@phnx-labs/agents-cli 1.20.65 → 1.20.67

package/dist/lib/shims.js

@@ -16,7 +16,7 @@ import { confirm, select } from '@inquirer/prompts';
 import { IS_WINDOWS, prependToWindowsUserPath } from './platform/index.js';
 import { getShimsDir, getVersionsDir, getBackupsDir, getHistoryDir, ensureAgentsDir } from './state.js';
 export { getShimsDir };
-import { AGENTS, agentConfigDirName } from './agents.js';
+import { AGENTS, agentConfigDirName, readAuthAccountIdentity } from './agents.js';
 /**
  * Files and directories to always skip during conflict detection and migration.
  * These are never user config that should be migrated.
@@ -1143,6 +1143,21 @@ function detectMigrationConflicts(agent, version) {
  * preserved so the "freshest" comparison stays stable and switches don't
  * ping-pong. Best-effort: a failed copy just means the user re-logs in.
  */
+/**
+ * Best-effort account identity for the credential *directory* of a file-auth
+ * agent (droid / kimi / antigravity), or null when the directory holds no
+ * decodable account claim. Delegates to readAuthAccountIdentity, which decrypts
+ * / decodes each agent's REAL on-disk format (droid AES-256-GCM + WorkOS JWT,
+ * kimi access-token JWT, antigravity refresh-token) — the earlier plaintext
+ * top-level-key scan matched NO real credential file, so the guard below never
+ * engaged. Two dirs for the SAME account compare equal; DIFFERENT accounts
+ * compare distinct. Used by carryForwardAuthFiles to refuse overwriting one
+ * account's login with a credential that belongs to a DIFFERENT account
+ * (RUSH-1764).
+ */
+export function readAuthFileIdentity(agent, configDir) {
+    return readAuthAccountIdentity(agent, configDir);
+}
 export function carryForwardAuthFiles(agent, toConfigDir) {
     const authFiles = AGENTS[agent].authFiles;
     if (!authFiles || authFiles.length === 0)
@@ -1158,12 +1173,33 @@ export function carryForwardAuthFiles(agent, toConfigDir) {
     catch {
         return; // no installed versions to source from
     }
+    // Account identity currently installed at the destination home (null when the
+    // dest is empty or its credential can't be decoded). When it IS known, only a
+    // source home whose credential decodes to the SAME account is eligible to
+    // overwrite it — so a newer login for a DIFFERENT account sitting in another
+    // version-home can't silently replace the account the user is signed into
+    // (RUSH-1764). An empty destination still seeds from the freshest source (the
+    // version-switch case). Identity is a per-DIR/account property, not per-file:
+    // for droid it comes from decrypting auth.v2.file with auth.v2.key, so it must
+    // gate BOTH files as a unit (never carry account B's key over account A's).
+    const toResolved = path.resolve(toConfigDir);
+    const destIdentity = readAuthFileIdentity(agent, toConfigDir);
+    const identityCache = new Map();
+    const dirIdentity = (dir) => {
+        const key = path.resolve(dir);
+        if (!identityCache.has(key))
+            identityCache.set(key, readAuthFileIdentity(agent, dir));
+        return identityCache.get(key) ?? null;
+    };
     for (const rel of authFiles) {
         const dest = path.join(toConfigDir, rel);
         const destResolved = path.resolve(dest);
-        // Newest existing source copy across all version homes (excluding dest).
+        // Newest existing source copy across all version homes (excluding dest),
+        // constrained to the destination's account identity when it is known.
         let newest = null;
         for (const dir of sourceDirs) {
+            if (path.resolve(dir) === toResolved)
+                continue; // never source from self
             const src = path.join(dir, rel);
             if (path.resolve(src) === destResolved)
                 continue;
@@ -1176,6 +1212,10 @@ export function carryForwardAuthFiles(agent, toConfigDir) {
             }
             if (!st.isFile())
                 continue;
+            // Account-identity guard: never carry a different account's credential over
+            // an existing login. Only enforced when the destination's identity is known.
+            if (destIdentity !== null && dirIdentity(dir) !== destIdentity)
+                continue;
             if (!newest || st.mtimeMs > newest.mtimeMs)
                 newest = { path: src, mtimeMs: st.mtimeMs };
         }

