@phnx-labs/agents-cli 1.20.65 → 1.20.66

package/dist/lib/picker.js

@@ -12,7 +12,7 @@
  * display, and keyboard navigation. Used by sessions, teams, and other
  * interactive pickers throughout the CLI.
  */
-import { createPrompt, useState, useKeypress, useEffect, useMemo, usePagination, usePrefix, makeTheme, isEnterKey, isUpKey, isDownKey, isSpaceKey, Separator, } from '@inquirer/core';
+import { createPrompt, useState, useKeypress, useEffect, useMemo, useRef, usePagination, usePrefix, makeTheme, isEnterKey, isUpKey, isDownKey, isSpaceKey, isBackspaceKey, Separator, } from '@inquirer/core';
 import chalk from 'chalk';
 import { stripVTControlCharacters } from 'node:util';
 const DEFAULT_TERMINAL_ROWS = 24;
@@ -324,3 +324,216 @@ export function multiItemPicker(config) {
     });
     return prompt(config);
 }
+/**
+ * Async-refetch variant of {@link itemPicker}. Holds a `filter` object in state and
+ * re-runs `load(filter)` whenever a keybinding mutates it (with a loading placeholder
+ * while the fetch — e.g. an SSH fleet fan-out — is in flight). A separate `S` search
+ * mode filters the loaded pool client-side. `enter` returns the active row + the live
+ * filter; `esc` cancels (from search mode, `esc` first exits search).
+ *
+ * Same render/pagination/preview machinery as the static pickers — only the data
+ * source and keymap are dynamic.
+ */
+export function dynamicPicker(config) {
+    const prompt = createPrompt((cfg, done) => {
+        const theme = makeTheme({});
+        const [status, setStatus] = useState('idle');
+        const [filter, setFilter] = useState(() => cfg.initialFilter);
+        const [items, setItems] = useState([]);
+        const [loading, setLoading] = useState(true);
+        const [query, setQuery] = useState('');
+        const [mode, setMode] = useState('nav');
+        const [previewOpen, setPreviewOpen] = useState(false);
+        const [active, setActive] = useState(0);
+        const [flash, setFlash] = useState('');
+        const prefix = usePrefix({ status, theme });
+        // Guards against a slow load resolving after a newer filter superseded it.
+        const gen = useRef(0);
+        useEffect(() => {
+            const my = ++gen.current;
+            setLoading(true);
+            Promise.resolve(cfg.load(filter))
+                .then((rows) => {
+                if (my !== gen.current)
+                    return;
+                setItems(rows);
+                setLoading(false);
+                setActive(0);
+            })
+                .catch(() => {
+                if (my !== gen.current)
+                    return;
+                setItems([]);
+                setLoading(false);
+            });
+        }, [filter]);
+        const results = useMemo(() => {
+            const q = query.trim();
+            const pool = q && cfg.matches ? items.filter((it) => cfg.matches(it, q)) : items;
+            return pool.slice(0, 200).map((item) => ({
+                value: item,
+                label: cfg.labelFor(item, q),
+            }));
+        }, [items, query]);
+        useEffect(() => {
+            if (active >= results.length)
+                setActive(0);
+        }, [results]);
+        const selected = results[active];
+        const finish = () => {
+            if (!selected)
+                return;
+            setStatus('done');
+            done({ item: selected.value, filter });
+        };
+        useKeypress((key, rl) => {
+            if (isEnterKey(key)) {
+                finish();
+                return;
+            }
+            // Search mode: we own the query buffer (readline's line doesn't survive
+            // across renders here, so we build it from key events). Clear readline
+            // every keystroke so nothing leaks, then append the typed character.
+            if (mode === 'search') {
+                if (key.name === 'escape') {
+                    // Exit search but KEEP the query as an active filter, so hotkeys (and
+                    // the y copy-cmd) operate on the searched view. A second esc in nav
+                    // clears it. Enter also confirms the highlighted row directly.
