@phnx-labs/agents-cli 1.20.51 → 1.20.52

package/dist/lib/crabbox/lease.js

@@ -7,7 +7,7 @@
  * `--script-stdin` body so the token contents never touch argv.
  */
 import { crabboxWarmup, crabboxWaitReady, crabboxRunScript, crabboxStop } from './cli.js';
-import { buildCredentialScript } from './runtimes.js';
+import { buildCredentialScript, CLAUDE_TOKEN_REMOTE } from './runtimes.js';
 /** POSIX single-quote for safe embedding in the generated bootstrap script. */
 function q(s) {
     return "'" + s.replace(/'/g, "'\\''") + "'";
@@ -46,20 +46,22 @@ const ENSURE_AGENTS_CLI = [
  * the credential files. Best-effort install steps never abort the run.
  */
 export function buildBootstrapScript(opts) {
-    const credScript = buildCredentialScript(opts.runtimes, opts.detected);
+    const credScript = buildCredentialScript(opts.runtimes, opts.detected, {
+        claudeCredentialsJson: opts.claudeCredentialsJson,
+    });
     const runParts = ['agents', 'run', q(opts.agent), q(opts.prompt), '--quiet'];
     if (opts.mode)
         runParts.push('--mode', q(opts.mode));
     if (opts.model)
         runParts.push('--model', q(opts.model));
     // Credential files to shred after the run (home-level paths written above).
-    const shred = opts.runtimes
-        .map((id) => {
-        const cred = { claude: '.claude.json', codex: '.codex/auth.json', gemini: '.gemini/google_accounts.json', grok: '.grok/auth.json' }[id];
-        return cred ? `rm -f "$HOME/${cred}" 2>/dev/null || true` : '';
-    })
-        .filter(Boolean)
-        .join('\n');
+    // Runs regardless of --keep-box (it's in the box body, not teardown), so a kept
+    // box still loses the token after the run — minimizing the credential window.
+    const shredPaths = opts.runtimes.flatMap((id) => {
+        const paths = { claude: ['.claude.json', CLAUDE_TOKEN_REMOTE], codex: ['.codex/auth.json'], gemini: ['.gemini/google_accounts.json'], grok: ['.grok/auth.json'] }[id];
+        return paths ?? [];
+    });
+    const shred = shredPaths.map((p) => `rm -f "$HOME/${p}" 2>/dev/null || true`).join('\n');
     const installRuntimes = opts.runtimes.map((id) => `agents add ${q(id)} >/dev/null 2>&1 || true`).join('\n');
     return [
         'set -uo pipefail',

package/dist/lib/crabbox/runtimes.d.ts

@@ -47,11 +47,48 @@ export declare function pickRuntimes(detected: DetectedRuntime[], prompt?: (choi
     checked: boolean;
     disabled: boolean | string;
 }[]) => Promise<AgentId[]>): Promise<AgentId[]>;
+/**
+ * Where Claude Code reads its OAuth token on the box. `.claude.json` (the file
+ * LEASE_RUNTIMES copies) is config/account-metadata ONLY — the actual token
+ * lives here, so without it the box boots "Not logged in".
+ */
+export declare const CLAUDE_TOKEN_REMOTE = ".claude/.credentials.json";
+/**
+ * The RAW wrapped Claude credential payload (`{"claudeAiOauth":{…}}`) to write to
+ * the box's `~/.claude/.credentials.json`, or null if no signed-in token is found.
+ *
+ * On macOS the token is in the login Keychain, read SILENTLY via
+ * `getKeychainToken` (the `/usr/bin/security … -w` path — Claude's item trusts it,
+ * no Touch ID). A default native install uses the bare `Claude Code-credentials`
+ * service; an agents-cli managed install (where `~/.claude` symlinks into a
+ * versioned home) uses a hash-suffixed service, so we try the bare service first,
+ * then enumerate installed version homes (preferring the account whose email
+ * matches `preferEmail`, so the token matches the `.claude.json` config we copy).
+ * Off macOS the local Claude CLI stores the token in `.credentials.json` already —
+ * reuse the rush.ts Linux branch verbatim.
+ *
+ * The reader/service/version helpers are injected so unit tests never touch the
+ * real Keychain.
+ */
+export declare function resolveClaudeCredentialsBlob(opts?: {
+    preferEmail?: string | null;
+    readItem?: (service: string) => string;
+    service?: (home?: string) => string;
+    listVersions?: () => string[];
+    versionHome?: (version: string) => string;
+    accountEmail?: (home: string) => Promise<string | null>;
+}): Promise<string | null>;
 /**
  * Build a bash snippet that writes each picked runtime's token file to the box's
  * home-level config path (0600), from the token contents read locally. Returns
  * `''` when no runtimes were selected. The snippet is meant to be embedded in
  * the `--script-stdin` body (never argv).
+ *
+ * `extras.claudeCredentialsJson` (the raw wrapped payload from
+ * `resolveClaudeCredentialsBlob`) is written to `~/.claude/.credentials.json` in
+ * ADDITION to claude's `.claude.json` config — without it the box is "Not logged in".
  */
-export declare function buildCredentialScript(picked: AgentId[], detected: DetectedRuntime[]): string;
+export declare function buildCredentialScript(picked: AgentId[], detected: DetectedRuntime[], extras?: {
+    claudeCredentialsJson?: string | null;
+}): string;
 export {};

