@intent-systems/nexus 2026.1.5-4 → 2026.1.5-8

package/dist/cli/credential-cli.js

@@ -1,5 +1,6 @@
 import { cancel, confirm, isCancel } from "@clack/prompts";
-import { addCredential, flagCredential, getCredential, getCredentialPaths, listCredentials, removeCredential, scanCredentialEnv, } from "../commands/credential.js";
+import { addCredential, flagCredential, getCredential, getCredentialPaths, getCredentialValue, importCliCredential, listCredentials, removeCredential, scanCredentialEnv, verifyCredentials, } from "../commands/credential.js";
+import { listCredentialEntries } from "../credentials/store.js";
 function parseFields(raw, fieldsArgs) {
     const out = {};
     if (raw) {
@@ -25,7 +26,9 @@ function parseFields(raw, fieldsArgs) {
     return out;
 }
 export function registerCredentialCli(program) {
-    const credential = program.command("credential").description("Manage credentials");
+    const credential = program
+        .command("credential")
+        .description("Manage credentials");
     credential
         .command("list")
         .description("List credentials from the index")
@@ -55,28 +58,100 @@ export function registerCredentialCli(program) {
         console.log(`\nIndex: ${paths.indexPath}`);
     });
     credential
-        .command("get")
-        .description("Get a credential record")
-        .requiredOption("--service <id>", "Service id")
-        .requiredOption("--account <id>", "Account id")
-        .requiredOption("--auth <id>", "Auth id")
+        .command("verify <service>")
+        .description("Verify credential status for a service")
         .option("--json", "Output as JSON")
-        .action(async (opts) => {
-        const result = await getCredential({
-            service: opts.service,
-            account: opts.account,
-            authId: opts.auth,
-        });
+        .action(async (service, opts) => {
+        const result = await verifyCredentials({ service });
         if (!result) {
-            console.error("Credential not found.");
+            console.error("Credential service not found.");
             process.exit(1);
         }
         if (opts.json) {
             console.log(JSON.stringify(result, null, 2));
             return;
         }
-        console.log(`\n${result.filePath}`);
-        console.log(JSON.stringify(result.record, null, 2));
+        const iconFor = (status) => status === "ok" ? "✅" : status === "skipped" ? "⚠️" : "❌";
+        console.log(`${result.ok ? "✅" : "❌"} ${result.service}: ${result.accounts} account(s) checked`);
+        for (const entry of result.checked) {
+            const err = entry.error ? ` - ${entry.error}` : "";
+            console.log(`  ${iconFor(entry.status)} ${entry.account} (${entry.authId})${err}`);
+        }
+        if (!result.ok) {
+            process.exit(1);
+        }
+    });
+    credential
+        .command("get [serviceAccount]")
+        .description("Get a credential value")
+        .option("--service <id>", "Service id")
+        .option("--account <id>", "Account id")
+        .option("--auth <id>", "Auth id")
+        .option("--json", "Output as JSON")
+        .option("--record", "Show credential record instead of value")
+        .action(async (serviceAccount, opts) => {
+        let service = opts.service;
+        let account = opts.account;
+        let authId = opts.auth;
+        if (serviceAccount && typeof serviceAccount === "string") {
+            const parts = serviceAccount.split("/").filter(Boolean);
+            if (parts.length >= 2) {
+                service = service ?? parts[0];
+                account = account ?? parts[1];
+                if (parts.length >= 3) {
+                    authId = authId ?? parts.slice(2).join("/");
+                }
+            }
+        }
+        if (!service || !account) {
+            console.error("Missing service/account. Use service/account or flags.");
+            process.exit(1);
+        }
+        if (!authId) {
+            const entries = await listCredentialEntries();
+            const matches = entries.filter((entry) => entry.service === service && entry.account === account);
+            const auths = Array.from(new Set(matches.map((entry) => entry.authId)));
+            if (auths.length === 1) {
+                authId = auths[0];
+            }
+            else {
+                console.error(`Missing --auth. Available auth ids: ${auths.join(", ") || "none"}`);
+                process.exit(1);
+            }
+        }
+        const params = {
+            service,
+            account,
+            authId,
+        };
+        if (opts.record) {
+            const result = await getCredential(params);
+            if (!result) {
+                console.error("Credential not found.");
+                process.exit(1);
+            }
+            if (opts.json) {
+                console.log(JSON.stringify(result, null, 2));
+                return;
+            }
+            console.log(`\n${result.filePath}`);
+            console.log(JSON.stringify(result.record, null, 2));
+            return;
+        }
+        const valueResult = await getCredentialValue(params);
+        if (!valueResult) {
+            console.error("Credential value not found.");
+            process.exit(1);
+        }
+        if (opts.json) {
+            console.log(JSON.stringify({
+                filePath: valueResult.filePath,
+                field: valueResult.field,
+                value: valueResult.value,
+            }, null, 2));
+            return;
+        }
+        console.log(valueResult.value);
     });
     credential
         .command("add")
@@ -86,23 +161,55 @@ export function registerCredentialCli(program) {
         .requiredOption("--type <type>", "api_key | token | oauth | config")
         .option("--auth <id>", "Auth id (defaults to type)")
         .option("--owner <owner>", "shared | user | agent:<id>", "user")
-        .option("--storage <provider>", "plaintext | keychain | 1password | external", "plaintext")
-        .option("--value <value>", "Secret value for plaintext/keychain")
+        .option("--storage <provider>", "keychain | 1password | env | external")
+        .option("--value <value>", "Secret value for keychain")
         .option("--refresh-token <token>", "OAuth refresh token")
         .option("--expires-at <ts>", "Expiration (unix ms or ISO string)")
         .option("--vault <name>", "1Password vault")
         .option("--item <name>", "1Password item")
         .option("--fields <json>", "1Password field map as JSON")
         .option("--field <pair...>", "1Password field map: key=value")
-        .option("--sync-command <cmd>", "External sync command")
+        .option("--env-var <name>", "Env var name for env storage")
+        .option("--command <cmd>", "External command to fetch secret")
+        .option("--sync-command <cmd>", "External sync command (deprecated)")
+        .option("--format <format>", "External command output format: raw|json")
+        .option("--json-path <path>", "JSON path for external output")
         .action(async (opts) => {
         const type = String(opts.type).trim();
         if (!["api_key", "token", "oauth", "config"].includes(type)) {
