@openape/apes 1.13.1 → 1.15.0

package/dist/cli.js

@@ -2643,6 +2643,12 @@ if dscl . -read "/Users/$NAME" >/dev/null 2>&1; then
   exit 1
 fi
 
+# Phase G: agent home dirs live under /var/openape/homes/, not
+# /Users/. Pre-create the parent and chmod it world-traversable
+# so per-agent dirs can be reached by their respective uids.
+mkdir -p /var/openape/homes
+chmod 755 /var/openape/homes
+
 # Pick the next free UID in the [200, 500) hidden service-account range.
 # Starts the running max at 199 so an empty range yields 200 after the
 # floor check; otherwise NEXT_UID = max(existing in-range UIDs) + 1.
@@ -2846,10 +2852,12 @@ function readMacOSUser(name) {
   }
   const uidMatch = output.match(/UniqueID:\s*(\d+)/);
   const shellMatch = output.match(/UserShell:\s*(\S.*)$/m);
+  const homeMatch = output.match(/NFSHomeDirectory:\s*(\S.*)$/m);
   return {
     name,
     uid: uidMatch ? Number.parseInt(uidMatch[1], 10) : null,
-    shell: shellMatch ? shellMatch[1].trim() : null
+    shell: shellMatch ? shellMatch[1].trim() : null,
+    homeDir: homeMatch ? homeMatch[1].trim() : null
   };
 }
 function listMacOSUserNames() {
@@ -2955,12 +2963,61 @@ function shQuote2(s) {
 
 // src/commands/agents/destroy.ts
 import { execFileSync as execFileSync4 } from "child_process";
-import { mkdtempSync, rmSync, writeFileSync } from "fs";
+import { mkdtempSync, rmSync, writeFileSync as writeFileSync2 } from "fs";
 import { tmpdir, userInfo } from "os";
-import { join as join2 } from "path";
+import { join as join3 } from "path";
 import { defineCommand as defineCommand21 } from "citty";
 import consola19 from "consola";
 
+// src/lib/nest-registry.ts
+import { existsSync as existsSync4, mkdirSync, readFileSync as readFileSync3, writeFileSync } from "fs";
+import { homedir as homedir4 } from "os";
+import { join as join2 } from "path";
+function resolveRegistryPath() {
+  if (existsSync4("/var/openape/nest/agents.json")) return "/var/openape/nest/agents.json";
+  if (existsSync4("/var/openape/nest")) return "/var/openape/nest/agents.json";
+  return join2(homedir4(), ".openape", "nest", "agents.json");
+}
+function emptyRegistry() {
+  return { version: 1, agents: [] };
+}
+function readNestRegistry() {
+  const path2 = resolveRegistryPath();
+  if (!existsSync4(path2)) return emptyRegistry();
+  try {
+    const parsed = JSON.parse(readFileSync3(path2, "utf8"));
+    if (parsed?.version !== 1 || !Array.isArray(parsed.agents)) return emptyRegistry();
+    return parsed;
+  } catch {
+    return emptyRegistry();
+  }
+}
+function writeNestRegistry(reg) {
+  const path2 = resolveRegistryPath();
+  const dir = path2.replace(/\/agents\.json$/, "");
+  try {
+    mkdirSync(dir, { recursive: true });
+  } catch {
+  }
+  writeFileSync(path2, `${JSON.stringify(reg, null, 2)}
+`, { mode: 432 });
+}
+function upsertNestAgent(entry) {
+  const reg = readNestRegistry();
+  const existing = reg.agents.findIndex((a) => a.name === entry.name);
+  if (existing >= 0) reg.agents[existing] = entry;
+  else reg.agents.push(entry);
+  writeNestRegistry(reg);
+}
+function removeNestAgent(name) {
+  const reg = readNestRegistry();
+  const before = reg.agents.length;
+  reg.agents = reg.agents.filter((a) => a.name !== name);
+  if (reg.agents.length === before) return false;
+  writeNestRegistry(reg);
+  return true;
+}
+
 // src/lib/silent-password.ts
 function readPasswordSilent(prompt) {
   if (!process.stdin.isTTY) {
@@ -3058,14 +3115,18 @@ var destroyAgentCommand = defineCommand21({
     const owned = await apiFetch("/api/my-agents", { idp });
     const idpAgent = owned.find((u) => u.name === name);
     const idpExists = idpAgent !== void 0;
-    const osUserExists = !args["keep-os-user"] && isDarwin() && readMacOSUser(name) !== null;
+    const osUser = isDarwin() ? readMacOSUser(name) : null;
+    const osUserExists = !args["keep-os-user"] && osUser !== null;
     if (!idpExists && !osUserExists) {
       consola19.info(`Nothing to destroy: no IdP agent and no OS user named "${name}".`);
       return;
     }
     if (!args.force) {
       const consequences = [];
-      if (osUserExists) consequences.push(`\u2022 Remove macOS user ${name} and rm -rf /Users/${name}`);
+      if (osUserExists) {
+        const home = osUser?.homeDir ?? `/Users/${name}`;
+        consequences.push(`\u2022 Remove macOS user ${name} and rm -rf ${home}`);
+      }
       if (idpExists) {
         consequences.push(args.soft ? `\u2022 Deactivate IdP agent ${idpAgent.email} (PATCH isActive=false)` : `\u2022 Hard-delete IdP agent ${idpAgent.email} and all its SSH keys`);
       }
@@ -3100,11 +3161,12 @@ ${consequences.join("\n")}`);
       }
       const adminUser = userInfo().username;
       const adminPassword = await collectAdminPassword({ adminUser });
-      const scratch = mkdtempSync(join2(tmpdir(), `apes-destroy-${name}-`));
-      const scriptPath = join2(scratch, "teardown.sh");
+      const scratch = mkdtempSync(join3(tmpdir(), `apes-destroy-${name}-`));
+      const scriptPath = join3(scratch, "teardown.sh");
       try {
-        const script = buildDestroyTeardownScript({ name, homeDir: `/Users/${name}`, adminUser });
-        writeFileSync(scriptPath, script, { mode: 448 });
+        const homeDir = osUser?.homeDir ?? `/Users/${name}`;
+        const script = buildDestroyTeardownScript({ name, homeDir, adminUser });
+        writeFileSync2(scriptPath, script, { mode: 448 });
         consola19.start("Running teardown via sudo\u2026");
         execFileSync4(sudo, ["-S", "--prompt=", "--", "bash", scriptPath], {
           input: `${adminPassword}
@@ -3118,6 +3180,11 @@ ${adminPassword}
     } else if (!args["keep-os-user"] && isDarwin()) {
       consola19.info("No macOS user to remove (skipped).");
     }
+    try {
+      removeNestAgent(name);
+    } catch (err) {
+      consola19.warn(`Could not update nest registry: ${err instanceof Error ? err.message : String(err)}`);
+    }
     consola19.success(`Destroyed ${name}.`);
   }
 });
@@ -3161,13 +3228,17 @@ var listAgentsCommand = defineCommand22({
     const all = await apiFetch("/api/my-agents", { idp });
     const filtered = args["include-inactive"] ? all : all.filter((u) => u.isActive !== false);
     const osUsers = isDarwin() ? listMacOSUserNames() : /* @__PURE__ */ new Set();
-    const home = (name) => `/Users/${name}`;
+    const homeOf = (name) => {
+      if (!osUsers.has(name)) return null;
+      const u = readMacOSUser(name);
+      return u?.homeDir ?? `/Users/${name}`;
+    };
     const rows = filtered.map((u) => ({
       name: u.name,
       email: u.email,
       isActive: u.isActive !== false,
       osUser: osUsers.has(u.name),
-      home: osUsers.has(u.name) ? home(u.name) : null
+      home: homeOf(u.name)
     }));
     if (args.json) {
       process.stdout.write(`${JSON.stringify(rows, null, 2)}
@@ -3193,7 +3264,7 @@ var listAgentsCommand = defineCommand22({
 });
 
