@phnx-labs/agents-cli 0.1.0 → 1.14.1

package/dist/lib/cloud/rush.js

@@ -1,11 +1,47 @@
+/**
+ * Rush Cloud provider -- dispatches tasks to the Factory Floor via api.prix.dev.
+ *
+ * Auth: reads the session token from ~/.rush/user.yaml (written by `rush login`).
+ * Requires the Rush GitHub App installed on the target repo.
+ */
 import * as fs from 'fs';
 import * as path from 'path';
 import * as os from 'os';
+import * as crypto from 'crypto';
 import * as yaml from 'yaml';
+import { getAgentsDir } from '../state.js';
+import { resolveDispatchRepos } from './types.js';
 import { parseSSE } from './stream.js';
+import { listInstalledVersions, getVersionHomePath } from '../versions.js';
+import { getAccountInfo } from '../agents.js';
+import { loadClaudeOauth } from '../usage.js';
 const PROXY_BASE = 'https://api.prix.dev';
 const USER_YAML = path.join(os.homedir(), '.rush', 'user.yaml');
-/** Map Factory Floor status to our canonical status. */
+// Persistent consent record for uploading Claude OAuth blobs to Rush Cloud.
+// Created on first explicit consent (env var or flag); subsequent dispatches
+// see it and proceed without re-prompting.
+const RUSH_CONSENT_PATH = path.join(getAgentsDir(), 'cloud', 'rush-consent.json');
+const RUSH_CONSENT_ENV = 'AGENTS_RUSH_UPLOAD_TOKENS';
+function hasRushUploadConsent(opts) {
+    if (process.env[RUSH_CONSENT_ENV] === '1')
+        return true;
+    const po = opts?.providerOptions;
+    if (po?.uploadAccountTokens === true)
+        return true;
+    return fs.existsSync(RUSH_CONSENT_PATH);
+}
+function recordRushUploadConsent(grantedBy) {
+    try {
+        fs.mkdirSync(path.dirname(RUSH_CONSENT_PATH), { recursive: true });
+        const body = { granted_at: new Date().toISOString(), granted_by: grantedBy };
+        fs.writeFileSync(RUSH_CONSENT_PATH, JSON.stringify(body, null, 2), { mode: 0o600 });
+    }
+    catch {
+        // Non-fatal: consent persistence is a UX optimization, not a security
+        // boundary. Worst case, the user is asked to consent again next dispatch.
+    }
+}
+/** Map a Factory Floor status string to the canonical CloudTaskStatus enum. */
 function mapStatus(s) {
     switch (s) {
         case 'allocating': return 'allocating';
@@ -17,6 +53,7 @@ function mapStatus(s) {
         default: return 'running';
     }
 }
+/** Read the Rush session access token from ~/.rush/user.yaml. */
 function readToken() {
     if (!fs.existsSync(USER_YAML)) {
         throw new Error('Not logged in to Rush. Run `rush login` first.');
@@ -29,6 +66,7 @@ function readToken() {
     }
     return token;
 }
+/** Read the user's email from the Rush session config, if available. */
 function readEmail() {
     try {
         const raw = fs.readFileSync(USER_YAML, 'utf-8');
@@ -39,6 +77,7 @@ function readEmail() {
         return undefined;
     }
 }
+/** Make an authenticated request to the Rush API proxy. */
 async function api(method, endpoint, token, body) {
     const url = endpoint.startsWith('http') ? endpoint : `${PROXY_BASE}${endpoint}`;
     const headers = {
@@ -51,6 +90,7 @@ async function api(method, endpoint, token, body) {
         body: body ? JSON.stringify(body) : undefined,
     });
 }
+/** Find the GitHub App installation ID for a given owner/repo pair. */
 async function findInstallation(token, owner, repo) {
     const res = await api('GET', '/api/v1/github/app/installations', token);
     if (!res.ok) {
@@ -68,34 +108,247 @@ async function findInstallation(token, owner, repo) {
     }
     throw new Error(`No GitHub App installation found for ${owner}/${repo}. Install the Rush GitHub App at https://github.com/apps/prix-cloud.`);
 }
+/** sha256 → hex. */
+function sha256(input) {
+    return crypto.createHash('sha256').update(input).digest('hex');
+}
+/**
+ * Strip tokens/credentials from a server error body before surfacing it.
