@openape/apes 1.9.0 → 1.11.0

package/dist/cli.js

@@ -7,8 +7,11 @@ import {
 import {
   CliError,
   CliExit,
-  parseDuration
-} from "./chunk-ZSJU7IXE.js";
+  RpcSessionMap,
+  parseDuration,
+  runLoop,
+  taskTools
+} from "./chunk-TDSCDH5P.js";
 import {
   loadEd25519PrivateKey,
   readPublicKeyComment
@@ -317,7 +320,7 @@ async function loginWithPKCE(idp) {
   authUrl.searchParams.set("state", state);
   authUrl.searchParams.set("nonce", nonce);
   authUrl.searchParams.set("scope", "openid email profile offline_access");
-  const code = await new Promise((resolve5, reject) => {
+  const code = await new Promise((resolve4, reject) => {
     const server = createServer((req, res) => {
       const url = new URL(req.url, `http://localhost:${CALLBACK_PORT}`);
       if (url.pathname === "/callback") {
@@ -334,7 +337,7 @@ async function loginWithPKCE(idp) {
           res.writeHead(200, { "Content-Type": "text/html" });
           res.end("<h1>Login successful!</h1><p>You can close this window.</p>");
           server.close();
-          resolve5(authCode);
+          resolve4(authCode);
           return;
         }
         res.writeHead(400);
@@ -390,7 +393,7 @@ async function loginWithPKCE(idp) {
   consola2.success(`Logged in as ${payload.email || payload.sub}`);
 }
 async function loginWithKey(idp, keyPath, agentEmail) {
-  const { readFileSync: readFileSync15 } = await import("fs");
+  const { readFileSync: readFileSync14 } = await import("fs");
   const { sign: sign3 } = await import("crypto");
   const { loadEd25519PrivateKey: loadEd25519PrivateKey2 } = await import("./ssh-key-6X3YZXSD.js");
   const challengeUrl = await getAgentChallengeEndpoint(idp);
@@ -403,7 +406,7 @@ async function loginWithKey(idp, keyPath, agentEmail) {
     throw new CliError(`Challenge failed: ${await challengeResp.text()}`);
   }
   const { challenge } = await challengeResp.json();
-  const keyContent = readFileSync15(keyPath, "utf-8");
+  const keyContent = readFileSync14(keyPath, "utf-8");
   const privateKey = loadEd25519PrivateKey2(keyContent);
   const signature = sign3(null, Buffer2.from(challenge), privateKey).toString("base64");
   const authenticateUrl = await getAgentAuthenticateEndpoint(idp);
@@ -895,7 +898,7 @@ async function waitForApproval2(grantsUrl, grantId) {
     if (grant.status === "revoked") {
       throw new CliError("Grant revoked.");
     }
-    await new Promise((resolve5) => setTimeout(resolve5, interval));
+    await new Promise((resolve4) => setTimeout(resolve4, interval));
   }
   throw new CliError("Timed out waiting for approval.");
 }
@@ -2262,7 +2265,7 @@ function createFetch(globalOptions = {}) {
       if (retries > 0 && (Array.isArray(context.options.retryStatusCodes) ? context.options.retryStatusCodes.includes(responseCode) : retryStatusCodes.has(responseCode))) {
         const retryDelay = typeof context.options.retryDelay === "function" ? context.options.retryDelay(context) : context.options.retryDelay || 0;
         if (retryDelay > 0) {
-          await new Promise((resolve5) => setTimeout(resolve5, retryDelay));
+          await new Promise((resolve4) => setTimeout(resolve4, retryDelay));
         }
         return $fetchRaw(context.request, {
           ...context.options,
@@ -2702,23 +2705,9 @@ chown root:wheel ${shQuote(bridge.plistPath)}
 chmod 644 ${shQuote(bridge.plistPath)}
 `;
 }
-function buildBridgeBootstrapBlock(bridge, name) {
+function buildBridgeBootstrapBlock(bridge, _name) {
   if (!bridge) return "";
   return `
-echo "==> Installing bridge stack as ${name} via bun (one-time)\u2026"
-su - ${shQuote(name)} -c '
-set -euo pipefail
-if ! command -v bun >/dev/null 2>&1 && [ ! -x "$HOME/.bun/bin/bun" ]; then
-  echo "==> bun not found \u2014 installing via official installer"
-  curl -fsSL https://bun.sh/install | bash
-fi
-export PATH="$HOME/.bun/bin:/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:$HOME/.bun/install/global/bin"
-bun add -g @openape/chat-bridge @openape/apes
-'
-
-# Bootstrap into the system domain. Spawn already runs as root via
-# \`apes run --as root\`, so we have permission. Stale label is bootouted
-# first to make re-spawn idempotent.
 launchctl bootout "system/${bridge.plistLabel}" 2>/dev/null || true
 launchctl bootstrap system ${shQuote(bridge.plistPath)} || \\
   echo "warn: bridge bootstrap into system domain failed; check ${bridge.plistPath}"
@@ -3006,7 +2995,7 @@ function readPasswordSilent(prompt) {
       "No TTY available for the silent password prompt. Set APES_ADMIN_PASSWORD in the environment instead."
     ));
   }
-  return new Promise((resolve5, reject) => {
+  return new Promise((resolve4, reject) => {
     process.stdout.write(prompt);
     const wasRaw = process.stdin.isRaw ?? false;
     process.stdin.setRawMode(true);
@@ -3021,7 +3010,7 @@ function readPasswordSilent(prompt) {
         if (ch === "\r" || ch === "\n") {
           cleanup();
           process.stdout.write("\n");
-          resolve5(buf);
+          resolve4(buf);
           return;
         }
         if (code === 3) {
@@ -3317,481 +3306,12 @@ var registerAgentCommand = defineCommand23({
 });
 
 // src/commands/agents/run.ts
-import { existsSync as existsSync5, readFileSync as readFileSync5 } from "fs";
-import { homedir as homedir5 } from "os";
+import { existsSync as existsSync5, readFileSync as readFileSync4 } from "fs";
+import { homedir as homedir4 } from "os";
 import { join as join3 } from "path";
 import { defineCommand as defineCommand24 } from "citty";
 import consola22 from "consola";
 