package/dist/lib/crabbox/runtimes.js

@@ -16,6 +16,10 @@ import * as os from 'os';
 import * as path from 'path';
 import * as fs from 'fs';
 import { getAccountInfo } from '../agents.js';
+import { getKeychainToken } from '../secrets/index.js';
+import { getClaudeKeychainService } from '../usage.js';
+import { listInstalledVersions, getVersionHomePath } from '../versions.js';
+import { readClaudeCredentialsBlob } from '../cloud/rush.js';
 export const LEASE_RUNTIMES = [
     { id: 'claude', label: 'Claude Code', localCandidates: ['.claude/.claude.json', '.claude.json'], remote: '.claude.json' },
     { id: 'codex', label: 'Codex CLI', localCandidates: ['.codex/auth.json'], remote: '.codex/auth.json' },
@@ -79,15 +83,102 @@ export async function pickRuntimes(detected, prompt) {
 // token's contents effectively impossible, so the quoted heredoc can never be
 // closed early by the credential body.
 const CRED_EOF = 'AGENTS_LEASE_CRED_EOF_9f3c1a7b5e2d4068';
+/**
+ * Where Claude Code reads its OAuth token on the box. `.claude.json` (the file
+ * LEASE_RUNTIMES copies) is config/account-metadata ONLY — the actual token
+ * lives here, so without it the box boots "Not logged in".
+ */
+export const CLAUDE_TOKEN_REMOTE = '.claude/.credentials.json';
+/** True when `s` parses to a Claude keychain payload with an OAuth access token. */
+function isClaudeCredentialsBlob(s) {
+    try {
+        const p = JSON.parse(s);
+        return typeof p?.claudeAiOauth?.accessToken === 'string';
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * The RAW wrapped Claude credential payload (`{"claudeAiOauth":{…}}`) to write to
+ * the box's `~/.claude/.credentials.json`, or null if no signed-in token is found.
+ *
+ * On macOS the token is in the login Keychain, read SILENTLY via
+ * `getKeychainToken` (the `/usr/bin/security … -w` path — Claude's item trusts it,
+ * no Touch ID). A default native install uses the bare `Claude Code-credentials`
+ * service; an agents-cli managed install (where `~/.claude` symlinks into a
+ * versioned home) uses a hash-suffixed service, so we try the bare service first,
+ * then enumerate installed version homes (preferring the account whose email
+ * matches `preferEmail`, so the token matches the `.claude.json` config we copy).
+ * Off macOS the local Claude CLI stores the token in `.credentials.json` already —
+ * reuse the rush.ts Linux branch verbatim.
+ *
+ * The reader/service/version helpers are injected so unit tests never touch the
+ * real Keychain.
+ */
+export async function resolveClaudeCredentialsBlob(opts) {
+    const readItem = opts?.readItem ?? getKeychainToken;
+    const service = opts?.service ?? getClaudeKeychainService;
+    const listVersions = opts?.listVersions ?? (() => listInstalledVersions('claude'));
+    const versionHome = opts?.versionHome ?? ((v) => getVersionHomePath('claude', v));
+    const accountEmail = opts?.accountEmail ?? (async (home) => (await getAccountInfo('claude', home)).email);
+    const tryRead = (svc) => {
+        try {
+            const raw = readItem(svc).trim();
+            return isClaudeCredentialsBlob(raw) ? raw : null;
+        }
+        catch {
+            return null;
+        }
+    };
+    if (process.platform === 'darwin') {
