@crewx/cli 0.9.0-rc.18 → 0.9.0-rc.180

package/dist/bootstrap/codex-writable-roots.d.ts

@@ -33,10 +33,29 @@ export declare function escapeTomlBasicString(value: string): string;
  * Works for both `codex exec` and `codex exec resume` (config-override form).
  */
 export declare function buildCodexWritableRootArgs(crewxHome: string): string[];
+/**
+ * Create an `AdditionalArgsProvider` that skips Codex's git repository trust
+ * check for a resolved workspace.
+ *
+ * The workspace is resolved by the product layer, so an unavailable workspace
+ * must not fall back to the host cwd. The flag is independent of execution
+ * mode because it controls repository trust rather than filesystem access.
+ */
+export declare function createCodexSkipGitRepoCheckProvider(workspaceRoot: string | undefined): AdditionalArgsProvider;
+/**
+ * Compose product-layer argument providers while preserving their order.
+ */
+export declare function composeAdditionalArgsProviders(...providers: AdditionalArgsProvider[]): AdditionalArgsProvider;
 /**
  * Create an `AdditionalArgsProvider` (SDK extension point, WI-20260703-001)
  * that injects CrewX home as a Codex writable root for `workspace-write`
- * equivalent modes (`agent`, `auto`, `undefined`).
+ * equivalent modes (`agent`, `auto`, `undefined`). Only explicit `agent`
+ * also receives a permission profile allowing localhost network access and
+ * writes to the same CrewX home. `auto`/`undefined` keep their existing policy.
+ *
+ * All overrides use `-c`, supported by both `exec` and `exec resume`. Keep
+ * writable_roots for older Codex versions that ignore permission profiles
+ * and fall back to the closed workspace-write sandbox. No version gate.
  *
  * No-ops for:
  *   - Non-codex providers.

package/dist/bootstrap/codex-writable-roots.js

@@ -1,88 +1 @@
-"use strict";
-/**
- * CLI-layer policy: inject CrewX home as an extra writable root for Codex
- * `workspace-write` sandbox invocations.
- *
- * Why this lives in packages/cli (not packages/sdk):
- * CrewX home (`~/.crewx` by default) is a product-specific path. The SDK's
- * `additionalArgsProvider` extension point (WI-20260703-001) exists precisely
- * so that product layers like this CLI can inject such paths without the SDK
- * knowing about them.
- *
- * Why `-c sandbox_workspace_write.writable_roots=[...]` instead of `--add-dir`:
- * Verified against codex-cli 0.139.0 (`codex exec --help` / `codex exec resume --help`):
- *   - `codex exec` supports `--add-dir <DIR>`.
- *   - `codex exec resume` does NOT support `--add-dir` (only `-c/--config`).
- * Using the `-c` config-override form works identically for both `exec` and
- * `exec resume`, avoiding a resume-incompatible flag.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.resolveCrewxHome = resolveCrewxHome;
-exports.escapeTomlBasicString = escapeTomlBasicString;
-exports.buildCodexWritableRootArgs = buildCodexWritableRootArgs;
-exports.createCodexWritableRootsProvider = createCodexWritableRootsProvider;
-const os_1 = require("os");
-const path_1 = require("path");
-/**
- * crewx.yaml / query-option `mode` values for which Codex is NOT running in
- * (or being pushed into) a `workspace-write`-equivalent sandbox. Injecting an
- * extra writable root is meaningless (read-only/plan) or redundant
- * (full-access variants already allow writes everywhere) in these modes.
- */
-const NO_INJECT_MODES = new Set([
-    'read-only',
-    'plan',
-    'agent-full-access',
-    'yolo',
-    'danger-full-access',
-]);
-/**
- * Resolve CrewX home directory.
- * Priority: `CREWX_HOME` env var → `~/.crewx`.
- */
-function resolveCrewxHome() {
-    return process.env.CREWX_HOME ?? (0, path_1.join)((0, os_1.homedir)(), '.crewx');
-}
-/**
- * Escape a string for embedding inside a TOML basic string (`"..."`).
- * Sufficient for filesystem paths: handles backslash (Windows paths),
- * double-quote, and control characters that could otherwise break TOML
- * parsing of the `-c key="value"` override.
- */
-function escapeTomlBasicString(value) {
-    return value
-        .replace(/\\/g, '\\\\')
-        .replace(/"/g, '\\"')
-        .replace(/\n/g, '\\n')
-        .replace(/\r/g, '\\r')
-        .replace(/\t/g, '\\t');
-}
-/**
- * Build the `-c sandbox_workspace_write.writable_roots=["<path>"]` arg pair.
- * Works for both `codex exec` and `codex exec resume` (config-override form).
- */
-function buildCodexWritableRootArgs(crewxHome) {
-    const escaped = escapeTomlBasicString(crewxHome);
-    return ['-c', `sandbox_workspace_write.writable_roots=["${escaped}"]`];
-}
-function isCodexProvider(ctx) {
-    return ctx.providerId === 'codex' || ctx.providerStr === 'cli/codex';
-}
-/**
- * Create an `AdditionalArgsProvider` (SDK extension point, WI-20260703-001)
- * that injects CrewX home as a Codex writable root for `workspace-write`
- * equivalent modes (`agent`, `auto`, `undefined`).
- *
- * No-ops for:
- *   - Non-codex providers.
- *   - Modes in {@link NO_INJECT_MODES} (read-only/plan/agent-full-access/yolo/danger-full-access).
- */
-function createCodexWritableRootsProvider(crewxHome = resolveCrewxHome()) {
-    return (ctx) => {
-        if (!isCodexProvider(ctx))
-            return [];
-        if (ctx.mode !== undefined && NO_INJECT_MODES.has(ctx.mode))
-            return [];
-        return buildCodexWritableRootArgs(crewxHome);
-    };
-}
+"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.resolveCrewxHome=i;exports.escapeTomlBasicString=t;exports.buildCodexWritableRootArgs=s;exports.createCodexSkipGitRepoCheckProvider=u;exports.composeAdditionalArgsProviders=p;exports.createCodexWritableRootsProvider=w;const a=require("os");const d=require("path");const l=new Set(["read-only","plan","agent-full-access","yolo","danger-full-access"]);function i(){return process.env.CREWX_HOME??(0,d.join)((0,a.homedir)(),".crewx")}function t(e){return e.replace(/\\/g,"\\\\").replace(/"/g,'\\"').replace(/\n/g,"\\n").replace(/\r/g,"\\r").replace(/\t/g,"\\t")}function s(e){const r=t(e);return["-c",`sandbox_workspace_write.writable_roots=["${r}"]`]}function n(e){return e.providerId==="codex"||e.providerStr==="cli/codex"}function u(e){return r=>{if(!n(r))return[];if(!e)return[];return["--skip-git-repo-check"]}}function p(...e){return r=>e.flatMap(o=>o(r))}function w(e=i()){return r=>{if(!n(r))return[];if(r.mode!==void 0&&l.has(r.mode))return[];const o=s(e);if(r.mode==="agent"){const c=t(e);o.push("-c","default_permissions=crewx","-c",'permissions.crewx.extends=":workspace"',"-c","features.network_proxy=true","-c","permissions.crewx.network.enabled=true","-c","permissions.crewx.network.allow_local_binding=true","-c",'permissions.crewx.network.domains={"localhost"="allow","127.0.0.1"="allow"}',"-c",`permissions.crewx.filesystem={"${c}"="write"}`)}return o}}

