@openape/apes 0.22.1 → 0.24.0

package/dist/cli.js

@@ -379,7 +379,7 @@ async function loginWithPKCE(idp) {
   consola2.success(`Logged in as ${payload.email || payload.sub}`);
 }
 async function loginWithKey(idp, keyPath, agentEmail) {
-  const { readFileSync: readFileSync8 } = await import("fs");
+  const { readFileSync: readFileSync9 } = await import("fs");
   const { sign: sign3 } = await import("crypto");
   const { loadEd25519PrivateKey: loadEd25519PrivateKey2 } = await import("./ssh-key-YBNNG5K5.js");
   const challengeUrl = await getAgentChallengeEndpoint(idp);
@@ -392,7 +392,7 @@ async function loginWithKey(idp, keyPath, agentEmail) {
     throw new CliError(`Challenge failed: ${await challengeResp.text()}`);
   }
   const { challenge } = await challengeResp.json();
-  const keyContent = readFileSync8(keyPath, "utf-8");
+  const keyContent = readFileSync9(keyPath, "utf-8");
   const privateKey = loadEd25519PrivateKey2(keyContent);
   const signature = sign3(null, Buffer2.from(challenge), privateKey).toString("base64");
   const authenticateUrl = await getAgentAuthenticateEndpoint(idp);
@@ -1873,7 +1873,7 @@ mkdir -p "$HOME_DIR/.ssh" "$HOME_DIR/.config/apes"
 cat > "$HOME_DIR/.ssh/id_ed25519" ${shHeredoc(privatePemForHeredoc.trimEnd())}
 cat > "$HOME_DIR/.ssh/id_ed25519.pub" ${shHeredoc(`${input.publicKeySshLine}`)}
 cat > "$HOME_DIR/.config/apes/auth.json" ${shHeredoc(input.authJson)}
-${claudeBlock}${claudeTokenBlock}
+${claudeBlock}${claudeTokenBlock}${buildBridgeBlock(input.bridge)}
 chown -R "$NAME:staff" "$HOME_DIR"
 chmod 700 "$HOME_DIR/.ssh"
 chmod 700 "$HOME_DIR/.config"
@@ -1886,6 +1886,31 @@ if [ -f "$HOME_DIR/.config/openape/claude-token.env" ]; then
 fi
 
 echo "OK $NAME uid=$NEXT_UID home=$HOME_DIR"
+${buildBridgeBootstrapBlock(input.bridge)}`;
+}
+function buildBridgeBlock(bridge) {
+  if (!bridge) return "";
+  return `
+mkdir -p "$HOME_DIR/Library/Application Support/openape/bridge" "$HOME_DIR/Library/Logs" "$HOME_DIR/.pi/agent"
+cat > "$HOME_DIR/.pi/agent/.env" ${shHeredoc(bridge.envFile)}
+cat > "$HOME_DIR/Library/Application Support/openape/bridge/start.sh" ${shHeredoc(bridge.startScript)}
+chmod 755 "$HOME_DIR/Library/Application Support/openape/bridge/start.sh"
+chmod 600 "$HOME_DIR/.pi/agent/.env"
+
+# System-wide LaunchDaemon \u2014 root-owned, mode 644 (launchd refuses
+# group/world-writable plists). UserName in the plist makes launchd run
+# the binary as the agent, not root.
+cat > ${shQuote(bridge.plistPath)} ${shHeredoc(bridge.plistContent)}
+chown root:wheel ${shQuote(bridge.plistPath)}
+chmod 644 ${shQuote(bridge.plistPath)}
+`;
+}
+function buildBridgeBootstrapBlock(bridge) {
+  if (!bridge) return "";
+  return `
+launchctl bootout "system/${bridge.plistLabel}" 2>/dev/null || true
+launchctl bootstrap system ${shQuote(bridge.plistPath)} || \\
+  echo "warn: bridge bootstrap into system domain failed; check ${bridge.plistPath}"
 `;
 }
 function buildDestroyTeardownScript(input) {
@@ -1916,6 +1941,16 @@ if [ -n "$UID_OF" ]; then
   pkill -9 -u "$UID_OF" 2>/dev/null || true
 fi
 
+# Per-agent system LaunchDaemon written by spawn --bridge. Bootout +
+# delete must come BEFORE we delete the user, otherwise launchd keeps a
+# zombie reference. No-op if the plist isn't there.