 // src/commands/agents/register.ts
-import { existsSync as existsSync4, readFileSync as readFileSync3 } from "fs";
+import { existsSync as existsSync5, readFileSync as readFileSync4 } from "fs";
 import { defineCommand as defineCommand23 } from "citty";
 import consola21 from "consola";
 var registerAgentCommand = defineCommand23({
@@ -3241,10 +3312,10 @@ var registerAgentCommand = defineCommand23({
       throw new CliError("Pass either --public-key or --public-key-file, not both.");
     }
     if (!publicKey && keyFile) {
-      if (!existsSync4(keyFile)) {
+      if (!existsSync5(keyFile)) {
         throw new CliError(`Public-key file not found: ${keyFile}`);
       }
-      publicKey = readFileSync3(keyFile, "utf-8").trim();
+      publicKey = readFileSync4(keyFile, "utf-8").trim();
     }
     if (!publicKey) {
       throw new CliError('Provide --public-key "<ssh-ed25519 line>" or --public-key-file <path>.');
@@ -3279,9 +3350,9 @@ var registerAgentCommand = defineCommand23({
 });
 
 // src/commands/agents/run.ts
-import { existsSync as existsSync5, readFileSync as readFileSync4 } from "fs";
-import { homedir as homedir4 } from "os";
-import { join as join3 } from "path";
+import { existsSync as existsSync6, readFileSync as readFileSync5 } from "fs";
+import { homedir as homedir5 } from "os";
+import { join as join4 } from "path";
 import { defineCommand as defineCommand24 } from "citty";
 import consola22 from "consola";
 
@@ -3343,13 +3414,13 @@ function resolveTroopUrl(override) {
 }
 
 // src/commands/agents/run.ts
-var AUTH_PATH = join3(homedir4(), ".config", "apes", "auth.json");
-var TASK_CACHE_DIR = join3(homedir4(), ".openape", "agent", "tasks");
+var AUTH_PATH = join4(homedir5(), ".config", "apes", "auth.json");
+var TASK_CACHE_DIR = join4(homedir5(), ".openape", "agent", "tasks");
 function readAuth() {
-  if (!existsSync5(AUTH_PATH)) {
+  if (!existsSync6(AUTH_PATH)) {
     throw new CliError(`No agent auth found at ${AUTH_PATH}. Run \`apes agents spawn <name>\` first.`);
   }
-  const parsed = JSON.parse(readFileSync4(AUTH_PATH, "utf8"));
+  const parsed = JSON.parse(readFileSync5(AUTH_PATH, "utf8"));
   if (!parsed.access_token) throw new CliError("auth.json missing access_token");
   return parsed;
 }
@@ -3385,26 +3456,26 @@ ${msg}`.slice(0, 9e3);
   }
 }
 function readTaskSpec(taskId) {
-  const path2 = join3(TASK_CACHE_DIR, `${taskId}.json`);
-  if (!existsSync5(path2)) {
+  const path2 = join4(TASK_CACHE_DIR, `${taskId}.json`);
+  if (!existsSync6(path2)) {
     throw new CliError(`No cached task spec at ${path2}. Run \`apes agents sync\` first to pull the task list from troop.`);
   }
-  return JSON.parse(readFileSync4(path2, "utf8"));
+  return JSON.parse(readFileSync5(path2, "utf8"));
 }
-var AGENT_CONFIG_PATH = join3(homedir4(), ".openape", "agent", "agent.json");
+var AGENT_CONFIG_PATH = join4(homedir5(), ".openape", "agent", "agent.json");
 function readAgentConfig() {
-  if (!existsSync5(AGENT_CONFIG_PATH)) return { systemPrompt: "" };
+  if (!existsSync6(AGENT_CONFIG_PATH)) return { systemPrompt: "" };
   try {
-    return JSON.parse(readFileSync4(AGENT_CONFIG_PATH, "utf8"));
+    return JSON.parse(readFileSync5(AGENT_CONFIG_PATH, "utf8"));
   } catch {
     return { systemPrompt: "" };
   }
 }
 function readLitellmConfig(model) {
-  const envPath = join3(homedir4(), "litellm", ".env");
+  const envPath = join4(homedir5(), "litellm", ".env");
   const env = {};
-  if (existsSync5(envPath)) {
-    for (const line of readFileSync4(envPath, "utf8").split(/\r?\n/)) {
+  if (existsSync6(envPath)) {
+    for (const line of readFileSync5(envPath, "utf8").split(/\r?\n/)) {
       const m = line.match(/^([A-Z_]+)=(.*)$/);
       if (m) env[m[1]] = m[2].replace(/^["']|["']$/g, "");
     }
@@ -3509,17 +3580,17 @@ var runAgentCommand = defineCommand24({
 });
 
