@phnx-labs/agents-cli 1.12.0 → 1.14.1

package/dist/lib/cloud/rush.js

@@ -0,0 +1,438 @@
+/**
+ * Rush Cloud provider -- dispatches tasks to the Factory Floor via api.prix.dev.
+ *
+ * Auth: reads the session token from ~/.rush/user.yaml (written by `rush login`).
+ * Requires the Rush GitHub App installed on the target repo.
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+import * as os from 'os';
+import * as crypto from 'crypto';
+import * as yaml from 'yaml';
+import { getAgentsDir } from '../state.js';
+import { resolveDispatchRepos } from './types.js';
+import { parseSSE } from './stream.js';
+import { listInstalledVersions, getVersionHomePath } from '../versions.js';
+import { getAccountInfo } from '../agents.js';
+import { loadClaudeOauth } from '../usage.js';
+const PROXY_BASE = 'https://api.prix.dev';
+const USER_YAML = path.join(os.homedir(), '.rush', 'user.yaml');
+// Persistent consent record for uploading Claude OAuth blobs to Rush Cloud.
+// Created on first explicit consent (env var or flag); subsequent dispatches
+// see it and proceed without re-prompting.
+const RUSH_CONSENT_PATH = path.join(getAgentsDir(), 'cloud', 'rush-consent.json');
+const RUSH_CONSENT_ENV = 'AGENTS_RUSH_UPLOAD_TOKENS';
+function hasRushUploadConsent(opts) {
+    if (process.env[RUSH_CONSENT_ENV] === '1')
+        return true;
+    const po = opts?.providerOptions;
+    if (po?.uploadAccountTokens === true)
+        return true;
+    return fs.existsSync(RUSH_CONSENT_PATH);
+}
+function recordRushUploadConsent(grantedBy) {
+    try {
+        fs.mkdirSync(path.dirname(RUSH_CONSENT_PATH), { recursive: true });
+        const body = { granted_at: new Date().toISOString(), granted_by: grantedBy };
+        fs.writeFileSync(RUSH_CONSENT_PATH, JSON.stringify(body, null, 2), { mode: 0o600 });
+    }
+    catch {
+        // Non-fatal: consent persistence is a UX optimization, not a security
+        // boundary. Worst case, the user is asked to consent again next dispatch.
+    }
+}
+/** Map a Factory Floor status string to the canonical CloudTaskStatus enum. */
+function mapStatus(s) {
+    switch (s) {
+        case 'allocating': return 'allocating';
+        case 'running': return 'running';
+        case 'needs_review': return 'input_required';
+        case 'completed': return 'completed';
+        case 'failed': return 'failed';
+        case 'cancelled': return 'cancelled';
+        default: return 'running';
+    }
+}
+/** Read the Rush session access token from ~/.rush/user.yaml. */
+function readToken() {
+    if (!fs.existsSync(USER_YAML)) {
+        throw new Error('Not logged in to Rush. Run `rush login` first.');
+    }
+    const raw = fs.readFileSync(USER_YAML, 'utf-8');
+    const data = yaml.parse(raw);
+    const token = data?.session?.access_token;
+    if (!token) {
+        throw new Error('No session token in ~/.rush/user.yaml. Run `rush login` first.');
+    }
+    return token;
+}
+/** Read the user's email from the Rush session config, if available. */
+function readEmail() {
+    try {
+        const raw = fs.readFileSync(USER_YAML, 'utf-8');
+        const data = yaml.parse(raw);
+        return data?.session?.email;
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Make an authenticated request to the Rush API proxy. */
+async function api(method, endpoint, token, body) {
+    const url = endpoint.startsWith('http') ? endpoint : `${PROXY_BASE}${endpoint}`;
+    const headers = {
+        'Authorization': `Bearer ${token}`,
+        'Content-Type': 'application/json',
+    };
+    return fetch(url, {
+        method,
+        headers,
+        body: body ? JSON.stringify(body) : undefined,
+    });
+}
+/** Find the GitHub App installation ID for a given owner/repo pair. */
+async function findInstallation(token, owner, repo) {
+    const res = await api('GET', '/api/v1/github/app/installations', token);
+    if (!res.ok) {
+        throw new Error(`Failed to fetch GitHub installations (${res.status}). Is the Rush GitHub App installed?`);
+    }
+    const data = await res.json();
+    for (const inst of data.installations ?? []) {
+        if (inst.account_login?.toLowerCase() === owner.toLowerCase()) {
+            if (inst.repository_selection === 'all')
+                return inst.id;
+            if (inst.repositories?.some(r => r.name.toLowerCase() === repo.toLowerCase())) {
+                return inst.id;
+            }
+        }
+    }
+    throw new Error(`No GitHub App installation found for ${owner}/${repo}. Install the Rush GitHub App at https://github.com/apps/prix-cloud.`);
+}
+/** sha256 → hex. */
+function sha256(input) {
+    return crypto.createHash('sha256').update(input).digest('hex');
+}
+/**
+ * Strip tokens/credentials from a server error body before surfacing it.
