@openape/apes 1.22.2 → 1.24.0

package/dist/cli.js

@@ -1773,13 +1773,15 @@ var adminCommand = defineCommand19({
 import { defineCommand as defineCommand28 } from "citty";
 
 // src/commands/agents/allow.ts
-import { execFileSync as execFileSync3 } from "child_process";
+import { execFileSync as execFileSync4 } from "child_process";
 import { defineCommand as defineCommand20 } from "citty";
 import consola18 from "consola";
 
 // src/lib/agent-bootstrap.ts
 import { Buffer as Buffer3 } from "buffer";
+import { execFileSync as execFileSync2 } from "child_process";
 import { createPrivateKey, sign } from "crypto";
+import { rmSync } from "fs";
 
 // ../../node_modules/.pnpm/ofetch@1.5.1/node_modules/ofetch/dist/node.mjs
 import http from "http";
@@ -2725,34 +2727,37 @@ mkdir -p "$HOME_DIR/Library/Logs" "$HOME_DIR/.openape/agent/tasks"
 function buildTroopBootstrapBlock(_troop, _name) {
   return "";
 }
-function buildPhaseGTeardownScript(input) {
+function runPhaseGTeardownInProcess(input) {
   const { name, homeDir } = input;
-  return `#!/bin/bash
-set -u
-
-NAME=${shQuote(name)}
-HOME_DIR=${shQuote(homeDir)}
-
-UID_OF=$(dscl . -read "/Users/$NAME" UniqueID 2>/dev/null | awk '/UniqueID:/ {print $2}')
-
-if [ -n "$UID_OF" ]; then
-  launchctl bootout "user/$UID_OF" 2>/dev/null || true
-  pkill -9 -u "$UID_OF" 2>/dev/null || true
-fi
-
-# Per-agent ecosystem files written by the Nest's pm2-supervisor.
-rm -rf "/var/openape/agents/$NAME"
-
-# Home dir lives under /var/openape/homes/ \u2014 no FDA wall, root can
-# remove directly.
-if [ -d "$HOME_DIR" ] && [ "$HOME_DIR" != "/" ] && [ "$HOME_DIR" != "" ]; then
-  rm -rf "$HOME_DIR"
-fi
-
-# dscl record stays as a tombstone. Operators run
-# \`sudo sysadminctl -deleteUser $NAME\` to fully clean up if desired.
-echo "OK Phase-G teardown done for $NAME (dscl record kept as tombstone)"
-`;
+  let uid = null;
+  try {
+    const out = execFileSync2("/usr/bin/dscl", [".", "-read", `/Users/${name}`, "UniqueID"], { encoding: "utf8" });
+    const m = out.match(/UniqueID:\s*(\d+)/);
+    if (m) uid = m[1];
+  } catch {
+  }
+  if (uid) {
+    try {
+      execFileSync2("/bin/launchctl", ["bootout", `user/${uid}`], { stdio: "ignore" });
+    } catch {
+    }
+    try {
+      execFileSync2("/usr/bin/pkill", ["-9", "-u", uid], { stdio: "ignore" });
+    } catch {
+    }
+  }
+  const agentDir = `/var/openape/agents/${name}`;
+  try {
+    rmSync(agentDir, { recursive: true, force: true });
+  } catch {
+  }
+  if (homeDir && homeDir !== "/" && homeDir.startsWith("/var/openape/homes/")) {
+    try {
+      rmSync(homeDir, { recursive: true, force: true });
+    } catch {
+    }
+  }
+  console.log(`OK Phase-G teardown done for ${name} (dscl record kept as tombstone)`);
 }
 function buildDestroyTeardownScript(input) {
   const { name, homeDir, adminUser } = input;
@@ -2876,7 +2881,7 @@ print(json.dumps(out))
 `;
 
