@phnx-labs/agents-cli 1.20.78 → 1.20.82

package/dist/lib/menubar/notify-desktop.d.ts

@@ -16,6 +16,7 @@
  * 'error' listener — without it Node re-throws ENOENT as an uncaught exception and
  * takes the whole daemon down (the exact crash overdue.test.ts guards).
  */
+import { type ChildProcess } from 'child_process';
 export interface DesktopNotification {
     /** Bold first line. */
     title: string;
@@ -36,6 +37,20 @@ export interface DesktopNotification {
 export declare function buildMenubarNotifyArgs(n: DesktopNotification): string[];
 /** AppleScript for the osascript degradation path. Exported for tests. */
 export declare function buildOsascriptNotifyArgs(n: DesktopNotification): string[];
+/**
+ * Spawn one detached, best-effort notifier process with a bounded lifetime.
+ *
+ * The child is detached + unref'd so it never blocks the daemon, but — unlike a
+ * pure fire-and-forget — it is supervised: a watchdog SIGKILLs it after
+ * `timeoutMs` so a stalled notifier can never linger (the pile-up this fixes).
+ * The common path (a sub-second post + self-exit) clears the watchdog on the
+ * child's own 'exit', so the kill only ever fires for a genuinely hung child.
+ *
+ * `timeoutMs` is injectable so the bounded-lifetime behaviour is testable against
+ * a real long-running child without a multi-second wait. Returns the child so a
+ * caller/test can observe it; callers in this module ignore it.
+ */
+export declare function spawnDetachedQuiet(command: string, args: string[], timeoutMs?: number): ChildProcess;
 /**
  * Fire a native desktop notification, branded via the MenubarHelper companion on
  * macOS. Best-effort — any failure is swallowed so a notification hiccup never

package/dist/lib/menubar/notify-desktop.js

@@ -19,6 +19,15 @@
 import { spawn } from 'child_process';
 import * as os from 'os';
 import { resolveInstalledMenubarExecutable } from './install-menubar.js';
+/**
+ * Hard ceiling on a one-shot notifier's lifetime. A notifier posts and exits in
+ * well under a second on the happy path; if delivery stalls (locked screen, a
+ * WindowServer/XPC hiccup) a detached GUI helper can hang indefinitely and pile
+ * up in the menu bar. This is above the Swift one-shot's own 0.6s flush + its 3s
+ * self-terminate watchdog, so Node's kill is the last-resort guarantee that runs
+ * only if the child never self-exits.
+ */
+const NOTIFY_TIMEOUT_MS = 4000;
 /** Argv for the MenubarHelper one-shot notify mode. Exported for tests. */
 export function buildMenubarNotifyArgs(n) {
     const args = ['--notify', '--title', n.title, '--body', n.body];
@@ -36,14 +45,41 @@ export function buildOsascriptNotifyArgs(n) {
         script += ` subtitle "${esc(n.subtitle)}"`;
     return ['-e', script];
 }
-/** Spawn one detached, best-effort notifier process; swallow async ENOENT. */
-function spawnDetachedQuiet(command, args) {
+/**
+ * Spawn one detached, best-effort notifier process with a bounded lifetime.
+ *
+ * The child is detached + unref'd so it never blocks the daemon, but — unlike a
+ * pure fire-and-forget — it is supervised: a watchdog SIGKILLs it after
+ * `timeoutMs` so a stalled notifier can never linger (the pile-up this fixes).
+ * The common path (a sub-second post + self-exit) clears the watchdog on the
+ * child's own 'exit', so the kill only ever fires for a genuinely hung child.
+ *
+ * `timeoutMs` is injectable so the bounded-lifetime behaviour is testable against
+ * a real long-running child without a multi-second wait. Returns the child so a
+ * caller/test can observe it; callers in this module ignore it.
+ */
+export function spawnDetachedQuiet(command, args, timeoutMs = NOTIFY_TIMEOUT_MS) {
     const child = spawn(command, args, { detached: true, stdio: 'ignore' });
+    // Bound the lifetime: a stalled notifier is hard-killed after the timeout. The
+    // timer is unref'd so it never keeps a short-lived caller's event loop alive.
+    const watchdog = setTimeout(() => {
+        try {
+            child.kill('SIGKILL');
+        }
+        catch {
+            /* already gone */
+        }
+    }, timeoutMs);
+    watchdog.unref();
     // A missing binary (headless box with no osascript/notify-send, or a helper
-    // that vanished) arrives as an async 'error' event. Without this listener Node
-    // re-throws it as an uncaught exception and crashes the daemon — swallow it.
-    child.on('error', () => { });
+    // that vanished) arrives as an async 'error' event — the process never started,
+    // so cancel the watchdog. Without a listener Node re-throws ENOENT as an
+    // uncaught exception and crashes the daemon; having one swallows it.
+    child.on('error', () => clearTimeout(watchdog));
+    // Fast, self-driven exit (the common path) — cancel the watchdog.
+    child.on('exit', () => clearTimeout(watchdog));
     child.unref();
+    return child;
 }
 /**
  * Fire a native desktop notification, branded via the MenubarHelper companion on