+        // 1) Bare service — the default native (non-managed) install.
+        const bare = tryRead(service(undefined));
+        if (bare)
+            return bare;
+        // 2) Managed installs — hash-suffixed service keyed to each version home.
+        //    Prefer the version whose account email matches the copied config.
+        let homes;
+        try {
+            homes = listVersions().map(versionHome);
+        }
+        catch {
+            homes = [];
+        }
+        if (opts?.preferEmail) {
+            const scored = await Promise.all(homes.map(async (home) => ({ home, match: (await accountEmail(home).catch(() => null)) === opts.preferEmail })));
+            homes = [...scored.filter((s) => s.match), ...scored.filter((s) => !s.match)].map((s) => s.home);
+        }
+        for (const home of homes) {
+            const hit = tryRead(service(home));
+            if (hit)
+                return hit;
+        }
+        return null;
+    }
+    // Off darwin: the local Claude CLI already stores the wrapped blob on disk.
+    const home = process.env.AGENTS_REAL_HOME || os.homedir();
+    return readClaudeCredentialsBlob(home);
+}
 /**
  * Build a bash snippet that writes each picked runtime's token file to the box's
  * home-level config path (0600), from the token contents read locally. Returns
  * `''` when no runtimes were selected. The snippet is meant to be embedded in
  * the `--script-stdin` body (never argv).
+ *
+ * `extras.claudeCredentialsJson` (the raw wrapped payload from
+ * `resolveClaudeCredentialsBlob`) is written to `~/.claude/.credentials.json` in
+ * ADDITION to claude's `.claude.json` config — without it the box is "Not logged in".
  */
-export function buildCredentialScript(picked, detected) {
+export function buildCredentialScript(picked, detected, extras) {
     const byId = new Map(detected.map((d) => [d.id, d]));
     const parts = [];
+    const writeFile = (remote, contents) => {
+        const dir = path.posix.dirname(remote);
+        const mkdir = dir && dir !== '.' ? `mkdir -p "$HOME/${dir}"\n` : '';
+        return (`${mkdir}cat > "$HOME/${remote}" <<'${CRED_EOF}'\n${contents}${contents.endsWith('\n') ? '' : '\n'}${CRED_EOF}\n` +
+            `chmod 600 "$HOME/${remote}"`);
+    };
     for (const id of picked) {
         const d = byId.get(id);
         const cred = LEASE_RUNTIMES.find((c) => c.id === id);
@@ -100,10 +191,12 @@ export function buildCredentialScript(picked, detected) {
         catch {
             continue;
         }
-        const dir = path.posix.dirname(cred.remote);
-        const mkdir = dir && dir !== '.' ? `mkdir -p "$HOME/${dir}"\n` : '';
-        parts.push(`${mkdir}cat > "$HOME/${cred.remote}" <<'${CRED_EOF}'\n${contents}${contents.endsWith('\n') ? '' : '\n'}${CRED_EOF}\n` +
-            `chmod 600 "$HOME/${cred.remote}"`);
+        parts.push(writeFile(cred.remote, contents));
+        // For claude the file above is config/state only; the OAuth token is a
+        // second artifact — without it the box comes up "Not logged in".
+        if (id === 'claude' && extras?.claudeCredentialsJson) {
+            parts.push(writeFile(CLAUDE_TOKEN_REMOTE, extras.claudeCredentialsJson));
+        }
     }
     return parts.join('\n');
 }

