@phnx-labs/agents-cli 1.20.66 → 1.20.68

package/dist/lib/resources/mcp.js

@@ -12,8 +12,9 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import * as yaml from 'yaml';
-import * as TOML from 'smol-toml';
 import { capableAgents } from '../capabilities.js';
+import { getProjectMcpConfigPath } from '../agents.js';
+import { writeMcpConfig } from '../mcp.js';
 import { getSystemMcpDir, getUserMcpDir, getProjectAgentsDir, getEnabledExtraRepos, } from '../state.js';
 /**
  * Parse an MCP YAML file into an McpItem.
@@ -132,316 +133,10 @@ export function getMcpConfigPath(agent, versionHome) {
     }
 }
 /**
- * Strip JSON comments (for JSONC files).
+ * Dispatch MCP items to the agent-specific config writer.
  */
-function stripJsonComments(content) {
-    let result = '';
-    let inString = false;
-    let escape = false;
-    let i = 0;
-    while (i < content.length) {
-        const char = content[i];
-        const next = content[i + 1];
-        if (escape) {
-            result += char;
-            escape = false;
-            i++;
-            continue;
-        }
-        if (char === '\\' && inString) {
-            result += char;
-            escape = true;
-            i++;
-            continue;
-        }
-        if (char === '"') {
-            inString = !inString;
-            result += char;
-            i++;
-            continue;
-        }
-        if (!inString) {
-            if (char === '/' && next === '/') {
-                while (i < content.length && content[i] !== '\n') {
-                    i++;
-                }
-                continue;
-            }
-            if (char === '/' && next === '*') {
-                i += 2;
-                while (i < content.length && !(content[i] === '*' && content[i + 1] === '/')) {
-                    i++;
-                }
-                i += 2;
-                continue;
-            }
-        }
-        result += char;
-        i++;
-    }
-    return result;
-}
-/**
- * Write MCP servers to Claude settings.json format.
- */
-function syncToClaudeConfig(configPath, items) {
-    let config = {};
-    if (fs.existsSync(configPath)) {
-        try {
-            config = JSON.parse(fs.readFileSync(configPath, 'utf-8'));
-        }
-        catch {
-            config = {};
-        }
-    }
-    const mcpServers = {};
-    for (const item of items) {
-        if (item.transport === 'stdio') {
-            mcpServers[item.name] = {
-                command: item.command,
-                args: item.args || [],
-                env: item.env || {},
-            };
-        }
-        else {
-            mcpServers[item.name] = {
-                url: item.url,
-                ...(item.headers && { headers: item.headers }),
-            };
-        }
-    }
-    config.mcpServers = mcpServers;
-    fs.mkdirSync(path.dirname(configPath), { recursive: true });
-    fs.writeFileSync(configPath, JSON.stringify(config, null, 2), 'utf-8');
-}
-/**
- * Write MCP servers to Codex config.toml format.
- */
-function syncToCodexConfig(configPath, items) {
-    let config = {};
-    if (fs.existsSync(configPath)) {
-        try {
-            config = TOML.parse(fs.readFileSync(configPath, 'utf-8'));
-        }
-        catch {
-            config = {};
-        }
-    }
-    const mcpServers = {};
-    for (const item of items) {
-        if (item.transport === 'stdio') {
-            mcpServers[item.name] = {
-                command: item.command,
-                args: item.args || [],
-                ...(item.env && { env: item.env }),
-            };
-        }
-        // Codex may not support HTTP MCPs
-    }
-    config.mcp_servers = mcpServers;
-    fs.mkdirSync(path.dirname(configPath), { recursive: true });
-    fs.writeFileSync(configPath, TOML.stringify(config), 'utf-8');
-}
-/**
- * Write MCP servers to Grok config.toml format ([mcp_servers] section).
