@phnx-labs/agents-cli 1.20.35 → 1.20.36

package/dist/lib/secrets/mcp.js

@@ -0,0 +1,205 @@
+/**
+ * Zero-knowledge / JIT secret delivery over MCP (issue #333).
+ *
+ * A stdio MCP server exposing a single `get_secret(bundle, key)` tool. Unlike
+ * `agents secrets exec`, which spawns the child process with EVERY resolved
+ * value baked into `process.env` (any subprocess can `printenv` the lot — see
+ * buildSecretsExecEnv in src/commands/secrets.ts), this server hands an
+ * MCP-speaking agent framework ONE credential at a time, by name, at call
+ * time. The raw value is returned only inside the tool result: it never enters
+ * the child's environment, is never logged, and never appears in `tools/list`
+ * metadata (names only).
+ *
+ * Resolution reuses the canonical bundle read path
+ * (readAndResolveBundleEnv -> getKeychainToken); no keychain access is
+ * re-implemented here. On Linux the libsecret backend (or its encrypted-file
+ * fallback for locked/headless collections) applies transparently through that
+ * abstraction, so the server stays backend-agnostic and works unchanged on
+ * macOS.
+ *
+ * Transport: the MCP stdio transport is newline-delimited JSON-RPC 2.0 (one
+ * message per line, UTF-8, no embedded newlines). That framing is trivial, so
+ * we implement it directly rather than pull in the @modelcontextprotocol/sdk
+ * server dependency — keeping the tree dependency-free and the handler pure and
+ * unit-testable in-process.
+ */
+import * as readline from 'readline';
+import { listBundles, readAndResolveBundleEnv, readBundle, validateBundleName, } from './bundles.js';
+/** MCP protocol revision this server negotiates. */
+export const MCP_PROTOCOL_VERSION = '2024-11-05';
+/** The single tool this server exposes. */
+export const GET_SECRET_TOOL = 'get_secret';
+/** serverInfo.name reported at `initialize`. */
+export const MCP_SERVER_NAME = 'agents-secrets';
+// JSON-RPC 2.0 error codes we use.
+const JSONRPC_PARSE_ERROR = -32700;
+const JSONRPC_INVALID_REQUEST = -32600;
+const JSONRPC_METHOD_NOT_FOUND = -32601;
+const JSONRPC_INVALID_PARAMS = -32602;
+/**
+ * Enumerate every bundle and its key names WITHOUT resolving or reading any
+ * value. Mirrors how `agents secrets list` surfaces bundle metadata: names are
+ * safe to expose, values are not. `listBundles()` reads only the bundle
+ * metadata items (var definitions), never the secret items behind them.
+ */
+export function listSecretMetadata() {
+    return listBundles()
+        .map((b) => ({
+        bundle: b.name,
+        description: b.description,
+        keys: Object.keys(b.vars).sort(),
+    }))
+        .sort((a, b) => a.bundle.localeCompare(b.bundle));
+}
+/**
+ * Resolve a single secret value by bundle + key through the canonical read
+ * path. Throws a clear error when the bundle or the key is absent.
+ *
+ * The bundle metadata is read first (readBundle) so a missing key is reported
+ * without triggering resolution — and, on macOS, without prompting Touch ID —
+ * for the other keys in the bundle.
+ */
+export function resolveSecret(bundle, key) {
+    validateBundleName(bundle);
+    // readBundle throws `Secrets bundle '<name>' not found.` for a missing bundle.
+    const meta = readBundle(bundle);
+    if (!Object.prototype.hasOwnProperty.call(meta.vars, key)) {
+        const available = Object.keys(meta.vars).sort();
+        throw new Error(`Key '${key}' not found in bundle '${bundle}'.` +
+            (available.length ? ` Available keys: ${available.join(', ')}.` : ' Bundle has no keys.'));
+    }
+    const { env } = readAndResolveBundleEnv(bundle, { caller: 'secrets-mcp' });
+    const value = env[key];
+    if (value === undefined) {
+        throw new Error(`Key '${key}' in bundle '${bundle}' could not be resolved.`);
+    }
+    return value;
+}
+/** Build the `get_secret` tool definition, advertising available names only. */
+function getSecretToolDefinition() {
+    let catalog = '(no bundles configured)';
+    try {
+        const meta = listSecretMetadata();
+        if (meta.length > 0) {
+            catalog = meta
+                .map((b) => `${b.bundle}: ${b.keys.length ? b.keys.join(', ') : '(no keys)'}`)
+                .join(' | ');
+        }
+    }
+    catch {
+        // Listing is best-effort decoration; never fail tools/list because the
+        // keychain enumeration hiccuped.
+        catalog = '(unavailable)';
+    }
+    return {
+        name: GET_SECRET_TOOL,