 // src/lib/macos-user.ts
-import { execFileSync as execFileSync2 } from "child_process";
+import { execFileSync as execFileSync3 } from "child_process";
 import { existsSync as existsSync3, readFileSync as readFileSync2 } from "fs";
 function isDarwin() {
   return process.platform === "darwin";
@@ -2884,7 +2889,7 @@ function isDarwin() {
 function readMacOSUser(name) {
   let output;
   try {
-    output = execFileSync2("dscl", [".", "-read", `/Users/${name}`], {
+    output = execFileSync3("dscl", [".", "-read", `/Users/${name}`], {
       encoding: "utf-8",
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -2904,7 +2909,7 @@ function readMacOSUser(name) {
 function listMacOSUserNames() {
   let output;
   try {
-    output = execFileSync2("dscl", [".", "-list", "/Users"], {
+    output = execFileSync3("dscl", [".", "-list", "/Users"], {
       encoding: "utf-8",
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -2917,7 +2922,7 @@ function listMacOSUserNames() {
 }
 function whichBinary(name) {
   try {
-    const out = execFileSync2("which", [name], {
+    const out = execFileSync3("which", [name], {
       encoding: "utf-8",
       stdio: ["ignore", "pipe", "ignore"]
     }).trim();
@@ -2994,7 +2999,7 @@ PY
 chmod 600 "$F"
 `;
     consola18.start(`Adding ${email} to ${agent}'s allowlist\u2026`);
-    execFileSync3(apes, ["run", "--as", agent, "--wait", "--", "bash", "-c", script], { stdio: "inherit" });
+    execFileSync4(apes, ["run", "--as", agent, "--wait", "--", "bash", "-c", script], { stdio: "inherit" });
     consola18.success(`${agent} will auto-accept future contact requests from ${email} (within ~30s of next bridge connect).`);
   }
 });
@@ -3003,8 +3008,8 @@ function shQuote2(s) {
 }
 
 // src/commands/agents/destroy.ts
-import { execFileSync as execFileSync4 } from "child_process";
-import { mkdtempSync, rmSync, writeFileSync as writeFileSync2 } from "fs";
+import { execFileSync as execFileSync5 } from "child_process";
+import { mkdtempSync, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "fs";
 import { tmpdir, userInfo } from "os";
 import { join as join3 } from "path";
 import { defineCommand as defineCommand21 } from "citty";
@@ -3136,6 +3141,10 @@ var destroyAgentCommand = defineCommand21({
     "keep-os-user": {
       type: "boolean",
       description: "Skip OS-side teardown. Useful for CI where the agent has no OS user."
+    },
+    "root-stage": {
+      type: "boolean",
+      description: "Internal \u2014 destroy.ts re-invokes itself via `apes run --as root --` with this flag set, then runs only the Phase-G teardown (rm home, launchctl bootout, kill processes). Skips IdP + auth + interactive prompts since those already ran in the outer pass."
     }
   },
   async run({ args }) {
@@ -3145,6 +3154,15 @@ var destroyAgentCommand = defineCommand21({
         `Invalid agent name "${name}". Must match /^[a-z][a-z0-9-]{0,23}$/.`
       );
     }
+    if (args["root-stage"]) {
+      if (process.geteuid?.() !== 0) {
+        throw new CliError("--root-stage was passed but this process is not running as root. Refusing to continue.");
+      }
+      const homeDir = readMacOSUser(name)?.homeDir ?? `/var/openape/homes/${name}`;
+      consola19.start(`Running teardown for ${name} (Phase-G, root-stage)\u2026`);
+      runPhaseGTeardownInProcess({ name, homeDir });
+      return;
+    }
     const auth = loadAuth();
     if (!auth) {
       throw new CliError("Not authenticated. Run `apes login` first.");
@@ -3199,15 +3217,24 @@ ${consequences.join("\n")}`);
       const homeDir = osUser?.homeDir ?? `/Users/${name}`;
       const isPhaseG = homeDir.startsWith("/var/openape/homes/");
       if (isPhaseG) {
-        const scratch = mkdtempSync(join3(tmpdir(), `apes-destroy-${name}-`));
-        const scriptPath = join3(scratch, "teardown.sh");
-        try {
-          const script = buildPhaseGTeardownScript({ name, homeDir });
-          writeFileSync2(scriptPath, script, { mode: 448 });
+        if (process.geteuid?.() === 0) {
+          consola19.start("Running teardown (Phase G \u2014 already root, no grant needed)\u2026");
+          runPhaseGTeardownInProcess({ name, homeDir });
+        } else {
           consola19.start("Running teardown (Phase G \u2014 no admin password needed)\u2026");
-          execFileSync4("apes", ["run", "--as", "root", "--wait", "--", "bash", scriptPath], { stdio: "inherit" });
-        } finally {
-          rmSync(scratch, { recursive: true, force: true });
+          execFileSync5("apes", [
+            "run",
+            "--as",
+            "root",
+            "--wait",
+            "--",
+            "apes",
+            "agents",
+            "destroy",
+            name,
+            "--force",
+            "--root-stage"
+          ], { stdio: "inherit" });
         }
         consola19.info(`dscl record /Users/${name} kept as tombstone (hidden, no home). Run \`sudo sysadminctl -deleteUser ${name}\` to fully remove.`);
       } else {
@@ -3235,14 +3262,14 @@ ${consequences.join("\n")}`);
             const script = buildDestroyTeardownScript({ name, homeDir, adminUser });
             writeFileSync2(scriptPath, script, { mode: 448 });
             consola19.start("Running teardown via sudo\u2026");
-            execFileSync4(sudo, ["-S", "--prompt=", "--", "bash", scriptPath], {
+            execFileSync5(sudo, ["-S", "--prompt=", "--", "bash", scriptPath], {
               input: `${adminPassword}
 ${adminPassword}
 `,
               stdio: ["pipe", "inherit", "inherit"]
             });
           } finally {
-            rmSync(scratch, { recursive: true, force: true });
+            rmSync2(scratch, { recursive: true, force: true });
           }
         }
       }
@@ -3768,8 +3795,8 @@ async function handleInbound(msg, sessions) {
 }
 
