skydive-cli 0.6.0-beta.39 → 0.6.0-beta.41

package/dist/js/{boot-FnZU62YK.mjs → boot-Dzf7JWwL.mjs}

@@ -1,16 +1,16 @@
 #!/usr/bin/env node
-import { a as errorMessage, i as sendErrorMessage, n as errorDetail, o as isRecord, t as createRestClient } from "./rest-HMJ6HYnl.mjs";
-import { C as DEFAULT_APP_URL, E as getConfigPath, K as saveTheme, L as recordDefaultAgent, M as getSavedTheme, S as DEFAULT_API_URL, U as resolveWebUrl, _ as parseConnectCard, c as actionableCardVerb, d as parseOauthConnectParams, f as prioritizeActionableCards, g as computeSettledLabel, h as composeQuestionAnswer, i as resolveAgent, j as getReviewStateDir, l as cardActionErrorMessage, m as resolveConnectUrl, p as reconcileMaskedInput, s as MASK_CHAR, u as parseExternalOauthConnectParams, v as specKeyFor } from "./print-BPQO_UaI.mjs";
-import { A as installAgentAlias, C as themeVersion, D as machineOsFromPlatform, F as detectShell, L as getActiveWorkspaceId, M as takenAliasNames, O as aliasActivationHint, S as themeModeFromColorFgBg, T as themesForMode, V as setActiveWorkspace, _ as monoTheme, a as WORDMARK, b as themeForMode, d as profilingEnabled, f as record, g as findTheme, h as applyTheme, i as MARK_CELLS, j as slugifyAliasName, k as dedupeAliasName, m as DEFAULT_THEME_ID, n as buildCrashReport, p as writeArtifact, r as writeCrashReport, s as splashFitsWidth, t as installCrashHandler, v as noColorRequested, x as themeMode, y as theme, z as listWorkspaces } from "./install-03ApVdVv.mjs";
+import { a as errorMessage, i as sendErrorMessage, n as errorDetail, o as isRecord, t as createRestClient } from "./rest-CXCsoY4Q.mjs";
+import { C as DEFAULT_API_URL, D as getConfigPath, M as getReviewStateDir, N as getSavedTheme, R as recordDefaultAgent, W as resolveWebUrl, _ as computeSettledLabel, c as actionableCardVerb, d as parseOauthConnectParams, f as prioritizeActionableCards, g as composeQuestionAnswerEntries, h as composeQuestionAnswer, i as resolveAgent, l as cardActionErrorMessage, m as resolveConnectUrl, p as reconcileMaskedInput, q as saveTheme, s as MASK_CHAR, u as parseExternalOauthConnectParams, v as parseConnectCard, w as DEFAULT_APP_URL, y as specKeyFor } from "./print-DTaoROjq.mjs";
+import { A as installAgentAlias, C as themeVersion, D as machineOsFromPlatform, F as detectShell, L as getActiveWorkspaceId, M as takenAliasNames, O as aliasActivationHint, S as themeModeFromColorFgBg, T as themesForMode, V as setActiveWorkspace, _ as monoTheme, a as WORDMARK, b as themeForMode, d as profilingEnabled, f as record, g as findTheme, h as applyTheme, i as MARK_CELLS, j as slugifyAliasName, k as dedupeAliasName, m as DEFAULT_THEME_ID, n as buildCrashReport, p as writeArtifact, r as writeCrashReport, s as splashFitsWidth, t as installCrashHandler, v as noColorRequested, x as themeMode, y as theme, z as listWorkspaces } from "./install-DxZwvQnt.mjs";
 import { t as HttpError } from "./http-error-BF2NZZE3.mjs";
 import { i as billingBlockedOutcomeFromSendResponse } from "./billing-blocked-D3l5kJlX.mjs";
-import { t as PortalClient } from "./client-C1r0rRmd.mjs";
+import { n as PortalClient } from "./client-hxuyfRBc.mjs";
 import { t as defaultTlsCertSource } from "./tls-cert-Rua2oV7n.mjs";
 import "./api-BFQ4PQDA.mjs";
-import "./daemon-CSAbOyRz.mjs";
-import { t as SandboxStream } from "./client-l6orYfqq.mjs";
-import { t as PortalDaemonClient } from "./daemon-client-D4WAalkV.mjs";
-import { t as runRawPtyPassthrough } from "./raw-pty-dndn1Kxc.mjs";
+import "./daemon-BHEJmgBq.mjs";
+import { t as SandboxStream } from "./client-Dr81zuTm.mjs";
+import { t as PortalDaemonClient } from "./daemon-client-B0-KqkuJ.mjs";
+import { t as runRawPtyPassthrough } from "./raw-pty-C323I8xG.mjs";
 import * as os$1 from "node:os";
 import { homedir, platform, release, tmpdir } from "node:os";
 import path, { basename, extname, isAbsolute, join, posix, win32 } from "node:path";
@@ -3873,6 +3873,7 @@ function ConversationHome({ agent, initialQuery, conversations, showAutomated, o
 	]);
 	const [removedIds, setRemovedIds] = useState(/* @__PURE__ */ new Set());
 	const [archiveOverrides, setArchiveOverrides] = useState(/* @__PURE__ */ new Map());
+	const [pinOverrides, setPinOverrides] = useState(/* @__PURE__ */ new Map());
 	const [confirmId, setConfirmId] = useState(null);
 	const [error, setError] = useState(null);
 	const [sending, setSending] = useState(false);
@@ -3887,7 +3888,16 @@ function ConversationHome({ agent, initialQuery, conversations, showAutomated, o
 		onError: setError
 	});
 	const isArchived = (c) => archiveOverrides.get(c.id) ?? c.viewerArchivedAt != null;
