@phnx-labs/agents-cli 1.18.5 → 1.19.0

package/dist/lib/fs-atomic.js

@@ -0,0 +1,76 @@
+import * as fs from 'fs';
+import * as path from 'path';
+import { randomBytes } from 'crypto';
+import lockfile from 'proper-lockfile';
+const LOCK_STALE_MS = 5_000;
+const LOCK_RETRIES = 5;
+// Reused across all sleepSync calls — avoids allocating a new SAB each time.
+const _sleepBuf = new Int32Array(new SharedArrayBuffer(4));
+export function sleepSync(ms) {
+    Atomics.wait(_sleepBuf, 0, 0, ms);
+}
+/**
+ * Ensures the target file (and its parent directory) exist so proper-lockfile
+ * can create a sibling .lock directory. Created with flag 'wx' so concurrent
+ * creation races are safe (EEXIST is swallowed).
+ */
+export function ensureLockTarget(filePath, initialContent = '', dirMode) {
+    fs.mkdirSync(path.dirname(filePath), { recursive: true, ...(dirMode != null ? { mode: dirMode } : {}) });
+    if (fs.existsSync(filePath))
+        return;
+    try {
+        fs.writeFileSync(filePath, initialContent, { encoding: 'utf-8', flag: 'wx' });
+    }
+    catch (err) {
+        if (err?.code !== 'EEXIST')
+            throw err;
+    }
+}
+/**
+ * Writes content to filePath via a temp file + rename so readers never see a
+ * partial write. On POSIX, rename(2) is atomic.
+ */
+export function atomicWriteFileSync(filePath, content) {
+    const tmpPath = `${filePath}.tmp-${process.pid}-${randomBytes(8).toString('hex')}`;
+    fs.writeFileSync(tmpPath, content, 'utf-8');
+    try {
+        fs.renameSync(tmpPath, filePath);
+    }
+    catch (err) {
+        try {
+            fs.unlinkSync(tmpPath);
+        }
+        catch { /* best-effort cleanup */ }
+        throw err;
+    }
+}
+/**
+ * Acquires an exclusive proper-lockfile lock on filePath, runs fn, then
+ * releases the lock. Retries up to LOCK_RETRIES times with linear back-off.
+ * Breaks stale locks older than LOCK_STALE_MS.
+ */
+export function withFileLock(filePath, fn) {
+    let release = null;
+    let lastError;
+    for (let attempt = 0; attempt <= LOCK_RETRIES; attempt++) {
+        try {
+            release = lockfile.lockSync(filePath, { stale: LOCK_STALE_MS });
+            break;
+        }
+        catch (err) {
+            lastError = err;
+            if (attempt < LOCK_RETRIES)
+                sleepSync(50 * (attempt + 1));
+        }
+    }
+    if (!release) {
+        const message = lastError instanceof Error ? lastError.message : String(lastError);
+        throw new Error(`Could not acquire lock for ${filePath}: ${message}`);
+    }
+    try {
+        return fn();
+    }
+    finally {
+        release();
+    }
+}

package/dist/lib/git.js

@@ -9,7 +9,7 @@ import simpleGit from 'simple-git';
 import * as fs from 'fs';
 import * as path from 'path';
 import { getPackageLocalPath } from './state.js';
-import { DEFAULT_SYSTEM_REPO, MIRROR_SYSTEM_REPO, systemRepoSlug } from './types.js';
+import { DEFAULT_SYSTEM_REPO, systemRepoSlug } from './types.js';
 /**
  * Install hooks from `.githooks/` by symlinking each entry into `.git/hooks/`.
  *
@@ -398,11 +398,9 @@ export async function isSystemRepoOrigin(dir) {
         const origin = remotes.find(r => r.name === 'origin');
         if (!origin?.refs?.fetch)
             return false;
-        // Check if origin points at the current or legacy system repo.
         const url = origin.refs.fetch.toLowerCase();
         const currentSlug = systemRepoSlug(DEFAULT_SYSTEM_REPO).toLowerCase();
-        const mirrorSlug = systemRepoSlug(MIRROR_SYSTEM_REPO).toLowerCase();
-        return url.includes(currentSlug) || url.includes(mirrorSlug);
+        return url.includes(currentSlug);
     }
     catch {
         /* not a git repo or no remotes */