 // src/commands/agents/spawn.ts
-import { execFileSync as execFileSync6 } from "child_process";
-import { mkdtempSync as mkdtempSync2, rmSync as rmSync2, writeFileSync as writeFileSync4 } from "fs";
+import { execFileSync as execFileSync7 } from "child_process";
+import { mkdtempSync as mkdtempSync2, rmSync as rmSync3, writeFileSync as writeFileSync4 } from "fs";
 import { tmpdir as tmpdir2 } from "os";
 import { join as join7 } from "path";
 import { defineCommand as defineCommand26 } from "citty";
@@ -3884,7 +3911,7 @@ function generateKeyPairInMemory() {
 }
 
 // src/lib/llm-bridge.ts
-import { execFileSync as execFileSync5 } from "child_process";
+import { execFileSync as execFileSync6 } from "child_process";
 import { existsSync as existsSync9, readFileSync as readFileSync8 } from "fs";
 import { homedir as homedir8 } from "os";
 import { dirname as dirname2, join as join6 } from "path";
@@ -3928,7 +3955,7 @@ function captureHostBinDirs() {
   for (const bin of ["node", "ape-agent", "apes"]) {
     let resolved;
     try {
-      resolved = execFileSync5("/usr/bin/which", [bin], { encoding: "utf8" }).trim();
+      resolved = execFileSync6("/usr/bin/which", [bin], { encoding: "utf8" }).trim();
     } catch {
       const installCmd = bin === "ape-agent" ? "npm i -g @openape/ape-agent" : bin === "apes" ? "npm i -g @openape/apes" : "install Node.js (e.g. brew install node)";
       throw new Error(`'${bin}' not found on host PATH. ${installCmd} before spawning agents \u2014 the bridge runtime resolves these at spawn time and bakes the dir into the agent's launchd plist.`);
@@ -4192,11 +4219,11 @@ and try again.`
       const alreadyRoot = process.getuid?.() === 0;
       if (alreadyRoot) {
         consola23.start("Running privileged setup directly (already root)\u2026");
-        execFileSync6("bash", [scriptPath], { stdio: "inherit" });
+        execFileSync7("bash", [scriptPath], { stdio: "inherit" });
       } else {
         consola23.start("Running privileged setup as root via `apes run --as root --wait`\u2026");
         consola23.info("You will be asked to approve the as=root grant in your DDISA inbox; this command blocks until you do.");
-        execFileSync6(apes, ["run", "--as", "root", "--wait", "--", "bash", scriptPath], { stdio: "inherit" });
+        execFileSync7(apes, ["run", "--as", "root", "--wait", "--", "bash", scriptPath], { stdio: "inherit" });
       }
       try {
         const uid = readMacOSUidOrNull(name);
@@ -4225,7 +4252,7 @@ and try again.`
       console.log("Run as the agent with:");
       console.log(`  apes run --as ${name} -- claude --session-name ${name} --dangerously-skip-permissions`);
     } finally {
-      rmSync2(scratch, { recursive: true, force: true });
+      rmSync3(scratch, { recursive: true, force: true });
     }
   }
 });
@@ -4253,18 +4280,18 @@ async function resolveClaudeToken(opts) {
 }
 
