@phnx-labs/agents-cli 1.20.74 → 1.20.76

package/dist/commands/routines.js

@@ -783,18 +783,26 @@ export function registerRoutinesCommands(program) {
         try {
             const result = await executeJob(job);
             const logPath = `${getRunDir(name, result.meta.runId)}/stdout.log`;
+            const succeeded = result.meta.status === 'completed';
             if (options.json) {
                 writeJson({
-                    ok: true,
+                    ok: succeeded,
                     job: name,
                     logDir: getRunDir(name, result.meta.runId),
                     ...runMetaJson(result.meta),
                     logPath,
                     reportPath: result.reportPath ?? null,
                 });
+                // A failed run must exit non-zero so cron wrappers, `&&` chains, and
+                // `--json` consumers actually see the failure (a logged-out agent used
+                // to exit 0 with ok:true, hiding the whole auth-failure epidemic). Set
+                // exitCode rather than process.exit() so the JSON payload is fully
+                // flushed to a pipe before the process ends.
+                if (!succeeded)
+                    process.exitCode = 1;
                 return;
             }
-            if (result.meta.status === 'completed') {
+            if (succeeded) {
                 spinner.succeed(`Job completed (exit code: ${result.meta.exitCode})`);
             }
             else if (result.meta.status === 'timeout') {
@@ -805,10 +813,15 @@ export function registerRoutinesCommands(program) {
             }
             console.log(chalk.gray(`  Run: ${result.meta.runId}`));
             console.log(chalk.gray(`  Log: ${logPath}`));
+            if (result.meta.errorMessage) {
+                console.log(chalk.gray(`  Reason: ${result.meta.errorMessage}`));
+            }
             if (result.reportPath) {
                 console.log(chalk.bold('\nReport:\n'));
                 console.log(fs.readFileSync(result.reportPath, 'utf-8'));
             }
+            if (!succeeded)
+                process.exitCode = 1;
         }
         catch (err) {
             if (options.json) {