package/dist/lib/daemon.d.ts

@@ -54,13 +54,15 @@ export declare function runDaemon(): Promise<void>;
 /**
  * Read the long-lived Claude OAuth token (from `claude setup-token`) that the
  * user stored under the `claude` secrets bundle. Resolves the bundle the same
- * way `agents run --secrets` does, so the token is found whether it was stored
- * keychain-backed or as a literal. Returns null when the bundle/key isn't
- * configured, the Keychain read is cancelled, or the platform has no keychain —
- * the daemon then behaves exactly as before (relying on the interactive OAuth
- * session). Never throws: a misconfigured token must not block daemon startup.
+ * way `agents run --secrets` does. Interactive starts may prompt Keychain;
+ * headless auto-starts are broker-only and return null unless the user already
+ * unlocked the bundle in the secrets agent. That keeps a background browser
+ * command from hanging on an unseen biometric prompt. Never throws: an absent
+ * token leaves the daemon on its existing interactive OAuth session.
  */
-export declare function readDaemonClaudeOAuthToken(): string | null;
+export declare function readDaemonClaudeOAuthToken(opts?: {
+    allowPrompt?: boolean;
+}): string | null;
 /**
  * Write a launchd plist or systemd unit with owner-only permissions atomically.
  *
@@ -72,9 +74,10 @@ export declare function readDaemonClaudeOAuthToken(): string | null;
  */
 export declare function writeOwnerOnlyServiceManifest(filePath: string, content: string): void;
 /** Generate a macOS launchd plist for auto-starting the daemon. */
-export declare function generateLaunchdPlist(): string;
+export declare function generateLaunchdPlist(oauthToken?: string | null): string;
 /** Generate a Linux systemd user unit for auto-starting the daemon. */
-export declare function generateSystemdUnit(): string;
+export declare function generateSystemdUnit(oauthToken?: string | null): string;
+export declare function getAgentsBinPath(): string;
 /** Start the daemon via launchd, systemd, or as a detached process. */
 export declare function startDaemon(): {
     pid: number | null;
@@ -102,7 +105,7 @@ export declare function ensureDaemonStarted(): {
  * the daemon then passes it to every routine run it spawns. An already-set
  * value (e.g. inherited from launchd) is left untouched.
  */
-export declare function buildDetachedDaemonEnv(baseEnv?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+export declare function buildDetachedDaemonEnv(baseEnv?: NodeJS.ProcessEnv, oauthToken?: string | null): NodeJS.ProcessEnv;
 /**
  * Resolve how to launch the daemon: `node <entry> daemon _run`, matching the
  * exact form that works under a direct `daemon _run`.