-// src/lib/agent-tools/file.ts
-import { mkdirSync, readFileSync as readFileSync4, writeFileSync as writeFileSync2 } from "fs";
-import { homedir as homedir4 } from "os";
-import { dirname, normalize, resolve as resolve2 } from "path";
-var MAX_BYTES = 1024 * 1024;
-function jailPath(input) {
-  if (typeof input !== "string" || input === "") {
-    throw new Error("path must be a non-empty string");
-  }
-  const home = homedir4();
-  const candidate = input.startsWith("~/") ? resolve2(home, input.slice(2)) : input.startsWith("/") ? normalize(input) : resolve2(home, input);
-  if (candidate !== home && !candidate.startsWith(`${home}/`)) {
-    throw new Error(`path "${input}" resolves outside the agent's home`);
-  }
-  return candidate;
-}
-var fileTools = [
-  {
-    name: "file.read",
-    description: "Read a UTF-8 file from the agent's home directory ($HOME). Capped at 1MB. Path traversal blocked.",
-    parameters: {
-      type: "object",
-      properties: {
-        path: { type: "string", description: "Path relative to $HOME (or absolute under $HOME). `..` segments are rejected." }
-      },
-      required: ["path"]
-    },
-    execute: async (args) => {
-      const a = args;
-      const p2 = jailPath(a.path);
-      const content = readFileSync4(p2, "utf8");
-      if (Buffer.byteLength(content, "utf8") > MAX_BYTES) {
-        return { path: p2, truncated: true, content: content.slice(0, MAX_BYTES) };
-      }
-      return { path: p2, truncated: false, content };
-    }
-  },
-  {
-    name: "file.write",
-    description: "Write a UTF-8 file under the agent's home directory. Creates parent dirs as needed. 1MB max.",
-    parameters: {
-      type: "object",
-      properties: {
-        path: { type: "string", description: "Path relative to $HOME (or absolute under $HOME)." },
-        content: { type: "string", description: "File body. Existing files are overwritten." }
-      },
-      required: ["path", "content"]
-    },
-    execute: async (args) => {
-      const a = args;
-      if (typeof a.content !== "string") throw new Error("content must be a string");
-      if (Buffer.byteLength(a.content, "utf8") > MAX_BYTES) {
-        throw new Error(`content exceeds ${MAX_BYTES} byte cap`);
-      }
-      const p2 = jailPath(a.path);
-      mkdirSync(dirname(p2), { recursive: true });
-      writeFileSync2(p2, a.content, { encoding: "utf8" });
-      return { path: p2, bytes: Buffer.byteLength(a.content, "utf8") };
-    }
-  }
-];
-
-// src/lib/agent-tools/http.ts
-var MAX_BYTES2 = 1024 * 1024;
-var FORBIDDEN_HEADERS = /* @__PURE__ */ new Set([
-  "host",
-  "authorization",
-  "cookie",
-  "connection",
-  "transfer-encoding",
-  "upgrade",
-  "proxy-authorization"
-]);
-function sanitizeHeaders(input) {
-  if (!input || typeof input !== "object") return {};
-  const out = {};
-  for (const [k, v] of Object.entries(input)) {
-    if (typeof v !== "string") continue;
-    if (FORBIDDEN_HEADERS.has(k.toLowerCase())) continue;
-    out[k] = v;
-  }
-  return out;
-}
-async function readCappedBody(res) {
-  const buf = new Uint8Array(MAX_BYTES2 + 1);
-  let written = 0;
-  const reader = res.body?.getReader();
-  if (!reader) return await res.text();
-  while (true) {
-    const { value, done } = await reader.read();
-    if (done) break;
-    if (written + value.byteLength > MAX_BYTES2) {
-      buf.set(value.subarray(0, MAX_BYTES2 - written), written);
-      written = MAX_BYTES2;
-      try {
-        await reader.cancel();
-      } catch {
-      }
-      break;
-    }
-    buf.set(value, written);
-    written += value.byteLength;
-  }
-  return new TextDecoder().decode(buf.subarray(0, written));
-}
-var httpTools = [
-  {
-    name: "http.get",
-    description: "GET an HTTPS URL and return the response body (capped at 1MB). Useful for reading public APIs, RSS feeds, web pages.",
-    parameters: {
-      type: "object",
-      properties: {
-        url: { type: "string", description: "Absolute HTTPS URL." },
-        headers: { type: "object", description: "Optional headers (Host, Authorization, Cookie are stripped)." }
-      },
-      required: ["url"]
-    },
-    execute: async (args) => {
-      const a = args;
-      if (typeof a.url !== "string" || !a.url.startsWith("http")) {
-        throw new Error("url must be an http(s) URL");
-      }
-      const res = await fetch(a.url, { method: "GET", headers: sanitizeHeaders(a.headers) });
-      const body = await readCappedBody(res);
-      return { status: res.status, headers: Object.fromEntries(res.headers), body };
-    }
-  },
-  {
-    name: "http.post",
-    description: "POST JSON to an HTTPS URL and return the response body (capped at 1MB).",
-    parameters: {
-      type: "object",
-      properties: {
-        url: { type: "string", description: "Absolute HTTPS URL." },
-        body: { description: "JSON-serialisable payload." },
-        headers: { type: "object", description: "Optional headers (Host, Authorization, Cookie are stripped)." }
-      },
-      required: ["url", "body"]
-    },
-    execute: async (args) => {
-      const a = args;
-      if (typeof a.url !== "string" || !a.url.startsWith("http")) {
-        throw new Error("url must be an http(s) URL");
-      }
-      const res = await fetch(a.url, {
-        method: "POST",
-        headers: { "content-type": "application/json", ...sanitizeHeaders(a.headers) },
-        body: JSON.stringify(a.body)
-      });
-      const body = await readCappedBody(res);
-      return { status: res.status, headers: Object.fromEntries(res.headers), body };
-    }
-  }
-];
-
-// src/lib/agent-tools/mail.ts
-import { execFileSync as execFileSync5 } from "child_process";
-function o365(args) {
-  try {
-    return execFileSync5("o365-cli", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
-  } catch (err) {
-    const e = err;
-    if (e.code === "ENOENT") {
-      throw new Error("o365-cli is not installed on this agent host");
-    }
-    const stderr = typeof e.stderr === "string" ? e.stderr : e.stderr?.toString("utf8");
-    throw new Error(`o365-cli failed: ${stderr ?? e.message ?? err}`);
-  }
-}
-var mailTools = [
-  {
-    name: "mail.list",
-    description: "List recent inbox messages via o365-cli. Optional `unread_only` and `limit`.",
-    parameters: {
-      type: "object",
-      properties: {
-        limit: { type: "integer", minimum: 1, maximum: 100, default: 20 },
-        unread_only: { type: "boolean", default: false }
-      },
-      required: []
-    },
-    execute: async (args) => {
-      const a = args ?? {};
-      const argv = ["mail", "list", "--json", "--limit", String(a.limit ?? 20)];
-      if (a.unread_only) argv.push("--unread");
-      const out = o365(argv);
-      try {
-        return JSON.parse(out);
-      } catch {
-        return { raw: out };
-      }
-    }
-  },
-  {
-    name: "mail.search",
-    description: "Search the inbox via o365-cli using a free-form query string.",
-    parameters: {
-      type: "object",
-      properties: {
-        q: { type: "string" },
-        limit: { type: "integer", minimum: 1, maximum: 100, default: 20 }
-      },
-      required: ["q"]
-    },
-    execute: async (args) => {
-      const a = args;
-      if (typeof a.q !== "string" || a.q.length === 0) throw new Error("q is required");
-      const argv = ["mail", "search", a.q, "--json", "--limit", String(a.limit ?? 20)];
-      const out = o365(argv);
-      try {
-        return JSON.parse(out);
-      } catch {
-        return { raw: out };
-      }
-    }
-  }
-];
-
-// src/lib/agent-tools/tasks.ts
-import { execFileSync as execFileSync6 } from "child_process";
-function ape(args) {
-  try {
-    return execFileSync6("ape-tasks", args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
-  } catch (err) {
-    const e = err;
-    const stderr = typeof e.stderr === "string" ? e.stderr : e.stderr?.toString("utf8");
-    throw new Error(`ape-tasks failed: ${stderr ?? e.message ?? err}`);
-  }
-}
-var tasksTools = [
-  {
-    name: "tasks.list",
-    description: "List the owner's open ape-tasks (the user's personal task list at tasks.openape.ai).",
-    parameters: {
-      type: "object",
-      properties: {
-        status: { type: "string", enum: ["open", "doing", "done", "archived"] },
-        team_id: { type: "string" }
-      },
-      required: []
-    },
-    execute: async (args) => {
-      const a = args ?? {};
-      const argv = ["list", "--json"];
-      if (a.status) argv.push("--status", a.status);
-      if (a.team_id) argv.push("--team", a.team_id);
-      const out = ape(argv);
-      try {
-        return JSON.parse(out);
-      } catch {
-        return { raw: out };
-      }
-    }
-  },
-  {
-    name: "tasks.create",
-    description: "Create a new ape-task on the owner's task list at tasks.openape.ai.",
-    parameters: {
-      type: "object",
-      properties: {
-        title: { type: "string" },
-        notes: { type: "string" },
-        priority: { type: "string", enum: ["low", "med", "high"] },
-        due_at: { type: "string", description: "ISO date or +Nh/+Nd shorthand." }
-      },
-      required: ["title"]
-    },
-    execute: async (args) => {
-      const a = args;
-      const argv = ["new", "--title", a.title, "--json"];
-      if (a.notes) argv.push("--notes", a.notes);
-      if (a.priority) argv.push("--priority", a.priority);
-      if (a.due_at) argv.push("--due", a.due_at);
-      const out = ape(argv);
-      try {
-        return JSON.parse(out);
-      } catch {
-        return { raw: out };
-      }
-    }
-  }
-];
-
-// src/lib/agent-tools/time.ts
-var timeTools = [
-  {
-    name: "time.now",
-    description: "Returns the current UTC date and time as ISO 8601 plus epoch seconds. No inputs.",
-    parameters: { type: "object", properties: {}, required: [] },
-    execute: async () => {
-      const now = /* @__PURE__ */ new Date();
-      return {
-        iso: now.toISOString(),
-        epoch_seconds: Math.floor(now.getTime() / 1e3),
-        timezone_offset_minutes: -now.getTimezoneOffset()
-      };
-    }
-  }
-];
-
-// src/lib/agent-tools/index.ts
-var ALL_TOOLS = [
-  ...timeTools,
-  ...httpTools,
-  ...fileTools,
-  ...tasksTools,
-  ...mailTools
-];
-var TOOLS = Object.fromEntries(
-  ALL_TOOLS.map((t) => [t.name, t])
-);
-function taskTools(names) {
-  const out = [];
-  const missing = [];
-  for (const name of names) {
-    const tool = TOOLS[name];
-    if (!tool) missing.push(name);
-    else out.push(tool);
-  }
-  if (missing.length > 0) {
-    throw new Error(`unknown tool(s): ${missing.join(", ")}`);
-  }
-  return out;
-}
-function asOpenAiTools(tools) {
-  return tools.map((t) => ({
-    type: "function",
-    function: { name: wireToolName(t.name), description: t.description, parameters: t.parameters }
-  }));
-}
-function wireToolName(local) {
-  return local.replace(/\./g, "_");
-}
-function localToolName(wire) {
-  for (const t of Object.values(TOOLS)) {
-    if (wireToolName(t.name) === wire) return t.name;
-  }
-  return wire;
-}
-
-// src/lib/agent-runtime.ts
-function previewJson(value, max = 500) {
-  let s;
-  try {
-    s = JSON.stringify(value);
-  } catch {
-    s = String(value);
-  }
-  return s.length > max ? `${s.slice(0, max)}\u2026` : s;
-}
-async function runLoop(opts) {
-  const fetchFn = opts.fetchImpl ?? fetch;
-  const trace = [];
-  const messages = [
-    { role: "system", content: opts.systemPrompt },
-    ...opts.history ?? [],
-    { role: "user", content: opts.userMessage }
-  ];
-  const tools = asOpenAiTools(opts.tools);
-  for (let step = 1; step <= opts.maxSteps; step++) {
-    const res = await fetchFn(`${opts.config.apiBase}/chat/completions`, {
-      method: "POST",
-      headers: {
-        "authorization": `Bearer ${opts.config.apiKey}`,
-        "content-type": "application/json"
-      },
-      body: JSON.stringify({
-        model: opts.config.model,
-        messages,
-        ...tools.length > 0 ? { tools, tool_choice: "auto" } : {}
-      })
-    });
-    if (!res.ok) {
-      const text = await res.text().catch(() => "");
-      throw new Error(`LiteLLM ${res.status}: ${text.slice(0, 500)}`);
-    }
-    const data = await res.json();
-    const choice = data.choices?.[0];
-    if (!choice) throw new Error("LiteLLM response had no choices");
-    const assistant = choice.message;
-    messages.push(assistant);
-    if (assistant.content) opts.handlers?.onTextDelta?.(assistant.content);
-    trace.push({
-      step,
-      type: "assistant",
-      preview: previewJson({ content: assistant.content, tool_calls: assistant.tool_calls?.length ?? 0 })
-    });
-    if (!assistant.tool_calls || assistant.tool_calls.length === 0) {
-      const result2 = {
-        status: "ok",
-        finalMessage: assistant.content,
-        stepCount: step,
-        trace
-      };
-      opts.handlers?.onDone?.(result2);
-      return result2;
-    }
-    for (const call of assistant.tool_calls) {
-      const wireName = call.function.name;
-      const localName = localToolName(wireName);
-      const tool = opts.tools.find((t) => t.name === localName);
-      let parsedArgs;
-      try {
-        parsedArgs = JSON.parse(call.function.arguments);
-      } catch {
-        parsedArgs = {};
-      }
-      opts.handlers?.onToolCall?.({ name: localName, args: parsedArgs });
-      trace.push({ step, type: "tool_call", tool: localName, preview: previewJson(parsedArgs) });
-      let result2;
-      let isError = false;
-      if (!tool) {
-        result2 = `unknown tool: ${localName}`;
-        isError = true;
-      } else {
-        try {
-          result2 = await tool.execute(parsedArgs);
-        } catch (err) {
-          result2 = err?.message ?? String(err);
-          isError = true;
-        }
-      }
-      if (isError) {
-        opts.handlers?.onToolError?.({ name: localName, error: String(result2) });
-        trace.push({ step, type: "tool_error", tool: localName, preview: previewJson(result2) });
-      } else {
-        opts.handlers?.onToolResult?.({ name: localName, result: result2 });
-        trace.push({ step, type: "tool_result", tool: localName, preview: previewJson(result2) });
-      }
-      messages.push({
-        role: "tool",
-        tool_call_id: call.id,
-        name: wireToolName(localName),
-        content: typeof result2 === "string" ? result2 : JSON.stringify(result2)
-      });
-    }
-  }
-  const result = {
-    status: "error",
-    finalMessage: `max_steps (${opts.maxSteps}) reached without completion`,
-    stepCount: opts.maxSteps,
-    trace
-  };
-  opts.handlers?.onDone?.(result);
-  return result;
-}
-var RPC_SESSION_TTL_MS = 60 * 60 * 1e3;
-var RpcSessionMap = class {
-  sessions = /* @__PURE__ */ new Map();
-  get(id) {
-    const s = this.sessions.get(id);
-    if (s) s.lastTouched = Date.now();
-    return s;
-  }
-  put(id, s) {
-    s.lastTouched = Date.now();
-    this.sessions.set(id, s);
-  }
-  evictStale() {
-    const cutoff = Date.now() - RPC_SESSION_TTL_MS;
-    for (const [k, v] of this.sessions) {
-      if (v.lastTouched < cutoff) this.sessions.delete(k);
-    }
-  }
-  size() {
-    return this.sessions.size;
-  }
-};
-
 // src/lib/troop-client.ts
 var DEFAULT_TROOP_URL = "https://troop.openape.ai";
 var TroopClient = class {
@@ -3850,13 +3370,13 @@ function resolveTroopUrl(override) {
 }
 
