@phnx-labs/agents-cli 1.20.51 → 1.20.53

package/dist/lib/versions.js

@@ -42,6 +42,7 @@ import { emit } from './events.js';
 import { safeJoin } from './paths.js';
 import { readSkillSourceCommandMarker, shouldInstallCommandAsSkill } from './command-skills.js';
 import { getWriter, getDetector } from './staleness/registry.js';
+import { syncMemoryToVersionHome } from './memory.js';
 /** Promisified exec for running shell commands. */
 const execAsync = promisify(exec);
 const execFileAsync = promisify(execFile);
@@ -1127,19 +1128,28 @@ export async function installVersion(agent, version, onProgress, opts) {
         emit('version.install', { agent, version: installedVersion });
         return { success: true, installedVersion };
     }
-    // Resolve the `oldest` alias to a concrete npm version up front so the rest
-    // of the install path treats it as an ordinary pinned install. (`latest`
-    // keeps its bare-package-name + post-install-rename handling below.)
-    if (version === 'oldest') {
-        const oldest = await getOldestNpmVersion(agent);
-        if (!oldest) {
+    // Resolve the `latest`/`oldest` aliases to a concrete npm version up front so
+    // the rest of the install path treats them as an ordinary pinned install.
+    // This is what keeps concurrent installs safe: resolving `latest` only AFTER
+    // npm finished meant the install ran in a shared, well-known
+    // `versions/<agent>/latest/` scratch dir that was renamed to the real version
+    // at the end — so a concurrent `agents view` reconcile
+    // (reconcileStaleLatestForAgent) or a second `latest` install could rename
+    // that dir out from under npm mid-extraction and corrupt the install (the
+    // seeded package.json and half-extracted node_modules would vanish, yielding
+    // ENOENT). A concrete dir per version has no shared name to race on.
+    if (version === 'latest' || version === 'oldest') {
+        const resolved = version === 'latest'
+            ? await getLatestNpmVersion(agent)
+            : await getOldestNpmVersion(agent);
+        if (!resolved) {
             return {
                 success: false,
                 installedVersion: version,
-                error: `Could not resolve the oldest published version for ${agentConfig.name} from npm.`,
+                error: `Could not resolve the ${version} published version for ${agentConfig.name} from npm.`,
             };
         }
-        version = oldest;
+        version = resolved;
     }
     ensureAgentsDir();
     const versionDir = getVersionDir(agent, version);
@@ -1161,12 +1171,11 @@ export async function installVersion(agent, version, onProgress, opts) {
         private: true,
     };
     fs.writeFileSync(path.join(versionDir, 'package.json'), JSON.stringify(packageJson, null, 2));
-    // Install the package
-    const packageSpec = version === 'latest'
-        ? agentConfig.npmPackage
-        : `${agentConfig.npmPackage}@${version}`;
-    // The `${agentConfig.npmPackage}@` prefix is load-bearing: it ensures `version`
-    // (which VERSION_RE permits to start with `-`) is never passed as a standalone npm CLI flag.
+    // Install the package. `version` is always concrete here (`latest`/`oldest`
+    // were resolved above), so the spec is always pinned. The `@` prefix is
+    // load-bearing: it ensures `version` (which VERSION_RE permits to start with
+    // `-`) is never passed as a standalone npm CLI flag.
+    const packageSpec = `${agentConfig.npmPackage}@${version}`;
     try {
         // Check npm is available
         const winShell = process.platform === 'win32';
@@ -1181,37 +1190,12 @@ export async function installVersion(agent, version, onProgress, opts) {
             };
         }
         onProgress?.(`Installing ${packageSpec}...`);
-        const { stdout } = await execFileAsync('npm', ['install', packageSpec, '--ignore-scripts'], { cwd: versionDir, shell: winShell });
-        // Determine the actual installed version
-        let installedVersion = version;
-        if (version === 'latest') {