package/dist/lib/daemon.js

@@ -558,15 +558,19 @@ export async function runDaemon() {
 /**
  * Read the long-lived Claude OAuth token (from `claude setup-token`) that the
  * user stored under the `claude` secrets bundle. Resolves the bundle the same
- * way `agents run --secrets` does, so the token is found whether it was stored
- * keychain-backed or as a literal. Returns null when the bundle/key isn't
- * configured, the Keychain read is cancelled, or the platform has no keychain —
- * the daemon then behaves exactly as before (relying on the interactive OAuth
- * session). Never throws: a misconfigured token must not block daemon startup.
+ * way `agents run --secrets` does. Interactive starts may prompt Keychain;
+ * headless auto-starts are broker-only and return null unless the user already
+ * unlocked the bundle in the secrets agent. That keeps a background browser
+ * command from hanging on an unseen biometric prompt. Never throws: an absent
+ * token leaves the daemon on its existing interactive OAuth session.
  */
-export function readDaemonClaudeOAuthToken() {
+export function readDaemonClaudeOAuthToken(opts = {}) {
     try {
-        const { env } = readAndResolveBundleEnv(DAEMON_OAUTH_BUNDLE, { caller: 'daemon' });
+        const allowPrompt = opts.allowPrompt ?? Boolean(process.stdin.isTTY);
+        const { env } = readAndResolveBundleEnv(DAEMON_OAUTH_BUNDLE, {
+            caller: 'daemon',
+            agentOnly: !allowPrompt,
+        });
         const token = (env[DAEMON_OAUTH_KEY] ?? '').trim();
         return token.length > 0 ? token : null;
     }
@@ -599,10 +603,9 @@ export function writeOwnerOnlyServiceManifest(filePath, content) {
     fs.writeFileSync(filePath, content, { encoding: 'utf-8', mode: 0o600 });
 }
 /** Generate a macOS launchd plist for auto-starting the daemon. */
-export function generateLaunchdPlist() {
+export function generateLaunchdPlist(oauthToken = readDaemonClaudeOAuthToken()) {
     const agentsBin = getAgentsBinPath();
     const logPath = getLogPath();
-    const oauthToken = readDaemonClaudeOAuthToken();
     const oauthEntry = oauthToken
         ? `
     <key>${DAEMON_OAUTH_KEY}</key>
@@ -637,9 +640,8 @@ export function generateLaunchdPlist() {
 </plist>`;
 }
 /** Generate a Linux systemd user unit for auto-starting the daemon. */
-export function generateSystemdUnit() {
+export function generateSystemdUnit(oauthToken = readDaemonClaudeOAuthToken()) {
     const agentsBin = getAgentsBinPath();
-    const oauthToken = readDaemonClaudeOAuthToken();
     const oauthLine = oauthToken
         ? `\nEnvironment=${DAEMON_OAUTH_KEY}=${oauthToken}`
         : '';
@@ -657,15 +659,29 @@ Environment=PATH=/usr/local/bin:/usr/bin:/bin:${os.homedir()}/.nvm/versions/node
 [Install]
 WantedBy=default.target`;
 }
-function getAgentsBinPath() {
+export function getAgentsBinPath() {
     // Prefer the binary actively executing this code. `which agents` returns
     // whatever happens to be first on PATH, which means a side-by-side dev
     // build at ~/.local/bin would silently spawn the registry-installed
     // daemon and run stale code. process.argv[1] is the absolute path of
     // the JS entrypoint the user actually invoked.
     const argv1 = process.argv[1];
-    if (argv1 && fs.existsSync(argv1))
+    if (argv1 && fs.existsSync(argv1)) {
+        // The package's browser/computer entrypoints are sibling shims without a
+        // `daemon` command. A daemon started as their IPC side effect must launch
+        // through the main agents entrypoint instead of replaying the shim path.
+        const entryName = path.basename(argv1);
+        const compiledShim = /^(browser|computer)\.(c|m)?js$/.test(entryName);
+        const installedShim = /^(browser|computer)$/.test(entryName);
+        if (compiledShim || installedShim) {
+            const agentsEntry = path.join(path.dirname(argv1), compiledShim ? 'index.js' : 'agents');
+            if (!fs.existsSync(agentsEntry)) {
+                throw new Error(`Cannot start agents daemon: main CLI entry not found at ${agentsEntry}`);
+            }
+            return agentsEntry;
+        }
         return argv1;
+    }
     try {
         return execFileSync('which', ['agents'], { encoding: 'utf-8' }).trim();
     }
@@ -799,12 +815,11 @@ function startDaemonLocked() {
  * the daemon then passes it to every routine run it spawns. An already-set
  * value (e.g. inherited from launchd) is left untouched.
  */
-export function buildDetachedDaemonEnv(baseEnv = process.env) {
+export function buildDetachedDaemonEnv(baseEnv = process.env, oauthToken = readDaemonClaudeOAuthToken()) {
     const env = { ...baseEnv };
     if (!env.CLAUDE_CODE_OAUTH_TOKEN) {
-        const token = readDaemonClaudeOAuthToken();
-        if (token)
-            env.CLAUDE_CODE_OAUTH_TOKEN = token;
+        if (oauthToken)
+            env.CLAUDE_CODE_OAUTH_TOKEN = oauthToken;
     }
     return env;
 }