 // src/commands/agents/run.ts
-var AUTH_PATH = join3(homedir5(), ".config", "apes", "auth.json");
-var TASK_CACHE_DIR = join3(homedir5(), ".openape", "agent", "tasks");
+var AUTH_PATH = join3(homedir4(), ".config", "apes", "auth.json");
+var TASK_CACHE_DIR = join3(homedir4(), ".openape", "agent", "tasks");
 function readAuth() {
   if (!existsSync5(AUTH_PATH)) {
     throw new CliError(`No agent auth found at ${AUTH_PATH}. Run \`apes agents spawn <name>\` first.`);
   }
-  const parsed = JSON.parse(readFileSync5(AUTH_PATH, "utf8"));
+  const parsed = JSON.parse(readFileSync4(AUTH_PATH, "utf8"));
   if (!parsed.access_token) throw new CliError("auth.json missing access_token");
   return parsed;
 }
@@ -3896,22 +3416,22 @@ function readTaskSpec(taskId) {
   if (!existsSync5(path2)) {
     throw new CliError(`No cached task spec at ${path2}. Run \`apes agents sync\` first to pull the task list from troop.`);
   }
-  return JSON.parse(readFileSync5(path2, "utf8"));
+  return JSON.parse(readFileSync4(path2, "utf8"));
 }
-var AGENT_CONFIG_PATH = join3(homedir5(), ".openape", "agent", "agent.json");
+var AGENT_CONFIG_PATH = join3(homedir4(), ".openape", "agent", "agent.json");
 function readAgentConfig() {
   if (!existsSync5(AGENT_CONFIG_PATH)) return { systemPrompt: "" };
   try {
-    return JSON.parse(readFileSync5(AGENT_CONFIG_PATH, "utf8"));
+    return JSON.parse(readFileSync4(AGENT_CONFIG_PATH, "utf8"));
   } catch {
     return { systemPrompt: "" };
   }
 }
 function readLitellmConfig(model) {
-  const envPath = join3(homedir5(), "litellm", ".env");
+  const envPath = join3(homedir4(), "litellm", ".env");
   const env = {};
   if (existsSync5(envPath)) {
-    for (const line of readFileSync5(envPath, "utf8").split(/\r?\n/)) {
+    for (const line of readFileSync4(envPath, "utf8").split(/\r?\n/)) {
       const m = line.match(/^([A-Z_]+)=(.*)$/);
       if (m) env[m[1]] = m[2].replace(/^["']|["']$/g, "");
     }
@@ -4016,17 +3536,17 @@ var runAgentCommand = defineCommand24({
 });
 