+ * If the body is JSON with a `message` or `error` field, prefer that.
+ * Otherwise truncate and redact anything that looks like a bearer token or JWT.
+ */
+function sanitizeErrorBody(body) {
+    const MAX_LEN = 300;
+    try {
+        const parsed = JSON.parse(body);
+        const msg = (parsed.message ?? parsed.error ?? parsed.detail);
+        if (typeof msg === 'string')
+            return msg.slice(0, MAX_LEN);
+    }
+    catch { /* not JSON, fall through */ }
+    let safe = body.slice(0, MAX_LEN);
+    safe = safe.replace(/eyJ[A-Za-z0-9_-]{20,}/g, '[REDACTED_TOKEN]');
+    safe = safe.replace(/Bearer\s+\S+/gi, 'Bearer [REDACTED]');
+    safe = safe.replace(/"(access_token|refresh_token|credentials_json)"\s*:\s*"[^"]*"/g, '"$1":"[REDACTED]"');
+    if (body.length > MAX_LEN)
+        safe += '...';
+    return safe;
+}
+/**
+ * Pull `prompt_code` out of a JSON-encoded error body. Returns null when the
+ * body isn't JSON or doesn't carry one — caller falls through to the generic
+ * dispatch-failed path.
+ */
+function parsePromptCode(body) {
+    try {
+        const parsed = JSON.parse(body);
+        return typeof parsed.prompt_code === 'string' ? parsed.prompt_code : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Read the raw OAuth credentials for one Claude version. On Mac, prefer the
+ * Keychain blob (canonical). On Linux/CI, fall back to `.claude/.credentials.json`
+ * inside the version home (where the Linux Claude CLI stores its OAuth).
+ *
+ * Returns null when no credentials are findable — caller treats as "version
+ * is installed but not signed in" and skips it from the manifest.
+ */
+async function readClaudeCredentialsBlob(home) {
+    if (process.platform === 'darwin') {
+        const oauth = await loadClaudeOauth(home);
+        if (oauth && oauth.accessToken) {
+            return JSON.stringify(oauth);
+        }
+    }
+    const credsPath = path.join(home, '.claude', '.credentials.json');
+    try {
+        if (fs.existsSync(credsPath)) {
+            const raw = fs.readFileSync(credsPath, 'utf-8').trim();
+            if (raw)
+                return raw;
+        }
+    }
+    catch {
+        // fall through to null
+    }
+    return null;
+}
+/**
+ * Build a manifest of the user's local Claude installations to send on every
+ * cloud dispatch. The manifest is the contract the server uses to detect when
+ * the user has added a new account or rotated a token.
+ *
+ * Returns null when no Claude versions are signed in (the dispatch falls back
+ * to the platform-wide key, current behavior).
+ */
+export async function buildAccountManifest() {
+    const versions = listInstalledVersions('claude');
+    if (versions.length === 0)
+        return null;
+    const entries = [];
+    for (const version of versions) {
+        const home = getVersionHomePath('claude', version);
+        const info = await getAccountInfo('claude', home);
+        if (!info.email)
+            continue;
+        const blob = await readClaudeCredentialsBlob(home);
+        if (!blob)
+            continue;
+        entries.push({ version, email: info.email, cred_fp: sha256(blob) });
+    }
+    if (entries.length === 0)
+        return null;
+    entries.sort((a, b) => a.version.localeCompare(b.version));
+    const fp = sha256(JSON.stringify(entries));
+    return { fp, versions: entries };
+}
+/**
+ * Re-load OAuth blobs for the given versions so they can be uploaded to the
+ * server on a retry. Only the versions named in the manifest are loaded — we
+ * never upload tokens for versions the server hasn't asked about.