+ * If the body is JSON with a `message` or `error` field, prefer that.
+ * Otherwise truncate and redact anything that looks like a bearer token or JWT.
+ */
+function sanitizeErrorBody(body) {
+    const MAX_LEN = 300;
+    try {
+        const parsed = JSON.parse(body);
+        const msg = (parsed.message ?? parsed.error ?? parsed.detail);
+        if (typeof msg === 'string')
+            return msg.slice(0, MAX_LEN);
+    }
+    catch { /* not JSON, fall through */ }
+    let safe = body.slice(0, MAX_LEN);
+    safe = safe.replace(/eyJ[A-Za-z0-9_-]{20,}/g, '[REDACTED_TOKEN]');
+    safe = safe.replace(/Bearer\s+\S+/gi, 'Bearer [REDACTED]');
+    safe = safe.replace(/"(access_token|refresh_token|credentials_json)"\s*:\s*"[^"]*"/g, '"$1":"[REDACTED]"');
+    if (body.length > MAX_LEN)
+        safe += '...';
+    return safe;
+}
+/**
+ * Pull `prompt_code` out of a JSON-encoded error body. Returns null when the
+ * body isn't JSON or doesn't carry one — caller falls through to the generic
+ * dispatch-failed path.
+ */
+function parsePromptCode(body) {
+    try {
+        const parsed = JSON.parse(body);
+        return typeof parsed.prompt_code === 'string' ? parsed.prompt_code : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Read the raw OAuth credentials for one Claude version. On Mac, prefer the
+ * Keychain blob (canonical). On Linux/CI, fall back to `.claude/.credentials.json`
+ * inside the version home (where the Linux Claude CLI stores its OAuth).
+ *
+ * Returns null when no credentials are findable — caller treats as "version
+ * is installed but not signed in" and skips it from the manifest.
+ */
+async function readClaudeCredentialsBlob(home) {
+    if (process.platform === 'darwin') {
+        const oauth = await loadClaudeOauth(home);
+        if (oauth && oauth.accessToken) {
+            return JSON.stringify(oauth);
+        }
+    }
+    const credsPath = path.join(home, '.claude', '.credentials.json');
+    try {
+        if (fs.existsSync(credsPath)) {
+            const raw = fs.readFileSync(credsPath, 'utf-8').trim();
+            if (raw)
+                return raw;
+        }
+    }
+    catch {
+        // fall through to null
+    }
+    return null;
+}
+/**
+ * Build a manifest of the user's local Claude installations to send on every
+ * cloud dispatch. The manifest is the contract the server uses to detect when
+ * the user has added a new account or rotated a token.
+ *
+ * Returns null when no Claude versions are signed in (the dispatch falls back
+ * to the platform-wide key, current behavior).
+ */
+export async function buildAccountManifest() {
+    const versions = listInstalledVersions('claude');
+    if (versions.length === 0)
+        return null;
+    const entries = [];
+    for (const version of versions) {
+        const home = getVersionHomePath('claude', version);
+        const info = await getAccountInfo('claude', home);
+        if (!info.email)
+            continue;
+        const blob = await readClaudeCredentialsBlob(home);
+        if (!blob)
+            continue;
+        entries.push({ version, email: info.email, cred_fp: sha256(blob) });
+    }
+    if (entries.length === 0)
+        return null;
+    entries.sort((a, b) => a.version.localeCompare(b.version));
+    const fp = sha256(JSON.stringify(entries));
+    return { fp, versions: entries };
+}
+/**
+ * Re-load OAuth blobs for the given versions so they can be uploaded to the
+ * server on a retry. Only the versions named in the manifest are loaded — we
+ * never upload tokens for versions the server hasn't asked about.