-	const list = ((isSearching && search?.query === debouncedQuery && search.state.kind === "ready" ? search.state.conversations : null) ?? conversations).filter((c) => !removedIds.has(c.id) && (showArchived || !isArchived(c)));
+	const pinnedAt = (c) => pinOverrides.has(c.id) ? pinOverrides.get(c.id) ?? null : c.viewerPinnedAt ?? null;
+	const isPinned = (c) => pinnedAt(c) !== null;
+	const list = ((isSearching && search?.query === debouncedQuery && search.state.kind === "ready" ? search.state.conversations : null) ?? conversations).filter((c) => !removedIds.has(c.id) && (showArchived || !isArchived(c))).sort((a, b) => {
+		const aPin = pinnedAt(a);
+		const bPin = pinnedAt(b);
+		if (aPin && bPin) return bPin.localeCompare(aPin);
+		if (aPin) return -1;
+		if (bPin) return 1;
+		return 0;
+	});
 	useEffect(() => {
 		setHighlight(0);
 	}, [showAutomated, showArchived]);
@@ -3904,6 +3914,7 @@ function ConversationHome({ agent, initialQuery, conversations, showAutomated, o
 	const clamped = Math.min(highlight, Math.max(0, rows.length - 1));
 	const highlightRow = rows[clamped];
 	const highlightArchived = highlightRow?.kind === "conv" && isArchived(highlightRow.hit.item);
+	const highlightPinned = highlightRow?.kind === "conv" && isPinned(highlightRow.hit.item);
 	const highlightAgentRun = highlightRow?.kind === "conv" && isAgentRunConversation(highlightRow.hit.item);
 	const highlightOutsider = highlightRow?.kind === "conv" && !viewerIsParticipant(highlightRow.hit.item);
 	const confirmConv = confirmId !== null ? list.find((c) => c.id === confirmId) : void 0;
@@ -3932,7 +3943,8 @@ function ConversationHome({ agent, initialQuery, conversations, showAutomated, o
 			`tab ${showAutomated ? "hide" : "show"} agent runs`,
 			`shift+tab ${showArchived ? "hide" : "show"} archived`,
 			"↑/↓ move",
-			"esc back"
+			"esc back",
+			...highlightAgentRun || highlightOutsider ? [] : [`ctrl+p ${highlightPinned ? "unpin" : "pin"}`]
 		].filter((segment) => segment !== ""), innerWidth)
 	};
 	const identityRows = height >= 24 ? 3 : 0;
@@ -4022,6 +4034,25 @@ function ConversationHome({ agent, initialQuery, conversations, showAutomated, o
 	* reachable with archived rows shown) it restores instead — which is the
 	* only in-TUI way back.
 	*/
+	const togglePinned = (conversation) => {
+		if (!rest) return;
+		const id = conversation.id;
+		const pinned = !isPinned(conversation);
+		const revert = pinOverrides.has(id) ? pinOverrides.get(id) : conversation.viewerPinnedAt;
+		setPinOverrides((prev) => new Map(prev).set(id, pinned ? (/* @__PURE__ */ new Date()).toISOString() : null));
+		rest.setConversationPinned({
+			conversationId: id,
+			pinned
+		}).catch((err) => {
+			setPinOverrides((prev) => {
+				const next = new Map(prev);
+				if (revert === void 0) next.delete(id);
+				else next.set(id, revert ?? null);
+				return next;
+			});
+			setError(`${pinned ? "pin" : "unpin"} failed: ${err instanceof Error ? err.message : String(err)}`);
+		});
+	};
 	const toggleArchived = (conversation) => {
 		if (!rest) return;
 		const id = conversation.id;
@@ -4075,6 +4106,21 @@ function ConversationHome({ agent, initialQuery, conversations, showAutomated, o
 				setConfirmId(row.hit.item.id);
 			}
 			key.preventDefault();
+		} else if (key.name === "p" && key.ctrl) {
+			const row = rows[clamped];
+			if (row?.kind === "conv") {
+				if (isAgentRunConversation(row.hit.item)) {
+					setError("agent runs can't be pinned");
+					return;
+				}
+				if (!viewerIsParticipant(row.hit.item)) {
+					setError("you're not in this thread, so there's nothing to pin");
+					return;
+				}
+				setError(null);
+				togglePinned(row.hit.item);
+			}
+			key.preventDefault();
 		} else if (key.name === "a" && key.ctrl) {
 			const row = rows[clamped];
 			if (row?.kind === "conv") {
@@ -4200,7 +4246,7 @@ function ConversationHome({ agent, initialQuery, conversations, showAutomated, o
 							const fg = selected ? theme.accent : theme.fg;
 							const marker = selected ? "› " : "  ";
 							const archived = isArchived(row.hit.item);
-							const { title, time } = layoutRow(`${archived ? "archived · " : ""}${singleLine(row.hit.item.title ?? "(untitled)")}`, relativeTime(row.hit.item.updatedAt), coAgentsTag(row.hit.item, agent.id), rowWidth);
+							const { title, time } = layoutRow(`${isPinned(row.hit.item) ? "pinned · " : ""}${archived ? "archived · " : ""}${singleLine(row.hit.item.title ?? "(untitled)")}`, relativeTime(row.hit.item.updatedAt), coAgentsTag(row.hit.item, agent.id), rowWidth);
 							const glyph = channelGlyph(row.hit.item.channel);
 							const tag = coAgentsTag(row.hit.item, agent.id);
 							const unread = row.hit.item.unread === true;
@@ -4722,7 +4768,7 @@ function ErrorItem({ item }) {
 