+        description: 'Fetch a single secret value by bundle + key, resolved at call time. The value ' +
+            'is returned only in this tool result and never enters the process environment. ' +
+            `Available bundles and keys (names only): ${catalog}`,
+        inputSchema: {
+            type: 'object',
+            properties: {
+                bundle: { type: 'string', description: 'Secrets bundle name' },
+                key: { type: 'string', description: 'Key / env-var name within the bundle' },
+            },
+            required: ['bundle', 'key'],
+            additionalProperties: false,
+        },
+    };
+}
+function success(id, result) {
+    return { jsonrpc: '2.0', id, result };
+}
+function rpcError(id, code, message) {
+    return { jsonrpc: '2.0', id, error: { code, message } };
+}
+/**
+ * A tool-execution failure. Per the MCP spec, tool errors are reported IN the
+ * result (`isError: true`) — not as a JSON-RPC error — so the model sees and
+ * can react to the message. The value channel (`content`) still carries no
+ * secret here.
+ */
+function toolError(id, message) {
+    return success(id, { content: [{ type: 'text', text: message }], isError: true });
+}
+function handleToolCall(id, params) {
+    const p = (params ?? {});
+    if (p.name !== GET_SECRET_TOOL) {
+        return rpcError(id, JSONRPC_INVALID_PARAMS, `Unknown tool: ${String(p.name)}`);
+    }
+    const args = (p.arguments ?? {});
+    if (typeof args.bundle !== 'string' || !args.bundle || typeof args.key !== 'string' || !args.key) {
+        return toolError(id, `${GET_SECRET_TOOL} requires non-empty string 'bundle' and 'key' arguments.`);
+    }
+    try {
+        const value = resolveSecret(args.bundle, args.key);
+        return success(id, { content: [{ type: 'text', text: value }] });
+    }
+    catch (err) {
+        return toolError(id, err.message);
+    }
+}
+/**
+ * Handle one parsed JSON-RPC request. Returns the response object, or `null`
+ * for notifications (which take no reply). Pure — no I/O, no logging — so tests
+ * drive it directly.
+ */
+export function handleMcpRequest(req, ctx = {}) {
+    const id = req.id ?? null;
+    const isNotification = req.id === undefined || req.id === null;
+    switch (req.method) {
+        case 'initialize':
+            return success(id, {
+                protocolVersion: MCP_PROTOCOL_VERSION,
+                capabilities: { tools: {} },
+                serverInfo: { name: MCP_SERVER_NAME, version: ctx.version ?? '0.0.0' },
+            });
+        case 'notifications/initialized':
+        case 'initialized':
+            return null; // notification — no response
+        case 'ping':
+            return success(id, {});
+        case 'tools/list':
+            return success(id, { tools: [getSecretToolDefinition()] });
+        case 'tools/call':
+            return handleToolCall(id, req.params);
+        default:
+            if (isNotification)
+                return null; // unknown notification — stay silent
+            return rpcError(id, JSONRPC_METHOD_NOT_FOUND, `Method not found: ${String(req.method)}`);
+    }
+}
+function writeMessage(output, msg) {
+    output.write(JSON.stringify(msg) + '\n');
+}
+/**
+ * Run the stdio MCP server: read newline-delimited JSON-RPC requests from
+ * `input`, write responses to `output`. Resolves when the input stream ends.
+ * Streams are injectable so tests can drive a full request/response loop
+ * without spawning a process.
+ */
+export async function runSecretsMcpServer(opts = {}) {
+    const input = opts.input ?? process.stdin;
+    const output = opts.output ?? process.stdout;
+    const rl = readline.createInterface({ input, crlfDelay: Infinity });
+    for await (const line of rl) {
+        const trimmed = line.trim();
+        if (!trimmed)
+            continue;
+        let req;
+        try {
+            req = JSON.parse(trimmed);
+        }
+        catch {
+            writeMessage(output, rpcError(null, JSONRPC_PARSE_ERROR, 'Parse error'));
+            continue;
+        }
+        if (!req || typeof req !== 'object' || typeof req.method !== 'string') {
+            writeMessage(output, rpcError((req && req.id) ?? null, JSONRPC_INVALID_REQUEST, 'Invalid Request'));
+            continue;
+        }
+        const res = handleMcpRequest(req, { version: opts.version });
+        if (res)
+            writeMessage(output, res);
+    }
+}

