@phnx-labs/agents-cli 1.20.50 → 1.20.52

package/dist/commands/computer.js

@@ -4,7 +4,9 @@ import * as os from 'os';
 import * as path from 'path';
 import { registerCommandGroups } from '../lib/help.js';
 import { openComputerClient, resolveHelperApp, resolveHelperExec, resolveSocketPath, resolveLogPath, resolvePolicyPath, resolvePeersPath, resolveTcpEndpoint, loadComputerAllowList, loadDefaultPeers, writeComputerPolicy, writeComputerPeers, } from '../lib/computer-rpc.js';
-import { setupRemoteHelper, startRemoteTunnel, stopRemoteHelper, hydrateRemoteEnvFromState, } from '../lib/ssh-tunnel.js';
+import { setupRemoteHelper, startRemoteTunnel, stopRemoteHelper, hydrateRemoteEnvFromState, readRemoteState, resolveRemoteDevice, REMOTE_TASK_NAME, WIN_HELPER_EXE, } from '../lib/ssh-tunnel.js';
+import { sshExec } from '../lib/ssh-exec.js';
+import { encodePowershell } from '../lib/hosts/remote-cmd.js';
 import { registerActionCommands, withClient, unwrap, pickTarget } from './computer-actions.js';
 import { runComputerLoop } from '../lib/computer/loop.js';
 import { makeVerbDispatcher } from '../lib/computer/dispatch.js';
@@ -18,9 +20,10 @@ const COMPUTER_HELP_GROUPS = [
     { title: 'Interact', names: ['launch', 'raise', 'click', 'right-click', 'type', 'type-text', 'key', 'drag', 'scroll', 'ax-action', 'focus', 'wait'] },
 ];
 // Subcommands that manage the `--host` remote path themselves (provisioning /
-// tunnel lifecycle). Every other `--host`-bearing subcommand is a plain verb
-// that just needs the TCP endpoint hydrated before it runs.
-const REMOTE_LIFECYCLE = new Set(['setup', 'start', 'stop']);
+// tunnel lifecycle, or daemon-state reporting that must degrade gracefully
+// when no tunnel is recorded). Every other `--host`-bearing subcommand is a
+// plain verb that just needs the TCP endpoint hydrated before it runs.
+const REMOTE_LIFECYCLE = new Set(['setup', 'start', 'stop', 'status', 'reload']);
 /**
  * Pure platform gate. The computer subsystem is macOS-only for LOCAL driving
  * (Accessibility / launchctl). It is NOT blocked off macOS when a remote daemon
@@ -111,8 +114,13 @@ export function registerComputerSubcommands(program) {
 function registerStatusCommand(program) {
     program
         .command('status')
-        .description('Report install state, daemon state, and Accessibility trust')
-        .action(async () => {
+        .description('Report install state, daemon state, and Accessibility trust — or a remote Windows daemon with --host')
+        .option('--host <device>', 'Report the remote Windows daemon (tunnel + liveness) instead of the local helper')
+        .action(async (opts) => {
+        if (opts.host) {
+            await reportRemoteStatus(opts.host);
+            return;
+        }
         const socketPath = resolveSocketPath();
         const installed = fs.existsSync(HELPER_APP_DEST);
         const socketUp = fs.existsSync(socketPath);
@@ -159,6 +167,108 @@ function registerStatusCommand(program) {
         }
     });
 }
+// status --host: the local checks (app install, launchd socket, policy files)
+// are macOS concepts — a remote Windows daemon is reported from what actually
+// exists for it: the recorded tunnel and a live trust_status probe through it.
+async function reportRemoteStatus(host) {
+    console.log(`host:      ${host}`);
+    const state = readRemoteState(host);
+    if (!state) {
+        console.log('tunnel:    none');
+        console.log('daemon:    unknown (no tunnel to probe through)');
+        console.log('');
+        console.log(`Run:  agents computer start --host ${host}`);
+        process.exit(1);
+    }
+    console.log(`tunnel:    127.0.0.1:${state.localPort} -> ${state.target} (127.0.0.1:${state.remotePort})`);
+    hydrateRemoteEnvFromState(host);
+    try {
+        const client = openComputerClient();
+        try {
+            const r = await client.call('trust_status');
+            if (r.error) {
+                console.error(`error: ${r.error.code}: ${r.error.message}`);
+                process.exit(1);
+            }
+            console.log('daemon:    running');
+            console.log(`trust:     ${r.result?.trusted ? 'granted' : 'denied'} (Windows UIAutomation needs no per-app grant)`);
+            if (typeof r.result?.pid === 'number')
+                console.log(`pid:       ${r.result.pid}`);
+            if (typeof r.result?.path === 'string' && r.result.path)