package/dist/lib/help.d.ts

@@ -18,5 +18,20 @@ export interface CommandGroup {
  * any group fall back to a plain "Commands:" section below the groups.
  */
 export declare function registerCommandGroups(parent: Command, groups: readonly CommandGroup[]): void;
+/** Examples + Notes blocks attached to a command via setHelpSections. */
+interface HelpSections {
+    examples?: string;
+    notes?: string;
+}
+/**
+ * Attach an Examples block (rendered between the description and Arguments)
+ * and/or a Notes block (rendered at the very end, after Options) to a command.
+ *
+ * Bodies are normalized: the shared leading indent is stripped, then every line
+ * is re-indented by two spaces. Callers can pass natural multiline template
+ * literals without babysitting whitespace.
+ */
+export declare function setHelpSections(cmd: Command, sections: HelpSections): void;
 /** Apply standardized help formatting to the root command and all subcommands. */
 export declare function applyGlobalHelpConventions(root: Command): void;
+export {};

package/dist/lib/help.js

@@ -7,6 +7,40 @@ const commandGroupRegistry = new WeakMap();
 export function registerCommandGroups(parent, groups) {
     commandGroupRegistry.set(parent, groups);
 }
+const helpSectionRegistry = new WeakMap();
+/**
+ * Attach an Examples block (rendered between the description and Arguments)
+ * and/or a Notes block (rendered at the very end, after Options) to a command.
+ *
+ * Bodies are normalized: the shared leading indent is stripped, then every line
+ * is re-indented by two spaces. Callers can pass natural multiline template
+ * literals without babysitting whitespace.
+ */
+export function setHelpSections(cmd, sections) {
+    helpSectionRegistry.set(cmd, sections);
+}
+/** Strip a uniform leading indent from a block and trim surrounding blank lines. */
+function dedent(body) {
+    const lines = body.replace(/^\n+/, '').replace(/\s+$/, '').split('\n');
+    let minIndent = Infinity;
+    for (const line of lines) {
+        if (line.trim() === '')
+            continue;
+        const indent = line.match(/^[ \t]*/)?.[0].length ?? 0;
+        if (indent < minIndent)
+            minIndent = indent;
+    }
+    if (!Number.isFinite(minIndent) || minIndent === 0)
+        return lines.join('\n');
+    return lines.map((line) => (line.length >= minIndent ? line.slice(minIndent) : line)).join('\n');
+}
+/** Re-indent a dedented block by two spaces so it sits under a section heading. */
+function indentBlock(body) {
+    return body
+        .split('\n')
+        .map((line) => (line.length === 0 ? '' : `  ${line}`))
+        .join('\n');
+}
 /** Format help output with Commands listed before Options for better discoverability. */
 function formatHelpCommandsFirst(cmd, helper) {
     const termWidth = helper.padWidth(cmd, helper);
@@ -49,6 +83,10 @@ function formatHelpCommandsFirst(cmd, helper) {
     if (commandDescription.length > 0) {
         output = output.concat([helper.wrap(commandDescription, helpWidth, 0), '']);
     }
+    const sections = helpSectionRegistry.get(cmd);
+    if (sections?.examples) {
+        output = output.concat(['Examples:', indentBlock(dedent(sections.examples)), '']);
+    }
     const argumentList = helper
         .visibleArguments(cmd)
         .filter((a) => !isHidden(a))
@@ -109,6 +147,9 @@ function formatHelpCommandsFirst(cmd, helper) {
             output = output.concat(['Global Options:', formatList(globalOptionList), '']);
         }
     }
+    if (sections?.notes) {
+        output = output.concat(['Notes:', indentBlock(dedent(sections.notes)), '']);
+    }
     return output.join('\n');
 }
 /** Recursively apply help conventions (-h flag, no help subcommand, custom formatter). */

