@openape/apes 0.23.0 → 0.25.0

package/dist/cli.js

@@ -1891,23 +1891,26 @@ ${buildBridgeBootstrapBlock(input.bridge)}`;
 function buildBridgeBlock(bridge) {
   if (!bridge) return "";
   return `
-mkdir -p "$HOME_DIR/Library/LaunchAgents" "$HOME_DIR/Library/Application Support/openape/bridge" "$HOME_DIR/Library/Logs" "$HOME_DIR/.pi/agent"
+mkdir -p "$HOME_DIR/Library/Application Support/openape/bridge" "$HOME_DIR/Library/Logs" "$HOME_DIR/.pi/agent"
 cat > "$HOME_DIR/.pi/agent/.env" ${shHeredoc(bridge.envFile)}
 cat > "$HOME_DIR/Library/Application Support/openape/bridge/start.sh" ${shHeredoc(bridge.startScript)}
 chmod 755 "$HOME_DIR/Library/Application Support/openape/bridge/start.sh"
-cat > "$HOME_DIR/Library/LaunchAgents/${bridge.plistLabel}.plist" ${shHeredoc(bridge.plistContent)}
 chmod 600 "$HOME_DIR/.pi/agent/.env"
+
+# System-wide LaunchDaemon \u2014 root-owned, mode 644 (launchd refuses
+# group/world-writable plists). UserName in the plist makes launchd run
+# the binary as the agent, not root.
+cat > ${shQuote(bridge.plistPath)} ${shHeredoc(bridge.plistContent)}
+chown root:wheel ${shQuote(bridge.plistPath)}
+chmod 644 ${shQuote(bridge.plistPath)}
 `;
 }
 function buildBridgeBootstrapBlock(bridge) {
   if (!bridge) return "";
   return `
-# Load the bridge launchd job into the agent's gui domain. Runs as root
-# from the spawn setup script so we target gui/<agent-uid> explicitly.
-# Failure here is non-fatal \u2014 the plist still lands and launchd will pick
-# it up next time the agent logs in.
-launchctl bootstrap "gui/$NEXT_UID" "$HOME_DIR/Library/LaunchAgents/${bridge.plistLabel}.plist" || \\
-  echo "warn: bridge bootstrap failed for gui/$NEXT_UID; loads on next login"
+launchctl bootout "system/${bridge.plistLabel}" 2>/dev/null || true
+launchctl bootstrap system ${shQuote(bridge.plistPath)} || \\
+  echo "warn: bridge bootstrap into system domain failed; check ${bridge.plistPath}"
 `;
 }
 function buildDestroyTeardownScript(input) {
@@ -1938,6 +1941,16 @@ if [ -n "$UID_OF" ]; then
   pkill -9 -u "$UID_OF" 2>/dev/null || true
 fi
 
+# Per-agent system LaunchDaemon written by spawn --bridge. Bootout +
+# delete must come BEFORE we delete the user, otherwise launchd keeps a
+# zombie reference. No-op if the plist isn't there.
+BRIDGE_LABEL="eco.hofmann.apes.bridge.$NAME"
+BRIDGE_PLIST="/Library/LaunchDaemons/$BRIDGE_LABEL.plist"
+if [ -f "$BRIDGE_PLIST" ]; then
+  launchctl bootout "system/$BRIDGE_LABEL" 2>/dev/null || true
+  rm -f "$BRIDGE_PLIST"
+fi
+
 if [ -d "$HOME_DIR" ] && [ "$HOME_DIR" != "/" ] && [ "$HOME_DIR" != "" ]; then
   rm -rf "$HOME_DIR"
 fi
@@ -2074,6 +2087,60 @@ function isShellRegistered(shellPath) {
   return content.split("\n").map((l) => l.trim()).filter((l) => l && !l.startsWith("#")).includes(shellPath);
 }
 
+// src/lib/silent-password.ts
+function readPasswordSilent(prompt) {
+  if (!process.stdin.isTTY) {
+    return Promise.reject(new CliError(
+      "No TTY available for the silent password prompt. Set APES_ADMIN_PASSWORD in the environment instead."
