@phnx-labs/agents-cli 1.22.102 → 1.22.104

package/dist/lib/secrets-client.js

@@ -25,9 +25,10 @@
  *     is load-bearing: the standalone wraps fd 3 in a `net.Socket`, and a Socket
  *     over a NAMED FIFO reads the request but never fires EOF on macOS, so the
  *     older FIFO wiring hung the read loop for the full timeout. Bounded to
- *     `SYNC_SERVE_TIMEOUT_MS` so a broken standalone fails fast, never for the
- *     server's 60s deadline. POSIX only; Windows fails loud pointing at the
- *     async path.
+ *     `SYNC_SERVE_TIMEOUT_MS` (30s — sized for a cold Node boot of the
+ *     standalone on a loaded box, see the constant) so a broken standalone
+ *     fails before the server's 60s deadline. POSIX only; Windows fails loud
+ *     pointing at the async path.
  *
  * State root (MIG-1): the standalone selects its state root from `SECRETS_HOME`.
  * agents-cli points it at the user agents dir (`~/.agents`) by default so the
@@ -59,20 +60,25 @@ const MAX_PROTOCOL_BYTES = 8 * 1024 * 1024;
 /** Just over the server's own 60s deadline, so the server times out first. */
 const SERVE_TIMEOUT_MS = 65_000;
 /**
- * The synchronous path only serves read-only STATUS surfaces — `agents view`,
- * the account-catalog rows, and run-config / account-rotation resolution on the
- * `agents run` hot path. Those must never hang the whole render or launch on a
- * missing or unreachable standalone, so the sync serve carries a short, hard
- * bound instead of the async path's 65s: a broken `secrets` fails loud in a few
- * seconds and the caller renders the rest of its output (or launches on the
- * native login) with one clear line, rather than sitting for the standalone's
- * own 60s deadline (the exact 60s hang PHNX-3989 hit when the child ran under
- * Bun). A real sync op (a handshake, a bundle list, one item read) completes in
- * tens of milliseconds, so this is ~100x headroom. It is NOT a fallback to the
- * embedded engine (DIST-1); the standalone stays the only implementation, it
- * just fails fast.
+ * The synchronous path serves the surfaces that resolve secrets before they can
+ * continue — `agents view`, the account-catalog rows, and the account listing and
+ * setup-token read on the `agents run` launch path. Those must never hang for the
+ * standalone's own 60s deadline (the exact hang PHNX-3989 hit when the child ran
+ * under Bun), so the sync serve carries a hard bound below it instead of the
+ * async path's 65s. The bound covers a COLD PROCESS, not just the operation: every
+ * request spawns `secrets __serve` afresh, so it pays a Node boot plus the
+ * standalone's module load before the tens-of-milliseconds op runs: ~0.3s on a
+ * quiet box, 0.4–2.6s and occasionally more on a desktop at load average ~100
+ * (measured 2026-09-12), where the previous 3s bound turned load into a failed
+ * launch (`secrets request failed: spawnSync sh ETIMEDOUT` from `agents run`).
+ * 30s absorbs that boot under load and still fails a broken or wedged standalone
+ * well before its 60s self-deadline. It is NOT a fallback to the embedded engine
+ * (DIST-1); the standalone stays the only implementation. Exported so the
+ * real-standalone test can assert a round-trip beats the bound.
  */
-const SYNC_SERVE_TIMEOUT_MS = 3_000;
+export const SYNC_SERVE_TIMEOUT_MS = 30_000;
+/** Test seam: a hang test plants a never-answering standalone and must not wait 30s. */
+let syncServeTimeoutMs = SYNC_SERVE_TIMEOUT_MS;
 /** Serialize `Map`s the way the server's `decodeWire` expects to receive them. */
 export function encodeWire(value) {
     if (value instanceof Map) {
@@ -291,7 +297,18 @@ function parseResponse(raw) {
     catch {
         throw new SecretsClientError('INVALID_RESPONSE', `secrets returned a non-JSON response${describeNonJson(text)}`);
     }
-    if (!parsed || parsed.v !== PROTOCOL_VERSION || typeof parsed.id !== 'string') {
+    if (!parsed || typeof parsed !== 'object') {
+        throw new SecretsClientError('INVALID_RESPONSE', 'secrets returned a malformed response envelope');
+    }
+    // Every reply carries the protocol it was written against, so version
+    // negotiation rides the answer itself — there is no separate handshake spawn
+    // to pay a cold Node boot for (PHNX-4082). A mismatch is the standalone being
+    // too old or too new, which is actionable; anything else is a broken envelope.
+    if (typeof parsed.v === 'number' && parsed.v !== PROTOCOL_VERSION) {
+        throw new SecretsClientError('PROTOCOL_UNSUPPORTED', `secrets speaks protocol ${String(parsed.v)}; this agents-cli needs ${PROTOCOL_VERSION}. ` +
+            'Update the standalone CLI (npm i -g @phnx-labs/secrets-cli).');
