@openape/apes 1.2.0 → 1.3.0

package/dist/cli.js

@@ -379,7 +379,7 @@ async function loginWithPKCE(idp) {
   consola2.success(`Logged in as ${payload.email || payload.sub}`);
 }
 async function loginWithKey(idp, keyPath, agentEmail) {
-  const { readFileSync: readFileSync14 } = await import("fs");
+  const { readFileSync: readFileSync13 } = await import("fs");
   const { sign: sign3 } = await import("crypto");
   const { loadEd25519PrivateKey: loadEd25519PrivateKey2 } = await import("./ssh-key-YBNNG5K5.js");
   const challengeUrl = await getAgentChallengeEndpoint(idp);
@@ -392,7 +392,7 @@ async function loginWithKey(idp, keyPath, agentEmail) {
     throw new CliError(`Challenge failed: ${await challengeResp.text()}`);
   }
   const { challenge } = await challengeResp.json();
-  const keyContent = readFileSync14(keyPath, "utf-8");
+  const keyContent = readFileSync13(keyPath, "utf-8");
   const privateKey = loadEd25519PrivateKey2(keyContent);
   const signature = sign3(null, Buffer2.from(challenge), privateKey).toString("base64");
   const authenticateUrl = await getAgentAuthenticateEndpoint(idp);
@@ -3343,16 +3343,18 @@ function escape(s) {
 }
 function buildSyncPlist(input) {
   const pathLine = `    <key>PATH</key><string>${escape(input.homeDir)}/.bun/bin:/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin</string>
+`;
+  const agentUserLine = `    <key>AGENT_USER</key><string>${escape(input.userName)}</string>
 `;
   const envBlock = input.troopUrl ? `  <key>EnvironmentVariables</key>
   <dict>
     <key>HOME</key><string>${escape(input.homeDir)}</string>
-${pathLine}    <key>OPENAPE_TROOP_URL</key><string>${escape(input.troopUrl)}</string>
+${pathLine}${agentUserLine}    <key>OPENAPE_TROOP_URL</key><string>${escape(input.troopUrl)}</string>
   </dict>
 ` : `  <key>EnvironmentVariables</key>
   <dict>
     <key>HOME</key><string>${escape(input.homeDir)}</string>
-${pathLine}  </dict>
+${pathLine}${agentUserLine}  </dict>
 `;
   return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
@@ -3360,8 +3362,6 @@ ${pathLine}  </dict>
 <dict>
   <key>Label</key>
   <string>${escape(syncPlistLabel(input.agentName))}</string>
-  <key>UserName</key>
-  <string>${escape(input.userName)}</string>
   <key>ProgramArguments</key>
   <array>
     <string>${escape(input.apesBin)}</string>
@@ -3750,205 +3750,18 @@ async function resolveClaudeToken(opts) {
 }
 
 // src/commands/agents/sync.ts
-import { existsSync as existsSync9, mkdirSync as mkdirSync4, readFileSync as readFileSync10, writeFileSync as writeFileSync6 } from "fs";
-import { homedir as homedir10 } from "os";
-import { join as join8 } from "path";
+import { chownSync, existsSync as existsSync9, mkdirSync as mkdirSync3, readFileSync as readFileSync9, statSync, writeFileSync as writeFileSync5 } from "fs";
+import { homedir as homedir9 } from "os";
+import { join as join7 } from "path";
 import { defineCommand as defineCommand27 } from "citty";
 import consola24 from "consola";
 
-// src/lib/launchd-reconcile.ts
-import { execFileSync as execFileSync8 } from "child_process";
-import { mkdirSync as mkdirSync3, readdirSync, readFileSync as readFileSync9, unlinkSync, writeFileSync as writeFileSync5 } from "fs";
-import { homedir as homedir9, userInfo as userInfo2 } from "os";
-import { join as join7 } from "path";
-var PLIST_PREFIX = "openape.troop.";
-function plistDir() {
-  return join7(homedir9(), "Library", "LaunchAgents");
-}
-function plistPath(agentName, taskId) {
-  return join7(plistDir(), `${PLIST_PREFIX}${agentName}.${taskId}.plist`);