package/dist/lib/merged-resources.d.ts

@@ -0,0 +1,11 @@
+/**
+ * The merged, first-wins DotAgents resource surface — every resource kind, one
+ * table, showing the winning layer per row.
+ *
+ * Ported verbatim from the former `agents resources` command, now surfaced as
+ * `agents view --merged`. `agents view agent@version` shows per-version
+ * resources; this shows the cross-layer merge across project → user → extras →
+ * system. Kept as a shared lib (not inlined into `view.ts`) so `inspect` can
+ * reuse it later.
+ */
+export declare function renderMergedResources(): void;

package/dist/{commands/resources.js → lib/merged-resources.js}

@@ -1,10 +1,17 @@
 /**
- * `agents resources` — show the merged DotAgents resource surface.
+ * The merged, first-wins DotAgents resource surface — every resource kind, one
+ * table, showing the winning layer per row.
+ *
+ * Ported verbatim from the former `agents resources` command, now surfaced as
+ * `agents view --merged`. `agents view agent@version` shows per-version
+ * resources; this shows the cross-layer merge across project → user → extras →
+ * system. Kept as a shared lib (not inlined into `view.ts`) so `inspect` can
+ * reuse it later.
  */
 import * as path from 'path';
 import chalk from 'chalk';
-import { listResources } from '../lib/resources.js';
-import { terminalWidth, truncateToWidth, stringWidth } from '../lib/session/width.js';
+import { listResources } from './resources.js';
+import { terminalWidth, truncateToWidth, stringWidth } from './session/width.js';
 const DRILLABLE_KINDS = [
     'skills',
     'commands',
@@ -25,22 +32,7 @@ const KIND_LABELS = {
     workflows: 'Workflows',
     subagents: 'Subagents',
 };
-export function registerResourcesCommand(program) {
-    program
-        .command('resources')
-        .description('Show the merged DotAgents resources resolved across project, user, system, and extras')
-        .option('--merged', 'Show the merged first-wins resource surface (default)')
-        .addHelpText('after', `
-Examples:
-  agents resources
-  agents resources --merged
-`)
-        .action((options) => {
-        void options;
-        renderMergedResources();
-    });
-}
-function renderMergedResources() {
+export function renderMergedResources() {
     const groups = DRILLABLE_KINDS.map((kind) => ({
         kind,
         rows: listResources(kind),