package/dist/lib/ssh-exec.d.ts

@@ -29,6 +29,16 @@ export declare function shellQuote(s: string): string;
  */
 export declare const SSH_OPTS: readonly string[];
 export declare function controlOpts(): string[];
+/**
+ * Compose an ssh connection-option prefix.
+ *
+ * `hostKeyOpts` (a caller's host-key posture, e.g. a pinned
+ * `StrictHostKeyChecking=yes` + managed `UserKnownHostsFile`) go FIRST, ahead of
+ * the `SSH_OPTS` baseline: ssh honors the *first* value it sees for each option,
+ * so an override placed after the baseline's `accept-new` would be silently
+ * ignored. Pure so the ordering contract is unit-testable. See RUSH-1767.
+ */
+export declare function sshConnectOpts(mux: string[], hostKeyOpts?: string[]): string[];
 export interface SshExecOptions {
     /** Piped to the remote command's stdin (never interpolated into the shell). */
     input?: string;
@@ -38,6 +48,13 @@ export interface SshExecOptions {
     extraSshArgs?: string[];
     /** Reuse a persistent control socket across calls (default true; see `controlOpts`). */
     multiplex?: boolean;
+    /**
+     * Host-key `-o` options that OVERRIDE the accept-new baseline — prepended so
+     * ssh's first-value-wins rule takes them (see {@link sshConnectOpts}). Used to
+     * force strict verification against the managed known_hosts store on the
+     * credential-copy path (RUSH-1767).
+     */
+    hostKeyOpts?: string[];
 }
 export interface SshExecResult {
     /** Remote exit status, or null if ssh itself failed / timed out. */
@@ -79,6 +96,13 @@ export interface SshStreamOptions {
     tty?: boolean;
     /** Reuse a persistent control socket across calls (default true; see `controlOpts`). */
     multiplex?: boolean;
+    /**
+     * Host-key `-o` options that OVERRIDE the accept-new baseline — prepended so
+     * ssh's first-value-wins rule takes them (see {@link sshConnectOpts}). Used to
+     * force strict verification against the managed known_hosts store on the
+     * interactive credential-copy path (RUSH-1767).
+     */
+    hostKeyOpts?: string[];
 }
 /**
  * Foreground counterpart to `sshExec`: run `remoteCmd` on `target` with the

package/dist/lib/ssh-exec.js

@@ -88,6 +88,18 @@ export function controlOpts() {
         '-o', 'ControlPersist=60s',
     ];
 }
+/**
+ * Compose an ssh connection-option prefix.
+ *
+ * `hostKeyOpts` (a caller's host-key posture, e.g. a pinned
+ * `StrictHostKeyChecking=yes` + managed `UserKnownHostsFile`) go FIRST, ahead of
+ * the `SSH_OPTS` baseline: ssh honors the *first* value it sees for each option,
+ * so an override placed after the baseline's `accept-new` would be silently
+ * ignored. Pure so the ordering contract is unit-testable. See RUSH-1767.
+ */
+export function sshConnectOpts(mux, hostKeyOpts) {
+    return [...(hostKeyOpts ?? []), ...SSH_OPTS, ...mux];
+}
 /**
  * Run `remoteCmd` on `target` over ssh and capture stdout/stderr/exit.
  *
@@ -97,7 +109,7 @@ export function controlOpts() {
 export function sshExec(target, remoteCmd, opts = {}) {
     assertValidSshTarget(target);
     const mux = opts.multiplex === false ? [] : controlOpts();
-    const args = [...SSH_OPTS, ...mux, ...(opts.extraSshArgs ?? []), target, remoteCmd];
+    const args = [...sshConnectOpts(mux, opts.hostKeyOpts), ...(opts.extraSshArgs ?? []), target, remoteCmd];
     const res = spawnSync('ssh', args, {
         input: opts.input,
         encoding: 'utf-8',
@@ -123,7 +135,7 @@ export function sshExec(target, remoteCmd, opts = {}) {
 export function sshExecRaw(target, remoteCmd, opts = {}) {
     assertValidSshTarget(target);
     const mux = opts.multiplex === false ? [] : controlOpts();
-    const args = [...SSH_OPTS, ...mux, ...(opts.extraSshArgs ?? []), target, remoteCmd];
+    const args = [...sshConnectOpts(mux, opts.hostKeyOpts), ...(opts.extraSshArgs ?? []), target, remoteCmd];
     const res = spawnSync('ssh', args, {
         input: opts.input,
         // No `encoding` → spawnSync returns Buffers.
@@ -154,7 +166,7 @@ export function sshStream(target, remoteCmd, opts = {}) {
     assertValidSshTarget(target);
     const mux = opts.multiplex === false ? [] : controlOpts();
     const tty = opts.tty ? ['-tt'] : [];
-    const args = [...SSH_OPTS, ...mux, ...tty, target, remoteCmd];
+    const args = [...sshConnectOpts(mux, opts.hostKeyOpts), ...tty, target, remoteCmd];
     const res = spawnSync('ssh', args, { stdio: 'inherit' });
     if (typeof res.status === 'number')
         return res.status;

