@phnx-labs/agents-cli 1.12.0 → 1.14.1

package/dist/commands/exec.js

@@ -1,31 +1,76 @@
+/**
+ * Agent execution command.
+ *
+ * Registers the `agents run` command which spawns agent CLIs interactively
+ * or headlessly. Supports profile resolution, version rotation, secrets
+ * injection, and multi-agent fallback chains for rate-limit resilience.
+ */
 import chalk from 'chalk';
 import { buildExecCommand, parseExecEnv, execAgent, runWithFallback, AGENT_COMMANDS, } from '../lib/exec.js';
+import { profileExists, resolveProfileForRun } from '../lib/profiles.js';
+import { readBundle, resolveBundleEnv } from '../lib/secrets/bundles.js';
+import { getConfiguredRunStrategy, normalizeRunStrategy, resolveRunVersion, RUN_STRATEGIES, } from '../lib/rotate.js';
+import { resolveVersionAlias } from '../lib/versions.js';
 const VALID_AGENTS = Object.keys(AGENT_COMMANDS);
+/** Type guard that narrows a string to a known AgentId. */
 function isValidAgent(agent) {
     return VALID_AGENTS.includes(agent);
 }
+/** Build a one-line banner describing which version the rotation picked. */
+function formatRotationBanner(result) {
+    const { picked, healthy, excluded } = result;
+    const label = picked.email ? `${picked.email} · ${picked.agent}@${picked.version}` : `${picked.agent}@${picked.version}`;
+    const ratio = `${healthy.length} of ${healthy.length + excluded.length} healthy`;
+    return `[agents] rotation picked ${label} (${ratio})`;
+}
+/** Register the `agents run <agent> [prompt]` command. */
 export function registerRunCommand(program) {
     program
-        .command('run <agent> <prompt>')
-        .description('Execute an agent non-interactively from scripts, scheduled jobs, or automation pipelines. Returns when the agent finishes.')
+        .command('run <agent> [prompt]')
+        .description('Execute an agent. Pass a prompt for headless runs; omit it to launch the agent interactively.')
         .option('-m, --mode <mode>', 'How much the agent can do: plan (read-only), edit (can write files), full (writes + all permissions)', 'plan')
         .option('-e, --effort <effort>', 'Reasoning effort: low | medium | high | xhigh | max | auto (claude and codex only)', 'auto')
         .option('--model <model>', 'Override the model directly (e.g., claude-opus-4-6)')
         .option('--env <key=value>', 'Pass environment variable to the agent (repeatable, e.g., --env DEBUG=1 --env API_KEY=xyz)', (val, prev) => [...prev, val], [])
+        .option('--secrets <bundle>', 'Inject a secrets bundle (repeatable). Values resolve from macOS Keychain at run time. See `agents secrets`.', (val, prev) => [...prev, val], [])
         .option('--cwd <dir>', 'Working directory for the agent (defaults to current directory)')
         .option('--add-dir <dir>', 'Grant access to an additional directory outside the project (Claude only, repeatable)', (val, prev) => [...prev, val], [])
         .option('--json', 'Stream events as JSON lines (for parsing by other tools)')
         .option('--headless', 'Non-interactive mode (default for run)', true)
+        .option('-i, --interactive', 'Force interactive mode even when a prompt is provided')
         .option('--session-id <id>', 'Resume a previous conversation (Claude only)')
         .option('--verbose', 'Show detailed execution logs')
         .option('--timeout <duration>', 'Kill the agent after this duration (e.g., 30m, 1h, 2h30m)')
         .option('--fallback <agents>', 'Comma-separated agents to try on rate-limit failure. Each entry accepts an optional @version pin (e.g., codex@0.116.0,gemini). The primary runs first; if it exits with a rate-limit error, the next agent picks up via /continue handoff.')
+        .option('-r, --rotate', 'Shortcut for --strategy rotate. Ignored when @version is pinned.')
+        .option('--strategy <strategy>', 'Version/account selection strategy: pinned | available | rotate. Defaults to run.<agent>.strategy, then pinned.')
+        .option('--acp', 'Route through the Agent Client Protocol instead of direct exec. Supported for gemini, claude (via @zed-industries/claude-code-acp adapter). Unified event stream; emits ndjson when --json.')
         .addHelpText('after', `
+Modes:
+  With a prompt -> headless (pipes output, no TTY, exits when the agent finishes).
+  Without a prompt -> interactive (launches the agent's TUI; stdio is fully inherited).
+
+Run strategy:
+  pinned     Use the workspace/global pinned version from agents.yaml.
+  available  Use the pinned version if it has usage available; otherwise switch
+             to another signed-in version with usage available.
+  rotate     Pick the signed-in account with usage available and the most
+             headroom; last-active breaks ties.
+  Configure with run.<agent>.strategy in agents.yaml, or override with
+  --strategy. --rotate is kept as a shortcut for --strategy rotate.
+  Ignored when @version is pinned, when a profile is used, or with --fallback.
+
 Examples:
-  # Quick read-only analysis (plan mode, low reasoning effort)
-  agents run claude "summarize recent git commits" --mode plan --effort low
+  # Interactive with the pinned default version
+  agents run claude
+
+  # Interactive, rotate to the least-used healthy account
+  agents run claude --strategy rotate
+
+  # Headless, switch away from the pinned version when usage is unavailable
+  agents run claude "summarize recent git commits" --mode plan --strategy available
 
