@phnx-labs/agents-cli 1.20.85 → 1.20.87

package/dist/lib/claude-account-token.d.ts

@@ -0,0 +1,12 @@
+/** The per-account key an email maps to inside the `auth` bundle. */
+export declare function claudeAccountTokenKey(account: string): string;
+/** Signed-in account email for a version home, from `.claude.json` (no keychain). */
+export declare function readClaudeAccountEmail(home?: string): string | null;
+/**
+ * Resolve a long-lived `claude setup-token` for the account signed into `home`
+ * from the reserved FILE-BASED `auth` bundle. Returns the token or null. Reads
+ * ONLY when the bundle is file-backed (never keychain), so this path itself can
+ * never trigger a Touch ID prompt — that is the entire point: usage/probe reads
+ * authenticate with the shareable setup-token, not the ACL-bound login item.
+ */
+export declare function resolveClaudeSetupToken(home?: string): string | null;

package/dist/lib/claude-account-token.js

@@ -0,0 +1,63 @@
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+import { bundleBackend, bundleExists, readAndResolveBundleEnv } from './secrets/bundles.js';
+/**
+ * Reserved FILE-BASED secrets bundle holding long-lived, non-rotating Claude
+ * setup-tokens. Usage/probe reads authenticate with these instead of Claude
+ * Code's ACL-bound login item, so they never pop Touch ID. Keyed strictly
+ * per-account (`CLAUDE_CODE_OAUTH_TOKEN_<slug>` from the account email) — never a
+ * bare key, so one account's token can't be misapplied to another in a
+ * multi-account fleet.
+ */
+const AUTH_BUNDLE = 'auth';
+/** The per-account key an email maps to inside the `auth` bundle. */
+export function claudeAccountTokenKey(account) {
+    const slug = account
+        .trim()
+        .toUpperCase()
+        .replace(/@/g, '_AT_')
+        .replace(/\./g, '_DOT_')
+        .replace(/[^A-Z0-9_]/g, '_');
+    return `CLAUDE_CODE_OAUTH_TOKEN_${slug}`;
+}
+/** Signed-in account email for a version home, from `.claude.json` (no keychain). */
+export function readClaudeAccountEmail(home) {
+    const base = home ?? os.homedir();
+    for (const p of [path.join(base, '.claude', '.claude.json'), path.join(base, '.claude.json')]) {
+        try {
+            const email = JSON.parse(fs.readFileSync(p, 'utf-8')).oauthAccount?.emailAddress;
+            if (typeof email === 'string' && email.trim().length > 0)
+                return email.trim();
+        }
+        catch {
+            // Missing/unreadable at this location — try the next.
+        }
+    }
+    return null;
+}
+/**
+ * Resolve a long-lived `claude setup-token` for the account signed into `home`
+ * from the reserved FILE-BASED `auth` bundle. Returns the token or null. Reads
+ * ONLY when the bundle is file-backed (never keychain), so this path itself can
+ * never trigger a Touch ID prompt — that is the entire point: usage/probe reads
+ * authenticate with the shareable setup-token, not the ACL-bound login item.
+ */
+export function resolveClaudeSetupToken(home) {
+    try {
+        // Require a known account (email) up front: without it we cannot key a
+        // per-account token, and we must NOT fall back to a bare shared key that
+        // would misapply one account's setup-token to another.
+        const email = readClaudeAccountEmail(home);
+        if (!email)
+            return null;
+        if (!bundleExists(AUTH_BUNDLE) || bundleBackend(AUTH_BUNDLE) !== 'file')
+            return null;
+        const { env } = readAndResolveBundleEnv(AUTH_BUNDLE, { caller: 'usage', agentOnly: true });
+        const v = (env[claudeAccountTokenKey(email)] ?? '').trim();
+        return v.length > 0 ? v : null;
+    }
+    catch {
+        return null;
+    }
+}