+    }
+    if (parsed.v !== PROTOCOL_VERSION || typeof parsed.id !== 'string') {
         throw new SecretsClientError('INVALID_RESPONSE', 'secrets returned a malformed response envelope');
     }
     if (parsed.ok)
@@ -413,13 +430,25 @@ function serveOnceSync(op, args, context) {
         input: request,
         stdio: ['pipe', 'pipe', 'inherit'],
         env: buildServeEnv(),
-        timeout: SYNC_SERVE_TIMEOUT_MS,
+        timeout: syncServeTimeoutMs,
         maxBuffer: MAX_PROTOCOL_BYTES + 4096,
     });
     if (result.error) {
         const err = result.error;
-        const code = err.code === 'ETIMEDOUT' ? 'TIMEOUT' : 'SPAWN_FAILED';
-        throw new SecretsClientError(code, `secrets request failed: ${err.message}`);
+        if (err.code === 'ETIMEDOUT') {
+            throw new SecretsClientError('TIMEOUT', `the standalone \`secrets\` CLI did not answer within ${Math.round(syncServeTimeoutMs / 1000)}s ` +
+                `(${[command, ...prefix, '__serve'].join(' ')}). The machine may be too loaded to boot it in time, or the install is broken: ` +
+                'check with `secrets --version`.');
+        }
+        // A standalone that exits before draining fd 3 leaves `spawnSync`'s stdin
+        // write with EPIPE, yet its exit status and everything it wrote to fd 4 are
+        // still returned. Like the async path (`input.on('error', () => {})`), the
+        // outcome is whatever reached fd 4 — an empty or non-JSON answer is the
+        // diagnostic, not the errno. Seen on the GitHub-hosted runner, where a
+        // planted `exit 0` standalone exits faster than the request is written.
+        if (err.code !== 'EPIPE') {
+            throw new SecretsClientError('SPAWN_FAILED', `secrets request failed: ${err.message}`);
+        }
     }
     const raw = result.stdout ?? Buffer.alloc(0);
     if (raw.length > MAX_PROTOCOL_BYTES) {
@@ -427,45 +456,14 @@ function serveOnceSync(op, args, context) {
     }
     return parseResponse(raw);
 }
-// --- handshake (once per process) ------------------------------------------
-let handshakeReady = false;
-let handshakePromise = null;
-function checkHandshake(result) {
-    const protocol = result?.protocol;
-    if (protocol !== PROTOCOL_VERSION) {
-        throw new SecretsClientError('PROTOCOL_UNSUPPORTED', `secrets speaks protocol ${String(protocol)}; this agents-cli needs ${PROTOCOL_VERSION}. ` +
-            'Update the standalone CLI (npm i -g @phnx-labs/secrets-cli).');
-    }
-}
-async function ensureHandshake() {
-    if (handshakeReady)
-        return;
-    if (!handshakePromise) {
-        handshakePromise = (async () => {
-            checkHandshake(await serveOnce('handshake', []));
-            handshakeReady = true;
-        })().catch((error) => {
-            handshakePromise = null;
-            throw error;
-        });
-    }
-    await handshakePromise;
-}
-function ensureHandshakeSync() {
-    if (handshakeReady)
-        return;
-    checkHandshake(serveOnceSync('handshake', []));
-    handshakeReady = true;
-}
 // --- primitives ------------------------------------------------------------
 /**
  * Send one operation to the standalone secrets CLI and await its typed result.
- * Verifies the executable speaks protocol v1 once per process (cached), then
- * spawns `secrets __serve` for the operation. Throws a {@link SecretsClientError}
+ * Spawns `secrets __serve` once for the operation; `parseResponse` checks the
+ * protocol on the reply it already carries. Throws a {@link SecretsClientError}
  * carrying the server's `{code, message}` on failure.
  */
 export async function secretsRequest(op, args = [], context) {
-    await ensureHandshake();
     return (await serveOnce(op, args, context));
 }
 /**
@@ -474,15 +472,17 @@ export async function secretsRequest(op, args = [], context) {
  * Bounded by a spawn timeout. POSIX only.
  */
 export function secretsRequestSync(op, args = [], context) {
-    ensureHandshakeSync();
     return serveOnceSync(op, args, context);
 }
-/** Test hook: forget the cached binary + handshake so a new env is re-resolved. */
+/** Test hook: forget the cached binary so a new env is re-resolved. */
 export function _resetSecretsClientForTest() {
     cachedBin = undefined;
-    handshakeReady = false;
-    handshakePromise = null;
     requestCounter = 0;
+    syncServeTimeoutMs = SYNC_SERVE_TIMEOUT_MS;
+}
+/** Shorten the sync bound for a test that plants a hanging standalone; reset restores it. */
+export function _setSyncServeTimeoutForTest(ms) {
+    syncServeTimeoutMs = ms;
 }
 // --- typed wrappers -------------------------------------------------------
 //