 // src/commands/agents/sync.ts
-import { chownSync, existsSync as existsSync10, mkdirSync as mkdirSync3, readdirSync, readFileSync as readFileSync9, rmSync as rmSync3, statSync, writeFileSync as writeFileSync5 } from "fs";
+import { chownSync, existsSync as existsSync10, mkdirSync as mkdirSync3, readdirSync, readFileSync as readFileSync9, rmSync as rmSync4, statSync, writeFileSync as writeFileSync5 } from "fs";
 import { homedir as homedir9 } from "os";
 import { join as join8 } from "path";
 import { defineCommand as defineCommand27 } from "citty";
 import consola24 from "consola";
 
 // src/lib/macos-host.ts
-import { execFileSync as execFileSync7 } from "child_process";
+import { execFileSync as execFileSync8 } from "child_process";
 import { hostname as hostname3 } from "os";
 function getHostId() {
   try {
-    const output = execFileSync7(
+    const output = execFileSync8(
       "/usr/sbin/ioreg",
       ["-d2", "-c", "IOPlatformExpertDevice"],
       { encoding: "utf8", timeout: 2e3 }
@@ -4347,11 +4374,10 @@ var syncAgentCommand = defineCommand27({
       ownerEmail: auth.owner_email
     });
     consola24.info(sync.first_sync ? "\u2713 first sync \u2014 agent registered" : "\u2713 presence updated");
-    const { system_prompt: systemPrompt, tools, soul, skills, tasks } = await client.listTasks();
+    const { system_prompt: systemPrompt, tools, skills, tasks } = await client.listTasks();
     consola24.info(`Pulled ${tasks.length} task${tasks.length === 1 ? "" : "s"}`);
     consola24.info(`Tools enabled: ${tools.length === 0 ? "(none)" : tools.join(", ")}`);
     consola24.info(`Skills: ${skills.length === 0 ? "(none)" : skills.map((s) => s.name).join(", ")}`);
-    consola24.info(`SOUL.md: ${soul.length > 0 ? `${soul.length} chars` : "(empty)"}`);
     let agentUid = null;
     let agentGid = null;
     if (process.geteuid?.() === 0) {
@@ -4390,10 +4416,6 @@ var syncAgentCommand = defineCommand27({
 `, { mode: 384 });
       chownToAgent(path2);
     }
-    const soulPath = join8(agentDir, "SOUL.md");
-    writeFileSync5(soulPath, soul.endsWith("\n") ? soul : `${soul}
-`, { mode: 384 });
-    chownToAgent(soulPath);
     const skillsDir = join8(agentDir, "skills");
     mkdirSync3(skillsDir, { recursive: true });
     chownToAgent(skillsDir);
@@ -4402,7 +4424,7 @@ var syncAgentCommand = defineCommand27({
       for (const entry of readdirSync(skillsDir)) {
         if (incomingNames.has(entry)) continue;
         try {
-          rmSync3(join8(skillsDir, entry), { recursive: true, force: true });
+          rmSync4(join8(skillsDir, entry), { recursive: true, force: true });
         } catch {
         }
       }
@@ -4443,7 +4465,7 @@ var agentsCommand = defineCommand28({
 import { defineCommand as defineCommand36 } from "citty";
 