 // src/commands/agents/serve.ts
-import { existsSync as existsSync6, readFileSync as readFileSync5 } from "fs";
-import { homedir as homedir5 } from "os";
-import { join as join4 } from "path";
+import { existsSync as existsSync7, readFileSync as readFileSync6 } from "fs";
+import { homedir as homedir6 } from "os";
+import { join as join5 } from "path";
 import { createInterface } from "readline";
 import { defineCommand as defineCommand25 } from "citty";
-var AUTH_PATH2 = join4(homedir5(), ".config", "apes", "auth.json");
+var AUTH_PATH2 = join5(homedir6(), ".config", "apes", "auth.json");
 function readLitellmConfig2(model) {
-  const envPath = join4(homedir5(), "litellm", ".env");
+  const envPath = join5(homedir6(), "litellm", ".env");
   const env = {};
-  if (existsSync6(envPath)) {
-    for (const line of readFileSync5(envPath, "utf8").split(/\r?\n/)) {
+  if (existsSync7(envPath)) {
+    for (const line of readFileSync6(envPath, "utf8").split(/\r?\n/)) {
       const m = line.match(/^([A-Z_]+)=(.*)$/);
       if (m) env[m[1]] = m[2].replace(/^["']|["']$/g, "");
     }
@@ -3551,9 +3622,9 @@ var serveAgentCommand = defineCommand25({
     if (!args.rpc) {
       throw new CliError("apes agents serve currently only supports --rpc mode");
     }
-    if (existsSync6(AUTH_PATH2)) {
+    if (existsSync7(AUTH_PATH2)) {
       try {
-        JSON.parse(readFileSync5(AUTH_PATH2, "utf8"));
+        JSON.parse(readFileSync6(AUTH_PATH2, "utf8"));
       } catch {
       }
     }
@@ -3629,9 +3700,9 @@ async function handleInbound(msg, sessions) {
 
 // src/commands/agents/spawn.ts
 import { execFileSync as execFileSync6 } from "child_process";
-import { mkdtempSync as mkdtempSync2, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
+import { mkdtempSync as mkdtempSync2, rmSync as rmSync2, writeFileSync as writeFileSync4 } from "fs";
 import { tmpdir as tmpdir2 } from "os";
-import { join as join6 } from "path";
+import { join as join7 } from "path";
 import { defineCommand as defineCommand26 } from "citty";
 import consola23 from "consola";
 
@@ -3689,12 +3760,12 @@ ${envBlock}  <key>StartInterval</key>
 
 // src/lib/keygen.ts
 import { Buffer as Buffer4 } from "buffer";
-import { existsSync as existsSync7, mkdirSync, readFileSync as readFileSync6, writeFileSync as writeFileSync2 } from "fs";
+import { existsSync as existsSync8, mkdirSync as mkdirSync2, readFileSync as readFileSync7, writeFileSync as writeFileSync3 } from "fs";
 import { generateKeyPairSync } from "crypto";
-import { homedir as homedir6 } from "os";
+import { homedir as homedir7 } from "os";
 import { dirname, resolve as resolve2 } from "path";
 function resolveKeyPath(p2) {
-  return resolve2(p2.replace(/^~/, homedir6()));
+  return resolve2(p2.replace(/^~/, homedir7()));
 }
 function buildSshEd25519Line(rawPub) {
   const keyTypeStr = "ssh-ed25519";
@@ -3707,10 +3778,10 @@ function buildSshEd25519Line(rawPub) {
 }
 function readPublicKey(keyPath) {
   const pubPath = `${keyPath}.pub`;
-  if (existsSync7(pubPath)) {
-    return readFileSync6(pubPath, "utf-8").trim();
+  if (existsSync8(pubPath)) {
+    return readFileSync7(pubPath, "utf-8").trim();
   }
-  const keyContent = readFileSync6(keyPath, "utf-8");
+  const keyContent = readFileSync7(keyPath, "utf-8");
   const privateKey = loadEd25519PrivateKey(keyContent);
   const jwk = privateKey.export({ format: "jwk" });
   const pubBytes = Buffer4.from(jwk.x, "base64url");
@@ -3719,16 +3790,16 @@ function readPublicKey(keyPath) {
 function generateAndSaveKey(keyPath) {
   const resolved = resolveKeyPath(keyPath);
   const dir = dirname(resolved);
-  if (!existsSync7(dir)) {
-    mkdirSync(dir, { recursive: true });
+  if (!existsSync8(dir)) {
+    mkdirSync2(dir, { recursive: true });
   }
   const { publicKey, privateKey } = generateKeyPairSync("ed25519");
   const privatePem = privateKey.export({ type: "pkcs8", format: "pem" });
-  writeFileSync2(resolved, privatePem, { mode: 384 });
+  writeFileSync3(resolved, privatePem, { mode: 384 });
   const jwk = publicKey.export({ format: "jwk" });
   const pubBytes = Buffer4.from(jwk.x, "base64url");
   const pubKeyStr = buildSshEd25519Line(pubBytes);
-  writeFileSync2(`${resolved}.pub`, `${pubKeyStr}
+  writeFileSync3(`${resolved}.pub`, `${pubKeyStr}
 `, { mode: 420 });
   return pubKeyStr;
 }
@@ -3745,14 +3816,14 @@ function generateKeyPairInMemory() {
 