-}
-function plistLabel(agentName, taskId) {
-  return `${PLIST_PREFIX}${agentName}.${taskId}`;
-}
-function fieldValues(token, range) {
-  const [min, max] = range;
-  if (token === "*") return null;
-  if (token.startsWith("*/")) {
-    const step = Number(token.slice(2));
-    if (!Number.isInteger(step) || step < 1) return [];
-    const values = [];
-    for (let i = min; i <= max; i++) {
-      if (i % step === 0) values.push(i);
-    }
-    return values;
-  }
-  const n = Number(token);
-  return Number.isInteger(n) ? [n] : [];
-}
-function cronToSchedule(expr) {
-  const parts = expr.trim().split(/\s+/);
-  if (parts.length !== 5) return [];
-  const [m, h, dom, mo, dow] = parts;
-  const minutes = fieldValues(m, [0, 59]);
-  const hours = fieldValues(h, [0, 23]);
-  const doms = fieldValues(dom, [1, 31]);
-  const months = fieldValues(mo, [1, 12]);
-  const dows = fieldValues(dow, [0, 7]);
-  const slots = [];
-  const minList = minutes ?? [null];
-  const hourList = hours ?? [null];
-  const domList = doms ?? [null];
-  const monthList = months ?? [null];
-  const dowList = dows ?? [null];
-  for (const M of minList) {
-    for (const H of hourList) {
-      for (const D of domList) {
-        for (const Mo of monthList) {
-          for (const W of dowList) {
-            const slot = {};
-            if (M !== null) slot.Minute = M;
-            if (H !== null) slot.Hour = H;
-            if (D !== null) slot.Day = D;
-            if (Mo !== null) slot.Month = Mo;
-            if (W !== null) slot.Weekday = W === 7 ? 0 : W;
-            slots.push(slot);
-          }
-        }
-      }
-    }
-  }
-  return slots;
-}
-function escape2(s) {
-  return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
-}
-function plistBody(input) {
-  const calendarBlocks = input.schedule.map((slot) => {
-    const lines = [];
-    if (slot.Minute !== void 0) lines.push(`      <key>Minute</key><integer>${slot.Minute}</integer>`);
-    if (slot.Hour !== void 0) lines.push(`      <key>Hour</key><integer>${slot.Hour}</integer>`);
-    if (slot.Day !== void 0) lines.push(`      <key>Day</key><integer>${slot.Day}</integer>`);
-    if (slot.Month !== void 0) lines.push(`      <key>Month</key><integer>${slot.Month}</integer>`);
-    if (slot.Weekday !== void 0) lines.push(`      <key>Weekday</key><integer>${slot.Weekday}</integer>`);
-    return `    <dict>
-${lines.join("\n")}
-    </dict>`;
-  }).join("\n");
-  const calendarKey = input.schedule.length === 1 ? `  <key>StartCalendarInterval</key>
-  <dict>
-${calendarBlocks.replace(/^ {4}/gm, "  ").replace(/^ {2}<dict>\n|\n {2}<\/dict>$/g, "")}
-  </dict>` : `  <key>StartCalendarInterval</key>
-  <array>
-${calendarBlocks}
-  </array>`;
-  return `<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
-<plist version="1.0">
-<dict>
-  <key>Label</key>
-  <string>${escape2(input.label)}</string>
-  <key>ProgramArguments</key>
-  <array>
-    <string>${escape2(input.apesBin)}</string>
-    <string>agents</string>
-    <string>run</string>
-    <string>${escape2(input.taskId)}</string>
-  </array>
-  <key>WorkingDirectory</key>
-  <string>${escape2(input.homeDir)}</string>
-  <key>EnvironmentVariables</key>
-  <dict>
-    <key>HOME</key>
-    <string>${escape2(input.homeDir)}</string>
-  </dict>
-${calendarKey}
-  <key>StandardOutPath</key>
-  <string>${escape2(input.homeDir)}/Library/Logs/openape-troop-${escape2(input.taskId)}.log</string>
-  <key>StandardErrorPath</key>