package/dist/lib/self-heal/checks/menubar-helper.d.ts

@@ -0,0 +1,2 @@
+import type { HealCheck } from '../types.js';
+export declare const menubarHelperCheck: HealCheck;

package/dist/lib/self-heal/checks/menubar-helper.js

@@ -0,0 +1,21 @@
+// menubar-helper check — keeps the installed AGI Menu on the newest published
+// build. Discovery + trigger for the helper's auto-update: the daemon runs this
+// on the periodic cadence; the same call runs right after `agents upgrade`.
+// Detect-only under dryRun (what `agents doctor` shows); the repair is the
+// verified download + atomic swap + restart in `updateMenubarHelperIfNewer`.
+import { resultOf } from '../types.js';
+export const menubarHelperCheck = {
+    id: 'menubar-helper',
+    title: 'AGI Menu helper is the newest published build',
+    platforms: ['darwin'],
+    cadence: 'periodic',
+    async run(ctx) {
+        const { updateMenubarHelperIfNewer } = await import('../../menubar/install-menubar.js');
+        const r = await updateMenubarHelperIfNewer({ dryRun: ctx.dryRun });
+        switch (r.outcome) {
+            case 'updated': return resultOf([r.detail], []);
+            case 'failed': return resultOf([], [`AGI Menu ${r.installed ?? '?'} → ${r.available}: ${r.detail}`]);
+            default: return resultOf([], []);
+        }
+    },
+};

package/dist/lib/self-heal/registry.js

@@ -11,6 +11,7 @@ import { shimsCheck } from './checks/shims.js';
 import { shadowingCheck } from './checks/shadowing.js';
 import { pathCheck } from './checks/path.js';
 import { installStagingCheck } from './checks/install-staging.js';
+import { menubarHelperCheck } from './checks/menubar-helper.js';
 // Order matters: cheap structural fixes (shims, shadow adoption, PATH, generated
 // hook wrappers) before the heavier resource reconciliation, so a freshly-
 // repaired shim is in place first.
@@ -24,6 +25,8 @@ export const HEAL_CHECKS = [
     hookManifestCheck,
     resourcesCheck,
     installStagingCheck,
+    // Last and network-touching: the menu-bar helper's auto-update (macOS only).
+    menubarHelperCheck,
 ];
 /** Run the selected checks, isolating per-check failures. */
 export async function runSelfHeal(opts = {}) {