 // src/commands/agents/serve.ts
-import { existsSync as existsSync6, readFileSync as readFileSync6 } from "fs";
-import { homedir as homedir6 } from "os";
+import { existsSync as existsSync6, readFileSync as readFileSync5 } from "fs";
+import { homedir as homedir5 } from "os";
 import { join as join4 } from "path";
 import { createInterface } from "readline";
 import { defineCommand as defineCommand25 } from "citty";
-var AUTH_PATH2 = join4(homedir6(), ".config", "apes", "auth.json");
+var AUTH_PATH2 = join4(homedir5(), ".config", "apes", "auth.json");
 function readLitellmConfig2(model) {
-  const envPath = join4(homedir6(), "litellm", ".env");
+  const envPath = join4(homedir5(), "litellm", ".env");
   const env = {};
   if (existsSync6(envPath)) {
-    for (const line of readFileSync6(envPath, "utf8").split(/\r?\n/)) {
+    for (const line of readFileSync5(envPath, "utf8").split(/\r?\n/)) {
       const m = line.match(/^([A-Z_]+)=(.*)$/);
       if (m) env[m[1]] = m[2].replace(/^["']|["']$/g, "");
     }
@@ -4060,7 +3580,7 @@ var serveAgentCommand = defineCommand25({
     }
     if (existsSync6(AUTH_PATH2)) {
       try {
-        JSON.parse(readFileSync6(AUTH_PATH2, "utf8"));
+        JSON.parse(readFileSync5(AUTH_PATH2, "utf8"));
       } catch {
       }
     }
@@ -4135,8 +3655,8 @@ async function handleInbound(msg, sessions) {
 }
 
 // src/commands/agents/spawn.ts
-import { execFileSync as execFileSync7 } from "child_process";
-import { mkdtempSync as mkdtempSync2, rmSync as rmSync2, writeFileSync as writeFileSync4 } from "fs";
+import { execFileSync as execFileSync6 } from "child_process";
+import { mkdtempSync as mkdtempSync2, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
 import { tmpdir as tmpdir2 } from "os";
 import { join as join6 } from "path";
 import { defineCommand as defineCommand26 } from "citty";
@@ -4152,7 +3672,8 @@ function escape(s) {
   return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
 }
 function buildSyncPlist(input) {
-  const pathLine = `    <key>PATH</key><string>${escape(input.homeDir)}/.bun/bin:/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin</string>
+  const pathDirs = (input.hostBinDirs && input.hostBinDirs.length > 0 ? input.hostBinDirs : ["/opt/homebrew/bin", "/usr/local/bin"]).join(":");
+  const pathLine = `    <key>PATH</key><string>${escape(pathDirs)}:/usr/bin:/bin</string>
 `;
   const agentUserLine = `    <key>AGENT_USER</key><string>${escape(input.userName)}</string>
 `;
@@ -4195,12 +3716,12 @@ ${envBlock}  <key>StartInterval</key>
 
 // src/lib/keygen.ts
 import { Buffer as Buffer4 } from "buffer";
-import { existsSync as existsSync7, mkdirSync as mkdirSync2, readFileSync as readFileSync7, writeFileSync as writeFileSync3 } from "fs";
+import { existsSync as existsSync7, mkdirSync, readFileSync as readFileSync6, writeFileSync as writeFileSync2 } from "fs";
 import { generateKeyPairSync } from "crypto";
-import { homedir as homedir7 } from "os";
-import { dirname as dirname2, resolve as resolve3 } from "path";
+import { homedir as homedir6 } from "os";
+import { dirname, resolve as resolve2 } from "path";
 function resolveKeyPath(p2) {
-  return resolve3(p2.replace(/^~/, homedir7()));
+  return resolve2(p2.replace(/^~/, homedir6()));
 }
 function buildSshEd25519Line(rawPub) {
   const keyTypeStr = "ssh-ed25519";
@@ -4214,9 +3735,9 @@ function buildSshEd25519Line(rawPub) {
 function readPublicKey(keyPath) {
   const pubPath = `${keyPath}.pub`;
   if (existsSync7(pubPath)) {
-    return readFileSync7(pubPath, "utf-8").trim();
+    return readFileSync6(pubPath, "utf-8").trim();
   }
-  const keyContent = readFileSync7(keyPath, "utf-8");
+  const keyContent = readFileSync6(keyPath, "utf-8");
   const privateKey = loadEd25519PrivateKey(keyContent);
   const jwk = privateKey.export({ format: "jwk" });
   const pubBytes = Buffer4.from(jwk.x, "base64url");
@@ -4224,17 +3745,17 @@ function readPublicKey(keyPath) {
 }
 function generateAndSaveKey(keyPath) {
   const resolved = resolveKeyPath(keyPath);
-  const dir = dirname2(resolved);
+  const dir = dirname(resolved);
   if (!existsSync7(dir)) {
-    mkdirSync2(dir, { recursive: true });
+    mkdirSync(dir, { recursive: true });
   }
   const { publicKey, privateKey } = generateKeyPairSync("ed25519");
   const privatePem = privateKey.export({ type: "pkcs8", format: "pem" });
-  writeFileSync3(resolved, privatePem, { mode: 384 });
+  writeFileSync2(resolved, privatePem, { mode: 384 });
   const jwk = publicKey.export({ format: "jwk" });
   const pubBytes = Buffer4.from(jwk.x, "base64url");
   const pubKeyStr = buildSshEd25519Line(pubBytes);
-  writeFileSync3(`${resolved}.pub`, `${pubKeyStr}
+  writeFileSync2(`${resolved}.pub`, `${pubKeyStr}
 `, { mode: 420 });
   return pubKeyStr;
 }
@@ -4250,14 +3771,15 @@ function generateKeyPairInMemory() {
 }
 
 // src/lib/llm-bridge.ts
-import { existsSync as existsSync8, readFileSync as readFileSync8 } from "fs";
-import { homedir as homedir8 } from "os";
-import { join as join5 } from "path";
+import { execFileSync as execFileSync5 } from "child_process";
+import { existsSync as existsSync8, readFileSync as readFileSync7 } from "fs";
+import { homedir as homedir7 } from "os";
+import { dirname as dirname2, join as join5 } from "path";
 var PLIST_LABEL_PREFIX = "eco.hofmann.apes.bridge";
-function readLitellmEnv(envPath = join5(homedir8(), "litellm", ".env")) {
+function readLitellmEnv(envPath = join5(homedir7(), "litellm", ".env")) {
   if (!existsSync8(envPath)) return null;
   try {
-    const text = readFileSync8(envPath, "utf8");
+    const text = readFileSync7(envPath, "utf8");
     const out = {};
     for (const line of text.split("\n")) {
       const trimmed = line.trim();
@@ -4287,6 +3809,25 @@ function resolveBridgeConfig(opts) {
   }
   return { baseUrl, apiKey, model };
 }
+function captureHostBinDirs() {
+  const dirs = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const bin of ["node", "openape-chat-bridge", "apes"]) {
+    let resolved;
+    try {
+      resolved = execFileSync5("/usr/bin/which", [bin], { encoding: "utf8" }).trim();
+    } catch {
+      const installCmd = bin === "openape-chat-bridge" ? "npm i -g @openape/chat-bridge" : bin === "apes" ? "npm i -g @openape/apes" : "install Node.js (e.g. brew install node)";
+      throw new Error(`'${bin}' not found on host PATH. ${installCmd} before spawning agents \u2014 the bridge runtime resolves these at spawn time and bakes the dir into the agent's launchd plist.`);
+    }
+    const dir = dirname2(resolved);
+    if (!seen.has(dir)) {
+      seen.add(dir);
+      dirs.push(dir);
+    }
+  }
+  return dirs;
+}
 function bridgePlistLabel(agentName) {
   return `${PLIST_LABEL_PREFIX}.${agentName}`;
 }
@@ -4302,34 +3843,31 @@ LITELLM_BASE_URL=${cfg.baseUrl}
 LITELLM_API_KEY=${cfg.apiKey}
 ${modelLine}`;
 }
-function buildBridgeStartScript() {
+function buildBridgeStartScript(hostBinDirs) {
+  const pathLine = `export PATH="${hostBinDirs.join(":")}:/usr/bin:/bin"`;
   return `#!/usr/bin/env bash
 # Auto-generated by 'apes agents spawn --bridge'.
-# Slim launcher \u2014 install stack lives in spawn, not here.
+# Slim launcher \u2014 bridge stack lives on the host, no per-agent install.
 set -euo pipefail
 