+ */
+export async function buildAccountTokensPayload(versions) {
+    const out = [];
+    for (const version of versions) {
+        const home = getVersionHomePath('claude', version);
+        const blob = await readClaudeCredentialsBlob(home);
+        if (!blob)
+            continue;
+        out.push({ version, credentials_json: blob });
+    }
+    return out;
+}
+/**
+ * Build the POST body for /api/v1/cloud-runs. Exported so tests can verify
+ * the back-compat shape (singular fields + repos[]) without needing real
+ * GitHub installations or a live Rush session. `findInstallation` is the
+ * only other I/O and it's tested by the halo/proxy integration suite.
+ */
+export function buildDispatchBody(input) {
+    if (input.resolvedRepos.length === 0) {
+        throw new Error('buildDispatchBody: resolvedRepos must have at least one entry');
+    }
+    const primary = input.resolvedRepos[0];
+    const body = {
+        agent: input.agent ?? 'claude',
+        prompt: input.prompt,
+        repos: input.resolvedRepos,
+        mode: input.mode,
+    };
+    if (input.resolvedRepos.length === 1) {
+        body.installation_id = primary.installation_id;
+        body.repo_owner = primary.repo_owner;
+        body.repo_name = primary.repo_name;
+    }
+    if (input.accountManifest) {
+        body.account_manifest = input.accountManifest;
+    }
+    if (input.accountTokens && input.accountTokens.length > 0) {
+        body.account_tokens = input.accountTokens;
+    }
+    return body;
+}
 export class RushCloudProvider {
     id = 'rush';
     name = 'Rush Cloud';
-    supports(_options) {
-        return fs.existsSync(USER_YAML);
+    capabilities() {
+        return {
+            available: fs.existsSync(USER_YAML),
+            dispatch: true,
+            status: true,
+            list: true,
+            stream: true,
+            cancel: true,
+            message: true,
+            multiRepo: true,
+            skills: false,
+            images: false,
+        };
     }
     async dispatch(options) {
-        if (!options.repo) {
-            throw new Error('Rush Cloud requires --repo <owner/repo>.');
-        }
-        const [owner, repo] = options.repo.split('/');
-        if (!owner || !repo) {
-            throw new Error('Invalid repo format. Use owner/repo (e.g., muqsitnawaz/agents).');
+        const repos = resolveDispatchRepos(options);
+        if (repos.length === 0) {
+            throw new Error('Rush Cloud requires --repo <owner/repo> (or --repo repeated for multi-repo).');
         }
+        // Validate each repo's shape and resolve its installation_id up front.
+        // Any bad entry fails the whole dispatch — we never want a half-started
+        // multi-repo run that only found installations for some of the repos.
         const token = readToken();
-        const installationId = await findInstallation(token, owner, repo);
-        const body = {
-            agent: options.agent ?? 'claude',
+        const parsed = repos.map((full) => {
+            const parts = full.split('/');
+            if (parts.length !== 2 || !parts[0] || !parts[1]) {
+                throw new Error(`Invalid repo format: ${JSON.stringify(full)}. Use owner/repo.`);
+            }
+            return { full, owner: parts[0], name: parts[1] };
+        });
+        const resolvedRepos = await Promise.all(parsed.map(async (r) => ({
+            installation_id: await findInstallation(token, r.owner, r.name),
+            repo_owner: r.owner,
+            repo_name: r.name,
+        })));
+        const accountManifest = await buildAccountManifest();
+        const body = buildDispatchBody({
+            agent: options.agent,
             prompt: options.prompt,
-            installation_id: installationId,
-            repo_owner: owner,
-            repo_name: repo,
             mode: options.providerOptions?.mode,
-        };
-        const res = await api('POST', '/api/v1/cloud-runs', token, body);
+            resolvedRepos,
+            accountManifest,
+        });
+        let res = await api('POST', '/api/v1/cloud-runs', token, body);
+        // Server detects drift (new account or rotated token) by comparing the
+        // manifest's fp against what's stored. It returns 401 with a prompt_code
+        // telling the client to re-upload the actual token blobs and retry once.