package/dist/lib/self-heal/types.d.ts

@@ -1,4 +1,4 @@
-export type HealCheckId = 'resources' | 'hook-runtime' | 'hook-manifest' | 'shims' | 'shadowing' | 'path' | 'install-staging';
+export type HealCheckId = 'resources' | 'hook-runtime' | 'hook-manifest' | 'shims' | 'shadowing' | 'path' | 'install-staging' | 'menubar-helper';
 /** When the daemon schedules a check. */
 export type HealCadence = 'startup' | 'frequent' | 'periodic';
 export interface HealCtx {

package/dist/lib/session/db.js

@@ -488,7 +488,7 @@ CREATE INDEX IF NOT EXISTS idx_browser_sessions_started ON browser_sessions(star
 -- silently vanished on day 8. This row carries the same identity into the durable
 -- store; the ledger is untouched and remains the audit log, with no second pruner.
 --
--- Keyed on invocation_id, the id emitComputerAction stamps once per emitting CLI
+-- Keyed on invocation_id, the id recordComputerAction stamps once per emitting CLI
 -- process: one explicit verb is one row, and a whole "computer run" observe/act
 -- loop is also one row. task_preview is already bounded by events.ts truncate()
 -- before it is ever written, and typed-text content is never captured at all.

package/dist/lib/sha256-asset.d.ts

@@ -2,7 +2,8 @@
  * sha256 helpers for verifying downloaded release assets.
  *
  * These live in their own LEAF module — importing only `node:crypto` and
- * `node:fs` — on purpose. They used to sit in `computer/ssh-tunnel.ts`, whose
+ * `node:fs` — on purpose. They used to sit in the computer subsystem's ssh-tunnel
+ * module (since extracted, PHNX-4075), whose
  * own import graph reached `browser/drivers/ssh.ts` -> `browser/chrome.ts` ->
  * the in-repo secrets engine's own keychain-helper downloader, which imported
  * back into `helper-download.ts` while it was still evaluating — before

package/dist/lib/sha256-asset.js

@@ -2,7 +2,8 @@
  * sha256 helpers for verifying downloaded release assets.
  *
  * These live in their own LEAF module — importing only `node:crypto` and
- * `node:fs` — on purpose. They used to sit in `computer/ssh-tunnel.ts`, whose
+ * `node:fs` — on purpose. They used to sit in the computer subsystem's ssh-tunnel
+ * module (since extracted, PHNX-4075), whose
  * own import graph reached `browser/drivers/ssh.ts` -> `browser/chrome.ts` ->
  * the in-repo secrets engine's own keychain-helper downloader, which imported
  * back into `helper-download.ts` while it was still evaluating — before