+                    rl.clearLine(0);
+                    setMode('nav');
+                    return;
+                }
+                if (isUpKey(key)) {
+                    rl.clearLine(0);
+                    if (results.length > 0)
+                        setActive((active - 1 + results.length) % results.length);
+                    return;
+                }
+                if (isDownKey(key)) {
+                    rl.clearLine(0);
+                    if (results.length > 0)
+                        setActive((active + 1) % results.length);
+                    return;
+                }
+                if (isBackspaceKey(key)) {
+                    rl.clearLine(0);
+                    setQuery(query.slice(0, -1));
+                    return;
+                }
+                const seq = key.sequence;
+                rl.clearLine(0);
+                if (seq && seq.length === 1 && seq >= ' ' && !key.ctrl) {
+                    setQuery(query + seq);
+                }
+                return;
+            }
+            // Nav mode: single keys are hotkeys — clear the readline buffer so a hotkey
+            // letter (r/b/c/…) never accumulates as stray input.
+            rl.clearLine(0);
+            if (key.name === 'escape') {
+                // First esc clears an active search filter; a second (no filter) cancels.
+                if (query) {
+                    setQuery('');
+                    return;
+                }
+                done(null);
+                return;
+            }
+            if (isUpKey(key)) {
+                if (results.length > 0)
+                    setActive((active - 1 + results.length) % results.length);
+                return;
+            }
+            if (isDownKey(key)) {
+                if (results.length > 0)
+                    setActive((active + 1) % results.length);
+                return;
+            }
+            if (flash)
+                setFlash('');
+            if (key.name === (cfg.searchKey ?? 's')) {
+                setMode('search');
+                return;
+            }
+            if (cfg.buildPreview && key.name === (cfg.previewKey ?? 'tab')) {
+                setPreviewOpen(!previewOpen);
+                return;
+            }
+            const binding = cfg.keyBindings?.[key.name ?? ''];
+            if (binding) {
+                const next = binding(filter);
+                if (!Object.is(next, filter))
+                    setFilter(next);
+                return;
+            }
+            if (cfg.onKey) {
+                const msg = cfg.onKey(key.name ?? '', filter, selected?.value, query);
+                if (msg)
+                    setFlash(msg);
+            }
+        });
+        const message = theme.style.message(cfg.message, status);
+        if (status === 'done') {
+            return `${prefix} ${message}`;
+        }
+        const headerBits = [prefix, message];
+        if (cfg.headerFor)
+            headerBits.push(chalk.gray(cfg.headerFor(filter)));
+        if (mode === 'search') {
+            headerBits.push(query ? chalk.cyan('/' + query) : chalk.gray('/ (type to filter)'));
+        }
+        else if (query) {
+            headerBits.push(chalk.cyan('/' + query));
+        }
+        const header = headerBits.filter(Boolean).join(' ');
+        const page = usePagination({
+            items: results,
+            active,
+            renderItem({ item, isActive }) {
+                if (Separator.isSeparator(item))
+                    return ` ${item.separator}`;
+                const cursor = isActive ? chalk.cyan('>') : ' ';
+                const row = isActive ? chalk.bold(item.label) : item.label;
+                return `${cursor} ${row}`;
+            },
+            pageSize: cfg.pageSize ?? 12,
+            loop: false,
+        });
+        const help = chalk.gray(cfg.helpFor
+            ? cfg.helpFor(filter, mode)
+            : mode === 'search'
+                ? '↑↓ navigate · esc exit search · ⏎ ' + (cfg.enterHint ?? 'select')
+                : 's search · ↑↓ navigate · ⏎ ' + (cfg.enterHint ?? 'select') + ' · esc cancel');
+        const parts = [header];
+        if (loading) {
+            parts.push(chalk.gray(`  ${cfg.loadingMessage ?? 'Loading…'}`));
+        }
+        else {
+            parts.push(page);
+            if (results.length === 0) {
+                parts.push(chalk.gray(`  ${cfg.emptyMessage ?? 'No matches.'}`));
+            }
+        }
+        if (previewOpen && selected && cfg.buildPreview && !loading) {
+            const width = terminalWidth();
+            const separator = chalk.gray('─'.repeat(Math.min(width, 80)));
+            const flashRows = flash ? renderedRows(flash, width) : 0;
+            const fixedRows = renderedRows(header, width) +
+                renderedRows(parts.slice(1).join('\n'), width) +
+                renderedRows(separator, width) +
+                renderedRows(help, width) +
+                flashRows;
+            const availablePreviewRows = terminalRows() - fixedRows;
+            const preview = limitPreviewHeight(cfg.buildPreview(selected.value), availablePreviewRows, width);
+            if (preview) {
+                parts.push(separator);
+                parts.push(preview);
+            }
+        }
+        if (flash)
+            parts.push(chalk.green(flash));
+        parts.push(help);
+        return [header, parts.slice(1).join('\n')];
+    });
+    return prompt(config);
+}

package/dist/lib/plugins.d.ts

@@ -316,7 +316,37 @@ export declare function getUpstreamManifestVersion(info: PluginSourceInfo): stri
  * Update an installed plugin by re-pulling from its original source.