package/dist/lib/startup/command-registry.d.ts

@@ -91,6 +91,7 @@ export declare const loadMessage: ModuleLoader;
 export declare const loadFeed: ModuleLoader;
 export declare const loadMailboxes: ModuleLoader;
 export declare const loadServe: ModuleLoader;
+export declare const loadShare: ModuleLoader;
 export declare const loadAudit: ModuleLoader;
 export declare const loadWebhook: ModuleLoader;
 export declare const loadFunnel: ModuleLoader;

package/dist/lib/startup/command-registry.js

@@ -69,6 +69,7 @@ export const loadMessage = async () => (await import('../../commands/message.js'
 export const loadFeed = async () => (await import('../../commands/feed.js')).registerFeedCommand;
 export const loadMailboxes = async () => (await import('../../commands/mailboxes.js')).registerMailboxesCommand;
 export const loadServe = async () => (await import('../../commands/serve.js')).registerServeCommand;
+export const loadShare = async () => (await import('../../commands/share.js')).registerShareCommands;
 export const loadAudit = async () => (await import('../../commands/audit.js')).registerAuditCommands;
 export const loadWebhook = async () => (await import('../../commands/webhook.js')).registerWebhookCommand;
 export const loadFunnel = async () => (await import('../../commands/funnel.js')).registerFunnelCommand;
@@ -179,6 +180,7 @@ export const COMMAND_LOADERS = {
     mailboxes: [loadMailboxes],
     mailbox: [loadMailboxes],
     serve: [loadServe],
+    share: [loadShare],
     audit: [loadAudit],
     webhook: [loadWebhook],
     funnel: [loadFunnel],

package/dist/lib/types.d.ts

@@ -160,6 +160,16 @@ export interface AgentConfig {
          * `skip` errors with a clear message naming the supported modes.
          */
         modes: Mode[];
+        /**
+         * Whether `plan` mode works in a HEADLESS run (`--prompt`/`-p`). Some CLIs
+         * list a `plan` mode that only works interactively — kimi refuses `--prompt`
+         * combined with `--plan`, and grok's `--permission-mode plan` silently stalls
+         * a headless run at its ExitPlanMode gate. Absent (undefined) means true:
+         * headless plan is assumed to work unless a agent opts out with `false`, in
+         * which case a headless `--mode plan` request auto-downgrades to `auto`
+         * (see resolveHeadlessMode). Interactive plan is unaffected.
+         */
+        headlessPlan?: boolean;
         /**
          * Whether the agent natively resolves `@path/to/file` imports inside its
          * rules file at session start. If false, agents-cli must pre-compile the
@@ -723,6 +733,16 @@ export interface Meta {
      * Full shape in `lib/fleet/types.ts` (FleetManifest).
      */
     fleet?: import('./fleet/types.js').FleetManifest;
+    /** `agents share` endpoint (Cloudflare R2 + Worker). Set by `agents share
+     * setup`/`join`; syncs fleet-wide via `agents repo push/pull`. The write token
+     * lives in the `share` secrets bundle, not here. */
+    share?: {
+        baseUrl?: string;
+        accountId?: string;
+        workerName?: string;
+        bucketName?: string;
+        domain?: string;
+    };
 }
 /** Persisted agent-host entry in agents.yaml (overlay or inline). */
 export interface HostEntry {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@phnx-labs/agents-cli",
-  "version": "1.20.65",
+  "version": "1.20.67",
   "description": "One CLI for all your AI coding agents - versions, config, cloud dispatch, sessions, and teams (now with first-class Grok Build CLI support)",
   "type": "module",
   "main": "dist/index.js",