             console.error("Invalid --type");
             process.exit(1);
         }
-        const storage = String(opts.storage).trim();
+        const storageRaw = opts.storage ? String(opts.storage).trim() : "";
+        const storage = storageRaw || (process.platform === "darwin" ? "keychain" : "");
+        if (!storage) {
+            console.error("Missing --storage. Use keychain (macOS), 1password, env, or external.");
+            process.exit(1);
+        }
+        if (storage === "keychain" && !opts.value) {
+            console.error("Missing --value for keychain storage.");
+            process.exit(1);
+        }
+        if (storage === "env" && !opts.envVar) {
+            console.error("Missing --env-var for env storage.");
+            process.exit(1);
+        }
+        if (storage === "external" && !opts.command && !opts.syncCommand) {
+            console.error("Missing --command for external storage.");
+            process.exit(1);
+        }
+        if (opts.format && !["raw", "json"].includes(String(opts.format))) {
+            console.error("Invalid --format. Use raw or json.");
+            process.exit(1);
+        }
+        if (!["keychain", "1password", "env", "external"].includes(storage)) {
+            console.error("Invalid --storage. Use keychain, 1password, env, external.");
+            process.exit(1);
+        }
         const fields = parseFields(opts.fields, opts.field);
+        const format = opts.format === "raw" || opts.format === "json"
+            ? opts.format
+            : undefined;
         const expiresAt = opts.expiresAt && /^\d+$/.test(String(opts.expiresAt).trim())
             ? Number.parseInt(String(opts.expiresAt).trim(), 10)
             : opts.expiresAt;
@@ -121,14 +228,59 @@ export function registerCredentialCli(program) {
                         item: String(opts.item ?? ""),
                         fields,
                     }
-                    : storage === "external"
-                        ? { provider: "external", syncCommand: String(opts.syncCommand ?? "") }
-                        : { provider: "plaintext", value: opts.value },
+                    : storage === "env"
+                        ? { provider: "env", var: String(opts.envVar ?? "") }
+                        : storage === "external"
+                            ? {
+                                provider: "external",
+                                command: opts.command ? String(opts.command) : undefined,
+                                syncCommand: opts.syncCommand
+                                    ? String(opts.syncCommand)
+                                    : undefined,
+                                ...(format ? { format } : {}),
+                                jsonPath: opts.jsonPath
+                                    ? String(opts.jsonPath)
+                                    : undefined,
+                            }
+                            : { provider: "env", var: String(opts.envVar ?? "") },
             refreshToken: opts.refreshToken,
             expiresAt,
         });
         console.log(`Added credential at ${record.filePath}`);
     });
+    credential
+        .command("import <source>")
+        .description("Import external CLI credentials")
+        .option("--account <id>", "Account id override")
+        .option("--owner <owner>", "shared | user | agent:<id>", "user")
+        .option("--force", "Overwrite existing record")
+        .option("--json", "Output as JSON")
+        .option("--no-keychain-prompt", "Skip keychain prompts")
+        .action(async (source, opts) => {
+        const normalized = String(source ?? "").trim();
+        if (!["claude-cli", "codex-cli"].includes(normalized)) {
+            console.error("Invalid source. Use claude-cli or codex-cli.");
+            process.exit(1);
+        }
+        try {
+            const result = await importCliCredential({
+                source: normalized,
+                account: opts.account,
+                owner: opts.owner,
+                force: Boolean(opts.force),
+                allowKeychainPrompt: opts.keychainPrompt !== false,
+            });
+            if (opts.json) {
+                console.log(JSON.stringify(result, null, 2));
+                return;
+            }
+            console.log(`Imported ${result.source} credentials into ${result.profileId} (${result.filePath})`);
+        }
+        catch (err) {
+            console.error(err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
     credential
         .command("remove")
         .description("Remove a credential record")
@@ -147,6 +299,8 @@ export function registerCredentialCli(program) {
         .command("scan")
         .description("Scan environment variables for credentials")
         .option("--deep", "Scan all environment variables for credential patterns")
+        .option("--import", "Import detected credentials into the store")
+        .option("--account <id>", "Account id for imported credentials")
         .option("--yes", "Skip confirmation prompts")
         .option("--json", "Output as JSON")
         .action(async (opts) => {
@@ -161,6 +315,43 @@ export function registerCredentialCli(program) {
             }
         }
         const result = scanCredentialEnv({ deep: Boolean(opts.deep) });
+        if (opts.import) {
+            const accountOverride = typeof opts.account === "string" && opts.account.trim()
+                ? opts.account.trim()
+                : null;
+            const importable = [
+                ...result.known,
+                ...(result.deep ? result.discovered : []),
+            ].filter((entry) => entry.service && entry.type);
+            const existing = await listCredentialEntries();
+            const existingKeys = new Set(existing.map((entry) => `${entry.service}::${entry.account}::${entry.authId}`));
+            const imported = [];
+            const skipped = [];
+            for (const entry of importable) {
+                const account = accountOverride ?? `env:${entry.env}`;
+                const authId = entry.type ?? "token";
+                const key = `${entry.service}::${account}::${authId}`;
+                if (existingKeys.has(key)) {
+                    skipped.push(`${entry.service}/${account}/${authId}`);
+                    continue;
+                }
+                await addCredential({
+                    service: entry.service ?? "unknown",
+                    account,
+                    type: authId,
+                    storage: { provider: "env", var: entry.env },
+                });
+                imported.push(`${entry.service}/${account}/${authId}`);
+            }
+            if (opts.json) {
+                console.log(JSON.stringify({ imported, skipped, total: importable.length }, null, 2));
+                return;
+            }
+            console.log(`Imported: ${imported.length}`);
+            if (skipped.length > 0) {
+                console.log(`Skipped (already exists): ${skipped.length}`);
+            }
+        }
         if (opts.json) {
             console.log(JSON.stringify(result, null, 2));
             return;

