TUI.\n- GitHub bot connect opens on the web front door, not api.skydive.com.\n- TUI activity counter times from the run, not the screen.\n\n## [0.2.0] - 2026-07-29\n\n### Added\n\n**Sandbox & machine access**\n\n- Standalone `skydive sandbox` command for direct access to an agent's sandbox.\n- `/sandbox` in the chat TUI — live PTY session and one-shot command execution.\n- Headless machine sharing via `skydive portal`, with self-registering portal grants.\n- `shareMachineDefault` config key for always-on portal sharing.\n\n**Chat TUI**\n\n- File pane (`ctrl+g`) with Changes and Files tabs: a shared file tree plus source viewer and a workspace browser, mouse-resizable and responsive to terminal size.\n- Agent todo list rendered in the chat TUI, above the composer, mirroring the web chat's todo card.\n- Fuzzy finder in the conversation and agent pickers.\n- Slash-command autocomplete menu.\n- Paste or drag-and-drop any file into the composer; paste clipboard images with Cmd+V.\n- Run local shell commands with `!` in the composer.\n- Conversation recaps, streamed live title updates, and per-agent attribution on assistant turns.\n- Working timer rolls up into minutes and hours.\n- Conversation picker paginates past 50 conversations and shows only your own conversations.\n- Esc leaves a live run; typing `exit` quits the chat.\n- Cursor Dark theme.\n- Picker rows no longer overlap when a conversation title contains a newline, tab, or control character.\n\n**Headless & scripting**\n\n- Resume a conversation by id.\n- `conversations list` and `conversations show` for transcript reads.\n- `messages get`, with run recovery keyed on message id.\n- Connect cards surface in headless `-p` mode so a driving agent never gets stuck.\n\n**Authentication**\n\n- `skydive auth login` via the browser now auto-mints an API key, so one login yields both a chat session and a usable management credential. Management commands announce the key's pinned workspace when it drives them, so a workspace mismatch is visible at use time.\n- Workspace picker on the device authorization page.\n- Account and workspace identity shown in `auth status`.\n\n**Platform**\n\n- Standalone binary builds compiling the CLI into a per-target executable.\n- Interactive workspace switcher; management commands follow the active workspace.\n- Terminal host integrations and agent notifications.\n\n### Fixed\n\n- Transcript errors collapse to one line, click to expand (REST and portal errors keep their full body).\n- Dragged/pasted image file paths attach the file instead of inserting path text, including macOS paths with literal parentheses.\n- Bare URLs in chat markdown are hyperlinked so they survive text wrap.\n- Composer draft is preserved across TUI overlays.\n- Relative connect links resolve before opening the browser.\n- Numbered markdown headings render colored in the TUI.\n- Chat transcript pages by 75% of a screen; picker rows stay on one line.\n- Run starts push to the TUI over the conversation stream.\n- Security: remediated high-severity dependency findings and cleared tar/shell-quote CVEs.\n\n## [0.1.0] - 2026-07-21\n\nInitial public release: `skydive chat` TUI, agent and conversation management,\ndevice authorization, and headless `-p` mode.\n";
 
 //#endregion
 //#region src/whats-new.ts
@@ -4573,7 +5351,7 @@ if (process.argv.includes(UPDATE_WORKER_FLAG)) {
 	process.exit(0);
 }
 if (process.argv.includes(PORTAL_DAEMON_FLAG)) {
-	const { runPortalDaemon } = await import("./daemon-CLTmAfBt.mjs");
+	const { runPortalDaemon } = await import("./daemon-DpnxS19C.mjs");
 	runPortalDaemon(process.argv);
 } else runCli();
 function runCli() {