-            const pkgJsonPath = path.join(versionDir, 'node_modules', agentConfig.npmPackage.replace(/^@/, '').split('/')[0], 'package.json');
-            // Try to read the actual version from installed package
-            try {
-                const installedPkgPath = path.join(versionDir, 'node_modules', agentConfig.npmPackage, 'package.json');
-                if (fs.existsSync(installedPkgPath)) {
-                    const installedPkg = JSON.parse(fs.readFileSync(installedPkgPath, 'utf-8'));
-                    installedVersion = installedPkg.version;
-                    // Rename the directory to the actual version
-                    if (installedVersion !== 'latest') {
-                        const actualVersionDir = getVersionDir(agent, installedVersion);
-                        if (!fs.existsSync(actualVersionDir)) {
-                            fs.renameSync(versionDir, actualVersionDir);
-                        }
-                        else {
-                            // Already exists — drop the 'latest' install artifacts but keep
-                            // `home/` (may contain conversation history from sessions that
-                            // ran while the user was on `latest`).
-                            removeInstallArtifacts(versionDir);
-                        }
-                    }
-                }
-            }
-            catch (e) {
-                // Failed to determine version - this shouldn't happen
-                throw new Error(`Failed to determine installed version: ${e.message}`);
-            }
-        }
+        await execFileAsync('npm', ['install', packageSpec, '--ignore-scripts'], { cwd: versionDir, shell: winShell });
+        // `version` is concrete (the `latest`/`oldest` aliases were resolved up
+        // front), so the package installed directly into its final versioned dir —
+        // no post-install rename, and no shared `latest/` dir for a concurrent
+        // process to move out from under us.
+        const installedVersion = version;
         // Create versioned alias (e.g., claude@2.0.65)
         createVersionedAlias(agent, installedVersion);
         // Claude reads its global config from CLAUDE_CONFIG_DIR/.claude.json —
@@ -1241,9 +1225,9 @@ export async function installVersion(agent, version, onProgress, opts) {
         // binary (postinstall failed, or a platform with no published native dep)
         // fails there with the correct message rather than throwing here.
         if (agentConfig.npmPackage) {
-            // Recompute from installedVersion, not the (possibly renamed) `versionDir`:
-            // the `latest` branch above may have renamed the dir to its concrete version.
-            const pkgRoot = path.join(getVersionDir(agent, installedVersion), 'node_modules', agentConfig.npmPackage);
+            // `installedVersion === version`, so this is exactly `versionDir` — the
+            // install landed in its final dir with no rename to chase.
+            const pkgRoot = path.join(versionDir, 'node_modules', agentConfig.npmPackage);
             try {
                 const pkg = JSON.parse(fs.readFileSync(path.join(pkgRoot, 'package.json'), 'utf-8'));
                 const postinstall = pkg?.scripts?.postinstall;
@@ -2335,6 +2319,12 @@ export function syncResourcesToVersion(agent, version, selection, options = {})
         const r = workflowsWriter.write({ version, versionHome, selection: workflowsToSync, cwd });
         result.workflows.push(...r.synced);
     }
+    // Knowledge memory (RUSH-1330) — distinct from selection.memory which still
+    // means the composed *rules* file. Always fan out ~/.agents/memory/ facts
+    // into capable agent version homes on every full or partial sync.
+    if (supports(agent, 'memory', version).ok) {
+        syncMemoryToVersionHome(agent, versionHome, cwd);
+    }
     // Write manifest after a full sync (no user-passed selection) so the next
     // launch can skip the slow path. Pattern-derived selections still count as
     // "full" — the agents.yaml patterns describe the intended scope, not a