 // src/commands/nest/authorize.ts
-import { execFileSync as execFileSync8 } from "child_process";
+import { execFileSync as execFileSync9 } from "child_process";
 import { existsSync as existsSync12, readFileSync as readFileSync10 } from "fs";
 import { join as join10 } from "path";
 import { defineCommand as defineCommand30 } from "citty";
@@ -4610,7 +4632,7 @@ var authorizeNestCommand = defineCommand30({
       cmdArgs.push("--expires-in", args["expires-in"]);
     }
     try {
-      execFileSync8("apes", cmdArgs, { stdio: "inherit" });
+      execFileSync9("apes", cmdArgs, { stdio: "inherit" });
     } catch (err) {
       throw new CliError(err instanceof Error ? err.message : String(err));
     }
@@ -4620,7 +4642,7 @@ var authorizeNestCommand = defineCommand30({
 });
 
 // src/commands/nest/destroy.ts
-import { execFileSync as execFileSync9 } from "child_process";
+import { execFileSync as execFileSync10 } from "child_process";
 import { defineCommand as defineCommand31 } from "citty";
 import consola27 from "consola";
 var destroyNestCommand = defineCommand31({
@@ -4634,7 +4656,7 @@ var destroyNestCommand = defineCommand31({
   async run({ args }) {
     const name = String(args.name);
     try {
-      execFileSync9("apes", ["run", "--as", "root", "--wait", "--", "apes", "agents", "destroy", name, "--force"], { stdio: "inherit" });
+      execFileSync10("apes", ["run", "--as", "root", "--wait", "--", "apes", "agents", "destroy", name, "--force"], { stdio: "inherit" });
       consola27.success(`Nest will tear down ${name}'s pm2 process on its next reconcile (\u22642s).`);
     } catch (err) {
       const status = err.status ?? 1;
@@ -4644,7 +4666,7 @@ var destroyNestCommand = defineCommand31({
 });
 
 // src/commands/nest/install.ts
-import { execFileSync as execFileSync10 } from "child_process";
+import { execFileSync as execFileSync11 } from "child_process";
 import { existsSync as existsSync13, mkdirSync as mkdirSync5, readFileSync as readFileSync11, writeFileSync as writeFileSync7 } from "fs";
 import { homedir as homedir11, userInfo as userInfo2 } from "os";
 import { dirname as dirname3, join as join11 } from "path";
@@ -4843,10 +4865,10 @@ var installNestCommand = defineCommand32({
     }
     const uid = userInfo2().uid;
     try {
-      execFileSync10("/bin/launchctl", ["bootout", `gui/${uid}/${PLIST_LABEL}`], { stdio: "ignore" });
+      execFileSync11("/bin/launchctl", ["bootout", `gui/${uid}/${PLIST_LABEL}`], { stdio: "ignore" });
     } catch {
     }
-    execFileSync10("/bin/launchctl", ["bootstrap", `gui/${uid}`, plistPath()], { stdio: "inherit" });
+    execFileSync11("/bin/launchctl", ["bootstrap", `gui/${uid}`, plistPath()], { stdio: "inherit" });
     consola28.success(`Nest daemon bootstrapped \u2014 http://127.0.0.1:${port}`);
     consola28.info("");
     consola28.info("Next steps for zero-prompt spawn \u2014 both one-time:");
@@ -4888,7 +4910,7 @@ var listNestCommand = defineCommand33({
 });
 