+        if (res.status === 401 && accountManifest) {
+            const errBody = await res.clone().text();
+            const promptCode = parsePromptCode(errBody);
+            if (promptCode === 'NEW_ACCOUNT' || promptCode === 'TOKEN_ROTATED') {
+                // Refuse to silently exfiltrate Claude OAuth credentials. The retry
+                // path below reads accessToken+refreshToken from every installed
+                // Claude version and POSTs them to api.prix.dev. That's an explicit
+                // data-flow decision the user has to opt into.
+                if (!hasRushUploadConsent(options)) {
+                    throw new Error([
+                        `Rush Cloud asked to sync your Claude credentials (reason: ${promptCode.toLowerCase()}).`,
+                        `This would upload accessToken + refreshToken from every installed Claude version`,
+                        `to ${PROXY_BASE} so Factory Floor pods can act as your Anthropic account.`,
+                        ``,
+                        `To consent, re-run with one of:`,
+                        `  AGENTS_RUSH_UPLOAD_TOKENS=1 agents cloud run ...`,
+                        `  agents cloud run --upload-account-tokens ...   # if your CLI exposes this flag`,
+                        ``,
+                        `Consent will be recorded at ${RUSH_CONSENT_PATH} so you won't be asked again.`,
+                        `Remove that file to revoke.`,
+                    ].join('\n'));
+                }
+                // Always-on stderr notice (no isTTY gate). Scripts and CI need to see
+                // this in their captured stderr / logs.
+                const grantedBy = process.env[RUSH_CONSENT_ENV] === '1' ? 'env'
+                    : options.providerOptions?.uploadAccountTokens === true ? 'flag'
+                        : 'manual';
+                process.stderr.write(`[rush] uploading Claude OAuth credentials to ${PROXY_BASE} (reason: ${promptCode.toLowerCase()}, consent: ${grantedBy})\n`);
+                const accountTokens = await buildAccountTokensPayload(accountManifest.versions.map((v) => v.version));
+                const retryBody = buildDispatchBody({
+                    agent: options.agent,
+                    prompt: options.prompt,
+                    mode: options.providerOptions?.mode,
+                    resolvedRepos,
+                    accountManifest,
+                    accountTokens,
+                });
+                res = await api('POST', '/api/v1/cloud-runs', token, retryBody);
+                // Persist consent on first successful upload so we don't re-prompt
+                // every time tokens rotate.
+                if (res.ok && grantedBy !== 'manual') {
+                    recordRushUploadConsent(grantedBy);
+                }
+            }
+        }
         if (!res.ok) {
             const text = await res.text();
-            throw new Error(`Dispatch failed (${res.status}): ${text}`);
+            throw new Error(`Dispatch failed (${res.status}): ${sanitizeErrorBody(text)}`);
         }
         const data = await res.json();
         const now = new Date().toISOString();
@@ -105,7 +358,8 @@ export class RushCloudProvider {
             status: 'queued',
             agent: options.agent ?? 'claude',
             prompt: options.prompt,
-            repo: options.repo,
+            repo: repos[0],
+            repos: repos,
             branch: options.branch,
             createdAt: now,
             updatedAt: now,
@@ -182,4 +436,3 @@ export class RushCloudProvider {
         }
     }
 }
-//# sourceMappingURL=rush.js.map

package/dist/lib/cloud/store.d.ts

@@ -1,10 +1,22 @@
+/**
+ * Local SQLite persistence for cloud-dispatched tasks.
+ *
+ * Every dispatch, status poll, and list query flows through this module so
+ * that task history survives across CLI invocations without hitting the
+ * remote provider each time.