-export PATH="$HOME/.bun/bin:/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin"
+${pathLine}
 
 # Token refresh is in-process via @openape/cli-auth's challenge-response
 # path (auth.json.key_path -> ~/.ssh/id_ed25519). No "apes login" needed
 # at boot \u2014 keeping start.sh slim avoids the rate-limit dance the old
 # refresh hit when KeepAlive crash-restarted the daemon every 1h.
 
-# M6 dropped the third-party LLM-runtime install + extension write
-# that used to live here. The bridge now spawns
-# \`apes agents serve --rpc\` directly (M8) which calls LiteLLM
-# itself, so no third-party extension config is needed.
-
 set -a
 . "$HOME/Library/Application Support/openape/bridge/.env"
 set +a
 exec openape-chat-bridge
 `;
 }
-function buildBridgePlist(agentName, homeDir, ownerEmail) {
+function buildBridgePlist(agentName, homeDir, ownerEmail, hostBinDirs) {
   const startScript = `${homeDir}/Library/Application Support/openape/bridge/start.sh`;
   const stdoutLog = `${homeDir}/Library/Logs/openape-chat-bridge.log`;
   const stderrLog = `${homeDir}/Library/Logs/openape-chat-bridge.err.log`;
+  const pathValue = `${hostBinDirs.join(":")}:/usr/bin:/bin`;
   return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
@@ -4360,7 +3898,7 @@ function buildBridgePlist(agentName, homeDir, ownerEmail) {
         <key>HOME</key>
         <string>${homeDir}</string>
         <key>PATH</key>
-        <string>${homeDir}/.bun/bin:/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin</string>
+        <string>${pathValue}</string>
         <key>OPENAPE_OWNER_EMAIL</key>
         <string>${ownerEmail}</string>
     </dict>
@@ -4498,20 +4036,22 @@ and try again.`
           cliBaseUrl: typeof args["bridge-base-url"] === "string" ? args["bridge-base-url"] : void 0,
           cliModel: typeof args["bridge-model"] === "string" ? args["bridge-model"] : void 0
         });
+        const hostBinDirs = captureHostBinDirs();
         return {
           plistLabel: bridgePlistLabel(name),
           plistPath: bridgePlistPath(name),
-          plistContent: buildBridgePlist(name, homeDir, auth.email),
-          startScript: buildBridgeStartScript(),
+          plistContent: buildBridgePlist(name, homeDir, auth.email, hostBinDirs),
+          startScript: buildBridgeStartScript(hostBinDirs),
           envFile: buildBridgeEnvFile(cfg)
         };
       })() : null;
       const troopPlistLabel = `openape.troop.sync.${name}`;
       const troopPlistPath = `/Library/LaunchDaemons/${troopPlistLabel}.plist`;
+      const troopBinDirs = bridge ? captureHostBinDirs() : captureHostBinDirs();
       const troop = {
         plistLabel: troopPlistLabel,
         plistPath: troopPlistPath,
-        plistContent: buildSyncPlist({ agentName: name, apesBin: apes, homeDir, userName: name })
+        plistContent: buildSyncPlist({ agentName: name, apesBin: apes, homeDir, userName: name, hostBinDirs: troopBinDirs })
       };
       const script = buildSpawnSetupScript({
         name,
@@ -4526,10 +4066,10 @@ and try again.`
         bridge,
         troop
       });
-      writeFileSync4(scriptPath, script, { mode: 448 });
+      writeFileSync3(scriptPath, script, { mode: 448 });
       consola23.start("Running privileged setup as root via `apes run --as root --wait`\u2026");
       consola23.info("You will be asked to approve the as=root grant in your DDISA inbox; this command blocks until you do.");
-      execFileSync7(apes, ["run", "--as", "root", "--wait", "--", "bash", scriptPath], { stdio: "inherit" });
+      execFileSync6(apes, ["run", "--as", "root", "--wait", "--", "bash", scriptPath], { stdio: "inherit" });
       consola23.success(`Agent ${name} spawned.`);
       consola23.info(`\u{1F517} Troop: https://troop.openape.ai/agents/${name}`);
       if (args.bridge) {
@@ -4568,18 +4108,18 @@ async function resolveClaudeToken(opts) {
 }
 
 // src/commands/agents/sync.ts
-import { chownSync, existsSync as existsSync9, mkdirSync as mkdirSync3, readFileSync as readFileSync9, statSync, writeFileSync as writeFileSync5 } from "fs";
-import { homedir as homedir9 } from "os";
+import { chownSync, existsSync as existsSync9, mkdirSync as mkdirSync2, readFileSync as readFileSync8, statSync, writeFileSync as writeFileSync4 } from "fs";
+import { homedir as homedir8 } from "os";
 import { join as join7 } from "path";
 import { defineCommand as defineCommand27 } from "citty";
 import consola24 from "consola";
 
 // src/lib/macos-host.ts
-import { execFileSync as execFileSync8 } from "child_process";
+import { execFileSync as execFileSync7 } from "child_process";
 import { hostname as hostname3 } from "os";
 function getHostId() {
   try {
-    const output = execFileSync8(
+    const output = execFileSync7(
       "/usr/sbin/ioreg",
       ["-d2", "-c", "IOPlatformExpertDevice"],
       { encoding: "utf8", timeout: 2e3 }
@@ -4599,15 +4139,15 @@ function getHostname() {
 }
 
 // src/commands/agents/sync.ts
-var AUTH_PATH3 = join7(homedir9(), ".config", "apes", "auth.json");
-var TASK_CACHE_DIR2 = join7(homedir9(), ".openape", "agent", "tasks");
+var AUTH_PATH3 = join7(homedir8(), ".config", "apes", "auth.json");
+var TASK_CACHE_DIR2 = join7(homedir8(), ".openape", "agent", "tasks");
 function readAuthJson() {
   if (!existsSync9(AUTH_PATH3)) {
     throw new CliError(
       `No agent auth found at ${AUTH_PATH3}. Run \`apes agents spawn <name>\` to provision an agent first.`
     );
   }
-  const raw = readFileSync9(AUTH_PATH3, "utf8");
+  const raw = readFileSync8(AUTH_PATH3, "utf8");
   let parsed;
   try {
     parsed = JSON.parse(raw);
@@ -4668,7 +4208,7 @@ var syncAgentCommand = defineCommand27({
     let agentGid = null;
     if (process.geteuid?.() === 0) {
       try {
-        const homeStat = statSync(homedir9());
+        const homeStat = statSync(homedir8());
         agentUid = homeStat.uid;
         agentGid = homeStat.gid;
       } catch {
@@ -4682,23 +4222,23 @@ var syncAgentCommand = defineCommand27({
         }
       }
     }
-    const agentDir = join7(homedir9(), ".openape", "agent");
-    mkdirSync3(agentDir, { recursive: true });
-    chownToAgent(join7(homedir9(), ".openape"));
+    const agentDir = join7(homedir8(), ".openape", "agent");
+    mkdirSync2(agentDir, { recursive: true });
+    chownToAgent(join7(homedir8(), ".openape"));
     chownToAgent(agentDir);
     const agentJsonPath = join7(agentDir, "agent.json");
-    writeFileSync5(
+    writeFileSync4(
       agentJsonPath,
       `${JSON.stringify({ systemPrompt }, null, 2)}
 `,
       { mode: 384 }
     );
     chownToAgent(agentJsonPath);
-    mkdirSync3(TASK_CACHE_DIR2, { recursive: true });
+    mkdirSync2(TASK_CACHE_DIR2, { recursive: true });
     chownToAgent(TASK_CACHE_DIR2);
     for (const task of tasks) {
       const path2 = join7(TASK_CACHE_DIR2, `${task.taskId}.json`);
-      writeFileSync5(path2, `${JSON.stringify(task, null, 2)}
+      writeFileSync4(path2, `${JSON.stringify(task, null, 2)}
 `, { mode: 384 });
       chownToAgent(path2);
     }
@@ -4728,19 +4268,19 @@ var agentsCommand = defineCommand28({
 import { defineCommand as defineCommand37 } from "citty";
 