 // src/lib/llm-bridge.ts
 import { execFileSync as execFileSync5 } from "child_process";
-import { existsSync as existsSync8, readFileSync as readFileSync7 } from "fs";
-import { homedir as homedir7 } from "os";
-import { dirname as dirname2, join as join5 } from "path";
+import { existsSync as existsSync9, readFileSync as readFileSync8 } from "fs";
+import { homedir as homedir8 } from "os";
+import { dirname as dirname2, join as join6 } from "path";
 var PLIST_LABEL_PREFIX = "eco.hofmann.apes.bridge";
-function readLitellmEnv(envPath = join5(homedir7(), "litellm", ".env")) {
-  if (!existsSync8(envPath)) return null;
+function readLitellmEnv(envPath = join6(homedir8(), "litellm", ".env")) {
+  if (!existsSync9(envPath)) return null;
   try {
-    const text = readFileSync7(envPath, "utf8");
+    const text = readFileSync8(envPath, "utf8");
     const out = {};
     for (const line of text.split("\n")) {
       const trimmed = line.trim();
@@ -3881,6 +3952,14 @@ function buildBridgePlist(agentName, homeDir, ownerEmail, hostBinDirs) {
 }
 
 // src/commands/agents/spawn.ts
+function readMacOSUidOrNull(name) {
+  try {
+    const u = readMacOSUser(name);
+    return u?.uid ?? null;
+  } catch {
+    return null;
+  }
+}
 var spawnAgentCommand = defineCommand26({
   meta: {
     name: "spawn",
@@ -3967,9 +4046,9 @@ and try again.`
     if (existing) {
       throw new CliError(`macOS user "${name}" already exists (uid=${existing.uid ?? "?"}). Refusing to overwrite.`);
     }
-    const homeDir = `/Users/${name}`;
-    const scratch = mkdtempSync2(join6(tmpdir2(), `apes-spawn-${name}-`));
-    const scriptPath = join6(scratch, "setup.sh");
+    const homeDir = `/var/openape/homes/${name}`;
+    const scratch = mkdtempSync2(join7(tmpdir2(), `apes-spawn-${name}-`));
+    const scriptPath = join7(scratch, "setup.sh");
     try {
       consola23.start(`Generating keypair for ${name}\u2026`);
       const { privatePem, publicSshLine } = generateKeyPairInMemory();
@@ -4039,10 +4118,27 @@ and try again.`
         bridge,
         troop
       });
-      writeFileSync3(scriptPath, script, { mode: 448 });
+      writeFileSync4(scriptPath, script, { mode: 448 });
       consola23.start("Running privileged setup as root via `apes run --as root --wait`\u2026");
       consola23.info("You will be asked to approve the as=root grant in your DDISA inbox; this command blocks until you do.");
       execFileSync6(apes, ["run", "--as", "root", "--wait", "--", "bash", scriptPath], { stdio: "inherit" });
+      try {
+        const uid = readMacOSUidOrNull(name);
+        upsertNestAgent({
+          name,
+          uid: uid ?? -1,
+          home: homeDir,
+          email: registration.email,
+          registeredAt: Math.floor(Date.now() / 1e3),
+          bridge: args.bridge ? {
+            baseUrl: typeof args["bridge-base-url"] === "string" ? args["bridge-base-url"] : void 0,
+            apiKey: typeof args["bridge-key"] === "string" ? args["bridge-key"] : void 0,
+            model: typeof args["bridge-model"] === "string" ? args["bridge-model"] : void 0
+          } : void 0
+        });
+      } catch (err) {
+        consola23.warn(`Could not write to nest registry: ${err instanceof Error ? err.message : String(err)}`);
+      }
       consola23.success(`Agent ${name} spawned.`);
       consola23.info(`\u{1F517} Troop: https://troop.openape.ai/agents/${name}`);
       if (args.bridge) {
@@ -4081,9 +4177,9 @@ async function resolveClaudeToken(opts) {
 }
 
 // src/commands/agents/sync.ts
-import { chownSync, existsSync as existsSync9, mkdirSync as mkdirSync2, readFileSync as readFileSync8, statSync, writeFileSync as writeFileSync4 } from "fs";
-import { homedir as homedir8 } from "os";
-import { join as join7 } from "path";
+import { chownSync, existsSync as existsSync10, mkdirSync as mkdirSync3, readFileSync as readFileSync9, statSync, writeFileSync as writeFileSync5 } from "fs";
+import { homedir as homedir9 } from "os";
+import { join as join8 } from "path";
 import { defineCommand as defineCommand27 } from "citty";
 import consola24 from "consola";
 