-  <string>${escape2(input.homeDir)}/Library/Logs/openape-troop-${escape2(input.taskId)}.log</string>
-</dict>
-</plist>
-`;
-}
-function buildPlistContent(args) {
-  return plistBody({
-    label: plistLabel(args.agentName, args.task.taskId),
-    apesBin: args.apesBin,
-    taskId: args.task.taskId,
-    schedule: cronToSchedule(args.task.cron),
-    homeDir: args.homeDir
-  });
-}
-function uid() {
-  return userInfo2().uid;
-}
-function bootstrap(label, path2) {
-  try {
-    execFileSync8("/bin/launchctl", ["bootout", `gui/${uid()}/${label}`], { stdio: "ignore" });
-  } catch {
-  }
-  execFileSync8("/bin/launchctl", ["bootstrap", `gui/${uid()}`, path2], { stdio: "ignore" });
-}
-function bootout(label) {
-  try {
-    execFileSync8("/bin/launchctl", ["bootout", `gui/${uid()}/${label}`], { stdio: "ignore" });
-  } catch {
-  }
-}
-function reconcile(input) {
-  mkdirSync3(plistDir(), { recursive: true });
-  const present = readdirSync(plistDir()).filter((f) => f.startsWith(`${PLIST_PREFIX}${input.agentName}.`) && f.endsWith(".plist"));
-  const presentTaskIds = new Set(
-    present.map((f) => f.slice(`${PLIST_PREFIX}${input.agentName}.`.length, -".plist".length))
-  );
-  const desiredById = new Map(input.desired.map((t) => [t.taskId, t]));
-  const result = { added: [], updated: [], removed: [], unchanged: [] };
-  for (const taskId of presentTaskIds) {
-    if (!desiredById.has(taskId)) {
-      const path2 = plistPath(input.agentName, taskId);
-      bootout(plistLabel(input.agentName, taskId));
-      try {
-        unlinkSync(path2);
-      } catch {
-      }
-      result.removed.push(taskId);
-    }
-  }
-  for (const task of input.desired) {
-    const path2 = plistPath(input.agentName, task.taskId);
-    const desiredContent = buildPlistContent({
-      agentName: input.agentName,
-      apesBin: input.apesBin,
-      homeDir: input.homeDir,
-      task
-    });
-    let existingContent = "";
-    try {
-      existingContent = readFileSync9(path2, "utf8");
-    } catch {
-    }
-    if (existingContent === desiredContent) {
-      if (task.enabled) bootstrap(plistLabel(input.agentName, task.taskId), path2);
-      else bootout(plistLabel(input.agentName, task.taskId));
-      result.unchanged.push(task.taskId);
-      continue;
-    }
-    writeFileSync5(path2, desiredContent, { mode: 420 });
-    if (task.enabled) bootstrap(plistLabel(input.agentName, task.taskId), path2);
-    else bootout(plistLabel(input.agentName, task.taskId));
-    if (presentTaskIds.has(task.taskId)) result.updated.push(task.taskId);
-    else result.added.push(task.taskId);
-  }
-  return result;
-}
-
 // src/lib/macos-host.ts
-import { execFileSync as execFileSync9 } from "child_process";
+import { execFileSync as execFileSync8 } from "child_process";
 import { hostname as hostname3 } from "os";
 function getHostId() {
   try {
-    const output = execFileSync9(
+    const output = execFileSync8(
       "/usr/sbin/ioreg",
       ["-d2", "-c", "IOPlatformExpertDevice"],
       { encoding: "utf8", timeout: 2e3 }
@@ -3968,15 +3781,15 @@ function getHostname() {
 }
 
 // src/commands/agents/sync.ts
-var AUTH_PATH3 = join8(homedir10(), ".config", "apes", "auth.json");
-var TASK_CACHE_DIR2 = join8(homedir10(), ".openape", "agent", "tasks");
+var AUTH_PATH3 = join7(homedir9(), ".config", "apes", "auth.json");
+var TASK_CACHE_DIR2 = join7(homedir9(), ".openape", "agent", "tasks");
 function readAuthJson() {
   if (!existsSync9(AUTH_PATH3)) {
     throw new CliError(