package/dist/commands/secrets.js

@@ -15,10 +15,10 @@ import * as path from 'path';
 import { SSH_TARGET_RE, assertValidSshTarget, sshExec } from '../lib/ssh-exec.js';
 import { quoteWin32ExecArg, composeWin32CommandLine } from '../lib/platform/index.js';
 import { ensureDaemonStarted, isDaemonRunning } from '../lib/daemon.js';
-import { parseHostsOption, remoteResolveEnv, remoteSecretsRaw, remoteSecretsStream, resolveSshTarget, } from '../lib/secrets/remote.js';
+import { parseHostsOption, remoteResolveEnv, remoteSecretsRaw, remoteSecretsStream, resolveHostSshTarget, } from '../lib/secrets/remote.js';
 import { remoteShellFor, buildWindowsStdinImportCommand } from '../lib/hosts/remote-cmd.js';
 import { resolveRemoteOsSync } from '../lib/hosts/remote-os.js';
-import { bundleExists, bundleItemStore, bundlePolicy, deleteBundle, describeBundle, keychainItemsForBundle, keychainRef, listBundles, migrateLegacyBundles, parseDotenv, readAndResolveBundleEnv, isHeadlessSecretsContext, readBundle, renameBundle, rotateBundleSecret, sanitizeProcessEnv, validateBundleName, validateEnvKey, validateExpiresFutureDated, validateSecretType, writeBundle, writeBundleWithItems, } from '../lib/secrets/bundles.js';
+import { bundleExists, bundleItemStore, bundlePolicy, deleteBundle, describeBundle, keychainItemsForBundle, keychainRef, listBundles, migrateLegacyBundles, parseDotenv, readAndResolveBundleEnv, isHeadlessSecretsContext, readBundle, readBundleIfDecryptable, renameBundle, rotateBundleSecret, sanitizeProcessEnv, validateBundleName, validateEnvKey, validateExpiresFutureDated, validateSecretType, writeBundle, writeBundleWithItems, } from '../lib/secrets/bundles.js';
 import { encryptForFallback, decryptForFallback } from '../lib/secrets/filestore.js';
 import { getKeychainToken, getKeychainTokens, hasKeychainToken, secretsKeychainItem, setKeychainToken, } from '../lib/secrets/index.js';
 import { assertOpAvailable, createPasswordItem, deleteItemByTitle, extractSecrets, itemExistsByTitle, listItems, listVaults, } from '../lib/onepassword.js';
@@ -225,17 +225,29 @@ async function importFromICloud(bundleName, opts) {
     }
 }
 /**
- * Printed under a "bundle not found" failure: if the name matches a bundle
- * stranded in the iCloud Keychain (pre-device-local-cutover era), point at the
- * recovery command instead of leaving a dead end.
+ * Printed under a read failure: if the name matches a bundle stranded in the
+ * iCloud Keychain (pre-device-local-cutover era), point at the recovery command
+ * instead of leaving a dead end.
+ *
+ * `stillPresent` distinguishes the two failures, because they need different
+ * commands. A MISSING bundle imports straight from iCloud. A bundle that is on
+ * disk but undecryptable does not: `import` reads the existing bundle before
+ * writing into it, so it fails the same way the read just did. That one has to
+ * be deleted first — which is why naming the wrong command here bricked the
+ * name entirely.
  */
-function maybePrintSyncedHint(name) {
+function maybePrintSyncedHint(name, stillPresent) {
     if (process.platform !== 'darwin')
         return;
     try {
-        if (discoverSyncedBundles().some((c) => c.name === name)) {
-            console.error(chalk.yellow(`A legacy iCloud Keychain copy of '${name}' exists. Recover it with: agents secrets import ${name} --from icloud`));
-        }
+        if (!discoverSyncedBundles().some((c) => c.name === name))
+            return;
+        console.error(chalk.yellow(stillPresent
+            ? `A legacy iCloud Keychain copy of '${name}' exists, but the local copy is unreadable and ` +
+                `import writes into it. Delete the local copy first, then recover:\n` +
+                `  agents secrets delete ${name}\n` +
+                `  agents secrets import ${name} --from icloud`
+            : `A legacy iCloud Keychain copy of '${name}' exists. Recover it with: agents secrets import ${name} --from icloud`));
     }
     catch {
         // Hint only — never mask the original error.
@@ -383,12 +395,12 @@ async function browseRemote(targets, args, tty) {
     };
     if (tty) {
         for (const t of targets) {
-            const target = await resolveSshTarget(t);
+            const target = await resolveHostSshTarget(t);
             render(t, remoteSecretsRaw(target, args, { tty: true, osLookupName: t }));
         }
     }
     else {
-        const resolved = await Promise.all(targets.map(async (t) => ({ name: t, target: await resolveSshTarget(t) })));
+        const resolved = await Promise.all(targets.map(async (t) => ({ name: t, target: await resolveHostSshTarget(t) })));
         const results = resolved.map(({ name, target }) => remoteSecretsRaw(target, args, { osLookupName: name }));