- */
-function syncToGrokConfig(configPath, items) {
-    let config = {};
-    if (fs.existsSync(configPath)) {
-        try {
-            config = TOML.parse(fs.readFileSync(configPath, 'utf-8'));
-        }
-        catch {
-            config = {};
-        }
-    }
-    const mcpServers = {};
-    for (const item of items) {
-        if (item.transport === 'stdio') {
-            mcpServers[item.name] = {
-                command: item.command,
-                args: item.args || [],
-                ...(item.env && { env: item.env }),
-            };
-        }
-        else if (item.transport === 'http' || item.transport === 'sse') {
-            mcpServers[item.name] = {
-                url: item.url,
-                ...(item.headers && { headers: item.headers }),
-            };
-        }
-    }
-    config.mcp_servers = mcpServers;
-    fs.mkdirSync(path.dirname(configPath), { recursive: true });
-    fs.writeFileSync(configPath, TOML.stringify(config), 'utf-8');
-}
-function syncToHermesConfig(configPath, items) {
-    let config = {};
-    if (fs.existsSync(configPath)) {
-        try {
-            const parsed = yaml.parse(fs.readFileSync(configPath, 'utf-8'));
-            if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
-                config = parsed;
-            }
-        }
-        catch {
-            config = {};
-        }
-    }
-    const mcpServers = {};
-    for (const item of items) {
-        if (item.transport === 'stdio') {
-            mcpServers[item.name] = {
-                command: item.command,
-                args: item.args || [],
-                ...(item.env && { env: item.env }),
-            };
-        }
-        else {
-            mcpServers[item.name] = {
-                url: item.url,
-            };
-        }
-    }
-    config.mcp_servers = mcpServers;
-    fs.mkdirSync(path.dirname(configPath), { recursive: true });
-    fs.writeFileSync(configPath, yaml.stringify(config), 'utf-8');
-}
-/**
- * Write MCP servers to OpenCode opencode.jsonc format.
- */
-function syncToOpenCodeConfig(configPath, items) {
-    let config = {};
-    if (fs.existsSync(configPath)) {
-        try {
-            const content = stripJsonComments(fs.readFileSync(configPath, 'utf-8'));
-            config = JSON.parse(content);
-        }
-        catch {
-            config = {};
-        }
-    }
-    const mcp = {};
-    for (const item of items) {
-        if (item.transport === 'stdio') {
-            // OpenCode uses command as array
-            const commandArray = [item.command, ...(item.args || [])];
-            mcp[item.name] = {
-                type: 'local',
-                command: commandArray,
-                ...(item.env && { env: item.env }),
-            };
-        }
-        else {
-            mcp[item.name] = {
-                type: 'remote',
-                url: item.url,
-            };
-        }
-    }
-    config.mcp = mcp;
-    fs.mkdirSync(path.dirname(configPath), { recursive: true });
-    fs.writeFileSync(configPath, JSON.stringify(config, null, 2), 'utf-8');
-}
-/**
- * Write MCP servers to Cursor mcp.json format.
- */
-function syncToCursorConfig(configPath, items) {
-    let config = {};
-    if (fs.existsSync(configPath)) {
-        try {
-            config = JSON.parse(fs.readFileSync(configPath, 'utf-8'));
-        }
-        catch {
-            config = {};
-        }
-    }
-    const mcpServers = {};
-    for (const item of items) {
-        if (item.transport === 'stdio') {
-            mcpServers[item.name] = {
-                command: item.command,
-                args: item.args || [],
-                env: item.env || {},
-            };
-        }
-        else {
-            mcpServers[item.name] = {
-                url: item.url,
-            };
-        }
-    }
-    config.mcpServers = mcpServers;
-    fs.mkdirSync(path.dirname(configPath), { recursive: true });
-    fs.writeFileSync(configPath, JSON.stringify(config, null, 2), 'utf-8');
-}
-/**
- * Write MCP servers to Gemini settings.json format.
