@phnx-labs/agents-cli 1.19.2 → 1.20.3

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@phnx-labs/agents-cli",
-  "version": "1.19.2",
-  "description": "One CLI for all your AI coding agents - versions, config, cloud dispatch, sessions, and teams",
+  "version": "1.20.3",
+  "description": "One CLI for all your AI coding agents - versions, config, cloud dispatch, sessions, and teams (now with first-class Grok Build CLI support)",
   "type": "module",
   "main": "dist/index.js",
   "exports": {
@@ -24,14 +24,14 @@
     "dist/**/*.js",
     "dist/**/*.d.ts",
     "dist/lib/secrets/Agents CLI.app/**",
-    "npm-shrinkwrap.json",
     "scripts/postinstall.js",
+    "scripts/install-helper.js",
     "CHANGELOG.md",
     "README.md",
     "LICENSE"
   ],
   "publishConfig": {
-    "provenance": true
+    "provenance": false
   },
   "repository": {
     "type": "git",
@@ -59,6 +59,8 @@
     "gemini",
     "cursor",
     "opencode",
+    "grok",
+    "xai",
     "mcp",
     "skills",
     "ai",
@@ -72,14 +74,14 @@
     "npm": ">=9"
   },
   "dependencies": {
-    "@inquirer/prompts": "7.10.1",
+    "@inquirer/prompts": "8.5.1",
     "@types/proper-lockfile": "4.1.4",
     "@xterm/headless": "6.0.0",
     "@zed-industries/agent-client-protocol": "0.4.5",
     "chalk": "5.6.2",
-    "commander": "12.1.0",
-    "croner": "9.1.0",
-    "diff": "8.0.4",
+    "commander": "15.0.0",
+    "croner": "10.0.1",
+    "diff": "9.0.0",
     "marked": "15.0.12",
     "marked-terminal": "7.3.0",
     "node-pty": "1.1.0",
@@ -87,15 +89,14 @@
     "proper-lockfile": "4.1.2",
     "simple-git": "3.36.0",
     "smol-toml": "1.6.1",
-    "yaml": "2.8.3"
+    "yaml": "2.9.0"
   },
   "devDependencies": {
-    "@types/diff": "6.0.0",
+    "@types/diff": "8.0.0",
     "@types/marked-terminal": "6.1.1",
-    "@types/node": "22.19.10",
-    "playwright": "1.59.1",
-    "tsx": "4.22.2",
-    "typescript": "5.9.3",
+    "@types/node": "25.9.1",
+    "tsx": "4.22.3",
+    "typescript": "6.0.3",
     "vitest": "4.1.6"
   }
 }

