@openape/apes 1.6.0 → 1.6.1

package/dist/cli.js

@@ -4009,12 +4009,19 @@ var enrollNestCommand = defineCommand29({
 
 // src/commands/nest/authorize.ts
 var DEFAULT_ALLOW_PATTERNS = [
-  // Agent lifecycle ops the nest issues against `apes run --as root`
+  // Outer spawn-grant — what the nest's HTTP handler invokes.
   "apes agents spawn *",
   "apes agents destroy *",
   "apes agents sync",
-  // Bridge invocation the supervisor uses to keep agent processes
-  // running. Pattern is intentionally precise — not a generic
+  // Inner setup.sh-grant — `apes agents spawn` itself shells out to
+  // `apes run --as root --wait -- bash <tempdir>/setup.sh` to do the
+  // dscl/launchctl/heredoc-write work. Path looks like
+  // `bash /var/folders/.../apes-spawn-<name>-XXXX/setup.sh`. The narrow
+  // glob below limits the auto-approval to that exact lifecycle path
+  // — `bash *` would be unsafe.
+  "bash *apes-spawn-*setup.sh",
+  // Bridge invocation the nest's process supervisor uses (Stage 1
+  // supervisor work). Intentionally precise — not a generic
   // `apes run --as *` wildcard — so a compromised nest can't pivot
   // to running arbitrary commands as arbitrary users.
   "apes run --as * -- openape-chat-bridge"
@@ -5644,7 +5651,7 @@ var mcpCommand = defineCommand42({
     if (transport !== "stdio" && transport !== "sse") {
       throw new Error('Transport must be "stdio" or "sse"');
     }
-    const { startMcpServer } = await import("./server-PHANS7PS.js");
+    const { startMcpServer } = await import("./server-UKQ5QFOZ.js");
     await startMcpServer(transport, port);
   }
 });
@@ -6282,7 +6289,7 @@ async function bestEffortGrantCount(idp) {
   }
 }
 async function runHealth(args) {
-  const version = true ? "1.6.0" : "0.0.0";
+  const version = true ? "1.6.1" : "0.0.0";
   const auth = loadAuth();
   if (!auth) {
     throw new CliError("Not logged in. Run `apes login` first.", 1);
@@ -6555,10 +6562,10 @@ if (shellRewrite) {
   if (shellRewrite.action === "rewrite") {
     process.argv = shellRewrite.argv;
   } else if (shellRewrite.action === "version") {
-    console.log(`ape-shell ${"1.6.0"} (OpenApe DDISA shell wrapper)`);
+    console.log(`ape-shell ${"1.6.1"} (OpenApe DDISA shell wrapper)`);
     process.exit(0);
   } else if (shellRewrite.action === "help") {
-    console.log(`ape-shell ${"1.6.0"} \u2014 OpenApe DDISA shell wrapper`);
+    console.log(`ape-shell ${"1.6.1"} \u2014 OpenApe DDISA shell wrapper`);
     console.log("");
     console.log("Usage:");
     console.log("  ape-shell                 Start interactive grant-mediated REPL");
@@ -6616,7 +6623,7 @@ var configCommand = defineCommand54({
 var main = defineCommand54({
   meta: {
     name: "apes",
-    version: "1.6.0",
+    version: "1.6.1",
     description: "Unified CLI for OpenApe"
   },
   subCommands: {
@@ -6672,7 +6679,7 @@ async function maybeRefreshAuth() {
   }
 }
 await maybeRefreshAuth();
-await maybeWarnStaleVersion("1.6.0").catch(() => {
+await maybeWarnStaleVersion("1.6.1").catch(() => {
 });
 runMain(main).catch((err) => {
   if (err instanceof CliExit) {