package/dist/lib/permissions.d.ts

@@ -120,19 +120,6 @@ export interface CopilotPermissionsConfig {
         allowed_directories?: string[];
     }>;
 }
-/**
- * Convert canonical permission set to Gemini format.
- * Gemini reads tool allow/deny lists from settings.json under
- * `tools.core` / `tools.exclude`. Bash permissions map to ShellTool(pattern).
- * Blanket Bash grants map to bare "ShellTool" (no command filter).
- * Non-Bash tool patterns are skipped; Gemini uses different tool names.
- */
-export declare function convertToGeminiFormat(set: PermissionSet): {
-    tools: {
-        core: string[];
-        exclude?: string[];
-    };
-};
 export declare function convertToCopilotFormat(set: PermissionSet, location: string): CopilotPermissionsConfig;
 /** Convert canonical Bash rules into Droid's command arrays. */
 export declare function convertToDroidFormat(set: PermissionSet): {
@@ -154,25 +141,6 @@ export declare function convertToOpenClawFormat(set: PermissionSet): {
     alsoAllow: string[];
     deny: string[];
 };
-export type ForgePermission = 'allow' | 'deny' | 'confirm';
-export type ForgeOperation = 'read' | 'write' | 'command' | 'url';
-export type ForgePolicy = {
-    permission: ForgePermission;
-    rule: Partial<Record<ForgeOperation, string>>;
-};
-/**
- * Convert canonical permissions to ForgeCode's permissions.yaml policy list.
- *
- * ForgeCode gates built-in tools by operation family (`read`, `write`,
- * `command`, `url`) plus glob patterns, optionally scoped by `dir`. The policy
- * file is ignored unless `.forge.toml` has `restricted = true`, and MCP tools
- * bypass permissions.yaml entirely; agents-cli therefore maps only canonical
- * built-in allow/deny rules and does not try to express per-named-MCP-tool
- * grants.
- */
-export declare function convertToForgeFormat(set: PermissionSet): {
-    policies: ForgePolicy[];
-};
 export declare function convertToHermesFormat(set: PermissionSet): {
     command_allowlist: string[];
     approvals: {

