@phnx-labs/agents-cli 1.22.103 → 1.22.105

package/CHANGELOG.md

@@ -1,5 +1,44 @@
 # Changelog
 
+## 1.22.105
+
+- Computer setup installs standalone Computer CLI 0.1.2, whose application code is obfuscated before compilation to increase inspection effort. Agents continues to provide permissions and session tracking through its adapter.
+
+- Fleet test runs use separate temporary workspaces and clean up their own copies. Router account fixtures run only with isolated file-backed secret storage, preserving native keyrings.
+
+- **Device picker module for `agents run <agent>@` (PHNX-4083).** New
+  `run-device-picker` command module builds the fleet device menu entirely from
+  on-disk state — the device registry, the cached fleet stats, configured roles
+  and descriptions, and the fleet-synced account catalog — with zero SSH, zero
+  network, and no re-probing of stale rows. Source: `src/commands/run-device-picker.ts`.
+
+## 1.22.104
+
+- **Interactive Claude runs on a worker fail loud instead of dropping to the login screen (PHNX-3502 sibling).** `agents run claude --interactive --device auto/<worker>` whose selected account had no synced setup-token used to fall through to Claude Code's "Select login method" screen — an interactive OAuth on a headless box that never persists, so Anthropic re-prompted on the next run (the repeated re-login loop). The run is now refused before spawn with the real fix (pin a live account with `agents run claude#<name>`, set the fleet default with `agents accounts default claude <name>`, or mint the account's token on a headed box with `agents accounts login claude#<name>`). Headless runs are unchanged (they already fail loud with a 401), and headed boxes still show their normal native-login prompt. Source: `cli/src/lib/harness/adapters/claude.ts`, `cli/src/lib/exec.ts`.
+
+- **`agents view` and `agents accounts list` read as name + usage (PHNX-4051).** The
+  account table printed IDENTITY, STATE and WHERE on every row — an email, `UNVERIFIED`
+  and `on 9 boxes` repeated down the whole list — which pushed the usage bars past the
+  terminal width and wrapped every line. A row is now the account name and its usage
+  bars, and nothing else when the account is healthy. Only a state worth acting on
+  trails the row: `rate-limited` (yellow), `expired` / `revoked` / `missing` (red),
+  partial fleet coverage (`usable on 3 of 5 boxes`), then the repair command. A
+  blocking marker (`out of credits`) now renders after the bars instead of in front of
+  them, so one throttled account no longer misaligns the table, and a stale window is
+  `48%* (period ended 2h)` rather than `48% · stale (period ended 2h ago)`. The identity
+  and per-device state the columns carried are still one command away —
+  `agents accounts list --fleet`, `agents accounts view <name>`, `--json`. A discovered
+  login nobody has named is listed by its identity (the email) rather than `unnamed`. Source:
+  `cli/src/lib/account-catalog.ts`, `cli/src/lib/accounting/usage.ts`,
+  `cli/src/commands/view.ts`, `cli/src/commands/accounts.ts`.
+
+- **`agents computer` now uses the standalone `computer` CLI (PHNX-4075).** Install it with `npm i -g @phnx-labs/computer-cli`; `agents setup computer` also installs it when missing. The standalone package owns desktop commands, native helpers, remote provisioning, and VNC transport. Agents retains fleet device resolution, permission groups, session identity, and action history. The separate `computer` npm executable and native helper sources now ship from the standalone project.
+- **Release cleanup preserves unfinished work.** Dirty orchestration, publication, and attestation worktrees remain available with their paths printed. Generated files are restored only after their exact contents are saved in the release PR head; later edits are preserved.
+
+- **A launched agent's own `secrets` calls hit the store agents-cli reads for it (PHNX-4081).** `buildExecEnv` now exports `SECRETS_HOME` (the user agents dir, unless the launching environment set one), the same root the process client already passes the standalone. Before, an agent's `secrets exec` inside a Claude Code or Cursor session ran against a second broker under `~/.secrets` with its own event log, so an unlock in one store was invisible in the other. The pinned standalone moves to `@phnx-labs/secrets-cli@0.1.4`, whose broker keeps `--durable` unlocks across restarts and lets a user-driven agent raise the Touch ID sheet instead of asking for `secrets unlock` by hand. Source: `cli/src/lib/exec.ts`, `cli/src/commands/setup-secrets.ts`.
+
+- **One fewer cold `secrets` process on every command that touches secrets (PHNX-4082).** Each synchronous secrets request spawns a fresh `secrets __serve`, so it pays a full Node boot of the standalone — 0.3–2.6 s on a desktop at load average ~100. The client spent one of those purely to ask which protocol version the standalone speaks, before the first real request of every process. It no longer does: every response envelope already carries `v`, and `parseResponse` checks it on each one. That is also stricter than the handshake it replaces — a standalone that answered the handshake as v1 and a later op as v2 used to surface as "malformed response envelope" and now reports `secrets speaks protocol 2; this agents-cli needs 1`. Measured on `agents run claude`: 7 standalone spawns before, 6 after. Source: `cli/src/lib/secrets-client.ts`, `cli/src/lib/secrets-client.test.ts`, `cli/docs/secrets-client.md`, `cli/docs/specifications.md`.
+
 ## 1.22.103
 