 // src/commands/nest/authorize.ts
-import { execFileSync as execFileSync9 } from "child_process";
-import { existsSync as existsSync11, readFileSync as readFileSync10 } from "fs";
+import { execFileSync as execFileSync8 } from "child_process";
+import { existsSync as existsSync11, readFileSync as readFileSync9 } from "fs";
 import { join as join9 } from "path";
 import { defineCommand as defineCommand30 } from "citty";
 import consola26 from "consola";
 
 // src/commands/nest/enroll.ts
-import { hostname as hostname4, homedir as homedir10 } from "os";
-import { existsSync as existsSync10, mkdirSync as mkdirSync4, writeFileSync as writeFileSync6, chmodSync } from "fs";
+import { hostname as hostname4, homedir as homedir9 } from "os";
+import { existsSync as existsSync10, mkdirSync as mkdirSync3, writeFileSync as writeFileSync5, chmodSync } from "fs";
 import { join as join8 } from "path";
 import { defineCommand as defineCommand29 } from "citty";
 import consola25 from "consola";
-var NEST_DATA_DIR = join8(homedir10(), ".openape", "nest");
+var NEST_DATA_DIR = join8(homedir9(), ".openape", "nest");
 function nestAgentName() {
   const raw = hostname4().toLowerCase();
   const head = raw.split(".")[0] ?? raw;
@@ -4779,13 +4319,13 @@ var enrollNestCommand = defineCommand29({
     }
     const sshDir = join8(NEST_DATA_DIR, ".ssh");
     const configDir = join8(NEST_DATA_DIR, ".config", "apes");
-    mkdirSync4(sshDir, { recursive: true });
-    mkdirSync4(configDir, { recursive: true });
+    mkdirSync3(sshDir, { recursive: true });
+    mkdirSync3(configDir, { recursive: true });
     consola25.start(`Generating keypair for ${name}\u2026`);
     const { privatePem, publicSshLine } = generateKeyPairInMemory();
-    writeFileSync6(join8(sshDir, "id_ed25519"), `${privatePem.trimEnd()}
+    writeFileSync5(join8(sshDir, "id_ed25519"), `${privatePem.trimEnd()}
 `, { mode: 384 });
-    writeFileSync6(join8(sshDir, "id_ed25519.pub"), `${publicSshLine}
+    writeFileSync5(join8(sshDir, "id_ed25519.pub"), `${publicSshLine}
 `, { mode: 420 });
     chmodSync(sshDir, 448);
     consola25.start(`Registering nest at ${idp}\u2026`);
@@ -4805,7 +4345,7 @@ var enrollNestCommand = defineCommand29({
       keyPath: join8(sshDir, "id_ed25519"),
       ownerEmail: ownerAuth.email
     });
-    writeFileSync6(authPath, authJson, { mode: 384 });
+    writeFileSync5(authPath, authJson, { mode: 384 });
     chmodSync(configDir, 448);
     consola25.success(`Nest enrolled \u2014 auth.json at ${authPath}`);
     consola25.info("");
@@ -4867,7 +4407,7 @@ var authorizeNestCommand = defineCommand30({
     if (!existsSync11(nestAuthPath)) {
       throw new CliError("Nest not enrolled. Run `apes nest enroll` first.");
     }
-    const nestAuth = JSON.parse(readFileSync10(nestAuthPath, "utf8"));
+    const nestAuth = JSON.parse(readFileSync9(nestAuthPath, "utf8"));
     if (!nestAuth.email) throw new CliError(`${nestAuthPath} has no email`);
     const allow = args.allow ?? DEFAULT_ALLOW_PATTERNS.join(",");
     consola26.info(`Configuring YOLO-policy on ${nestAuth.email} via \`apes yolo set\`\u2026`);
@@ -4884,7 +4424,7 @@ var authorizeNestCommand = defineCommand30({
       cmdArgs.push("--expires-in", args["expires-in"]);
     }
     try {
-      execFileSync9("apes", cmdArgs, { stdio: "inherit" });
+      execFileSync8("apes", cmdArgs, { stdio: "inherit" });
     } catch (err) {
       throw new CliError(err instanceof Error ? err.message : String(err));
     }
@@ -5029,9 +4569,9 @@ var destroyNestCommand = defineCommand31({
 });
 
