@phnx-labs/agents-cli 1.20.57 → 1.20.58

package/dist/lib/project-root.js

@@ -0,0 +1,133 @@
+/**
+ * Projects-root resolution for the `agents run --project <slug>` shorthand.
+ *
+ * Projects follow a predictable layout — `<root>/<repo>` (e.g.
+ * `~/src/github.com/<user>/<repo>`), with git worktrees under
+ * `<repo>/.agents/worktrees/<slug>`. The root is auto-inferred from the repo you
+ * launch inside (the directory ABOVE the git root) and cached in `agents.yaml`
+ * so later runs resolve a bare slug from anywhere. It is stored home-relative
+ * (`~/…`) when it sits under `$HOME`, so the SAME value resolves on a remote
+ * host whose home differs (`/home/<user>` vs `/Users/<user>`): a `--host` run
+ * keeps the `~` and lets the remote login shell expand it (see `remoteCdPrefix`
+ * in `hosts/dispatch.ts`), while a local run expands `~` against the local home.
+ */
+import * as os from 'os';
+import * as path from 'path';
+import * as fs from 'fs';
+import { readMeta, updateMeta } from './state.js';
+import { getMainRepoRoot } from './git.js';
+const HOME = process.env.HOME ?? os.homedir();
+/** Rewrite an absolute path under the local home to a `~/`-relative string; pass others through. */
+export function toHomeRelative(abs) {
+    const rel = path.relative(HOME, abs);
+    if (rel === '')
+        return '~';
+    if (!rel.startsWith('..') && !path.isAbsolute(rel))
+        return `~/${rel}`;
+    return abs;
+}
+/** Expand a leading `~`/`$HOME` against the LOCAL home. Other paths pass through unchanged. */
+export function expandLocalHome(p) {
+    if (p === '~' || p === '$HOME')
+        return HOME;
+    if (p.startsWith('~/'))
+        return path.join(HOME, p.slice(2));
+    if (p.startsWith('$HOME/'))
+        return path.join(HOME, p.slice(6));
+    return p;
+}
+/**
+ * Make a `--cwd`/`--project` value portable to a remote host: an absolute path
+ * under the LOCAL home (which the local shell already expanded from `~`) becomes
+ * `~/…` so the *remote* shell re-roots it at its own home. Paths already anchored
+ * at `~`/`$HOME` pass through; other absolute or relative paths are left as-is
+ * (used verbatim on the host). Explicit `--remote-cwd` is NOT run through this —
+ * it is a literal remote path by contract.
+ */
+export function toRemotePortable(p) {
+    if (p.startsWith('~') || p.startsWith('$HOME'))
+        return p;
+    if (path.isAbsolute(p))
+        return toHomeRelative(p);
+    return p;
+}
+/** The configured projects root (home-relative or absolute), or undefined when unset. */
+export function getProjectRoot() {
+    return readMeta().projectRoot;
+}
+/** Set (override) the cached projects root. Stored home-relative when under `$HOME`. */
+export function setProjectRoot(rootPath) {
+    const stored = toHomeRelative(path.resolve(expandLocalHome(rootPath)));
+    updateMeta({ projectRoot: stored });
+    return stored;
+}
+/**
+ * Infer the projects root from `cwd`: the directory ABOVE the git repo root
+ * (cwd inside `~/src/github.com/user/repo` → `~/src/github.com/user`). Returns a
+ * home-relative string when under `$HOME`; undefined when `cwd` is not in a repo.
+ */
+export async function inferProjectRoot(cwd) {
+    try {
+        const mainRoot = await getMainRepoRoot(cwd);
+        return toHomeRelative(path.dirname(mainRoot));
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Resolve the projects root, auto-inferring and caching on first use. Throws an
+ * actionable error when it is neither configured nor inferrable from `cwd`.
+ */
+export async function ensureProjectRoot(cwd) {
+    const existing = getProjectRoot();
+    if (existing)
+        return existing;
+    const inferred = await inferProjectRoot(cwd);
+    if (!inferred) {
+        throw new Error('Could not determine your projects root. Run once from inside a project ' +
+            '(a git repo under your projects dir) so it can be inferred, or set it:\n' +
+            '  agents defaults project-root ~/src/github.com/<you>');
+    }
+    updateMeta({ projectRoot: inferred });
+    process.stderr.write(`[project] cached projects root: ${inferred}\n`);
+    return inferred;
+}
+/** Parse a `--project` value of the form `<slug>[@<worktree>]`. */
+export function parseProjectRef(ref) {
+    const at = ref.indexOf('@');
+    if (at === -1)
+        return { slug: ref };
+    return { slug: ref.slice(0, at), worktree: ref.slice(at + 1) || undefined };
+}
+/**
+ * Join a root + `--project` ref into a working directory. Pure (no I/O) so the
+ * slug/worktree layout is unit-testable. `forRemote` keeps the path
+ * home-relative (`~/…`) for the remote shell to expand; otherwise it is expanded
+ * against the local home into an absolute path.
+ */
+export function buildProjectPath(root, ref, forRemote) {
+    const { slug, worktree } = parseProjectRef(ref);
+    if (!slug)
+        throw new Error(`Invalid --project value: "${ref}"`);
+    let rel = `${root}/${slug}`;
+    if (worktree)
+        rel += `/.agents/worktrees/${worktree}`;
+    return forRemote ? rel : path.resolve(expandLocalHome(rel));
+}
+/**
+ * Resolve a `--project` ref to a working directory, inferring/caching the root.
+ *
+ * `forRemote: true` returns a home-relative path (`~/…`) so the REMOTE login
+ * shell expands `~`/`$HOME` to its own home. `forRemote: false` returns an
+ * absolute local path and verifies it exists (so a mistyped slug fails loudly).
+ */
+export async function resolveProjectRef(ref, opts) {
+    const cwd = opts.cwd ?? process.cwd();
+    const root = await ensureProjectRoot(cwd);
+    const resolved = buildProjectPath(root, ref, opts.forRemote);
+    if (!opts.forRemote && !fs.existsSync(resolved)) {
+        throw new Error(`Project path not found: ${resolved}`);
+    }
+    return resolved;
+}