package/scripts/install-helper.js

@@ -0,0 +1,97 @@
+#!/usr/bin/env node
+/**
+ * Copy the bundled `Agents CLI.app` to a stable user-scoped path so its
+ * keychain ACLs survive future npm installs/updates.
+ *
+ * Source:      dist/lib/secrets/Agents CLI.app   (in the installed npm package)
+ *              bin/Agents CLI.app                 (in a raw working tree)
+ * Destination: ~/Library/Application Support/agents-cli/Agents CLI.app
+ *
+ * Invoked by scripts/postinstall.js on global install, and by
+ * scripts/install.sh for dev installs. Pure Node, no agents-cli imports,
+ * so it runs before the package's TS is wired up.
+ *
+ * macOS only — silently no-ops on other platforms so postinstall stays clean.
+ */
+
+import { spawnSync } from 'child_process';
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+import { fileURLToPath } from 'url';
+
+const APP_BUNDLE_NAME = 'Agents CLI.app';
+const INSTALL_DIR_NAME = 'agents-cli';
+
+function destAppPath() {
+  return path.join(os.homedir(), 'Library', 'Application Support', INSTALL_DIR_NAME, APP_BUNDLE_NAME);
+}
+
+function findSourceApp() {
+  const here = path.dirname(fileURLToPath(import.meta.url));
+  // From scripts/install-helper.js, look in the installed npm layout first
+  // (../dist/lib/secrets/...) then a raw repo layout (../bin/...).
+  const candidates = [
+    path.resolve(here, '..', 'dist', 'lib', 'secrets', APP_BUNDLE_NAME),
+    path.resolve(here, '..', 'bin', APP_BUNDLE_NAME),
+  ];
+  for (const c of candidates) {
+    if (fs.existsSync(c)) return c;
+  }
+  return null;
+}
+
+function codesignVerify(appPath) {
+  const r = spawnSync('codesign', ['--verify', '--deep', '--strict', appPath], {
+    stdio: ['ignore', 'pipe', 'pipe'],
+    encoding: 'utf-8',
+  });
+  return { ok: r.status === 0, output: (r.stderr || r.stdout || '').toString().trim() };
+}
+
+function copyAppBundle(src, dest) {
+  fs.mkdirSync(path.dirname(dest), { recursive: true });
+  if (fs.existsSync(dest)) fs.rmSync(dest, { recursive: true, force: true });
+  const r = spawnSync('cp', ['-R', src, dest], { stdio: ['ignore', 'pipe', 'pipe'], encoding: 'utf-8' });
+  if (r.status !== 0) {
+    const msg = (r.stderr || r.stdout || '').toString().trim();
+    throw new Error(`Failed to copy ${src} -> ${dest}: ${msg || 'unknown error'}`);
+  }
+}
+
+function main() {
+  if (process.platform !== 'darwin') return;
+  const force = process.argv.includes('--force');
+  const dest = destAppPath();
+
+  if (!force && fs.existsSync(dest) && codesignVerify(dest).ok) {
+    return;
+  }
+
+  const src = findSourceApp();
+  if (!src) {
+    // No source bundle to install. Stay silent during postinstall so we don't
+    // create noise on Linux/Windows or on builds that intentionally omit the
+    // helper. `agents helper install` surfaces a clearer error if a user
+    // actually needs the helper.
+    return;
+  }
+
+  try {
+    copyAppBundle(src, dest);
+  } catch (err) {
+    process.stderr.write(`agents-cli: failed to install Keychain helper: ${err.message}\n`);
+    return;
+  }
+
+  const verify = codesignVerify(dest);
+  if (!verify.ok) {
+    process.stderr.write(
+      `agents-cli: installed helper failed codesign verification at ${dest}\n${verify.output}\n`
+    );
+    return;
+  }
+  process.stdout.write(`  Installed Keychain helper: ${dest}\n`);
+}
+
+main();

package/scripts/postinstall.js

@@ -7,6 +7,7 @@ import * as fs from 'fs';
 import * as path from 'path';
 import * as os from 'os';
 import * as readline from 'readline';
+import { spawnSync } from 'child_process';
 import { fileURLToPath } from 'url';
 
 const HOME = os.homedir();
@@ -14,6 +15,16 @@ const SHIMS_DIR = path.join(HOME, '.agents', '.cache', 'shims');
 const SYSTEM_DIR = path.join(HOME, '.agents-system');
 const USER_DIR = path.join(HOME, '.agents');
 const AGENTS_BIN = fileURLToPath(new URL('../dist/index.js', import.meta.url));
+const INSTALL_HELPER_SCRIPT = fileURLToPath(new URL('./install-helper.js', import.meta.url));
+
+function installKeychainHelper() {
+  if (process.platform !== 'darwin') return;
+  if (!fs.existsSync(INSTALL_HELPER_SCRIPT)) return;
+  // Sub-process so a hard failure (codesign / spctl missing on a weird host)
+  // can't take down the rest of postinstall. install-helper.js stays silent
+  // on no-op and emits one stdout line on success.
+  spawnSync(process.execPath, [INSTALL_HELPER_SCRIPT], { stdio: 'inherit' });
+}
 
 function shellQuote(value) {
   return `'${value.replace(/'/g, `'\\''`)}'`;
@@ -24,6 +35,7 @@ const isGlobalInstall = process.env.npm_config_global || process.argv.includes('
 if (!isGlobalInstall) {
   // Still create user directories for local installs
   fs.mkdirSync(USER_DIR, { recursive: true, mode: 0o700 });
+  installKeychainHelper();
   console.log(`
 agents-cli installed locally.
 To complete setup, run: npx agents setup
@@ -36,6 +48,10 @@ fs.mkdirSync(SHIMS_DIR, { recursive: true });
 fs.mkdirSync(SYSTEM_DIR, { recursive: true });
 fs.mkdirSync(USER_DIR, { recursive: true, mode: 0o700 });
 
+// Copy the signed macOS Keychain helper to a stable user path so its trusted-app
+// ACLs survive future npm publishes (which re-sign the bundle).
+installKeychainHelper();
+
 // One-shot idempotent migrations
 function runMigrations() {
   // 1. Move agents.yaml from system to user repo