package/dist/lib/whats-new.d.ts

@@ -1,8 +1,10 @@
 /**
  * Render a compact "What's new" summary from a CHANGELOG.md body: one bullet
- * per feature/fix heading (the `**...**` lines) for each version in the range
- * the user actually moved through, `(fromVersion, toVersion]`. The verbose
- * sub-bullets are intentionally dropped — the full notes live in the changelog.
+ * per feature/fix heading for each version in the range the user actually
+ * moved through, `(fromVersion, toVersion]`. Headings are recognized in both
+ * changelog formats — the current `- **Title.** prose…` single-line bullets
+ * and the older standalone `**Heading**` lines. The verbose prose/sub-bullets
+ * are intentionally dropped — the full notes live in the changelog.
  *
  * Returns colored lines ready to print, empty when nothing is in range.
  */

package/dist/lib/whats-new.js

@@ -2,15 +2,23 @@ import chalk from 'chalk';
 import { compareVersions } from './agent-spec/primitives.js';
 /**
  * Render a compact "What's new" summary from a CHANGELOG.md body: one bullet
- * per feature/fix heading (the `**...**` lines) for each version in the range
- * the user actually moved through, `(fromVersion, toVersion]`. The verbose
- * sub-bullets are intentionally dropped — the full notes live in the changelog.
+ * per feature/fix heading for each version in the range the user actually
+ * moved through, `(fromVersion, toVersion]`. Headings are recognized in both
+ * changelog formats — the current `- **Title.** prose…` single-line bullets
+ * and the older standalone `**Heading**` lines. The verbose prose/sub-bullets
+ * are intentionally dropped — the full notes live in the changelog.
  *
  * Returns colored lines ready to print, empty when nothing is in range.
  */
 export function renderWhatsNew(changelog, fromVersion, toVersion) {
     const out = [];
     let inRelevantSection = false;
+    // Whether the CURRENT version section uses the old standalone-heading format.
+    // Old sections nest `-` sub-bullets under each `**Heading**` line, and some
+    // sub-bullets are themselves bold-led (`- **Claim.** detail…`) — once a
+    // standalone heading is seen, `- **` lines in that section are sub-bullets,
+    // not entries, and must not render.
+    let sectionUsesStandaloneHeadings = false;
     for (const line of changelog.split('\n')) {
         const versionMatch = line.match(/^## (\d+\.\d+\.\d+)/);
         if (versionMatch) {
@@ -20,15 +28,27 @@ export function renderWhatsNew(changelog, fromVersion, toVersion) {
             inRelevantSection =
                 compareVersions(currentVersion, fromVersion) > 0 &&
                     compareVersions(currentVersion, toVersion) <= 0;
+            sectionUsesStandaloneHeadings = false;
             if (inRelevantSection) {
                 out.push('');
                 out.push(chalk.bold(`v${currentVersion}`));
             }
             continue;
         }
-        // Only the bold headings — one bullet per feature/fix.
-        if (inRelevantSection && line.startsWith('**') && line.endsWith('**')) {
+        // Only the entry headings — one bullet per feature/fix. Two formats exist
+        // across the changelog's history: the current single-line bullets
+        // (`- **Title.** verbose prose…`, heading kept, prose dropped) and the
+        // older standalone `**Heading**` lines with `-` sub-bullets beneath.
+        if (!inRelevantSection)
+            continue;
+        if (line.startsWith('**') && line.endsWith('**')) {
+            sectionUsesStandaloneHeadings = true;
             out.push(`  ${chalk.cyan('•')} ${line.replace(/\*\*/g, '')}`);
+            continue;
+        }
+        const entryBullet = sectionUsesStandaloneHeadings ? null : line.match(/^- \*\*(.+?)\*\*/);
+        if (entryBullet) {
+            out.push(`  ${chalk.cyan('•')} ${entryBullet[1].replace(/\*\*/g, '')}`);
         }
     }
     return out;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@phnx-labs/agents-cli",
-  "version": "1.20.51",
+  "version": "1.20.53",
   "description": "One CLI for all your AI coding agents - versions, config, cloud dispatch, sessions, and teams (now with first-class Grok Build CLI support)",
   "type": "module",
   "main": "dist/index.js",
@@ -24,6 +24,7 @@
     "dist/**/*.js",
     "dist/**/*.d.ts",
     "dist/**/*.json",
+    "dist/bin/**",
     "dist/lib/secrets/Agents CLI.app/**",
     "dist/lib/menubar/MenubarHelper.app/**",
     "scripts/postinstall.js",
@@ -44,10 +45,10 @@
     "url": "https://github.com/phnx-labs/agents-cli/issues"
   },
   "scripts": {
-    "build": "tsc && rm -rf 'dist/lib/secrets/AgentsKeychain.app' 'dist/lib/secrets/Agents CLI.app' 'dist/lib/menubar/MenubarHelper.app' && ([ -d 'bin/Agents CLI.app' ] && cp -R 'bin/Agents CLI.app' 'dist/lib/secrets/Agents CLI.app' || true) && ([ -d 'bin/MenubarHelper.app' ] && mkdir -p 'dist/lib/menubar' && cp -R 'bin/MenubarHelper.app' 'dist/lib/menubar/MenubarHelper.app' || true)",
+    "build": "tsc && rm -rf 'dist/lib/secrets/AgentsKeychain.app' 'dist/lib/secrets/Agents CLI.app' 'dist/lib/menubar/MenubarHelper.app' && ([ -d 'bin/Agents CLI.app' ] && cp -R 'bin/Agents CLI.app' 'dist/lib/secrets/Agents CLI.app' || true) && ([ -d 'bin/MenubarHelper.app' ] && mkdir -p 'dist/lib/menubar' && cp -R 'bin/MenubarHelper.app' 'dist/lib/menubar/MenubarHelper.app' || true) && ([ -f 'bin/agents-macos' ] && mkdir -p dist/bin && cp -f 'bin/agents-macos' 'dist/bin/agents' && chmod 755 'dist/bin/agents' || true)",
     "build:bin": "scripts/build-bin.sh",
     "prepare": "npm run build",
-    "prepack": "cp ../../README.md README.md && scripts/verify-keychain-helper.sh && scripts/verify-menubar-helper.sh",
+    "prepack": "cp ../../README.md README.md && scripts/verify-keychain-helper.sh && scripts/verify-menubar-helper.sh && scripts/verify-cli-binary.sh",
     "postinstall": "node scripts/postinstall.js",
     "dev": "tsx src/index.ts",
     "start": "node dist/index.js",

