@phnx-labs/agents-cli 1.20.51 → 1.20.53

package/dist/lib/daemon.js

@@ -558,15 +558,19 @@ export async function runDaemon() {
 /**
  * Read the long-lived Claude OAuth token (from `claude setup-token`) that the
  * user stored under the `claude` secrets bundle. Resolves the bundle the same
- * way `agents run --secrets` does, so the token is found whether it was stored
- * keychain-backed or as a literal. Returns null when the bundle/key isn't
- * configured, the Keychain read is cancelled, or the platform has no keychain —
- * the daemon then behaves exactly as before (relying on the interactive OAuth
- * session). Never throws: a misconfigured token must not block daemon startup.
+ * way `agents run --secrets` does. Interactive starts may prompt Keychain;
+ * headless auto-starts are broker-only and return null unless the user already
+ * unlocked the bundle in the secrets agent. That keeps a background browser
+ * command from hanging on an unseen biometric prompt. Never throws: an absent
+ * token leaves the daemon on its existing interactive OAuth session.
  */
-export function readDaemonClaudeOAuthToken() {
+export function readDaemonClaudeOAuthToken(opts = {}) {
     try {
-        const { env } = readAndResolveBundleEnv(DAEMON_OAUTH_BUNDLE, { caller: 'daemon' });
+        const allowPrompt = opts.allowPrompt ?? Boolean(process.stdin.isTTY);
+        const { env } = readAndResolveBundleEnv(DAEMON_OAUTH_BUNDLE, {
+            caller: 'daemon',
+            agentOnly: !allowPrompt,
+        });
         const token = (env[DAEMON_OAUTH_KEY] ?? '').trim();
         return token.length > 0 ? token : null;
     }
@@ -599,10 +603,9 @@ export function writeOwnerOnlyServiceManifest(filePath, content) {
     fs.writeFileSync(filePath, content, { encoding: 'utf-8', mode: 0o600 });
 }
 /** Generate a macOS launchd plist for auto-starting the daemon. */
-export function generateLaunchdPlist() {
+export function generateLaunchdPlist(oauthToken = readDaemonClaudeOAuthToken()) {
     const agentsBin = getAgentsBinPath();
     const logPath = getLogPath();
-    const oauthToken = readDaemonClaudeOAuthToken();
     const oauthEntry = oauthToken
         ? `
     <key>${DAEMON_OAUTH_KEY}</key>
@@ -637,9 +640,8 @@ export function generateLaunchdPlist() {
 </plist>`;
 }
 /** Generate a Linux systemd user unit for auto-starting the daemon. */
-export function generateSystemdUnit() {
+export function generateSystemdUnit(oauthToken = readDaemonClaudeOAuthToken()) {
     const agentsBin = getAgentsBinPath();
-    const oauthToken = readDaemonClaudeOAuthToken();
     const oauthLine = oauthToken
         ? `\nEnvironment=${DAEMON_OAUTH_KEY}=${oauthToken}`
         : '';
@@ -657,15 +659,29 @@ Environment=PATH=/usr/local/bin:/usr/bin:/bin:${os.homedir()}/.nvm/versions/node
 [Install]
 WantedBy=default.target`;
 }
-function getAgentsBinPath() {
+export function getAgentsBinPath() {
     // Prefer the binary actively executing this code. `which agents` returns
     // whatever happens to be first on PATH, which means a side-by-side dev
     // build at ~/.local/bin would silently spawn the registry-installed
     // daemon and run stale code. process.argv[1] is the absolute path of
     // the JS entrypoint the user actually invoked.
     const argv1 = process.argv[1];
-    if (argv1 && fs.existsSync(argv1))
+    if (argv1 && fs.existsSync(argv1)) {
+        // The package's browser/computer entrypoints are sibling shims without a
+        // `daemon` command. A daemon started as their IPC side effect must launch
+        // through the main agents entrypoint instead of replaying the shim path.
+        const entryName = path.basename(argv1);
+        const compiledShim = /^(browser|computer)\.(c|m)?js$/.test(entryName);
+        const installedShim = /^(browser|computer)$/.test(entryName);
+        if (compiledShim || installedShim) {
+            const agentsEntry = path.join(path.dirname(argv1), compiledShim ? 'index.js' : 'agents');
+            if (!fs.existsSync(agentsEntry)) {
+                throw new Error(`Cannot start agents daemon: main CLI entry not found at ${agentsEntry}`);
+            }
+            return agentsEntry;
+        }
         return argv1;
+    }
     try {
         return execFileSync('which', ['agents'], { encoding: 'utf-8' }).trim();
     }
@@ -799,12 +815,11 @@ function startDaemonLocked() {
  * the daemon then passes it to every routine run it spawns. An already-set
  * value (e.g. inherited from launchd) is left untouched.
  */
-export function buildDetachedDaemonEnv(baseEnv = process.env) {
+export function buildDetachedDaemonEnv(baseEnv = process.env, oauthToken = readDaemonClaudeOAuthToken()) {
     const env = { ...baseEnv };
     if (!env.CLAUDE_CODE_OAUTH_TOKEN) {
-        const token = readDaemonClaudeOAuthToken();
-        if (token)
-            env.CLAUDE_CODE_OAUTH_TOKEN = token;
+        if (oauthToken)
+            env.CLAUDE_CODE_OAUTH_TOKEN = oauthToken;
     }
     return env;
 }