+ */
 import type { CloudTask, CloudProviderId, CloudTaskStatus } from './types.js';
+/** Persist a task snapshot, replacing any existing row with the same ID. */
 export declare function insertTask(task: CloudTask): void;
+/** Update a task's status and optionally patch summary, PR URL, or branch. */
 export declare function updateTaskStatus(id: string, status: CloudTaskStatus, extra?: Partial<Pick<CloudTask, 'summary' | 'prUrl' | 'branch'>>): void;
+/** Fetch a single task by its provider-assigned ID, or null if not found locally. */
 export declare function getTaskById(id: string): CloudTask | null;
+/** List tasks with optional provider/status filters, ordered newest-first. */
 export declare function listTasks(filter?: {
     provider?: CloudProviderId;
     status?: CloudTaskStatus;
     limit?: number;
 }): CloudTask[];
-//# sourceMappingURL=store.d.ts.map
+/** Return tasks still in a transient state (queued, allocating, running, input_required). */
+export declare function listActiveTasks(): CloudTask[];

package/dist/lib/cloud/store.js

@@ -1,8 +1,15 @@
+/**
+ * Local SQLite persistence for cloud-dispatched tasks.
+ *
+ * Every dispatch, status poll, and list query flows through this module so
+ * that task history survives across CLI invocations without hitting the
+ * remote provider each time.
+ */
 import * as fs from 'fs';
 import * as path from 'path';
-import * as os from 'os';
-import Database from 'better-sqlite3';
-const CLOUD_DIR = path.join(os.homedir(), '.agents', 'cloud');
+import Database from '../sqlite.js';
+import { getAgentsDir } from '../state.js';
+const CLOUD_DIR = path.join(getAgentsDir(), 'cloud');
 const DB_PATH = path.join(CLOUD_DIR, 'tasks.db');
 const SCHEMA = `
 CREATE TABLE IF NOT EXISTS tasks (
@@ -24,6 +31,7 @@ CREATE INDEX IF NOT EXISTS idx_tasks_status ON tasks(status);
 CREATE INDEX IF NOT EXISTS idx_tasks_created ON tasks(created_at DESC);
 `;
 let _db = null;
+/** Lazy-initialize the SQLite connection, creating the database and schema on first access. */
 function db() {
     if (_db)
         return _db;
@@ -33,12 +41,14 @@ function db() {
     _db.exec(SCHEMA);
     return _db;
 }
+/** Persist a task snapshot, replacing any existing row with the same ID. */
 export function insertTask(task) {
     db().prepare(`
     INSERT OR REPLACE INTO tasks (id, provider, status, agent, prompt, repo, branch, pr_url, summary, created_at, updated_at)
     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
   `).run(task.id, task.provider, task.status, task.agent ?? null, task.prompt, task.repo ?? null, task.branch ?? null, task.prUrl ?? null, task.summary ?? null, task.createdAt, task.updatedAt);
 }
+/** Update a task's status and optionally patch summary, PR URL, or branch. */
 export function updateTaskStatus(id, status, extra) {
     const now = new Date().toISOString();
     const sets = ['status = ?', 'updated_at = ?'];
@@ -58,10 +68,12 @@ export function updateTaskStatus(id, status, extra) {
     params.push(id);
     db().prepare(`UPDATE tasks SET ${sets.join(', ')} WHERE id = ?`).run(...params);
 }
+/** Fetch a single task by its provider-assigned ID, or null if not found locally. */
 export function getTaskById(id) {
     const row = db().prepare('SELECT * FROM tasks WHERE id = ?').get(id);
     return row ? rowToTask(row) : null;
 }
+/** List tasks with optional provider/status filters, ordered newest-first. */
 export function listTasks(filter) {
     const clauses = [];
     const params = [];
@@ -78,6 +90,14 @@ export function listTasks(filter) {
     const rows = db().prepare(`SELECT * FROM tasks ${where} ORDER BY created_at DESC LIMIT ?`).all(...params, limit);
     return rows.map(rowToTask);
 }
+const TERMINAL_STATUSES = ['completed', 'failed', 'cancelled'];
+/** Return tasks still in a transient state (queued, allocating, running, input_required). */
+export function listActiveTasks() {
+    const placeholders = TERMINAL_STATUSES.map(() => '?').join(', ');
+    const rows = db().prepare(`SELECT * FROM tasks WHERE status NOT IN (${placeholders}) ORDER BY created_at DESC`).all(...TERMINAL_STATUSES);
+    return rows.map(rowToTask);
+}
+/** Map a raw SQLite row to a typed CloudTask, converting snake_case columns to camelCase. */
 function rowToTask(row) {
     return {
         id: row.id,
@@ -93,4 +113,3 @@ function rowToTask(row) {
         updatedAt: row.updated_at,
     };
 }
-//# sourceMappingURL=store.js.map

package/dist/lib/cloud/stream.d.ts

@@ -1,3 +1,9 @@
+/**
+ * Server-Sent Events parser and terminal renderer for cloud task output.