       `No agent auth found at ${AUTH_PATH3}. Run \`apes agents spawn <name>\` to provision an agent first.`
     );
   }
-  const raw = readFileSync10(AUTH_PATH3, "utf8");
+  const raw = readFileSync9(AUTH_PATH3, "utf8");
   let parsed;
   try {
     parsed = JSON.parse(raw);
@@ -4000,14 +3813,6 @@ function agentNameFromEmail(email) {
   }
   return before.slice(0, dashIdx);
 }
-function findApesBin() {
-  const argv1 = process.argv[1];
-  if (argv1 && existsSync9(argv1)) return argv1;
-  for (const candidate of ["/opt/homebrew/bin/apes", "/usr/local/bin/apes"]) {
-    if (existsSync9(candidate)) return candidate;
-  }
-  throw new CliError("Could not locate the apes binary path for launchd. Set APES_BIN env var to point at it.");
-}
 var syncAgentCommand = defineCommand27({
   meta: {
     name: "sync",
@@ -4041,31 +3846,44 @@ var syncAgentCommand = defineCommand27({
     consola24.info(sync.first_sync ? "\u2713 first sync \u2014 agent registered" : "\u2713 presence updated");
     const { system_prompt: systemPrompt, tasks } = await client.listTasks();
     consola24.info(`Pulled ${tasks.length} task${tasks.length === 1 ? "" : "s"}`);
-    const agentDir = join8(homedir10(), ".openape", "agent");
-    mkdirSync4(agentDir, { recursive: true });
-    writeFileSync6(
-      join8(agentDir, "agent.json"),
+    let agentUid = null;
+    let agentGid = null;
+    if (process.geteuid?.() === 0) {
+      try {
+        const homeStat = statSync(homedir9());
+        agentUid = homeStat.uid;
+        agentGid = homeStat.gid;
+      } catch {
+      }
+    }
+    function chownToAgent(path2) {
+      if (agentUid !== null && agentGid !== null) {
+        try {
+          chownSync(path2, agentUid, agentGid);
+        } catch {
+        }
+      }
+    }
+    const agentDir = join7(homedir9(), ".openape", "agent");
+    mkdirSync3(agentDir, { recursive: true });
+    chownToAgent(join7(homedir9(), ".openape"));
+    chownToAgent(agentDir);
+    const agentJsonPath = join7(agentDir, "agent.json");
+    writeFileSync5(
+      agentJsonPath,
       `${JSON.stringify({ systemPrompt }, null, 2)}
 `,
       { mode: 384 }
     );
-    mkdirSync4(TASK_CACHE_DIR2, { recursive: true });
+    chownToAgent(agentJsonPath);
+    mkdirSync3(TASK_CACHE_DIR2, { recursive: true });
+    chownToAgent(TASK_CACHE_DIR2);
     for (const task of tasks) {
-      const path2 = join8(TASK_CACHE_DIR2, `${task.taskId}.json`);
-      writeFileSync6(path2, `${JSON.stringify(task, null, 2)}
+      const path2 = join7(TASK_CACHE_DIR2, `${task.taskId}.json`);
+      writeFileSync5(path2, `${JSON.stringify(task, null, 2)}
 `, { mode: 384 });
+      chownToAgent(path2);
     }
-    const apesBin = findApesBin();
-    const result = reconcile({
-      agentName,
-      apesBin,
-      homeDir: homedir10(),
-      desired: tasks
-    });
-    if (result.added.length) consola24.success(`launchd: added ${result.added.join(", ")}`);
-    if (result.updated.length) consola24.success(`launchd: updated ${result.updated.join(", ")}`);
-    if (result.removed.length) consola24.warn(`launchd: removed ${result.removed.join(", ")}`);
-    if (result.unchanged.length) consola24.info(`launchd: ${result.unchanged.length} unchanged`);
     consola24.success("Sync complete.");
   }
 });
@@ -4417,7 +4235,7 @@ var adapterCommand = defineCommand29({
 });
 
 // src/commands/run.ts
-import { execFileSync as execFileSync10 } from "child_process";
+import { execFileSync as execFileSync9 } from "child_process";
 import { hostname as hostname4 } from "os";