+ */
+export async function buildAccountTokensPayload(versions) {
+    const out = [];
+    for (const version of versions) {
+        const home = getVersionHomePath('claude', version);
+        const blob = await readClaudeCredentialsBlob(home);
+        if (!blob)
+            continue;
+        out.push({ version, credentials_json: blob });
+    }
+    return out;
+}
+/**
+ * Build the POST body for /api/v1/cloud-runs. Exported so tests can verify
+ * the back-compat shape (singular fields + repos[]) without needing real
+ * GitHub installations or a live Rush session. `findInstallation` is the
+ * only other I/O and it's tested by the halo/proxy integration suite.
+ */
+export function buildDispatchBody(input) {
+    if (input.resolvedRepos.length === 0) {
+        throw new Error('buildDispatchBody: resolvedRepos must have at least one entry');
+    }
+    const primary = input.resolvedRepos[0];
+    const body = {
+        agent: input.agent ?? 'claude',
+        prompt: input.prompt,
+        repos: input.resolvedRepos,
+        mode: input.mode,
+    };
+    if (input.resolvedRepos.length === 1) {
+        body.installation_id = primary.installation_id;
+        body.repo_owner = primary.repo_owner;
+        body.repo_name = primary.repo_name;
+    }
+    if (input.accountManifest) {
+        body.account_manifest = input.accountManifest;
+    }
+    if (input.accountTokens && input.accountTokens.length > 0) {
+        body.account_tokens = input.accountTokens;
+    }
+    return body;
+}
+export class RushCloudProvider {
+    id = 'rush';
+    name = 'Rush Cloud';
+    capabilities() {
+        return {
+            available: fs.existsSync(USER_YAML),
+            dispatch: true,
+            status: true,
+            list: true,
+            stream: true,
+            cancel: true,
+            message: true,
+            multiRepo: true,
+            skills: false,
+            images: false,
+        };
+    }
+    async dispatch(options) {
+        const repos = resolveDispatchRepos(options);
+        if (repos.length === 0) {
+            throw new Error('Rush Cloud requires --repo <owner/repo> (or --repo repeated for multi-repo).');
+        }
+        // Validate each repo's shape and resolve its installation_id up front.
+        // Any bad entry fails the whole dispatch — we never want a half-started
+        // multi-repo run that only found installations for some of the repos.
+        const token = readToken();
+        const parsed = repos.map((full) => {
+            const parts = full.split('/');
+            if (parts.length !== 2 || !parts[0] || !parts[1]) {
+                throw new Error(`Invalid repo format: ${JSON.stringify(full)}. Use owner/repo.`);
+            }
+            return { full, owner: parts[0], name: parts[1] };
+        });
+        const resolvedRepos = await Promise.all(parsed.map(async (r) => ({
+            installation_id: await findInstallation(token, r.owner, r.name),
+            repo_owner: r.owner,
+            repo_name: r.name,
+        })));
+        const accountManifest = await buildAccountManifest();
+        const body = buildDispatchBody({
+            agent: options.agent,
+            prompt: options.prompt,
+            mode: options.providerOptions?.mode,
+            resolvedRepos,
+            accountManifest,
+        });
+        let res = await api('POST', '/api/v1/cloud-runs', token, body);
+        // Server detects drift (new account or rotated token) by comparing the
+        // manifest's fp against what's stored. It returns 401 with a prompt_code
+        // telling the client to re-upload the actual token blobs and retry once.
+        if (res.status === 401 && accountManifest) {
+            const errBody = await res.clone().text();
+            const promptCode = parsePromptCode(errBody);
+            if (promptCode === 'NEW_ACCOUNT' || promptCode === 'TOKEN_ROTATED') {
+                // Refuse to silently exfiltrate Claude OAuth credentials. The retry
+                // path below reads accessToken+refreshToken from every installed
+                // Claude version and POSTs them to api.prix.dev. That's an explicit
+                // data-flow decision the user has to opt into.