+ *
+ * Used by `agents cloud logs -f` to stream live output from a running task
+ * and by the post-dispatch follow mode to show progress inline.
+ */
 import type { CloudEvent } from './types.js';
 /**
  * Parse a Server-Sent Events stream into CloudEvents.
@@ -15,4 +21,3 @@ export declare function renderStream(events: AsyncIterable<CloudEvent>, options?
     summary?: string;
     prUrl?: string;
 }>;
-//# sourceMappingURL=stream.d.ts.map

package/dist/lib/cloud/stream.js

@@ -1,4 +1,58 @@
+/**
+ * Server-Sent Events parser and terminal renderer for cloud task output.
+ *
+ * Used by `agents cloud logs -f` to stream live output from a running task
+ * and by the post-dispatch follow mode to show progress inline.
+ */
 import chalk from 'chalk';
+/**
+ * Translate a (server-emitted SSE event name, raw data string) pair into a
+ * typed CloudEvent. Unknown event names are surfaced as `{ type: 'unknown' }`
+ * rather than dropped — that's the whole point of widening the taxonomy.
+ */
+function decodeSSEFrame(name, data, timestamp) {
+    let parsed = {};
+    try {
+        parsed = data ? JSON.parse(data) : {};
+    }
+    catch {
+        // non-JSON payloads are kept as raw text below
+    }
+    switch (name) {
+        case 'status':
+            return { type: 'status', status: parsed.status ?? 'running', timestamp };
+        case 'text':
+        case 'output':
+        case 'message':
+            return { type: 'text', content: parsed.content ?? data, timestamp };
+        case 'thinking':
+            return { type: 'thinking', content: parsed.content ?? data, timestamp };
+        case 'tool_use':
+            return { type: 'tool_use', tool: parsed.tool ?? '', input: parsed.input, timestamp };
+        case 'tool_result':
+            return { type: 'tool_result', tool: parsed.tool ?? '', output: parsed.output, timestamp };
+        case 'usage':
+            return {
+                type: 'usage',
+                model: parsed.model,
+                inputTokens: parsed.inputTokens,
+                outputTokens: parsed.outputTokens,
+                timestamp,
+            };
+        case 'done':
+            return {
+                type: 'done',
+                status: parsed.status,
+                prUrl: parsed.prUrl,
+                summary: typeof parsed.output === 'string' ? parsed.output.slice(0, 2000) : parsed.summary,
+                timestamp,
+            };
+        case 'error':
+            return { type: 'error', message: parsed.message ?? data, timestamp };
+        default:
+            return { type: 'unknown', name, data, timestamp };
+    }
+}
 /**
  * Parse a Server-Sent Events stream into CloudEvents.
  * Handles `event:`, `data:`, keepalive comments, and multi-line data.