package/dist/lib/devices/registry.d.ts

@@ -142,3 +142,28 @@ export declare function addIgnored(name: string): Promise<Set<string>>;
 /** Remove a node name from the ignore-list (un-ignore). Returns false if it was
  * not ignored. */
 export declare function removeIgnored(name: string): Promise<boolean>;
+/**
+ * Auto-launch preferences: which registered devices are eligible for Factory's
+ * auto-host selection, and which are preferred. Stored as a sibling to the
+ * registry and ignore-list under ~/.agents/.history/devices/.
+ */
+export interface AutoLaunchPreference {
+    enabled?: boolean;
+    preferred?: boolean;
+}
+export interface AutoLaunchPreferences {
+    devices: Record<string, AutoLaunchPreference>;
+    updatedAt: string;
+}
+/** Load auto-launch preferences. Missing or malformed file => empty map. */
+export declare function loadAutoLaunchPreferences(): Promise<Record<string, AutoLaunchPreference>>;
+/** True if the device is enabled for auto-launch. Missing entry defaults to true. */
+export declare function isAutoLaunchEnabled(name: string): Promise<boolean>;
+/** Set whether a device is enabled for auto-launch. Setting to the default
+ * (enabled) removes the entry to keep the file minimal. */
+export declare function setAutoLaunchEnabled(name: string, enabled: boolean): Promise<void>;
+/** True if the device is preferred for auto-launch ranking. */
+export declare function isAutoLaunchPreferred(name: string): Promise<boolean>;
+/** Set whether a device is preferred for auto-launch. Setting to the default
+ * (not preferred) removes the flag to keep the file minimal. */
+export declare function setAutoLaunchPreferred(name: string, preferred: boolean): Promise<void>;

package/dist/lib/devices/registry.js

@@ -18,7 +18,7 @@ import * as fsSync from 'fs';
 import * as path from 'path';
 import { randomBytes } from 'crypto';
 import lockfile from 'proper-lockfile';
-import { getDevicesRegistryPath, getDevicesIgnoredPath } from '../state.js';
+import { getDevicesRegistryPath, getDevicesIgnoredPath, getDevicesAutoLaunchPath } from '../state.js';
 /** A device's effective role, defaulting to `worker` when unset. */
 export function deviceRole(d) {
     return d.role ?? 'worker';
@@ -288,3 +288,84 @@ export async function removeIgnored(name) {
         return true;
     });
 }
+function autoLaunchPath() {
+    return getDevicesAutoLaunchPath();
+}
+/** Load auto-launch preferences. Missing or malformed file => empty map. */
+export async function loadAutoLaunchPreferences() {
+    const p = autoLaunchPath();
+    let raw;
+    try {
+        raw = await fs.readFile(p, 'utf-8');
+    }
+    catch (err) {
+        if (err && err.code === 'ENOENT')
+            return {};
+        throw err;
+    }
+    try {
+        const parsed = JSON.parse(raw);
+        return parsed.devices && typeof parsed.devices === 'object' ? parsed.devices : {};
+    }
+    catch (err) {
+        throw new Error(`Device auto-launch preferences corrupted at ${p}: ${err?.message ?? err}. Inspect and restore from backup.`);
+    }
+}
+/** True if the device is enabled for auto-launch. Missing entry defaults to true. */
+export async function isAutoLaunchEnabled(name) {
+    assertValidDeviceName(name);
+    const prefs = await loadAutoLaunchPreferences();
+    return prefs[name]?.enabled !== false;
+}
+/** Set whether a device is enabled for auto-launch. Setting to the default
+ * (enabled) removes the entry to keep the file minimal. */
+export async function setAutoLaunchEnabled(name, enabled) {
+    assertValidDeviceName(name);
+    const p = autoLaunchPath();
+    await withRegistryLock(p, async () => {
+        const prefs = await loadAutoLaunchPreferences();
+        if (enabled) {
+            if (prefs[name]) {
+                const { enabled: _, ...rest } = prefs[name];
+                if (Object.keys(rest).length === 0) {
+                    delete prefs[name];
+                }
+                else {
+                    prefs[name] = rest;
+                }
+            }
+        }
+        else {
+            prefs[name] = { ...prefs[name], enabled: false };
+        }
+        await atomicWriteJson(p, { devices: prefs, updatedAt: new Date().toISOString() });
+    });
+}
+/** True if the device is preferred for auto-launch ranking. */
+export async function isAutoLaunchPreferred(name) {
+    assertValidDeviceName(name);
+    const prefs = await loadAutoLaunchPreferences();
+    return prefs[name]?.preferred === true;
+}
+/** Set whether a device is preferred for auto-launch. Setting to the default
+ * (not preferred) removes the flag to keep the file minimal. */
+export async function setAutoLaunchPreferred(name, preferred) {
+    assertValidDeviceName(name);
+    const p = autoLaunchPath();
+    await withRegistryLock(p, async () => {
+        const prefs = await loadAutoLaunchPreferences();
+        if (preferred) {
+            prefs[name] = { ...prefs[name], preferred: true };
+        }
+        else if (prefs[name]) {
+            const { preferred: _, ...rest } = prefs[name];
+            if (Object.keys(rest).length === 0) {
+                delete prefs[name];
+            }
+            else {
+                prefs[name] = rest;
+            }
+        }
+        await atomicWriteJson(p, { devices: prefs, updatedAt: new Date().toISOString() });
+    });
+}