+    ));
+  }
+  return new Promise((resolve4, reject) => {
+    process.stdout.write(prompt);
+    const wasRaw = process.stdin.isRaw ?? false;
+    process.stdin.setRawMode(true);
+    process.stdin.resume();
+    process.stdin.setEncoding("utf8");
+    let buf = "";
+    let cleanupFn;
+    const cleanup = () => cleanupFn?.();
+    const onData = (chunk) => {
+      for (const ch of chunk) {
+        const code = ch.charCodeAt(0);
+        if (ch === "\r" || ch === "\n") {
+          cleanup();
+          process.stdout.write("\n");
+          resolve4(buf);
+          return;
+        }
+        if (code === 3) {
+          cleanup();
+          process.stdout.write("\n");
+          reject(new CliError("Aborted by user (Ctrl-C)."));
+          return;
+        }
+        if (code === 4 && buf.length === 0) {
+          cleanup();
+          process.stdout.write("\n");
+          reject(new CliError("Aborted by user (Ctrl-D)."));
+          return;
+        }
+        if (code === 127 || code === 8) {
+          if (buf.length > 0) buf = buf.slice(0, -1);
+          continue;
+        }
+        if (code < 32) continue;
+        buf += ch;
+      }
+    };
+    cleanupFn = () => {
+      process.stdin.removeListener("data", onData);
+      process.stdin.setRawMode(wasRaw);
+      process.stdin.pause();
+    };
+    process.stdin.on("data", onData);
+  });
+}
+
 // src/commands/agents/destroy.ts
 var destroyAgentCommand = defineCommand20({
   meta: {
@@ -2153,25 +2220,21 @@ ${consequences.join("\n")}`);
       consola18.info("No IdP agent to remove (skipped).");
     }
     if (osUserExists) {
-      const apes = whichBinary("apes");
-      if (!apes) {
-        throw new CliError("`apes` not found on PATH. Install @openape/apes globally first.");
-      }
-      const escapes = whichBinary("escapes");
-      if (!escapes) {
-        throw new CliError("`escapes` not found on PATH; OS teardown requires escapes.");
+      const sudo = whichBinary("sudo");
+      if (!sudo) {
+        throw new CliError("`sudo` not found on PATH; required for OS teardown.");
       }
       const adminUser = userInfo().username;
-      const adminPassword = await collectAdminPassword({ adminUser, force: !!args.force });
+      const adminPassword = await collectAdminPassword({ adminUser });
       const scratch = mkdtempSync(join2(tmpdir(), `apes-destroy-${name}-`));
       const scriptPath = join2(scratch, "teardown.sh");
       try {
         const script = buildDestroyTeardownScript({ name, homeDir: `/Users/${name}`, adminUser });
         writeFileSync(scriptPath, script, { mode: 448 });
-        consola18.start("Running teardown as root via `apes run --as root --wait`\u2026");
-        consola18.info("You will be asked to approve the as=root grant in your DDISA inbox; this command blocks until you do.");
-        execFileSync3(apes, ["run", "--as", "root", "--wait", "--", "bash", scriptPath], {
+        consola18.start("Running teardown via sudo\u2026");
+        execFileSync3(sudo, ["-S", "--prompt=", "--", "bash", scriptPath], {
           input: `${adminPassword}
+${adminPassword}
 `,
           stdio: ["pipe", "inherit", "inherit"]
         });
@@ -2187,14 +2250,8 @@ ${consequences.join("\n")}`);
 async function collectAdminPassword(opts) {
   const fromEnv = process.env.APES_ADMIN_PASSWORD;
   if (fromEnv && fromEnv.length > 0) return fromEnv;
-  if (!process.stdin.isTTY) {
-    throw new CliError(
-      `Admin password required for sysadminctl -deleteUser. No TTY available for the silent prompt; set APES_ADMIN_PASSWORD in the environment (local admin password for ${opts.adminUser}). The teardown reads it from stdin and never stores it.`
-    );
-  }