 // src/commands/nest/install.ts
-import { execFileSync as execFileSync10 } from "child_process";
-import { existsSync as existsSync12, mkdirSync as mkdirSync5, readFileSync as readFileSync11, writeFileSync as writeFileSync7 } from "fs";
-import { homedir as homedir11, userInfo as userInfo2 } from "os";
+import { execFileSync as execFileSync9 } from "child_process";
+import { existsSync as existsSync12, mkdirSync as mkdirSync4, readFileSync as readFileSync10, writeFileSync as writeFileSync6 } from "fs";
+import { homedir as homedir10, userInfo as userInfo2 } from "os";
 import { dirname as dirname3, join as join10 } from "path";
 import { defineCommand as defineCommand32 } from "citty";
 import consola29 from "consola";
@@ -5101,7 +4641,7 @@ resource_chain = ["agents:name={name}", "allowlist:email={peer_email}"]
 // src/commands/nest/install.ts
 var PLIST_LABEL = "ai.openape.nest";
 function plistPath() {
-  return join10(homedir11(), "Library", "LaunchAgents", `${PLIST_LABEL}.plist`);
+  return join10(homedir10(), "Library", "LaunchAgents", `${PLIST_LABEL}.plist`);
 }
 function escape2(s) {
   return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
@@ -5129,7 +4669,7 @@ function buildPlist(args) {
   <key>EnvironmentVariables</key>
   <dict>
     <key>HOME</key><string>${escape2(args.nestHome)}</string>
-    <key>PATH</key><string>${escape2(args.userHome)}/.bun/bin:/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin</string>
+    <key>PATH</key><string>/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin</string>
     <key>OPENAPE_NEST_PORT</key><string>${args.port}</string>
     <key>OPENAPE_APES_BIN</key><string>${escape2(args.apesBin)}</string>
   </dict>
@@ -5142,34 +4682,34 @@ function buildPlist(args) {
 `;
 }
 function installAdapter2() {
-  const target = join10(homedir11(), ".openape", "shapes", "adapters", "apes-agents.toml");
-  mkdirSync5(dirname3(target), { recursive: true });
+  const target = join10(homedir10(), ".openape", "shapes", "adapters", "apes-agents.toml");
+  mkdirSync4(dirname3(target), { recursive: true });
   let existing = "";
   try {
-    existing = readFileSync11(target, "utf8");
+    existing = readFileSync10(target, "utf8");
   } catch {
   }
   if (existing === APES_AGENTS_ADAPTER_TOML) return false;
-  writeFileSync7(target, APES_AGENTS_ADAPTER_TOML, { mode: 420 });
+  writeFileSync6(target, APES_AGENTS_ADAPTER_TOML, { mode: 420 });
   consola29.success(`Wrote shapes adapter ${target}`);
   return true;
 }
 function writeBridgeModelDefault(model) {
-  const envDir = join10(homedir11(), "litellm");
+  const envDir = join10(homedir10(), "litellm");
   const envFile = join10(envDir, ".env");
-  mkdirSync5(envDir, { recursive: true });
+  mkdirSync4(envDir, { recursive: true });
   let lines = [];
   if (existsSync12(envFile)) {
-    lines = readFileSync11(envFile, "utf8").split("\n").filter((l) => !l.startsWith("APE_CHAT_BRIDGE_MODEL="));
+    lines = readFileSync10(envFile, "utf8").split("\n").filter((l) => !l.startsWith("APE_CHAT_BRIDGE_MODEL="));
   }
   lines.push(`APE_CHAT_BRIDGE_MODEL=${model}`);
   while (lines.length > 0 && lines.at(-1).trim() === "") lines.pop();
-  writeFileSync7(envFile, `${lines.join("\n")}
+  writeFileSync6(envFile, `${lines.join("\n")}
 `, { mode: 384 });
 }
 function findBinary(name) {
   for (const dir of [
-    join10(homedir11(), ".bun", "bin"),
+    join10(homedir10(), ".bun", "bin"),
     "/opt/homebrew/bin",
     "/usr/local/bin",
     "/usr/bin"
@@ -5195,7 +4735,7 @@ var installNestCommand = defineCommand32({
     }
   },
   async run({ args }) {
-    const homeDir = homedir11();
+    const homeDir = homedir10();
     const port = Number(args.port ?? 9091);
     if (!Number.isInteger(port) || port < 1024 || port > 65535) {
       throw new Error(`invalid port ${port}`);
@@ -5211,26 +4751,26 @@ var installNestCommand = defineCommand32({
       consola29.success(`Default bridge model set to ${args["bridge-model"]} (in ~/litellm/.env)`);
     }
     installAdapter2();
-    mkdirSync5(join10(homeDir, "Library", "LaunchAgents"), { recursive: true });
-    mkdirSync5(NEST_DATA_DIR, { recursive: true });
+    mkdirSync4(join10(homeDir, "Library", "LaunchAgents"), { recursive: true });
+    mkdirSync4(NEST_DATA_DIR, { recursive: true });
     const desired = buildPlist({ nestBin, apesBin, userHome: homeDir, nestHome: NEST_DATA_DIR, port });
     let existing = "";
     try {
-      existing = readFileSync11(plistPath(), "utf8");
+      existing = readFileSync10(plistPath(), "utf8");
     } catch {
     }
     if (existing !== desired) {
-      writeFileSync7(plistPath(), desired, { mode: 420 });
+      writeFileSync6(plistPath(), desired, { mode: 420 });
       consola29.success("Wrote launchd plist");
     } else {
       consola29.info("plist already up to date");
     }
     const uid = userInfo2().uid;
     try {
-      execFileSync10("/bin/launchctl", ["bootout", `gui/${uid}/${PLIST_LABEL}`], { stdio: "ignore" });
+      execFileSync9("/bin/launchctl", ["bootout", `gui/${uid}/${PLIST_LABEL}`], { stdio: "ignore" });
     } catch {
     }
-    execFileSync10("/bin/launchctl", ["bootstrap", `gui/${uid}`, plistPath()], { stdio: "inherit" });
+    execFileSync9("/bin/launchctl", ["bootstrap", `gui/${uid}`, plistPath()], { stdio: "inherit" });
     consola29.success(`Nest daemon bootstrapped \u2014 http://127.0.0.1:${port}`);
     consola29.info("");
     consola29.info("Next steps for zero-prompt spawn \u2014 both one-time:");
@@ -5393,9 +4933,9 @@ var statusNestCommand = defineCommand35({
 });
 
 // src/commands/nest/uninstall.ts
-import { execFileSync as execFileSync11 } from "child_process";
+import { execFileSync as execFileSync10 } from "child_process";
 import { existsSync as existsSync13, unlinkSync } from "fs";
-import { homedir as homedir12, userInfo as userInfo3 } from "os";
+import { homedir as homedir11, userInfo as userInfo3 } from "os";
 import { join as join11 } from "path";
 import { defineCommand as defineCommand36 } from "citty";
 import consola33 from "consola";
@@ -5407,9 +4947,9 @@ var uninstallNestCommand = defineCommand36({
   },
   async run() {
     const uid = userInfo3().uid;
-    const path2 = join11(homedir12(), "Library", "LaunchAgents", `${PLIST_LABEL2}.plist`);
+    const path2 = join11(homedir11(), "Library", "LaunchAgents", `${PLIST_LABEL2}.plist`);
     try {
-      execFileSync11("/bin/launchctl", ["bootout", `gui/${uid}/${PLIST_LABEL2}`], { stdio: "ignore" });
+      execFileSync10("/bin/launchctl", ["bootout", `gui/${uid}/${PLIST_LABEL2}`], { stdio: "ignore" });
       consola33.success("Nest daemon stopped");
     } catch {
       consola33.info("Nest daemon was not loaded");
@@ -5964,7 +5504,7 @@ var adapterCommand = defineCommand42({
 });
 
 // src/commands/run.ts
-import { execFileSync as execFileSync12 } from "child_process";
+import { execFileSync as execFileSync11 } from "child_process";
 import { hostname as hostname6 } from "os";
 import { basename } from "path";
 import { defineCommand as defineCommand43 } from "citty";
@@ -6242,7 +5782,7 @@ function execShellCommand(command) {
     throw new CliError("No command to execute");
   try {
     const { APES_SHELL_WRAPPER: _wrapperMarker, ...inheritedEnv } = process.env;
-    execFileSync12(command[0], command.slice(1), {
+    execFileSync11(command[0], command.slice(1), {
       stdio: "inherit",
       env: inheritedEnv
     });
@@ -6394,7 +5934,7 @@ async function runAudienceMode(audience, action, args) {
     consola38.info(`Executing: ${command.join(" ")}`);
     try {
       const { APES_SHELL_WRAPPER: _wrapperMarker, ...inheritedEnv } = process.env;
-      execFileSync12(args["escapes-path"] || "escapes", ["--grant", authz_jwt, "--", ...command], {
+      execFileSync11(args["escapes-path"] || "escapes", ["--grant", authz_jwt, "--", ...command], {
         stdio: "inherit",
         env: inheritedEnv
       });
@@ -6444,10 +5984,10 @@ note = "VPC-internal hostname suffix"
 
 // src/proxy/local-proxy.ts
 import { spawn } from "child_process";
-import { mkdtempSync as mkdtempSync3, rmSync as rmSync3, writeFileSync as writeFileSync8 } from "fs";
+import { mkdtempSync as mkdtempSync3, rmSync as rmSync3, writeFileSync as writeFileSync7 } from "fs";
 import { createRequire } from "module";
 import { tmpdir as tmpdir3 } from "os";
-import { dirname as dirname4, join as join12, resolve as resolve4 } from "path";
+import { dirname as dirname4, join as join12, resolve as resolve3 } from "path";
 var require2 = createRequire(import.meta.url);
 function findProxyBin() {
   const pkgPath = require2.resolve("@openape/proxy/package.json");
@@ -6456,12 +5996,12 @@ function findProxyBin() {
   if (!binRel) {
     throw new Error("@openape/proxy is missing the openape-proxy bin entry");
   }
-  return resolve4(dirname4(pkgPath), binRel);
+  return resolve3(dirname4(pkgPath), binRel);
 }
 async function startEphemeralProxy(configToml) {
   const tmpDir = mkdtempSync3(join12(tmpdir3(), "openape-proxy-"));
   const configPath = join12(tmpDir, "config.toml");
-  writeFileSync8(configPath, configToml, { mode: 384 });
+  writeFileSync7(configPath, configToml, { mode: 384 });
   const binPath = findProxyBin();
   const child = spawn(process.execPath, [binPath, "-c", configPath], {
     stdio: ["ignore", "pipe", "pipe"],
@@ -6896,15 +6436,15 @@ var mcpCommand = defineCommand49({
     if (transport !== "stdio" && transport !== "sse") {
       throw new Error('Transport must be "stdio" or "sse"');
     }
-    const { startMcpServer } = await import("./server-6WQYPDVO.js");
+    const { startMcpServer } = await import("./server-F3ALNNYS.js");
     await startMcpServer(transport, port);
   }
 });
 
