@openape/apes 1.28.0 → 1.28.2

package/dist/cli.js

@@ -1805,7 +1805,12 @@ var TroopClient = class {
         hostname: input.hostname,
         host_id: input.hostId,
         owner_email: input.ownerEmail,
-        ...input.pubkeySsh ? { pubkey_ssh: input.pubkeySsh } : {}
+        ...input.pubkeySsh ? { pubkey_ssh: input.pubkeySsh } : {},
+        // Without this the agent's encryption pubkey never reaches troop,
+        // so every sealed-capability bind 409s ("no X25519 public key
+        // yet"). The keypair is written at spawn (agent-bootstrap); we
+        // just have to report the public half here.
+        ...input.pubkeyX25519 ? { pubkey_x25519: input.pubkeyX25519 } : {}
       })
     });
   }
@@ -1845,10 +1850,22 @@ function parseKeyValues(pairs) {
 function missingCapabilities(required, provided) {
   return required.filter((env) => !(env in provided));
 }
-function asArray(v) {
-  if (Array.isArray(v)) return v;
-  if (typeof v === "string" && v.length > 0) return [v];
-  return [];
+function collectFlag(rawArgs, name) {
+  const out = [];
+  const long = `--${name}`;
+  for (let i = 0; i < rawArgs.length; i++) {
+    const a = rawArgs[i];
+    if (a === long) {
+      const v = rawArgs[i + 1];
+      if (v !== void 0 && !v.startsWith("--")) {
+        out.push(v);
+        i++;
+      }
+    } else if (a.startsWith(`${long}=`)) {
+      out.push(a.slice(long.length + 1));
+    }
+  }
+  return out;
 }
 async function api(url, token, init) {
   const res = await fetch(url, {
@@ -1871,11 +1888,11 @@ var deployAgentCommand = defineCommand20({
     "host-id": { type: "string", description: "Target nest host_id (default: first connected)" },
     json: { type: "boolean", description: "Machine-readable output, no prompts" }
   },
-  async run({ args }) {
+  async run({ args, rawArgs }) {
     const repoRef = args.repo;
     if (!repoRef) throw new CliError("usage: apes agent deploy <repo>@<ref> [--param k=v] [--secret ENV=val]");
-    const params = parseKeyValues(asArray(args.param));
-    const secrets = parseKeyValues(asArray(args.secret));
+    const params = parseKeyValues(collectFlag(rawArgs, "param"));
+    const secrets = parseKeyValues(collectFlag(rawArgs, "secret"));
     const json = !!args.json;
     const token = (await ensureFreshIdpAuth()).access_token;
     const troop = resolveTroopUrl();
@@ -1902,7 +1919,7 @@ var deployAgentCommand = defineCommand20({
         secrets[env] = val;
       }
     }
-    if (deploy.required_capabilities.length > 0) {
+    if (Object.keys(secrets).length > 0) {
       if (!json) consola18.start("Waiting for the agent to come online\u2026");
       let online = false;
       for (let i = 0; i < 90 && !online; i++) {
@@ -3541,6 +3558,7 @@ import { openString } from "@openape/core";
 var CONFIG_DIR2 = join5(homedir6(), ".config", "openape");
 var SECRETS_DIR = join5(CONFIG_DIR2, "secrets.d");
 var X25519_KEY_PATH = join5(CONFIG_DIR2, "agent-x25519.key");
+var X25519_PUBKEY_PATH = `${X25519_KEY_PATH}.pub`;
 function envNameFromFile(file) {
   if (!file.endsWith(".blob")) return null;
   const env = file.slice(0, -".blob".length);
@@ -3551,6 +3569,11 @@ function readAgentEncryptionKey(keyPath = X25519_KEY_PATH) {
   const k = readFileSync6(keyPath, "utf8").trim();
   return k.length > 0 ? k : null;