@@ -4112,15 +4208,15 @@ function getHostname() {
 }
 
 // src/commands/agents/sync.ts
-var AUTH_PATH3 = join7(homedir8(), ".config", "apes", "auth.json");
-var TASK_CACHE_DIR2 = join7(homedir8(), ".openape", "agent", "tasks");
+var AUTH_PATH3 = join8(homedir9(), ".config", "apes", "auth.json");
+var TASK_CACHE_DIR2 = join8(homedir9(), ".openape", "agent", "tasks");
 function readAuthJson() {
-  if (!existsSync9(AUTH_PATH3)) {
+  if (!existsSync10(AUTH_PATH3)) {
     throw new CliError(
       `No agent auth found at ${AUTH_PATH3}. Run \`apes agents spawn <name>\` to provision an agent first.`
     );
   }
-  const raw = readFileSync8(AUTH_PATH3, "utf8");
+  const raw = readFileSync9(AUTH_PATH3, "utf8");
   let parsed;
   try {
     parsed = JSON.parse(raw);
@@ -4181,7 +4277,7 @@ var syncAgentCommand = defineCommand27({
     let agentGid = null;
     if (process.geteuid?.() === 0) {
       try {
-        const homeStat = statSync(homedir8());
+        const homeStat = statSync(homedir9());
         agentUid = homeStat.uid;
         agentGid = homeStat.gid;
       } catch {
@@ -4195,23 +4291,23 @@ var syncAgentCommand = defineCommand27({
         }
       }
     }
-    const agentDir = join7(homedir8(), ".openape", "agent");
-    mkdirSync2(agentDir, { recursive: true });
-    chownToAgent(join7(homedir8(), ".openape"));
+    const agentDir = join8(homedir9(), ".openape", "agent");
+    mkdirSync3(agentDir, { recursive: true });
+    chownToAgent(join8(homedir9(), ".openape"));
     chownToAgent(agentDir);
-    const agentJsonPath = join7(agentDir, "agent.json");
-    writeFileSync4(
+    const agentJsonPath = join8(agentDir, "agent.json");
+    writeFileSync5(
       agentJsonPath,
       `${JSON.stringify({ systemPrompt }, null, 2)}
 `,
       { mode: 384 }
     );
     chownToAgent(agentJsonPath);
-    mkdirSync2(TASK_CACHE_DIR2, { recursive: true });
+    mkdirSync3(TASK_CACHE_DIR2, { recursive: true });
     chownToAgent(TASK_CACHE_DIR2);
     for (const task of tasks) {
-      const path2 = join7(TASK_CACHE_DIR2, `${task.taskId}.json`);
-      writeFileSync4(path2, `${JSON.stringify(task, null, 2)}
+      const path2 = join8(TASK_CACHE_DIR2, `${task.taskId}.json`);
+      writeFileSync5(path2, `${JSON.stringify(task, null, 2)}
 `, { mode: 384 });
       chownToAgent(path2);
     }
@@ -4242,18 +4338,18 @@ import { defineCommand as defineCommand36 } from "citty";
 
 // src/commands/nest/authorize.ts
 import { execFileSync as execFileSync8 } from "child_process";
-import { existsSync as existsSync11, readFileSync as readFileSync9 } from "fs";
-import { join as join9 } from "path";
+import { existsSync as existsSync12, readFileSync as readFileSync10 } from "fs";
+import { join as join10 } from "path";
 import { defineCommand as defineCommand30 } from "citty";
 import consola26 from "consola";
 
 // src/commands/nest/enroll.ts
-import { hostname as hostname4, homedir as homedir9 } from "os";
-import { existsSync as existsSync10, mkdirSync as mkdirSync3, writeFileSync as writeFileSync5, chmodSync } from "fs";
-import { join as join8 } from "path";
+import { hostname as hostname4, homedir as homedir10 } from "os";
+import { existsSync as existsSync11, mkdirSync as mkdirSync4, writeFileSync as writeFileSync6, chmodSync } from "fs";
+import { join as join9 } from "path";
 import { defineCommand as defineCommand29 } from "citty";
 import consola25 from "consola";
-var NEST_DATA_DIR = join8(homedir9(), ".openape", "nest");
+var NEST_DATA_DIR = join9(homedir10(), ".openape", "nest");
 function nestAgentName() {
   const raw = hostname4().toLowerCase();
   const head = raw.split(".")[0] ?? raw;
@@ -4286,19 +4382,19 @@ var enrollNestCommand = defineCommand29({
       throw new CliError("Run `apes login <email>` first \u2014 nest enroll attaches the new identity to your owner account.");
     }
     const name = args.name || nestAgentName();
-    const authPath = join8(NEST_DATA_DIR, ".config", "apes", "auth.json");
-    if (existsSync10(authPath) && !args.force) {
+    const authPath = join9(NEST_DATA_DIR, ".config", "apes", "auth.json");
+    if (existsSync11(authPath) && !args.force) {
       throw new CliError(`Nest already enrolled at ${authPath}. Pass --force to re-enroll.`);
     }
-    const sshDir = join8(NEST_DATA_DIR, ".ssh");
-    const configDir = join8(NEST_DATA_DIR, ".config", "apes");
-    mkdirSync3(sshDir, { recursive: true });
-    mkdirSync3(configDir, { recursive: true });
+    const sshDir = join9(NEST_DATA_DIR, ".ssh");
+    const configDir = join9(NEST_DATA_DIR, ".config", "apes");
+    mkdirSync4(sshDir, { recursive: true });
+    mkdirSync4(configDir, { recursive: true });
     consola25.start(`Generating keypair for ${name}\u2026`);
     const { privatePem, publicSshLine } = generateKeyPairInMemory();
-    writeFileSync5(join8(sshDir, "id_ed25519"), `${privatePem.trimEnd()}
+    writeFileSync6(join9(sshDir, "id_ed25519"), `${privatePem.trimEnd()}
 `, { mode: 384 });
-    writeFileSync5(join8(sshDir, "id_ed25519.pub"), `${publicSshLine}
+    writeFileSync6(join9(sshDir, "id_ed25519.pub"), `${publicSshLine}
 `, { mode: 420 });
     chmodSync(sshDir, 448);
     consola25.start(`Registering nest at ${idp}\u2026`);
@@ -4315,10 +4411,10 @@ var enrollNestCommand = defineCommand29({
       accessToken: token,
       email: registration.email,
       expiresAt: Math.floor(Date.now() / 1e3) + expiresIn,
-      keyPath: join8(sshDir, "id_ed25519"),
+      keyPath: join9(sshDir, "id_ed25519"),
       ownerEmail: ownerAuth.email
     });
-    writeFileSync5(authPath, authJson, { mode: 384 });
+    writeFileSync6(authPath, authJson, { mode: 384 });
     chmodSync(configDir, 448);
     consola25.success(`Nest enrolled \u2014 auth.json at ${authPath}`);
     consola25.info("");
@@ -4384,11 +4480,11 @@ var authorizeNestCommand = defineCommand30({
     }
   },
   async run({ args }) {
-    const nestAuthPath = join9(NEST_DATA_DIR, ".config", "apes", "auth.json");
-    if (!existsSync11(nestAuthPath)) {
+    const nestAuthPath = join10(NEST_DATA_DIR, ".config", "apes", "auth.json");
+    if (!existsSync12(nestAuthPath)) {
       throw new CliError("Nest not enrolled. Run `apes nest enroll` first.");
     }
-    const nestAuth = JSON.parse(readFileSync9(nestAuthPath, "utf8"));
+    const nestAuth = JSON.parse(readFileSync10(nestAuthPath, "utf8"));
     if (!nestAuth.email) throw new CliError(`${nestAuthPath} has no email`);
     const allow = args.allow ?? DEFAULT_ALLOW_PATTERNS.join(",");
     consola26.info(`Configuring YOLO-policy on ${nestAuth.email} via \`apes yolo set\`\u2026`);
@@ -4415,102 +4511,31 @@ var authorizeNestCommand = defineCommand30({
 });
 