 // src/commands/nest/spawn.ts
-import { execFileSync as execFileSync11 } from "child_process";
+import { execFileSync as execFileSync12 } from "child_process";
 import { defineCommand as defineCommand34 } from "citty";
 import consola30 from "consola";
 var spawnNestCommand = defineCommand34({
@@ -4921,7 +4943,7 @@ var spawnNestCommand = defineCommand34({
     if (typeof args["bridge-base-url"] === "string") apesArgs.push("--bridge-base-url", args["bridge-base-url"]);
     if (typeof args["bridge-model"] === "string") apesArgs.push("--bridge-model", args["bridge-model"]);
     try {
-      execFileSync11("apes", apesArgs, { stdio: "inherit" });
+      execFileSync12("apes", apesArgs, { stdio: "inherit" });
       consola30.success(`Nest will pick up ${name} on its next reconcile (\u22642s).`);
     } catch (err) {
       const status = err.status ?? 1;
@@ -4931,7 +4953,7 @@ var spawnNestCommand = defineCommand34({
 });
 
 // src/commands/nest/uninstall.ts
-import { execFileSync as execFileSync12 } from "child_process";
+import { execFileSync as execFileSync13 } from "child_process";
 import { existsSync as existsSync14, unlinkSync } from "fs";
 import { homedir as homedir12, userInfo as userInfo3 } from "os";
 import { join as join12 } from "path";
@@ -4947,7 +4969,7 @@ var uninstallNestCommand = defineCommand35({
     const uid = userInfo3().uid;
     const path2 = join12(homedir12(), "Library", "LaunchAgents", `${PLIST_LABEL2}.plist`);
     try {
-      execFileSync12("/bin/launchctl", ["bootout", `gui/${uid}/${PLIST_LABEL2}`], { stdio: "ignore" });
+      execFileSync13("/bin/launchctl", ["bootout", `gui/${uid}/${PLIST_LABEL2}`], { stdio: "ignore" });
       consola31.success("Nest daemon stopped");
     } catch {
       consola31.info("Nest daemon was not loaded");
@@ -5501,7 +5523,7 @@ var adapterCommand = defineCommand41({
 });
 
 // src/commands/run.ts
-import { execFileSync as execFileSync13 } from "child_process";
+import { execFileSync as execFileSync14 } from "child_process";
 import { hostname as hostname5 } from "os";
 import { basename } from "path";
 import { defineCommand as defineCommand42 } from "citty";
@@ -5779,7 +5801,7 @@ function execShellCommand(command) {
     throw new CliError("No command to execute");
   try {
     const { APES_SHELL_WRAPPER: _wrapperMarker, ...inheritedEnv } = process.env;
-    execFileSync13(command[0], command.slice(1), {
+    execFileSync14(command[0], command.slice(1), {
       stdio: "inherit",
       env: inheritedEnv
     });
@@ -5948,7 +5970,7 @@ function executeWithGrantToken(opts) {
     consola36.info(`Executing: ${command.join(" ")}`);
     try {
       const { APES_SHELL_WRAPPER: _wrapperMarker, ...inheritedEnv } = process.env;
-      execFileSync13(args["escapes-path"] || "escapes", ["--grant", token, "--", ...command], {
+      execFileSync14(args["escapes-path"] || "escapes", ["--grant", token, "--", ...command], {
         stdio: "inherit",
         env: inheritedEnv
       });
@@ -6019,7 +6041,7 @@ note = "VPC-internal hostname suffix"
 