package/dist/lib/events.d.ts

@@ -13,7 +13,7 @@
  */
 import { type ActorKind } from './actor.js';
 export type EventLevel = 'audit' | 'warn' | 'info' | 'debug';
-export type EventType = 'agent.run.start' | 'agent.run.end' | 'agent.spawn.start' | 'agent.spawn.end' | 'version.install' | 'version.switch' | 'version.remove' | 'skill.install' | 'skill.remove' | 'browser.launch' | 'browser.close' | 'browser.navigate' | 'browser.screenshot' | 'secrets.get' | 'secrets.unlocked' | 'secrets.set' | 'secrets.delete' | 'secrets.rename' | 'cloud.dispatch' | 'cloud.complete' | 'cloud.cancel' | 'cloud.message' | 'teams.create' | 'teams.add' | 'teams.start' | 'teams.complete' | 'teams.disband' | 'hook.fire' | 'hook.complete' | 'hook.error' | 'mcp.add' | 'mcp.remove' | 'mcp.register' | 'resource.sync' | 'rotation.resolved' | 'command.start' | 'command.end' | 'perf.timing' | 'session.start' | 'session.end' | 'plan.created' | 'pr.opened' | 'pr.merged' | 'worktree.created' | 'worktree.removed' | 'commit.created' | 'pushed' | 'subagent.spawned' | 'artifact.created' | 'task.completed' | 'checklist.created' | 'status.posted' | 'file.edited' | 'error' | 'warn' | 'info' | 'debug';
+export type EventType = 'agent.run.start' | 'agent.run.end' | 'agent.spawn.start' | 'agent.spawn.end' | 'version.install' | 'version.switch' | 'version.remove' | 'skill.install' | 'skill.remove' | 'browser.launch' | 'browser.close' | 'browser.navigate' | 'browser.screenshot' | 'secrets.get' | 'secrets.unlocked' | 'secrets.set' | 'secrets.delete' | 'secrets.rename' | 'cloud.dispatch' | 'cloud.complete' | 'cloud.cancel' | 'cloud.message' | 'teams.create' | 'teams.add' | 'teams.start' | 'teams.complete' | 'teams.disband' | 'hook.fire' | 'hook.complete' | 'hook.error' | 'mcp.add' | 'mcp.remove' | 'mcp.register' | 'resource.sync' | 'rotation.resolved' | 'command.start' | 'command.end' | 'perf.timing' | 'session.start' | 'session.end' | 'plan.created' | 'pr.opened' | 'pr.merged' | 'worktree.created' | 'worktree.removed' | 'commit.created' | 'pushed' | 'subagent.spawned' | 'artifact.created' | 'task.completed' | 'checklist.created' | 'status.posted' | 'file.edited' | 'friction' | 'error' | 'warn' | 'info' | 'debug';
 export declare function levelFor(event: EventType): EventLevel;
 export interface EventMeta {
     ts: string;
@@ -156,6 +156,13 @@ export declare function emitCommand(command: string, args?: string[], payload?:
  * Emit an error event with full details.
  */
 export declare function emitError(err: Error | string, payload?: EventPayload): void;
+/**
+ * Emit a friction event — a structured, point-of-use record of a failure or
+ * block the CLI just hit. `surface` is the subsystem (teams, browser, secrets,
+ * guard, …); `failureId` is a stable slug that lets the nightly routine group
+ * the same failure across sessions (e.g. 'remote-cwd-on-add', 'not-installed').
+ */
+export declare function emitFriction(surface: string, failureId: string, payload?: EventPayload): void;
 /**
  * Remove log files older than the retention period.
  * Removes numbered gzip archives whose filesystem mtime exceeds retention.

