@phnx-labs/agents-cli 1.20.85 → 1.20.87

package/dist/lib/state.d.ts

@@ -181,6 +181,8 @@ export declare function getTeamsRegistryPath(): string;
 export declare function getDevicesRegistryPath(): string;
 /** Path to the device ignore-list — tailscale node names the user dismissed, so auto-discovery never re-suggests them. Per-machine, same dir as the registry. */
 export declare function getDevicesIgnoredPath(): string;
+/** Path to the device auto-launch preference file — which registered devices are eligible/preferred for Factory's auto-host selection. Per-machine, same dir as the registry. */
+export declare function getDevicesAutoLaunchPath(): string;
 /** Dir of "pending device" sentinels (~/.agents/.cache/state/devices-pending/) — one empty-ish file per newly-discovered, not-yet-approved tailnet node. Written by the daemon probe, read by the menu-bar helper (mirrors the attention sentinel dir). */
 export declare function getDevicesPendingDir(): string;
 /** Path to cloud dispatch cache (~/.agents/.cache/cloud/). */

package/dist/lib/state.js

@@ -402,6 +402,8 @@ function getDevicesDir() {
 export function getDevicesRegistryPath() { return path.join(getDevicesDir(), 'registry.json'); }
 /** Path to the device ignore-list — tailscale node names the user dismissed, so auto-discovery never re-suggests them. Per-machine, same dir as the registry. */
 export function getDevicesIgnoredPath() { return path.join(getDevicesDir(), 'ignored.json'); }
+/** Path to the device auto-launch preference file — which registered devices are eligible/preferred for Factory's auto-host selection. Per-machine, same dir as the registry. */
+export function getDevicesAutoLaunchPath() { return path.join(getDevicesDir(), 'auto-launch.json'); }
 /** Dir of "pending device" sentinels (~/.agents/.cache/state/devices-pending/) — one empty-ish file per newly-discovered, not-yet-approved tailnet node. Written by the daemon probe, read by the menu-bar helper (mirrors the attention sentinel dir). */
 export function getDevicesPendingDir() { return path.join(RUNTIME_STATE_DIR, 'devices-pending'); }
 /** Path to cloud dispatch cache (~/.agents/.cache/cloud/). */

package/dist/lib/usage.js

@@ -18,7 +18,7 @@ import chalk from 'chalk';
 import { decodeJwtPayload, decryptDroidAuthPayload } from './agents.js';
 import { walkForFiles } from './fs-walk.js';
 import { getKeychainToken, setKeychainToken, deleteKeychainToken, isKeychainBackendOverridden, } from './secrets/index.js';
-import { bundleExists, bundleBackend, readAndResolveBundleEnv } from './secrets/bundles.js';
+import { resolveClaudeSetupToken } from './claude-account-token.js';
 import { getCacheDir } from './state.js';
 const execFileAsync = promisify(execFile);
 const CLAUDE_USAGE_URL = 'https://api.anthropic.com/api/oauth/usage';
@@ -999,65 +999,6 @@ function deleteCachedClaudeOauth(service) {
         /* best-effort — cache is an optimization */
     }
 }
-/**
- * Reserved FILE-BASED secrets bundle holding long-lived, non-rotating Claude
- * setup-tokens. Usage/probe reads authenticate with these instead of Claude
- * Code's ACL-bound login item, so they never pop Touch ID. Keyed strictly
- * per-account (`CLAUDE_CODE_OAUTH_TOKEN_<slug>` from the account email) — never a
- * bare key, so one account's token can't be misapplied to another in a
- * multi-account fleet.
- */
-const AUTH_BUNDLE = 'auth';
-/** The per-account key an email maps to inside the `auth` bundle. */
-function claudeAccountTokenKey(account) {
-    const slug = account
-        .trim()
-        .toUpperCase()
-        .replace(/@/g, '_AT_')
-        .replace(/\./g, '_DOT_')
-        .replace(/[^A-Z0-9_]/g, '_');
-    return `CLAUDE_CODE_OAUTH_TOKEN_${slug}`;
-}
-/** Signed-in account email for a version home, from `.claude.json` (no keychain). */
-function readClaudeAccountEmail(home) {
-    const base = home ?? os.homedir();
-    for (const p of [path.join(base, '.claude', '.claude.json'), path.join(base, '.claude.json')]) {
-        try {
-            const email = JSON.parse(fs.readFileSync(p, 'utf-8')).oauthAccount?.emailAddress;
-            if (typeof email === 'string' && email.trim().length > 0)
-                return email.trim();
-        }
-        catch {
-            // Missing/unreadable at this location — try the next.
-        }
-    }
-    return null;
-}
-/**
- * Resolve a long-lived `claude setup-token` for the account signed into `home`
- * from the reserved FILE-BASED `auth` bundle. Returns the token or null. Reads
- * ONLY when the bundle is file-backed (never keychain), so this path itself can
- * never trigger a Touch ID prompt — that is the entire point: usage/probe reads
- * authenticate with the shareable setup-token, not the ACL-bound login item.
- */
-function resolveClaudeSetupToken(home) {
-    try {
-        // Require a known account (email) up front: without it we cannot key a
-        // per-account token, and we must NOT fall back to a bare shared key that
-        // would misapply one account's setup-token to another.
-        const email = readClaudeAccountEmail(home);
-        if (!email)
-            return null;
-        if (!bundleExists(AUTH_BUNDLE) || bundleBackend(AUTH_BUNDLE) !== 'file')
-            return null;
-        const { env } = readAndResolveBundleEnv(AUTH_BUNDLE, { caller: 'usage', agentOnly: true });
-        const v = (env[claudeAccountTokenKey(email)] ?? '').trim();
-        return v.length > 0 ? v : null;
-    }
-    catch {
-        return null;
-    }
-}
 /**
  * Load a version home's Claude OAuth credential from the two stores Claude Code
  * uses, tried in order:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@phnx-labs/agents-cli",
-  "version": "1.20.85",
+  "version": "1.20.87",
   "description": "One CLI for all your AI coding agents - versions, config, cloud dispatch, sessions, and teams (now with first-class Grok Build CLI support)",
   "type": "module",
   "main": "dist/index.js",