package/dist/lib/hooks/match.d.ts

@@ -21,6 +21,7 @@ export interface HookInput {
     tool_args?: unknown;
     cwd?: string;
 }
+export declare function isSafeHookRegex(source: string): boolean;
 /**
  * Decide whether a hook with the given match config should fire on this input.
  * Pure function — no side effects, no IO except git/cwd checks for predicates

package/dist/lib/hooks/match.js

@@ -44,6 +44,59 @@ function findProjectRoot(start) {
         dir = parent;
     }
 }
+function maxGroupDepth(source) {
+    let depth = 0;
+    let max = 0;
+    let escaped = false;
+    let inClass = false;
+    for (const ch of source) {
+        if (escaped) {
+            escaped = false;
+            continue;
+        }
+        if (ch === '\\') {
+            escaped = true;
+            continue;
+        }
+        if (ch === '[') {
+            inClass = true;
+            continue;
+        }
+        if (ch === ']') {
+            inClass = false;
+            continue;
+        }
+        if (inClass)
+            continue;
+        if (ch === '(') {
+            depth += 1;
+            max = Math.max(max, depth);
+        }
+        else if (ch === ')' && depth > 0) {
+            depth -= 1;
+        }
+    }
+    return max;
+}
+export function isSafeHookRegex(source) {
+    if (source.length > 200)
+        return false;
+    if (maxGroupDepth(source) > 3)
+        return false;
+    if (/\((?:\?:)?[^)]*[*+][?+*{,\d}]*[^)]*\)\s*(?:[+*]|\{\d*,?\d*\})/.test(source))
+        return false;
+    return true;
+}
+function compileHookRegex(source) {
+    if (!isSafeHookRegex(source))
+        return null;
+    try {
+        return new RegExp(source);
+    }
+    catch {
+        return null;
+    }
+}
 /**
  * Decide whether a hook with the given match config should fire on this input.
  * Pure function — no side effects, no IO except git/cwd checks for predicates
@@ -63,13 +116,9 @@ export function shouldFire(matches, input) {
     }
     if (matches.prompt_matches !== undefined) {
         const prompt = input.prompt ?? '';
-        let re;
-        try {
-            re = new RegExp(matches.prompt_matches);
-        }
-        catch {
+        const re = compileHookRegex(matches.prompt_matches);
+        if (!re)
             return false;
-        }
         if (!re.test(prompt))
             return false;
     }
@@ -86,13 +135,9 @@ export function shouldFire(matches, input) {
         const serialized = typeof input.tool_args === 'string'
             ? input.tool_args
             : JSON.stringify(input.tool_args ?? '');
-        let re;
-        try {
-            re = new RegExp(matches.tool_args_match);
-        }
-        catch {
+        const re = compileHookRegex(matches.tool_args_match);
+        if (!re)
             return false;
-        }
         if (!re.test(serialized))
             return false;
     }

package/dist/lib/hooks.d.ts

@@ -7,6 +7,7 @@
  * parsing those manifests, registering hooks into agent-native settings files,
  * and syncing them across version switches.
  */
+export declare function resolveHookScriptPath(script: string): string | null;
 import type { AgentId, InstalledHook, ManifestHook } from './types.js';
 export type HookEntry = {
     name: string;

