@phnx-labs/agents-cli 1.20.50 → 1.20.52

package/dist/commands/secrets.js

@@ -7,6 +7,7 @@
  */
 import { Option } from 'commander';
 import chalk from 'chalk';
+import { padVisible, readStdinSync } from '../lib/format.js';
 import { terminalWidth, truncateToWidth, stringWidth } from '../lib/session/width.js';
 import * as fs from 'fs';
 import { SSH_TARGET_RE, assertValidSshTarget, sshExec } from '../lib/ssh-exec.js';
@@ -23,6 +24,7 @@ import { parseDuration } from '../lib/hooks/cache.js';
 import { emit } from '../lib/events.js';
 import { registerCommandGroups, setHelpSections } from '../lib/help.js';
 import { isInteractiveTerminal, isPromptCancelled } from './utils.js';
+import { discoverSyncedBundles, importSyncedBundle, } from '../lib/secrets/icloud-import.js';
 import { registerSecretsSyncCommands } from './secrets-sync.js';
 import { registerSecretsMigrateAclCommand } from './secrets-migrate.js';
 import { registerSecretsImportKeyringCommand } from './secrets-import.js';
@@ -125,23 +127,6 @@ async function resolveVault(vaultOpt) {
     });
 }
 /** Read all available data from stdin synchronously, trimmed. */
-function readStdinSync() {
-    const chunks = [];
-    const buf = Buffer.alloc(65536);
-    while (true) {
-        let bytesRead;
-        try {
-            bytesRead = fs.readSync(0, buf, 0, buf.length, null);
-        }
-        catch {
-            break;
-        }
-        if (bytesRead === 0)
-            break;
-        chunks.push(Buffer.from(buf.subarray(0, bytesRead)));
-    }
-    return Buffer.concat(chunks).toString('utf-8').trim();
-}
 /**
  * Read the raw `.env` text for `import --from <path|->`. A `-` reads the .env
  * from stdin (the SSH push path: `export --host` pipes the resolved dotenv over
@@ -151,6 +136,101 @@ function readStdinSync() {
 export function readImportDotenv(from) {
     return from === '-' ? readStdinSync() : fs.readFileSync(from, 'utf-8');
 }
+/**
+ * Parse the unified `--from <source>` value: a .env path (`-` reads stdin),
+ * `1password:<vault>` (bare `1password` prompts for the vault), or `icloud`
+ * (legacy iCloud Keychain bundles). The deprecated `--from-1password --vault`
+ * pair maps onto the 1password source. A file literally named `icloud` or
+ * `1password` can still be imported via an explicit path (`./icloud`).
+ */
+export function parseImportSource(opts) {
+    if (opts.from && opts.from1password) {
+        throw new Error('--from and --from-1password are mutually exclusive.');
+    }
+    if (opts.from1password)
+        return { kind: '1password', vault: opts.vault };
+    if (!opts.from) {
+        throw new Error("Pass --from <source>: a .env path (- reads stdin), '1password:<vault>', or 'icloud'.");
+    }
+    if (opts.from === 'icloud')
+        return { kind: 'icloud' };
+    if (opts.from === '1password')
+        return { kind: '1password', vault: opts.vault };
+    if (opts.from.startsWith('1password:')) {
+        const vault = opts.from.slice('1password:'.length);
+        return { kind: '1password', vault: vault || opts.vault };
+    }
+    return { kind: 'dotenv', path: opts.from };
+}
+/**
+ * `secrets import --from icloud` — recover bundles stranded in the iCloud
+ * Keychain by the device-local cutover. With a bundle name, imports exactly
+ * that bundle; without one, interactively multi-selects from everything
+ * discovered (all pre-checked — the common case is "bring them all back").
+ */
+async function importFromICloud(bundleName, opts) {
+    if (process.platform !== 'darwin') {
+        throw new Error('--from icloud reads the macOS iCloud Keychain and is only available on macOS.');
+    }
+    const candidates = discoverSyncedBundles();
+    if (candidates.length === 0) {
+        console.log('No legacy iCloud Keychain bundles found.');
+        return;
+    }
+    const describe = (c) => `${c.name} (${c.keys.length} key${c.keys.length === 1 ? '' : 's'}${c.hasMeta ? '' : ', no metadata'})`;
+    let chosen;
+    if (bundleName) {
+        const hit = candidates.find((c) => c.name === bundleName);
+        if (!hit) {
+            throw new Error(`No iCloud Keychain bundle named '${bundleName}'. Found: ${candidates.map((c) => c.name).join(', ')}`);
+        }
+        chosen = [hit];
+    }
+    else if (!isInteractiveTerminal()) {
+        throw new Error(`Found ${candidates.length} iCloud Keychain bundle(s): ${candidates.map((c) => c.name).join(', ')}. ` +
+            'Pass a bundle name to import non-interactively.');
+    }
+    else {
+        const { checkbox } = await import('@inquirer/prompts');
+        chosen = await checkbox({