+                console.log(`exe:       ${r.result.path}`);
+        }
+        finally {
+            await client.close();
+        }
+    }
+    catch (err) {
+        console.log('daemon:    unreachable');
+        console.log(`           ${err.message}`);
+        console.log('');
+        console.log(`Run:  agents computer start --host ${host}`);
+        process.exit(1);
+    }
+}
+// PowerShell to bounce the remote daemon: kill the running exe (tolerating
+// "not running"), then start the LOGON scheduled task that owns its
+// lifecycle. Pure so tests can assert the exact script (mirrors the
+// ssh-tunnel script builders).
+export function buildRestartTaskScript(taskName, exeName) {
+    const procName = exeName.replace(/\.exe$/i, '');
+    return [
+        `$ErrorActionPreference = 'Stop'`,
+        `Stop-Process -Name '${procName}' -Force -ErrorAction SilentlyContinue`,
+        `Start-ScheduledTask -TaskName '${taskName}'`,
+        `Write-Output 'restarted'`,
+    ].join('; ');
+}
+// reload --host: the Windows daemon has no policy file to re-read (it
+// enforces no allow-list — see TrustStatus in native/computer-win/Rpc.cs), so
+// reload means bounce the daemon via its scheduled task — the way to pick up
+// a freshly pushed exe — then prove it answers through the recorded tunnel.
+async function reloadRemoteHelper(host) {
+    const { target } = await resolveRemoteDevice(host);
+    const script = buildRestartTaskScript(REMOTE_TASK_NAME, WIN_HELPER_EXE);
+    const res = sshExec(target, `powershell -NoProfile -NonInteractive -EncodedCommand ${encodePowershell(script)}`, { timeoutMs: 60_000 });
+    if (res.code !== 0) {
+        const msg = (res.stderr || res.stdout || '').trim();
+        console.error(`restart failed on ${target}${res.timedOut ? ' (timed out)' : ''}${msg ? `: ${msg}` : ''}`);
+        process.exit(1);
+    }
+    console.log(`task:   restarted "${REMOTE_TASK_NAME}" on ${target}`);
+    const state = readRemoteState(host);
+    if (!state) {
+        console.log(`(no tunnel recorded — run \`agents computer start --host ${host}\` to drive it)`);
+        return;
+    }
+    hydrateRemoteEnvFromState(host);
+    // The relaunched daemon needs a beat to rebind its port; poll through the
+    // tunnel until it answers.
+    const deadline = Date.now() + 15_000;
+    let lastErr = '';
+    while (Date.now() < deadline) {
+        try {
+            const client = openComputerClient();
+            try {
+                const r = await client.call('trust_status');
+                if (!r.error && r.result) {
+                    console.log(`reloaded: daemon answering (pid ${r.result.pid ?? '?'})`);
+                    return;
+                }
+                lastErr = r.error ? `${r.error.code}: ${r.error.message}` : 'empty result';
+            }
+            finally {
+                await client.close();
+            }
+        }
+        catch (err) {
+            lastErr = err.message;
+        }
+        await sleep(500);
+    }
+    console.error(`daemon did not answer within 15s after restart${lastErr ? ` (${lastErr})` : ''}`);
+    process.exit(1);
+}
 // run — the embedded observe -> act -> verify agent loop. A reasoning model
 // (Claude API by default, or any Anthropic-shaped endpoint via --base-url for
 // Ollama / vLLM / LiteLLM) drives the EXISTING computer verbs as tools over the
@@ -560,8 +670,19 @@ function registerStartCommand(program) {
 function registerReloadCommand(program) {
     program
         .command('reload')
-        .description('Reload the allow-list policy from ~/.agents/permissions/groups/ (SIGHUP the daemon)')
-        .action(async () => {
+        .description('Reload the allow-list policy (SIGHUP the local daemon) — or restart a remote Windows daemon with --host')
+        .option('--host <device>', 'Restart the remote Windows daemon (its scheduled task) instead of SIGHUPing the local one')
+        .action(async (opts) => {
+        if (opts.host) {
+            try {
+                await reloadRemoteHelper(opts.host);
+            }
+            catch (err) {
+                console.error(`error: ${err.message}`);
+                process.exit(1);
+            }
+            return;
+        }
         const socketPath = resolveSocketPath();
         if (!fs.existsSync(socketPath)) {
             console.error(`daemon not running (no socket at ${socketPath})`);