package/dist/lib/resources/permissions.js

@@ -69,6 +69,8 @@ function getAgentConfigPath(agent, versionHome) {
             return path.join(versionHome, '.opencode', 'opencode.jsonc');
         case 'kimi':
             return path.join(versionHome, '.kimi-code', 'config.toml');
+        case 'kiro':
+            return path.join(versionHome, '.kiro', 'settings', 'permissions.yaml');
         default:
             return null;
     }

package/dist/lib/resources/types.d.ts

@@ -5,7 +5,7 @@
  * - Union: All resources from all layers are combined
  * - Override on name conflict: Higher layer wins (project > user > system)
  */
-export type AgentId = 'claude' | 'codex' | 'gemini' | 'cursor' | 'opencode' | 'openclaw' | 'antigravity' | 'grok' | 'kimi' | 'hermes' | 'forge';
+export type AgentId = 'claude' | 'codex' | 'gemini' | 'cursor' | 'opencode' | 'openclaw' | 'kiro' | 'antigravity' | 'grok' | 'kimi' | 'hermes' | 'forge';
 export type Layer = 'system' | 'user' | 'project';
 export type ResourceKind = 'command' | 'hook' | 'skill' | 'rule' | 'mcp' | 'permission' | 'subagent' | 'workflow' | 'memory';
 /** A resolved resource with its origin layer. */