 //#endregion
 //#region src/chat/tui/chunks/tool-call-summary.ts
-const TOOL_CALL_SUMMARY_KEY = "__skydive_summary__";
+const TOOL_CALL_SUMMARY_KEYS = ["skydive_summary", "__skydive_summary__"];
 /**
 * The model's one-line summary for a tool call, read from its arguments.
 * Returns null when absent or blank; whitespace is collapsed so a stray
@@ -4730,8 +4776,8 @@ const TOOL_CALL_SUMMARY_KEY = "__skydive_summary__";
 */
 function getToolCallSummary(input) {
 	if (!input || typeof input !== "object") return null;
-	for (const [key, value] of Object.entries(input)) {
-		if (key !== TOOL_CALL_SUMMARY_KEY) continue;
+	for (const key of TOOL_CALL_SUMMARY_KEYS) for (const [entryKey, value] of Object.entries(input)) {
+		if (entryKey !== key) continue;
 		if (typeof value !== "string") return null;
 		return value.replace(/\s+/g, " ").trim() || null;
 	}
@@ -4744,8 +4790,8 @@ function getToolCallSummary(input) {
 */
 function withoutToolCallSummary(input) {
 	if (!input || typeof input !== "object" || Array.isArray(input)) return input;
-	if (!(TOOL_CALL_SUMMARY_KEY in input)) return input;
-	return Object.fromEntries(Object.entries(input).filter(([key]) => key !== TOOL_CALL_SUMMARY_KEY));
+	if (!TOOL_CALL_SUMMARY_KEYS.some((key) => key in input)) return input;
+	return Object.fromEntries(Object.entries(input).filter(([key]) => !TOOL_CALL_SUMMARY_KEYS.includes(key)));
 }
 