+            message: 'Which iCloud Keychain bundles to import?',
+            choices: candidates.map((c) => ({ name: describe(c), value: c, checked: true })),
+        });
+        if (chosen.length === 0) {
+            console.log('Nothing selected.');
+            return;
+        }
+    }
+    for (const candidate of chosen) {
+        const result = importSyncedBundle(candidate, opts);
+        const parts = [`imported ${result.added} key(s)`];
+        if (result.skipped)
+            parts.push(`skipped ${result.skipped} (already set, pass --force)`);
+        if (result.missing.length)
+            parts.push(`unreadable (left in iCloud): ${result.missing.join(', ')}`);
+        if (opts.purge)
+            parts.push(`purged ${result.purged} iCloud item(s)`);
+        const line = `${candidate.name}: ${parts.join(', ')}`;
+        console.log(result.missing.length ? chalk.yellow(line) : chalk.green(line));
+    }
+}
+/**
+ * Printed under a "bundle not found" failure: if the name matches a bundle
+ * stranded in the iCloud Keychain (pre-device-local-cutover era), point at the
+ * recovery command instead of leaving a dead end.
+ */
+function maybePrintSyncedHint(name) {
+    if (process.platform !== 'darwin')
+        return;
+    try {
+        if (discoverSyncedBundles().some((c) => c.name === name)) {
+            console.error(chalk.yellow(`A legacy iCloud Keychain copy of '${name}' exists. Recover it with: agents secrets import ${name} --from icloud`));
+        }
+    }
+    catch {
+        // Hint only — never mask the original error.
+    }
+}
 /**
  * Build the remote `agents secrets unlock` argv for `unlock --host`. `--all`
  * forwards verbatim; otherwise the explicit bundle names. A `--ttl` is passed
@@ -257,17 +337,6 @@ async function browseRemote(targets, args, tty) {
         process.exit(1);
 }
 /** Strip ANSI escape sequences so padding can be computed on visible width. */
-function visibleWidth(s) {
-    // eslint-disable-next-line no-control-regex
-    return s.replace(/\x1b\[[0-9;]*m/g, '').length;
-}
-/** padEnd that respects ANSI color codes (chalk-wrapped strings have invisible bytes). */
-function padVisible(s, n) {
-    const w = visibleWidth(s);
-    if (w >= n)
-        return s;
-    return s + ' '.repeat(n - w);
-}
 /** Render an ISO-8601 timestamp as a compact relative age: "now", "5m", "1h", "3d", "2w", "4mo", "1y". */
 function relativeAge(iso) {
     const t = Date.parse(iso);
@@ -552,7 +621,8 @@ export function registerSecretsCommands(program) {
         agents secrets status                          show held bundles + when they lock
         agents secrets rotate <bundle> <key>           rotate value, preserve metadata
         agents secrets import <bundle> --from .env     bulk import from .env
-        agents secrets import <bundle> --from-1password --vault <name>
+        agents secrets import <bundle> --from 1password:<vault>
+        agents secrets import --from icloud            recover legacy iCloud Keychain bundles
         agents secrets generate [length]               generate a random password / PIN / hex
         agents secrets migrate-acl                     upgrade legacy items to the biometry ACL
     `,
@@ -637,7 +707,15 @@ export function registerSecretsCommands(program) {
                 return;
             }
             const resolvedName = name ?? (await pickBundleName('view'));
-            const bundle = readBundle(resolvedName);
+            let bundle;
+            try {
+                bundle = readBundle(resolvedName);
+            }
+            catch (err) {
+                console.error(chalk.red(err.message));
+                maybePrintSyncedHint(resolvedName);
+                process.exit(1);
+            }
             const entries = describeBundle(bundle);
             console.log(chalk.bold(bundle.name));
             if (bundle.description)
@@ -699,7 +777,7 @@ export function registerSecretsCommands(program) {
                     emit('secrets.get', {
                         module: 'secrets',
                         bundle: bundle.name,
-                        caller: 'view --reveal',
+                        operation: 'view --reveal',
                         source: 'reveal',
                         status: 'success',
                         keyCount: exposedCount,
@@ -740,24 +818,48 @@ export function registerSecretsCommands(program) {
         }
     });
     cmd
-        .command('get <item>')
-        .description('Print a raw keychain item by name (for shell hooks/automation). Cross-platform; no bundle required.')
-        .action((item) => {