package/dist/lib/events.d.ts

@@ -1,8 +1,8 @@
 /**
  * Centralized event logging for agents-cli.
  *
- * Structured JSONL logs at ~/.agents/.cache/logs/events-YYYY-MM-DD.jsonl
- * with automatic daily rotation and rich metadata for debugging/auditing.
+ * Structured JSONL audit log at ~/.agents/events.jsonl with lossless numbered
+ * gzip rotation at 10 MB and rich metadata for debugging/auditing.
  *
  * Features:
  * - Rich metadata: hostname, platform, arch, pid, timezone
@@ -11,7 +11,9 @@
  * - Permissions: logs dir is 0700, files are 0600 (owner-only)
  * - Performance tracking: withTiming() wrapper for any async function
  */
-export type EventType = 'agent.run.start' | 'agent.run.end' | 'agent.spawn.start' | 'agent.spawn.end' | 'version.install' | 'version.switch' | 'version.remove' | 'skill.install' | 'skill.remove' | 'browser.launch' | 'browser.close' | 'browser.navigate' | 'browser.screenshot' | 'secrets.get' | 'secrets.set' | 'secrets.delete' | 'secrets.rename' | 'cloud.dispatch' | 'cloud.complete' | 'teams.create' | 'teams.add' | 'teams.start' | 'teams.complete' | 'teams.disband' | 'hook.fire' | 'hook.complete' | 'hook.error' | 'resource.sync' | 'command.start' | 'command.end' | 'perf.timing' | 'session.start' | 'session.end' | 'error' | 'warn' | 'info' | 'debug';
+export type EventLevel = 'audit' | 'warn' | 'info' | 'debug';
+export type EventType = 'agent.run.start' | 'agent.run.end' | 'agent.spawn.start' | 'agent.spawn.end' | 'version.install' | 'version.switch' | 'version.remove' | 'skill.install' | 'skill.remove' | 'browser.launch' | 'browser.close' | 'browser.navigate' | 'browser.screenshot' | 'secrets.get' | 'secrets.set' | 'secrets.delete' | 'secrets.rename' | 'cloud.dispatch' | 'cloud.complete' | 'cloud.cancel' | 'cloud.message' | 'teams.create' | 'teams.add' | 'teams.start' | 'teams.complete' | 'teams.disband' | 'hook.fire' | 'hook.complete' | 'hook.error' | 'mcp.add' | 'mcp.remove' | 'mcp.register' | 'resource.sync' | 'rotation.resolved' | 'command.start' | 'command.end' | 'perf.timing' | 'session.start' | 'session.end' | 'error' | 'warn' | 'info' | 'debug';
+export declare function levelFor(event: EventType): EventLevel;
 export interface EventMeta {
     ts: string;
     tz: string;
@@ -22,6 +24,9 @@ export interface EventMeta {
     pid: number;
     ppid: number;
     event: EventType;
+    level: EventLevel;
+    caller: string;
+    session?: string;
     osUser: string;
     transport: 'local' | 'ssh';
     sshClientIp?: string;
@@ -67,8 +72,14 @@ export declare function redactArgs(args: string[] | undefined): string[] | undef
  * Returns undefined for null/undefined input.
  */
 export declare function truncate(str: string | null | undefined, maxLength?: number): string | undefined;
+export interface CallerIdentity {
+    kind: string;
+    session?: string;
+}
+/** Identify the environment that invoked agents-cli, not the source callsite. */
+export declare function detectCaller(env?: NodeJS.ProcessEnv, stdoutIsTTY?: boolean): CallerIdentity;
 /**
- * Emit a structured event to the daily log file.
+ * Emit a structured event to the append-only audit log.
  *
  * @param event - The event type
  * @param payload - Event-specific data (agent, version, cwd, etc.)
@@ -142,7 +153,7 @@ export declare function emitCommand(command: string, args?: string[], payload?:
 export declare function emitError(err: Error | string, payload?: EventPayload): void;
 /**
  * Remove log files older than the retention period.
- * Called lazily on emit or explicitly via CLI.
+ * Removes numbered gzip archives whose filesystem mtime exceeds retention.
  *
  * @param retentionDays - Number of days to keep (default 7, from DEFAULT_RETENTION_DAYS)
  * @returns Number of files removed
@@ -159,7 +170,9 @@ export declare function query(options: {
     startDate?: Date;
     endDate?: Date;
     eventTypes?: EventType[];
+    level?: EventLevel;
     agent?: string;
+    caller?: string;
     command?: string;
     module?: string;
     limit?: number;
@@ -177,4 +190,17 @@ export declare function getTimingStats(label: string, options?: {
     p50Ms: number;
     p95Ms: number;
 } | null;
+export interface EventStats {
+    totalEvents: number;
+    byLevel: Record<string, number>;
+    byEvent: Record<string, number>;
+    byModule: Record<string, number>;
+    byUser: Record<string, number>;
+    fileCount: number;
+    totalBytes: number;
+}
+export declare function stats(options?: {
+    days?: number;
+}): EventStats;
 export declare function getLogsPath(): string;
+export declare function _resetForTest(overrideEventsPath?: string): void;