-  # Edit files with the agent's default effort
+  # Pin a specific version (rotation ignored)
   agents run codex@0.116.0 "fix linting errors in src/" --mode edit
 
   # Full autonomy with maximum reasoning for a complex task
@@ -40,20 +85,93 @@ Examples:
   # Auto-fallback to codex then gemini if claude hits a rate limit
   agents run claude "refactor auth module" --mode edit --fallback codex,gemini
 
+  # Inject a named secrets bundle (keychain-backed)
+  agents run claude "charge a test card" --secrets prod-stripe
+
   # Pin fallback versions: primary claude@2.0.65, fallback codex@0.116.0 then gemini
   agents run claude@2.0.65 "deep refactor" --fallback codex@0.116.0,gemini
-
-Note: 'agents run' executes non-interactively (no TTY). To work interactively with
-the agent, launch it directly (e.g., 'claude', 'codex') instead of using 'run'.
 `)
         .action(async (agentSpec, prompt, options) => {
         // Parse agent@version
-        const [agent, version] = agentSpec.split('@');
-        if (!isValidAgent(agent)) {
-            console.error(chalk.red(`Unknown agent: ${agent}`));
-            console.error(chalk.gray(`Available: ${VALID_AGENTS.join(', ')}`));
+        const [rawAgent, rawVersion] = agentSpec.split('@');
+        let agent;
+        let version = rawVersion || undefined;
+        let profileEnv;
+        let fromProfile = false;
+        if (isValidAgent(rawAgent)) {
+            agent = rawAgent;
+        }
+        else if (profileExists(rawAgent)) {
+            // Not a known agent id, but a profile by this name exists. Profiles
+            // bind (host agent, version, env overrides, keychain-backed auth)
+            // so Chinese models (Kimi, DeepSeek, Qwen, GLM) can run inside
+            // Claude Code without a local proxy.
+            try {
+                const resolved = resolveProfileForRun(rawAgent);
+                agent = resolved.agent;
+                if (!version)
+                    version = resolved.version;
+                profileEnv = resolved.env;
+                fromProfile = true;
+                process.stderr.write(chalk.gray(`Resolved profile '${resolved.profileName}' -> ${agent}${version ? `@${version}` : ''}\n`));
+            }
+            catch (err) {
+                console.error(chalk.red(err.message));
+                process.exit(1);
+            }
+        }
+        else {
+            console.error(chalk.red(`Unknown agent: ${rawAgent}`));
+            console.error(chalk.gray(`Available agents: ${VALID_AGENTS.join(', ')}`));
+            console.error(chalk.gray(`Or add a profile: agents profiles add <name>`));
+            process.exit(1);
+        }
+        version = resolveVersionAlias(agent, version);
+        const cwd = options.cwd ?? process.cwd();
+        const configuredStrategy = getConfiguredRunStrategy(agent, cwd);
+        const explicitStrategy = options.strategy ? normalizeRunStrategy(options.strategy) : null;
+        if (options.strategy && !explicitStrategy) {
+            console.error(chalk.red(`Invalid strategy: ${options.strategy}. Use ${RUN_STRATEGIES.join(', ')}.`));
+            process.exit(1);
+        }
+        if (options.rotate && explicitStrategy && explicitStrategy !== 'rotate') {
+            console.error(chalk.red('--rotate conflicts with --strategy. Use one strategy override.'));
             process.exit(1);
         }
+        const strategy = options.rotate ? 'rotate' : explicitStrategy ?? configuredStrategy;
+        // Strategy only applies to bare agent invocations. Explicit @version,
+        // profiles, and fallback chains already define their execution target.
+        if (strategy !== 'pinned' || options.rotate || explicitStrategy) {
+            if (version) {
+                process.stderr.write(chalk.yellow(`[agents] strategy ${strategy} ignored: version ${version} is pinned\n`));
+            }
+            else if (fromProfile) {
+                process.stderr.write(chalk.yellow(`[agents] strategy ${strategy} ignored: profile pins its own version/auth\n`));
+            }
+            else if (options.fallback) {
+                process.stderr.write(chalk.yellow(`[agents] strategy ${strategy} ignored: --fallback pins versions directly\n`));
+            }
+            else {
+                try {
+                    const resolved = await resolveRunVersion(agent, strategy, cwd);
+                    if (resolved.version) {
+                        version = resolved.version;
+                        if (resolved.rotation) {
+                            const banner = strategy === 'available'
+                                ? formatRotationBanner(resolved.rotation).replace('rotation picked', 'available picked')
+                                : formatRotationBanner(resolved.rotation);
+                            process.stderr.write(chalk.gray(banner + '\n'));
+                        }
+                    }
+                    else {
+                        process.stderr.write(chalk.yellow(`[agents] strategy ${strategy} found no usable ${agent} version; falling back to defaults\n`));
+                    }
+                }
+                catch (err) {
+                    process.stderr.write(chalk.yellow(`[agents] strategy ${strategy} skipped: ${err.message}\n`));
+                }
+            }
+        }
         const mode = options.mode;
         if (!['plan', 'edit', 'full'].includes(mode)) {
             console.error(chalk.red(`Invalid mode: ${mode}. Use 'plan', 'edit', or 'full'`));
@@ -64,18 +182,40 @@ the agent, launch it directly (e.g., 'claude', 'codex') instead of using 'run'.