package/dist/cli/gateway-cli.js

@@ -1,5 +1,5 @@
 import fs from "node:fs";
-import { CONFIG_PATH_NEXUS, loadConfig, resolveGatewayPort } from "../config/config.js";
+import { CONFIG_PATH_NEXUS, loadConfig, resolveGatewayPort, } from "../config/config.js";
 import { GATEWAY_LAUNCH_AGENT_LABEL, GATEWAY_SYSTEMD_SERVICE_NAME, GATEWAY_WINDOWS_TASK_NAME, } from "../daemon/constants.js";
 import { resolveGatewayService } from "../daemon/service.js";
 import { callGateway, randomIdempotencyKey } from "../gateway/call.js";

package/dist/cli/log-cli.js

@@ -0,0 +1,25 @@
+import { logCommand } from "../commands/log.js";
+import { defaultRuntime } from "../runtime.js";
+export function registerLogCli(program) {
+    program
+        .command("log")
+        .description("Show Nexus event or skill usage logs")
+        .option("--json", "Output as JSON")
+        .option("--errors", "Only include error events")
+        .option("--since <time>", "Only include events after time (e.g. 24h)")
+        .option("--limit <n>", "Limit entries", (value) => Number.parseInt(value, 10))
+        .option("--skill <name>", "Show usage log for a skill")
+        .option("--source <source>", "Filter by event source")
+        .option("--command <path>", "Filter by command path")
+        .action(async (opts) => {
+        await logCommand({
+            json: Boolean(opts.json),
+            errors: Boolean(opts.errors),
+            since: typeof opts.since === "string" ? opts.since : undefined,
+            limit: Number.isFinite(opts.limit) ? opts.limit : undefined,
+            skill: typeof opts.skill === "string" ? opts.skill : undefined,
+            source: typeof opts.source === "string" ? opts.source : undefined,
+            command: typeof opts.command === "string" ? opts.command : undefined,
+        }, defaultRuntime);
+    });
+}