 //#endregion
@@ -8355,6 +8401,10 @@ const keybindGroups = [
 				keys: "ctrl+x",
 				action: "drop the last staged image"
 			},
+			{
+				keys: "ctrl+p",
+				action: "pin / unpin this conversation for you (again to unpin)"
+			},
 			{
 				keys: "ctrl+a",
 				action: "archive conversation (hides it for you only; again to restore)"
@@ -9149,7 +9199,8 @@ function printResumeHint(write = (text) => process.stdout.write(text)) {
 * AskUserQuestion overlay: one question at a time, a highlighted option
 * list (Other is the last row), enter selects, letters jump, esc cancels.
 * Multi-question forms advance after each pick and submit once every
-* question is answered. The composed answer is a normal user message.
+* question is answered. Submission carries both the normal user-message text
+* and a typed answer list so the transcript can settle this exact card.
 */
 function AskPicker({ questions, onSubmit, onCancel }) {
 	const [active, setActive] = useState(0);
@@ -9173,7 +9224,7 @@ function AskPicker({ questions, onSubmit, onCancel }) {
 	function finish(nextSelected, nextOther) {
 		const answers = answersFor(nextSelected, nextOther);
 		if (answers.some((a) => a.length === 0)) return;
-		onSubmit(composeQuestionAnswer(questions, answers));
+		onSubmit(composeQuestionAnswer(questions, answers), composeQuestionAnswerEntries(questions, answers));
 	}
 	function advanceOrSubmit(nextSelected) {
 		const nextUnanswered = questions.findIndex((_, i) => i > active && !(nextSelected[i] ?? []).length);
@@ -9629,7 +9680,7 @@ function ModelPicker({ agentId, conversationId, currentModel, currentEffort, mod
 		let cancelled = false;
 		(async () => {
 			try {
-				const [models, savedEfforts, floor] = await Promise.all([
+				const [catalog, savedEfforts, floor] = await Promise.all([
 					rest.listModels(),
 					rest.listModelEfforts().catch(() => ({})),
 					loadFreeFloor(rest)
@@ -9637,9 +9688,10 @@ function ModelPicker({ agentId, conversationId, currentModel, currentEffort, mod
 				if (cancelled) return;
 				setState({
 					kind: "ready",
-					models,
+					models: catalog.models,
 					savedEfforts,
-					floor
+					floor,
+					trainingOptedOut: catalog.trainingOptedOut
 				});
 			} catch (err) {
 				if (cancelled) return;
@@ -9671,6 +9723,7 @@ function ModelPicker({ agentId, conversationId, currentModel, currentEffort, mod
 		models: state.models,
 		initialSavedEfforts: state.savedEfforts,
 		floor: state.floor,
+		trainingOptedOut: state.trainingOptedOut,
 		currentModel,
 		currentEffort,
 		modelLocked,
@@ -9708,7 +9761,7 @@ function ModelPickerFrame({ hint, children }) {
 		]
 	});
 }
-function ModelSwitcher({ models, initialSavedEfforts, floor, currentModel, currentEffort, modelLocked, initialView, agentId, conversationId, onModelSelected, onEffortSelected, onCancel }) {
+function ModelSwitcher({ models, initialSavedEfforts, floor, trainingOptedOut, currentModel, currentEffort, modelLocked, initialView, agentId, conversationId, onModelSelected, onEffortSelected, onCancel }) {
 	const rest = useStore((s) => s.rest);
 	const [savedEfforts, setSavedEfforts] = useState(initialSavedEfforts);
 	const [view, setView] = useState(() => {
@@ -9736,6 +9789,10 @@ function ModelSwitcher({ models, initialSavedEfforts, floor, currentModel, curre
 	}
 	async function selectModel(model) {
 		if (!rest || saving) return;
+		if (trainingOptedOut && !model.noTraining) {
+			setSaveError("this workspace limits model selection to verified no-training routes");
+			return;
+		}
 		const effort = effortFor(model);
 		if (model.id === currentModel && effort === currentEffort) {
 			onCancel();
@@ -9841,6 +9898,7 @@ function ModelSwitcher({ models, initialSavedEfforts, floor, currentModel, curre
 		floor,
 		currentModel,
 		modelLocked,
+		trainingOptedOut,
 		saving,
 		saveError,
 		effortFor,
@@ -9855,7 +9913,7 @@ function ModelSwitcher({ models, initialSavedEfforts, floor, currentModel, curre
 		onCancel
 	});
 }
-function ModelList({ models, floor, currentModel, modelLocked, saving, saveError, effortFor, onSelect, onEditEffort, onCancel }) {
+function ModelList({ models, floor, currentModel, modelLocked, trainingOptedOut, saving, saveError, effortFor, onSelect, onEditEffort, onCancel }) {
 	const { width, height } = useTerminalDimensions();
 	const [query, setQuery] = useState("");
 	const { lock } = floor;
@@ -9887,8 +9945,8 @@ function ModelList({ models, floor, currentModel, modelLocked, saving, saveError
 			onCancel();
 			return;
 		}
-		if (key.name === "up") setHighlight(Math.max(0, clamped - 1));
-		else if (key.name === "down") setHighlight(Math.min(Math.max(0, filtered.length - 1), clamped + 1));
+		if (key.name === "up") setHighlight((prev) => Math.max(0, Math.min(prev, filtered.length - 1) - 1));
+		else if (key.name === "down") setHighlight((prev) => Math.min(Math.max(0, filtered.length - 1), Math.max(0, prev) + 1));
 		else if (key.name === "tab") {
 			const model = filtered[clamped];
 			if (model && !isLocked(model) && effortFor(model)) onEditEffort(model);
@@ -9911,6 +9969,10 @@ function ModelList({ models, floor, currentModel, modelLocked, saving, saveError
 				fg: theme.accent,
 				children: "switch model"
 			}),
+			trainingOptedOut ? /* @__PURE__ */ jsx("text", {
+				fg: theme.warning,
+				children: "this workspace limits model selection to verified no-training routes."
+			}) : null,
 			modelLocked ? /* @__PURE__ */ jsx("text", {
 				fg: theme.warning,
 				children: "model choice is limited while this agent uses a Google integration. models without a zero-data-retention route will be rejected."
@@ -12986,6 +13048,7 @@ function useCardActions({ rest, appUrl, portalClient, portalStatus, setPortalPro
 		if (action.kind === "answer_question") {
 			setAskPrompt({
 				cardId: item.id,
+				durableCardId: action.cardId,
 				questions: item.card.questions
 			});
 			return;
@@ -14378,11 +14441,11 @@ function useChatStream({ rest, conversationId, initialConversationId, attachRunI
 	return {
 		markRead,
 		attachToRun,
-		sendContent: useCallback(async (content, staged, opts) => {
+		sendContent: useCallback(async (content, staged, params) => {
 			if (!rest) return;
 			const trimmed = content.trim();
 			if (!trimmed && staged.length === 0) return;
-			const echo = opts?.echo !== false;
+			const echo = params?.echo !== false;
 			const optimisticId = crypto.randomUUID();
 			const stagedNames = staged.map((a) => a.fileName);
 			if (echo) setItems((prev) => [...prev, {
@@ -14414,6 +14477,7 @@ function useChatStream({ rest, conversationId, initialConversationId, attachRunI
 					conversationId,
 					content: trimmed,
 					attachmentIds,
+					questionAnswer: params?.questionAnswer ?? null,
 					clientSurface: "tui"
 				});
 				releaseUploaded(rows);
@@ -15193,7 +15257,7 @@ function useExecuteLine({ agent, rest, conversationId, appUrl, goTo, history, se
 		composerRef.current?.clear();
 		setComposerRows(1);
 		clearAttachments();
-		sendContent(content, staged);
+		sendContent(content, staged, null);
 	}, [
 		history,
 		runLocalShell,
@@ -15831,7 +15895,10 @@ function useLocalCommands({ setItems, shellSessionRef, bindPortalCwd, sendConten
 					exit: 1
 				} : m));
 			}
-			sendContent(formatShellContext(command, captured, exitCode), [], { echo: false });
+			sendContent(formatShellContext(command, captured, exitCode), [], {
+				echo: false,
+				questionAnswer: null
+			});
 		}, [
 			setItems,
 			shellSessionRef,
@@ -16471,7 +16538,7 @@ function ChatScreen({ agent, conversation, attachRunId, parentConversationId })
 					variant: "warning"
 				});
 			}
-			await sendContent(seedPrompt ?? "", adoptUploaded(seedAttachments));
+			await sendContent(seedPrompt ?? "", adoptUploaded(seedAttachments), null);
 		})();
 	}, [
 		conversation,
@@ -16832,14 +16899,20 @@ function ChatScreen({ agent, conversation, attachRunId, parentConversationId })
 	});
 	if (askPrompt) return /* @__PURE__ */ jsx(AskPicker, {
 		questions: askPrompt.questions,
-		onSubmit: (text) => {
+		onSubmit: (text, answers) => {
 			const cardId = askPrompt.cardId;
 			setAskPrompt(null);
 			updateCard(cardId, {
 				status: "done",
 				detail: text
 			});
-			sendContent(text, []);
+			sendContent(text, [], {
+				echo: true,
+				questionAnswer: {
+					cardId: askPrompt.durableCardId,
+					answers
+				}
+			});
 		},
 		onCancel: () => setAskPrompt(null)
 	});