  * Returns true if the update succeeded.
  */
-export declare function updatePlugin(name: string): Promise<{
+/**
+ * Labels of exec surfaces present in `after` that were NOT present in `before`.
+ * Used by updatePlugin to distinguish a newly-appearing execution surface
+ * (upstream compromise → renewed consent required) from one the user already
+ * trusted (leave enablement alone).
+ */
+export declare function newExecSurfaceLabels(before: PluginCapabilities, after: PluginCapabilities): string[];
+/**
+ * Re-fetch a plugin from its recorded source and apply the update to disk.
+ *
+ * Security (RUSH-1757): a plugin's upstream is mutable. `updatePlugin` never
+ * mutates the live plugin tree before it has inspected the incoming content —
+ * the new revision is fetched into a **quarantine** dir first, its capabilities
+ * are diffed against the current on-disk baseline, and the update is applied to
+ * `plugin.root` only after the trust decision. If the update introduces a NEW
+ * executable surface (hooks/, .mcp.json, bin/, scripts/, settings.json,
+ * permissions/) that the current revision did not carry, the update is refused
+ * unless `options.allowExecSurfaces` is set — the last-good content is kept in
+ * place, so a benign-then-compromised upstream can never execute on the next
+ * update without renewed consent. A surface the user already trusted is not a
+ * "new" surface and does not re-trigger the gate.
+ */
+export declare function updatePlugin(name: string, options?: {
+    allowExecSurfaces?: boolean;
+}): Promise<{
     success: boolean;
     error?: string;
+    /** True when the update was refused because it introduced new exec surfaces. */
+    blockedByExecSurfaces?: boolean;
+    /** Labels of exec surfaces newly introduced by this update, if any. */
+    newExecSurfaces?: string[];
+    /** Whether the applied revision carries executable surfaces (for the caller's re-sync). */
+    hasExecSurfaces?: boolean;
 }>;

package/dist/lib/plugins.js

@@ -1739,7 +1739,33 @@ export function getUpstreamManifestVersion(info) {
  * Update an installed plugin by re-pulling from its original source.
  * Returns true if the update succeeded.
  */
-export async function updatePlugin(name) {
+/**
+ * Labels of exec surfaces present in `after` that were NOT present in `before`.
+ * Used by updatePlugin to distinguish a newly-appearing execution surface
+ * (upstream compromise → renewed consent required) from one the user already
+ * trusted (leave enablement alone).
+ */
+export function newExecSurfaceLabels(before, after) {
+    return Object.keys(PLUGIN_EXEC_SURFACE_LABELS)
+        .filter((key) => after[key] && !before[key])
+        .map((key) => PLUGIN_EXEC_SURFACE_LABELS[key]);
+}
+/**
+ * Re-fetch a plugin from its recorded source and apply the update to disk.
+ *
+ * Security (RUSH-1757): a plugin's upstream is mutable. `updatePlugin` never
+ * mutates the live plugin tree before it has inspected the incoming content —
+ * the new revision is fetched into a **quarantine** dir first, its capabilities
+ * are diffed against the current on-disk baseline, and the update is applied to
+ * `plugin.root` only after the trust decision. If the update introduces a NEW
+ * executable surface (hooks/, .mcp.json, bin/, scripts/, settings.json,
+ * permissions/) that the current revision did not carry, the update is refused
+ * unless `options.allowExecSurfaces` is set — the last-good content is kept in
+ * place, so a benign-then-compromised upstream can never execute on the next
+ * update without renewed consent. A surface the user already trusted is not a
+ * "new" surface and does not re-trigger the gate.