package/dist/lib/permissions.js

@@ -15,6 +15,7 @@ import * as TOML from 'smol-toml';
 import { getPermissionsDir, getUserPermissionsDir, ensureAgentsDir } from './state.js';
 import { safeJoin } from './paths.js';
 import { agentConfigDirName } from './agents.js';
+import { supports } from './capabilities.js';
 import { updateGeminiSettings } from './gemini-settings.js';
 const HOME = os.homedir();
 // PERMISSIONS_CAPABLE_AGENTS removed — use `capableAgents('allowlist')`
@@ -504,43 +505,6 @@ function parseCanonicalPattern(permission) {
 }
 /** Blanket-Bash canonical forms that mean "allow any bash command". */
 const BLANKET_BASH_FORMS = new Set(['Bash', 'Bash(*)', 'Bash(**)']);
-/**
- * Convert canonical permission set to Gemini format.
- * Gemini reads tool allow/deny lists from settings.json under
- * `tools.core` / `tools.exclude`. Bash permissions map to ShellTool(pattern).
- * Blanket Bash grants map to bare "ShellTool" (no command filter).
- * Non-Bash tool patterns are skipped; Gemini uses different tool names.
- */
-export function convertToGeminiFormat(set) {
-    const serialize = (permissions) => {
-        const tools = new Set();
-        for (const perm of permissions) {
-            if (BLANKET_BASH_FORMS.has(perm)) {
-                tools.add('ShellTool');
-                continue;
-            }
-            const parsed = parseCanonicalPattern(perm);
-            if (!parsed || parsed.tool !== 'bash')
-                continue;
-            const command = normalizeBashPattern(parsed.pattern);
-            if (command === '*') {
-                tools.add('ShellTool');
-            }
-            else {
-                tools.add(`ShellTool(${command})`);
-            }
-        }
-        return Array.from(tools);
-    };
-    const core = serialize(set.allow);
-    const exclude = serialize(set.deny ?? []);
-    return {
-        tools: {
-            core,
-            ...(exclude.length ? { exclude } : {}),
-        },
-    };
-}
 /**
  * Strip Claude's `:*` subcommand-wildcard suffix and return a space-glob form.
  * "mq:*" -> "mq *", "git status" -> "git status", "*" -> "*".
@@ -710,64 +674,6 @@ export function convertToOpenClawFormat(set) {
         deny: map(set.deny ?? []),
     };
 }
-const FORGE_OPERATION_BY_CANONICAL = {
-    bash: 'command',
-    read: 'read',
-    grep: 'read',
-    glob: 'read',
-    write: 'write',
-    edit: 'write',
-    notebookedit: 'write',
-    webfetch: 'url',
-    websearch: 'url',
-};
-function canonicalToForgePolicy(perm, permission) {
-    if (BLANKET_BASH_FORMS.has(perm)) {
-        return { permission, rule: { command: '*' } };
-    }
-    const parsed = parseCanonicalPattern(perm);
-    if (!parsed)
-        return null;
-    const operation = FORGE_OPERATION_BY_CANONICAL[parsed.tool];
-    if (!operation)
-        return null;
-    const pattern = parsed.tool === 'bash'
-        ? normalizeBashPattern(parsed.pattern)
-        : (parsed.tool === 'webfetch' || parsed.tool === 'websearch') && parsed.pattern.startsWith('domain:')
-            ? `${parsed.pattern.slice('domain:'.length)}*`
-            : parsed.pattern === '**'
-                ? '**/*'
-                : parsed.pattern;
-    return { permission, rule: { [operation]: pattern } };
-}
-/**
- * Convert canonical permissions to ForgeCode's permissions.yaml policy list.
- *
- * ForgeCode gates built-in tools by operation family (`read`, `write`,
- * `command`, `url`) plus glob patterns, optionally scoped by `dir`. The policy
- * file is ignored unless `.forge.toml` has `restricted = true`, and MCP tools
- * bypass permissions.yaml entirely; agents-cli therefore maps only canonical
- * built-in allow/deny rules and does not try to express per-named-MCP-tool
- * grants.
- */
-export function convertToForgeFormat(set) {
-    const policies = [];
-    const seen = new Set();
-    const add = (policy) => {
-        if (!policy)
-            return;
-        const key = `${policy.permission}|${JSON.stringify(policy.rule)}`;
-        if (seen.has(key))
-            return;
-        seen.add(key);
-        policies.push(policy);
-    };
-    for (const perm of set.allow)
-        add(canonicalToForgePolicy(perm, 'allow'));
-    for (const perm of set.deny ?? [])
-        add(canonicalToForgePolicy(perm, 'deny'));
-    return { policies };
-}
 export function convertToHermesFormat(set) {
     const commands = (permissions) => {
         const out = new Set();
@@ -1467,6 +1373,9 @@ function applyPermissionsToAgent(agentId, set, scope = 'user', cwd, merge = true
  * This writes to {versionHome}/.{agent}/settings.json (or equivalent).
  */
 export function applyPermissionsToVersion(agentId, set, versionHome, merge = true, cwd) {
+    if (!supports(agentId, 'allowlist').ok) {
+        return { success: false, error: `Agent '${agentId}' does not support permissions` };
+    }
     const configDir = path.join(versionHome, agentConfigDirName(agentId));
     try {
         fs.mkdirSync(configDir, { recursive: true });
@@ -1557,38 +1466,6 @@ export function applyPermissionsToVersion(agentId, set, versionHome, merge = tru
             }
             return { success: true };
         }
-        if (agentId === 'gemini') {
-            const geminiPerms = convertToGeminiFormat(set);
-            const settingsPath = path.join(versionHome, '.gemini', 'settings.json');
-            updateGeminiSettings(settingsPath, (settings) => {
-                // Remove stale keys written by earlier serializer versions:
-                // top-level `permissions`, and Gemini's pre-core/exclude `tools.allowed`.
-                delete settings.permissions;
-                const tools = (typeof settings.tools === 'object' && settings.tools !== null && !Array.isArray(settings.tools))
-                    ? settings.tools
-                    : {};
-                delete tools.allowed;
-                if (merge) {
-                    const existingCore = Array.isArray(tools.core) ? tools.core : [];
-                    const existingExclude = Array.isArray(tools.exclude) ? tools.exclude : [];
-                    tools.core = Array.from(new Set([...existingCore, ...geminiPerms.tools.core]));
-                    const mergedExclude = Array.from(new Set([...existingExclude, ...(geminiPerms.tools.exclude ?? [])]));
-                    if (mergedExclude.length)
-                        tools.exclude = mergedExclude;
-                    else
-                        delete tools.exclude;
-                }
-                else {
-                    tools.core = geminiPerms.tools.core;
-                    if (geminiPerms.tools.exclude?.length)
-                        tools.exclude = geminiPerms.tools.exclude;
-                    else
-                        delete tools.exclude;
-                }
-                settings.tools = tools;
-            });
-            return { success: true };
-        }
         if (agentId === 'antigravity') {
             const antigravityPerms = convertToAntigravityFormat(set);
             const settingsPath = path.join(versionHome, '.gemini', 'antigravity-cli', 'settings.json');
@@ -1888,36 +1765,6 @@ export function applyPermissionsToVersion(agentId, set, versionHome, merge = tru
             fs.writeFileSync(configPath, JSON.stringify(config, null, 2), 'utf-8');
             return { success: true };
         }
-        if (agentId === 'forge') {
-            const permissionsPath = path.join(versionHome, '.forge', 'permissions.yaml');
-            let config = {};
-            if (fs.existsSync(permissionsPath)) {
-                const parsed = yaml.parse(fs.readFileSync(permissionsPath, 'utf-8'));
-                if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
-                    config = parsed;
-                }
-            }
-            const newPolicies = convertToForgeFormat(set).policies;
-            if (merge) {
-                const existingPolicies = Array.isArray(config.policies) ? config.policies : [];
-                const seen = new Set();
-                config.policies = [...existingPolicies, ...newPolicies].filter((policy) => {
-                    if (!policy || typeof policy !== 'object' || Array.isArray(policy))
-                        return false;
-                    const key = JSON.stringify(policy);
-                    if (seen.has(key))
-                        return false;
-                    seen.add(key);
-                    return true;
-                });
-            }
-            else {
-                config.policies = newPolicies;
-            }
-            fs.mkdirSync(path.dirname(permissionsPath), { recursive: true });
-            fs.writeFileSync(permissionsPath, yaml.stringify(config), 'utf-8');
-            return { success: true };
-        }
         if (agentId === 'hermes') {
             const configPath = path.join(versionHome, '.hermes', 'config.yaml');
             let config = {};