package/dist/cli/pairing-cli.js

@@ -15,7 +15,7 @@ const PROVIDERS = [
     "whatsapp",
 ];
 function parseProvider(raw) {
-    const value = String(raw ?? "")
+    const value = (typeof raw === "string" || typeof raw === "number" ? String(raw) : "")
         .trim()
         .toLowerCase();
     if (PROVIDERS.includes(value))

package/dist/cli/program.js

@@ -1,25 +1,28 @@
 import { Command } from "commander";
 import { capabilitiesCommand } from "../commands/capabilities.js";
+import { configGetCommand, configListCommand, configSetCommand, } from "../commands/config.js";
 import { configViewCommand } from "../commands/config-view.js";
 import { identityCommand } from "../commands/identity.js";
 import { initCommand } from "../commands/init.js";
 import { questCommand } from "../commands/quest.js";
-import { suggestionsCommand } from "../commands/suggestions.js";
 import { statusCommand } from "../commands/status.js";
+import { suggestionsCommand } from "../commands/suggestions.js";
 import { updateCommand } from "../commands/update.js";
 import { isNixMode, migrateLegacyConfig, readConfigFileSnapshot, writeConfigFile, } from "../config/config.js";
 import { danger } from "../globals.js";
+import { recordCliCommandFinish, recordCliCommandStart, } from "../infra/event-log.js";
 import { defaultRuntime } from "../runtime.js";
 import { VERSION } from "../version.js";
-import { recordCliCommandFinish, recordCliCommandStart } from "../infra/event-log.js";
 import { registerCloudCommand } from "./cloud-cli.js";
 import { registerCredentialCli } from "./credential-cli.js";
 import { registerDnsCli } from "./dns-cli.js";
 import { registerGatewayCli } from "./gateway-cli.js";
+import { registerLogCli } from "./log-cli.js";
 import { registerSkillsCommand } from "./skills-cli.js";
 import { registerSkillsHubCommand } from "./skills-hub-cli.js";
 import { registerToolConnectorCli } from "./tool-connector-cli.js";
 import { registerUsageCli } from "./usage-cli.js";
+import { resolveIdentitySnapshot } from "../agents/identity-state.js";
 function buildCommandPath(cmd) {
     const parts = [];
     let current = cmd;
@@ -51,6 +54,19 @@ export function buildProgram() {
         });
         if (actionCommand.name() === "init")
             return;
+        const skipIdentityCheck = process.env.NODE_ENV === "test" || Boolean(process.env.VITEST);
+        if (!skipIdentityCheck && actionCommand.name() !== "status") {
+            const identity = resolveIdentitySnapshot();
+            if (!identity.ok) {
+                defaultRuntime.error("Multiple agents detected in state/agents.");
+                defaultRuntime.error(`Set NEXUS_AGENT_ID to one of: ${identity.agentOptions.join(", ")}`);
+                process.exit(2);
+            }
+            if (!identity.snapshot.hasIdentity) {
+                await statusCommand({ brief: true }, defaultRuntime);
+                process.exit(2);
+            }
+        }
         const snapshot = await readConfigFileSnapshot();
         if (snapshot.legacyIssues.length === 0)
             return;
@@ -79,50 +95,107 @@ export function buildProgram() {
         .option("--brief", "Compact output")
         .option("--capabilities", "Focus on capabilities")
         .option("--credentials", "Focus on credentials")
+        .option("--usage", "Focus on usage statistics")
+        .option("--quiet", "Minimal output, exit codes only")
         .action(async (opts) => {
         await statusCommand({
             json: Boolean(opts.json),
             brief: Boolean(opts.brief),
             capabilities: Boolean(opts.capabilities),
             credentials: Boolean(opts.credentials),
+            usage: Boolean(opts.usage),
+            quiet: Boolean(opts.quiet),
         }, defaultRuntime);
     });
     program
         .command("capabilities")
         .description("Show full capabilities map")
         .option("--json", "Output as JSON")
+        .option("--category <name>", "Filter to a category")
+        .option("--status <status>", "Filter by status")
+        .option("--compact", "Compact output")
         .action(async (opts) => {
-        await capabilitiesCommand({ json: Boolean(opts.json) }, defaultRuntime);
+        await capabilitiesCommand({
+            json: Boolean(opts.json),
+            category: opts.category ? String(opts.category) : undefined,
+            status: opts.status ? String(opts.status) : undefined,
+            compact: Boolean(opts.compact),
+        }, defaultRuntime);
     });
     program
         .command("map")