+                if (!hasRushUploadConsent(options)) {
+                    throw new Error([
+                        `Rush Cloud asked to sync your Claude credentials (reason: ${promptCode.toLowerCase()}).`,
+                        `This would upload accessToken + refreshToken from every installed Claude version`,
+                        `to ${PROXY_BASE} so Factory Floor pods can act as your Anthropic account.`,
+                        ``,
+                        `To consent, re-run with one of:`,
+                        `  AGENTS_RUSH_UPLOAD_TOKENS=1 agents cloud run ...`,
+                        `  agents cloud run --upload-account-tokens ...   # if your CLI exposes this flag`,
+                        ``,
+                        `Consent will be recorded at ${RUSH_CONSENT_PATH} so you won't be asked again.`,
+                        `Remove that file to revoke.`,
+                    ].join('\n'));
+                }
+                // Always-on stderr notice (no isTTY gate). Scripts and CI need to see
+                // this in their captured stderr / logs.
+                const grantedBy = process.env[RUSH_CONSENT_ENV] === '1' ? 'env'
+                    : options.providerOptions?.uploadAccountTokens === true ? 'flag'
+                        : 'manual';
+                process.stderr.write(`[rush] uploading Claude OAuth credentials to ${PROXY_BASE} (reason: ${promptCode.toLowerCase()}, consent: ${grantedBy})\n`);
+                const accountTokens = await buildAccountTokensPayload(accountManifest.versions.map((v) => v.version));
+                const retryBody = buildDispatchBody({
+                    agent: options.agent,
+                    prompt: options.prompt,
+                    mode: options.providerOptions?.mode,
+                    resolvedRepos,
+                    accountManifest,
+                    accountTokens,
+                });
+                res = await api('POST', '/api/v1/cloud-runs', token, retryBody);
+                // Persist consent on first successful upload so we don't re-prompt
+                // every time tokens rotate.
+                if (res.ok && grantedBy !== 'manual') {
+                    recordRushUploadConsent(grantedBy);
+                }
+            }
+        }
+        if (!res.ok) {
+            const text = await res.text();
+            throw new Error(`Dispatch failed (${res.status}): ${sanitizeErrorBody(text)}`);
+        }
+        const data = await res.json();
+        const now = new Date().toISOString();
+        return {
+            id: data.execution_id,
+            provider: 'rush',
+            status: 'queued',
+            agent: options.agent ?? 'claude',
+            prompt: options.prompt,
+            repo: repos[0],
+            repos: repos,
+            branch: options.branch,
+            createdAt: now,
+            updatedAt: now,
+        };
+    }
+    async status(taskId) {
+        const token = readToken();
+        const res = await api('GET', `/api/v1/cloud-runs/${taskId}`, token);
+        if (!res.ok) {
+            throw new Error(`Failed to get task status (${res.status}).`);
+        }
+        const data = await res.json();
+        return {
+            id: taskId,
+            provider: 'rush',
+            status: mapStatus(data.status),
+            agent: data.agent || undefined,
+            prompt: data.prompt || '',
+            repo: data.repo_owner && data.repo_name ? `${data.repo_owner}/${data.repo_name}` : undefined,
+            branch: data.branch || undefined,
+            prUrl: data.pr_url || undefined,
+            summary: data.summary || undefined,
+            createdAt: data.created_at || new Date().toISOString(),
+            updatedAt: data.updated_at || new Date().toISOString(),
+        };
+    }
+    async list(filter) {
+        const token = readToken();
+        const params = new URLSearchParams();
+        if (filter?.status)
+            params.set('status', filter.status);
+        const qs = params.toString() ? `?${params.toString()}` : '';
+        const res = await api('GET', `/api/v1/cloud-runs${qs}`, token);
+        if (!res.ok) {