 // src/commands/nest/destroy.ts
+import { execFileSync as execFileSync9 } from "child_process";
 import { defineCommand as defineCommand31 } from "citty";
 import consola27 from "consola";
-
-// src/lib/nest-intent.ts
-import { existsSync as existsSync12, mkdirSync as mkdirSync4, readFileSync as readFileSync10, statSync as statSync2, unlinkSync, writeFileSync as writeFileSync6 } from "fs";
-import { homedir as homedir10 } from "os";
-import { join as join10 } from "path";
-import { randomUUID } from "crypto";
-var POLL_INTERVAL_MS = 200;
-var DEFAULT_TIMEOUT_MS = 5 * 60 * 1e3;
-function resolveIntentDir() {
-  if (process.env.OPENAPE_NEST_INTENT_DIR) return process.env.OPENAPE_NEST_INTENT_DIR;
-  if (existsSync12("/var/openape/nest/intents")) return "/var/openape/nest/intents";
-  return join10(homedir10(), ".openape", "nest", "intents");
-}
-async function dispatchIntent(intent, opts = {}) {
-  const id = randomUUID();
-  const dir = resolveIntentDir();
-  if (!existsSync12(dir)) {
-    throw new CliError(`Nest intent dir does not exist: ${dir}
-  Is the nest daemon running? Try \`ps aux | grep openape-nest\`.`);
-  }
-  const intentPath = join10(dir, `${id}.json`);
-  const responsePath = join10(dir, `${id}.response`);
-  const tmpPath = `${intentPath}.tmp`;
-  writeFileSync6(tmpPath, `${JSON.stringify({ id, ...intent })}
-`, { mode: 432 });
-  try {
-    const fs = await import("fs");
-    fs.renameSync(tmpPath, intentPath);
-  } catch (err) {
-    try {
-      unlinkSync(tmpPath);
-    } catch {
-    }
-    throw err;
-  }
-  const deadline = Date.now() + (opts.timeoutMs ?? DEFAULT_TIMEOUT_MS);
-  while (Date.now() < deadline) {
-    if (existsSync12(responsePath)) {
-      let raw;
-      try {
-        const st = statSync2(responsePath);
-        if (Date.now() - st.mtimeMs < 50) {
-          await sleep(50);
-        }
-        raw = readFileSync10(responsePath, "utf8");
-      } catch {
-        await sleep(POLL_INTERVAL_MS);
-        continue;
-      }
-      try {
-        unlinkSync(responsePath);
-      } catch {
-      }
-      let parsed;
-      try {
-        parsed = JSON.parse(raw);
-      } catch (err) {
-        throw new CliError(`malformed nest response: ${err instanceof Error ? err.message : String(err)}`);
-      }
-      if (!parsed.ok) {
-        throw new CliError(`nest: ${parsed.error}`);
-      }
-      return parsed.result;
-    }
-    await sleep(POLL_INTERVAL_MS);
-  }
-  try {
-    unlinkSync(intentPath);
-  } catch {
-  }
-  throw new CliError(`nest intent timeout (${(opts.timeoutMs ?? DEFAULT_TIMEOUT_MS) / 1e3}s) \u2014 Nest daemon may not be running or is stuck.`);
-}
-function sleep(ms) {
-  return new Promise((resolve4) => setTimeout(resolve4, ms));
-}
-
-// src/commands/nest/destroy.ts
 var destroyNestCommand = defineCommand31({
   meta: {
     name: "destroy",
-    description: "Tear down an agent on the local nest. Drops an intent file the nest daemon picks up."
+    description: "Destroy a local agent. Wraps `apes run --as root -- apes agents destroy <name>`; the Nest watches its registry and pm2-deletes the bridge automatically."
   },
   args: {
     name: { type: "positional", required: true, description: "Agent name to destroy" }
   },
   async run({ args }) {
     const name = String(args.name);
-    await dispatchIntent({ action: "destroy", name });
-    consola27.success(`Destroyed ${name}`);
+    try {
+      execFileSync9("apes", ["run", "--as", "root", "--wait", "--", "apes", "agents", "destroy", name, "--force"], { stdio: "inherit" });
+      consola27.success(`Nest will tear down ${name}'s pm2 process on its next reconcile (\u22642s).`);
+    } catch (err) {
+      const status = err.status ?? 1;
+      throw new CliExit(status);
+    }
   }
 });
 