+ */
+export async function updatePlugin(name, options = {}) {
     const plugin = getPlugin(name);
     if (!plugin) {
         return { success: false, error: `Plugin '${name}' not found` };
@@ -1755,33 +1781,68 @@ export async function updatePlugin(name) {
     catch {
         return { success: false, error: `Could not read source info for '${name}'` };
     }
+    // Baseline: what the live (already-trusted) revision ships today.
+    const before = inspectPluginCapabilities(plugin.root);
+    // Quarantine dir lives beside plugin.root (same filesystem) so the final
+    // apply can be a rename. The dot-prefix keeps it out of plugin discovery.
+    const quarantine = path.join(path.dirname(plugin.root), `.${path.basename(plugin.root)}.update-quarantine`);
+    const cleanupQuarantine = () => {
+        try {
+            fs.rmSync(quarantine, { recursive: true, force: true });
+        }
+        catch { /* best effort */ }
+    };
+    cleanupQuarantine();
     try {
+        // 1. Fetch the incoming revision into quarantine — never touch plugin.root yet.
         if (sourceInfo.isGit) {
-            execFileSync('git', ['-C', plugin.root, 'pull', '--ff-only'], { stdio: 'pipe' });
+            // Copy the working checkout (with its .git) and fast-forward the copy, so a
+            // hostile upstream diff lands in the quarantine, not the live tree.
+            fs.cpSync(plugin.root, quarantine, { recursive: true });
+            execFileSync('git', ['-C', quarantine, 'pull', '--ff-only'], { stdio: 'pipe' });
         }
         else {
             const resolvedSource = sourceInfo.source.replace(/^~/, homeDir());
             if (!fs.existsSync(resolvedSource)) {
+                cleanupQuarantine();
                 return { success: false, error: `Source path no longer exists: ${resolvedSource}` };
             }
-            // Preserve .user-config.json and .source during re-copy
-            const userConfigPath = path.join(plugin.root, USER_CONFIG_FILE);
-            const userConfigBackup = fs.existsSync(userConfigPath)
-                ? fs.readFileSync(userConfigPath, 'utf-8')
-                : null;
-            fs.rmSync(plugin.root, { recursive: true, force: true });
-            fs.cpSync(resolvedSource, plugin.root, { recursive: true });
-            if (userConfigBackup !== null) {
-                fs.writeFileSync(userConfigPath, userConfigBackup, 'utf-8');
-            }
+            fs.cpSync(resolvedSource, quarantine, { recursive: true });
+        }
+        // 2. Diff capabilities of the incoming revision against the baseline.
+        const after = inspectPluginCapabilities(quarantine);
+        const newSurfaces = newExecSurfaceLabels(before, after);
+        // 3. Refuse a surface-introducing update without renewed consent. The
+        //    last-good content stays in place untouched.
+        if (newSurfaces.length > 0 && options.allowExecSurfaces !== true) {
+            cleanupQuarantine();
+            return {
+                success: false,
+                blockedByExecSurfaces: true,
+                newExecSurfaces: newSurfaces,
+                error: `Update refused: '${name}' introduces new executable surfaces (${newSurfaces.join(', ')}). ` +
+                    `Re-run with --allow-exec-surfaces if you trust the source.`,
+            };
+        }
+        // 4. Apply: swap the quarantined revision into plugin.root, preserving the
+        //    user config and re-stamping .source.