         targets.forEach((t, i) => render(t, results[i]));
     }
@@ -871,7 +883,7 @@ export function registerSecretsCommands(program) {
             }
             catch (err) {
                 console.error(chalk.red(err.message));
-                maybePrintSyncedHint(resolvedName);
+                maybePrintSyncedHint(resolvedName, bundleExists(resolvedName));
                 process.exit(1);
             }
             const entries = describeBundle(bundle);
@@ -1465,16 +1477,27 @@ Examples:
         .action(async (name, opts) => {
         try {
             const resolvedName = name ?? (await pickBundleName('delete'));
-            const bundle = readBundle(resolvedName);
+            // An undecryptable bundle (lost/rotated passphrase) must still be
+            // deletable: deletion is the ONLY way out of that state, and every other
+            // verb — view, add, import — refuses to touch the name until it's gone.
+            // Its key refs are unreadable, so its keychain items cannot be
+            // enumerated for purging; say so rather than claiming a clean purge.
+            const bundle = readBundleIfDecryptable(resolvedName);
             if (!opts.yes) {
                 if (!isInteractiveTerminal()) {
                     console.error(chalk.red(`Refusing to delete '${resolvedName}' without --yes in a non-interactive shell.`));
                     process.exit(1);
                 }
-                const keychainCount = describeBundle(bundle).filter((e) => e.kind === 'keychain').length;
-                const suffix = keychainCount && !opts.keepSecrets
-                    ? ` and purge ${keychainCount} keychain item${keychainCount === 1 ? '' : 's'}`
-                    : '';
+                let suffix;
+                if (!bundle) {
+                    suffix = ' (unreadable — its keychain items cannot be enumerated and will be left in place)';
+                }
+                else {
+                    const keychainCount = describeBundle(bundle).filter((e) => e.kind === 'keychain').length;
+                    suffix = keychainCount && !opts.keepSecrets
+                        ? ` and purge ${keychainCount} keychain item${keychainCount === 1 ? '' : 's'}`
+                        : '';
+                }
                 const { confirm } = await import('@inquirer/prompts');
                 const proceed = await confirm({
                     message: `Delete bundle '${resolvedName}'${suffix}?`,
@@ -1485,7 +1508,7 @@ Examples:
                     return;
                 }
             }
-            if (!opts.keepSecrets) {
+            if (bundle && !opts.keepSecrets) {
                 const store = bundleItemStore(bundle.backend);
                 for (const { item } of keychainItemsForBundle(bundle)) {
                     store.delete(item);
@@ -1583,7 +1606,7 @@ Examples:
                 }
                 assertValidSshTarget(opts.host);
                 const resolvedBundleName = bundleName ?? (await pickBundleName('import into'));
-                const target = await resolveSshTarget(opts.host);
+                const target = await resolveHostSshTarget(opts.host);
                 const env = await remoteResolveEnv(target, resolvedBundleName, { osLookupName: opts.host });
                 const bundle = resolveImportBundle(resolvedBundleName, opts.backend, opts.synced);
                 const { added, skipped } = applyEnvToBundle(bundle, env, opts);
@@ -1848,7 +1871,7 @@ Examples:
                 // locally instead.
                 const { assertRemoteBundleFlagsUnsupported } = await import('../lib/secrets/bundles.js');
                 assertRemoteBundleFlagsUnsupported(bundleName, execOpts.host, { keys: keysSubset, allowExpired: execOpts.allowExpired }, { keysFlag: '--keys', allowExpiredFlag: '--allow-expired' });
-                secretEnv = await remoteResolveEnv(await resolveSshTarget(execOpts.host), bundleName, { osLookupName: execOpts.host });
+                secretEnv = await remoteResolveEnv(await resolveHostSshTarget(execOpts.host), bundleName, { osLookupName: execOpts.host });
             }
             else {
                 const { readAndResolveBundleEnv } = await import('../lib/secrets/bundles.js');
@@ -2052,7 +2075,7 @@ Examples:
             const unlockArgs = buildRemoteUnlockArgs(names, opts);
             let failures = 0;
             for (const h of hosts) {
-                const target = await resolveSshTarget(h);
+                const target = await resolveHostSshTarget(h);
                 // FOREGROUND stream (stdio inherited), NOT the piped remoteSecretsRaw:
                 // the remote's passphrase prompt only surfaces if the remote process
                 // sees a real TTY, which requires our local terminal to pass straight