@@ -32,11 +86,7 @@ export async function* parseSSE(response) {
                 else if (line === '') {
                     // Empty line = end of event
                     if (currentEvent || currentData) {
-                        yield {
-                            type: (currentEvent || 'output'),
-                            data: currentData,
-                            timestamp: new Date().toISOString(),
-                        };
+                        yield decodeSSEFrame(currentEvent || 'output', currentData, new Date().toISOString());
                         currentEvent = '';
                         currentData = '';
                     }
@@ -45,11 +95,7 @@ export async function* parseSSE(response) {
         }
         // Flush remaining
         if (currentEvent || currentData) {
-            yield {
-                type: (currentEvent || 'output'),
-                data: currentData,
-                timestamp: new Date().toISOString(),
-            };
+            yield decodeSSEFrame(currentEvent || 'output', currentData, new Date().toISOString());
         }
     }
     finally {
@@ -71,50 +117,61 @@ export async function renderStream(events, options) {
         }
         switch (event.type) {
             case 'status': {
-                try {
-                    const parsed = JSON.parse(event.data);
-                    lastStatus = parsed.status ?? lastStatus;
-                    const label = statusLabel(lastStatus);
-                    process.stderr.write(`${label}\n`);
-                }
-                catch {
-                    process.stderr.write(chalk.dim(`[status] ${event.data}\n`));
-                }
+                lastStatus = event.status;
+                process.stderr.write(`${statusLabel(lastStatus)}\n`);
                 break;
             }
-            case 'output': {
-                try {
-                    const parsed = JSON.parse(event.data);
-                    process.stdout.write(parsed.content ?? event.data);
-                }
-                catch {
-                    process.stdout.write(event.data);
+            case 'text': {
+                process.stdout.write(event.content);
+                break;
+            }
+            case 'thinking': {
+                process.stderr.write(chalk.dim(`[thinking] ${event.content}\n`));
+                break;
+            }
+            case 'tool_use': {
+                process.stderr.write(chalk.cyan(`[tool] ${event.tool}\n`));
+                break;
+            }
+            case 'tool_result': {
+                // Tool results are usually verbose; just acknowledge inline.
+                process.stderr.write(chalk.dim(`[tool_result] ${event.tool}\n`));
+                break;
+            }
+            case 'usage': {
+                const parts = [];
+                if (event.model)
+                    parts.push(event.model);
+                if (event.inputTokens != null)
+                    parts.push(`in=${event.inputTokens}`);
+                if (event.outputTokens != null)
+                    parts.push(`out=${event.outputTokens}`);
+                if (parts.length > 0) {
+                    process.stderr.write(chalk.dim(`[usage] ${parts.join(' ')}\n`));
                 }
                 break;
             }
             case 'done': {
-                try {
-                    const parsed = JSON.parse(event.data);
-                    lastStatus = parsed.status ?? 'completed';
-                    summary = parsed.output?.slice(0, 2000);
-                    prUrl = parsed.prUrl;
-                }
-                catch {
-                    lastStatus = 'completed';
-                }
-                const label = statusLabel(lastStatus);
-                process.stderr.write(`\n${label}\n`);
+                lastStatus = event.status ?? 'completed';
+                summary = event.summary;
+                prUrl = event.prUrl;
+                process.stderr.write(`\n${statusLabel(lastStatus)}\n`);
                 break;
             }
             case 'error': {
-                process.stderr.write(chalk.red(`Error: ${event.data}\n`));
+                process.stderr.write(chalk.red(`Error: ${event.message}\n`));
                 lastStatus = 'failed';
                 break;
             }
+            case 'unknown': {
+                process.stderr.write(chalk.dim(`[${event.name}] ${event.data}\n`));
+                break;
+            }
         }
     }
     return { status: lastStatus, summary, prUrl };
 }
+/** Map a task status string to a colored terminal label. */
 function statusLabel(status) {
     switch (status) {
         case 'queued':
@@ -135,4 +192,3 @@ function statusLabel(status) {
             return chalk.dim(`[${status}]`);
     }
 }
-//# sourceMappingURL=stream.js.map