         .description("Alias for capabilities")
         .option("--json", "Output as JSON")
+        .option("--category <name>", "Filter to a category")
+        .option("--status <status>", "Filter by status")
+        .option("--compact", "Compact output")
         .action(async (opts) => {
-        await capabilitiesCommand({ json: Boolean(opts.json) }, defaultRuntime);
+        await capabilitiesCommand({
+            json: Boolean(opts.json),
+            category: opts.category ? String(opts.category) : undefined,
+            status: opts.status ? String(opts.status) : undefined,
+            compact: Boolean(opts.compact),
+        }, defaultRuntime);
     });
     program
         .command("quest")
         .description("Show onboarding quests")
         .option("--json", "Output as JSON")
+        .option("--list", "List all quests")
+        .option("--progress", "Show quest progress summary")
+        .option("--start <quest>", "Mark a quest as started")
+        .option("--secrets", "Include secret quests")
+        .option("--power-path", "Only show power-path quests")
+        .option("--quick-wins", "Only show quick wins")
         .action(async (opts) => {
-        await questCommand({ json: Boolean(opts.json) }, defaultRuntime);
+        await questCommand({
+            json: Boolean(opts.json),
+            list: Boolean(opts.list),
+            progress: Boolean(opts.progress),
+            start: opts.start ? String(opts.start) : undefined,
+            secrets: Boolean(opts.secrets),
+            powerPath: Boolean(opts.powerPath),
+            quickWins: Boolean(opts.quickWins),
+        }, defaultRuntime);
     });
     program
         .command("identity [target]")
         .description("Show identity files")
         .option("--json", "Output as JSON")
         .action(async (target, opts) => {
-        const normalized = target && (target === "user" || target === "agent") ? target : undefined;
+        const normalized = target && (target === "user" || target === "agent")
+            ? target
+            : undefined;
         await identityCommand({ target: normalized, json: Boolean(opts.json) }, defaultRuntime);
     });
-    program
-        .command("config")
+    const config = program.command("config").description("Manage config");
+    config
         .description("Show config path and status")
         .option("--json", "Output as JSON")
         .action(async (opts) => {
         await configViewCommand({ json: Boolean(opts.json) }, defaultRuntime);
     });
+    config
+        .command("list")
+        .description("List config values")
+        .option("--json", "Output as JSON")
+        .action(async (opts) => {
+        await configListCommand({ json: Boolean(opts.json) }, defaultRuntime);
+    });
+    config
+        .command("get <key>")
+        .description("Get a config value")
+        .option("--json", "Output as JSON")
+        .action(async (key, opts) => {
+        await configGetCommand({ key, json: Boolean(opts.json) }, defaultRuntime);
+    });
+    config
+        .command("set <key> <value>")
+        .description("Set a config value")
+        .option("--json", "Output as JSON")
+        .action(async (key, value, opts) => {
+        await configSetCommand({ key, value, json: Boolean(opts.json) }, defaultRuntime);
+    });
     program
         .command("update")
         .description("Update nexus CLI")
@@ -156,6 +229,7 @@ export function buildProgram() {
     registerCredentialCli(program);
     registerDnsCli(program);
     registerGatewayCli(program);
+    registerLogCli(program);
     registerToolConnectorCli(program);
     registerUsageCli(program);
     return program;

package/dist/cli/run-main.js

@@ -2,10 +2,10 @@ import process from "node:process";
 import { fileURLToPath } from "node:url";
 import { loadDotEnv } from "../infra/dotenv.js";
 import { normalizeEnv } from "../infra/env.js";
+import { initCliEventLogSession, recordCliCommandFailure, recordCliSessionEnd, registerAgentEventLogListener, } from "../infra/event-log.js";
 import { isMainModule } from "../infra/is-main.js";
 import { ensureNexusCliOnPath } from "../infra/path-env.js";
 import { assertSupportedRuntime } from "../infra/runtime-guard.js";
-import { initCliEventLogSession, recordCliCommandFailure, recordCliSessionEnd, registerAgentEventLogListener, } from "../infra/event-log.js";
 import { enableConsoleCapture } from "../logging.js";
 export async function runCli(argv = process.argv) {
     loadDotEnv({ quiet: true });