package/dist/commands/events.d.ts

@@ -1,7 +1,7 @@
 /**
  * `agents events` — read the structured audit/event log.
  *
- * The event log (`~/.agents/.cache/logs/events-YYYY-MM-DD.jsonl`) records every
+ * The event log (`~/.agents/events.jsonl`) records every
  * `agents <module> <cmd>` invocation plus richer typed events (secrets access,
  * version installs, ...), each stamped with who ran it and from where (OS user,
  * local vs SSH, remote client IP). This command reads it back — the audit trail

package/dist/commands/events.js

@@ -1,7 +1,7 @@
 /**
  * `agents events` — read the structured audit/event log.
  *
- * The event log (`~/.agents/.cache/logs/events-YYYY-MM-DD.jsonl`) records every
+ * The event log (`~/.agents/events.jsonl`) records every
  * `agents <module> <cmd>` invocation plus richer typed events (secrets access,
  * version installs, ...), each stamped with who ran it and from where (OS user,
  * local vs SSH, remote client IP). This command reads it back — the audit trail
@@ -125,8 +125,7 @@ function collect(value, previous) {
 }
 /** Tail today's event file, printing new lines as they land. */
 async function followLog() {
-    const today = new Date();
-    const file = `${getLogsPath()}/events-${today.getFullYear()}-${String(today.getMonth() + 1).padStart(2, '0')}-${String(today.getDate()).padStart(2, '0')}.jsonl`;
+    const file = getLogsPath();
     let offset = 0;
     try {
         offset = fs.statSync(file).size;