             console.error(chalk.red(`Invalid effort: ${effort}. Use 'low', 'medium', 'high', 'xhigh', 'max', or 'auto'`));
             process.exit(1);
         }
-        let env;
+        let userEnv;
         try {
-            env = parseExecEnv(options.env);
+            userEnv = parseExecEnv(options.env);
         }
         catch (err) {
             console.error(chalk.red(err.message));
             process.exit(1);
         }
+        // Resolve --secrets bundles in flag order. Later bundles override earlier
+        // ones. Any resolution failure (missing keychain item, blocked exec ref)
+        // aborts before spawn so the agent never sees a partial env.
+        let secretsEnv = {};
+        for (const bundleName of options.secrets) {
+            try {
+                const bundle = readBundle(bundleName);
+                secretsEnv = { ...secretsEnv, ...resolveBundleEnv(bundle) };
+            }
+            catch (err) {
+                console.error(chalk.red(err.message));
+                process.exit(1);
+            }
+        }
+        // Merge order (later wins): profile env < secrets bundles < --env K=V.
+        // Profile carries provider auth; secrets bundles carry user-defined
+        // values; --env is the per-invocation override.
+        const hasOverrides = profileEnv || options.secrets.length > 0 || userEnv;
+        const env = hasOverrides
+            ? { ...(profileEnv ?? {}), ...secretsEnv, ...(userEnv ?? {}) }
+            : undefined;
         const execOptions = {
             agent,
             version,
             prompt,
+            interactive: options.interactive,
             mode,
             effort,
             cwd: options.cwd,
@@ -88,8 +228,22 @@ the agent, launch it directly (e.g., 'claude', 'codex') instead of using 'run'.
             timeout: options.timeout,
             env,
         };
+        if (options.interactive) {
+            if (options.fallback) {
+                console.error(chalk.red('--interactive is not compatible with --fallback. Fallback only works for headless prompt runs.'));
+                process.exit(1);
+            }
+            if (options.acp) {
+                console.error(chalk.red('--interactive is not compatible with --acp. ACP is a headless protocol.'));
+                process.exit(1);
+            }
+        }
         const fallback = [];
         if (options.fallback) {
+            if (prompt === undefined) {
+                console.error(chalk.red('--fallback requires a prompt. Fallback hands off headless runs only — interactive sessions can\'t be resumed on a different CLI.'));
+                process.exit(1);
+            }
             const entries = options.fallback.split(',').map(s => s.trim()).filter(Boolean);
             for (const entry of entries) {
                 const [fbAgent, fbVersion] = entry.split('@');
@@ -102,16 +256,50 @@ the agent, launch it directly (e.g., 'claude', 'codex') instead of using 'run'.
                     console.error(chalk.red(`Fallback cannot include the primary agent (${agent}). Rate-limit fallback only helps when switching providers.`));
                     process.exit(1);
                 }
-                fallback.push({ agent: fbAgent, version: fbVersion || undefined });
+                fallback.push({ agent: fbAgent, version: resolveVersionAlias(fbAgent, fbVersion || undefined) });
+            }
+        }
+        if (options.acp) {
+            if (prompt === undefined) {
+                console.error(chalk.red('--acp requires a prompt. ACP is a programmatic protocol; interactive TUI sessions still use the native CLI.'));
+                process.exit(1);
+            }
+            if (fallback.length > 0) {
+                console.error(chalk.red('--acp is not compatible with --fallback yet. Drop one.'));
+                process.exit(1);
+            }
+            const { supportsAcp } = await import('../lib/acp/harnesses.js');
+            if (!supportsAcp(agent)) {
+                console.error(chalk.red(`Agent '${agent}' does not support ACP. Drop --acp to use direct exec.`));
+                process.exit(1);
+            }
+            const { runAcpHeadless } = await import('../lib/acp/run.js');
+            try {
+                const exitCode = await runAcpHeadless({
+                    agent,
+                    prompt,
+                    cwd: options.cwd ?? process.cwd(),
+                    mode,
+                    json: options.json ?? false,
+                });
+                process.exit(exitCode);
+            }
+            catch (err) {
+                console.error(chalk.red(`ACP run failed for ${agent}: ${err.message}`));
+                process.exit(1);
             }
         }
-        // Show what we're running (stderr so stdout stays clean for piping)
         const cmd = buildExecCommand(execOptions);
         process.stderr.write(chalk.gray(`Running: ${cmd.join(' ')}\n\n`));
         try {
-            const exitCode = fallback.length > 0
-                ? await runWithFallback({ ...execOptions, fallback })
-                : await execAgent(execOptions);
+            let exitCode;
+            if (fallback.length > 0) {
+                // fallback requires a prompt — enforced above, narrow the type here.
+                exitCode = await runWithFallback({ ...execOptions, prompt: prompt, fallback });
+            }
+            else {
+                exitCode = await execAgent(execOptions);
+            }
             process.exit(exitCode);
         }
         catch (err) {
@@ -120,4 +308,3 @@ the agent, launch it directly (e.g., 'claude', 'codex') instead of using 'run'.
         }
     });
 }
-//# sourceMappingURL=exec.js.map