package/dist/commands/sessions-browser.js

@@ -214,7 +214,7 @@ function helpFor(_f, mode) {
     if (mode === 'search') {
         return 'type to filter · ↑↓ navigate · esc exit search · ⏎ resume';
     }
-    return 's search · r running · c teams · a agent · d device · p project · w window · y copy-cmd · ⏎ resume · esc quit';
+    return 's search · r running · c teams · a agent · d device · p project · w window · tab preview · y copy-cmd · ⏎ resume · esc quit';
 }
 /**
  * Launch the interactive session browser. `initial` seeds the filter (e.g.

package/dist/commands/sessions-export.js

@@ -20,7 +20,8 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import chalk from 'chalk';
-import { discoverSessions, resolveSessionById } from '../lib/session/discover.js';
+import { discoverSessions, resolveSessionById, isCompleteSessionId } from '../lib/session/discover.js';
+import { findSessionsById } from '../lib/session/db.js';
 import { filterSessionsByQuery, parseAgentFilter } from './sessions.js';
 import { listLocalTranscripts, SYNC_AGENTS } from '../lib/session/sync/agents.js';
 import { machineId } from '../lib/machine-id.js';
@@ -228,16 +229,29 @@ function selectSessions(metas, selectors) {
     const byId = [];
     const unmatched = [];
     for (const sel of selectors) {
-        const hits = resolveSessionById(metas, sel);
-        if (hits.length > 0)
-            byId.push(...hits);
+        const trimmed = sel.trim();
+        // Same reason as resolveSessionQuery: the discovered pool is a minority of
+        // the index, so a complete id absent from it may still be indexed here.
+        const hits = resolveSessionById(metas, trimmed);
+        const resolved = hits.length > 0 || !isCompleteSessionId(trimmed) ? hits : findSessionsById(trimmed);
+        if (resolved.length > 0)
+            byId.push(...resolved);
         else
-            unmatched.push(sel);
+            unmatched.push(trimmed);
     }
     if (byId.length > 0 && unmatched.length === 0) {
         const seen = new Set();
         return byId.filter(s => (seen.has(s.id) ? false : (seen.add(s.id), true)));
     }
+    // A selector that is a COMPLETE session id and still missed cannot be widened:
+    // the id is unique, so the text query below could only bundle sessions that
+    // merely mention it. Bundling those would ship unrelated transcripts to
+    // whoever receives the export, so select nothing and let the caller report it.
+    const missingIds = unmatched.filter(isCompleteSessionId);
+    if (missingIds.length > 0) {
+        process.stderr.write(chalk.red(`No session with id ${missingIds.join(', ')} on this machine.\n`));
+        return [];
+    }
     // Any selector that isn't an id → treat the whole thing as a text query.
     return filterSessionsByQuery(metas, selectors.join(' '));
 }

package/dist/commands/sessions-migrate.d.ts

@@ -0,0 +1,29 @@
+import type { Command } from 'commander';
+import type { SessionMeta } from '../lib/session/types.js';
+/** Agents whose sessions cannot be faithfully --resume'd (buildResumeCommand → null). */
+type MigrateMode = 'resume' | 'rehydrate';
+export declare function registerSessionsMigrateCommand(sessionsCmd: Command): void;
+/**
+ * Harness-parity gate (pure, testable). `buildResumeCommand` returns null for the
+ * non-resumable agents (gemini, antigravity, openclaw, rush, hermes, grok, kimi,
+ * droid) — for those a faithful --resume is impossible, so a requested `resume`
+ * transparently becomes `rehydrate`. A resumable agent honors the request.
+ * Returns the effective mode plus whether it was downgraded, so the caller can
+ * print the notice.
+ */
+export declare function effectiveMode(source: SessionMeta, requested: MigrateMode): {
+    mode: MigrateMode;
+    downgraded: boolean;
+};
+/**
+ * Rehydrate command: launch a fresh agent that reads the transcript. For a
+ * non-resumable agent there is no faithful --resume, so we start the agent with
+ * a prompt pointing it at the imported transcript path.
+ */
+export declare function rehydrateCommand(source: SessionMeta): string[];
+/**
+ * `agents sessions migrations` — the border tracker: the append-only ledger of
+ * every session handed off to/from another machine (RUSH-1977).
+ */
+export declare function registerSessionsMigrationsCommand(sessionsCmd: Command): void;
+export {};