package/dist/commands/exec.js

@@ -11,6 +11,7 @@ import { setHelpSections } from '../lib/help.js';
 import { parseLoopInterval } from '../lib/loop.js';
 import { AGENTS } from '../lib/agents.js';
 import { recordDispatchedRun } from '../lib/audit/log.js';
+import { warnUnpushedWork, shouldWarnUnpushed } from '../lib/warn-unpushed.js';
 import * as fs from 'fs';
 import * as path from 'path';
 import * as os from 'os';
@@ -211,7 +212,7 @@ export function registerRunCommand(program) {
         .option('--secrets-keys <keys>', 'Inject only this comma-separated subset of keys from --secrets bundles (e.g. KEY1,KEY2). Missing keys are an error. Applies to all --secrets bundles on this run.')
         .option('--allow-expired', 'Inject secrets even if their expiry date has passed (overrides the pre-run expiry abort).')
         .option('--cwd <dir>', 'Working directory for the agent (defaults to current directory)')
-        .option('--add-dir <dir>', 'Grant access to an additional directory outside the project (Claude only, repeatable)', (val, prev) => [...prev, val], [])
+        .option('--add-dir <dir>', 'Grant access to an additional directory outside the project (Claude and Codex, repeatable)', (val, prev) => [...prev, val], [])
         .option('--json', 'Stream events as JSON lines (for parsing by other tools)')
         .option('--quiet', 'Suppress preamble (rotation banner, "Running:" line). Useful when piping JSON events to a parser.', false)
         .option('--headless', 'Force headless mode. Auto-enabled when a prompt is provided; pass explicitly to stay headless with no prompt (reads the prompt from stdin).', false)
@@ -245,6 +246,12 @@ export function registerRunCommand(program) {
     // `--on` and `--computer` are hidden aliases of `--host` — same behavior.
     runCmd.addOption(new Option('--on <name>', 'Alias of --host.').hideHelp());
     runCmd.addOption(new Option('--computer <name>', 'Alias of --host.').hideHelp());
+    // Required for the documented `agents run <agent> [prompt] -- <native flags>`
+    // passthrough: commander >=13 rejects excess operands by default, so any
+    // post-`--` token died with "too many arguments" before the action ran. The
+    // action re-derives the `--` boundary from rawArgs and still errors on excess
+    // operands that are NOT behind `--`.
+    runCmd.allowExcessArguments(true);
     setHelpSections(runCmd, {
         examples: `
       # Headless, read-only: investigate or summarize without writing files
@@ -293,10 +300,25 @@ export function registerRunCommand(program) {
     `,
     });
     runCmd.action(async (agentSpec, prompt, options, command) => {
-        // Capture everything after -- as passthrough args forwarded verbatim to the underlying CLI.
-        // Use command.args (all positional strings) and strip the declared positional args from the front.
-        const declaredArgCount = prompt !== undefined ? 2 : 1;
-        const passthroughArgs = command.args.slice(declaredArgCount);
+        // Capture everything after -- as passthrough args forwarded verbatim to the
+        // underlying CLI. Commander strips the literal `--` and folds what follows
+        // into the positional operands (so `agents run codex -- --yolo` would parse
+        // `--yolo` as the PROMPT) — recover the boundary from rawArgs instead of
+        // operand counts. Excess operands not behind `--` are still an error (an
+        // unquoted prompt must not silently become agent flags).
+        const rawArgs = process.argv;
+        const separatorIdx = rawArgs.indexOf('--');
+        const passthroughArgs = separatorIdx === -1 ? [] : rawArgs.slice(separatorIdx + 1);
+        const operandsBeforeSeparator = command.args.length - passthroughArgs.length;
+        if (operandsBeforeSeparator > 2) {
+            console.error(chalk.red(`Too many arguments for 'run'. Quote the prompt ("fix the bug"), and put agent-native flags after -- (agents run codex -- --yolo).`));
+            process.exit(1);
+        }
+        if (prompt !== undefined && operandsBeforeSeparator < 2) {
+            // The token commander assigned to [prompt] came from behind `--` — it is
+            // a native flag, not a prompt. Run interactively.
+            prompt = undefined;
+        }
         // --lease: invent a disposable cloud box for this run (via crabbox), run
         // the agent there, then tear it down. Unlike --host, nothing is registered.
         if (options.lease) {
@@ -305,7 +327,7 @@ export function registerRunCommand(program) {
                 process.exit(1);
             }
             const backend = typeof options.lease === 'string' ? options.lease : undefined;
-            const { detectSignedInRuntimes, pickRuntimes } = await import('../lib/crabbox/runtimes.js');
+            const { detectSignedInRuntimes, pickRuntimes, resolveClaudeCredentialsBlob } = await import('../lib/crabbox/runtimes.js');
             const { leaseAndRun } = await import('../lib/crabbox/lease.js');
             const { confirm } = await import('@inquirer/prompts');
             const detected = await detectSignedInRuntimes();
@@ -322,14 +344,28 @@ export function registerRunCommand(program) {
                 return `${d?.label ?? id}${d?.email ? ` (${d.email})` : ''}`;
             })
                 .join(', ');
+            // Claude ships its OAuth token (not just the .claude.json config) — name it
+            // explicitly so the consent covers the actual credential transferred.
+            const whatShips = runtimes.includes('claude') ? 'credentials + Claude OAuth token' : 'credentials';
             const ok = await confirm({
-                message: `Copy credentials for ${names} to a disposable cloud box, run there, then destroy it?`,
+                message: `Copy ${whatShips} for ${names} to a disposable cloud box, run there, then destroy it?`,
                 default: false,
             });