package/dist/lib/picker.js

@@ -214,7 +214,7 @@ export function multiItemPicker(config) {
         const theme = makeTheme({});
         const [status, setStatus] = useState('idle');
         const [searchTerm, setSearchTerm] = useState(cfg.initialSearch ?? '');
-        const [previewOpen, setPreviewOpen] = useState(false);
+        const [previewOpen, setPreviewOpen] = useState(Boolean(cfg.buildPreview));
         const [selectedKeys, setSelectedKeys] = useState(new Set());
         const [active, setActive] = useState(0);
         const prefix = usePrefix({ status, theme });

package/dist/lib/platform/process.d.ts

@@ -41,13 +41,24 @@ export declare function backgroundSpawnOptions(opts?: {
     windowsHide: boolean;
 };
 /**
- * Is a process with this PID currently alive?
+ * Whether `pid` has stopped serving — dead, or a ZOMBIE awaiting reap.
  *
- * Uses the signal-0 probe, which is cross-platform in Node (Windows included —
- * it maps to OpenProcess). Returns false on any error (no such process, or no
- * permission to signal it), matching the long-standing call sites that treat a
- * throw from `process.kill(pid, 0)` as "not running".
+ * `isAlive` is a bare `kill(pid, 0)`, which succeeds for a zombie. That matters
+ * here because {@link waitForExit} blocks the event loop, so a daemon that is
+ * this process's own child can never be reaped while we wait: it would read as
+ * alive for the entire timeout and then be hard-killed after it had already
+ * exited. A zombie holds no socket and serves no request, so for stop purposes
+ * it has exited.
  */
+export declare function hasExited(pid: number): boolean;
+/**
+ * Block until `pid` stops serving or `timeoutMs` elapses. Synchronous on purpose:
+ * the callers are short-lived CLI/postinstall processes that exit before any
+ * async timer would fire, which is exactly how a SIGTERMed daemon used to outlive
+ * the `stopDaemon()` that was supposed to have reaped it. Returns true if it is
+ * gone.
+ */
+export declare function waitForExit(pid: number, timeoutMs: number): boolean;
 export declare function isAlive(pid: number): boolean;
 /**
  * A stable identifier for the process at `pid` as of when it started, or null if