+        .command('get <item> [key]')
+        .description('Print one secret value for shell hooks/automation. One arg = a raw keychain item by name; two args = one KEY out of a bundle (`get <bundle> <KEY>`). Cross-platform.')
+        .action((item, key) => {
+        if (key === undefined) {
+            // Raw keychain item path — unchanged.
+            try {
+                // Routes through the platform keychain layer: macOS reads bare items
+                // via /usr/bin/security (no Touch ID), Linux via secret-tool with the
+                // encrypted-file fallback. The value goes to stdout (newline-terminated
+                // so `$(agents secrets get NAME)` captures it cleanly); diagnostics go
+                // to stderr so they never pollute the captured value.
+                const value = getKeychainToken(item);
+                // Raw item reads bypass readAndResolveBundleEnv, so audit here too.
+                // `item` is the keychain service name, never the value.
+                emit('secrets.get', { module: 'secrets', item, source: 'raw-item', status: 'success' });
+                process.stdout.write(value.endsWith('\n') ? value : `${value}\n`);
+            }
+            catch {
+                // Missing item is a normal, quiet outcome for a hook probe: exit 1,
+                // print nothing to stdout. Callers test the exit code / empty capture.
+                process.exit(1);
+            }
+            return;
+        }
+        // Bundle-key path: `get <bundle> <KEY>` prints exactly one resolved value.
+        // Ungated like the raw path (it IS the automation primitive); the
+        // `secrets.get` audit event is emitted inside readAndResolveBundleEnv.
         try {
-            // Routes through the platform keychain layer: macOS reads bare items
-            // via /usr/bin/security (no Touch ID), Linux via secret-tool with the
-            // encrypted-file fallback. The value goes to stdout (newline-terminated
-            // so `$(agents secrets get NAME)` captures it cleanly); diagnostics go
-            // to stderr so they never pollute the captured value.
-            const value = getKeychainToken(item);
-            // Raw item reads bypass readAndResolveBundleEnv, so audit here too.
-            // `item` is the keychain service name, never the value.
-            emit('secrets.get', { module: 'secrets', item, source: 'raw-item', status: 'success' });
+            if (!bundleExists(item)) {
+                console.error(chalk.red(`Secrets bundle '${item}' not found.`));
+                process.exit(1);
+            }
+            const { env } = readAndResolveBundleEnv(item, { caller: 'secrets get', keys: [key] });
+            if (!(key in env)) {
+                console.error(chalk.red(`Key '${key}' not in bundle '${item}'.`));
+                process.exit(1);
+            }
+            const value = env[key];
             process.stdout.write(value.endsWith('\n') ? value : `${value}\n`);
         }
-        catch {
-            // Missing item is a normal, quiet outcome for a hook probe: exit 1,
-            // print nothing to stdout. Callers test the exit code / empty capture.
+        catch (err) {
+            console.error(chalk.red(err.message));
             process.exit(1);
         }
     });
@@ -1187,23 +1289,34 @@ Examples:
     });
     cmd
         .command('import [bundle]')
-        .description('Import keys from a .env file or a 1Password vault into a bundle. The bundle is created if it does not exist. Values are stored in the bundle\'s backend (keychain by default).')
-        .option('--from <path>', 'Path to a .env file (use - to read the .env from stdin)')
-        .option('--from-1password', 'Import secrets from a 1Password vault (requires the op CLI)')
-        .option('--vault <name>', '1Password vault name (used with --from-1password)')
+        .description('Import keys into a bundle from a .env file, a 1Password vault, or legacy iCloud Keychain bundles. The bundle is created if it does not exist. Values are stored in the bundle\'s backend (keychain by default).')
+        .option('--from <source>', "Source: a .env path (- reads stdin), '1password:<vault>', or 'icloud' (legacy iCloud Keychain bundles)")
+        .addOption(new Option('--from-1password', 'deprecated alias for --from 1password:<vault>').hideHelp())
+        .addOption(new Option('--vault <name>', 'deprecated: name the vault in --from 1password:<vault>').hideHelp())
         .option('--all-plaintext', 'Store every imported value as a literal in the bundle metadata (skip keychain item creation)')