 // src/commands/nest/install.ts
-import { execFileSync as execFileSync9 } from "child_process";
+import { execFileSync as execFileSync10 } from "child_process";
 import { existsSync as existsSync13, mkdirSync as mkdirSync5, readFileSync as readFileSync11, writeFileSync as writeFileSync7 } from "fs";
 import { homedir as homedir11, userInfo as userInfo2 } from "os";
 import { dirname as dirname3, join as join11 } from "path";
@@ -4708,10 +4733,10 @@ var installNestCommand = defineCommand32({
     }
     const uid = userInfo2().uid;
     try {
-      execFileSync9("/bin/launchctl", ["bootout", `gui/${uid}/${PLIST_LABEL}`], { stdio: "ignore" });
+      execFileSync10("/bin/launchctl", ["bootout", `gui/${uid}/${PLIST_LABEL}`], { stdio: "ignore" });
     } catch {
     }
-    execFileSync9("/bin/launchctl", ["bootstrap", `gui/${uid}`, plistPath()], { stdio: "inherit" });
+    execFileSync10("/bin/launchctl", ["bootstrap", `gui/${uid}`, plistPath()], { stdio: "inherit" });
     consola28.success(`Nest daemon bootstrapped \u2014 http://127.0.0.1:${port}`);
     consola28.info("");
     consola28.info("Next steps for zero-prompt spawn \u2014 both one-time:");
@@ -4729,23 +4754,23 @@ import consola29 from "consola";
 var listNestCommand = defineCommand33({
   meta: {
     name: "list",
-    description: "List agents registered with the local nest. File-based intent."
+    description: "List agents registered with the local nest. Reads /var/openape/nest/agents.json directly."
   },
   args: {
     json: { type: "boolean", description: "JSON output for scripts" }
   },
   async run({ args }) {
-    const result = await dispatchIntent({ action: "list" });
+    const reg = readNestRegistry();
     if (args.json) {
-      console.log(JSON.stringify(result, null, 2));
+      console.log(JSON.stringify(reg, null, 2));
       return;
     }
-    if (result.agents.length === 0) {
+    if (reg.agents.length === 0) {
       consola29.info("(no agents registered with this nest)");
       return;
     }
-    consola29.info(`${result.agents.length} agent(s) registered with this nest:`);
-    for (const a of result.agents) {
+    consola29.info(`${reg.agents.length} agent(s) registered with this nest:`);
+    for (const a of reg.agents) {
       const bridge = a.bridge ? " bridge=on" : "";
       consola29.info(`  ${a.name.padEnd(16)} uid=${String(a.uid).padEnd(5)} home=${a.home}${bridge}`);
     }
@@ -4753,38 +4778,51 @@ var listNestCommand = defineCommand33({
 });
 
 // src/commands/nest/spawn.ts
+import { execFileSync as execFileSync11 } from "child_process";
 import { defineCommand as defineCommand34 } from "citty";
 import consola30 from "consola";
 var spawnNestCommand = defineCommand34({
   meta: {
     name: "spawn",
-    description: "Spawn a new agent on the local nest. Drops an intent file the nest daemon picks up; UNIX permissions on the intents dir gate access."
+    description: "Spawn a new agent locally. Wraps `apes run --as root -- apes agents spawn <name>`; the Nest watches its registry and starts the bridge in pm2 automatically."
   },
   args: {
     name: { type: "positional", required: true, description: "Agent name (lowercase, [a-z0-9-], max 24 chars)" },
     "no-bridge": { type: "boolean", description: "Skip installing the chat-bridge daemon (default: install it)" },
     "bridge-key": { type: "string", description: "Override LITELLM_API_KEY (default: read from ~/litellm/.env)" },
-    "bridge-base-url": { type: "string", description: "Override LITELLM_BASE_URL (default: read from ~/litellm/.env)" },
+    "bridge-base-url": { type: "string", description: "Override LITELLM_BASE_URL" },
     "bridge-model": { type: "string", description: "Override APE_CHAT_BRIDGE_MODEL" }
   },
   async run({ args }) {
     const name = String(args.name);
-    const intent = {
-      action: "spawn",
-      name,
-      bridge: !args["no-bridge"]
-    };
-    if (typeof args["bridge-key"] === "string") intent.bridgeKey = args["bridge-key"];
-    if (typeof args["bridge-base-url"] === "string") intent.bridgeBaseUrl = args["bridge-base-url"];
-    if (typeof args["bridge-model"] === "string") intent.bridgeModel = args["bridge-model"];
-    const result = await dispatchIntent(intent);
-    consola30.success(`Spawned ${result.name} (uid=${result.uid}, home=${result.home})`);
+    const apesArgs = [
+      "run",
+      "--as",
+      "root",
+      "--wait",
+      "--",
+      "apes",
+      "agents",
+      "spawn",
+      name
+    ];
+    if (!args["no-bridge"]) apesArgs.push("--bridge");
+    if (typeof args["bridge-key"] === "string") apesArgs.push("--bridge-key", args["bridge-key"]);
+    if (typeof args["bridge-base-url"] === "string") apesArgs.push("--bridge-base-url", args["bridge-base-url"]);
+    if (typeof args["bridge-model"] === "string") apesArgs.push("--bridge-model", args["bridge-model"]);
+    try {
+      execFileSync11("apes", apesArgs, { stdio: "inherit" });
+      consola30.success(`Nest will pick up ${name} on its next reconcile (\u22642s).`);
+    } catch (err) {
+      const status = err.status ?? 1;
+      throw new CliExit(status);
+    }
   }
 });
 