package/dist/lib/ssh-tunnel.d.ts

@@ -0,0 +1,61 @@
+/**
+ * ssh-tunnel.ts — the generic `ssh -L localPort:127.0.0.1:remotePort -N`
+ * port-forward, plus the fleet-device resolution that names its far end.
+ *
+ * WHY IT LIVES HERE. These primitives used to sit in `lib/computer/ssh-tunnel.ts`
+ * alongside the Windows computer-helper provisioning, because `agents computer
+ * --device` was their second caller after the browser CDP driver. The computer
+ * engine has since moved to the standalone `computer` CLI (PHNX-4075), so a
+ * generic tunnel parked in a deleted subsystem's directory would have gone with
+ * it and taken `agents browser`'s remote path down. It is fleet plumbing — the
+ * devices registry, the hardened ssh baseline, a local loopback port — and
+ * belongs in the fleet layer, not under a feature.
+ *
+ * Its callers are thin: `browser/drivers/ssh.ts` holds a tunnel for one CDP
+ * session, and `lib/computer/context.ts` uses `resolveRemoteDevice` alone —
+ * `agents computer --device` resolves the fleet name here and forwards the
+ * answer to the standalone engine, which opens and owns its own tunnel (it
+ * holds the helper token that tunnel's transport needs).
+ */
+import { type ChildProcess } from 'child_process';
+import { type DeviceProfile } from './devices/registry.js';
+export interface StartTunnelOptions {
+    extraSshArgs?: string[];
+}
+/** Build the ssh argv (after the `ssh` program name) for an `-L` tunnel. Pure.
+ *
+ * Composes the shared hardened baseline (`SSH_OPTS`) rather than re-listing it,
+ * so the tunnel inherits the same options — crucially the keepalive, which lets
+ * a dropped `-N` tunnel exit instead of lingering as a zombie on the laptop. */
+export declare function buildTunnelArgs(user: string, host: string, localPort: number, remotePort: number, extraSshArgs?: string[]): string[];
+/**
+ * Spawn `ssh -L localPort:127.0.0.1:remotePort -N user@host`.
+ *
+ * stderr is captured so a tunnel that dies inside 500ms rejects with the ssh
+ * error — the browser driver's original contract. The tunnel is held by this
+ * process for the lifetime of the session that opened it.
+ */
+export declare function startSSHTunnel(user: string, host: string, localPort: number, remotePort: number, opts?: StartTunnelOptions): Promise<ChildProcess>;
+/** One registered device, resolved to everything an ssh invocation needs. */
+export interface ResolvedRemoteDevice {
+    device: DeviceProfile;
+    target: string;
+    user: string;
+    host: string;
+    /** Per-device identity flags (`-i <key> -o IdentitiesOnly=yes`), possibly empty. */
+    identityArgs: string[];
+}
+/**
+ * Resolve a registered device to its ssh pieces, or throw a clear error.
+ *
+ * `expectPlatform` is how a caller keeps a platform requirement it used to
+ * hard-code: `agents computer --device` drives the Windows helper daemon, so it
+ * passes `'windows'` and gets the same refusal as before. Callers with no
+ * platform requirement (the browser driver) omit it. The gate is a parameter
+ * rather than a baked-in check so this module stays fleet-generic — a
+ * hard-coded `windows` here would be a feature rule in shared plumbing.
+ */
+export declare function resolveRemoteDevice(name: string, opts?: {
+    expectPlatform?: DeviceProfile['platform'];
+    forWhat?: string;
+}): Promise<ResolvedRemoteDevice>;