             if (!ok) {
                 console.error(chalk.yellow('Aborted — no credentials pushed, no box leased.'));
                 process.exit(1);
             }
+            // Read the Claude OAuth token from the local Keychain (silent) so it can be
+            // written to ~/.claude/.credentials.json on the box — otherwise Claude boots
+            // "Not logged in". Consent above already covered this transfer.
+            let claudeCredentialsJson = null;
+            if (runtimes.includes('claude')) {
+                const claudeEmail = detected.find((d) => d.id === 'claude')?.email ?? null;
+                claudeCredentialsJson = await resolveClaudeCredentialsBlob({ preferEmail: claudeEmail });
+                if (!claudeCredentialsJson) {
+                    console.error(chalk.yellow('Warning: could not read the local Claude OAuth token — the box may come up "Not logged in".'));
+                }
+            }
             try {
                 const { exitCode, box, toreDown } = await leaseAndRun({
                     agent: agentSpec.split('@')[0],
@@ -339,10 +375,11 @@ export function registerRunCommand(program) {
                     backend,
                     runtimes,
                     detected,
+                    claudeCredentialsJson,
                     secretsBundle: process.env.AGENTS_LEASE_SECRETS_BUNDLE,
                     keep: options.keepBox,
                 });
-                console.error(chalk.gray(toreDown ? `Box ${box.slug} destroyed.` : `Box ${box.slug} kept${box.ip ? ` (${box.ip})` : ''}. Stop it: crabbox stop --id ${box.slug}`));
+                console.error(chalk.gray(toreDown ? `Box ${box.slug} destroyed.` : `Box ${box.slug} kept${box.ip ? ` (${box.ip})` : ''}. Stop it: crabbox stop ${box.slug}`));
                 process.exit(exitCode === null ? 1 : exitCode);
             }
             catch (err) {
@@ -568,6 +605,9 @@ export function registerRunCommand(program) {
                 cwd: resumeExec.cwd ?? process.cwd(),
                 exitCode: resumeExit,
             });
+            // A resumed loop is always headless; surface any commits it left unpushed.
+            if (shouldWarnUnpushed(resumeExec.mode ?? 'auto', false))
+                await warnUnpushedWork(resumeExec.cwd ?? process.cwd());
             process.exit(resumeExit);
         }
         const [{ buildExecCommand, parseExecEnv, execAgent, runWithFallback, normalizeMode, resolveMode, headlessPlanStallCommand, nativeResume, resolveInteractive }, { ALL_AGENT_IDS }, { profileExists, resolveProfileForRun }, { readAndResolveBundleEnv, describeBundle, assertRemoteBundleFlagsUnsupported }, { splitBundleRef, resolveSshTarget, remoteResolveEnv }, { getConfiguredRunStrategy, normalizeRunStrategy, resolveRunVersion, rotationFailoverChain, shouldArmRotationFailover, RUN_STRATEGIES }, { getGlobalDefault, getVersionHomePath, resolveVersion, resolveVersionAlias, ensureAgentRunnable }, { buildDiscoveredPlugin, loadPluginManifest, syncPluginToVersion }, { parseWorkflowFrontmatter, resolveWorkflowRef, resolveAllowedSubagents, pruneStaleWorkflowSubagents }, { resolveRunDefaults }, { getMcpServersByName, buildWorkflowMcpConfig }, { supports },] = await Promise.all([
@@ -1279,6 +1319,9 @@ export function registerRunCommand(program) {
                 // Governance chokepoint (#347): the --acp path exits here, bypassing
                 // the normal finalize below — record its one audit entry.
                 recordDispatchedRun({ agent, version: defaultVersion ?? 'unknown', mode, cwd, exitCode });
+                // ACP headless run always has a prompt; surface any unpushed commits.
+                if (shouldWarnUnpushed(mode, false))
+                    await warnUnpushedWork(cwd);
                 process.exit(exitCode);
             }
             catch (err) {
@@ -1435,6 +1478,9 @@ export function registerRunCommand(program) {
                 // the normal finalize below — record its one audit entry.
                 const loopExit = loopExitCode(result.stoppedBy);
                 recordDispatchedRun({ agent, version: defaultVersion ?? 'unknown', mode, cwd, exitCode: loopExit });
+                // A loop is always headless; surface any commits it left unpushed.
+                if (shouldWarnUnpushed(mode, false))
+                    await warnUnpushedWork(cwd);
                 process.exit(loopExit);
             }
             catch (err) {
@@ -1462,6 +1508,13 @@ export function registerRunCommand(program) {
             }
             cleanupWorkflowMcpConfig();
             cleanupWorkflowSubagents();
+            // Surface committed-but-unpushed work a headless writable run left
+            // behind, so it isn't silently stranded in a worktree. Advisory only,
+            // never throws; skipped for interactive runs (the human sees the shell)
+            // and read-only plan mode (can't commit).
+            if (shouldWarnUnpushed(mode, resolveInteractive(execOptions))) {
+                await warnUnpushedWork(cwd);
+            }
             // Governance chokepoint (#347): every dispatched run finalizes here.
             // ONE tamper-evident audit record per run — non-fatal by contract.
             recordDispatchedRun({ agent: ranAgent, version: ranVersion ?? 'unknown', mode, cwd, exitCode });
@@ -1470,6 +1523,11 @@ export function registerRunCommand(program) {
         catch (err) {
             cleanupWorkflowMcpConfig();
             cleanupWorkflowSubagents();
+            // An agent that committed then crashed is the case where stranded work
+            // matters most — warn before exiting the error path too.
+            if (shouldWarnUnpushed(mode, resolveInteractive(execOptions))) {
+                await warnUnpushedWork(cwd);
+            }
             console.error(chalk.red(`Failed to execute ${agent}: ${err.message}`));
             process.exit(1);
         }

package/dist/commands/factory.js

@@ -1,13 +1,11 @@
 import chalk from 'chalk';
+import { die } from '../lib/format.js';
 import * as fs from 'fs';
 import * as path from 'path';
 import { homedir } from 'os';
 import { betaEnableHint, isBetaEnabled } from '../lib/beta.js';
 import { insertTask } from '../lib/cloud/store.js';
-function die(msg, code = 1) {
-    console.error(chalk.red(msg));
-    process.exit(code);
-}
+import { emit } from '../lib/events.js';
 function requireFactoryUrl() {
     const url = process.env.FACTORY_FLOOR_URL;
     if (!url) {
@@ -82,6 +80,13 @@ Examples:
             createdAt: now,
             updatedAt: now,
         });
+        emit('cloud.dispatch', {
+            module: 'factory',
+            taskId: result.cloud_execution_id,
+            ref,
+            linear_identifier: result.linear_identifier,
+            status: 'queued',
+        });
         console.log(chalk.green(`Submitted ${result.linear_identifier} (${result.label})`));
         console.log(`  ticket       ${result.ticket_id}`);
         console.log(`  execution    ${result.cloud_execution_id}`);

package/dist/commands/feed.d.ts

@@ -0,0 +1,9 @@
+/**
+ * `agents feed` -- list open blocks (decisions agents are waiting on).
+ *
+ * Aggregates block records from the local feed store and, with --host, from
+ * reachable remote hosts via SSH passthrough. Each block carries enough
+ * identity for `agents message` to route a reply back to the right agent.
+ */
+import type { Command } from 'commander';
+export declare function registerFeedCommand(program: Command): void;

package/dist/commands/feed.js

@@ -0,0 +1,69 @@
+import chalk from 'chalk';
+import { ensureFeedPublishHook, listBlocks } from '../lib/feed.js';
+import { machineId } from '../lib/machine-id.js';
+import { relTime } from '../lib/format.js';
+function renderBlock(b, localHost) {
+    const host = b.host !== localHost ? chalk.yellow(` [${b.host}]`) : '';
+    const runtime = chalk.gray(b.runtime);
+    const age = chalk.gray(relTime(b.ts));
+    console.log(`${chalk.cyan(b.mailboxId)}${host}  ${runtime}  ${age}`);
+    for (const question of b.questions) {
+        const header = question.header ? chalk.gray(`[${question.header}] `) : '';
+        console.log(`  ${header}${question.text}`);
+        if (question.options?.length) {
+            for (let i = 0; i < question.options.length; i++) {
+                const o = question.options[i];
+                const desc = o.description ? chalk.gray(` -- ${o.description}`) : '';
+                console.log(`    ${chalk.dim(`${i + 1}.`)} ${o.label}${desc}`);
+            }
+        }
+    }
+    if (b.ticket || b.pr) {
+        const meta = [b.ticket, b.pr].filter(Boolean).join('  ');
+        console.log(`  ${chalk.gray(meta)}`);
+    }
+    console.log(`  ${chalk.dim('reply:')} agents message ${b.mailboxId} "<answer>"`);
+    console.log();
+}
+export function registerFeedCommand(program) {
+    program
+        .command('feed')
+        .description('List open blocks -- decisions agents are waiting on')
+        .option('--json', 'Output as JSON')
+        .action(async (opts) => {
+        const setupWarnings = [];
+        const hookInstall = ensureFeedPublishHook();
+        if (hookInstall.error) {
+            setupWarnings.push(hookInstall.error);
+        }
+        else {
+            const [{ iterHooksCapableVersions, parseHookManifest, registerHooksToSettings }, { getVersionHomePath }] = await Promise.all([
+                import('../lib/hooks.js'),
+                import('../lib/versions.js'),
+            ]);
+            const manifest = parseHookManifest({ warn: false });
+            for (const { agent, version } of iterHooksCapableVersions({ agent: 'claude' })) {
+                const result = registerHooksToSettings(agent, getVersionHomePath(agent, version), manifest);
+                if (result.errors.length > 0) {
+                    setupWarnings.push(`${agent}@${version}: ${result.errors.join('; ')}`);
+                }
+            }
+        }
+        const blocks = listBlocks();
+        for (const warning of setupWarnings) {
+            console.error(chalk.yellow(`Feed hook setup warning: ${warning}`));
+        }
+        if (opts.json) {
+            console.log(JSON.stringify(blocks, null, 2));
+            return;
+        }
+        if (blocks.length === 0) {
+            console.log(chalk.gray('No open blocks.'));
+            return;
+        }
+        const local = machineId();
+        console.log(chalk.bold(`${blocks.length} open block${blocks.length === 1 ? '' : 's'}:\n`));
+        for (const b of blocks)
+            renderBlock(b, local);
+    });
+}

package/dist/commands/inspect.js

@@ -17,6 +17,7 @@ import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
 import chalk from 'chalk';
+import { truncate, termLink } from '../lib/format.js';
 import * as yaml from 'yaml';
 import { AGENTS, getCliState, resolveAgentName } from '../lib/agents.js';
 import { supports } from '../lib/capabilities.js';
@@ -1216,12 +1217,6 @@ function readFirstProseLine(p) {
     return '';
 }
 // ─── OSC-8 + path helpers ────────────────────────────────────────────────────
-function termLink(text, filePath) {
-    if (!filePath || !process.stdout.isTTY)
-        return text;
-    const url = `file://${filePath}`;
-    return `\x1b]8;;${url}\x1b\\${text}\x1b]8;;\x1b\\`;
-}
 function linkTarget(p) {
     if (!p)
         return '';
@@ -1271,8 +1266,3 @@ function safeCountSessions(agent) {
         return 0;
     }
 }
-function truncate(s, n) {
-    if (s.length <= n)
-        return s;
-    return s.slice(0, n - 1) + '…';
-}

package/dist/commands/logs.d.ts

@@ -1,10 +1,14 @@
 /**
- * `agents logs` — unified, discoverable run-log viewer.
+ * `agents logs` — unified, discoverable run-log viewer + audit trail.
  *
  * Resolves a run across two substrates and shows (or `-f` follows) its log:
  *  - host-dispatch tasks (`agents run --host`) → combined-stdout log, offset-tailed
  *  - sessions (the local index) → transcript, tailed via the sessions tailer
  *
+ * Subcommands:
+ *  - `agents logs audit` — read the structured audit/event log
+ *  - `agents logs stats` — show aggregate audit statistics
+ *
  * Concise by default: a bare `agents logs <id>` prints the same summary digest as
  * `agents sessions <id>` — cheap for an agent to glance at. The token-heavy full
  * transcript / raw stdout is opt-in behind `--full` (alias `-m/--markdown`).