- */
-function syncToGeminiConfig(configPath, items) {
-    let config = {};
-    if (fs.existsSync(configPath)) {
-        try {
-            config = JSON.parse(fs.readFileSync(configPath, 'utf-8'));
-        }
-        catch {
-            config = {};
-        }
-    }
-    const mcpServers = {};
-    for (const item of items) {
-        if (item.transport === 'stdio') {
-            mcpServers[item.name] = {
-                command: item.command,
-                args: item.args || [],
-                env: item.env || {},
-            };
-        }
-        else {
-            mcpServers[item.name] = {
-                url: item.url,
-            };
-        }
-    }
-    config.mcpServers = mcpServers;
-    fs.mkdirSync(path.dirname(configPath), { recursive: true });
-    fs.writeFileSync(configPath, JSON.stringify(config, null, 2), 'utf-8');
-}
-/**
- * Write MCP servers to OpenClaw openclaw.json format.
- */
-function syncToOpenClawConfig(configPath, items) {
-    let config = {};
-    if (fs.existsSync(configPath)) {
-        try {
-            config = JSON.parse(fs.readFileSync(configPath, 'utf-8'));
-        }
-        catch {
-            config = {};
-        }
-    }
-    if (!config.mcp || typeof config.mcp !== 'object') {
-        config.mcp = {};
-    }
-    const servers = {};
-    for (const item of items) {
-        if (item.transport === 'stdio') {
-            servers[item.name] = {
-                command: item.command,
-                args: item.args,
-                env: item.env,
-            };
-        }
-        else {
-            servers[item.name] = {
-                url: item.url,
-                transport: item.transport,
-            };
-        }
-    }
-    config.mcp.servers = servers;
-    fs.mkdirSync(path.dirname(configPath), { recursive: true });
-    fs.writeFileSync(configPath, JSON.stringify(config, null, 2), 'utf-8');
+function syncToAgentConfig(agent, configPath, items, mode = 'overwrite') {
+    writeMcpConfig(agent, configPath, items, mode);
 }
 /**
  * MCP resource handler implementing ResourceHandler<McpItem>.
@@ -511,39 +206,22 @@ export const McpHandler = {
         if (items.length === 0) {
             return;
         }
+        // Sync resolved MCPs to the version home (user-level agent config).
         const configPath = getMcpConfigPath(agent, versionHome);
-        if (!configPath) {
-            return;
-        }
-        const mcpItems = items.map((r) => r.item);
-        switch (agent) {
-            case 'claude':
-                syncToClaudeConfig(configPath, mcpItems);
-                break;
-            case 'codex':
-                syncToCodexConfig(configPath, mcpItems);
-                break;
-            case 'opencode':
-                syncToOpenCodeConfig(configPath, mcpItems);
-                break;
-            case 'cursor':
-                syncToCursorConfig(configPath, mcpItems);
-                break;
-            case 'gemini':
-                syncToGeminiConfig(configPath, mcpItems);
-                break;
-            case 'openclaw':
-                syncToOpenClawConfig(configPath, mcpItems);
-                break;
-            case 'grok':
-                syncToGrokConfig(configPath, mcpItems);
-                break;
-            case 'hermes':
-                syncToHermesConfig(configPath, mcpItems);
-                break;
-            case 'forge':
-                syncToCursorConfig(configPath, mcpItems);
-                break;
+        if (configPath) {
+            const mcpItems = items.map((r) => r.item);
+            syncToAgentConfig(agent, configPath, mcpItems, 'overwrite');
+        }
+        // Sync project-layer MCPs to the agent's project-level config path so each
+        // agent CLI can discover them alongside its user-level config. Merge so we
+        // do not clobber entries added manually or by the agent's own CLI.