package/dist/js/client-BQPhWfh2.mjs

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+import { n as PortalClient, r as RATE_LIMIT_STAND_DOWN_MS, t as AUTH_STAND_DOWN_MS } from "./client-hxuyfRBc.mjs";
+import "./api-BFQ4PQDA.mjs";
+
+export { PortalClient };

package/dist/js/{client-l6orYfqq.mjs → client-Dr81zuTm.mjs}

@@ -113,6 +113,8 @@ const FRAME = {
 	RESIZE: 17
 };
 const MAX_INPUT_BYTES = 1 * 1024 * 1024;
+/** Upper bound for an exec's `timeoutMs`; larger asks are clamped to this. */
+const MAX_EXEC_TIMEOUT_MS = 1440 * 60 * 1e3;
 /** Query params for the upgrade URL, from a spec. Inverse of {@link parseStreamSpec}. */
 function streamSpecToQuery(spec) {
 	if (spec.mode === "pty") return {
@@ -124,7 +126,8 @@ function streamSpecToQuery(spec) {
 	if (spec.mode === "exec") return {
 		agentId: spec.agentId,
 		mode: "exec",
-		command: spec.command
+		command: spec.command,
+		...spec.timeoutMs !== void 0 ? { timeoutMs: String(spec.timeoutMs) } : {}
 	};
 	return {
 		agentId: spec.agentId,
@@ -273,7 +276,8 @@ var SandboxStream = class SandboxStream {
 		} : {
 			mode: "exec",
 			agentId: opts.agentId,
-			command: opts.command
+			command: opts.command,
+			...opts.timeoutMs !== void 0 ? { timeoutMs: opts.timeoutMs } : {}
 		};
 		const url = new URL(`${wsBase(opts.appUrl)}${SANDBOX_STREAM_PATH}`);
 		for (const [key, value] of Object.entries(streamSpecToQuery(spec))) url.searchParams.set(key, value);

package/dist/js/{client-C1r0rRmd.mjs → client-hxuyfRBc.mjs}

@@ -1,4 +1,5 @@
 #!/usr/bin/env node
+import { t as HttpError } from "./http-error-BF2NZZE3.mjs";
 import { a as mintPortalDeviceToken, c as unifyLegacyCliGrants, i as grantPortalAccess, l as startTlsForward, n as fetchPortalDevices, r as findThisDevice } from "./api-BFQ4PQDA.mjs";
 import os from "node:os";
 import { z } from "zod";
@@ -160,7 +161,7 @@ function errorMessage(err) {
 * the commit time of the built tree is one monotonic clock they share.
 */
 function portalDaemonBuild() {
-	return "1790383310";
+	return "1790619216";
 }
 /**
 * Whether a client carrying `mine` should replace a running daemon carrying
@@ -579,18 +580,41 @@ var JobManager = class {
 