package/dist/lib/events.js

@@ -523,6 +523,19 @@ export function emitError(err, payload = {}) {
         errorStack: truncate(error.stack, 1000),
     });
 }
+/**
+ * Emit a friction event — a structured, point-of-use record of a failure or
+ * block the CLI just hit. `surface` is the subsystem (teams, browser, secrets,
+ * guard, …); `failureId` is a stable slug that lets the nightly routine group
+ * the same failure across sessions (e.g. 'remote-cwd-on-add', 'not-installed').
+ */
+export function emitFriction(surface, failureId, payload = {}) {
+    emit('friction', {
+        ...payload,
+        surface,
+        failureId,
+    });
+}
 // ─── Gzip rotation ──────────────────────────────────────────────────────────
 /** Rotate the active file while its append lock is held. */
 function maybeGzipRotateLocked(logPath) {

package/dist/lib/exec.js

@@ -28,6 +28,7 @@ import { mailboxDir, isValidMailboxId } from './mailbox.js';
 import { composeWin32CommandLine } from './platform/index.js';
 import { isTmuxInstalled } from './tmux/binary.js';
 import { shellQuote } from './ssh-exec.js';
+import { resolveClaudeSetupToken } from './claude-account-token.js';
 /**
  * Map a raw mode string (CLI flag, YAML field, env var) to the canonical Mode.
  *
@@ -259,7 +260,15 @@ export function buildExecEnv(options) {
             ? resolvedVersion
             : (resolvedVersion && isVersionInstalled('claude', resolvedVersion) ? resolvedVersion : null);
         if (version) {
-            result.CLAUDE_CONFIG_DIR = path.join(getVersionHomePath('claude', version), '.claude');
+            const versionHome = getVersionHomePath('claude', version);
+            result.CLAUDE_CONFIG_DIR = path.join(versionHome, '.claude');
+            const setupToken = resolveClaudeSetupToken(versionHome);
+            if (setupToken) {
+                // A token keyed to this version home's own account replaces any ambient
+                // shared value inherited from the launcher. options.env still wins below
+                // for explicit caller overrides.
+                result.CLAUDE_CODE_OAUTH_TOKEN = setupToken;
+            }
             // A managed pin lives in a per-version dir; Claude Code's own background
             // auto-updater would rewrite that pinned binary in place (and has left it
             // half-swapped and broken). Disable it so a pin stays a pin. Honor an

package/dist/lib/format.d.ts

@@ -27,6 +27,13 @@ export declare function formatDie(msg: string, opts?: DieOptions): {
  * keep the original red-stderr behavior.
  */
 export declare function die(msg: string, code?: number, opts?: DieOptions): never;
+/**
+ * `die()` with a structured friction event attached. Use this at CLI error
+ * chokepoints so the nightly routine can classify and rank recurring failures
+ * without re-parsing transcripts. `surface` is the subsystem (teams, browser,
+ * secrets, guard, …); `failureId` is a stable slug (e.g. 'remote-cwd-on-add').
+ */
+export declare function dieFriction(surface: string, failureId: string, msg: string, code?: number, opts?: DieOptions): never;
 /**
  * Truncate `s` to at most `max` characters, appending a single-char ellipsis
  * (`…`) when shortened. Character-count based (not ANSI/width aware — use

package/dist/lib/format.js

@@ -9,6 +9,7 @@
  */
 import chalk from 'chalk';
 import { readSync } from 'node:fs';
+import { emitFriction } from './events.js';
 /**
  * Render a fatal error to the right stream. Pure — no I/O, no `process.exit` — so
  * the human-vs-agent split is unit-testable. A `--json` caller gets
@@ -43,6 +44,16 @@ export function die(msg, code = 1, opts = {}) {
         console.error(text);
     process.exit(code);
 }
+/**
+ * `die()` with a structured friction event attached. Use this at CLI error
+ * chokepoints so the nightly routine can classify and rank recurring failures
+ * without re-parsing transcripts. `surface` is the subsystem (teams, browser,
+ * secrets, guard, …); `failureId` is a stable slug (e.g. 'remote-cwd-on-add').
+ */
+export function dieFriction(surface, failureId, msg, code = 1, opts = {}) {
+    emitFriction(surface, failureId, { error: msg });
+    die(msg, code, opts);
+}
 /**
  * Truncate `s` to at most `max` characters, appending a single-char ellipsis
  * (`…`) when shortened. Character-count based (not ANSI/width aware — use

package/dist/lib/menubar/MenubarHelper.app/Contents/_CodeSignature/CodeResources

@@ -6,7 +6,7 @@
 	<dict>
 		<key>Resources/AppIcon.icns</key>
 		<data>
-		Vd5nfogg74zSRNspluv4uvDecUA=
+		DFq5H08EkhgWIC3UvGMR9B58BZw=
 		</data>
 	</dict>
 	<key>files2</key>
@@ -15,7 +15,7 @@
 		<dict>
 			<key>hash2</key>
 			<data>
-			DznVe0VgYOux7+B/aiHNgGYLCvSJKzgXDTPJn2jNkNg=
+			mBSjM6jlvN7J1jQowsvqTl7CHM0pur0e6qsHMuzk5k0=
 			</data>
 		</dict>
 	</dict>

package/dist/lib/models.d.ts

@@ -57,6 +57,27 @@ export interface ModelSource {
  * Returns null if nothing usable is found.
  */
 export declare function locateModelSource(agent: AgentId, version: string): ModelSource | null;
+/**
+ * Parse `grok models` stdout into a catalog. Exported for unit tests.
+ *
+ * Output shape (verified 0.2.118):
+ *   You are logged in with grok.com.
+ *
+ *   Default model: grok-4.5
+ *
+ *   Available models:
+ *     * grok-4.5 (default)
+ *
+ * The `Default model:` line is authoritative; rows may also carry a leading `*`
+ * and a `(default)` flag. Grok has no `--json` on this subcommand. Settings live
+ * in `config.toml` / `models_cache.json`, not `settings.json`, so the native
+ * settings.json reader cannot surface the default — the catalog is the source
+ * that makes `resolveConfiguredModel` return a cli-default for Grok.
+ */
+export declare function parseGrokModelsStdout(stdout: string): {
+    models: ModelInfo[];
+    aliases: Record<string, string>;
+};
 /**
  * Build (or load from cache) the model catalog for a specific (agent, version).
  * Cache is keyed on source-file mtime (binary or js module), so re-extracts

package/dist/lib/models.js

@@ -3,15 +3,15 @@
  *
  * Each agent ships its model list differently -- Claude and Codex embed it in
  * compiled bundles/binaries, Gemini exports it from a JS module, and OpenCode/
- * Cursor/OpenClaw expose it via CLI commands. This module provides a unified
- * `getModelCatalog()` and `resolveModel()` interface over all of them, backed
- * by a file-system cache keyed on source mtime.
+ * Cursor/OpenClaw/Antigravity/Kimi/Grok expose it via CLI commands. This
+ * module provides a unified `getModelCatalog()` and `resolveModel()` interface
+ * over all of them, backed by a file-system cache keyed on source mtime.
  */
 import * as fs from 'fs';
 import * as path from 'path';
 import { execFileSync } from 'child_process';
 import chalk from 'chalk';
-import { getVersionDir, getVersionHomePath } from './versions.js';
+import { getVersionDir, getVersionHomePath, getBinaryPath } from './versions.js';
 import { getModelsCachePath } from './state.js';
 import { agentConfigDirName } from './agents.js';
 import { resolveRunDefaults } from './run-defaults.js';
@@ -188,6 +188,36 @@ export function locateModelSource(agent, version) {
             return { path: pathBin, kind: 'cli' };
         return null;
     }
+    if (agent === 'grok') {
+        // Grok ships a native binary under the version home's `.grok/downloads/`,
+        // not node_modules/.bin. Prefer a real binary over a failed-download stub
+        // (a 99-byte placeholder sometimes left beside a prior good download).
+        const preferred = getBinaryPath('grok', version);
+        if (isUsableGrokBinary(preferred))
+            return { path: preferred, kind: 'cli' };
+        const downloads = path.join(getVersionHomePath('grok', version), '.grok', 'downloads');
+        try {
+            const candidates = fs
+                .readdirSync(downloads)
+                .filter((e) => e.startsWith('grok-'))
+                .map((e) => path.join(downloads, e))
+                .filter(isUsableGrokBinary)
+                .sort((a, b) => {
+                try {
+                    return fs.statSync(b).size - fs.statSync(a).size;
+                }
+                catch {
+                    return 0;
+                }
+            });
+            if (candidates[0])
+                return { path: candidates[0], kind: 'cli' };
+        }
+        catch {
+            /* empty downloads */
+        }
+        return null;
+    }
     if (agent === 'cursor') {
         // cursor-agent is installed via curl script, not agents-cli. Version argument
         // is accepted for API symmetry but ignored -- cursor lives on PATH.
@@ -198,6 +228,16 @@ export function locateModelSource(agent, version) {
     }
     return null;
 }
+/** Real Grok binaries are ~100MB+; failed-download stubs are tens of bytes. */
+function isUsableGrokBinary(filePath) {
+    try {
+        const st = fs.statSync(filePath);
+        return st.isFile() && st.size > 1024 * 1024;
+    }
+    catch {
+        return false;
+    }
+}
 /** Search PATH for a command and return its absolute path, or null. */
 function findOnPath(command) {
     const pathEnv = process.env.PATH || '';
@@ -679,6 +719,93 @@ function extractAntigravityCatalog(binaryPath) {
     }
     return { models, aliases: {} };
 }
+/**
+ * Parse `grok models` stdout into a catalog. Exported for unit tests.
+ *
+ * Output shape (verified 0.2.118):
+ *   You are logged in with grok.com.
+ *
+ *   Default model: grok-4.5
+ *
+ *   Available models:
+ *     * grok-4.5 (default)
+ *
+ * The `Default model:` line is authoritative; rows may also carry a leading `*`
+ * and a `(default)` flag. Grok has no `--json` on this subcommand. Settings live
+ * in `config.toml` / `models_cache.json`, not `settings.json`, so the native
+ * settings.json reader cannot surface the default — the catalog is the source
+ * that makes `resolveConfiguredModel` return a cli-default for Grok.
+ */
+export function parseGrokModelsStdout(stdout) {
+    // Strip ANSI in case a spinner or color codes slip through.
+    // eslint-disable-next-line no-control-regex
+    const plain = stdout.replace(/\x1b\[[0-9;]*[A-Za-z]/g, '');
+    let defaultId = null;
+    const defaultLine = plain.match(/Default model:\s*(\S+)/i);
+    if (defaultLine)
+        defaultId = defaultLine[1];
+    const models = [];
+    const seen = new Set();
+    for (const raw of plain.split('\n')) {
+        const line = raw.trim();
+        if (!line)
+            continue;
+        // Rows: "* grok-4.5 (default)" or "grok-4.5" or "  grok-code-fast-1"
+        const m = line.match(/^\*?\s*([A-Za-z0-9][A-Za-z0-9._-]*)(?:\s+\(([^)]*)\))?\s*$/);
+        if (!m)
+            continue;
+        const id = m[1];
+        // Real model ids are grok-* (or match the Default model: line). Skip banner words.
+        if (!/^grok[-_]/i.test(id) && id !== defaultId)
+            continue;
+        if (seen.has(id))
+            continue;
+        seen.add(id);
+        const flags = (m[2] ?? '').split(',').map((s) => s.trim().toLowerCase()).filter(Boolean);
+        models.push({
+            id,
+            isDefault: (defaultId != null && id === defaultId) || flags.includes('default'),
+        });
+    }
+    // If Default model was set but did not appear as a row, still surface it.
+    if (defaultId && !seen.has(defaultId)) {
+        models.unshift({ id: defaultId, isDefault: true });
+    }
+    // Normalize: exactly one default when we know the Default model: id.
+    if (defaultId) {
+        for (const model of models)
+            model.isDefault = model.id === defaultId;
+    }
+    else if (models.length > 0 && !models.some((model) => model.isDefault)) {
+        models[0].isDefault = true;
+    }
+    return { models, aliases: {} };
+}
+/** Extract Grok's catalog via `grok models` (see parseGrokModelsStdout). */
+function extractGrokCatalog(binaryPath) {
+    const env = { ...process.env };
+    // Point GROK_HOME at the version home that owns this binary so auth +
+    // models_cache come from the right install, not a host ~/.grok symlink.
+    // binary: <home>/.grok/downloads/grok-<ver>-...
+    const downloadsDir = path.dirname(binaryPath);
+    if (path.basename(downloadsDir) === 'downloads') {
+        env.GROK_HOME = path.dirname(downloadsDir);
+    }
+    let stdout;
+    try {
+        stdout = execFileSync(binaryPath, ['models'], {
+            encoding: 'utf-8',
+            stdio: ['ignore', 'pipe', 'ignore'],
+            timeout: 15_000,
+            maxBuffer: 8 * 1024 * 1024,
+            env,
+        });
+    }
+    catch {
+        return { models: [], aliases: {} };
+    }
+    return parseGrokModelsStdout(stdout);
+}
 /**
  * Extract Kimi's catalog via `kimi provider list --json`, which emits the raw
  * providers/models config. Model ids are the `models` object keys (e.g.
@@ -789,6 +916,8 @@ export function getModelCatalog(agent, version) {
             ({ models, aliases } = extractAntigravityCatalog(src.path));
         else if (agent === 'kimi')
             ({ models, aliases } = extractKimiCatalog(src.path));
+        else if (agent === 'grok')
+            ({ models, aliases } = extractGrokCatalog(src.path));
     }
     const catalog = {
         agent,

package/dist/lib/secrets/Agents CLI.app/Contents/_CodeSignature/CodeResources

@@ -6,7 +6,7 @@
 	<dict>
 		<key>Resources/AppIcon.icns</key>
 		<data>
-		Vd5nfogg74zSRNspluv4uvDecUA=
+		DFq5H08EkhgWIC3UvGMR9B58BZw=
 		</data>
 	</dict>
 	<key>files2</key>
@@ -15,7 +15,7 @@
 		<dict>
 			<key>hash2</key>
 			<data>
-			DznVe0VgYOux7+B/aiHNgGYLCvSJKzgXDTPJn2jNkNg=
+			mBSjM6jlvN7J1jQowsvqTl7CHM0pur0e6qsHMuzk5k0=
 			</data>
 		</dict>
 		<key>embedded.provisionprofile</key>

package/dist/lib/session/db.d.ts

@@ -8,6 +8,10 @@
  */
 import Database from '../sqlite.js';
 import type { SessionAgentId, SessionMeta } from './types.js';
+/** Current schema version; bumped when migrations are added. Exported so tests
+ * assert against the constant instead of hardcoding a number that every bump
+ * then has to chase (docs/05-sessions.md calls the constant the source of truth). */
+export declare const SCHEMA_VERSION = 21;
 /** Raw row shape returned from the sessions table. */
 export interface SessionRow {
     id: string;
@@ -40,6 +44,7 @@ export interface SessionRow {
     pr_number: number | null;
     worktree_slug: string | null;
     ticket_id: string | null;
+    spawned_team: string | null;
     plan: string | null;
     machine: string | null;
     todos: string | null;
@@ -297,6 +302,22 @@ export declare function queryAffinityRollup(options: {
 export declare function queryUsageRollup(options: QueryOptions & {
     groupBy: UsageRollupGroup;
 }): UsageRollupRow[];
+/** Who spawned a team: the orchestrator session, from its transcript. */
+export interface TeamSpawner {
+    sessionId: string;
+    shortId: string;
+    /** The human the orchestrator ran as, when the row carries actor provenance. */
+    actor?: string;
+}
+/**
+ * Map every team name to the session that ran `agents teams create/add` for it.
+ *
+ * One scan over the rows that carry a `spawned_team`, rather than a query per
+ * team — `agents teams list` needs the whole map at once, and the column has no
+ * index. When two sessions spawned the same team name (a team re-created after a
+ * disband), the most recent wins, which is the one whose work the name refers to.
+ */
+export declare function teamSpawners(): Map<string, TeamSpawner>;
 /** A session with its cost, for the top-N-by-cost listing. */
 export interface TopCostSession {
     meta: SessionMeta;