 // src/proxy/local-proxy.ts
 import { spawn } from "child_process";
-import { mkdtempSync as mkdtempSync3, rmSync as rmSync4, writeFileSync as writeFileSync8 } from "fs";
+import { mkdtempSync as mkdtempSync3, rmSync as rmSync5, writeFileSync as writeFileSync8 } from "fs";
 import { createRequire } from "module";
 import { tmpdir as tmpdir3 } from "os";
 import { dirname as dirname4, join as join13, resolve as resolve3 } from "path";
@@ -6044,7 +6066,7 @@ async function startEphemeralProxy(configToml) {
   });
   const cleanupTmp = () => {
     try {
-      rmSync4(tmpDir, { recursive: true, force: true });
+      rmSync5(tmpDir, { recursive: true, force: true });
     } catch {
     }
   };
@@ -6471,7 +6493,7 @@ var mcpCommand = defineCommand48({
     if (transport !== "stdio" && transport !== "sse") {
       throw new Error('Transport must be "stdio" or "sse"');
     }
-    const { startMcpServer } = await import("./server-PKEGSN5E.js");
+    const { startMcpServer } = await import("./server-K77SHBP2.js");
     await startMcpServer(transport, port);
   }
 });
@@ -6479,7 +6501,7 @@ var mcpCommand = defineCommand48({
 // src/commands/init/index.ts
 import { existsSync as existsSync15, copyFileSync, writeFileSync as writeFileSync9 } from "fs";
 import { randomBytes } from "crypto";
-import { execFileSync as execFileSync14 } from "child_process";
+import { execFileSync as execFileSync15 } from "child_process";
 import { join as join14 } from "path";
 import { defineCommand as defineCommand49 } from "citty";
 import consola40 from "consola";
@@ -6491,11 +6513,11 @@ async function downloadTemplate(repo, targetDir) {
 function installDeps(dir) {
   const hasLockFile = (name) => existsSync15(join14(dir, name));
   if (hasLockFile("pnpm-lock.yaml")) {
-    execFileSync14("pnpm", ["install"], { cwd: dir, stdio: "inherit" });
+    execFileSync15("pnpm", ["install"], { cwd: dir, stdio: "inherit" });
   } else if (hasLockFile("bun.lockb")) {
-    execFileSync14("bun", ["install"], { cwd: dir, stdio: "inherit" });
+    execFileSync15("bun", ["install"], { cwd: dir, stdio: "inherit" });
   } else {
-    execFileSync14("npm", ["install"], { cwd: dir, stdio: "inherit" });
+    execFileSync15("npm", ["install"], { cwd: dir, stdio: "inherit" });
   }
 }
 async function promptChoice(message, choices) {
@@ -7109,7 +7131,7 @@ async function bestEffortGrantCount(idp) {
   }
 }
 async function runHealth(args) {
-  const version = true ? "1.22.2" : "0.0.0";
+  const version = true ? "1.24.0" : "0.0.0";
   const auth = loadAuth();
   if (!auth) {
     throw new CliError("Not logged in. Run `apes login` first.", 1);
@@ -7382,10 +7404,10 @@ if (shellRewrite) {
   if (shellRewrite.action === "rewrite") {
     process.argv = shellRewrite.argv;
   } else if (shellRewrite.action === "version") {
-    console.log(`ape-shell ${"1.22.2"} (OpenApe DDISA shell wrapper)`);
+    console.log(`ape-shell ${"1.24.0"} (OpenApe DDISA shell wrapper)`);
     process.exit(0);
   } else if (shellRewrite.action === "help") {
-    console.log(`ape-shell ${"1.22.2"} \u2014 OpenApe DDISA shell wrapper`);
+    console.log(`ape-shell ${"1.24.0"} \u2014 OpenApe DDISA shell wrapper`);
     console.log("");
     console.log("Usage:");
     console.log("  ape-shell                 Start interactive grant-mediated REPL");
@@ -7443,7 +7465,7 @@ var configCommand = defineCommand60({
 var main = defineCommand60({
   meta: {
     name: "apes",
-    version: "1.22.2",
+    version: "1.24.0",
     description: "Unified CLI for OpenApe"
   },
   subCommands: {
@@ -7500,7 +7522,7 @@ async function maybeRefreshAuth() {
   }
 }
 await maybeRefreshAuth();
-await maybeWarnStaleVersion("1.22.2").catch(() => {
+await maybeWarnStaleVersion("1.24.0").catch(() => {
 });
 runMain(main).catch((err) => {
   if (err instanceof CliExit) {