package/dist/commands/factory.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Software Factory CLI -- thin client over `prix/factory/service`.
+ *
+ * One verb today:
+ *
+ *   agents factory submit <linear-ref>   POST /factory/submit
+ *
+ * Everything else (planner pod, worker dispatch, PR-merged/CI-failed
+ * webhooks, retry caps, heartbeat reaper) lives server-side in
+ * `agents/prix/factory/service/src/factory.ts`, driven by the
+ * `factory-tick` k8s CronJob. The laptop is optional after submit.
+ *
+ * Future verbs (list / status / tail / cancel / message) are intentionally
+ * deferred until the matching server endpoints land; they'll be thin
+ * clients too. No supervisor, ledger, oracle, or `~/.agents/factory/`
+ * registry on the laptop -- ever.
+ */
+import type { Command } from 'commander';
+export declare function registerFactoryCommands(program: Command): void;

package/dist/commands/factory.js

@@ -0,0 +1,71 @@
+import chalk from 'chalk';
+import * as fs from 'fs';
+import * as path from 'path';
+import { homedir } from 'os';
+import { betaEnableHint, isBetaEnabled } from '../lib/beta.js';
+const FACTORY_URL = process.env.FACTORY_FLOOR_URL ?? 'https://agents.427yosemite.com';
+function die(msg, code = 1) {
+    console.error(chalk.red(msg));
+    process.exit(code);
+}
+function readRushToken() {
+    const userYaml = path.join(homedir(), '.rush', 'user.yaml');
+    if (!fs.existsSync(userYaml)) {
+        die('Not logged in to Rush. Run `rush login` first.');
+    }
+    const raw = fs.readFileSync(userYaml, 'utf-8');
+    const match = raw.match(/access_token:\s*([^\s#]+)/);
+    if (!match) {
+        die('No session token in ~/.rush/user.yaml. Run `rush login` first.');
+    }
+    return match[1].replace(/^['"]|['"]$/g, '');
+}
+async function postFactorySubmit(ref) {
+    const token = readRushToken();
+    const res = await fetch(`${FACTORY_URL}/factory/submit`, {
+        method: 'POST',
+        headers: {
+            'Authorization': `Bearer ${token}`,
+            'Content-Type': 'application/json',
+        },
+        body: JSON.stringify({ ref }),
+    });
+    if (!res.ok) {
+        const body = await res.text().catch(() => '');
+        die(`Factory submit failed (${res.status}): ${body.slice(0, 400)}`);
+    }
+    return res.json();
+}
+export function registerFactoryCommands(program) {
+    const enabled = isBetaEnabled('factory');
+    const factory = program
+        .command('factory', { hidden: !enabled })
+        .description('Software Factory -- submit Linear tickets to the cloud orchestrator.')
+        .addHelpText('after', `
+Examples:
+  agents factory submit RUSH-2451
+  agents factory submit https://linear.app/getrush/issue/RUSH-2451
+`);
+    factory.hook('preAction', () => {
+        if (enabled)
+            return;
+        console.error(chalk.red('agents factory is in beta.'));
+        console.error(chalk.gray(betaEnableHint('factory')));
+        process.exit(1);
+    });
+    factory
+        .command('submit <linear-ref>')
+        .description('Submit a Linear issue (RUSH-123 or URL) to the Software Factory.')
+        .option('--json', 'Output machine-readable JSON')
+        .action(async (ref, opts) => {
+        const result = await postFactorySubmit(ref);
+        if (opts.json) {
+            console.log(JSON.stringify(result, null, 2));
+            return;