+        const projectAgentsDir = cwd ? getProjectAgentsDir(cwd) : null;
+        if (projectAgentsDir) {
+            const projectItems = items.filter((r) => r.layer === 'project').map((r) => r.item);
+            if (projectItems.length > 0) {
+                const projectConfigPath = getProjectMcpConfigPath(agent, path.dirname(projectAgentsDir));
+                syncToAgentConfig(agent, projectConfigPath, projectItems, 'merge');
+            }
         }
     },
     format(agent) {

package/dist/lib/routines.d.ts

@@ -134,12 +134,25 @@ export interface RunMeta {
     startedAt: string;
     completedAt: string | null;
     exitCode: number | null;
+    /** Machine-readable failure reason when the run did not complete successfully. */
+    errorMessage?: string;
+    /** Wall-clock duration of the run in milliseconds (set when the run finishes). */
+    duration?: number;
     /** Set for `host:`-placed runs — where the job body executes (no local pid). */
     host?: string;
     /** The host-task sidecar id backing a `host:` run; the daemon monitor
      *  finalizes the run by reconciling it against the remote `.exit`. */
     hostTaskId?: string;
 }
+/**
+ * Finalize a run record with a terminal status, computing `duration` from
+ * `startedAt` and the completion timestamp. Keeps failure-reason population
+ * centralized so every completion path writes the same machine-readable fields.
+ */
+export declare function finalizeRunMeta(meta: RunMeta, status: RunMeta['status'], exitCode: number | null, opts?: {
+    errorMessage?: string;
+    completedAt?: string;
+}): void;
 /**
  * True when the job may execute on this machine: no `devices` allowlist (or
  * empty), or the allowlist includes this device. Both sides go through

package/dist/lib/routines.js

@@ -50,6 +50,27 @@ export function normalizeTriggerEvent(input) {
     };
     return aliases[key] ?? null;
 }
+/**
+ * Finalize a run record with a terminal status, computing `duration` from
+ * `startedAt` and the completion timestamp. Keeps failure-reason population
+ * centralized so every completion path writes the same machine-readable fields.
+ */
+export function finalizeRunMeta(meta, status, exitCode, opts) {
+    meta.status = status;
+    meta.exitCode = exitCode;
+    meta.completedAt = opts?.completedAt ?? new Date().toISOString();
+    const started = Date.parse(meta.startedAt);
+    const completed = Date.parse(meta.completedAt);
+    meta.duration = Number.isFinite(started) && Number.isFinite(completed) && completed >= started
+        ? completed - started
+        : 0;
+    if (opts?.errorMessage) {
+        meta.errorMessage = opts.errorMessage;
+    }
+    else {
+        delete meta.errorMessage;
+    }
+}
 /**
  * True when the job may execute on this machine: no `devices` allowlist (or
  * empty), or the allowlist includes this device. Both sides go through

package/dist/lib/runner.js

@@ -17,12 +17,12 @@ import { spawn, execFileSync } from 'child_process';
 import * as fs from 'fs';
 import * as path from 'path';
 import * as os from 'os';
-import { resolveJobPrompt, parseTimeout, writeRunMeta, getRunDir, checkJobDeviceEligibility, } from './routines.js';
+import { resolveJobPrompt, parseTimeout, writeRunMeta, getRunDir, checkJobDeviceEligibility, finalizeRunMeta, } from './routines.js';
 import { getRunsDir } from './state.js';
 import { prepareJobHome, buildSpawnEnv } from './sandbox.js';
 import { resolveModel, buildReasoningFlags } from './models.js';
 import { createTimer, maybeRotate, redactPrompt } from './events.js';
-import { normalizeMode, buildExecEnv, detectRateLimit, } from './exec.js';
+import { normalizeMode, resolveHeadlessMode, buildExecEnv, detectRateLimit, } from './exec.js';
 import { loadTask as loadHostTask } from './hosts/tasks.js';
 import { reconcileTask as reconcileHostTask } from './hosts/reconcile.js';
 import { backgroundSpawnOptions } from './platform/process.js';
@@ -129,12 +129,11 @@ export function buildJobCommand(config, resolvedPrompt) {
         // kimi daemon jobs always run headless via `--prompt`, which cannot be
         // combined with any startup-mode flag (--plan/--auto/--yolo all abort with
         // "Cannot combine --prompt with --X"). edit/auto/skip reduce to kimi's default
-        // headless auto-run, so emit no flag; plan has no headless read-only
-        // equivalent, so fail closed rather than silently allowing writes.