+        const userConfigPath = path.join(plugin.root, USER_CONFIG_FILE);
+        const userConfigBackup = fs.existsSync(userConfigPath)
+            ? fs.readFileSync(userConfigPath, 'utf-8')
+            : null;
+        fs.rmSync(plugin.root, { recursive: true, force: true });
+        fs.renameSync(quarantine, plugin.root);
+        if (userConfigBackup !== null) {
+            fs.writeFileSync(userConfigPath, userConfigBackup, 'utf-8');
         }
         // Re-stamp .source with the freshly pulled manifest version so the baseline
         // tracks what's now on disk (keeps the heal "unmodified?" check honest).
         const freshVersion = loadPluginManifest(plugin.root)?.version;
         fs.writeFileSync(path.join(plugin.root, SOURCE_FILE), JSON.stringify({ ...sourceInfo, version: freshVersion }), 'utf-8');
+        return { success: true, newExecSurfaces: newSurfaces, hasExecSurfaces: hasPluginExecSurfaces(after) };
     }
     catch (err) {
+        cleanupQuarantine();
         return { success: false, error: err.message };
     }
-    return { success: true };
 }

package/dist/lib/secrets/agent.d.ts

@@ -23,6 +23,7 @@
  * macOS only: Linux libsecret has no biometry prompt, so there's nothing to
  * deduplicate — every entry point here no-ops off darwin.
  */
+import * as net from 'net';
 import type { SecretsBundle } from './bundles.js';
 /** Default lifetime of an unlocked bundle when `--ttl` is not given. */
 export declare const DEFAULT_TTL_MS: number;
@@ -74,6 +75,13 @@ export interface AgentStatusEntry {
     expiresAt: number;
     keyCount: number;
 }
+/**
+ * Read the current broker capability token, or null if none is present. Clients
+ * read it fresh per request and attach it to every non-ping command; a broker
+ * restart mints a new token, so a stale read simply fails authorization and the
+ * caller falls back to a direct keychain read (soft, never a hard error).
+ */
+export declare function readAgentToken(): string | null;
 /** True if a legacy standalone-broker launchd plist is still installed. */
 export declare function secretsAgentServiceInstalled(): boolean;
 /**
@@ -97,17 +105,21 @@ export type Request = {
 } | {
     cmd: 'get';
     name: string;
+    token?: string;
 } | {
     cmd: 'load';
     name: string;
     bundle: SecretsBundle;
     env: Record<string, string>;
     ttlMs: number;
+    token?: string;
 } | {
     cmd: 'lock';
     name?: string;
+    token?: string;
 } | {
     cmd: 'status';
+    token?: string;
 };
 export type Response = {
     ok: true;
@@ -164,6 +176,28 @@ export declare function handleAgentRequest(store: Map<string, StoredBundle>, req
  * has direct regression coverage (the inline stdout handler isn't unit-testable).
  */
 export declare function shouldWipeOnWatchEvent(chunk: string): boolean;
+/**
+ * Authorization gate applied to every request BEFORE handleAgentRequest touches
+ * the store (RUSH-1760). A bare same-UID socket connection is no longer trusted
+ * to load/get arbitrary bundle env: each command except the liveness `ping` must
+ * carry the per-broker capability token, which lives in a 0600 file inside the
+ * 0700 agent dir and so is readable only by the UID that owns the broker.
+ *
+ * Fail closed: a missing/empty expected token (no token file) rejects every
+ * command but ping. `ping` stays unauthenticated — it exposes only the protocol
+ * and cli version, and clients need it to detect a reachable broker before they
+ * have any reason to read the token. Pure + exported for direct unit testing.
+ */
+export declare function isRequestAuthorized(req: Request, expectedToken: string | null): boolean;
+type BrokerConnectionHandler = (conn: net.Socket) => void;
+/**
+ * Build the socket `connection` handler shared by both brokers (standalone and
+ * daemon-hosted): newline-framed JSON in, one response line out, with the
+ * authorization gate (isRequestAuthorized) applied before `handle`. `token`
+ * resolves the currently-expected capability token per request so a token
+ * rotation on broker restart is picked up without rebuilding the handler.
+ */
+export declare function makeConnectionHandler(handle: (req: Request) => Response, token: () => string | null): BrokerConnectionHandler;
 /**
  * Run the broker in the foreground. Spawned detached by ensureAgentRunning via
  * `agents secrets _agent-run`. Holds the store in memory, serves the socket,
@@ -325,3 +359,4 @@ export declare function agentPing(): Promise<{
  * gets starved under heavy load, so it's last.
  */
 export declare function ensureAgentRunning(timeoutMs?: number): Promise<boolean>;
+export {};