package/dist/lib/secrets/agent.d.ts

@@ -74,23 +74,23 @@ export interface AgentStatusEntry {
     expiresAt: number;
     keyCount: number;
 }
-/** True if the launchd plist for the persistent broker is installed. */
+/** True if a legacy standalone-broker launchd plist is still installed. */
 export declare function secretsAgentServiceInstalled(): boolean;
 /**
- * Install + start the persistent broker as a launchd user service (idempotent).
- * Writes the plist, bootstraps it into the GUI domain, and waits for the socket.
- * `ProcessType: Interactive` asks launchd to schedule it at foreground priority
- * so it can boot even when the machine is loaded. Returns true once reachable.
+ * Retire the legacy standalone secrets-agent launchd service: bootout the job
+ * (falling back to the legacy `unload`) and remove its plist so the always-on
+ * daemon owns the broker socket. Idempotent and best-effort — a no-op when no
+ * legacy plist is present. Does NOT wipe held bundles: the booted-out process's
+ * memory is gone anyway, and the daemon-hosted broker starts fresh.
  */
-export declare function installSecretsAgentService(timeoutMs?: number): Promise<boolean>;
+export declare function retireLegacySecretsAgentService(): void;
 /**
- * Kickstart the already-installed persistent broker so launchd relaunches it
- * onto the current on-disk code. Used by postinstall heal-on-upgrade. No-op if
- * the service isn't installed; never rewrites the plist or waits, so it's safe
- * and fast to call from an installer.
+ * Stop the persistent broker for `agents secrets stop`: wipe whatever the broker
+ * holds (forces Touch ID again on the next read), then retire any legacy
+ * standalone service. The daemon-hosted broker itself is left running — it is
+ * the always-on backbone, and stopping it would take down unrelated background
+ * work (routines, browser IPC, session-sync).
  */
-export declare function kickstartSecretsAgentService(): void;
-/** Stop + remove the persistent broker service, and wipe whatever it held. */
 export declare function uninstallSecretsAgentService(): Promise<void>;
 export type Request = {
     cmd: 'ping';
@@ -171,7 +171,9 @@ export declare function shouldWipeOnWatchEvent(chunk: string): boolean;
  */
 export declare function runSecretsAgent(opts?: {
     service?: boolean;
-}): Promise<void>;
+}): Promise<{
+    close(): void;
+} | null>;
 /**
  * Host the secrets broker inside the always-on daemon (#416).
  *
@@ -184,11 +186,11 @@ export declare function runSecretsAgent(opts?: {
  *     (those would kill the daemon — the daemon is the always-on backbone and
  *     manages its own version/lifecycle). The sweep only TTL-evicts.
  *
- * The caller (`runDaemon`) must only invoke this when NO broker is already
- * reachable (ping first) — this function clears a stale socket before binding,
- * so calling it while a live standalone broker holds the socket would orphan
- * that broker's clients. Returns a handle the daemon closes on shutdown, or
- * null off-darwin (nothing to broker without biometry).
+ * The caller (`runDaemon`) normally invokes this only when no broker answers
+ * its initial ping. Binding still arbitrates ownership through the same shared
+ * path as the standalone service: a live owner wins, while only an unreachable
+ * stale socket is reclaimed. Returns a handle the daemon closes on shutdown,
+ * or null off-darwin (nothing to broker without biometry).
  */
 export declare function startHostedBroker(): Promise<{
     close(): void;
@@ -277,10 +279,11 @@ export declare function agentPing(): Promise<{
  * Ensure a broker is running and reachable. Returns true once the socket answers
  * a ping. macOS only.
  *
- * Prefers the persistent launchd service: if it isn't installed we install it
- * (which makes the broker survive for the whole login session, so subsequent
- * reads never cold-start); if it's installed but unreachable we kickstart it.
- * Only when the service path can't be used do we fall back to a one-off detached
- * broker — that's the model that gets starved under heavy load, so it's last.
+ * Prefers the always-on daemon, which hosts the broker socket (#416): retire any
+ * legacy standalone launchd service so the daemon owns the socket, then bring the
+ * daemon up (Path 0) — one supervised backbone that survives the whole login
+ * session, so subsequent reads never cold-start. Only when the daemon can't be
+ * used do we fall back to a one-off detached broker (Path 1) — the model that
+ * gets starved under heavy load, so it's last.
  */
 export declare function ensureAgentRunning(timeoutMs?: number): Promise<boolean>;