+        }
+        console.log(chalk.green(`Submitted ${result.linear_identifier} (${result.label})`));
+        console.log(`  ticket       ${result.ticket_id}`);
+        console.log(`  execution    ${result.cloud_execution_id}`);
+        console.log(`  tail output  agents cloud tail ${result.cloud_execution_id}`);
+    });
+}

package/dist/commands/fork.d.ts

@@ -1,3 +1,10 @@
+/**
+ * Repository fork command.
+ *
+ * Registers the `agents fork` command which forks the default system
+ * config repo to the user's GitHub account, reconfigures remotes
+ * (origin -> user fork, upstream -> system repo), and pushes.
+ */
 import type { Command } from 'commander';
+/** Register the `agents fork` command. */
 export declare function registerForkCommand(program: Command): void;
-//# sourceMappingURL=fork.d.ts.map

package/dist/commands/fork.js

@@ -1,9 +1,17 @@
+/**
+ * Repository fork command.
+ *
+ * Registers the `agents fork` command which forks the default system
+ * config repo to the user's GitHub account, reconfigures remotes
+ * (origin -> user fork, upstream -> system repo), and pushes.
+ */
 import chalk from 'chalk';
 import ora from 'ora';
 import { getAgentsDir, ensureAgentsDir } from '../lib/state.js';
 import { isGitRepo, isSystemRepoOrigin, getGitHubUsername, hasLocalChanges, setUpstreamRemote, setRemoteUrl, getRemoteUrl, } from '../lib/git.js';
 import { DEFAULT_SYSTEM_REPO, systemRepoSlug } from '../lib/types.js';
 import { isPromptCancelled } from './utils.js';
+/** Register the `agents fork` command. */
 export function registerForkCommand(program) {
     program
         .command('fork')
@@ -66,14 +74,14 @@ Requirements:
             spinner.succeed(`Logged in as ${username}`);
             // Fork the system repo
             const forkSpinner = ora('Forking system repo...').start();
-            const { exec } = await import('child_process');
+            const { execFile } = await import('child_process');
             const { promisify } = await import('util');
-            const execAsync = promisify(exec);
+            const execFileAsync = promisify(execFile);
             const repoSlug = systemRepoSlug(DEFAULT_SYSTEM_REPO);
             try {
                 // gh repo fork creates a fork and optionally clones it
                 // We just want to create the fork on GitHub, not clone
-                await execAsync(`gh repo fork ${repoSlug} --clone=false`);
+                await execFileAsync('gh', ['repo', 'fork', repoSlug, '--clone=false']);
                 forkSpinner.succeed(`Forked to ${username}/.agents`);
             }
             catch (err) {
@@ -136,4 +144,3 @@ Requirements:
         }
     });
 }
-//# sourceMappingURL=fork.js.map

package/dist/commands/hooks.d.ts

@@ -1,3 +1,11 @@
+/**
+ * Hook management commands for automating workflows on agent events.
+ *
+ * Implements `agents hooks` -- list, add, remove, sync, prune, and view
+ * shell scripts that fire on agent lifecycle events (session start, file
+ * edit, task completion). Central storage lives in ~/.agents/hooks/ and
+ * scripts are synced to individual version homes.
+ */
 import type { Command } from 'commander';
+/** Register the `agents hooks` command tree (list, add, remove, sync, prune, view). */
 export declare function registerHooksCommands(program: Command): void;
-//# sourceMappingURL=hooks.d.ts.map