 import { basename } from "path";
 import { defineCommand as defineCommand30 } from "citty";
@@ -4695,7 +4513,7 @@ function execShellCommand(command) {
     throw new CliError("No command to execute");
   try {
     const { APES_SHELL_WRAPPER: _wrapperMarker, ...inheritedEnv } = process.env;
-    execFileSync10(command[0], command.slice(1), {
+    execFileSync9(command[0], command.slice(1), {
       stdio: "inherit",
       env: inheritedEnv
     });
@@ -4847,7 +4665,7 @@ async function runAudienceMode(audience, action, args) {
     consola26.info(`Executing: ${command.join(" ")}`);
     try {
       const { APES_SHELL_WRAPPER: _wrapperMarker, ...inheritedEnv } = process.env;
-      execFileSync10(args["escapes-path"] || "escapes", ["--grant", authz_jwt, "--", ...command], {
+      execFileSync9(args["escapes-path"] || "escapes", ["--grant", authz_jwt, "--", ...command], {
         stdio: "inherit",
         env: inheritedEnv
       });
@@ -4897,10 +4715,10 @@ note = "VPC-internal hostname suffix"
 
 // src/proxy/local-proxy.ts
 import { spawn } from "child_process";
-import { mkdtempSync as mkdtempSync3, rmSync as rmSync3, writeFileSync as writeFileSync7 } from "fs";
+import { mkdtempSync as mkdtempSync3, rmSync as rmSync3, writeFileSync as writeFileSync6 } from "fs";
 import { createRequire } from "module";
 import { tmpdir as tmpdir3 } from "os";
-import { dirname as dirname3, join as join9, resolve as resolve4 } from "path";
+import { dirname as dirname3, join as join8, resolve as resolve4 } from "path";
 var require2 = createRequire(import.meta.url);
 function findProxyBin() {
   const pkgPath = require2.resolve("@openape/proxy/package.json");
@@ -4912,9 +4730,9 @@ function findProxyBin() {
   return resolve4(dirname3(pkgPath), binRel);
 }
 async function startEphemeralProxy(configToml) {
-  const tmpDir = mkdtempSync3(join9(tmpdir3(), "openape-proxy-"));
-  const configPath = join9(tmpDir, "config.toml");
-  writeFileSync7(configPath, configToml, { mode: 384 });
+  const tmpDir = mkdtempSync3(join8(tmpdir3(), "openape-proxy-"));
+  const configPath = join8(tmpDir, "config.toml");
+  writeFileSync6(configPath, configToml, { mode: 384 });
   const binPath = findProxyBin();
   const child = spawn(process.execPath, [binPath, "-c", configPath], {
     stdio: ["ignore", "pipe", "pipe"],
@@ -5349,16 +5167,16 @@ var mcpCommand = defineCommand36({
     if (transport !== "stdio" && transport !== "sse") {
       throw new Error('Transport must be "stdio" or "sse"');
     }
-    const { startMcpServer } = await import("./server-6OLIVAHI.js");
+    const { startMcpServer } = await import("./server-W5ZP3FWK.js");
     await startMcpServer(transport, port);
   }
 });
 
 // src/commands/init/index.ts
-import { existsSync as existsSync10, copyFileSync, writeFileSync as writeFileSync8 } from "fs";
+import { existsSync as existsSync10, copyFileSync, writeFileSync as writeFileSync7 } from "fs";
 import { randomBytes } from "crypto";
-import { execFileSync as execFileSync11 } from "child_process";
-import { join as join10 } from "path";
+import { execFileSync as execFileSync10 } from "child_process";
+import { join as join9 } from "path";
 import { defineCommand as defineCommand37 } from "citty";
 import consola30 from "consola";
 var DEFAULT_IDP_URL = "https://id.openape.at";
@@ -5367,13 +5185,13 @@ async function downloadTemplate(repo, targetDir) {
   await gigetDownload(`gh:${repo}`, { dir: targetDir, force: false });
 }
 function installDeps(dir) {
-  const hasLockFile = (name) => existsSync10(join10(dir, name));