package/scripts/postinstall.js

@@ -16,9 +16,36 @@ const SHIMS_DIR = path.join(USER_DIR, '.cache', 'shims');
 // System repo lives inside the user repo (folded in v1.21). Legacy installs at
 // ~/.agents-system/ are migrated by src/lib/migrate.ts on first CLI invocation.
 const SYSTEM_DIR = path.join(USER_DIR, '.system');
-const AGENTS_BIN = fileURLToPath(new URL('../dist/index.js', import.meta.url));
+const AGENTS_JS_ENTRYPOINT = fileURLToPath(new URL('../dist/index.js', import.meta.url));
+// Signed + notarized standalone Mach-O, macOS only (scripts/sign-cli-binary.sh).
+// Preferred over the node-shebang JS entrypoint on darwin: the unsigned JS shim
+// is what EDR (CrowdStrike Falcon) flags when an editor child spawns it (#315).
+const AGENTS_NATIVE_MACOS_BIN = fileURLToPath(new URL('../dist/bin/agents', import.meta.url));
+const AGENTS_BIN = resolveAgentsBin();
 const INSTALL_HELPER_SCRIPT = fileURLToPath(new URL('./install-helper.js', import.meta.url));
 
+function resolveAgentsBin() {
+  if (process.platform !== 'darwin') return AGENTS_JS_ENTRYPOINT;
+  try {
+    fs.accessSync(AGENTS_NATIVE_MACOS_BIN, fs.constants.X_OK);
+  } catch {
+    return AGENTS_JS_ENTRYPOINT; // no native binary in this install (dev build, arch without one)
+  }
+  // Real execution probe, not just a stat: catches a quarantined, EDR-blocked,
+  // or wrong-arch (Intel) binary at install time, where we can still fall back
+  // loudly, instead of breaking every later `agents` call.
+  const probe = spawnSync(AGENTS_NATIVE_MACOS_BIN, ['--version'], {
+    stdio: ['ignore', 'pipe', 'pipe'],
+    timeout: 15000,
+    encoding: 'utf-8',
+  });
+  if (probe.status === 0) return AGENTS_NATIVE_MACOS_BIN;
+  const why = probe.error ? probe.error.message : `exit status ${probe.status}`;
+  console.warn(`  warning: the signed agents binary at ${AGENTS_NATIVE_MACOS_BIN} failed to run (${why}).`);
+  console.warn(`  Falling back to the JS entrypoint; 'agents' still works but is not code-signed.`);
+  return AGENTS_JS_ENTRYPOINT;
+}
+
 function installKeychainHelper() {
   if (process.platform !== 'darwin') return;
   if (!fs.existsSync(INSTALL_HELPER_SCRIPT)) return;
@@ -276,6 +303,7 @@ To enable version-aware shims, add this to your shell config:
  */
 async function ensureAgentsResolvablePosix() {
   if (process.env.CI || process.env.AGENTS_NO_HEAL === '1') return;
+  retargetManagedLinksToNativeBin();
   try {
     const { localBinDir, ensureLocalBinSymlink, loginShellResolves, dirOnLoginPath } =
       await import('../dist/lib/platform/posixpath.js');
@@ -314,6 +342,38 @@ async function ensureAgentsResolvablePosix() {
   }
 }
 
+/**
+ * Upgrade path for #315: an earlier install symlinked ~/.local/bin/agents at
+ * the JS entrypoint. ensureLocalBinSymlink never repoints an existing link,
+ * and the loginShellResolves() early-return means ensureAgentsResolvablePosix
+ * would not even try - so without this, a machine healed before the signed
+ * binary existed keeps the unsigned JS shim forever. Repoint ONLY symlinks
+ * that resolve exactly to OUR dist/index.js; a dev build or foreign link is
+ * never touched.
+ */
+function retargetManagedLinksToNativeBin() {
+  if (AGENTS_BIN === AGENTS_JS_ENTRYPOINT) return;
+  const binDir = path.join(HOME, '.local', 'bin');
+  // Compare realpaths: dist/index.js can be reached through path aliases
+  // (/var vs /private/var on macOS) depending on who created the link.
+  let want = AGENTS_JS_ENTRYPOINT;
+  try { want = fs.realpathSync(AGENTS_JS_ENTRYPOINT); } catch { /* keep the literal path */ }
+  for (const name of ['agents', 'ag']) {
+    const linkPath = path.join(binDir, name);
+    try {
+      const current = fs.readlinkSync(linkPath); // throws unless a symlink
+      let resolved = path.isAbsolute(current) ? current : path.resolve(binDir, current);
+      try { resolved = fs.realpathSync(resolved); } catch { /* dangling - compare as-is */ }
+      if (resolved !== want) continue;
+      fs.unlinkSync(linkPath);
+      fs.symlinkSync(AGENTS_BIN, linkPath);
+      console.log(`  Repointed ${linkPath} at the signed agents binary.`);
+    } catch {
+      /* absent, unreadable, or not a symlink - nothing to retarget */
+    }
+  }
+}
+
 /**
  * Self-heal long-running processes onto the just-installed code (macOS).
  *