package/dist/lib/hooks.js

@@ -20,12 +20,22 @@ function getCentralHooksDir() { return getUserHooksDir(); }
  * Resolve a hook script's absolute path. Checks user dir first, then enabled
  * extra repos in insertion order, then system dir. Returns null if not found.
  */
-function resolveHookScriptPath(script) {
+function resolveContainedHookPath(hooksRoot, script) {
+    const resolvedRoot = path.resolve(hooksRoot);
+    const candidate = path.join(hooksRoot, script);
+    const resolved = path.resolve(candidate);
+    if (!resolved.startsWith(resolvedRoot + path.sep))
+        return null;
+    if (!fs.existsSync(resolved))
+        return null;
+    return resolved;
+}
+export function resolveHookScriptPath(script) {
     const extraDirs = getEnabledExtraRepos().map(e => e.dir);
     for (const root of [getUserAgentsDir(), ...extraDirs, getSystemAgentsDir()]) {
-        const candidate = path.join(root, 'hooks', script);
-        if (fs.existsSync(candidate))
-            return candidate;
+        const resolved = resolveContainedHookPath(path.join(root, 'hooks'), script);
+        if (resolved)
+            return resolved;
     }
     return null;
 }
@@ -586,14 +596,17 @@ export function listCentralHooks() {
  */
 export function parseHookManifest() {
     const merged = {};
+    const systemHooks = {};
     // System layer: hooks: section of agents.yaml (npm-shipped, separate repo).
     const systemPath = path.join(getSystemAgentsDir(), 'agents.yaml');
     if (fs.existsSync(systemPath)) {
         try {
             const meta = yaml.parse(fs.readFileSync(systemPath, 'utf-8'));
             if (meta?.hooks)
-                for (const [name, def] of Object.entries(meta.hooks))
+                for (const [name, def] of Object.entries(meta.hooks)) {
+                    systemHooks[name] = def;
                     merged[name] = def;
+                }
         }
         catch { /* skip unreadable manifest */ }
     }
@@ -603,8 +616,13 @@ export function parseHookManifest() {
         try {
             const meta = yaml.parse(fs.readFileSync(userMetaPath, 'utf-8'));
             if (meta?.hooks)
-                for (const [name, def] of Object.entries(meta.hooks))
+                for (const [name, def] of Object.entries(meta.hooks)) {
+                    if (systemHooks[name] && def.override !== true) {
+                        const action = def.enabled === false ? 'disables' : 'shadows';
+                        console.warn(`[agents hooks] User-layer hook '${name}' ${action} system-shipped hook. Set 'override: true' to silence this warning.`);
+                    }
                     merged[name] = def;
+                }
         }
         catch { /* skip unreadable meta */ }
     }
@@ -641,12 +659,11 @@ export function registerHooksToSettings(agentId, versionHome, hookManifest, agen
         : null;
     const resolveScript = (script) => {
         if (overrideRoots) {
-            const candidate = path.join(overrideRoots[0], 'hooks', script);
-            return fs.existsSync(candidate) ? candidate : null;
+            return resolveContainedHookPath(path.join(overrideRoots[0], 'hooks'), script);
         }
         if (localHooksDir) {
-            const local = path.join(localHooksDir, script);
-            if (fs.existsSync(local))
+            const local = resolveContainedHookPath(localHooksDir, script);
+            if (local)
                 return local;
         }
         return resolveHookScriptPath(script);

package/dist/lib/import.d.ts

@@ -28,6 +28,7 @@ export interface ImportBinaryResult {
     error?: string;
     resolvedFromPath?: string;
 }
+export declare function isValidImportVersion(version: string): boolean;
 /**
  * Move an agent's config dir into the managed version structure and symlink it
  * back to its original location. Sets the imported version as the global

package/dist/lib/import.js

@@ -22,6 +22,10 @@ import { AGENTS } from './agents.js';
 import { getVersionsDir } from './state.js';
 import { setGlobalDefault } from './versions.js';
 import { createShim, createVersionedAlias, ensureShimCurrent, switchHomeFileSymlinks } from './shims.js';
+const IMPORT_VERSION_RE = /^(?:latest|[A-Za-z0-9._+-]{1,64})$/;
+export function isValidImportVersion(version) {
+    return IMPORT_VERSION_RE.test(version);
+}
 /**
  * Move an agent's config dir into the managed version structure and symlink it
  * back to its original location. Sets the imported version as the global
@@ -31,6 +35,9 @@ import { createShim, createVersionedAlias, ensureShimCurrent, switchHomeFileSyml
  * No-op (returns skipped=true) if the version's config dir is already created.
  */
 export async function importAgentConfig(agentId, version) {
+    if (!isValidImportVersion(version)) {
+        return { success: false, error: `Invalid version: ${JSON.stringify(version)}` };
+    }
     const agent = AGENTS[agentId];
     const configDir = agent.configDir;
     const versionsDir = getVersionsDir();