package/dist/lib/secrets/remote.js

@@ -15,10 +15,18 @@
  * file-backend passphrase travels over ssh stdin (first line) so it never lands
  * in argv / `ps` / remote shell history. Nothing is persisted locally.
  */
-import { sshExec, assertValidSshTarget, shellQuote } from '../ssh-exec.js';
+import { sshExec, assertValidSshTarget } from '../ssh-exec.js';
 import { resolveHost } from '../hosts/registry.js';
 import { sshTargetFor } from '../hosts/types.js';
+import { buildRemoteAgentsInvocation } from '../hosts/remote-cmd.js';
+import { resolveRemoteOsSync } from '../hosts/remote-os.js';
 const REMOTE_TIMEOUT_MS = 30_000;
+/** Remote OS for a target string (bare alias matches a device entry; a raw
+ * `user@host` falls back to POSIX). Threaded into the command builder so a
+ * Windows host gets PowerShell instead of `bash -lc`. */
+function osForTarget(target) {
+    return resolveRemoteOsSync(target.split('@').pop() ?? target);
+}
 /**
  * Resolve a `--host` value to an ssh target string. Tries the `agents hosts`
  * registry first (enrolled name → ssh-config alias / `user@host`); on a miss,
@@ -77,8 +85,7 @@ export function splitBundleRef(ref) {
  * remote Touch-ID / passphrase prompt can surface (e.g. `view --reveal`).
  */
 export function remoteSecretsRaw(target, args, opts = {}) {
-    const inner = ['agents', 'secrets', ...args].map(shellQuote).join(' ');
-    const remoteCmd = `bash -lc ${shellQuote(inner)}`;
+    const remoteCmd = buildRemoteAgentsInvocation(['secrets', ...args], undefined, osForTarget(target));
     return sshExec(target, remoteCmd, {
         timeoutMs: REMOTE_TIMEOUT_MS,
         input: opts.input,
@@ -100,8 +107,8 @@ export function remoteSecretsRaw(target, args, opts = {}) {
  */
 export async function remoteResolveEnv(target, bundle) {
     assertValidSshTarget(target);
-    const exportCmd = `agents secrets export ${shellQuote(bundle)} --plaintext --format json`;
-    const res = sshExec(target, `bash -lc ${shellQuote(exportCmd)}`, {
+    const remoteCmd = buildRemoteAgentsInvocation(['secrets', 'export', bundle, '--plaintext', '--format', 'json'], undefined, osForTarget(target));
+    const res = sshExec(target, remoteCmd, {
         timeoutMs: REMOTE_TIMEOUT_MS,
     });
     if (res.code !== 0) {