 //#endregion
 //#region ../portal-daemon/src/client.ts
+const INITIAL_BACKOFF_MS = 500;
+const MAX_BACKOFF_MS = 1e4;
+const AUTH_STAND_DOWN_MS = 5 * 6e4;
+const AUTH_STAND_DOWN_MESSAGE = "portal sign-in expired — reopen Skydive Desktop (or run `skydive portal open`) to reconnect";
+/**
+* True when the error means the server could not authenticate us: a token-mint
+* failure (HttpError 401) or a WS upgrade rejected at the auth layer. `ws`
+* reports a rejected upgrade as `Unexpected server response: <status>` with no
+* structured status property, so the status is read from the message. A 429 is
+* deliberately NOT an auth failure — see isRateLimited.
+*/
+function isAuthFailure(err) {
+	if (err instanceof HttpError) return err.status === 401;
+	return /Unexpected server response: 401\b/.test(errorMessage(err));
+}
+const RATE_LIMIT_STAND_DOWN_MS = 12e4;
+const RATE_LIMIT_STAND_DOWN_MESSAGE = "portal connection rate limited — retrying in 2 minutes";
+function isRateLimited(err) {
+	if (err instanceof HttpError) return err.status === 429;
+	return /Unexpected server response: 429\b/.test(errorMessage(err));
+}
 const DEFAULT_HEARTBEAT = {
 	intervalMs: 15e3,
 	maxMissed: 2,
 	wakeTickMs: 2e3,
 	wakeGapThresholdMs: 1e4,
 	netWatchTickMs: 2e3,
-	initialBackoffMs: 500,
-	maxBackoffMs: 1e4,
+	initialBackoffMs: INITIAL_BACKOFF_MS,
+	maxBackoffMs: MAX_BACKOFF_MS,
 	supersededBackoffFloorMs: 5e3,
 	flapWindowMs: 6e4,
 	flapMaxStandDowns: 3,
-	flapBackoffMs: 6e4
+	flapBackoffMs: 6e4,
+	authStandDownMs: AUTH_STAND_DOWN_MS,
+	rateLimitStandDownMs: RATE_LIMIT_STAND_DOWN_MS
 };
 /**
 * A cheap fingerprint of the machine's network identity: every non-internal
@@ -670,6 +694,8 @@ var PortalClient = class {
 	machineName = "";
 	friendlyName = "";
 	legacyGrantsChecked = false;
+	authRejected = false;
+	rateLimited = false;
 	wakeWatch = null;
 	lastTick = Date.now();
 	netWatch = null;
@@ -785,6 +811,8 @@ var PortalClient = class {
 		if (this.enabled || this.disposed) return;
 		this.enabled = true;
 		this.error = null;
+		this.authRejected = false;
+		this.rateLimited = false;
 		this.connectLoop();
 	}
 	disable() {
@@ -939,11 +967,31 @@ var PortalClient = class {
 					} else backoff = Math.max(Math.min(backoff * 2, this.heartbeatConfig.maxBackoffMs), this.heartbeatConfig.supersededBackoffFloorMs);
 					sleepFloor = backoff / 2;
 				} else if (healthy) backoff = this.heartbeatConfig.initialBackoffMs;
-				else backoff = Math.min(backoff * 2, this.heartbeatConfig.maxBackoffMs);
+				else if (this.authRejected) {
+					this.setStatus("error", AUTH_STAND_DOWN_MESSAGE);
+					this.authRejected = false;
+					backoff = this.heartbeatConfig.authStandDownMs;
+					sleepFloor = backoff;
+				} else if (this.rateLimited) {
+					this.setStatus("error", RATE_LIMIT_STAND_DOWN_MESSAGE);
+					this.rateLimited = false;
+					backoff = this.heartbeatConfig.rateLimitStandDownMs;
+					sleepFloor = backoff;
+				} else backoff = Math.min(backoff * 2, this.heartbeatConfig.maxBackoffMs);
 			} catch (err) {
 				if (!this.enabled || this.disposed || this.handingOff) break;
-				this.setStatus("error", errorMessage(err));
-				backoff = Math.min(backoff * 2, this.heartbeatConfig.maxBackoffMs);
+				if (isAuthFailure(err)) {
+					this.setStatus("error", AUTH_STAND_DOWN_MESSAGE);
+					backoff = this.heartbeatConfig.authStandDownMs;
+					sleepFloor = backoff;
+				} else if (isRateLimited(err)) {
+					this.setStatus("error", RATE_LIMIT_STAND_DOWN_MESSAGE);
+					backoff = this.heartbeatConfig.rateLimitStandDownMs;
+					sleepFloor = backoff;
+				} else {
+					this.setStatus("error", errorMessage(err));
+					backoff = Math.min(backoff * 2, this.heartbeatConfig.maxBackoffMs);
+				}
 			}
 			if (!this.enabled || this.disposed || this.handingOff) break;
 			this.inStandDownSleep = sleepFloor > 0;
@@ -1000,6 +1048,8 @@ var PortalClient = class {
 			};
 			ws.on("open", () => {
 				missed = 0;
+				this.authRejected = false;
+				this.rateLimited = false;
 				this.dialReason = null;
 				this.disconnectedAt = null;
 				this.setStatus("connected");
@@ -1013,6 +1063,14 @@ var PortalClient = class {
 			});
 			ws.on("error", (err) => {
 				this.error = errorMessage(err);
+				if (isAuthFailure(err)) {
+					this.authRejected = true;
+					this.dialReason ??= "portal credentials rejected; standing down";
+				}
+				if (isRateLimited(err)) {
+					this.rateLimited = true;
+					this.dialReason ??= "portal connection rate limited; standing down";
+				}
 			});
 			ws.on("close", (code, reason) => {
 				standDown = code === CLOSE_SUPERSEDED || code === CLOSE_FLAP_COOLDOWN || code === 1e3 && reason.toString() === "superseded";
@@ -1076,4 +1134,4 @@ function sleep(ms) {
 }
 