-  consola18.info(`Local admin password for ${opts.adminUser} (used for sysadminctl -deleteUser; not stored):`);
-  const pw = await consola18.prompt("Admin password", { type: "text", mask: "*" });
-  if (typeof pw === "symbol" || !pw || pw.length === 0) {
+  const pw = await readPasswordSilent(`Password for ${opts.adminUser}: `);
+  if (pw.length === 0) {
     throw new CliExit(0);
   }
   return pw;
@@ -2355,6 +2412,57 @@ import { join as join4 } from "path";
 import { defineCommand as defineCommand23 } from "citty";
 import consola21 from "consola";
 
+// src/lib/chat-room.ts
+var DEFAULT_CHAT_ENDPOINT = "https://chat.openape.ai";
+function chatEndpoint() {
+  return (process.env.APE_CHAT_ENDPOINT ?? DEFAULT_CHAT_ENDPOINT).replace(/\/$/, "");
+}
+async function chatFetch(bearer, path2, init) {
+  const url = `${chatEndpoint()}${path2}`;
+  const res = await fetch(url, {
+    method: init?.method ?? "GET",
+    headers: {
+      Authorization: `Bearer ${bearer}`,
+      "Content-Type": "application/json"
+    },
+    body: init?.body !== void 0 ? JSON.stringify(init.body) : void 0
+  });
+  if (!res.ok) {
+    const detail = await res.text().catch(() => "");
+    throw new Error(`chat.openape.ai ${init?.method ?? "GET"} ${path2} \u2192 ${res.status}: ${detail.slice(0, 200)}`);
+  }
+  return await res.json();
+}
+async function findRoomByName(bearer, name) {
+  const rooms = await chatFetch(bearer, "/api/rooms");
+  return rooms.find((r) => r.name === name) ?? null;
+}
+async function createRoom(bearer, name) {
+  return chatFetch(bearer, "/api/rooms", {
+    method: "POST",
+    body: { name, kind: "channel", members: [] }
+  });
+}
+async function addMember(bearer, roomId, email, role = "member") {
+  await chatFetch(bearer, `/api/rooms/${encodeURIComponent(roomId)}/members`, {
+    method: "POST",
+    body: { email, role }
+  });
+}
+async function ensureRoomMembership(opts) {
+  const existing = await findRoomByName(opts.callerBearer, opts.roomName);
+  let room;
+  let created = false;
+  if (existing) {
+    room = existing;
+  } else {
+    room = await createRoom(opts.callerBearer, opts.roomName);
+    created = true;
+  }
+  await addMember(opts.callerBearer, room.id, opts.agentEmail);
+  return { roomId: room.id, created };
+}
+
 // src/lib/keygen.ts
 import { Buffer as Buffer4 } from "buffer";
 import { existsSync as existsSync5, mkdirSync, readFileSync as readFileSync4, writeFileSync as writeFileSync2 } from "fs";
@@ -2415,7 +2523,7 @@ function generateKeyPairInMemory() {
 import { existsSync as existsSync6, readFileSync as readFileSync5 } from "fs";
 import { homedir as homedir5 } from "os";
 import { join as join3 } from "path";
-var BRIDGE_PLIST_LABEL = "eco.hofmann.apes.bridge";
+var PLIST_LABEL_PREFIX = "eco.hofmann.apes.bridge";
 function readLitellmEnv(envPath = join3(homedir5(), "litellm", ".env")) {
   if (!existsSync6(envPath)) return null;
   try {
@@ -2447,6 +2555,12 @@ function resolveBridgeConfig(opts) {
   }
   return { baseUrl, apiKey };
 }
+function bridgePlistLabel(agentName) {
+  return `${PLIST_LABEL_PREFIX}.${agentName}`;
+}
+function bridgePlistPath(agentName) {
+  return `/Library/LaunchDaemons/${bridgePlistLabel(agentName)}.plist`;
+}
 function buildBridgeEnvFile(cfg) {
   return `# Auto-generated by 'apes agents spawn --bridge'.
 # Read by the chat-bridge daemon at boot to talk to the local LLM proxy.
@@ -2457,20 +2571,66 @@ LITELLM_API_KEY=${cfg.apiKey}
 function buildBridgeStartScript() {
   return `#!/usr/bin/env bash
 # Auto-generated by 'apes agents spawn --bridge'.
-# Idempotent installer + launcher. First boot installs @openape/chat-bridge
-# globally via bun (homebrew-provided); subsequent boots skip the install.