-        if (mode === 'plan') {
-            throw new Error('kimi has no headless read-only mode: routine jobs cannot run kimi with --mode plan ' +
-                '(kimi rejects --prompt + --plan). Use --mode edit, auto, or skip.');
-        }
+        // headless auto-run, so emit no flag. plan has no headless read-only
+        // equivalent, so resolveHeadlessMode downgrades a plan request to auto with a
+        // stderr warning (kimi's headlessPlan is false) — routines run headless, so
+        // interactive is always false here. The returned mode carries no flag either.
+        resolveHeadlessMode('kimi', mode, false);
         appendModelAndReasoning(cmd, config);
     }
     if (config.agent === 'droid') {
@@ -530,9 +529,8 @@ export async function executeJob(config, deps) {
             agent: effectiveAgent,
             version: primaryVersion,
         }, deps);
-        meta.status = loopResult.stoppedBy === 'error' ? 'failed' : 'completed';
-        meta.completedAt = new Date().toISOString();
-        meta.exitCode = loopResult.stoppedBy === 'error' ? 1 : 0;
+        const loopFailed = loopResult.stoppedBy === 'error';
+        finalizeRunMeta(meta, loopFailed ? 'failed' : 'completed', loopFailed ? 1 : 0, loopFailed ? { errorMessage: `loop stopped: ${loopResult.stoppedBy}` } : undefined);
         writeRunMeta(meta);
         timer.end({ status: meta.status, exitCode: meta.exitCode ?? undefined, runId });
         return { meta, reportPath: null };
@@ -575,17 +573,14 @@ export async function executeJob(config, deps) {
         meta.pid = attempt.pid;
         writeRunMeta(meta);
         if (attempt.status === 'timeout') {
-            meta.status = 'timeout';
-            meta.completedAt = new Date().toISOString();
+            finalizeRunMeta(meta, 'timeout', null, { errorMessage: 'run timed out' });
             writeRunMeta(meta);
             timer.end({ status: 'timeout', runId });
             const reportPath = extractAndSaveReport(stdoutPath, effectiveAgent, runDir);
             return { meta, reportPath };
         }
         if (attempt.status === 'completed') {
-            meta.exitCode = 0;
-            meta.status = 'completed';
-            meta.completedAt = new Date().toISOString();
+            finalizeRunMeta(meta, 'completed', 0);
             writeRunMeta(meta);
             timer.end({ status: 'completed', exitCode: 0, runId });
             const reportPath = extractAndSaveReport(stdoutPath, effectiveAgent, runDir);
@@ -604,9 +599,7 @@ export async function executeJob(config, deps) {
         if (attempt.error) {
             process.stderr.write(`[agents] routine ${config.name}: spawn failed for ${label}: ${attempt.error}\n`);
         }
-        meta.exitCode = attempt.exitCode ?? 1;
-        meta.status = 'failed';
-        meta.completedAt = new Date().toISOString();
+        finalizeRunMeta(meta, 'failed', attempt.exitCode ?? 1, attempt.error ? { errorMessage: attempt.error } : undefined);
         writeRunMeta(meta);
         timer.end({
             status: 'failed',
@@ -618,9 +611,7 @@ export async function executeJob(config, deps) {
         return { meta, reportPath };
     }
     // Unreachable: chain is always non-empty, but keep a safe fallback.