package/dist/bootstrap/crewx-cli.js

@@ -1,63 +1 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createCliCrewx = createCliCrewx;
-const fs_1 = require("fs");
-const path_1 = require("path");
-const os_1 = require("os");
-const sdk_1 = require("@crewx/sdk");
-const plugins_1 = require("@crewx/sdk/plugins");
-const repository_1 = require("@crewx/sdk/repository");
-const register_builtin_tools_1 = require("../register-builtin-tools");
-const version_1 = require("../utils/version");
-const codex_writable_roots_1 = require("./codex-writable-roots");
-/**
- * Build a Crewx instance with CLI-standard plugins (FileLogger + SqliteTracing)
- * and built-in tools registered. Use this from any CLI command that needs a
- * Crewx instance — keeps environment consistent across query / execute / slack / agent.
- *
- * workspaceRoot is always process.cwd()-based so that per-workspace logs land
- * in {cwd}/.crewx/logs/. Critical for file:// remote agent delegation.
- *
- * Behavior:
- *   - If configPath resolves to an existing file → load it (with built-ins merged)
- *   - If configPath is NOT set via CREWX_CONFIG env AND the file doesn't exist →
- *     fall back to built-in-only mode (no user yaml required)
- *   - If CREWX_CONFIG is explicitly set AND the file doesn't exist → throw
- */
-async function createCliCrewx(configPath = process.env.CREWX_CONFIG ?? 'crewx.yaml') {
-    const absConfigPath = (0, path_1.resolve)(configPath);
-    // workspaceRoot is always cwd-based, never package-internal
-    const workspaceRoot = process.cwd();
-    const isExplicitConfig = Boolean(process.env.CREWX_CONFIG);
-    const fileExists = (0, fs_1.existsSync)(absConfigPath);
-    let yamlPath;
-    if (fileExists) {
-        yamlPath = absConfigPath;
-    }
-    else if (isExplicitConfig) {
-        throw new Error(`[crewx] Config file not found: ${absConfigPath} (set via CREWX_CONFIG)`);
-    }
-    else {
-        yamlPath = undefined;
-    }
-    // Run drizzle migrations once at bootstrap — plugin relies on this guarantee.
-    const dbDir = (0, path_1.join)((0, os_1.homedir)(), '.crewx');
-    (0, fs_1.mkdirSync)(dbDir, { recursive: true });
-    const dbPath = (0, path_1.join)(dbDir, 'crewx.db');
-    const handle = (0, repository_1.openDrizzleDb)(dbPath);
-    try {
-        (0, repository_1.runMigrations)(handle.db);
-    }
-    finally {
-        handle.close();
-    }
-    const crewx = await sdk_1.Crewx.loadYaml(yamlPath, {
-        remoteFactory: createCliCrewx,
-        additionalArgsProvider: (0, codex_writable_roots_1.createCodexWritableRootsProvider)(),
-    });
-    (0, register_builtin_tools_1.registerBuiltinToolsIfNeeded)(crewx);
-    await crewx.use(new plugins_1.ConversationPlugin());
-    await crewx.use(new plugins_1.FileLoggerPlugin({ version: version_1.CLI_VERSION, workspaceRoot }));
-    await crewx.use(new plugins_1.SqliteTracingPlugin({ version: version_1.CLI_VERSION }));
-    return crewx;
-}
+"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.createCliCrewx=m;const n=require("fs");const t=require("path");const x=require("os");const s=require("@crewx/sdk");const h=require("@crewx/workflow/list");const a=require("@crewx/sdk/plugins");const l=require("@crewx/sdk/repository");const y=require("../register-builtin-tools");const _=require("../utils/version");const R=require("../utils/inherited-trace");const d=require("./codex-writable-roots");const k=require("./rate-limit-snapshot");async function m(v=process.env.CREWX_CONFIG??"crewx.yaml"){const o=(0,t.resolve)(v);const u=process.cwd();const C=Boolean(process.env.CREWX_CONFIG);const P=(0,n.existsSync)(o);let e;if(P){e=o}else if(C){throw new Error(`[crewx] Config file not found: ${o} (set via CREWX_CONFIG)`)}else{e=void 0}const f=e!==void 0?(0,t.dirname)(o):void 0;const c=process.env.CREWX_DB||(0,t.join)((0,x.homedir)(),".crewx","crewx.db");(0,n.mkdirSync)((0,t.dirname)(c),{recursive:true});const w=(0,l.openDrizzleDb)(c);try{(0,l.runMigrations)(w.db)}finally{w.close()}const r=await s.Crewx.loadYaml(e,{remoteFactory:m,inheritWorktreeOwner:true,additionalArgsProvider:(0,d.composeAdditionalArgsProviders)((0,d.createCodexWritableRootsProvider)(),(0,d.createCodexSkipGitRepoCheckProvider)(f)),onRateLimitObserved:(0,k.createRateLimitSnapshotObserver)()});(0,y.registerBuiltinToolsIfNeeded)(r);r.registerPromptListProvider(s.Crewx.createAgentListPromptResolver(e));r.registerPromptListProvider((0,h.createWorkflowListPromptResolver)(e));await r.use(new a.ConversationPlugin({dbPath:c}));await r.use(new a.FileLoggerPlugin({version:_.CLI_VERSION,workspaceRoot:u}));await r.use(new a.SqliteTracingPlugin({version:_.CLI_VERSION,runnerIdentity:(0,R.consumeInheritedRunnerIdentity)(),inheritWorktreeOwner:true}));const p=e!==void 0?(0,t.dirname)(e):u;const g=(0,s.normalizeWorkspacePath)(p);const i=(0,s.resolveWorkspaceOwnerPath)(p);if(i!==g&&((0,n.existsSync)((0,t.join)(i,"crewx.yaml"))||(0,n.existsSync)((0,t.join)(i,"crewx.yml")))){try{new l.WorkspaceRepository().registerWorkspace(i)}catch{}}return r}