+BRIDGE_LABEL="eco.hofmann.apes.bridge.$NAME"
+BRIDGE_PLIST="/Library/LaunchDaemons/$BRIDGE_LABEL.plist"
+if [ -f "$BRIDGE_PLIST" ]; then
+  launchctl bootout "system/$BRIDGE_LABEL" 2>/dev/null || true
+  rm -f "$BRIDGE_PLIST"
+fi
+
 if [ -d "$HOME_DIR" ] && [ "$HOME_DIR" != "/" ] && [ "$HOME_DIR" != "" ]; then
   rm -rf "$HOME_DIR"
 fi
@@ -2329,10 +2364,61 @@ var registerAgentCommand = defineCommand22({
 import { execFileSync as execFileSync4 } from "child_process";
 import { mkdtempSync as mkdtempSync2, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
 import { tmpdir as tmpdir2 } from "os";
-import { join as join3 } from "path";
+import { join as join4 } from "path";
 import { defineCommand as defineCommand23 } from "citty";
 import consola21 from "consola";
 
+// src/lib/chat-room.ts
+var DEFAULT_CHAT_ENDPOINT = "https://chat.openape.ai";
+function chatEndpoint() {
+  return (process.env.APE_CHAT_ENDPOINT ?? DEFAULT_CHAT_ENDPOINT).replace(/\/$/, "");
+}
+async function chatFetch(bearer, path2, init) {
+  const url = `${chatEndpoint()}${path2}`;
+  const res = await fetch(url, {
+    method: init?.method ?? "GET",
+    headers: {
+      Authorization: `Bearer ${bearer}`,
+      "Content-Type": "application/json"
+    },
+    body: init?.body !== void 0 ? JSON.stringify(init.body) : void 0
+  });
+  if (!res.ok) {
+    const detail = await res.text().catch(() => "");
+    throw new Error(`chat.openape.ai ${init?.method ?? "GET"} ${path2} \u2192 ${res.status}: ${detail.slice(0, 200)}`);
+  }
+  return await res.json();
+}
+async function findRoomByName(bearer, name) {
+  const rooms = await chatFetch(bearer, "/api/rooms");
+  return rooms.find((r) => r.name === name) ?? null;
+}
+async function createRoom(bearer, name) {
+  return chatFetch(bearer, "/api/rooms", {
+    method: "POST",
+    body: { name, kind: "channel", members: [] }
+  });
+}
+async function addMember(bearer, roomId, email, role = "member") {
+  await chatFetch(bearer, `/api/rooms/${encodeURIComponent(roomId)}/members`, {
+    method: "POST",
+    body: { email, role }
+  });
+}
+async function ensureRoomMembership(opts) {
+  const existing = await findRoomByName(opts.callerBearer, opts.roomName);
+  let room;
+  let created = false;
+  if (existing) {
+    room = existing;
+  } else {
+    room = await createRoom(opts.callerBearer, opts.roomName);
+    created = true;
+  }
+  await addMember(opts.callerBearer, room.id, opts.agentEmail);
+  return { roomId: room.id, created };
+}
+
 // src/lib/keygen.ts
 import { Buffer as Buffer4 } from "buffer";
 import { existsSync as existsSync5, mkdirSync, readFileSync as readFileSync4, writeFileSync as writeFileSync2 } from "fs";
@@ -2389,6 +2475,158 @@ function generateKeyPairInMemory() {
   };
 }
 
+// src/lib/llm-bridge.ts
+import { existsSync as existsSync6, readFileSync as readFileSync5 } from "fs";
+import { homedir as homedir5 } from "os";
+import { join as join3 } from "path";
+var PLIST_LABEL_PREFIX = "eco.hofmann.apes.bridge";
+function readLitellmEnv(envPath = join3(homedir5(), "litellm", ".env")) {
+  if (!existsSync6(envPath)) return null;
+  try {
+    const text = readFileSync5(envPath, "utf8");
+    const out = {};
+    for (const line of text.split("\n")) {
+      const trimmed = line.trim();
+      if (!trimmed || trimmed.startsWith("#")) continue;
+      const eq = trimmed.indexOf("=");
+      if (eq < 0) continue;
+      const key = trimmed.slice(0, eq).trim();
+      const value = trimmed.slice(eq + 1).trim();
+      if (key === "LITELLM_MASTER_KEY" || key === "LITELLM_API_KEY") out.apiKey = value;
+      if (key === "LITELLM_BASE_URL") out.baseUrl = value;
+    }
+    return out;
+  } catch {
+    return null;
+  }
+}
+function resolveBridgeConfig(opts) {
+  const env = readLitellmEnv(opts.envPath);
+  const apiKey = opts.cliKey ?? env?.apiKey;
+  const baseUrl = opts.cliBaseUrl ?? env?.baseUrl ?? "http://127.0.0.1:4000/v1";
+  if (!apiKey) {
+    throw new Error(
+      "No LITELLM_API_KEY resolved. Pass --bridge-key sk-\u2026 or write LITELLM_MASTER_KEY into ~/litellm/.env first."
+    );
+  }
+  return { baseUrl, apiKey };
+}
+function bridgePlistLabel(agentName) {
+  return `${PLIST_LABEL_PREFIX}.${agentName}`;
+}
+function bridgePlistPath(agentName) {
+  return `/Library/LaunchDaemons/${bridgePlistLabel(agentName)}.plist`;
+}
+function buildBridgeEnvFile(cfg) {
+  return `# Auto-generated by 'apes agents spawn --bridge'.
+# Read by the chat-bridge daemon at boot to talk to the local LLM proxy.
+LITELLM_BASE_URL=${cfg.baseUrl}
+LITELLM_API_KEY=${cfg.apiKey}
+`;
+}
+function buildBridgeStartScript() {
+  return `#!/usr/bin/env bash
+# Auto-generated by 'apes agents spawn --bridge'.
+# Idempotent installer + launcher.
+set -euo pipefail
+
+export NPM_CONFIG_PREFIX="$HOME/.npm-global"
+export PATH="$NPM_CONFIG_PREFIX/bin:/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin"
+mkdir -p "$NPM_CONFIG_PREFIX"
+
+if ! command -v openape-chat-bridge >/dev/null 2>&1; then
+  npm install -g --silent @openape/chat-bridge
+fi
+
+if ! command -v pi >/dev/null 2>&1; then
+  npm install -g --silent @mariozechner/pi-coding-agent
+fi
+
+EXT_DIR="$HOME/.pi/agent/extensions"
+mkdir -p "$EXT_DIR"
+if [ ! -f "$EXT_DIR/litellm.ts" ]; then
+  cat > "$EXT_DIR/litellm.ts" <<'PI_EXT_EOF'
+import type { ExtensionAPI } from "@mariozechner/pi-coding-agent";
+
+const BASE_URL = process.env.LITELLM_BASE_URL ?? "http://127.0.0.1:4000/v1";
+
+export default async function (pi: ExtensionAPI) {
+  pi.registerProvider("litellm", {
+    baseUrl: BASE_URL,
+    apiKey: "LITELLM_API_KEY",
+    api: "openai-completions",
+    models: [
+      {
+        id: "gpt-5.4",
+        name: "ChatGPT 5.4 (Subscription)",
+        reasoning: false,
+        input: ["text", "image"],
+        cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
+        contextWindow: 200000,
+        maxTokens: 8192,
+      },
+      {
+        id: "gpt-5.3-codex",
+        name: "ChatGPT 5.3 Codex (Subscription)",
+        reasoning: false,
+        input: ["text"],
+        cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
+        contextWindow: 200000,
+        maxTokens: 8192,
+      },
+    ],
+  });
+}
+PI_EXT_EOF
+fi
+
+set -a
+. "$HOME/.pi/agent/.env"
+set +a
+exec openape-chat-bridge
+`;
+}
+function buildBridgePlist(agentName, homeDir) {
+  const startScript = `${homeDir}/Library/Application Support/openape/bridge/start.sh`;
+  const stdoutLog = `${homeDir}/Library/Logs/openape-chat-bridge.log`;
+  const stderrLog = `${homeDir}/Library/Logs/openape-chat-bridge.err.log`;
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>Label</key>
+    <string>${bridgePlistLabel(agentName)}</string>
+    <key>UserName</key>
+    <string>${agentName}</string>
+    <key>ProgramArguments</key>
+    <array>
+        <string>/bin/bash</string>
+        <string>${startScript}</string>
+    </array>
+    <key>WorkingDirectory</key>
+    <string>${homeDir}</string>
+    <key>RunAtLoad</key>
+    <true/>
+    <key>KeepAlive</key>
+    <true/>
+    <key>ThrottleInterval</key>
+    <integer>10</integer>
+    <key>StandardOutPath</key>
+    <string>${stdoutLog}</string>
+    <key>StandardErrorPath</key>
+    <string>${stderrLog}</string>
+    <key>EnvironmentVariables</key>
+    <dict>
+        <key>HOME</key>
+        <string>${homeDir}</string>
+        <key>PATH</key>
+        <string>/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin</string>
+    </dict>
+</dict>
+</plist>
+`;
+}
+
 // src/commands/agents/spawn.ts
 var spawnAgentCommand = defineCommand23({
   meta: {
@@ -2416,6 +2654,22 @@ var spawnAgentCommand = defineCommand23({
     "claude-token-stdin": {
       type: "boolean",
       description: "Read the Claude Code OAuth token from stdin (paranoid form of --claude-token)."
+    },
+    "bridge": {
+      type: "boolean",
+      description: "Install the openape-chat-bridge daemon for this agent: drops a launchd plist that runs `@openape/chat-bridge` so the agent answers chat.openape.ai messages. Reads LITELLM_API_KEY/BASE_URL defaults from ~/litellm/.env; override via --bridge-key / --bridge-base-url."
+    },
+    "bridge-key": {
+      type: "string",
+      description: "Override LITELLM_API_KEY for the bridge (default: read from ~/litellm/.env)."
+    },
+    "bridge-base-url": {
+      type: "string",
+      description: "Override LITELLM_BASE_URL for the bridge (default: read from ~/litellm/.env or http://127.0.0.1:4000/v1)."
+    },
+    "bridge-room": {
+      type: "string",
+      description: "After spawn, create (or find) a chat.openape.ai room with this name and add the new agent as a member. Uses the spawning user's IdP bearer."
     }
   },
   async run({ args }) {
@@ -2461,8 +2715,8 @@ and try again.`
       throw new CliError(`macOS user "${name}" already exists (uid=${existing.uid ?? "?"}). Refusing to overwrite.`);
     }
     const homeDir = `/Users/${name}`;
-    const scratch = mkdtempSync2(join3(tmpdir2(), `apes-spawn-${name}-`));
-    const scriptPath = join3(scratch, "setup.sh");
+    const scratch = mkdtempSync2(join4(tmpdir2(), `apes-spawn-${name}-`));
+    const scriptPath = join4(scratch, "setup.sh");
     try {
       consola21.start(`Generating keypair for ${name}\u2026`);
       const { privatePem, publicSshLine } = generateKeyPairInMemory();
@@ -2486,6 +2740,19 @@ and try again.`
         flag: typeof args["claude-token"] === "string" ? args["claude-token"] : void 0,
         fromStdin: !!args["claude-token-stdin"]
       });
+      const bridge = args.bridge ? (() => {
+        const cfg = resolveBridgeConfig({
+          cliKey: typeof args["bridge-key"] === "string" ? args["bridge-key"] : void 0,
+          cliBaseUrl: typeof args["bridge-base-url"] === "string" ? args["bridge-base-url"] : void 0
+        });
+        return {
+          plistLabel: bridgePlistLabel(name),
+          plistPath: bridgePlistPath(name),
+          plistContent: buildBridgePlist(name, homeDir),
+          startScript: buildBridgeStartScript(),
+          envFile: buildBridgeEnvFile(cfg)
+        };
+      })() : null;
       const script = buildSpawnSetupScript({
         name,
         homeDir,
@@ -2495,13 +2762,32 @@ and try again.`
         authJson,
         claudeSettingsJson: includeClaudeHook ? CLAUDE_SETTINGS_JSON : null,
         hookScriptSource: includeClaudeHook ? BASH_VIA_APE_SHELL_HOOK_SOURCE : null,
-        claudeOauthToken
+        claudeOauthToken,
+        bridge
       });
       writeFileSync3(scriptPath, script, { mode: 448 });
       consola21.start("Running privileged setup as root via `apes run --as root --wait`\u2026");
       consola21.info("You will be asked to approve the as=root grant in your DDISA inbox; this command blocks until you do.");
       execFileSync4(apes, ["run", "--as", "root", "--wait", "--", "bash", scriptPath], { stdio: "inherit" });
       consola21.success(`Agent ${name} spawned.`);
+      const bridgeRoom = typeof args["bridge-room"] === "string" ? args["bridge-room"] : void 0;
+      if (args.bridge && bridgeRoom) {
+        try {
+          consola21.start(`Inviting agent into chat.openape.ai room "${bridgeRoom}"\u2026`);
+          const result = await ensureRoomMembership({
+            callerBearer: auth.access_token,
+            roomName: bridgeRoom,
+            agentEmail: registration.email
+          });
+          consola21.success(
+            result.created ? `Created room ${result.roomId} and added ${registration.email}` : `Room ${result.roomId} already existed; added ${registration.email}`
+          );
+        } catch (err) {
+          const msg = err instanceof Error ? err.message : String(err);
+          consola21.warn(`Could not auto-create / invite to chat room: ${msg}`);
+          consola21.info("Add the agent manually with: ape-chat members add <agent-email>");
+        }
+      }
       console.log("");
       console.log("Run as the agent with:");
       console.log(`  apes run --as ${name} -- claude --session-name ${name} --dangerously-skip-permissions`);
@@ -3359,7 +3645,7 @@ import { spawn } from "child_process";
 import { mkdtempSync as mkdtempSync3, rmSync as rmSync3, writeFileSync as writeFileSync4 } from "fs";
 import { createRequire } from "module";
 import { tmpdir as tmpdir3 } from "os";
-import { dirname as dirname2, join as join4, resolve as resolve3 } from "path";
+import { dirname as dirname2, join as join5, resolve as resolve3 } from "path";
 var require2 = createRequire(import.meta.url);
 function findProxyBin() {
   const pkgPath = require2.resolve("@openape/proxy/package.json");
@@ -3371,8 +3657,8 @@ function findProxyBin() {
   return resolve3(dirname2(pkgPath), binRel);
 }
 async function startEphemeralProxy(configToml) {
-  const tmpDir = mkdtempSync3(join4(tmpdir3(), "openape-proxy-"));
-  const configPath = join4(tmpDir, "config.toml");
+  const tmpDir = mkdtempSync3(join5(tmpdir3(), "openape-proxy-"));
+  const configPath = join5(tmpDir, "config.toml");
   writeFileSync4(configPath, configToml, { mode: 384 });
   const binPath = findProxyBin();
   const child = spawn(process.execPath, [binPath, "-c", configPath], {
@@ -3808,16 +4094,16 @@ var mcpCommand = defineCommand32({
     if (transport !== "stdio" && transport !== "sse") {
       throw new Error('Transport must be "stdio" or "sse"');
     }
-    const { startMcpServer } = await import("./server-WBR7VEDY.js");
+    const { startMcpServer } = await import("./server-J4H4UV25.js");
     await startMcpServer(transport, port);
   }
 });
 
 // src/commands/init/index.ts
-import { existsSync as existsSync6, copyFileSync, writeFileSync as writeFileSync5 } from "fs";
+import { existsSync as existsSync7, copyFileSync, writeFileSync as writeFileSync5 } from "fs";
 import { randomBytes } from "crypto";
 import { execFileSync as execFileSync6 } from "child_process";
-import { join as join5 } from "path";
+import { join as join6 } from "path";
 import { defineCommand as defineCommand33 } from "citty";
 import consola27 from "consola";
 var DEFAULT_IDP_URL = "https://id.openape.at";
@@ -3826,7 +4112,7 @@ async function downloadTemplate(repo, targetDir) {
   await gigetDownload(`gh:${repo}`, { dir: targetDir, force: false });
 }
 function installDeps(dir) {
-  const hasLockFile = (name) => existsSync6(join5(dir, name));
+  const hasLockFile = (name) => existsSync7(join6(dir, name));
   if (hasLockFile("pnpm-lock.yaml")) {
     execFileSync6("pnpm", ["install"], { cwd: dir, stdio: "inherit" });
   } else if (hasLockFile("bun.lockb")) {
@@ -3891,7 +4177,7 @@ var initCommand = defineCommand33({
 });
 async function initSP(targetDir) {
   const dir = targetDir || "my-app";
-  if (existsSync6(join5(dir, "package.json"))) {
+  if (existsSync7(join6(dir, "package.json"))) {
     throw new CliError(`Directory "${dir}" already contains a project.`);
   }
   consola27.start("Scaffolding SP starter...");
@@ -3900,9 +4186,9 @@ async function initSP(targetDir) {
   consola27.start("Installing dependencies...");
   installDeps(dir);
   consola27.success("Dependencies installed");
-  const envExample = join5(dir, ".env.example");
-  const envFile = join5(dir, ".env");
-  if (existsSync6(envExample) && !existsSync6(envFile)) {
+  const envExample = join6(dir, ".env.example");
+  const envFile = join6(dir, ".env");
+  if (existsSync7(envExample) && !existsSync7(envFile)) {
     copyFileSync(envExample, envFile);
     consola27.success(`\`.env\` created (using Free IdP at ${DEFAULT_IDP_URL})`);
   }
@@ -3916,7 +4202,7 @@ async function initSP(targetDir) {
 }
 async function initIdP(targetDir) {
   const dir = targetDir || "my-idp";
-  if (existsSync6(join5(dir, "package.json"))) {
+  if (existsSync7(join6(dir, "package.json"))) {
     throw new CliError(`Directory "${dir}" already contains a project.`);
   }
   const domain = await promptText("Domain for the IdP", "localhost");
@@ -3948,7 +4234,7 @@ async function initIdP(targetDir) {
     `NUXT_OPENAPE_RP_ID=${domain}`,
     `NUXT_OPENAPE_RP_ORIGIN=${origin}`
   ].join("\n");
-  writeFileSync5(join5(dir, ".env"), `${envContent}
+  writeFileSync5(join6(dir, ".env"), `${envContent}
 `, { mode: 384 });
   consola27.success(".env created");
   console.log("");
@@ -3969,7 +4255,7 @@ async function initIdP(targetDir) {
 
 // src/commands/enroll.ts
 import { Buffer as Buffer5 } from "buffer";
-import { existsSync as existsSync7, readFileSync as readFileSync5 } from "fs";
+import { existsSync as existsSync8, readFileSync as readFileSync6 } from "fs";
 import { execFile as execFile2 } from "child_process";
 import { sign as sign2 } from "crypto";
 import { defineCommand as defineCommand34 } from "citty";
@@ -3985,7 +4271,7 @@ function openBrowser2(url) {
 }
 async function pollForEnrollment(idp, agentEmail, keyPath) {
   const resolvedKey = resolveKeyPath(keyPath);
-  const keyContent = readFileSync5(resolvedKey, "utf-8");
+  const keyContent = readFileSync6(resolvedKey, "utf-8");
   const privateKey = loadEd25519PrivateKey(keyContent);
   const challengeUrl = await getAgentChallengeEndpoint(idp);
   const authenticateUrl = await getAgentAuthenticateEndpoint(idp);
@@ -4053,7 +4339,7 @@ var enrollCommand = defineCommand34({
     }) || DEFAULT_KEY_PATH;
     const resolvedKey = resolveKeyPath(keyPath);
     let publicKey;
-    if (existsSync7(resolvedKey)) {
+    if (existsSync8(resolvedKey)) {
       publicKey = readPublicKey(resolvedKey);
       consola28.success(`Using existing key ${keyPath}`);
     } else {
@@ -4097,7 +4383,7 @@ var enrollCommand = defineCommand34({
 });
 
 // src/commands/register-user.ts
-import { existsSync as existsSync8, readFileSync as readFileSync6 } from "fs";
+import { existsSync as existsSync9, readFileSync as readFileSync7 } from "fs";
 import { defineCommand as defineCommand35 } from "citty";
 import consola29 from "consola";
 var registerUserCommand = defineCommand35({
@@ -4136,8 +4422,8 @@ var registerUserCommand = defineCommand35({
       throw new CliError("No IdP URL configured. Run `apes login` first.");
     }
     let publicKey = args.key;
-    if (existsSync8(args.key)) {
-      publicKey = readFileSync6(args.key, "utf-8").trim();
+    if (existsSync9(args.key)) {
+      publicKey = readFileSync7(args.key, "utf-8").trim();
     }
     if (!publicKey.startsWith("ssh-ed25519 ")) {
       throw new CliError("Public key must be in ssh-ed25519 format.");
@@ -4446,7 +4732,7 @@ async function bestEffortGrantCount(idp) {
   }
 }
 async function runHealth(args) {
-  const version = true ? "0.22.1" : "0.0.0";
+  const version = true ? "0.24.0" : "0.0.0";
   const auth = loadAuth();
   if (!auth) {
     throw new CliError("Not logged in. Run `apes login` first.", 1);
@@ -4639,25 +4925,25 @@ var workflowsCommand = defineCommand43({
 });
 
 // src/version-check.ts
-import { existsSync as existsSync9, mkdirSync as mkdirSync2, readFileSync as readFileSync7, writeFileSync as writeFileSync6 } from "fs";
-import { homedir as homedir5 } from "os";
-import { join as join6 } from "path";
+import { existsSync as existsSync10, mkdirSync as mkdirSync2, readFileSync as readFileSync8, writeFileSync as writeFileSync6 } from "fs";
+import { homedir as homedir6 } from "os";
+import { join as join7 } from "path";
 import consola35 from "consola";
 var PACKAGE_NAME = "@openape/apes";
 var CACHE_TTL_MS = 24 * 60 * 60 * 1e3;
-var CACHE_FILE = join6(homedir5(), ".config", "apes", ".version-check.json");
+var CACHE_FILE = join7(homedir6(), ".config", "apes", ".version-check.json");
 function readCache() {
-  if (!existsSync9(CACHE_FILE)) return null;
+  if (!existsSync10(CACHE_FILE)) return null;
   try {
-    return JSON.parse(readFileSync7(CACHE_FILE, "utf-8"));
+    return JSON.parse(readFileSync8(CACHE_FILE, "utf-8"));
   } catch {
     return null;
   }
 }
 function writeCache(entry) {
   try {
-    const dir = join6(homedir5(), ".config", "apes");
-    if (!existsSync9(dir)) mkdirSync2(dir, { recursive: true, mode: 448 });
+    const dir = join7(homedir6(), ".config", "apes");
+    if (!existsSync10(dir)) mkdirSync2(dir, { recursive: true, mode: 448 });
     writeFileSync6(CACHE_FILE, JSON.stringify(entry), { mode: 384 });
   } catch {
   }
@@ -4719,10 +5005,10 @@ if (shellRewrite) {
   if (shellRewrite.action === "rewrite") {
     process.argv = shellRewrite.argv;
   } else if (shellRewrite.action === "version") {
-    console.log(`ape-shell ${"0.22.1"} (OpenApe DDISA shell wrapper)`);
+    console.log(`ape-shell ${"0.24.0"} (OpenApe DDISA shell wrapper)`);
     process.exit(0);
   } else if (shellRewrite.action === "help") {
-    console.log(`ape-shell ${"0.22.1"} \u2014 OpenApe DDISA shell wrapper`);
+    console.log(`ape-shell ${"0.24.0"} \u2014 OpenApe DDISA shell wrapper`);
     console.log("");
     console.log("Usage:");
     console.log("  ape-shell                 Start interactive grant-mediated REPL");
@@ -4780,7 +5066,7 @@ var configCommand = defineCommand44({
 var main = defineCommand44({
   meta: {
     name: "apes",
-    version: "0.22.1",
+    version: "0.24.0",
     description: "Unified CLI for OpenApe"
   },
   subCommands: {
@@ -4835,7 +5121,7 @@ async function maybeRefreshAuth() {
   }
 }
 await maybeRefreshAuth();
-await maybeWarnStaleVersion("0.22.1").catch(() => {
+await maybeWarnStaleVersion("0.24.0").catch(() => {
 });
 runMain(main).catch((err) => {
   if (err instanceof CliExit) {