package/dist/lib/ssh-tunnel.js

@@ -0,0 +1,105 @@
+/**
+ * ssh-tunnel.ts — the generic `ssh -L localPort:127.0.0.1:remotePort -N`
+ * port-forward, plus the fleet-device resolution that names its far end.
+ *
+ * WHY IT LIVES HERE. These primitives used to sit in `lib/computer/ssh-tunnel.ts`
+ * alongside the Windows computer-helper provisioning, because `agents computer
+ * --device` was their second caller after the browser CDP driver. The computer
+ * engine has since moved to the standalone `computer` CLI (PHNX-4075), so a
+ * generic tunnel parked in a deleted subsystem's directory would have gone with
+ * it and taken `agents browser`'s remote path down. It is fleet plumbing — the
+ * devices registry, the hardened ssh baseline, a local loopback port — and
+ * belongs in the fleet layer, not under a feature.
+ *
+ * Its callers are thin: `browser/drivers/ssh.ts` holds a tunnel for one CDP
+ * session, and `lib/computer/context.ts` uses `resolveRemoteDevice` alone —
+ * `agents computer --device` resolves the fleet name here and forwards the
+ * answer to the standalone engine, which opens and owns its own tunnel (it
+ * holds the helper token that tunnel's transport needs).
+ */
+import { spawn } from 'child_process';
+import { SSH_OPTS, assertValidSshTarget } from './ssh-exec.js';
+import { getDevice } from './devices/registry.js';
+import { deviceIdentityArgs, sshTargetFor } from './devices/connect.js';
+import { hostNameFor } from './devices/ssh-config.js';
+/** Build the ssh argv (after the `ssh` program name) for an `-L` tunnel. Pure.
+ *
+ * Composes the shared hardened baseline (`SSH_OPTS`) rather than re-listing it,
+ * so the tunnel inherits the same options — crucially the keepalive, which lets
+ * a dropped `-N` tunnel exit instead of lingering as a zombie on the laptop. */
+export function buildTunnelArgs(user, host, localPort, remotePort, extraSshArgs = []) {
+    return [
+        '-L',
+        `${localPort}:127.0.0.1:${remotePort}`,
+        `${user}@${host}`,
+        '-N',
+        ...extraSshArgs,
+        ...SSH_OPTS,
+    ];
+}
+/**
+ * Spawn `ssh -L localPort:127.0.0.1:remotePort -N user@host`.
+ *
+ * stderr is captured so a tunnel that dies inside 500ms rejects with the ssh
+ * error — the browser driver's original contract. The tunnel is held by this
+ * process for the lifetime of the session that opened it.
+ */
+export function startSSHTunnel(user, host, localPort, remotePort, opts = {}) {
+    return new Promise((resolve, reject) => {
+        // `user`/`host` can originate from a browser ssh:// profile or a device
+        // record. buildTunnelArgs places `${user}@${host}` before `-N`/SSH_OPTS, so
+        // a `-`-leading user would be parsed as an ssh option flag (option
+        // injection). Validate at the spawn sink so every caller is covered; reject
+        // (rather than throw synchronously) to keep the Promise contract.
+        try {
+            assertValidSshTarget(`${user}@${host}`);
+        }
+        catch (err) {
+            reject(err);
+            return;
+        }
+        const args = buildTunnelArgs(user, host, localPort, remotePort, opts.extraSshArgs);
+        const tunnel = spawn('ssh', args, {
+            stdio: ['ignore', 'ignore', 'pipe'],
+            detached: false,
+            windowsHide: true,
+        });
+        let stderr = '';
+        tunnel.stderr?.on('data', (data) => {
+            stderr += data.toString();
+        });
+        tunnel.on('error', (err) => {
+            reject(new Error(`SSH tunnel failed: ${err.message}`));
+        });
+        setTimeout(() => {
+            if (tunnel.killed)
+                reject(new Error(`SSH tunnel died: ${stderr}`));
+            else
+                resolve(tunnel);
+        }, 500);
+    });
+}
+/**
+ * Resolve a registered device to its ssh pieces, or throw a clear error.
+ *
+ * `expectPlatform` is how a caller keeps a platform requirement it used to
+ * hard-code: `agents computer --device` drives the Windows helper daemon, so it
+ * passes `'windows'` and gets the same refusal as before. Callers with no
+ * platform requirement (the browser driver) omit it. The gate is a parameter
+ * rather than a baked-in check so this module stays fleet-generic — a
+ * hard-coded `windows` here would be a feature rule in shared plumbing.
+ */
+export async function resolveRemoteDevice(name, opts = {}) {
+    const device = await getDevice(name);
+    if (!device) {
+        throw new Error(`Unknown device '${name}'. Register it with \`agents devices add\` / \`agents devices sync\`, then retry.`);
+    }
+    if (opts.expectPlatform && device.platform !== opts.expectPlatform) {
+        const what = opts.forWhat ?? `this command`;
+        throw new Error(`Device '${name}' is ${device.platform}, not ${opts.expectPlatform}. ${what} needs a ${opts.expectPlatform} device.`);
+    }
+    const target = sshTargetFor(device); // validates address + injection guard
+    const host = hostNameFor(device); // sshTargetFor already threw if absent
+    const user = device.user || process.env.USER || 'Administrator';
+    return { device, target, user, host, identityArgs: deviceIdentityArgs(device) };
+}

package/dist/lib/summarizer/summarize.d.ts

@@ -3,8 +3,8 @@
  *
  * A pure boundary: given the session's first user turn (the goal source) and its
  * live progress (todos / plan / phase off the state engine), it asks a local
- * Anthropic-wire endpoint (Ollama / vLLM / LiteLLM — the same configurable base
- * URL `computer/model.ts` speaks) for a strict JSON `{goal, checkpoints, checklist}`
+ * Anthropic-wire endpoint (Ollama / vLLM / LiteLLM) for a strict JSON
+ * `{goal, checkpoints, checklist}`
  * and validates the shape. On ANY failure — network, non-2xx, non-JSON, wrong
  * shape — it returns `undefined`, and the caller records `summaryState: 'skipped'`.
  *