+  const hasLockFile = (name) => existsSync10(join9(dir, name));
   if (hasLockFile("pnpm-lock.yaml")) {
-    execFileSync11("pnpm", ["install"], { cwd: dir, stdio: "inherit" });
+    execFileSync10("pnpm", ["install"], { cwd: dir, stdio: "inherit" });
   } else if (hasLockFile("bun.lockb")) {
-    execFileSync11("bun", ["install"], { cwd: dir, stdio: "inherit" });
+    execFileSync10("bun", ["install"], { cwd: dir, stdio: "inherit" });
   } else {
-    execFileSync11("npm", ["install"], { cwd: dir, stdio: "inherit" });
+    execFileSync10("npm", ["install"], { cwd: dir, stdio: "inherit" });
   }
 }
 async function promptChoice(message, choices) {
@@ -5432,7 +5250,7 @@ var initCommand = defineCommand37({
 });
 async function initSP(targetDir) {
   const dir = targetDir || "my-app";
-  if (existsSync10(join10(dir, "package.json"))) {
+  if (existsSync10(join9(dir, "package.json"))) {
     throw new CliError(`Directory "${dir}" already contains a project.`);
   }
   consola30.start("Scaffolding SP starter...");
@@ -5441,8 +5259,8 @@ async function initSP(targetDir) {
   consola30.start("Installing dependencies...");
   installDeps(dir);
   consola30.success("Dependencies installed");
-  const envExample = join10(dir, ".env.example");
-  const envFile = join10(dir, ".env");
+  const envExample = join9(dir, ".env.example");
+  const envFile = join9(dir, ".env");
   if (existsSync10(envExample) && !existsSync10(envFile)) {
     copyFileSync(envExample, envFile);
     consola30.success(`\`.env\` created (using Free IdP at ${DEFAULT_IDP_URL})`);
@@ -5457,7 +5275,7 @@ async function initSP(targetDir) {
 }
 async function initIdP(targetDir) {
   const dir = targetDir || "my-idp";
-  if (existsSync10(join10(dir, "package.json"))) {
+  if (existsSync10(join9(dir, "package.json"))) {
     throw new CliError(`Directory "${dir}" already contains a project.`);
   }
   const domain = await promptText("Domain for the IdP", "localhost");
@@ -5489,7 +5307,7 @@ async function initIdP(targetDir) {
     `NUXT_OPENAPE_RP_ID=${domain}`,
     `NUXT_OPENAPE_RP_ORIGIN=${origin}`
   ].join("\n");
-  writeFileSync8(join10(dir, ".env"), `${envContent}
+  writeFileSync7(join9(dir, ".env"), `${envContent}
 `, { mode: 384 });
   consola30.success(".env created");
   console.log("");
@@ -5510,7 +5328,7 @@ async function initIdP(targetDir) {
 
 // src/commands/enroll.ts
 import { Buffer as Buffer5 } from "buffer";
-import { existsSync as existsSync11, readFileSync as readFileSync11 } from "fs";
+import { existsSync as existsSync11, readFileSync as readFileSync10 } from "fs";
 import { execFile as execFile2 } from "child_process";
 import { sign as sign2 } from "crypto";
 import { defineCommand as defineCommand38 } from "citty";
@@ -5526,7 +5344,7 @@ function openBrowser2(url) {
 }
 async function pollForEnrollment(idp, agentEmail, keyPath) {
   const resolvedKey = resolveKeyPath(keyPath);
-  const keyContent = readFileSync11(resolvedKey, "utf-8");
+  const keyContent = readFileSync10(resolvedKey, "utf-8");
   const privateKey = loadEd25519PrivateKey(keyContent);
   const challengeUrl = await getAgentChallengeEndpoint(idp);
   const authenticateUrl = await getAgentAuthenticateEndpoint(idp);
@@ -5638,7 +5456,7 @@ var enrollCommand = defineCommand38({
 });
 
 // src/commands/register-user.ts
-import { existsSync as existsSync12, readFileSync as readFileSync12 } from "fs";
+import { existsSync as existsSync12, readFileSync as readFileSync11 } from "fs";