         .option('--backend <backend>', 'When creating the bundle: keychain (default) or file (passphrase-encrypted, headless-readable)', 'keychain')
         .option('--force', 'Overwrite an existing key in the bundle')
+        .option('--purge', 'With --from icloud: delete the iCloud copies after a successful import (iCloud propagates the deletion to your other devices)')
         .action(async (bundleName, opts) => {
         try {
-            if (!opts.from && !opts.from1password) {
-                throw new Error('Pass --from <path> to import a .env file, or --from-1password to import from a 1Password vault.');
+            const source = parseImportSource(opts);
+            if (opts.purge && source.kind !== 'icloud') {
+                throw new Error('--purge only applies to --from icloud.');
             }
-            if (opts.from && opts.from1password) {
-                throw new Error('--from and --from-1password are mutually exclusive.');
+            if (opts.from1password) {
+                console.log(chalk.yellow('--from-1password is deprecated; use --from 1password:<vault>.'));
             }
-            const resolvedBundleName = bundleName ?? (await pickBundleName('import into'));
             const requestedBackend = parseBackendOpt(opts.backend);
+            if (source.kind === 'icloud') {
+                await importFromICloud(bundleName, {
+                    force: opts.force,
+                    allPlaintext: opts.allPlaintext,
+                    backend: requestedBackend === 'file' ? 'file' : undefined,
+                    purge: opts.purge,
+                });
+                return;
+            }
+            const resolvedBundleName = bundleName ?? (await pickBundleName('import into'));
             // Read the bundle if it exists (inheriting its backend); otherwise
             // create it with the requested backend so a single `import --backend
             // file` works (this is what `export --host ... --remote-backend file`
@@ -1226,9 +1339,9 @@ Examples:
             const store = bundleItemStore(bundle.backend, { noAcl: bundlePolicy(bundle) === 'never' });
             let added = 0;
             let skipped = 0;
-            if (opts.from1password) {
+            if (source.kind === '1password') {
                 assertOpAvailable();
-                const vault = await resolveVault(opts.vault);
+                const vault = await resolveVault(source.vault);
                 const items = listItems(vault);
                 const { secrets, skipped: opSkipped } = extractSecrets(items, vault);
                 for (const { envKey, value } of secrets) {
@@ -1253,7 +1366,7 @@ Examples:
                 console.log(chalk.green(`Imported ${added} key(s) from 1Password vault '${vault}'${skipped ? `, skipped ${skipped} (already set, pass --force)` : ''}.`));
             }
             else {
-                const raw = readImportDotenv(opts.from);
+                const raw = readImportDotenv(source.path);
                 const pairs = parseDotenv(raw);
                 for (const [key, value] of Object.entries(pairs)) {
                     if (!opts.force && key in bundle.vars) {
@@ -1747,20 +1860,11 @@ Examples:
                 console.error(chalk.yellow('Aborted.'));
                 return;
             }
-            const wasDaily = bundlePolicy(bundle) === 'daily';
             bundle.policy = next;
+            // writeBundle evicts any broker-held copy, so tightening daily ->
+            // always/never takes effect NOW: the next read re-prompts (`always`)
+            // or reads its no-ACL item directly (`never`).
             writeBundle(bundle);
-            // Tightening daily -> always/never must take effect NOW, not up to the
-            // ~7d hold later. If the broker is already serving this bundle silently
-            // (auto-cached under the old `daily` policy), evict it so the next read
-            // re-prompts (`always`) or reads its no-ACL item directly (`never`).
-            // macOS-only + best-effort; agentLock no-ops off darwin / with no broker.
-            if (wasDaily && next !== 'daily') {
-                try {
-                    await agentLock(bundle.name);
-                }
-                catch { /* broker down — nothing held */ }
-            }
             console.log(chalk.green(`${bundle.name} policy set to ${next}.`));
             if (next === 'daily') {
                 console.log(chalk.gray('Held by the secrets-agent for ~7 days after one unlock (auto-cache is on by default; disable with `secrets.agent.auto: false` in agents.yaml).'));

package/dist/commands/sessions-picker.js

@@ -7,6 +7,7 @@
  */
 import fs from 'node:fs';
 import chalk from 'chalk';
+import { truncate, humanDuration } from '../lib/format.js';
 import { parseSession, sanitizeForTerminal } from '../lib/session/parse.js';
 import { cleanSessionPrompt, extractSessionTopic } from '../lib/session/prompt.js';
 import { linkPath, relativeToCwd } from '../lib/session/render.js';
@@ -154,21 +155,6 @@ function extractTiming(events) {
     const dur = Number.isNaN(lastMs) ? undefined : humanDuration(Math.max(0, lastMs - firstMs));
     return { startedAgo: ago, duration: dur };
 }
-function humanDuration(ms) {
-    const s = Math.floor(ms / 1000);
-    if (s < 60)
-        return `${s}s`;
-    const m = Math.floor(s / 60);
-    if (m < 60)
-        return `${m}m`;
-    const h = Math.floor(m / 60);
-    const mm = m % 60;
-    if (h < 24)
-        return mm ? `${h}h ${mm}m` : `${h}h`;
-    const d = Math.floor(h / 24);
-    const hh = h % 24;
-    return hh ? `${d}d ${hh}h` : `${d}d`;
-}
 function countMessages(events) {
     return events.filter(e => e.type === 'message').length;
 }
@@ -364,9 +350,6 @@ function renderTodos(todos, termWidth) {
     }
     return out;
 }
-function truncate(s, max) {
-    return s.length > max ? s.slice(0, max - 1) + '…' : s;
-}
 /** Show an interactive session picker and return the selected session with its action (resume or view). */
 export async function sessionPicker(config) {
     const picked = await itemPicker({

package/dist/commands/sessions.js

@@ -12,6 +12,7 @@ import * as os from 'os';
 import * as path from 'path';
 import { spawn } from 'child_process';
 import chalk from 'chalk';
+import { truncate, padRight } from '../lib/format.js';
 import ora from 'ora';
 import { SESSION_AGENTS } from '../lib/session/types.js';
 import { discoverArtifacts, readArtifact, resolveArtifact } from '../lib/session/artifacts.js';
@@ -1349,8 +1350,11 @@ async function renderSession(session, mode, filters, options = {}) {
         process.stdout.write(renderMarkdown(renderConversationMarkdown(events, { redact: options.noRedact !== true })));
         return;
     }
-    // json — no header, raw events only (pipeable)
-    process.stdout.write(renderJson(events));
+    // json — normalized events plus the durable session signals from the state
+    // engine (plan text, PR, worktree, ticket). Pre-1.20.51 emitted a bare event
+    // array; consumers that JSON.parse this now read `output.events` for the
+    // array. See issue #743 (plan surfaced) and CHANGELOG for the shape change.
+    process.stdout.write(renderJson(events, session));
 }
 function renderTopicCell(label, topic, query, visibleWidth, paddedWidth) {
     const lbl = (label ?? '').trim();
@@ -2289,9 +2293,3 @@ function formatAbsoluteTime(isoTimestamp) {
     const mm = String(d.getMinutes()).padStart(2, '0');
     return `${months[d.getMonth()]} ${d.getDate()} ${hh}:${mm}`;
 }
-function padRight(s, width) {
-    return s.length >= width ? s : s + ' '.repeat(width - s.length);
-}
-function truncate(s, max) {
-    return s.length > max ? s.slice(0, max - 1) + '.' : s;
-}

package/dist/commands/teams-picker.js

@@ -7,6 +7,7 @@
  * activity for each team.
  */
 import chalk from 'chalk';
+import { relTime, truncate, humanDuration } from '../lib/format.js';
 import { itemPicker } from '../lib/picker.js';
 const AGENT_LABEL = {
     claude: 'Claude',
@@ -26,23 +27,6 @@ function statusColor(status) {
         default: return chalk.white;
     }
 }
-function relTime(iso) {
-    const secs = Math.floor((Date.now() - new Date(iso).getTime()) / 1000);
-    if (secs < 10)
-        return 'just now';
-    if (secs < 60)
-        return `${secs}s ago`;
-    if (secs < 3600)
-        return `${Math.floor(secs / 60)}m ago`;
-    if (secs < 86400)
-        return `${Math.floor(secs / 3600)}h ago`;
-    return `${Math.floor(secs / 86400)}d ago`;
-}
-function truncate(s, n) {
-    if (s.length <= n)
-        return s;
-    return s.slice(0, n - 1) + '…';
-}
 function firstLine(s) {
     // Collapse to the first non-empty line so multi-line messages (markdown,
     // code blocks) render cleanly inside a one-line preview slot.
@@ -120,21 +104,6 @@ function formatComposition(agents) {
         .map(([type, n]) => (n === 1 ? type : `${type}×${n}`));
     return parts.join(' ');
 }
-function humanDuration(ms) {
-    const s = Math.floor(ms / 1000);
-    if (s < 60)
-        return `${s}s`;
-    const m = Math.floor(s / 60);
-    if (m < 60)
-        return `${m}m`;
-    const h = Math.floor(m / 60);
-    const mm = m % 60;
-    if (h < 24)
-        return mm ? `${h}h${mm}m` : `${h}h`;
-    const d = Math.floor(h / 24);
-    const hh = h % 24;
-    return hh ? `${d}d${hh}h` : `${d}d`;
-}
 function runtimeSpan(t) {
     const startMs = new Date(t.created_at).getTime();
     const endMs = new Date(t.modified_at).getTime();

package/dist/commands/teams.js

@@ -1,9 +1,11 @@
 import chalk from 'chalk';
+import { die, relTime, truncate, isJsonMode, padRight } from '../lib/format.js';
 import * as fs from 'fs/promises';
 import { addHostOption } from '../lib/hosts/option.js';
 import * as path from 'path';
 import { AgentManager, checkCliSignedIn, collectTeamsDoctorData, getAgentsDir, VALID_TASK_TYPES, } from '../lib/teams/agents.js';
 import { resolveProvider } from '../lib/cloud/registry.js';
+import { emit } from '../lib/events.js';
 import { runSupervisor } from '../lib/teams/supervisor.js';
 import { debug } from '../lib/teams/debug.js';
 import { runPrWatch, DEFAULT_MAX_WAVES, } from '../lib/teams/pr-watch.js';
@@ -48,13 +50,6 @@ const VALID_EFFORTS = ['low', 'medium', 'high', 'xhigh', 'max', 'auto'];
 const VALID_CLOUD_PROVIDERS = ['rush', 'codex', 'factory'];
 // Auto-enable JSON mode when piped / not a TTY so AI agent consumers get
 // parseable output by default.
-function isJsonMode(opts) {
-    return Boolean(opts.json) || !process.stdout.isTTY;
-}
-function die(msg, code = 1) {
-    console.error(chalk.red(msg));
-    process.exit(code);
-}
 function statusColor(status) {
     switch (status) {
         case 'pending': return chalk.blue;
@@ -65,23 +60,6 @@ function statusColor(status) {
         default: return chalk.white;
     }
 }
-function relTime(iso) {
-    const secs = Math.floor((Date.now() - new Date(iso).getTime()) / 1000);
-    if (secs < 10)
-        return 'just now';
-    if (secs < 60)
-        return `${secs}s ago`;
-    if (secs < 3600)
-        return `${Math.floor(secs / 60)}m ago`;
-    if (secs < 86400)
-        return `${Math.floor(secs / 3600)}h ago`;
-    return `${Math.floor(secs / 86400)}d ago`;
-}
-function truncate(s, n) {
-    if (s.length <= n)
-        return s;
-    return s.slice(0, n - 1) + '…';
-}
 function compactPrompt(s, n = 160) {
     return truncate(s.replace(/\s+/g, ' ').trim(), n);
 }
@@ -98,9 +76,6 @@ function formatTimestamp(iso) {
         minute: '2-digit',
     });
 }
-function padRight(s, width) {
-    return s.length >= width ? s : s + ' '.repeat(width - s.length);
-}
 function fullName(type, version) {
     const name = AGENT_NAMES[type];
     return version ? `${name} ${version}` : name;
@@ -1343,6 +1318,7 @@ export function registerTeamsCommands(program) {
         }
         try {
             const result = await handleSpawn(mgr, team, agent, effectiveTask, cwd, opts.mode, opts.effort, null, cwd, version, opts.name ?? null, after, opts.model ?? null, envOverrides ?? null, taskType, cloudProviderId, cloudSessionId, opts.repo ?? null, opts.branch ?? null, worktreeName, worktreePath, profileName, hostName, hostTarget, hostRepoPath);
+            emit('teams.add', { module: 'teams', team, agent, name: result.name, agent_id: result.agent_id, status: result.status });
             if (isJsonMode(opts)) {
                 console.log(JSON.stringify(result, null, 2));
                 return;
@@ -1513,6 +1489,7 @@ export function registerTeamsCommands(program) {
             await warnUnsignedTeammates(mgr, team);
             await warnThrottledTeammates(mgr, team);
         }
+        emit('teams.start', { module: 'teams', team, watch: Boolean(opts.watch) });
         if (!opts.watch) {
             await runOneWave(mgr, team, Boolean(opts.json));
             return;
@@ -1552,6 +1529,7 @@ export function registerTeamsCommands(program) {
             },
         });
         const elapsed = Math.floor(result.elapsed_ms / 1000);
+        emit('teams.complete', { module: 'teams', team, stoppedBy: result.stoppedBy, waves: result.waves, durationMs: result.elapsed_ms });
         if (result.stoppedBy === 'drained') {
             console.log(chalk.green(`Factory drained in ${elapsed}s (${result.waves} waves).`));
         }

package/dist/commands/tmux.js

@@ -21,6 +21,7 @@
  *   agents tmux kill-all       [--yes]
  */
 import chalk from 'chalk';
+import { truncate } from '../lib/format.js';
 import * as path from 'path';
 import { setHelpSections } from '../lib/help.js';
 import { assertTmuxAvailable, attachTmux, capturePane, createSession, getDefaultSocketPath, getTmuxVersion, hasSession, isTmuxInstalled, killAll, killSession, listSessions, readSessionMeta, sendKeys, splitPane, TmuxCommandError, TmuxSessionError, TmuxUnavailableError, } from '../lib/tmux/index.js';
@@ -395,9 +396,6 @@ function formatAge(secs) {
     const h = Math.floor(m / 60);
     return `${h}h ${m % 60}m`;
 }
-function truncate(s, n) {
-    return s.length > n ? `${s.slice(0, n - 1)}…` : s;
-}
 function printMeta(m) {
     console.log(`  ${chalk.bold('name')}       ${m.name}`);
     console.log(`  ${chalk.bold('socket')}     ${m.socket}`);

package/dist/commands/view.js

@@ -1,5 +1,6 @@
 import { addHostOption } from '../lib/hosts/option.js';
 import chalk from 'chalk';
+import { visibleWidth, termLink } from '../lib/format.js';
 import ora from 'ora';
 import * as fs from 'fs';
 import * as path from 'path';
@@ -67,12 +68,6 @@ function profileKindAndModel(model, planWidth) {
     const kind = 'profile'.padEnd(Math.max(planWidth, 'profile'.length));
     return `${kind}  ${model}`;
 }
-function termLink(text, filePath) {
-    if (!process.stdout.isTTY)
-        return text;
-    const url = `file://${filePath}`;
-    return `\x1b]8;;${url}\x1b\\${text}\x1b]8;;\x1b\\`;
-}
 /**
  * Resolve a resource path to something the IDE can open inline. When `p` is a
  * directory, OSC 8 file:// links cause IDEs (Cursor/VS Code) to open it as a
@@ -112,9 +107,6 @@ function formatLastActive(date) {
         return chalk.gray(`${days}d ago`);
     return chalk.gray(`${days}d ago`);
 }
-function visibleWidth(s) {
-    return s.replace(/\u001b\[[0-9;]*m/g, '').length;
-}
 function compareVersions(a, b) {
     const partsA = a.split('.').map(Number);
     const partsB = b.split('.').map(Number);

package/dist/commands/worktree.js

@@ -1,4 +1,5 @@
 import chalk from 'chalk';
+import { die } from '../lib/format.js';
 import { execFile } from 'child_process';
 import { promisify } from 'util';
 import * as fs from 'fs/promises';
@@ -8,10 +9,6 @@ import { setHelpSections } from '../lib/help.js';
 const execFileAsync = promisify(execFile);
 const WORKTREE_SUBDIR = path.join('.agents', 'worktrees');
 const BRANCH_PREFIX = 'agents/';
-function die(msg, code = 1) {
-    console.error(chalk.red(msg));
-    process.exit(code);
-}
 function isValidTerminalId(id) {
     // Allow letters, digits, dot, dash, underscore. Reject anything else so a
     // hostile or buggy caller can't inject path traversal or shell metachars.

package/dist/index.js

@@ -50,7 +50,7 @@ if (IS_DEV_BUILD) {
 // module on each invocation (which loaded the whole ~50-module tree before the
 // first byte of output), the registry maps a command name to a thunk that
 // imports only what that command needs. See src/lib/startup/command-registry.ts.
-import { COMMAND_LOADERS, LAZY_COMMAND_NAMES, loadView, loadInspect, loadFeedback, loadCommands, loadHooks, loadSkills, loadRules, loadPermissions, loadMcp, loadCli, loadSubagents, loadPlugins, loadWorkflows, loadWorktree, loadVersions, loadImport, loadPackages, loadDaemon, loadRoutines, loadRun, loadDefaults, loadModels, loadPrune, loadTrash, loadRestore, loadDoctor, loadCheck, loadStatus, loadProfiles, loadSecrets, loadWallet, loadHelper, loadMenubar, loadBeta, loadSync, loadLock, loadRefreshRules, loadDrive, loadFactory, loadUsage, loadCost, loadBudget, loadAlias, loadPty, loadTmux, loadWatchdog, loadBrowser, loadComputer, loadHosts, loadLogs, loadEvents, loadAudit, loadSsh, loadPull, loadPush, loadRepo, loadSetup, } from './lib/startup/command-registry.js';
+import { COMMAND_LOADERS, LAZY_COMMAND_NAMES, loadView, loadInspect, loadFeedback, loadCommands, loadHooks, loadSkills, loadRules, loadPermissions, loadMcp, loadCli, loadSubagents, loadPlugins, loadWorkflows, loadWorktree, loadVersions, loadImport, loadPackages, loadDaemon, loadRoutines, loadRun, loadDefaults, loadModels, loadPrune, loadTrash, loadRestore, loadDoctor, loadCheck, loadStatus, loadProfiles, loadSecrets, loadWallet, loadHelper, loadMenubar, loadBeta, loadSync, loadLock, loadRefreshRules, loadDrive, loadFactory, loadUsage, loadCost, loadBudget, loadAlias, loadPty, loadTmux, loadWatchdog, loadBrowser, loadComputer, loadHosts, loadLogs, loadEvents, loadAudit, loadSsh, loadPull, loadPush, loadRepo, loadSetup, loadFeed, } from './lib/startup/command-registry.js';
 import { applyGlobalHelpConventions } from './lib/help.js';
 import { renderWhatsNew } from './lib/whats-new.js';
 import { emit, redactArgs } from './lib/events.js';
@@ -101,7 +101,10 @@ program.hook('preAction', (_thisCommand, actionCommand) => {
         emit('command.start', {
             module: parts[0],
             command: parts.join(' '),
-            args: redactArgs(actionCommand.args),
+            // Commander exposes positional operands in actionCommand.args but omits
+            // parsed option values. Audit the real argv so sensitive flags are seen
+            // and redacted instead of silently bypassing the policy.
+            args: redactArgs(process.argv.slice(2, 22)),
             cwd: process.cwd(),
         });
     }
@@ -704,6 +707,7 @@ async function registerAllEagerCommands() {
     await reg(loadLogs);
     await reg(loadEvents);
     await reg(loadAudit);
+    await reg(loadFeed);
     await reg(loadSsh);
     registerJobsCronAliasCommand(program, 'jobs');
     registerJobsCronAliasCommand(program, 'cron');