 // src/commands/nest/uninstall.ts
-import { execFileSync as execFileSync10 } from "child_process";
-import { existsSync as existsSync14, unlinkSync as unlinkSync2 } from "fs";
+import { execFileSync as execFileSync12 } from "child_process";
+import { existsSync as existsSync14, unlinkSync } from "fs";
 import { homedir as homedir12, userInfo as userInfo3 } from "os";
 import { join as join12 } from "path";
 import { defineCommand as defineCommand35 } from "citty";
@@ -4799,13 +4837,13 @@ var uninstallNestCommand = defineCommand35({
     const uid = userInfo3().uid;
     const path2 = join12(homedir12(), "Library", "LaunchAgents", `${PLIST_LABEL2}.plist`);
     try {
-      execFileSync10("/bin/launchctl", ["bootout", `gui/${uid}/${PLIST_LABEL2}`], { stdio: "ignore" });
+      execFileSync12("/bin/launchctl", ["bootout", `gui/${uid}/${PLIST_LABEL2}`], { stdio: "ignore" });
       consola31.success("Nest daemon stopped");
     } catch {
       consola31.info("Nest daemon was not loaded");
     }
     if (existsSync14(path2)) {
-      unlinkSync2(path2);
+      unlinkSync(path2);
       consola31.success(`Removed ${path2}`);
     }
     consola31.info("Registry at ~/.openape/nest/agents.json kept \u2014 re-run `apes nest install` to resume supervision.");
@@ -5353,7 +5391,7 @@ var adapterCommand = defineCommand41({
 });
 
 // src/commands/run.ts
-import { execFileSync as execFileSync11 } from "child_process";
+import { execFileSync as execFileSync13 } from "child_process";
 import { hostname as hostname5 } from "os";
 import { basename } from "path";
 import { defineCommand as defineCommand42 } from "citty";
@@ -5631,7 +5669,7 @@ function execShellCommand(command) {
     throw new CliError("No command to execute");
   try {
     const { APES_SHELL_WRAPPER: _wrapperMarker, ...inheritedEnv } = process.env;
-    execFileSync11(command[0], command.slice(1), {
+    execFileSync13(command[0], command.slice(1), {
       stdio: "inherit",
       env: inheritedEnv
     });
@@ -5783,7 +5821,7 @@ async function runAudienceMode(audience, action, args) {
     consola36.info(`Executing: ${command.join(" ")}`);
     try {
       const { APES_SHELL_WRAPPER: _wrapperMarker, ...inheritedEnv } = process.env;
-      execFileSync11(args["escapes-path"] || "escapes", ["--grant", authz_jwt, "--", ...command], {
+      execFileSync13(args["escapes-path"] || "escapes", ["--grant", authz_jwt, "--", ...command], {
         stdio: "inherit",
         env: inheritedEnv
       });
@@ -6285,7 +6323,7 @@ var mcpCommand = defineCommand48({
     if (transport !== "stdio" && transport !== "sse") {
       throw new Error('Transport must be "stdio" or "sse"');
     }
-    const { startMcpServer } = await import("./server-5LHDHGDG.js");
+    const { startMcpServer } = await import("./server-A24A4ILW.js");
     await startMcpServer(transport, port);
   }
 });
@@ -6293,7 +6331,7 @@ var mcpCommand = defineCommand48({
 // src/commands/init/index.ts
 import { existsSync as existsSync15, copyFileSync, writeFileSync as writeFileSync9 } from "fs";
 import { randomBytes } from "crypto";
-import { execFileSync as execFileSync12 } from "child_process";
+import { execFileSync as execFileSync14 } from "child_process";
 import { join as join14 } from "path";
 import { defineCommand as defineCommand49 } from "citty";
 import consola40 from "consola";
@@ -6305,11 +6343,11 @@ async function downloadTemplate(repo, targetDir) {
 function installDeps(dir) {
   const hasLockFile = (name) => existsSync15(join14(dir, name));
   if (hasLockFile("pnpm-lock.yaml")) {
-    execFileSync12("pnpm", ["install"], { cwd: dir, stdio: "inherit" });
+    execFileSync14("pnpm", ["install"], { cwd: dir, stdio: "inherit" });
   } else if (hasLockFile("bun.lockb")) {
-    execFileSync12("bun", ["install"], { cwd: dir, stdio: "inherit" });
+    execFileSync14("bun", ["install"], { cwd: dir, stdio: "inherit" });
   } else {
-    execFileSync12("npm", ["install"], { cwd: dir, stdio: "inherit" });
+    execFileSync14("npm", ["install"], { cwd: dir, stdio: "inherit" });
   }
 }
 async function promptChoice(message, choices) {
@@ -6923,7 +6961,7 @@ async function bestEffortGrantCount(idp) {
   }
 }
 async function runHealth(args) {
-  const version = true ? "1.13.1" : "0.0.0";
+  const version = true ? "1.15.0" : "0.0.0";
   const auth = loadAuth();
   if (!auth) {
     throw new CliError("Not logged in. Run `apes login` first.", 1);
@@ -7196,10 +7234,10 @@ if (shellRewrite) {
   if (shellRewrite.action === "rewrite") {
     process.argv = shellRewrite.argv;
   } else if (shellRewrite.action === "version") {
-    console.log(`ape-shell ${"1.13.1"} (OpenApe DDISA shell wrapper)`);
+    console.log(`ape-shell ${"1.15.0"} (OpenApe DDISA shell wrapper)`);
     process.exit(0);
   } else if (shellRewrite.action === "help") {
-    console.log(`ape-shell ${"1.13.1"} \u2014 OpenApe DDISA shell wrapper`);
+    console.log(`ape-shell ${"1.15.0"} \u2014 OpenApe DDISA shell wrapper`);
     console.log("");
     console.log("Usage:");
     console.log("  ape-shell                 Start interactive grant-mediated REPL");
@@ -7257,7 +7295,7 @@ var configCommand = defineCommand60({
 var main = defineCommand60({
   meta: {
     name: "apes",
-    version: "1.13.1",
+    version: "1.15.0",
     description: "Unified CLI for OpenApe"
   },
   subCommands: {
@@ -7314,7 +7352,7 @@ async function maybeRefreshAuth() {
   }
 }
 await maybeRefreshAuth();
-await maybeWarnStaleVersion("1.13.1").catch(() => {
+await maybeWarnStaleVersion("1.15.0").catch(() => {
 });
 runMain(main).catch((err) => {
   if (err instanceof CliExit) {