 //#endregion
-export { resolveMachineIdentity as a, isRecord as i, isNewerBuild as n, portalDaemonBuild as r, PortalClient as t };
+export { portalDaemonBuild as a, isNewerBuild as i, PortalClient as n, isRecord as o, RATE_LIMIT_STAND_DOWN_MS as r, resolveMachineIdentity as s, AUTH_STAND_DOWN_MS as t };

package/dist/js/{daemon-CSAbOyRz.mjs → daemon-BHEJmgBq.mjs}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { i as isRecord, n as isNewerBuild, r as portalDaemonBuild, t as PortalClient } from "./client-C1r0rRmd.mjs";
+import { a as portalDaemonBuild, i as isNewerBuild, n as PortalClient, o as isRecord } from "./client-hxuyfRBc.mjs";
 import { t as defaultTlsCertSource } from "./tls-cert-Rua2oV7n.mjs";
 import os from "node:os";
 import path from "node:path";

package/dist/js/{daemon-DbtMlkm5.mjs → daemon-Cw1GI6jv.mjs}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
-import "./client-C1r0rRmd.mjs";
+import "./client-hxuyfRBc.mjs";
 import "./tls-cert-Rua2oV7n.mjs";
 import "./api-BFQ4PQDA.mjs";
-import { a as runPortalDaemon, c as stopDaemonForHandoff, i as queryDaemonStatus, n as ensureDaemonRunning, o as startPortalDaemon, r as isDaemonListening, s as stopDaemon, t as PortalDaemon } from "./daemon-CSAbOyRz.mjs";
+import { a as runPortalDaemon, c as stopDaemonForHandoff, i as queryDaemonStatus, n as ensureDaemonRunning, o as startPortalDaemon, r as isDaemonListening, s as stopDaemon, t as PortalDaemon } from "./daemon-BHEJmgBq.mjs";
 
 export { runPortalDaemon };

package/dist/js/{daemon-client-D4WAalkV.mjs → daemon-client-B0-KqkuJ.mjs}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { d as daemonPaths, f as encodeLine, l as LOCAL_PROTOCOL_VERSION, m as parseDaemonMessage, n as ensureDaemonRunning, p as makeLineParser } from "./daemon-CSAbOyRz.mjs";
+import { d as daemonPaths, f as encodeLine, l as LOCAL_PROTOCOL_VERSION, m as parseDaemonMessage, n as ensureDaemonRunning, p as makeLineParser } from "./daemon-BHEJmgBq.mjs";
 import { randomUUID } from "node:crypto";
 import { connect } from "node:net";
 

package/dist/js/daemon-client-Dk5z9CfF.mjs

@@ -0,0 +1,8 @@
+#!/usr/bin/env node
+import "./client-hxuyfRBc.mjs";
+import "./tls-cert-Rua2oV7n.mjs";
+import "./api-BFQ4PQDA.mjs";
+import "./daemon-BHEJmgBq.mjs";
+import { t as PortalDaemonClient } from "./daemon-client-B0-KqkuJ.mjs";
+
+export { PortalDaemonClient };

package/dist/js/{install-03ApVdVv.mjs → install-DxZwvQnt.mjs}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { c as version$1 } from "./rest-HMJ6HYnl.mjs";
-import { E as getConfigPath } from "./print-BPQO_UaI.mjs";
+import { c as version$1 } from "./rest-CXCsoY4Q.mjs";
+import { D as getConfigPath } from "./print-DTaoROjq.mjs";
 import os from "node:os";
 import path from "node:path";
 import { err, ok } from "neverthrow";

package/dist/js/{print-BzjQA_4s.mjs → print-Bovyirht.mjs}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import "./rest-HMJ6HYnl.mjs";
-import { a as runPrint, i as resolveAgent, n as messageGet, o as toPrintError, r as readStdin, t as collectRunText } from "./print-BPQO_UaI.mjs";
+import "./rest-CXCsoY4Q.mjs";
+import { a as runPrint, i as resolveAgent, n as messageGet, o as toPrintError, r as readStdin, t as collectRunText } from "./print-DTaoROjq.mjs";
 import "./billing-blocked-D3l5kJlX.mjs";
 
 export { messageGet, readStdin, resolveAgent, runPrint };

