@phnx-labs/agents-cli 1.20.11 → 1.20.12

package/CHANGELOG.md

@@ -2,6 +2,10 @@
 
 ## Unreleased
 
+**`agents upgrade` now refreshes the macOS Keychain helper**
+
+- Upgrading runs `npm install -g … --ignore-scripts`, so the postinstall that installs the signed Keychain helper never fired — a user upgrading away from a broken build (e.g. the entitlement-less 1.20.4 helper that failed `SecItemAdd` with `errSecMissingEntitlement -34018`) kept the broken helper until the lazy staleness check in `getKeychainHelperPath()` happened to repair it on their next secret operation. `installResolvedPackage` now force-refreshes the helper (`ensureKeychainHelperInstalled({ forceReinstall: true })`) on darwin after the install, so both the explicit `agents upgrade` and the auto-update prompt land the fixed helper immediately. Best-effort and non-fatal: an upgrade never fails because the helper could not be reinstalled, and `agents helper install --force` remains the manual path.
+
 **`agents inspect <repo>` summary now shows what's actually inside, not just counts**
 
 - The bare repo summary gained four enrichments so it reads as an inventory instead of a tally: (1) **resource name previews** — each kind lists its first few names with a `…(+N)` tail; (2) **manifest summary** — `agents.yaml` is parsed for its `run.<agent>.strategy` and any `agents.<agent>` version pins, shown under `manifests` instead of just the filename; (3) **git detail** — last commit (sha, subject, relative time), ahead/behind upstream when non-zero, and the names of dirty files; (4) **size + file counts** — total repo size and a per-kind byte size. `--json` carries all of it (`git.lastCommit`, `git.ahead/behind`, `manifest`, `size`, and per-kind `{count, bytes, files, names}`); `--brief` still skips resources and size.

package/dist/index.js

@@ -348,6 +348,24 @@ async function installResolvedPackage(metadata) {
     await installPackageIntoPrefix(`${NPM_PACKAGE_NAME}@${metadata.version}`, prefix);
     verifyInstalledVersion(packageRoot, metadata.version);
     refreshAliasShims(packageRoot);
+    // The npm install above runs with --ignore-scripts, so the postinstall that
+    // installs the macOS Keychain helper never fires on upgrade. Force-refresh the
+    // helper here so a user upgrading FROM a broken build (e.g. the entitlement-less
+    // 1.20.4 helper that fails SecItemAdd with -34018) gets the fixed, signed bundle
+    // immediately — instead of waiting for the lazy staleness check in
+    // getKeychainHelperPath() to repair it on their next secret operation. The new
+    // package is already on disk, so the dynamic import resolves the freshly-installed
+    // helper module + bundle. Best-effort: an upgrade must never fail because the
+    // helper could not be reinstalled (`agents helper install --force` stays available).
+    if (process.platform === 'darwin') {
+        try {
+            const { ensureKeychainHelperInstalled } = await import('./lib/secrets/install-helper.js');
+            ensureKeychainHelperInstalled({ forceReinstall: true });
+        }
+        catch {
+            // Non-fatal.
+        }
+    }
 }
 /** Present an interactive upgrade prompt (TTY) or a one-line hint (non-TTY). */
 async function promptUpgrade(latestVersion) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@phnx-labs/agents-cli",
-  "version": "1.20.11",
+  "version": "1.20.12",
   "description": "One CLI for all your AI coding agents - versions, config, cloud dispatch, sessions, and teams (now with first-class Grok Build CLI support)",
   "type": "module",
   "main": "dist/index.js",