package/dist/lib/manifest.js

@@ -6,9 +6,12 @@
  */
 import * as fs from 'fs';
 import * as yaml from 'yaml';
+import { ensureLockTarget, atomicWriteFileSync, withFileLock } from './fs-atomic.js';
 import { safeJoin } from './paths.js';
 /** Canonical filename for the manifest in any agents repo or project root. */
 export const MANIFEST_FILENAME = 'agents.yaml';
+// Per-path re-entrancy depth so withManifestLock is safe against recursive calls.
+const manifestLockDepth = new Map();
 /** Parse a YAML string into a typed Manifest object. */
 export function parseManifest(content) {
     return yaml.parse(content);
@@ -26,11 +29,34 @@ export function readManifest(repoPath) {
     const content = fs.readFileSync(manifestPath, 'utf-8');
     return parseManifest(content);
 }
+function withManifestLock(filePath, fn) {
+    const depth = manifestLockDepth.get(filePath) ?? 0;
+    if (depth > 0) {
+        manifestLockDepth.set(filePath, depth + 1);
+        try {
+            return fn();
+        }
+        finally {
+            manifestLockDepth.set(filePath, depth);
+        }
+    }
+    // Project manifests are shared (no restricted dir mode unlike ~/.agents).
+    ensureLockTarget(filePath);
+    return withFileLock(filePath, () => {
+        manifestLockDepth.set(filePath, 1);
+        try {
+            return fn();
+        }
+        finally {
+            manifestLockDepth.delete(filePath);
+        }
+    });
+}
 /** Write a Manifest object to agents.yaml in the given directory. */
 export function writeManifest(repoPath, manifest) {
     const manifestPath = safeJoin(repoPath, MANIFEST_FILENAME);
     const content = serializeManifest(manifest);
-    fs.writeFileSync(manifestPath, content, 'utf-8');
+    withManifestLock(manifestPath, () => atomicWriteFileSync(manifestPath, content));
 }
 /** Create a Manifest with sensible defaults for a fresh agents repo. */
 export function createDefaultManifest() {

package/dist/lib/mcp.d.ts

@@ -25,6 +25,16 @@ export interface InstalledMcpServer {
     config: McpYamlConfig;
     scope?: 'user' | 'project';
 }
+export interface McpCommandSpec {
+    command: string;
+    args: string[];
+}
+export interface McpTargetOperationResult {
+    agentId: AgentId;
+    version?: string;
+    success: boolean;
+    error?: string;
+}
 /**
  * Parse an MCP server config from a YAML file.
  */
@@ -41,6 +51,10 @@ export declare function listMcpServerConfigs(cwd?: string): InstalledMcpServer[]
 export declare function getMcpServersByName(names?: string[], options?: {
     cwd?: string;
 }): InstalledMcpServer[];
+export declare function registerMcpCommandToTargets(targets: {
+    directAgents: AgentId[];
+    versionSelections: Map<AgentId, string[]>;
+}, name: string, commandSpec: McpCommandSpec, scope?: 'user' | 'project', transport?: string): Promise<McpTargetOperationResult[]>;
 /**
  * Install MCP servers to an agent.
  * For Claude/Codex: uses CLI commands (claude mcp add, codex mcp add)