 }
+function readAgentEncryptionPublicKey(pubPath = X25519_PUBKEY_PATH) {
+  if (!existsSync7(pubPath)) return null;
+  const k = readFileSync6(pubPath, "utf8").trim();
+  return k.length > 0 ? k : null;
+}
 function materializeSecrets(opts = {}) {
   const dir = opts.dir ?? SECRETS_DIR;
   const env = opts.env ?? process.env;
@@ -4478,12 +4501,15 @@ var syncAgentCommand = defineCommand31({
       throw new CliError(`${AUTH_PATH3} is missing owner_email \u2014 re-run \`apes agents spawn\` to update.`);
     }
     consola27.start(`Syncing ${agentName} (${host}, hostId ${hostId.slice(0, 8)}\u2026) with ${troopUrl}`);
+    const pubkeyX25519 = readAgentEncryptionPublicKey() ?? void 0;
     const sync = await client.sync({
       hostname: host,
       hostId,
-      ownerEmail: auth.owner_email
+      ownerEmail: auth.owner_email,
+      ...pubkeyX25519 ? { pubkeyX25519 } : {}
     });
     consola27.info(sync.first_sync ? "\u2713 first sync \u2014 agent registered" : "\u2713 presence updated");
+    if (!pubkeyX25519) consola27.warn("No X25519 public key found on disk \u2014 sealed capability secrets cannot be bound until the agent is re-spawned.");
     const { system_prompt: systemPrompt, tools, skills, tasks } = await client.listTasks();
     consola27.info(`Pulled ${tasks.length} task${tasks.length === 1 ? "" : "s"}`);
     consola27.info(`Tools enabled: ${tools.length === 0 ? "(none)" : tools.join(", ")}`);
@@ -6690,7 +6716,7 @@ var mcpCommand = defineCommand52({
     if (transport !== "stdio" && transport !== "sse") {
       throw new Error('Transport must be "stdio" or "sse"');
     }
-    const { startMcpServer } = await import("./server-UKHYMZ7X.js");
+    const { startMcpServer } = await import("./server-WOOJEA67.js");
     await startMcpServer(transport, port);
   }
 });
@@ -7328,7 +7354,7 @@ async function bestEffortGrantCount(idp) {
   }
 }
 async function runHealth(args) {
-  const version = true ? "1.28.0" : "0.0.0";
+  const version = true ? "1.28.2" : "0.0.0";
   const auth = loadAuth();
   if (!auth) {
     throw new CliError("Not logged in. Run `apes login` first.", 1);
@@ -7601,10 +7627,10 @@ if (shellRewrite) {
   if (shellRewrite.action === "rewrite") {
     process.argv = shellRewrite.argv;
   } else if (shellRewrite.action === "version") {
-    console.log(`ape-shell ${"1.28.0"} (OpenApe DDISA shell wrapper)`);
+    console.log(`ape-shell ${"1.28.2"} (OpenApe DDISA shell wrapper)`);
     process.exit(0);
   } else if (shellRewrite.action === "help") {
-    console.log(`ape-shell ${"1.28.0"} \u2014 OpenApe DDISA shell wrapper`);
+    console.log(`ape-shell ${"1.28.2"} \u2014 OpenApe DDISA shell wrapper`);
     console.log("");
     console.log("Usage:");
     console.log("  ape-shell                 Start interactive grant-mediated REPL");
@@ -7662,7 +7688,7 @@ var configCommand = defineCommand64({
 var main = defineCommand64({
   meta: {
     name: "apes",
-    version: "1.28.0",
+    version: "1.28.2",
     description: "Unified CLI for OpenApe"
   },
   subCommands: {
@@ -7720,7 +7746,7 @@ async function maybeRefreshAuth() {
   }
 }
 await maybeRefreshAuth();
-await maybeWarnStaleVersion("1.28.0").catch(() => {
+await maybeWarnStaleVersion("1.28.2").catch(() => {
 });
 runMain(main).catch((err) => {
   if (err instanceof CliExit) {