+            throw new Error(`Failed to list tasks (${res.status}).`);
+        }
+        const data = await res.json();
+        return (data.executions ?? []).map((e) => ({
+            id: e.execution_id,
+            provider: 'rush',
+            status: mapStatus(e.status),
+            agent: e.agent || undefined,
+            prompt: e.prompt || '',
+            repo: e.repo_owner && e.repo_name ? `${e.repo_owner}/${e.repo_name}` : undefined,
+            branch: e.branch || undefined,
+            prUrl: e.pr_url || undefined,
+            summary: e.summary || undefined,
+            createdAt: e.created_at || '',
+            updatedAt: e.updated_at || '',
+        }));
+    }
+    async *stream(taskId) {
+        const token = readToken();
+        const res = await fetch(`${PROXY_BASE}/api/v1/cloud-runs/${taskId}/stream`, {
+            headers: { 'Authorization': `Bearer ${token}` },
+        });
+        if (!res.ok) {
+            throw new Error(`Failed to connect to stream (${res.status}).`);
+        }
+        yield* parseSSE(res);
+    }
+    async cancel(taskId) {
+        const token = readToken();
+        const res = await api('DELETE', `/api/v1/cloud-runs/${taskId}`, token);
+        if (!res.ok) {
+            throw new Error(`Failed to cancel task (${res.status}).`);
+        }
+    }
+    async message(taskId, content) {
+        const token = readToken();
+        const res = await api('POST', `/api/v1/cloud-runs/${taskId}/message`, token, { content });
+        if (!res.ok) {
+            throw new Error(`Failed to send message (${res.status}).`);
+        }
+    }
+}

package/dist/lib/cloud/store.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Local SQLite persistence for cloud-dispatched tasks.
+ *
+ * Every dispatch, status poll, and list query flows through this module so
+ * that task history survives across CLI invocations without hitting the
+ * remote provider each time.
+ */
+import type { CloudTask, CloudProviderId, CloudTaskStatus } from './types.js';
+/** Persist a task snapshot, replacing any existing row with the same ID. */
+export declare function insertTask(task: CloudTask): void;
+/** Update a task's status and optionally patch summary, PR URL, or branch. */
+export declare function updateTaskStatus(id: string, status: CloudTaskStatus, extra?: Partial<Pick<CloudTask, 'summary' | 'prUrl' | 'branch'>>): void;
+/** Fetch a single task by its provider-assigned ID, or null if not found locally. */
+export declare function getTaskById(id: string): CloudTask | null;
+/** List tasks with optional provider/status filters, ordered newest-first. */
+export declare function listTasks(filter?: {
+    provider?: CloudProviderId;
+    status?: CloudTaskStatus;
+    limit?: number;
+}): CloudTask[];
+/** Return tasks still in a transient state (queued, allocating, running, input_required). */
+export declare function listActiveTasks(): CloudTask[];

package/dist/lib/cloud/store.js

@@ -0,0 +1,115 @@
+/**
+ * Local SQLite persistence for cloud-dispatched tasks.
+ *
+ * Every dispatch, status poll, and list query flows through this module so
+ * that task history survives across CLI invocations without hitting the
+ * remote provider each time.
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+import Database from '../sqlite.js';
+import { getAgentsDir } from '../state.js';
+const CLOUD_DIR = path.join(getAgentsDir(), 'cloud');
+const DB_PATH = path.join(CLOUD_DIR, 'tasks.db');
+const SCHEMA = `
+CREATE TABLE IF NOT EXISTS tasks (
+  id TEXT PRIMARY KEY,
+  provider TEXT NOT NULL,
+  status TEXT NOT NULL,
+  agent TEXT,
+  prompt TEXT NOT NULL,
+  repo TEXT,
+  branch TEXT,
+  pr_url TEXT,
+  summary TEXT,
+  created_at TEXT NOT NULL,
+  updated_at TEXT NOT NULL,
+  provider_data TEXT
+);
+CREATE INDEX IF NOT EXISTS idx_tasks_provider ON tasks(provider);
+CREATE INDEX IF NOT EXISTS idx_tasks_status ON tasks(status);
+CREATE INDEX IF NOT EXISTS idx_tasks_created ON tasks(created_at DESC);
+`;
+let _db = null;
+/** Lazy-initialize the SQLite connection, creating the database and schema on first access. */
+function db() {
+    if (_db)
+        return _db;