-    meta.status = 'failed';
-    meta.exitCode = 1;
-    meta.completedAt = new Date().toISOString();
+    finalizeRunMeta(meta, 'failed', 1);
     writeRunMeta(meta);
     timer.end({ status: 'failed', exitCode: 1, runId });
     return { meta, reportPath: null };
@@ -677,9 +668,7 @@ async function executeJobOnHost(config, opts) {
     // Sync path: a real exit code finalizes now. -1 (follow window closed) and
     // the detached path leave the meta `running` for the monitor to reconcile.
     if (!opts.detached && exitCode !== null && exitCode !== undefined && exitCode !== -1) {
-        meta.status = exitCode === 0 ? 'completed' : 'failed';
-        meta.exitCode = exitCode;
-        meta.completedAt = new Date().toISOString();
+        finalizeRunMeta(meta, exitCode === 0 ? 'completed' : 'failed', exitCode);
     }
     writeRunMeta(meta);
     timer.end({ status: meta.status, exitCode: meta.exitCode ?? undefined, runId });
@@ -756,9 +745,7 @@ async function executeCommandJobForeground(config) {
             finish({ exitCode: 1, status: 'failed', error: err.message });
         });
     });
-    meta.status = result.status;
-    meta.exitCode = result.exitCode ?? (result.status === 'completed' ? 0 : 1);
-    meta.completedAt = new Date().toISOString();
+    finalizeRunMeta(meta, result.status, result.exitCode ?? (result.status === 'completed' ? 0 : 1), result.error ? { errorMessage: result.error } : undefined);
     writeRunMeta(meta);
     if (result.error) {
         process.stderr.write(`[agents] routine ${config.name}: command spawn failed: ${result.error}\n`);
@@ -848,9 +835,7 @@ export async function executeJobDetached(config) {
             fs.closeSync(stdoutFd);
         }
         catch { /* fd already closed */ }
-        meta.status = 'failed';
-        meta.exitCode = 1;
-        meta.completedAt = new Date().toISOString();
+        finalizeRunMeta(meta, 'failed', 1, { errorMessage: err.message });
         writeRunMeta(meta);
         process.stderr.write(`[agents] daemon: spawn failed for job "${config.name}": ${err.message}\n`);
     });
@@ -908,18 +893,16 @@ function executeCommandJobDetached(config) {
     // fire-and-forget call, so the exit event fires here. (monitorRunningJobs no
     // longer force-fails command jobs; it reads exit-code only on the restart edge.)
     let settled = false;
-    const settle = (status, exitCode) => {
+    const settle = (status, exitCode, errorMessage) => {
         if (settled)
             return;
         settled = true;
-        meta.status = status;
-        meta.exitCode = exitCode;
-        meta.completedAt = new Date().toISOString();
+        finalizeRunMeta(meta, status, exitCode, errorMessage ? { errorMessage } : undefined);
         writeRunMeta(meta);
     };
     child.on('exit', (code) => settle(code === 0 ? 'completed' : 'failed', code ?? 1));
     child.on('error', (err) => {
-        settle('failed', 1);
+        settle('failed', 1, err.message);
         process.stderr.write(`[agents] daemon: command spawn failed for job "${config.name}": ${err.message}\n`);
     });
     child.unref();
@@ -1073,9 +1056,7 @@ function finalizeHostRun(meta) {
         const healed = reconcileHostTask(task);
         if (healed.status !== 'completed' && healed.status !== 'failed')
             return;
-        meta.status = healed.status;
-        meta.exitCode = healed.exitCode ?? (healed.status === 'completed' ? 0 : 1);
-        meta.completedAt = healed.finishedAt ?? new Date().toISOString();
+        finalizeRunMeta(meta, healed.status, healed.exitCode ?? (healed.status === 'completed' ? 0 : 1), { completedAt: healed.finishedAt ?? undefined });
         writeRunMeta(meta);
     }
     catch { /* unreachable host or unreadable sidecar — retry next sweep */ }
@@ -1115,8 +1096,7 @@ export function monitorRunningJobs() {
                 const isCommandRun = Boolean(meta.command) || !meta.agent;
                 const wallClockMs = Date.now() - Date.parse(meta.startedAt);
                 if (Number.isFinite(wallClockMs) && wallClockMs > MAX_WALL_CLOCK_MS) {
-                    meta.status = 'timeout';
-                    meta.completedAt = new Date().toISOString();
+                    finalizeRunMeta(meta, 'timeout', null, { errorMessage: 'exceeded max wall clock' });
                     writeRunMeta(meta);
                     if (!isCommandRun)
                         extractAndSaveReport(stdoutPath, meta.agent, runDirPath);
@@ -1130,20 +1110,17 @@ export function monitorRunningJobs() {
                         // missed the exit event — recover the true code from the exit-code file
                         // the child wrote; its absence means the child was killed/crashed.