 // src/commands/init/index.ts
-import { existsSync as existsSync14, copyFileSync, writeFileSync as writeFileSync9 } from "fs";
+import { existsSync as existsSync14, copyFileSync, writeFileSync as writeFileSync8 } from "fs";
 import { randomBytes } from "crypto";
-import { execFileSync as execFileSync13 } from "child_process";
+import { execFileSync as execFileSync12 } from "child_process";
 import { join as join13 } from "path";
 import { defineCommand as defineCommand50 } from "citty";
 import consola42 from "consola";
@@ -6916,11 +6456,11 @@ async function downloadTemplate(repo, targetDir) {
 function installDeps(dir) {
   const hasLockFile = (name) => existsSync14(join13(dir, name));
   if (hasLockFile("pnpm-lock.yaml")) {
-    execFileSync13("pnpm", ["install"], { cwd: dir, stdio: "inherit" });
+    execFileSync12("pnpm", ["install"], { cwd: dir, stdio: "inherit" });
   } else if (hasLockFile("bun.lockb")) {
-    execFileSync13("bun", ["install"], { cwd: dir, stdio: "inherit" });
+    execFileSync12("bun", ["install"], { cwd: dir, stdio: "inherit" });
   } else {
-    execFileSync13("npm", ["install"], { cwd: dir, stdio: "inherit" });
+    execFileSync12("npm", ["install"], { cwd: dir, stdio: "inherit" });
   }
 }
 async function promptChoice(message, choices) {
@@ -7036,7 +6576,7 @@ async function initIdP(targetDir) {
     `NUXT_OPENAPE_RP_ID=${domain}`,
     `NUXT_OPENAPE_RP_ORIGIN=${origin}`
   ].join("\n");
-  writeFileSync9(join13(dir, ".env"), `${envContent}
+  writeFileSync8(join13(dir, ".env"), `${envContent}
 `, { mode: 384 });
   consola42.success(".env created");
   console.log("");
@@ -7057,7 +6597,7 @@ async function initIdP(targetDir) {
 
 // src/commands/enroll.ts
 import { Buffer as Buffer5 } from "buffer";
-import { existsSync as existsSync15, readFileSync as readFileSync12 } from "fs";
+import { existsSync as existsSync15, readFileSync as readFileSync11 } from "fs";
 import { execFile as execFile2 } from "child_process";
 import { sign as sign2 } from "crypto";
 import { defineCommand as defineCommand51 } from "citty";
@@ -7073,7 +6613,7 @@ function openBrowser2(url) {
 }
 async function pollForEnrollment(idp, agentEmail, keyPath) {
   const resolvedKey = resolveKeyPath(keyPath);
-  const keyContent = readFileSync12(resolvedKey, "utf-8");
+  const keyContent = readFileSync11(resolvedKey, "utf-8");
   const privateKey = loadEd25519PrivateKey(keyContent);
   const challengeUrl = await getAgentChallengeEndpoint(idp);
   const authenticateUrl = await getAgentAuthenticateEndpoint(idp);
@@ -7100,7 +6640,7 @@ async function pollForEnrollment(idp, agentEmail, keyPath) {
       }
     } catch {
     }
-    await new Promise((resolve5) => setTimeout(resolve5, POLL_INTERVAL));
+    await new Promise((resolve4) => setTimeout(resolve4, POLL_INTERVAL));
   }
   throw new Error("Enrollment timed out. Please check the browser and try again.");
 }
@@ -7185,7 +6725,7 @@ var enrollCommand = defineCommand51({
 });
 
 // src/commands/register-user.ts
-import { existsSync as existsSync16, readFileSync as readFileSync13 } from "fs";
+import { existsSync as existsSync16, readFileSync as readFileSync12 } from "fs";
 import { defineCommand as defineCommand52 } from "citty";
 import consola44 from "consola";
 var registerUserCommand = defineCommand52({
@@ -7225,7 +6765,7 @@ var registerUserCommand = defineCommand52({
     }
     let publicKey = args.key;
     if (existsSync16(args.key)) {
-      publicKey = readFileSync13(args.key, "utf-8").trim();
+      publicKey = readFileSync12(args.key, "utf-8").trim();
     }
     if (!publicKey.startsWith("ssh-ed25519 ")) {
       throw new CliError("Public key must be in ssh-ed25519 format.");
@@ -7534,7 +7074,7 @@ async function bestEffortGrantCount(idp) {
   }
 }
 async function runHealth(args) {
-  const version = true ? "1.9.0" : "0.0.0";
+  const version = true ? "1.11.0" : "0.0.0";
   const auth = loadAuth();
   if (!auth) {
     throw new CliError("Not logged in. Run `apes login` first.", 1);
@@ -7727,26 +7267,26 @@ var workflowsCommand = defineCommand60({
 });
 
 // src/version-check.ts
-import { existsSync as existsSync17, mkdirSync as mkdirSync6, readFileSync as readFileSync14, writeFileSync as writeFileSync10 } from "fs";
-import { homedir as homedir13 } from "os";
+import { existsSync as existsSync17, mkdirSync as mkdirSync5, readFileSync as readFileSync13, writeFileSync as writeFileSync9 } from "fs";
+import { homedir as homedir12 } from "os";
 import { join as join14 } from "path";
 import consola50 from "consola";
 var PACKAGE_NAME = "@openape/apes";
 var CACHE_TTL_MS = 24 * 60 * 60 * 1e3;
-var CACHE_FILE = join14(homedir13(), ".config", "apes", ".version-check.json");
+var CACHE_FILE = join14(homedir12(), ".config", "apes", ".version-check.json");
 function readCache() {
   if (!existsSync17(CACHE_FILE)) return null;
   try {
-    return JSON.parse(readFileSync14(CACHE_FILE, "utf-8"));
+    return JSON.parse(readFileSync13(CACHE_FILE, "utf-8"));
   } catch {
     return null;
   }
 }
 function writeCache(entry) {
   try {
-    const dir = join14(homedir13(), ".config", "apes");
-    if (!existsSync17(dir)) mkdirSync6(dir, { recursive: true, mode: 448 });
-    writeFileSync10(CACHE_FILE, JSON.stringify(entry), { mode: 384 });
+    const dir = join14(homedir12(), ".config", "apes");
+    if (!existsSync17(dir)) mkdirSync5(dir, { recursive: true, mode: 448 });
+    writeFileSync9(CACHE_FILE, JSON.stringify(entry), { mode: 384 });
   } catch {
   }
 }
@@ -7807,10 +7347,10 @@ if (shellRewrite) {
   if (shellRewrite.action === "rewrite") {
     process.argv = shellRewrite.argv;
   } else if (shellRewrite.action === "version") {
-    console.log(`ape-shell ${"1.9.0"} (OpenApe DDISA shell wrapper)`);
+    console.log(`ape-shell ${"1.11.0"} (OpenApe DDISA shell wrapper)`);
     process.exit(0);
   } else if (shellRewrite.action === "help") {
-    console.log(`ape-shell ${"1.9.0"} \u2014 OpenApe DDISA shell wrapper`);
+    console.log(`ape-shell ${"1.11.0"} \u2014 OpenApe DDISA shell wrapper`);
     console.log("");
     console.log("Usage:");
     console.log("  ape-shell                 Start interactive grant-mediated REPL");
@@ -7868,7 +7408,7 @@ var configCommand = defineCommand61({
 var main = defineCommand61({
   meta: {
     name: "apes",
-    version: "1.9.0",
+    version: "1.11.0",
     description: "Unified CLI for OpenApe"
   },
   subCommands: {
@@ -7925,7 +7465,7 @@ async function maybeRefreshAuth() {
   }
 }
 await maybeRefreshAuth();
-await maybeWarnStaleVersion("1.9.0").catch(() => {
+await maybeWarnStaleVersion("1.11.0").catch(() => {
 });
 runMain(main).catch((err) => {
   if (err instanceof CliExit) {