+    fs.mkdirSync(CLOUD_DIR, { recursive: true });
+    _db = new Database(DB_PATH);
+    _db.pragma('journal_mode = WAL');
+    _db.exec(SCHEMA);
+    return _db;
+}
+/** Persist a task snapshot, replacing any existing row with the same ID. */
+export function insertTask(task) {
+    db().prepare(`
+    INSERT OR REPLACE INTO tasks (id, provider, status, agent, prompt, repo, branch, pr_url, summary, created_at, updated_at)
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+  `).run(task.id, task.provider, task.status, task.agent ?? null, task.prompt, task.repo ?? null, task.branch ?? null, task.prUrl ?? null, task.summary ?? null, task.createdAt, task.updatedAt);
+}
+/** Update a task's status and optionally patch summary, PR URL, or branch. */
+export function updateTaskStatus(id, status, extra) {
+    const now = new Date().toISOString();
+    const sets = ['status = ?', 'updated_at = ?'];
+    const params = [status, now];
+    if (extra?.summary !== undefined) {
+        sets.push('summary = ?');
+        params.push(extra.summary);
+    }
+    if (extra?.prUrl !== undefined) {
+        sets.push('pr_url = ?');
+        params.push(extra.prUrl);
+    }
+    if (extra?.branch !== undefined) {
+        sets.push('branch = ?');
+        params.push(extra.branch);
+    }
+    params.push(id);
+    db().prepare(`UPDATE tasks SET ${sets.join(', ')} WHERE id = ?`).run(...params);
+}
+/** Fetch a single task by its provider-assigned ID, or null if not found locally. */
+export function getTaskById(id) {
+    const row = db().prepare('SELECT * FROM tasks WHERE id = ?').get(id);
+    return row ? rowToTask(row) : null;
+}
+/** List tasks with optional provider/status filters, ordered newest-first. */
+export function listTasks(filter) {
+    const clauses = [];
+    const params = [];
+    if (filter?.provider) {
+        clauses.push('provider = ?');
+        params.push(filter.provider);
+    }
+    if (filter?.status) {
+        clauses.push('status = ?');
+        params.push(filter.status);
+    }
+    const where = clauses.length > 0 ? `WHERE ${clauses.join(' AND ')}` : '';
+    const limit = filter?.limit ?? 50;
+    const rows = db().prepare(`SELECT * FROM tasks ${where} ORDER BY created_at DESC LIMIT ?`).all(...params, limit);
+    return rows.map(rowToTask);
+}
+const TERMINAL_STATUSES = ['completed', 'failed', 'cancelled'];
+/** Return tasks still in a transient state (queued, allocating, running, input_required). */
+export function listActiveTasks() {
+    const placeholders = TERMINAL_STATUSES.map(() => '?').join(', ');
+    const rows = db().prepare(`SELECT * FROM tasks WHERE status NOT IN (${placeholders}) ORDER BY created_at DESC`).all(...TERMINAL_STATUSES);
+    return rows.map(rowToTask);
+}
+/** Map a raw SQLite row to a typed CloudTask, converting snake_case columns to camelCase. */
+function rowToTask(row) {
+    return {
+        id: row.id,
+        provider: row.provider,
+        status: row.status,
+        agent: row.agent || undefined,
+        prompt: row.prompt,
+        repo: row.repo || undefined,
+        branch: row.branch || undefined,
+        prUrl: row.pr_url || undefined,
+        summary: row.summary || undefined,
+        createdAt: row.created_at,
+        updatedAt: row.updated_at,
+    };
+}

package/dist/lib/cloud/stream.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Server-Sent Events parser and terminal renderer for cloud task output.
+ *
+ * Used by `agents cloud logs -f` to stream live output from a running task
+ * and by the post-dispatch follow mode to show progress inline.
+ */
+import type { CloudEvent } from './types.js';
+/**
+ * Parse a Server-Sent Events stream into CloudEvents.
+ * Handles `event:`, `data:`, keepalive comments, and multi-line data.
+ */
+export declare function parseSSE(response: Response): AsyncIterable<CloudEvent>;
+/**
+ * Render a stream of CloudEvents to the terminal.
+ * Returns the final status and summary when the stream ends.
+ */
+export declare function renderStream(events: AsyncIterable<CloudEvent>, options?: {
+    json?: boolean;
+}): Promise<{
+    status: string;
+    summary?: string;
+    prUrl?: string;
+}>;