+# Idempotent installer + launcher.
 set -euo pipefail
-export PATH="/opt/homebrew/bin:$HOME/.bun/bin:$PATH"
+
+export NPM_CONFIG_PREFIX="$HOME/.npm-global"
+export PATH="$NPM_CONFIG_PREFIX/bin:/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin"
+mkdir -p "$NPM_CONFIG_PREFIX"
+
 if ! command -v openape-chat-bridge >/dev/null 2>&1; then
-  bun add -g @openape/chat-bridge
+  npm install -g --silent @openape/chat-bridge
+fi
+
+if ! command -v pi >/dev/null 2>&1; then
+  npm install -g --silent @mariozechner/pi-coding-agent
+fi
+
+EXT_DIR="$HOME/.pi/agent/extensions"
+mkdir -p "$EXT_DIR"
+if [ ! -f "$EXT_DIR/litellm.ts" ]; then
+  cat > "$EXT_DIR/litellm.ts" <<'PI_EXT_EOF'
+import type { ExtensionAPI } from "@mariozechner/pi-coding-agent";
+
+const BASE_URL = process.env.LITELLM_BASE_URL ?? "http://127.0.0.1:4000/v1";
+
+export default async function (pi: ExtensionAPI) {
+  pi.registerProvider("litellm", {
+    baseUrl: BASE_URL,
+    apiKey: "LITELLM_API_KEY",
+    api: "openai-completions",
+    models: [
+      {
+        id: "gpt-5.4",
+        name: "ChatGPT 5.4 (Subscription)",
+        reasoning: false,
+        input: ["text", "image"],
+        cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
+        contextWindow: 200000,
+        maxTokens: 8192,
+      },
+      {
+        id: "gpt-5.3-codex",
+        name: "ChatGPT 5.3 Codex (Subscription)",
+        reasoning: false,
+        input: ["text"],
+        cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
+        contextWindow: 200000,
+        maxTokens: 8192,
+      },
+    ],
+  });
+}
+PI_EXT_EOF
 fi
+
 set -a
 . "$HOME/.pi/agent/.env"
 set +a
 exec openape-chat-bridge
 `;
 }
-function buildBridgePlist(homeDir) {
+function buildBridgePlist(agentName, homeDir) {
   const startScript = `${homeDir}/Library/Application Support/openape/bridge/start.sh`;
   const stdoutLog = `${homeDir}/Library/Logs/openape-chat-bridge.log`;
   const stderrLog = `${homeDir}/Library/Logs/openape-chat-bridge.err.log`;
@@ -2479,9 +2639,12 @@ function buildBridgePlist(homeDir) {
 <plist version="1.0">
 <dict>
     <key>Label</key>
-    <string>${BRIDGE_PLIST_LABEL}</string>
+    <string>${bridgePlistLabel(agentName)}</string>
+    <key>UserName</key>
+    <string>${agentName}</string>
     <key>ProgramArguments</key>
     <array>
+        <string>/bin/bash</string>
         <string>${startScript}</string>
     </array>
     <key>WorkingDirectory</key>
@@ -2501,7 +2664,7 @@ function buildBridgePlist(homeDir) {
         <key>HOME</key>
         <string>${homeDir}</string>
         <key>PATH</key>
-        <string>/opt/homebrew/bin:/usr/bin:/bin</string>
+        <string>/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin</string>
     </dict>
 </dict>
 </plist>
@@ -2547,6 +2710,10 @@ var spawnAgentCommand = defineCommand23({
     "bridge-base-url": {
       type: "string",
       description: "Override LITELLM_BASE_URL for the bridge (default: read from ~/litellm/.env or http://127.0.0.1:4000/v1)."
+    },
+    "bridge-room": {
+      type: "string",
+      description: "After spawn, create (or find) a chat.openape.ai room with this name and add the new agent as a member. Uses the spawning user's IdP bearer."
     }
   },
   async run({ args }) {
@@ -2623,8 +2790,9 @@ and try again.`
           cliBaseUrl: typeof args["bridge-base-url"] === "string" ? args["bridge-base-url"] : void 0
         });
         return {
-          plistLabel: BRIDGE_PLIST_LABEL,
-          plistContent: buildBridgePlist(homeDir),
+          plistLabel: bridgePlistLabel(name),
+          plistPath: bridgePlistPath(name),
+          plistContent: buildBridgePlist(name, homeDir),
           startScript: buildBridgeStartScript(),
           envFile: buildBridgeEnvFile(cfg)
         };
@@ -2646,6 +2814,24 @@ and try again.`
       consola21.info("You will be asked to approve the as=root grant in your DDISA inbox; this command blocks until you do.");
       execFileSync4(apes, ["run", "--as", "root", "--wait", "--", "bash", scriptPath], { stdio: "inherit" });
       consola21.success(`Agent ${name} spawned.`);
+      const bridgeRoom = typeof args["bridge-room"] === "string" ? args["bridge-room"] : void 0;
+      if (args.bridge && bridgeRoom) {
+        try {
+          consola21.start(`Inviting agent into chat.openape.ai room "${bridgeRoom}"\u2026`);
+          const result = await ensureRoomMembership({
+            callerBearer: auth.access_token,
+            roomName: bridgeRoom,
+            agentEmail: registration.email
+          });
+          consola21.success(
+            result.created ? `Created room ${result.roomId} and added ${registration.email}` : `Room ${result.roomId} already existed; added ${registration.email}`
+          );
+        } catch (err) {
+          const msg = err instanceof Error ? err.message : String(err);
+          consola21.warn(`Could not auto-create / invite to chat room: ${msg}`);
+          consola21.info("Add the agent manually with: ape-chat members add <agent-email>");
+        }
+      }
       console.log("");
       console.log("Run as the agent with:");
       console.log(`  apes run --as ${name} -- claude --session-name ${name} --dangerously-skip-permissions`);
@@ -3952,7 +4138,7 @@ var mcpCommand = defineCommand32({
     if (transport !== "stdio" && transport !== "sse") {
       throw new Error('Transport must be "stdio" or "sse"');
     }
-    const { startMcpServer } = await import("./server-D5EQSCWF.js");
+    const { startMcpServer } = await import("./server-3HW3TBY5.js");
     await startMcpServer(transport, port);
   }
 });
@@ -4590,7 +4776,7 @@ async function bestEffortGrantCount(idp) {
   }
 }
 async function runHealth(args) {
-  const version = true ? "0.23.0" : "0.0.0";
+  const version = true ? "0.25.0" : "0.0.0";
   const auth = loadAuth();
   if (!auth) {
     throw new CliError("Not logged in. Run `apes login` first.", 1);
@@ -4863,10 +5049,10 @@ if (shellRewrite) {
   if (shellRewrite.action === "rewrite") {
     process.argv = shellRewrite.argv;
   } else if (shellRewrite.action === "version") {
-    console.log(`ape-shell ${"0.23.0"} (OpenApe DDISA shell wrapper)`);
+    console.log(`ape-shell ${"0.25.0"} (OpenApe DDISA shell wrapper)`);
     process.exit(0);
   } else if (shellRewrite.action === "help") {
-    console.log(`ape-shell ${"0.23.0"} \u2014 OpenApe DDISA shell wrapper`);
+    console.log(`ape-shell ${"0.25.0"} \u2014 OpenApe DDISA shell wrapper`);
     console.log("");
     console.log("Usage:");
     console.log("  ape-shell                 Start interactive grant-mediated REPL");
@@ -4924,7 +5110,7 @@ var configCommand = defineCommand44({
 var main = defineCommand44({
   meta: {
     name: "apes",
-    version: "0.23.0",
+    version: "0.25.0",
     description: "Unified CLI for OpenApe"
   },
   subCommands: {
@@ -4979,7 +5165,7 @@ async function maybeRefreshAuth() {
   }
 }
 await maybeRefreshAuth();
-await maybeWarnStaleVersion("0.23.0").catch(() => {
+await maybeWarnStaleVersion("0.25.0").catch(() => {
 });
 runMain(main).catch((err) => {
   if (err instanceof CliExit) {