                         const ec = readCommandExitCode(runDirPath);
-                        meta.status = ec === 0 ? 'completed' : 'failed';
-                        meta.exitCode = ec;
+                        finalizeRunMeta(meta, ec === 0 ? 'completed' : 'failed', ec);
                     }
                     else {
                         const inferred = inferFinalStatusFromLog(stdoutPath, meta.agent);
                         if (inferred) {
-                            meta.status = inferred.status;
-                            meta.exitCode = inferred.exitCode;
+                            finalizeRunMeta(meta, inferred.status, inferred.exitCode);
                         }
                         else {
-                            meta.status = 'failed';
+                            finalizeRunMeta(meta, 'failed', null, { errorMessage: 'process exited before final status could be inferred' });
                         }
                     }
-                    meta.completedAt = new Date().toISOString();
                     writeRunMeta(meta);
                     if (!isCommandRun)
                         extractAndSaveReport(stdoutPath, meta.agent, runDirPath);

package/dist/lib/secrets/agent.js

@@ -33,6 +33,7 @@ import { getHelpersDir, readMeta } from '../state.js';
 import { isAlive } from '../platform/process.js';
 import { getKeychainHelperPath } from './install-helper.js';
 import { getCliVersion, getCliVersionFresh } from '../version.js';
+import { getCliLaunch } from '../cli-entry.js';
 /** Bumped when the wire protocol changes; a client that pings a mismatched
  * server kills and respawns it rather than talking a stale dialect. */
 const PROTOCOL_VERSION = 1;
@@ -148,23 +149,18 @@ function writeAgentToken() {
 }
 /**
  * Argv for re-invoking THIS cli with a hidden subcommand, so a side-by-side dev
- * build spawns its own helpers rather than the registry-installed one. We always
- * go through `process.execPath` (the node binary) with the JS entrypoint as the
- * first arg — the entrypoint isn't reliably executable in dev builds (invoked as
- * `node dist/index.js`, no +x), so spawning it directly EACCES'd.
+ * build spawns its own helpers rather than the registry-installed one. Routed
+ * through the shared getCliLaunch so it handles both install shapes — a JS entry
+ * (`node dist/index.js …`) and a Bun standalone binary (run directly). The old
+ * hand-rolled `[process.execPath, process.argv[1], …]` broke on standalone builds:
+ * process.argv[1] is the bun virtual entry `/$bunfs/root/agents` (fs.existsSync
+ * reports it as present), so it was passed as an argv element and the broker died
+ * with `unknown command '/$bunfs/root/agents'` — the daemon-hosted broker never
+ * bound its socket and every unlock reported "Could not start the secrets broker".
  */
 function cliSpawn(sub) {
-    const argv1 = process.argv[1];
-    const entry = argv1 && fs.existsSync(argv1) ? argv1 : null;
-    if (entry)
-        return { cmd: process.execPath, args: [entry, ...sub] };
-    // No resolvable entrypoint (unusual) — fall back to the PATH shim.
-    let bin = 'agents';
-    try {
-        bin = execFileSync('which', ['agents'], { encoding: 'utf-8' }).trim();
-    }
-    catch { /* default */ }
-    return { cmd: bin, args: sub };
+    const { command, args } = getCliLaunch(sub);
+    return { cmd: command, args };
 }
 function brokerSpawn() {
     return cliSpawn(['secrets', '_agent-run']);