package/dist/lib/secrets/sync.js

@@ -11,7 +11,7 @@
  * never leaves this module; the backend only ever sees ciphertext + KDF params.
  */
 import * as crypto from 'crypto';
-import { getKeychainToken, hasKeychainToken, secretsKeychainItem, setKeychainToken, } from './index.js';
+import { deleteKeychainToken, getKeychainToken, hasKeychainToken, secretsKeychainItem, setKeychainToken, } from './index.js';
 import { readBundle, writeBundle, keychainItemsForBundle, validateBundleName, } from './bundles.js';
 import { rushSyncBackend } from './drivers/rush.js';
 // PBKDF2 cost. 600k SHA-256 iters matches OWASP 2023+ guidance and keeps a
@@ -93,14 +93,93 @@ function snapshotBundle(name) {
     }
     return { bundle, secrets };
 }
+/**
+ * Materialize a decrypted snapshot locally, atomically.
+ *
+ * A naive "set each secret, then write metadata" is not crash-safe: if one
+ * `setKeychainToken` throws midway, the keychain is left with a half-applied
+ * set — some items carry the pulled values, others the old ones — and the
+ * bundle metadata may never be written, leaving orphaned/wrong items readable.
+ *
+ * So we snapshot the PRIOR value of every item we're about to touch, apply all
+ * writes, and on ANY failure roll back to exactly the pre-restore state
+ * (restore previously-existing items, delete items that didn't exist) before
+ * rethrowing. Metadata is committed only after every secret write succeeds; if
+ * that final write fails, the secret writes are rolled back too. Either the
+ * whole pull lands or the keychain is untouched.
+ */
 function restoreSnapshot(snap) {
     const bundle = snap.bundle;
     validateBundleName(bundle.name);
-    for (const [shortId, value] of Object.entries(snap.secrets)) {
+    // Capture the pre-restore state of every item so a partial failure can be
+    // undone. hasKeychainToken never prompts; getKeychainToken reads the existing
+    // value via the same path the rest of the module uses.
+    const priors = [];
+    for (const shortId of Object.keys(snap.secrets)) {
         const item = secretsKeychainItem(bundle.name, shortId);
-        setKeychainToken(item, value);
+        if (hasKeychainToken(item)) {
+            priors.push({ item, existed: true, value: getKeychainToken(item) });
+        }
+        else {
+            priors.push({ item, existed: false });
+        }
+    }
+    // Best-effort reversal to the captured pre-restore state. Each item is
+    // reverted independently so one failure doesn't abort the rest of the
+    // rollback. Reversal writes hit the SAME backend that just failed the restore
+    // (a locked/erroring keyring is the realistic trigger), so a reversal can
+    // itself throw — those items are collected and returned so the caller can
+    // report an INCOMPLETE rollback instead of falsely claiming a clean one.
+    const rollback = () => {
+        const stillDirty = [];
+        for (const prior of priors) {
+            try {
+                if (prior.existed)
+                    setKeychainToken(prior.item, prior.value);
+                else
+                    deleteKeychainToken(prior.item);
+            }
+            catch {
+                // Keep undoing the remaining items, but remember this one couldn't be
+                // reverted — it may now hold an orphaned or wrong value.
+                stillDirty.push(prior.item);
+            }
+        }
+        return stillDirty;
+    };
+    try {
+        for (const [shortId, value] of Object.entries(snap.secrets)) {
+            const item = secretsKeychainItem(bundle.name, shortId);
+            setKeychainToken(item, value);
+        }
+    }
+    catch (err) {
+        throw new Error(rollbackFailureMessage(bundle.name, 'writing secrets', err, rollback()));
+    }
+    // Commit metadata last. If it fails, undo the secret writes so nothing
+    // partial lingers.
+    try {
+        writeBundle(bundle);
+    }
+    catch (err) {
+        throw new Error(rollbackFailureMessage(bundle.name, 'writing metadata', err, rollback()));
+    }
+}
+/**
+ * Build the error thrown when a restore fails. When the rollback reverted every
+ * touched item (`dirty` empty) we truthfully say the keychain is back to the
+ * pre-restore state. When some reversal writes ALSO failed we must NOT claim a
+ * clean rollback — the message names the still-dirty items so the user knows the
+ * keychain is half-restored and which secrets to check.
+ */
+function rollbackFailureMessage(name, phase, err, dirty) {
+    if (dirty.length === 0) {
+        return `Restore of bundle '${name}' failed while ${phase}; ` +
+            `rolled back to the pre-restore state. (${err.message})`;
     }
-    writeBundle(bundle);
+    return `Restore of bundle '${name}' failed while ${phase}, and the rollback was INCOMPLETE — ` +
+        `these keychain items could not be reverted and may hold orphaned or wrong values: ${dirty.join(', ')}. ` +
+        `(original error: ${err.message})`;
 }
 /** Push a local bundle to the remote. Encrypts client-side; the backend only sees ciphertext. */
 export async function pushBundle(name, opts) {

package/dist/lib/secrets/windows.js

@@ -53,6 +53,10 @@ export const CRED_MAX_CREDENTIAL_BLOB_SIZE = 2560;
  */
 const PS_SCRIPT = `
 $ErrorActionPreference = 'Stop'
+# Output must not depend on the console codepage: a windowsHide child owns a
+# fresh hidden console whose codepage is the OEM default (cp437), not the
+# terminal's UTF-8 — the Node side always decodes stdout/stderr as UTF-8.
+[Console]::OutputEncoding = New-Object System.Text.UTF8Encoding($false)
 Add-Type -TypeDefinition @'
 using System;
 using System.Runtime.InteropServices;
@@ -178,9 +182,12 @@ try {
             exit 0
         }
         'set' {
-            $value = [Console]::In.ReadToEnd()
-            $bytes = [System.Text.Encoding]::UTF8.GetBytes($value)
-            [AgentsCred]::Set($target, $bytes)
+            # Raw bytes, not [Console]::In text — text decoding runs through the
+            # console codepage and corrupts non-ASCII UTF-8 from the Node side.
+            $stdin = [Console]::OpenStandardInput()
+            $ms = New-Object System.IO.MemoryStream
+            $stdin.CopyTo($ms)
+            [AgentsCred]::Set($target, $ms.ToArray())
             exit 0
         }
         'delete' {
@@ -219,6 +226,9 @@ function runCred(op, opts) {
         input: opts.input,
         stdio: ['pipe', 'pipe', 'pipe'],
         maxBuffer: 16 * 1024 * 1024,
+        // Never flash a console window when the caller has no console of its own
+        // (the scheduler daemon resolves bundles through here every sync cycle).
+        windowsHide: true,
     });
     return {
         status: result.status,
@@ -231,6 +241,7 @@ function runCred(op, opts) {
 function powershellAvailable() {
     const result = spawnSync(POWERSHELL, ['-NoProfile', '-NonInteractive', '-Command', 'exit 0'], {
         stdio: ['ignore', 'ignore', 'ignore'],
+        windowsHide: true,
     });
     return !result.error && result.status === 0;
 }