package/dist/lib/mcp.js

@@ -12,6 +12,7 @@ import * as path from 'path';
 import * as yaml from 'yaml';
 import { execFileSync } from 'child_process';
 import { getMcpDir, getUserMcpDir, getProjectAgentsDir, getVersionsDir } from './state.js';
+import { getBinaryPath, getVersionHomePath } from './versions.js';
 import { MCP_CAPABLE_AGENTS, AGENTS } from './agents.js';
 import { setGeminiAutoUpdateDisabled, updateGeminiSettings } from './gemini-settings.js';
 /**
@@ -21,28 +22,60 @@ export function parseMcpServerConfig(filePath) {
     if (!fs.existsSync(filePath)) {
         return null;
     }
+    let parsed;
     try {
         const content = fs.readFileSync(filePath, 'utf-8');
-        const parsed = yaml.parse(content);
-        if (!parsed || typeof parsed !== 'object') {
-            return null;
-        }
-        // Validate required fields
-        if (!parsed.name || !parsed.transport) {
+        parsed = yaml.parse(content);
+    }
+    catch {
+        return null;
+    }
+    return validateMcpYamlConfig(parsed);
+}
+function validateMcpYamlConfig(parsed) {
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        return null;
+    }
+    const config = parsed;
+    if (typeof config.name !== 'string' || config.name.length === 0)
+        return null;
+    if (config.transport !== 'stdio' && config.transport !== 'http')
+        return null;
+    const result = {
+        name: config.name,
+        transport: config.transport,
+    };
+    if (config.transport === 'stdio') {
+        if (config.command === undefined || config.command === '')
             return null;
+        if (typeof config.command !== 'string') {
+            throw new Error(`Invalid MCP config '${config.name}': command must be a string`);
         }
-        // Validate transport-specific fields
-        if (parsed.transport === 'stdio' && !parsed.command) {
-            return null;
+        result.command = config.command;
+        if (config.args !== undefined) {
+            if (!Array.isArray(config.args) || !config.args.every((arg) => typeof arg === 'string')) {
+                throw new Error(`Invalid MCP config '${config.name}': args must be a string array`);
+            }
+            result.args = config.args;
         }
-        if (parsed.transport === 'http' && !parsed.url) {
-            return null;
+        if (config.env !== undefined) {
+            if (!isStringRecord(config.env)) {
+                throw new Error(`Invalid MCP config '${config.name}': env must be a string map`);
+            }
+            result.env = config.env;
         }
-        return parsed;
     }
-    catch {
-        return null;
+    else {
+        if (typeof config.url !== 'string' || config.url.length === 0)
+            return null;
+        result.url = config.url;
     }
+    return result;
+}
+function isStringRecord(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    return Object.values(value).every((item) => typeof item === 'string');
 }
 /**
  * List all MCP server configs from ~/.agents/mcp/.
@@ -151,6 +184,38 @@ function installMcpViaCodex(binaryPath, server, versionHome) {
     }
     // Note: Codex may not support HTTP MCPs
 }
+export async function registerMcpCommandToTargets(targets, name, commandSpec, scope = 'user', transport = 'stdio') {
+    const results = [];
+    for (const agentId of targets.directAgents) {
+        const result = registerMcpCommand(agentId, name, commandSpec, scope, transport);
+        results.push({ agentId, success: result.success, error: result.error });
+    }
+    for (const [agentId, versions] of targets.versionSelections) {
+        for (const version of versions) {
+            const result = registerMcpCommand(agentId, name, commandSpec, scope, transport, {
+                home: getVersionHomePath(agentId, version),
+                binary: getBinaryPath(agentId, version),
+            });
+            results.push({ agentId, version, success: result.success, error: result.error });
+        }
+    }
+    return results;
+}
+function registerMcpCommand(agentId, name, commandSpec, scope, transport, options = {}) {
+    try {
+        const bin = options.binary || AGENTS[agentId].cliCommand;
+        const commandArgs = [commandSpec.command, ...commandSpec.args];
+        const args = agentId === 'claude'
+            ? ['mcp', 'add', '--transport', transport, '--scope', scope, name, '--', ...commandArgs]
+            : ['mcp', 'add', name, '--', ...commandArgs];
+        const env = options.home ? { ...process.env, HOME: options.home } : process.env;
+        execFileSync(bin, args, { stdio: 'pipe', timeout: 30000, env });
+        return { success: true };
+    }
+    catch (err) {
+        return { success: false, error: err.message };
+    }
+}
 /**
  * Install MCP server to Gemini config file.
  */