 import { defineCommand as defineCommand39 } from "citty";
 import consola32 from "consola";
 var registerUserCommand = defineCommand39({
@@ -5678,7 +5496,7 @@ var registerUserCommand = defineCommand39({
     }
     let publicKey = args.key;
     if (existsSync12(args.key)) {
-      publicKey = readFileSync12(args.key, "utf-8").trim();
+      publicKey = readFileSync11(args.key, "utf-8").trim();
     }
     if (!publicKey.startsWith("ssh-ed25519 ")) {
       throw new CliError("Public key must be in ssh-ed25519 format.");
@@ -5987,7 +5805,7 @@ async function bestEffortGrantCount(idp) {
   }
 }
 async function runHealth(args) {
-  const version = true ? "1.2.0" : "0.0.0";
+  const version = true ? "1.3.0" : "0.0.0";
   const auth = loadAuth();
   if (!auth) {
     throw new CliError("Not logged in. Run `apes login` first.", 1);
@@ -6180,26 +5998,26 @@ var workflowsCommand = defineCommand47({
 });
 
 // src/version-check.ts
-import { existsSync as existsSync13, mkdirSync as mkdirSync5, readFileSync as readFileSync13, writeFileSync as writeFileSync9 } from "fs";
-import { homedir as homedir11 } from "os";
-import { join as join11 } from "path";
+import { existsSync as existsSync13, mkdirSync as mkdirSync4, readFileSync as readFileSync12, writeFileSync as writeFileSync8 } from "fs";
+import { homedir as homedir10 } from "os";
+import { join as join10 } from "path";
 import consola38 from "consola";
 var PACKAGE_NAME = "@openape/apes";
 var CACHE_TTL_MS = 24 * 60 * 60 * 1e3;
-var CACHE_FILE = join11(homedir11(), ".config", "apes", ".version-check.json");
+var CACHE_FILE = join10(homedir10(), ".config", "apes", ".version-check.json");
 function readCache() {
   if (!existsSync13(CACHE_FILE)) return null;
   try {
-    return JSON.parse(readFileSync13(CACHE_FILE, "utf-8"));
+    return JSON.parse(readFileSync12(CACHE_FILE, "utf-8"));
   } catch {
     return null;
   }
 }
 function writeCache(entry) {
   try {
-    const dir = join11(homedir11(), ".config", "apes");
-    if (!existsSync13(dir)) mkdirSync5(dir, { recursive: true, mode: 448 });
-    writeFileSync9(CACHE_FILE, JSON.stringify(entry), { mode: 384 });
+    const dir = join10(homedir10(), ".config", "apes");
+    if (!existsSync13(dir)) mkdirSync4(dir, { recursive: true, mode: 448 });
+    writeFileSync8(CACHE_FILE, JSON.stringify(entry), { mode: 384 });
   } catch {
   }
 }
@@ -6260,10 +6078,10 @@ if (shellRewrite) {
   if (shellRewrite.action === "rewrite") {
     process.argv = shellRewrite.argv;
   } else if (shellRewrite.action === "version") {
-    console.log(`ape-shell ${"1.2.0"} (OpenApe DDISA shell wrapper)`);
+    console.log(`ape-shell ${"1.3.0"} (OpenApe DDISA shell wrapper)`);
     process.exit(0);
   } else if (shellRewrite.action === "help") {
-    console.log(`ape-shell ${"1.2.0"} \u2014 OpenApe DDISA shell wrapper`);
+    console.log(`ape-shell ${"1.3.0"} \u2014 OpenApe DDISA shell wrapper`);
     console.log("");
     console.log("Usage:");
     console.log("  ape-shell                 Start interactive grant-mediated REPL");
@@ -6321,7 +6139,7 @@ var configCommand = defineCommand48({
 var main = defineCommand48({
   meta: {
     name: "apes",
-    version: "1.2.0",
+    version: "1.3.0",
     description: "Unified CLI for OpenApe"
   },
   subCommands: {
@@ -6376,7 +6194,7 @@ async function maybeRefreshAuth() {
   }
 }
 await maybeRefreshAuth();
-await maybeWarnStaleVersion("1.2.0").catch(() => {
+await maybeWarnStaleVersion("1.3.0").catch(() => {
 });
 runMain(main).catch((err) => {
   if (err instanceof CliExit) {