package/dist/lib/serve/data.d.ts

@@ -0,0 +1,81 @@
+/**
+ * Read-only state assembly for `agents serve`.
+ *
+ * Reuses the SAME structured data the CLI already emits — no recomputation:
+ *  - teams: {@link handleTasks} + {@link handleStatus} + {@link toTaskStatusSummary}
+ *    (the shape behind `agents teams status --json`), plus a per-worktree
+ *    `git diff` via {@link gitDiff}.
+ *  - routines: {@link listJobs} (the shape behind `agents routines list --json`).
+ *  - cloud: {@link listTasks} from the local SQLite store (behind `agents cloud list --json`).
+ *
+ * Every panel is assembled independently: if one subsystem throws (e.g. the
+ * SQLite cloud store isn't provisioned on this box), that panel reports an
+ * `error` string and the others still render. This is an aggregator dashboard,
+ * not a fallback that hides a bug in a single code path.
+ */
+import { AgentManager } from '../teams/agents.js';
+import type { AgentStatusSummary } from '../teams/api.js';
+import type { JobConfig } from '../routines.js';
+import type { CloudTask } from '../cloud/types.js';
+/** One teammate's worktree and its current uncommitted diff. */
+export interface WorktreeDiff {
+    agent_id: string;
+    name: string | null;
+    agent_type: string;
+    status: string;
+    worktree_name: string | null;
+    worktree_path: string | null;
+    pr_url: string | null;
+    /** Uncommitted `git diff HEAD` for the worktree, capped. '' when clean/absent. */
+    diff: string;
+}
+/** One team: its per-teammate status summary plus per-worktree diffs. */
+export interface TeamPanel {
+    task_name: string;
+    agent_count: number;
+    running: number;
+    completed: number;
+    failed: number;
+    agents: AgentStatusSummary[];
+    worktrees: WorktreeDiff[];
+}
+/** A panel that either carries data or an error string (never both). */
+export type PanelResult<T> = {
+    ok: true;
+    data: T;
+} | {
+    ok: false;
+    error: string;
+};
+/** The full read-only snapshot streamed to the browser. */
+export interface ServeState {
+    generated_at: string;
+    teams: PanelResult<TeamPanel[]>;
+    routines: PanelResult<JobConfig[]>;
+    cloud: PanelResult<CloudTask[]>;
+}
+/** Shape of the teammate fields needed to build a worktree diff. */
+export interface WorktreeAgentLike {
+    agentId: string;
+    name: string | null;
+    agentType: string;
+    status: string;
+    worktreeName: string | null;
+    worktreePath: string | null;
+    prUrl: string | null;
+}
+/**
+ * Build the per-worktree diffs for a set of teammates. Only teammates with a
+ * `worktreePath` produce a diff; each gets a real `git diff HEAD` via
+ * {@link gitDiff}. Pure over its inputs (no manager, no globals) so it can be
+ * unit-tested against a real temp git worktree.
+ */
+export declare function buildWorktreeDiffs(agents: WorktreeAgentLike[]): Promise<WorktreeDiff[]>;
+/**
+ * Assemble the full read-only snapshot. Each panel degrades independently to an
+ * `error` string so one unavailable subsystem never blanks the whole dashboard.
+ *
+ * @param cwd - Project root used for project-scoped routine discovery.
+ * @param manager - Injectable for tests; defaults to a fresh {@link AgentManager}.
+ */
+export declare function assembleState(cwd?: string, manager?: AgentManager): Promise<ServeState>;