package/dist/lib/platform/process.js

@@ -3,6 +3,7 @@
  */
 import { execFileSync } from 'child_process';
 import { readFileSync } from 'fs';
+import { sleepSync } from '../fs-atomic.js';
 /**
  * Forcefully terminate a process AND its descendant tree.
  *
@@ -70,6 +71,59 @@ export function backgroundSpawnOptions(opts = {}) {
  * permission to signal it), matching the long-standing call sites that treat a
  * throw from `process.kill(pid, 0)` as "not running".
  */
+/** Poll interval while waiting for a pid to disappear. */
+const EXIT_POLL_MS = 50;
+/**
+ * Whether `pid` has stopped serving — dead, or a ZOMBIE awaiting reap.
+ *
+ * `isAlive` is a bare `kill(pid, 0)`, which succeeds for a zombie. That matters
+ * here because {@link waitForExit} blocks the event loop, so a daemon that is
+ * this process's own child can never be reaped while we wait: it would read as
+ * alive for the entire timeout and then be hard-killed after it had already
+ * exited. A zombie holds no socket and serves no request, so for stop purposes
+ * it has exited.
+ */
+export function hasExited(pid) {
+    if (!isAlive(pid))
+        return true;
+    if (process.platform === 'win32')
+        return false; // no zombie state to unwrap
+    try {
+        const state = execFileSync('ps', ['-o', 'state=', '-p', String(pid)], { encoding: 'utf-8' }).trim();
+        return state.startsWith('Z');
+    }
+    catch (err) {
+        // `ps` exiting non-zero because the pid is unknown means gone. Any OTHER
+        // failure (ps missing from PATH, a permission error) is NOT evidence of
+        // death, and isAlive already said this pid is live — so fail CLOSED and keep
+        // treating it as alive. Failing open here would clear the pid file under a
+        // running daemon and recreate this very bug through a different door.
+        if (err?.code === 'ENOENT' && err?.syscall === 'spawnSync ps')
+            return false;
+        const out = String(err?.stdout ?? '').trim();
+        const errOut = String(err?.stderr ?? '').trim();
+        if (err?.status === 1 && out === '' && errOut === '')
+            return true; // no such pid
+        return false;
+    }
+}
+/**
+ * Block until `pid` stops serving or `timeoutMs` elapses. Synchronous on purpose:
+ * the callers are short-lived CLI/postinstall processes that exit before any
+ * async timer would fire, which is exactly how a SIGTERMed daemon used to outlive
+ * the `stopDaemon()` that was supposed to have reaped it. Returns true if it is
+ * gone.
+ */
+export function waitForExit(pid, timeoutMs) {
+    const deadline = Date.now() + timeoutMs;
+    for (;;) {
+        if (hasExited(pid))
+            return true;
+        if (Date.now() >= deadline)
+            return false;
+        sleepSync(EXIT_POLL_MS); // blocks this thread outright; no busy-loop
+    }
+}
 export function isAlive(pid) {
     if (!pid || pid <= 0)
         return false;

package/dist/lib/plugins.d.ts

@@ -191,14 +191,6 @@ export declare function resolveOpenCodePluginSources(pluginRoot: string): string
 export declare function installOpenCodePlugin(plugin: DiscoveredPlugin, versionHome: string): boolean;
 export declare function isOpenCodePluginInstalled(pluginName: string, versionHome: string): boolean;
 export declare function removeOpenCodePlugin(pluginName: string, versionHome: string): boolean;
-/**
- * Gemini CLI extensions live under `$HOME/.gemini/extensions/<name>/` and
- * require a `gemini-extension.json` manifest at the extension root.
- */
-export declare function geminiExtensionsDir(versionHome: string): string;
-export declare function installGeminiPlugin(plugin: DiscoveredPlugin, versionHome: string): boolean;
-export declare function isGeminiPluginInstalled(pluginName: string, versionHome: string): boolean;
-export declare function removeGeminiPlugin(pluginName: string, versionHome: string): boolean;
 /**
  * Goose auto-discovers Open Plugins at `$HOME/.agents/plugins/<name>/`.
  * Under agents-cli version isolation HOME is the version home, so we install to: