@phnx-labs/agents-cli 1.20.64 → 1.20.66

package/dist/lib/triggers/webhook.js

@@ -12,7 +12,9 @@
  * verification, idempotency, source allow-listing, and rate limiting.
  */
 import * as crypto from 'crypto';
+import * as fs from 'fs';
 import * as http from 'http';
+import * as path from 'path';
 import { jobRunsOnThisDevice, listJobs } from '../routines.js';
 import { executeJobDetached } from '../runner.js';
 /** Read `repository.full_name` (`owner/name`) from a webhook payload, if present. */
@@ -236,6 +238,88 @@ export function createMemoryDeliveryStore(maxEntries = 1000) {
         },
     };
 }
+/**
+ * A durable, disk-backed delivery store. Unlike `createMemoryDeliveryStore`,
+ * seen delivery ids survive a process restart and are bounded by AGE, not by a
+ * fixed entry count — so a captured valid delivery cannot re-fire after a
+ * restart or after count-based LRU eviction would have dropped it.
+ *
+ * `retentionMs` doubles as the replay-acceptance window: a delivery whose id is
+ * still on record (younger than the window) is rejected as a duplicate; entries
+ * older than the window are pruned (keeping the file bounded) since a webhook
+ * source will not legitimately retry a delivery that old.
+ */
+export function createFileDeliveryStore(filePath, retentionMs = 14 * 24 * 60 * 60 * 1000) {
+    const seen = new Map();
+    // Load persisted state (best-effort: a corrupt/missing file starts empty).
+    try {
+        const raw = JSON.parse(fs.readFileSync(filePath, 'utf-8'));
+        const loadedAt = Date.now();
+        for (const [id, entry] of Object.entries(raw)) {
+            if (typeof entry?.updatedAt !== 'number' || loadedAt - entry.updatedAt > retentionMs)
+                continue;
+            seen.set(id, {
+                complete: entry.complete === true,
+                jobs: new Set(Array.isArray(entry.jobs) ? entry.jobs : []),
+                updatedAt: entry.updatedAt,
+            });
+        }
+    }
+    catch {
+        // no prior file / unreadable — start empty
+    }
+    const persist = () => {
+        const snapshot = {};
+        for (const [id, entry] of seen) {
+            snapshot[id] = { complete: entry.complete, jobs: [...entry.jobs], updatedAt: entry.updatedAt };
+        }
+        try {
+            fs.mkdirSync(path.dirname(filePath), { recursive: true });
+            const tmp = `${filePath}.${process.pid}.tmp`;
+            fs.writeFileSync(tmp, JSON.stringify(snapshot), 'utf-8');
+            fs.renameSync(tmp, filePath);
+        }
+        catch {
+            // best-effort durability; an unwritable dir must not crash ingress
+        }
+    };
+    const prune = (now) => {
+        for (const [id, entry] of seen) {
+            if (now - entry.updatedAt > retentionMs)
+                seen.delete(id);
+        }
+    };
+    const touch = (id) => {
+        const now = Date.now();
+        prune(now);
+        let current = seen.get(id);
+        if (!current) {
+            current = { complete: false, jobs: new Set(), updatedAt: now };
+            seen.set(id, current);
+        }
+        current.updatedAt = now;
+        return current;
+    };
+    return {
+        seen: (id) => {
+            const entry = seen.get(id);
+            if (!entry)
+                return false;
+            if (Date.now() - entry.updatedAt > retentionMs)
+                return false;
+            return entry.complete === true;
+        },
+        mark: (id) => {
+            touch(id).complete = true;
+            persist();
+        },
+        completedJobs: (id) => new Set(seen.get(id)?.jobs ?? []),
+        markJob: (id, jobName) => {
+            touch(id).jobs.add(jobName);
+            persist();
+        },
+    };
+}
 export function createMemoryRateLimiter(limit, windowMs) {
     const buckets = new Map();
     return {
@@ -285,6 +369,7 @@ async function readRawBody(req, maxBytes) {
 export function startWebhookServer(options) {
     const deliveryStore = options.deliveryStore ?? createMemoryDeliveryStore();
     const rateLimiter = options.rateLimiter ?? createMemoryRateLimiter(options.rateLimitPerMinute ?? 60, 60_000);
+    const ipRateLimiter = options.ipRateLimiter ?? createMemoryRateLimiter(options.ipRateLimitPerMinute ?? 120, 60_000);
     const maxBodyBytes = options.maxBodyBytes ?? 1024 * 1024;
     const server = http.createServer((req, res) => {
         void (async () => {
@@ -305,6 +390,23 @@ export function startWebhookServer(options) {
                 res.end(JSON.stringify({ ok: false, error: `missing ${source} webhook secret` }));
                 return;
             }
+            // Per-IP throttle + declared-size cap BEFORE the (expensive) body read +
+            // HMAC. A bad-signature flood of 1 MiB POSTs must be rejected without
+            // forcing a full body read and an HMAC per request — the signed-delivery
+            // rate limit further down runs only after a signature passes, so it can't
+            // shed this load on its own.
+            const ip = req.socket.remoteAddress ?? 'unknown';
+            if (!ipRateLimiter.take(ip)) {
+                res.writeHead(429, { 'content-type': 'application/json' });
+                res.end(JSON.stringify({ ok: false, error: 'rate limit exceeded' }));
+                return;
+            }
+            const declaredLength = Number.parseInt(header(req.headers, 'content-length') ?? '', 10);
+            if (Number.isFinite(declaredLength) && declaredLength > maxBodyBytes) {
+                res.writeHead(413, { 'content-type': 'application/json' });
+                res.end(JSON.stringify({ ok: false, error: `payload exceeds ${maxBodyBytes} bytes` }));
+                return;
+            }
             try {
                 const rawBody = await readRawBody(req, maxBodyBytes);
                 const valid = source === 'github'
@@ -357,6 +459,9 @@ export function startWebhookServer(options) {
             }
         })();
     });
+    // Connection cap: bound how many concurrent TCP connections the receiver
+    // will hold open, so a flood cannot exhaust file descriptors / memory.
+    server.maxConnections = options.maxConnections ?? 256;
     server.listen(options.port ?? 0, options.host ?? '127.0.0.1');
     return server;
 }

package/dist/lib/types.d.ts

@@ -515,6 +515,20 @@ export interface PluginManifest {
     userConfig?: PluginUserConfigField[];
     /** Other plugin names this plugin depends on. Missing deps produce a warning. */
     dependencies?: string[];
+    /**
+     * Inline hook configuration (or a path to a hooks JSON file) declared directly
+     * in the manifest, per the official plugin format — an execution surface even
+     * when the plugin ships no `hooks/` directory. Untyped because the shape is a
+     * path string or an inline event map; capability detection only needs to know
+     * whether it is present and non-empty.
+     */
+    hooks?: unknown;
+    /**
+     * Inline MCP-server configuration (or a path to an MCP JSON file) declared
+     * directly in the manifest — an execution surface even when the plugin ships
+     * no `.mcp.json`. Untyped for the same reason as `hooks`.
+     */
+    mcpServers?: unknown;
 }
 /** A plugin found on disk with its parsed manifest and resource inventory. */
 export interface DiscoveredPlugin {
@@ -637,11 +651,15 @@ export interface Meta {
      * bundles without an explicit per-bundle policy: `daily` (the default) asks
      * once per ~7 days, `always` asks every time. `auto` (default on) lets the
      * first real keychain read of a `daily` bundle populate the broker so
-     * concurrent runs read silently — set it `false` to force a prompt on every read. */
+     * concurrent runs read silently — set it `false` to force a prompt on every read.
+     * `holdMs` caps how long an unlocked/auto-cached bundle is held before the next
+     * read re-prompts (default 7 days; e.g. 86400000 for a 24h cap). Clamped to
+     * [1 minute, 30 days]. */
     secrets?: {
         policy?: 'always' | 'daily';
         agent?: {
             auto?: boolean;
+            holdMs?: number;
         };
     };
     /** Spend guardrails (issue #346). User-global caps; project agents.yaml overrides. */
@@ -698,6 +716,23 @@ export interface Meta {
      * are never copied. `inline` hosts carry their own address/user.
      */
     hosts?: Record<string, HostEntry>;
+    /**
+     * Declarative fleet profile (`agents apply` / `ag apply`). Additive to the
+     * schema — project `agents:` version-pins are untouched. Declares which agents
+     * every device should have, which config to sync, and how login propagates.
+     * Full shape in `lib/fleet/types.ts` (FleetManifest).
+     */
+    fleet?: import('./fleet/types.js').FleetManifest;
+    /** `agents share` endpoint (Cloudflare R2 + Worker). Set by `agents share
+     * setup`/`join`; syncs fleet-wide via `agents repo push/pull`. The write token
+     * lives in the `share` secrets bundle, not here. */
+    share?: {
+        baseUrl?: string;
+        accountId?: string;
+        workerName?: string;
+        bucketName?: string;
+        domain?: string;
+    };
 }
 /** Persisted agent-host entry in agents.yaml (overlay or inline). */
 export interface HostEntry {

package/dist/lib/usage.js

@@ -207,12 +207,14 @@ export function formatUsageSummary(plan, snapshot, planWidth = 3) {
         parts.push(chalk.gray(plan.padEnd(planWidth)));
     }
     if (snapshot) {
-        // Compact rows show the two windows every agent shares (session + week);
-        // extra windows (Claude's Sonnet week, Droid's month) render only in the
-        // full per-version usage section. An exhausted month window still surfaces
-        // here as the rate-limited badge via deriveUsageStatusFromSnapshot.
+        // Compact rows show every BLOCKING window — the same set
+        // deriveUsageStatusFromSnapshot uses for the rate-limited badge — so an
+        // account throttled by its month window (Droid meters on 5h/week/month)
+        // shows the bar that explains why. Claude's Sonnet week is a per-model
+        // sub-limit, not a blocking window; it renders only in the full
+        // per-version usage section.
         const windows = snapshot.windows
-            .filter((window) => window.key === 'session' || window.key === 'week')
+            .filter((window) => window.key !== 'sonnet_week')
             .map((window) => `${chalk.gray(`${window.shortLabel}:`)} ${renderCompactUsageBar(window.usedPercent)}`);
         if (windows.length > 0) {
             parts.push(windows.join(' '));

package/dist/lib/versions.js

@@ -30,7 +30,7 @@ import { listResources } from './resources.js';
 import { VERSION_RE, compareVersions } from './agent-spec/primitives.js';
 import { AGENTS, agentConfigDirName, getAccountEmail, resolveAgentName, formatAgentError, findInPath, isSelfUpdatingAgent } from './agents.js';
 import { discoverPermissionGroups, getActivePermissionPresetName, readPermissionPresetRecipe, PERMISSION_PRESET_ENV_VAR } from './permissions.js';
-import { parseMcpServerConfig } from './mcp.js';
+import { parseMcpServerConfig, isProjectMcpTrusted } from './mcp.js';
 import { createVersionedAlias, removeVersionedAlias, getConfigSymlinkVersion, ensureClaudeInsideSymlink } from './shims.js';
 import { importInstallScriptBinary } from './import.js';
 import { IS_WINDOWS, composeWin32CommandLine } from './platform/index.js';
@@ -2511,20 +2511,23 @@ export function syncResourcesToVersion(agent, version, selection, options = {})
     // For Claude/Codex: uses CLI commands (claude mcp add, codex mcp add)
     // For others: edits config files directly
     //
-    // Mirror the hooks defense: exclude project-scoped MCPs from the sync. An
-    // MCP server is an executable invoked under the agent's authority, so a
-    // cloned public repo's .agents/mcp/foo.yaml could install an arbitrary
-    // command. We pre-compute the set of project-scoped names and drop them
-    // before handing the list to installMcpServers. (The deeper helper-side
-    // dedup in lib/mcp.ts still lets a project entry shadow a same-named
-    // user entry, so name-collision shadowing is not fully closed here —
-    // tracked separately for a follow-up in lib/mcp.ts.)
-    const projectScopedMcpNames = new Set(getScopedMcpResources(cwd).filter(r => r.scope === 'project').map(r => r.name));
+    // Mirror the hooks defense: an MCP server is an executable invoked under the
+    // agent's authority, so a cloned public repo's .agents/mcp/foo.yaml could
+    // install an arbitrary command (RUSH-1776). Project-scoped MCPs are UNTRUSTED
+    // by default — drop them before handing the list to installMcpServers unless
+    // the user has explicitly trusted this project (`agents mcp trust`). The
+    // register/spawn choke in lib/mcp.ts (getMcpServersByName) enforces the same
+    // trust gate and drops untrusted project entries before dedup, so a project
+    // entry can no longer shadow a same-named user entry either.
+    const projectMcpTrusted = projectAgentsDir ? isProjectMcpTrusted(projectAgentsDir) : false;
+    const untrustedProjectMcpNames = new Set(projectMcpTrusted
+        ? []
+        : getScopedMcpResources(cwd).filter(r => r.scope === 'project').map(r => r.name));
     const mcpWriter = getWriter('mcp', agent);
     const mcpToSyncAll = selection
         ? resolveSelection(selection.mcp, available.mcp)
         : (mcpWriter ? available.mcp : []);
-    const mcpToSync = mcpToSyncAll.filter(n => !projectScopedMcpNames.has(n));
+    const mcpToSync = mcpToSyncAll.filter(n => !untrustedProjectMcpNames.has(n));
     if (mcpToSync.length > 0 && mcpWriter) {
         const r = mcpWriter.write({ version, versionHome, selection: mcpToSync, cwd });
         result.mcp = r.synced;

package/dist/lib/workflows.d.ts

@@ -240,6 +240,26 @@ export declare function resolveAllowedSubagents(available: string[], allowedAgen
     allowedStems: string[];
     missing: string[];
 };
+/** The Claude tool an orchestrator uses to dispatch subagents. Must stay in a
+ *  workflow's `--tools` allowlist whenever the workflow ships dispatchable
+ *  subagents, or the orchestrator has no way to reach them. */
+export declare const SUBAGENT_DISPATCH_TOOL = "Task";
+/**
+ * Keep the subagent-dispatch tool (`Task`) in a `tools:`-restricted workflow's
+ * allowlist when the workflow actually ships subagents to dispatch.
+ *
+ * A WORKFLOW.md `tools:` list becomes Claude's `--tools` set, which *restricts*
+ * the available built-ins. An orchestrator whose `subagents/` files were just
+ * copied into the shared agents dir but whose `tools:` omits `Task` cannot
+ * reach any of them — it silently no-ops (observed: the run emits only "I'll
+ * wait for the completion notification" and exits). Omitting `Task` while
+ * shipping a `subagents/` dir is always an authoring miss, so we re-add it at
+ * the source rather than relying on every workflow author to remember.
+ *
+ * Returns `tools` unchanged when the workflow has no subagents or already lists
+ * `Task`; otherwise appends `Task`.
+ */
+export declare function ensureSubagentDispatchTool(tools: string[], hasSubagents: boolean): string[];
 /**
  * Prune stale workflow-managed subagent files from the shared per-agent agents
  * dir before a scoped run writes the permitted set (issue #401, follow-up to

package/dist/lib/workflows.js

@@ -278,6 +278,30 @@ export function resolveAllowedSubagents(available, allowedAgents) {
         missing: allowedAgents.filter(a => !present.has(a)),
     };
 }
+/** The Claude tool an orchestrator uses to dispatch subagents. Must stay in a
+ *  workflow's `--tools` allowlist whenever the workflow ships dispatchable
+ *  subagents, or the orchestrator has no way to reach them. */
+export const SUBAGENT_DISPATCH_TOOL = 'Task';
+/**
+ * Keep the subagent-dispatch tool (`Task`) in a `tools:`-restricted workflow's
+ * allowlist when the workflow actually ships subagents to dispatch.
+ *
+ * A WORKFLOW.md `tools:` list becomes Claude's `--tools` set, which *restricts*
+ * the available built-ins. An orchestrator whose `subagents/` files were just
+ * copied into the shared agents dir but whose `tools:` omits `Task` cannot
+ * reach any of them — it silently no-ops (observed: the run emits only "I'll
+ * wait for the completion notification" and exits). Omitting `Task` while
+ * shipping a `subagents/` dir is always an authoring miss, so we re-add it at
+ * the source rather than relying on every workflow author to remember.
+ *
+ * Returns `tools` unchanged when the workflow has no subagents or already lists
+ * `Task`; otherwise appends `Task`.
+ */
+export function ensureSubagentDispatchTool(tools, hasSubagents) {
+    if (!hasSubagents || tools.includes(SUBAGENT_DISPATCH_TOOL))
+        return tools;
+    return [...tools, SUBAGENT_DISPATCH_TOOL];
+}
 /**
  * Prune stale workflow-managed subagent files from the shared per-agent agents
  * dir before a scoped run writes the permitted set (issue #401, follow-up to

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@phnx-labs/agents-cli",
-  "version": "1.20.64",
+  "version": "1.20.66",
   "description": "One CLI for all your AI coding agents - versions, config, cloud dispatch, sessions, and teams (now with first-class Grok Build CLI support)",
   "type": "module",
   "main": "dist/index.js",
@@ -51,6 +51,7 @@
     "prepack": "cp ../../README.md README.md && scripts/verify-keychain-helper.sh && scripts/verify-menubar-helper.sh && scripts/verify-cli-binary.sh",
     "postinstall": "node scripts/postinstall.js",
     "dev": "tsx src/index.ts",
+    "changelog": "bun scripts/gen-changelog.ts",
     "start": "node dist/index.js",
     "test": "node ./node_modules/vitest/vitest.mjs run",
     "test:remote": "scripts/sandbox.sh 'bun install && bun run build && bun run test'",