package/dist/js/{print-BPQO_UaI.mjs → print-DTaoROjq.mjs}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { a as errorMessage, i as sendErrorMessage, o as isRecord, t as createRestClient } from "./rest-HMJ6HYnl.mjs";
+import { a as errorMessage, i as sendErrorMessage, o as isRecord, t as createRestClient } from "./rest-CXCsoY4Q.mjs";
 import { t as HttpError } from "./http-error-BF2NZZE3.mjs";
 import { i as billingBlockedOutcomeFromSendResponse, n as BillingBlockedError } from "./billing-blocked-D3l5kJlX.mjs";
 import path from "node:path";
@@ -512,18 +512,18 @@ function readQuestionEntries(raw) {
 		}];
 	});
 }
-/**
-* The `platform ask` form. The web renders it as an interactive picker; here
-* it maps onto an answer_question button so ctrl+r (and letter shortcuts)
-* open an in-TUI picker. The composed answer is sent as a normal user
-* message — same non-blocking model as the web card. Without this the spec
-* is not a Card, parses to null, and the question is silently dropped.
-*/
 /** Compose the user-message body the web card also sends. */
 function composeQuestionAnswer(questions, answers) {
 	if (questions.length === 1) return (answers[0] ?? []).join(", ");
 	return questions.map((q, i) => `${q.question} → ${(answers[i] ?? []).join(", ")}`).join("\n");
 }
+/** Build the typed durable payload that settles this exact question card. */
+function composeQuestionAnswerEntries(questions, answers) {
+	return questions.map((question, index) => ({
+		question: question.question,
+		answer: (answers[index] ?? []).join(", ")
+	}));
+}
 function parseQuestionCard(rootEl) {
 	const props = isRecord(rootEl.props) ? rootEl.props : {};
 	const cardId = optionalString(props.cardId);
@@ -708,8 +708,8 @@ function isBlockingCardAction(action) {
 * should target, prioritizing blocking cards over `platform ask` forms. When
 * both a blocking card and a stale `answer_question` are waiting, ctrl+r must
 * approve the thing the agent is stalled on, not re-answer an earlier ask that
-* never stops being actionable (the CLI only settles it via the AskPicker, so
-* an ignored or composer-answered ask lingers forever). Falls through to the
+* can remain actionable when ignored or answered as plain composer text.
+* Falls through to the
 * ask forms only when they are the only actionable cards left. Preserves input
 * order within a tier, so a single card and genuine multi-card cases behave
 * exactly as before.
@@ -900,6 +900,7 @@ async function runPrint({ appUrl, sessionToken, workspaceId, prompt, agentSelect
 			conversationId,
 			content: prompt,
 			attachmentIds: [],
+			questionAnswer: null,
 			clientSurface: "cli"
 		});
 	} catch (err) {
@@ -1077,4 +1078,4 @@ async function readStdin() {
 }
 
 //#endregion
-export { getPromptHistoryPath as A, resolveConfig as B, DEFAULT_APP_URL as C, getDefaultAgent as D, getConfigPath as E, getStoredApiKeyWorkspaceName as F, saveSession as G, resolveSession as H, getUpdateCheckDisabled as I, saveTheme as K, recordDefaultAgent as L, getSavedTheme as M, getShareMachineDefault as N, getLastSeenVersion as O, getStoredApiKeyId as P, resolveAppUrl as R, DEFAULT_API_URL as S, deleteConfig as T, resolveWebUrl as U, resolveManagementAuth as V, saveConfig as W, parseConnectCard as _, runPrint as a, API_KEY_FAMILY_PREFIX as b, actionableCardVerb as c, parseOauthConnectParams as d, prioritizeActionableCards as f, computeSettledLabel as g, composeQuestionAnswer as h, resolveAgent as i, getReviewStateDir as j, getPreference as k, cardActionErrorMessage as l, resolveConnectUrl as m, messageGet as n, toPrintError as o, reconcileMaskedInput as p, setLastSeenVersion as q, readStdin as r, MASK_CHAR as s, collectRunText as t, parseExternalOauthConnectParams as u, specKeyFor as v, PREFERENCES as w, API_KEY_PREFIX as x, API_KEYS_URL as y, resolveChatAuth as z };
+export { getPreference as A, resolveChatAuth as B, DEFAULT_API_URL as C, getConfigPath as D, deleteConfig as E, getStoredApiKeyId as F, saveConfig as G, resolveManagementAuth as H, getStoredApiKeyWorkspaceName as I, setLastSeenVersion as J, saveSession as K, getUpdateCheckDisabled as L, getReviewStateDir as M, getSavedTheme as N, getDefaultAgent as O, getShareMachineDefault as P, recordDefaultAgent as R, API_KEY_PREFIX as S, PREFERENCES as T, resolveSession as U, resolveConfig as V, resolveWebUrl as W, computeSettledLabel as _, runPrint as a, API_KEYS_URL as b, actionableCardVerb as c, parseOauthConnectParams as d, prioritizeActionableCards as f, composeQuestionAnswerEntries as g, composeQuestionAnswer as h, resolveAgent as i, getPromptHistoryPath as j, getLastSeenVersion as k, cardActionErrorMessage as l, resolveConnectUrl as m, messageGet as n, toPrintError as o, reconcileMaskedInput as p, saveTheme as q, readStdin as r, MASK_CHAR as s, collectRunText as t, parseExternalOauthConnectParams as u, parseConnectCard as v, DEFAULT_APP_URL as w, API_KEY_FAMILY_PREFIX as x, specKeyFor as y, resolveAppUrl as z };

package/dist/js/{print-share-Tdu4xDgY.mjs → print-share-BvFDVwGW.mjs}

@@ -14,7 +14,7 @@ import { n as printError } from "./output-C9mb3sUB.mjs";
 * the reply (and to --json).
 */
 async function connectMachineShare({ appUrl, sessionToken, timeoutHint }) {
-	const { PortalClient } = await import("./client-DSfF8nrb.mjs");
+	const { PortalClient } = await import("./client-BQPhWfh2.mjs");
 	const { defaultTlsCertSource } = await import("./tls-cert-BpCaD5AT.mjs");
 	let signalConnected;
 	const connected = new Promise((resolve) => {