package/dist/lib/summarizer/summarize.js

@@ -3,15 +3,22 @@
  *
  * A pure boundary: given the session's first user turn (the goal source) and its
  * live progress (todos / plan / phase off the state engine), it asks a local
- * Anthropic-wire endpoint (Ollama / vLLM / LiteLLM — the same configurable base
- * URL `computer/model.ts` speaks) for a strict JSON `{goal, checkpoints, checklist}`
+ * Anthropic-wire endpoint (Ollama / vLLM / LiteLLM) for a strict JSON
+ * `{goal, checkpoints, checklist}`
  * and validates the shape. On ANY failure — network, non-2xx, non-JSON, wrong
  * shape — it returns `undefined`, and the caller records `summaryState: 'skipped'`.
  *
  * NEVER called on the request path: only the background SessionSummarizerService
  * invokes it, debounced and reader-gated.
  */
-import { ANTHROPIC_VERSION } from '../computer/model.js';
+/**
+ * The `anthropic-version` header this request sends. Declared here because this
+ * is now its only caller: it used to be imported from the computer subsystem's
+ * model client, which left with the standalone `computer` engine (PHNX-4075).
+ * A shared constants module for one string used in one request would be more
+ * indirection than the string.
+ */
+const ANTHROPIC_VERSION = '2023-06-01';
 const SYSTEM_PROMPT = [
     'You summarize a coding-agent session for an operator dashboard.',
     'Reply with ONLY a single JSON object, no prose and no code fences, of exactly this shape:',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@phnx-labs/agents-cli",
-  "version": "1.22.102",
+  "version": "1.22.104",
   "description": "One CLI for all your AI coding agents - versions, config, cloud dispatch, sessions, and teams (now with first-class Grok Build CLI support)",
   "type": "module",
   "main": "dist/index.js",
@@ -17,8 +17,7 @@
   "bin": {
     "agents": "dist/index.js",
     "ag": "dist/index.js",
-    "browser": "dist/browser.js",
-    "computer": "dist/computer.js"
+    "browser": "dist/browser.js"
   },
   "files": [
     "dist/**/*.js",

package/dist/commands/computer-actions.d.ts

@@ -1,55 +0,0 @@
-import { Command } from 'commander';
-import { type ComputerClient, type RPCResponse } from '../lib/computer/computer-rpc.js';
-export { emitComputerAction, pickTarget, resolveTargetPidDecision, type AppInfo } from '../lib/computer/actions.js';
-export declare function parseXY(s: string, flag: string): {
-    x: number;
-    y: number;
-};
-export declare function buildElementOrCoords(opts: {
-    id?: string;
-    x?: number;
-    y?: number;
-}): {
-    ok: true;
-    params: Record<string, unknown>;
-} | {
-    ok: false;
-    error: string;
-};
-export declare function buildRaiseParams(opts: {
-    windowId?: number;
-    title?: string;
-}): Record<string, unknown>;
-export declare const CHAR_DELAY_MIN_MS = 1;
-export declare const CHAR_DELAY_MAX_MS = 250;
-export declare function clampCharDelay(ms: number | undefined): number | undefined;
-export declare function buildWaitParams(opts: {
-    duration?: number;
-    id?: string;
-    until?: string;
-    role?: string;
-    label?: string;
-    identifier?: string;
-    timeout?: number;
-}): {
-    ok: true;
-    params: Record<string, unknown>;
-} | {
-    ok: false;
-    error: string;
-};
-export declare function withClient<T>(fn: (client: ComputerClient) => Promise<T>): Promise<T>;
-export declare function unwrap(r: RPCResponse): Record<string, unknown>;
-export declare function focusStealNotes(opts: {
-    id?: string;
-    x?: number;
-    y?: number;
-    raise?: boolean;
-}): string[];
-export declare function shouldRaise(opts: {
-    id?: string;
-    raise?: boolean;
-}): boolean;
-export declare function appPathIsElectron(appPath: string | null, exists?: (p: string) => boolean): boolean;
-export declare function electronWebviewTip(appLabel: string): string;
-export declare function registerActionCommands(program: Command): void;