package/dist/bootstrap/rate-limit-snapshot.d.ts

@@ -0,0 +1,15 @@
+import type { ProviderRateLimitObservation } from '@crewx/sdk';
+import { UsageLimitSnapshotRepository } from '@crewx/sdk/repository';
+/** At most one snapshot write per account and window within this window of observations. */
+export declare const RATE_LIMIT_SNAPSHOT_THROTTLE_MS = 30000;
+/**
+ * Persists the Claude usage windows observed during a run into usage_limit_snapshots,
+ * keyed by the named account that ran it. The server reads tokens only for the default login,
+ * so named accounts get their limit history from these observations.
+ *
+ * Only named accounts are written. The default login's rows belong to the server's oauth
+ * writer, which uses the same unique key; writing them here would make the source flip.
+ *
+ * Observation only: a failed write is logged and never fails or slows the run.
+ */
+export declare function createRateLimitSnapshotObserver(sink?: Pick<UsageLimitSnapshotRepository, 'upsert'>): (observation: ProviderRateLimitObservation) => void;

package/dist/bootstrap/rate-limit-snapshot.js

@@ -0,0 +1 @@
+"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.RATE_LIMIT_SNAPSHOT_THROTTLE_MS=void 0;exports.createRateLimitSnapshotObserver=S;const u=require("@crewx/sdk");const _=require("@crewx/sdk/repository");exports.RATE_LIMIT_SNAPSHOT_THROTTLE_MS=3e4;const T=[["five_hour","five_hour"],["seven_day","weekly"]];function S(e=new _.UsageLimitSnapshotRepository){const n=new Map;return t=>{if(t.provider!=="cli/claude")return;if(t.accountId===u.DEFAULT_AI_ACCOUNT_ID)return;const r=t.observedAt.getTime();for(const[a,o]of T){const i=t.windows[a];if(!i)continue;const s=`${t.accountId}:${o}`;const c=n.get(s);if(c!==void 0&&r-c<exports.RATE_LIMIT_SNAPSHOT_THROTTLE_MS)continue;n.set(s,r);try{e.upsert(f(t,o,i))}catch(d){console.error(`[crewx] rate-limit snapshot write failed (${o}): ${I(d)}`)}}}}function f(e,n,t){const r=A(t.utilization);return{id:(0,u.generateId)("uls"),provider:"claude",accountRef:e.accountId,limitWindow:n,bucketStartMs:e.observedAt.getTime(),capturedAt:e.observedAt.toISOString(),usedPercent:r,remainingPercent:100-r,resetsAt:p(t.resetsAt),source:"cli_observed"}}function A(e){return Math.round(Math.min(1,Math.max(0,e))*100)}function p(e){return new Date(e*1e3).toISOString()}function I(e){return e instanceof Error?e.message:String(e)}

package/dist/builtin.d.ts

@@ -12,4 +12,4 @@ export declare const BUILTIN_COMMANDS: Set<string>;
  * Falls back to direct main() call on any tracer failure.
  */
 export declare function wrapWithTracer(builtinName: string, main: (args?: string[]) => Promise<void>, args: string[]): Promise<void>;
-export declare function handleBuiltin(builtinName: string, args: string[]): Promise<void>;
+export declare function handleBuiltin(builtinName: string, args: string[], productPackageRoot?: string): Promise<void>;

package/dist/builtin.js

@@ -1,127 +1,5 @@
-"use strict";
-/**
- * Built-in tool router.
- *
- * Routes built-in commands (memory, search, doc, etc.) to their respective
- * @crewx/* package CLI entry points.
- *
- * Copied and adapted from packages/cli-bak/src/cli/builtin.handler.ts.
- */
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.BUILTIN_COMMANDS = void 0;
-exports.wrapWithTracer = wrapWithTracer;
-exports.handleBuiltin = handleBuiltin;
-const BUILTIN_MAP = {
-    memory: () => Promise.resolve().then(() => __importStar(require('@crewx/memory/cli'))),
-    search: () => Promise.resolve().then(() => __importStar(require('@crewx/search/cli'))),
-    doc: () => Promise.resolve().then(() => __importStar(require('@crewx/doc/cli'))),
-    wbs: () => Promise.resolve().then(() => __importStar(require('@crewx/wbs/cli'))),
-    cron: () => Promise.resolve().then(() => __importStar(require('@crewx/cron/cli'))),
-    workflow: () => Promise.resolve().then(() => __importStar(require('@crewx/workflow/cli'))),
-    skill: () => Promise.resolve().then(() => __importStar(require('@crewx/skill/cli'))),
-    dreaming: () => Promise.resolve().then(() => __importStar(require('@crewx/dreaming/cli'))),
-    wi: () => Promise.resolve().then(() => __importStar(require('@crewx/wi/cli'))),
-    chromex: () => Promise.resolve().then(() => __importStar(require('@crewx/chromex/cli'))),
-};
-exports.BUILTIN_COMMANDS = new Set(Object.keys(BUILTIN_MAP));
-// Load skill-tracer for observability (graceful degradation if unavailable)
-async function loadTracer() {
-    try {
-        return await Promise.resolve().then(() => __importStar(require('@crewx/shared/skill-tracer')));
-    }
-    catch {
-        return null;
-    }
-}
-/**
- * Wrap main() with tracer.run() if tracer is available.
- * Falls back to direct main() call on any tracer failure.
- */
-async function wrapWithTracer(builtinName, main, args) {
-    let tracer = null;
-    try {
-        tracer = await loadTracer();
-    }
-    catch {
-        // tracer unavailable — proceed without it
-    }
-    if (tracer) {
-        let mainError = null;
-        let mainCompleted = false;
-        try {
-            await tracer.run(`crewx/${builtinName}`, async () => {
-                try {
-                    await main(args);
-                    mainCompleted = true;
-                }
-                catch (err) {
-                    mainError = err;
-                    throw err;
-                }
-            });
-            return;
-        }
-        catch {
-            if (mainError)
-                throw mainError;
-            if (mainCompleted)
-                return;
-            // tracer setup error — fall back
-        }
-    }
-    await main(args);
-}
-async function handleBuiltin(builtinName, args) {
-    const loader = BUILTIN_MAP[builtinName];
-    if (!loader) {
-        console.error(`Unknown built-in tool: ${builtinName}`);
-        process.exit(1);
-    }
-    try {
-        const mod = await loader();
-        await wrapWithTracer(builtinName, mod.main.bind(mod), args);
-    }
-    catch (err) {
-        const code = err.code;
-        if (code === 'MODULE_NOT_FOUND' || code === 'ERR_MODULE_NOT_FOUND') {
-            console.error(`\n  Built-in tool '${builtinName}' is not installed.\n`);
-            console.error(`  Install it with:\n`);
-            console.error(`    npm install @crewx/${builtinName}\n`);
-            process.exit(1);
-        }
-        throw err;
-    }
-}
+"use strict";var u=exports&&exports.__createBinding||(Object.create?(function(n,r,i,t){if(t===void 0)t=i;var e=Object.getOwnPropertyDescriptor(r,i);if(!e||("get"in e?!r.__esModule:e.writable||e.configurable)){e={enumerable:true,get:function(){return r[i]}}}Object.defineProperty(n,t,e)}):(function(n,r,i,t){if(t===void 0)t=i;n[t]=r[i]}));var f=exports&&exports.__setModuleDefault||(Object.create?(function(n,r){Object.defineProperty(n,"default",{enumerable:true,value:r})}):function(n,r){n["default"]=r});var o=exports&&exports.__importStar||(function(){var n=function(r){n=Object.getOwnPropertyNames||function(i){var t=[];for(var e in i)if(Object.prototype.hasOwnProperty.call(i,e))t[t.length]=e;return t};return n(r)};return function(r){if(r&&r.__esModule)return r;var i={};if(r!=null){for(var t=n(r),e=0;e<t.length;e++)if(t[e]!=="default")u(i,r,t[e])}f(i,r);return i}})();Object.defineProperty(exports,"__esModule",{value:true});exports.BUILTIN_COMMANDS=void 0;exports.wrapWithTracer=s;exports.handleBuiltin=w;const l={memory:()=>Promise.resolve().then(()=>o(require("@crewx/memory/cli"))),search:()=>Promise.resolve().then(()=>o(require("@crewx/search/cli"))),doc:()=>Promise.resolve().then(()=>o(require("@crewx/doc/cli"))),wbs:()=>Promise.resolve().then(()=>o(require("@crewx/wbs/cli"))),cron:()=>Promise.resolve().then(()=>o(require("@crewx/cron/cli"))),workflow:()=>Promise.resolve().then(()=>o(require("@crewx/workflow/cli"))),skill:()=>Promise.resolve().then(()=>o(require("@crewx/skill/cli"))),dreaming:()=>Promise.resolve().then(()=>o(require("@crewx/dreaming/cli"))),wi:()=>Promise.resolve().then(()=>o(require("@crewx/wi/cli"))),chromex:()=>Promise.resolve().then(()=>o(require("@crewx/chromex/cli"))),notify:()=>Promise.resolve().then(()=>o(require("@crewx/notify/cli"))),app:()=>Promise.resolve().then(()=>o(require("@crewx/app/cli")))};exports.BUILTIN_COMMANDS=new Set(Object.keys(l));async function h(){try{return await Promise.resolve().then(()=>o(require("@crewx/shared/skill-tracer")))}catch{return null}}async function s(n,r,i){let t=null;try{t=await h()}catch{}if(t){let e=null;let a=false;try{await t.run(`crewx/${n}`,async()=>{try{await r(i);a=true}catch(c){e=c;throw c}});return}catch{if(e)throw e;if(a)return}}await r(i)}async function w(n,r,i){const t=l[n];if(!t){console.error(`Unknown built-in tool: ${n}`);process.exit(1)}try{const e=await t();const a=n==="skill"?c=>e.main(c,{productPackageRoot:i}):e.main.bind(e);await s(n,a,r)}catch(e){const a=e.code;if(a==="MODULE_NOT_FOUND"||a==="ERR_MODULE_NOT_FOUND"){console.error(`
+  Built-in tool '${n}' is not installed.
+`);console.error(`  Install it with:
+`);console.error(`    npm install @crewx/${n}
+`);process.exit(1)}throw e}}

package/dist/commands/agent.d.ts

@@ -8,5 +8,6 @@
  * Subcommands:
  *   ls | list | (none) — list agents (default)
  *   prompt <agentId>   — print rendered system prompt
+ *   interceptor test   — dry-run an agent's interceptor chain on a text
  */
 export declare function handleAgent(args: string[]): Promise<void>;

package/dist/commands/agent.js

@@ -1,246 +1,3 @@
-"use strict";
-/**
- * crewx agent handler.
- * Dispatches `crewx agent ls` and `crewx agent prompt` subcommands.
- */
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.handleAgent = handleAgent;
-const path = __importStar(require("path"));
-const fs_1 = require("fs");
-const crewx_cli_1 = require("../bootstrap/crewx-cli");
-const sdk_1 = require("@crewx/sdk");
-const skill_1 = require("@crewx/skill");
-/**
- * Parse a flag from args array.
- * Supports both `--flag=value` and `--flag value` forms.
- * Returns undefined if flag is not present.
- */
-function parseFlag(args, flag) {
-    const prefix = `--${flag}=`;
-    for (let i = 0; i < args.length; i++) {
-        if (args[i].startsWith(prefix)) {
-            return args[i].slice(prefix.length);
-        }
-        if (args[i] === `--${flag}` && i + 1 < args.length) {
-            return args[i + 1];
-        }
-    }
-    return undefined;
-}
-/**
- * Format provider field for display.
- */
-function formatProvider(provider) {
-    return Array.isArray(provider) ? provider.join(', ') : provider;
-}
-/**
- * Print the agent list.
- */
-function printAgentList(agents, total, isFiltered) {
-    const configPath = process.env.CREWX_CONFIG ?? null;
-    if (agents.length === 0) {
-        console.log('WARNING: No agents configured.');
-        if (!configPath) {
-            console.log('Set CREWX_CONFIG to point to your crewx.yaml configuration file.');
-        }
-        return;
-    }
-    const headerCount = isFiltered ? `${agents.length} / ${total}` : `${total}`;
-    console.log(`Available Agents (${headerCount})\n`);
-    agents.forEach((agent, index) => {
-        const headerParts = [`@${agent.id}`];
-        if (agent.name && agent.name !== agent.id) {
-            headerParts.push(agent.name);
-        }
-        console.log(`${index + 1}. ${headerParts.join(' - ')}`);
-        console.log(`   Provider: ${formatProvider(agent.provider)}`);
-        const workDir = agent.working_directory ?? agent.workingDirectory ?? '.';
-        console.log(`   Working Dir: ${workDir}`);
-        if (agent.role) {
-            console.log(`   Role: ${agent.role}`);
-        }
-        if (agent.team) {
-            console.log(`   Team: ${agent.team}`);
-        }
-        if (agent.description) {
-            console.log(`   Description: ${agent.description}`);
-        }
-        if (index < agents.length - 1) {
-            console.log('');
-        }
-    });
-    const configSource = configPath ? 'External YAML file' : 'Default hardcoded values';
-    console.log(`\nConfiguration Source: ${configSource}`);
-    if (configPath) {
-        console.log(`Config Path: ${configPath}`);
-    }
-    else {
-        console.log('Tip: Set CREWX_CONFIG to point to your crewx.yaml file to customize agents.');
-    }
-}
-/**
- * Handle `crewx agent ls` — list agents with optional filters.
- */
-async function handleAgentList(crewx, args) {
-    const role = parseFlag(args, 'role');
-    const team = parseFlag(args, 'team');
-    const provider = parseFlag(args, 'provider');
-    const isFiltered = !!(role || team || provider);
-    const total = crewx.agents.size;
-    const filtered = crewx.filterAgents({ role, team, provider });
-    printAgentList(filtered, total, isFiltered);
-}
-/**
- * Handle `crewx agent prompt <agentId>` — print fully rendered system prompt.
- * Renders Handlebars template variables via Crewx.renderAgentPromptFull().
- */
-async function handleAgentPrompt(crewx, args) {
-    // Find the agent id argument (first non-flag arg after 'prompt')
-    const agentIdRaw = args.find(a => !a.startsWith('--'));
-    if (!agentIdRaw) {
-        console.error('Missing agent ID. Usage: crewx agent prompt @agent_name');
-        process.exit(1);
-    }
-    try {
-        const skills = loadAgentSkills();
-        const rendered = await crewx.renderAgentPromptFull(agentIdRaw, {
-            env: process.env,
-            session: { mode: 'query', platform: 'cli' },
-            skills,
-        });
-        const displayId = agentIdRaw.startsWith('@') ? agentIdRaw.slice(1) : agentIdRaw;
-        console.log(`\n🤖 **Rendered Prompt for Agent: ${displayId}**\n`);
-        console.log('--- BEGIN PROMPT ---');
-        console.log(rendered);
-        console.log('--- END PROMPT ---');
-    }
-    catch (err) {
-        const message = err instanceof Error ? err.message : String(err);
-        console.error(`Failed to get agent prompt: ${message}`);
-        process.exit(1);
-    }
-}
-/**
- * Handle `crewx agent [subcommand] [options]`.
- *
- * Subcommands:
- *   ls | list | (none) — list agents (default)
- *   prompt <agentId>   — print rendered system prompt
- */
-async function handleAgent(args) {
-    const configPath = process.env.CREWX_CONFIG ?? 'crewx.yaml';
-    let crewx;
-    try {
-        crewx = await (0, crewx_cli_1.createCliCrewx)(configPath);
-    }
-    catch (err) {
-        if (err instanceof sdk_1.ConfigLoadError && !(0, fs_1.existsSync)(configPath)) {
-            const subcommand = (args[0] ?? '').toLowerCase();
-            if (!subcommand || subcommand === 'ls' || subcommand === 'list') {
-                console.log('WARNING: No agents configured.');
-                console.log(`No crewx.yaml found. Run 'crewx init' to create one.`);
-                return;
-            }
-        }
-        throw err;
-    }
-    const subcommand = (args[0] ?? '').toLowerCase();
-    switch (subcommand) {
-        case 'ls':
-        case 'list':
-            await handleAgentList(crewx, args.slice(1));
-            return;
-        case '':
-            // Default: no subcommand → ls
-            await handleAgentList(crewx, args.slice(1));
-            return;
-        case 'prompt':
-        case 'p':
-            await handleAgentPrompt(crewx, args.slice(1));
-            return;
-        default:
-            console.error(`Unknown agent subcommand: ${subcommand}`);
-            printAgentHelp();
-            process.exit(1);
-    }
-}
-/**
- * Discover available skills and convert to SkillEntry format for template rendering.
- * Searches skills/ and node_modules/@crewx directories.
- */
-function loadAgentSkills() {
-    try {
-        const engine = new skill_1.SkillEngine(process.cwd());
-        const discovered = engine.discover();
-        return discovered.map(s => ({
-            metadata: {
-                name: s.name,
-                version: s.version ?? '0.0.0',
-                description: s.description ?? '',
-            },
-            filePath: s.skillMdPath ?? path.join(s.dir, 'SKILL.md'),
-        }));
-    }
-    catch {
-        return [];
-    }
-}
-function printAgentHelp() {
-    console.log(`
-CrewX Agent Management
-
-Usage:
-  crewx agent             # List configured agents (default)
-  crewx agent ls          # List configured agents
-  crewx agent list        # Alias for ls
-  crewx agent prompt <id> # Inspect rendered agent prompt
-
-Filter Options (for agent ls):
-  --role <value>      Filter by agent role (comma-separated for multiple: PM,Dev)
-  --team <value>      Filter by agent team (comma-separated for multiple)
-  --provider <value>  Filter by provider (comma-separated, partial match: claude)
-
-Examples:
-  crewx agent
-  crewx agent ls
-  crewx agent ls --role=PM
-  crewx agent ls --team="CrewX Core Team"
-  crewx agent ls --provider=claude
-  crewx agent ls --role=PM --provider=claude
-  crewx agent ls --role=PM,general
-  CREWX_CONFIG=./crewx.yaml crewx agent list
-`.trim());
-}
+"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.handleAgent=y;const f=require("fs");const u=require("../bootstrap/crewx-cli");const g=require("@crewx/sdk");const h=require("./command-help");function a(o,n){const t=`--${n}=`;for(let e=0;e<o.length;e++){if(o[e].startsWith(t)){return o[e].slice(t.length)}if(o[e]===`--${n}`&&e+1<o.length){return o[e+1]}}return void 0}function m(o,n,t){console.log((0,g.formatAgentList)({agents:o,total:n,isFiltered:t,configPath:process.env.CREWX_CONFIG??null}))}async function p(o,n){const t=a(n,"role");const e=a(n,"team");const r=a(n,"provider");const c=!!(t||e||r);const d=o.agents.size;const l=o.filterAgents({role:t,team:e,provider:r});m(l,d,c)}async function x(o,n){const t=n.find(e=>!e.startsWith("--"));if(!t){console.error("Missing agent ID. Usage: crewx agent prompt @agent_name");process.exit(1)}try{const e=await o.renderAgentPromptFull(t,{env:process.env,session:{mode:"query",platform:"cli"}});const r=t.startsWith("@")?t.slice(1):t;console.log(`
+\u{1F916} **Rendered Prompt for Agent: ${r}**
+`);console.log("--- BEGIN PROMPT ---");console.log(e);console.log("--- END PROMPT ---")}catch(e){const r=e instanceof Error?e.message:String(e);console.error(`Failed to get agent prompt: ${r}`);process.exit(1)}}function w(o){const n=[];for(let t=0;t<o.length;t++){const e=o[t];if(e==="--json")continue;if(e.startsWith("--")){if(!e.includes("="))t++;continue}n.push(e)}return n}async function $(o,n){if((n[0]??"").toLowerCase()!=="test"){console.error('Usage: crewx agent interceptor test <agentId> --phase request|response --text "<text>" [--json]');process.exit(1)}const t=n.slice(1);const e=w(t)[0];const r=a(t,"phase");const c=a(t,"text");const d=t.includes("--json");if(!e||r!=="request"&&r!=="response"||c===void 0){console.error('Usage: crewx agent interceptor test <agentId> --phase request|response --text "<text>" [--json]');process.exit(1)}const l=e.startsWith("@")?e.slice(1):e;let i;try{i=await o.testAgentInterceptors(l,r,c)}catch(s){if(s instanceof g.AgentInterceptorConfigError){console.error(`${s.code}: ${s.message}`);process.exit(1)}throw s}if(!i){if(d){console.log(JSON.stringify({agentId:l,phase:r,status:"passed",text:c,changed:false,steps:[]},null,2))}else{console.log(`@${l} has no enabled ${r} interceptors; the text passes unchanged.`)}return}if(d){console.log(JSON.stringify({agentId:l,...i},null,2))}else{console.log(`Interceptor test: @${l} ${r} lane`);for(const s of i.steps){console.log(`  [${s.outcome}] ${s.name} (${s.type}, ${s.mode}, failOpen=${s.failOpen}) ${s.durationMs}ms`);if(s.error)console.log(`      error ${s.error.code}: ${s.error.message}`);if(s.verdict)console.log(`      verdict valid=${s.verdict.valid}${s.verdict.severity?` severity=${s.verdict.severity}`:""}`)}if(i.status==="passed"){console.log(`Final text${i.changed?" (changed)":""}:`);console.log(i.text)}else{console.log(`INTERCEPTOR_BLOCKED: ${i.blocked?.message??"blocked"}`)}}if(i.status==="blocked")process.exit(1)}async function y(o){const n=process.env.CREWX_CONFIG??"crewx.yaml";let t;try{t=await(0,u.createCliCrewx)(n)}catch(r){if(r instanceof g.ConfigLoadError&&!(0,f.existsSync)(n)){const c=(o[0]??"").toLowerCase();if(!c||c==="ls"||c==="list"){console.log("WARNING: No agents configured.");console.log(`No crewx.yaml found. Run 'crewx init' to create one.`);return}}throw r}const e=(o[0]??"").toLowerCase();switch(e){case"ls":case"list":await p(t,o.slice(1));return;case"":await p(t,o.slice(1));return;case"prompt":case"p":await x(t,o.slice(1));return;case"interceptor":await $(t,o.slice(1));return;default:console.error(`Unknown agent subcommand: ${e}`);v();process.exit(1)}}function v(){console.log(h.AGENT_USAGE)}

package/dist/commands/ai-account.d.ts

@@ -0,0 +1,4 @@
+/** Run one `crewx ai-account` subcommand. Returns the process exit code. */
+export declare function runAiAccountCommand(args: string[]): number;
+/** Entry used by main.ts. */
+export declare function handleAiAccount(args: string[]): Promise<void>;

package/dist/commands/ai-account.js

@@ -0,0 +1,27 @@
+"use strict";Object.defineProperty(exports,"__esModule",{value:true});exports.runAiAccountCommand=w;exports.handleAiAccount=y;const f=require("child_process");const s=require("@crewx/sdk");const d=require("./parse-common-flags");const v={claude:"cli/claude","cli/claude":"cli/claude",codex:"cli/codex","cli/codex":"cli/codex"};const u=`Usage:
+  crewx ai-account list [--provider claude|codex] [--json]
+  crewx ai-account add --provider claude|codex --label <name> [--json]
+  crewx ai-account login <id> [--provider claude|codex]
+  crewx ai-account status <id> [--provider claude|codex] [--json]
+  crewx ai-account use <id> --provider claude|codex
+  crewx ai-account remove <id>`;function g(o){if(o===void 0)return void 0;const t=v[o];if(!t)throw new d.UnknownOptionError(`Unknown provider: ${o} (use claude or codex)`);return t}function m(o){const t={positional:[],json:false};for(let i=0;i<o.length;i+=1){const e=o[i];if(e==="--json"){t.json=true}else if(e==="--provider"||e.startsWith("--provider=")){const n=e.includes("=")?e.slice("--provider=".length):o[++i];t.provider=g(n)}else if(e==="--label"||e.startsWith("--label=")){t.label=e.includes("=")?e.slice("--label=".length):o[++i]}else if(e.startsWith("--")){throw new d.UnknownOptionError(`Unknown option: ${e}`)}else{t.positional.push(e)}}return t}function p(o){let t=0;for(const i of o){const e=i.codePointAt(0)??0;const n=e>=4352&&e<=4447||e>=11904&&e<=42191||e>=44032&&e<=55203||e>=63744&&e<=64255||e>=65280&&e<=65376;t+=n?2:1}return t}function h(o){const t=o.map(r=>[r.provider,r.id,r.active?"*":"",r.label,r.dir]);const i=["PROVIDER","ID","ACTIVE","LABEL","DIR"];const e=i.map((r,c)=>Math.max(p(r),...t.map(a=>p(a[c]))));const n=r=>r.map((c,a)=>c+" ".repeat(e[a]-p(c))).join("  ").trimEnd();return[n(i),...t.map(n)].join("\n")}function x(o){return o?[o]:["cli/claude","cli/codex"]}function $(o,t,i,e){if(o==="cli/codex"){const a=t.trim();return{loggedIn:i===0,lines:[...a?[a]:[],`loggedIn:${i===0}`,`configDirectory:${e}`]}}let n={};try{n=JSON.parse(t)}catch{}const r=n.loggedIn===true;const c=[`loggedIn:${r}`];if(typeof n.authMethod==="string")c.push(`authMethod:${n.authMethod}`);if(typeof n.subscriptionType==="string")c.push(`subscriptionType:${n.subscriptionType}`);c.push(`configDirectory:${e}`);return{loggedIn:r,lines:c}}function A(o,t,i){const e=(0,s.getStatusInvocation)(o,t);const n=(0,f.spawnSync)(e.command,e.argv,{env:(0,s.applyAiAccountEnv)(process.env,e),encoding:"utf8",timeout:3e4});if(n.error){process.stderr.write(`Could not start ${e.command}: ${n.error.message}
+`);return 2}const r=e.command==="codex"?"cli/codex":"cli/claude";const c=e.env.CLAUDE_CONFIG_DIR??e.env.CODEX_HOME??E(r);const a=r==="cli/codex"?`${n.stdout??""}${n.stderr??""}`:n.stdout??"";const l=$(r,a,n.status??1,c);if(i){process.stdout.write(`${JSON.stringify({id:o,provider:r,loggedIn:l.loggedIn,configDirectory:c})}
+`)}else{process.stdout.write(`${l.lines.join("\n")}
+`)}return l.loggedIn?0:1}function E(o){return(0,s.listAiAccounts)(o).find(t=>t.builtIn)?.dir??""}function O(o,t){const i=(0,s.getLoginInvocation)(o,t);process.stdout.write(`Running official login: ${i.command} ${i.argv.join(" ")}
+`);const e=(0,f.spawnSync)(i.command,i.argv,{env:(0,s.applyAiAccountEnv)(process.env,i),stdio:"inherit"});if(e.error){process.stderr.write(`Could not start ${i.command}: ${e.error.message}
+`);return 2}return e.status??1}function w(o){const[t,...i]=o;const e=m(i);const n=e.positional[0];try{switch(t){case"list":{const r=x(e.provider).flatMap(c=>(0,s.listAiAccounts)(c));process.stdout.write(e.json?`${JSON.stringify(r)}
+`:`${h(r)}
+`);return 0}case"add":{if(!e.provider)throw new d.UnknownOptionError("add requires --provider claude|codex");if(e.label===void 0)throw new d.UnknownOptionError("add requires --label <name>");const r=(0,s.addAiAccount)(e.provider,e.label);if(e.json){process.stdout.write(`${JSON.stringify({provider:e.provider,...r})}
+`)}else{process.stdout.write(`added ${r.id} for ${e.provider}
+configDirectory:${r.dir}
+next: crewx ai-account login ${r.id}
+`)}return 0}case"login":{if(!n)throw new d.UnknownOptionError(`login requires an account id
+${u}`);return O(n,e.provider)}case"status":{if(!n)throw new d.UnknownOptionError(`status requires an account id
+${u}`);return A(n,e.provider,e.json)}case"use":{if(!n)throw new d.UnknownOptionError(`use requires an account id
+${u}`);if(!e.provider)throw new d.UnknownOptionError("use requires --provider claude|codex");(0,s.setActiveAiAccount)(e.provider,n);process.stdout.write(`active account for ${e.provider}: ${n}
+`);return 0}case"remove":{if(!n)throw new d.UnknownOptionError(`remove requires an account id
+${u}`);const r=(0,s.removeAiAccount)(n);process.stdout.write(`removed ${n} (${r.provider}); its config directory was kept on disk
+`);return 0}default:process.stderr.write(`${u}
+`);return 2}}catch(r){if(r instanceof s.AiAccountError){process.stderr.write(`Error [${r.code}]: ${r.message}
+`);return 2}if(r instanceof d.UnknownOptionError){process.stderr.write(`${r.message}
+`);return 2}throw r}}async function y(o){process.exitCode=w(o)}