package/dist/lib/migrate.js

@@ -828,7 +828,7 @@ function migratePluginsBackToUserRoot() {
  *   ~/.agents/drive/         -> ~/.agents/.cache/drive/
  *   ~/.agents/terminals/     -> ~/.agents/.cache/terminals/
  *   ~/.agents/logs/          -> ~/.agents/.cache/logs/
- *   ~/.agents/swarmify/      -> ~/.agents/.cache/swarmify/
+ *   ~/.agents/companion/      -> ~/.agents/.cache/companion/
  *   ~/.agents/runtime/       -> ~/.agents/.cache/state/
  *   ~/.agents/cache/         -> ~/.agents/.cache/   (flatten — already a cache subdir)
  *   ~/.agents/helpers/{daemon,pty,...} -> ~/.agents/.cache/helpers/...
@@ -858,7 +858,7 @@ function migrateRuntimeToCache() {
     // ~/.agents/terminals/live-terminals.json and would race with the move on
     // VS Code restart. Leave the path where the extension expects it.
     moveDirOnce(path.join(USER_DIR, 'logs'), path.join(CACHE_DIR, 'logs'));
-    moveDirOnce(path.join(USER_DIR, 'swarmify'), path.join(CACHE_DIR, 'swarmify'));
+    moveDirOnce(path.join(USER_DIR, 'companion'), path.join(CACHE_DIR, 'companion'));
     moveDirOnce(path.join(USER_DIR, 'runtime'), path.join(CACHE_DIR, 'state'));
     // Pre-existing user `cache/` dir (claude usage cache, cloud-runs, etc.) — flatten
     // so it's not confused with the new bucket. Its contents merge into .cache/.
@@ -905,7 +905,7 @@ function migrateRuntimeToCache() {
     moveDirOnce(path.join(SYSTEM_DIR, '.fetch'), path.join(CACHE_DIR, '.fetch'));
     moveDirOnce(path.join(SYSTEM_DIR, 'browser'), path.join(CACHE_DIR, 'browser'));
     moveDirOnce(path.join(SYSTEM_DIR, 'state'), path.join(CACHE_DIR, 'state'));
-    moveDirOnce(path.join(SYSTEM_DIR, 'swarmify'), path.join(CACHE_DIR, 'swarmify'));
+    moveDirOnce(path.join(SYSTEM_DIR, 'companion'), path.join(CACHE_DIR, 'companion'));
     moveFileOnce(path.join(SYSTEM_DIR, '.cli-version-cache.json'), path.join(CACHE_DIR, '.cli-version-cache.json'));
     moveFileOnce(path.join(SYSTEM_DIR, '.update-check'), path.join(CACHE_DIR, '.update-check'));
     moveFileOnce(path.join(SYSTEM_DIR, '.migrated'), path.join(CACHE_DIR, '.migrated'));

package/dist/lib/models.js

@@ -210,7 +210,9 @@ function extractClaudeCatalog(text) {
         displayNames[constMatch[5]] = constMatch[6];
     }
     const perCloud = {};
-    const perCloudRe = /\{firstParty:"(claude-[^"]+)",bedrock:"([^"]+)"(?:,vertex:"([^"]+)")?(?:,foundry:"([^"]+)")?(?:,anthropicAws:"([^"]+)")?(?:,mantle:(?:null|"([^"]*)"))?\}/g;
+    // The record may carry additional trailing fields (e.g. gateway, eagerInputStreaming)
+    // in newer Claude bundles, so the regex does not anchor at the closing brace.
+    const perCloudRe = /\{firstParty:"(claude-[^"]+)",bedrock:"([^"]+)"(?:,vertex:"([^"]+)")?(?:,foundry:"([^"]+)")?(?:,anthropicAws:"([^"]+)")?(?:,mantle:(?:null|"([^"]*)"))?/g;
     let m;
     while ((m = perCloudRe.exec(text)) !== null) {
         const id = m[1];

package/dist/lib/permissions.d.ts

@@ -3,6 +3,11 @@ import type { AgentId, PermissionSet, InstalledPermission, ClaudePermissions, Op
 export declare const PERMISSIONS_CAPABLE_AGENTS: AgentId[];
 /** Filename used for Codex Starlark deny-rules generated from permission groups. */
 export declare const CODEX_RULES_FILENAME = "agents-deny.rules";
+export type ParsedRules = PermissionSet;
+export declare function containsBroadGrants(rules: ParsedRules): {
+    broad: string[];
+    reason: string;
+} | null;
 /**
  * Convert canonical deny rules to Codex Starlark .rules format.
  * E.g. "Bash(git reset:*)" -> prefix_rule(pattern=["git", "reset"], decision="forbidden")