package/dist/lib/events.d.ts

@@ -1,8 +1,8 @@
 /**
  * Centralized event logging for agents-cli.
  *
- * Structured JSONL logs at ~/.agents/.cache/logs/events-YYYY-MM-DD.jsonl
- * with automatic daily rotation and rich metadata for debugging/auditing.
+ * Structured JSONL audit log at ~/.agents/events.jsonl with lossless numbered
+ * gzip rotation at 10 MB and rich metadata for debugging/auditing.
  *
  * Features:
  * - Rich metadata: hostname, platform, arch, pid, timezone
@@ -11,7 +11,9 @@
  * - Permissions: logs dir is 0700, files are 0600 (owner-only)
  * - Performance tracking: withTiming() wrapper for any async function
  */
-export type EventType = 'agent.run.start' | 'agent.run.end' | 'agent.spawn.start' | 'agent.spawn.end' | 'version.install' | 'version.switch' | 'version.remove' | 'skill.install' | 'skill.remove' | 'browser.launch' | 'browser.close' | 'browser.navigate' | 'browser.screenshot' | 'secrets.get' | 'secrets.set' | 'secrets.delete' | 'secrets.rename' | 'cloud.dispatch' | 'cloud.complete' | 'teams.create' | 'teams.add' | 'teams.start' | 'teams.complete' | 'teams.disband' | 'hook.fire' | 'hook.complete' | 'hook.error' | 'resource.sync' | 'command.start' | 'command.end' | 'perf.timing' | 'session.start' | 'session.end' | 'error' | 'warn' | 'info' | 'debug';
+export type EventLevel = 'audit' | 'warn' | 'info' | 'debug';
+export type EventType = 'agent.run.start' | 'agent.run.end' | 'agent.spawn.start' | 'agent.spawn.end' | 'version.install' | 'version.switch' | 'version.remove' | 'skill.install' | 'skill.remove' | 'browser.launch' | 'browser.close' | 'browser.navigate' | 'browser.screenshot' | 'secrets.get' | 'secrets.set' | 'secrets.delete' | 'secrets.rename' | 'cloud.dispatch' | 'cloud.complete' | 'cloud.cancel' | 'cloud.message' | 'teams.create' | 'teams.add' | 'teams.start' | 'teams.complete' | 'teams.disband' | 'hook.fire' | 'hook.complete' | 'hook.error' | 'mcp.add' | 'mcp.remove' | 'mcp.register' | 'resource.sync' | 'rotation.resolved' | 'command.start' | 'command.end' | 'perf.timing' | 'session.start' | 'session.end' | 'error' | 'warn' | 'info' | 'debug';
+export declare function levelFor(event: EventType): EventLevel;
 export interface EventMeta {
     ts: string;
     tz: string;
@@ -22,6 +24,9 @@ export interface EventMeta {
     pid: number;
     ppid: number;
     event: EventType;
+    level: EventLevel;
+    caller: string;
+    session?: string;
     osUser: string;
     transport: 'local' | 'ssh';
     sshClientIp?: string;
@@ -67,8 +72,14 @@ export declare function redactArgs(args: string[] | undefined): string[] | undef
  * Returns undefined for null/undefined input.
  */
 export declare function truncate(str: string | null | undefined, maxLength?: number): string | undefined;
+export interface CallerIdentity {
+    kind: string;
+    session?: string;
+}
+/** Identify the environment that invoked agents-cli, not the source callsite. */
+export declare function detectCaller(env?: NodeJS.ProcessEnv, stdoutIsTTY?: boolean): CallerIdentity;
 /**
- * Emit a structured event to the daily log file.
+ * Emit a structured event to the append-only audit log.
  *
  * @param event - The event type
  * @param payload - Event-specific data (agent, version, cwd, etc.)
@@ -142,7 +153,7 @@ export declare function emitCommand(command: string, args?: string[], payload?:
 export declare function emitError(err: Error | string, payload?: EventPayload): void;
 /**
  * Remove log files older than the retention period.
- * Called lazily on emit or explicitly via CLI.
+ * Removes numbered gzip archives whose filesystem mtime exceeds retention.
  *
  * @param retentionDays - Number of days to keep (default 7, from DEFAULT_RETENTION_DAYS)
  * @returns Number of files removed
@@ -159,7 +170,9 @@ export declare function query(options: {
     startDate?: Date;
     endDate?: Date;
     eventTypes?: EventType[];
+    level?: EventLevel;
     agent?: string;
+    caller?: string;
     command?: string;
     module?: string;
     limit?: number;
@@ -177,4 +190,17 @@ export declare function getTimingStats(label: string, options?: {
     p50Ms: number;
     p95Ms: number;
 } | null;
+export interface EventStats {
+    totalEvents: number;
+    byLevel: Record<string, number>;
+    byEvent: Record<string, number>;
+    byModule: Record<string, number>;
+    byUser: Record<string, number>;
+    fileCount: number;
+    totalBytes: number;
+}
+export declare function stats(options?: {
+    days?: number;
+}): EventStats;
 export declare function getLogsPath(): string;
+export declare function _resetForTest(overrideEventsPath?: string): void;