package/dist/lib/serve/data.js

@@ -0,0 +1,91 @@
+/**
+ * Read-only state assembly for `agents serve`.
+ *
+ * Reuses the SAME structured data the CLI already emits — no recomputation:
+ *  - teams: {@link handleTasks} + {@link handleStatus} + {@link toTaskStatusSummary}
+ *    (the shape behind `agents teams status --json`), plus a per-worktree
+ *    `git diff` via {@link gitDiff}.
+ *  - routines: {@link listJobs} (the shape behind `agents routines list --json`).
+ *  - cloud: {@link listTasks} from the local SQLite store (behind `agents cloud list --json`).
+ *
+ * Every panel is assembled independently: if one subsystem throws (e.g. the
+ * SQLite cloud store isn't provisioned on this box), that panel reports an
+ * `error` string and the others still render. This is an aggregator dashboard,
+ * not a fallback that hides a bug in a single code path.
+ */
+import { AgentManager } from '../teams/agents.js';
+import { handleTasks, handleStatus, toTaskStatusSummary } from '../teams/api.js';
+import { gitDiff } from '../teams/worktree.js';
+import { listJobs } from '../routines.js';
+import { listTasks as listCloudTasks } from '../cloud/store.js';
+/**
+ * Build the per-worktree diffs for a set of teammates. Only teammates with a
+ * `worktreePath` produce a diff; each gets a real `git diff HEAD` via
+ * {@link gitDiff}. Pure over its inputs (no manager, no globals) so it can be
+ * unit-tested against a real temp git worktree.
+ */
+export async function buildWorktreeDiffs(agents) {
+    const withTree = agents.filter((a) => !!a.worktreePath);
+    return Promise.all(withTree.map(async (a) => ({
+        agent_id: a.agentId,
+        name: a.name,
+        agent_type: a.agentType,
+        status: a.status,
+        worktree_name: a.worktreeName,
+        worktree_path: a.worktreePath,
+        pr_url: a.prUrl,
+        diff: await gitDiff(a.worktreePath),
+    })));
+}
+/** Assemble the teams panel: overview counts, status summaries, worktree diffs. */
+async function assembleTeams(manager) {
+    const { tasks } = await handleTasks(manager, 1000);
+    const panels = [];
+    for (const t of tasks) {
+        const status = toTaskStatusSummary(await handleStatus(manager, t.task_name, 'all'));
+        const teamAgents = await manager.listByTask(t.task_name);
+        const worktrees = await buildWorktreeDiffs(teamAgents.map((a) => ({
+            agentId: a.agentId,
+            name: a.name,
+            agentType: a.agentType,
+            status: a.status,
+            worktreeName: a.worktreeName,
+            worktreePath: a.worktreePath,
+            prUrl: a.prUrl,
+        })));
+        panels.push({
+            task_name: t.task_name,
+            agent_count: t.agent_count,
+            running: t.running,
+            completed: t.completed,
+            failed: t.failed,
+            agents: status.agents,
+            worktrees,
+        });
+    }
+    return panels;
+}
+/**
+ * Assemble the full read-only snapshot. Each panel degrades independently to an
+ * `error` string so one unavailable subsystem never blanks the whole dashboard.
+ *
+ * @param cwd - Project root used for project-scoped routine discovery.
+ * @param manager - Injectable for tests; defaults to a fresh {@link AgentManager}.
+ */
+export async function assembleState(cwd = process.cwd(), manager = new AgentManager()) {
+    const [teams, routines, cloud] = await Promise.all([
+        assembleTeams(manager).then((data) => ({ ok: true, data }), (err) => ({ ok: false, error: String(err?.message ?? err) })),
+        Promise.resolve()
+            .then(() => listJobs(cwd))
+            .then((data) => ({ ok: true, data }), (err) => ({ ok: false, error: String(err?.message ?? err) })),
+        Promise.resolve()
+            .then(() => listCloudTasks({ limit: 50 }))
+            .then((data) => ({ ok: true, data }), (err) => ({ ok: false, error: String(err?.message ?? err) })),
+    ]);
+    return {
+        generated_at: new Date().toISOString(),
+        teams,
+        routines,
+        cloud,
+    };
+}

package/dist/lib/serve/page.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Self-contained HTML page for `agents serve`. No framework, no external assets
+ * — a single inline <style> + <script> that subscribes to /events (SSE) and
+ * re-renders the panels on each snapshot. Terminal-coded per the agents-cli
+ * brand: #0a0a0a bg, #a3e635 lime accent, JetBrains Mono.
+ */
+export declare function renderPage(): string;