 - **`agents run claude` no longer dies with `secrets request failed: spawnSync sh ETIMEDOUT` on a loaded machine (PHNX-4078).** Every synchronous secrets request spawns a fresh `secrets __serve` process, so its bound has to cover a cold Node boot of the standalone, not just the tens-of-milliseconds operation. The bound was 3 s; on a desktop at load average ~100 each spawn measured 0.4–2.6 s and sometimes more, so the account listing on the launch path timed out and the run aborted before Claude started (also why AGI EXT tabs opened to a bare shell there). The sync bound is now 30 s — enough to boot under load, still well under the standalone's own 60 s self-deadline — and a timeout names the cause ("the standalone secrets CLI did not answer within 30s … check with secrets --version") instead of the raw `spawnSync` errno. Source: `cli/src/lib/secrets-client.ts`, `cli/src/lib/secrets-client.test.ts`, `cli/docs/secrets-client.md`.

package/README.md

@@ -1836,7 +1836,7 @@ Agents are defined in [src/lib/agents.ts](cli/src/lib/agents.ts) -- each is a co
 |---|---|
 | [`cli`](cli) | **The CLI** (this README) — version management, config sync, sessions, teams, cloud, browser, computer, secrets. |
 | [phnx-labs/agi-ext](https://github.com/phnx-labs/agi-ext) | **AGI EXT** — the VS Code extension (agent terminals as tabs + the Fleet dashboard). Moved to its own repo (RUSH-3189); separate product, own publish identity. |
-| [`native/computer-mac`](native/computer-mac) · [`native/computer-win`](native/computer-win) | Native backends behind `agents computer` — Swift (macOS Accessibility + screen capture) and C#/.NET (Windows UI Automation). A third, install-free backend drives a **Linux GUI desktop over VNC/RFB**: `agents computer --vnc <host:port> screenshot` (coordinate-based — screenshot/click/type/key/scroll against any x11vnc/Xvnc server). |
+| `@phnx-labs/computer-cli` | The engine behind `agents computer`, published separately (`npm i -g @phnx-labs/computer-cli`): the Swift macOS Accessibility daemon, the C#/.NET Windows UI Automation daemon, and an install-free **VNC/RFB** backend for a Linux GUI desktop (`agents computer --vnc <host:port> screenshot` — coordinate-based screenshot/click/type/key/scroll against any x11vnc/Xvnc server). agents-cli supplies the app allow list, `--device` fleet resolution, and the action history. |
 | [`packages/session-tracker`](packages/session-tracker) | The `SessionStart` hook that writes live-session state **AGI EXT** reads back (agi-ext `src/core/liveSession.ts`) — not the CLI, which reads transcripts. |
 
 ## Contributing

package/dist/commands/accounts.js

@@ -542,7 +542,7 @@ export function registerAccountsCommand(program) {
         await runAccountsAction(command, () => printAccounts(!!o.json, !!o.fleet));
     });
     const listCmd = accounts.command('list [harness]')
-        .description('List accounts with authentication verdict, device coverage, usage, and exact repair command')
+        .description('List accounts as name + usage, with the state and repair command only when one is needed')
         .option('--json', 'Machine-readable account metadata')
         .option('--fleet', 'Show accounts as rows and devices as columns')
         .action(async (harness, o, command) => {
@@ -554,7 +554,7 @@ export function registerAccountsCommand(program) {
 agents accounts list claude
 agents accounts list --json
 agents accounts list --fleet`,
-        notes: 'One row per account per harness. STATE is the usage snapshot (`deriveUsageStatusFromSnapshot`/`applyUsageHonesty`, never a probe 429 — a throttled probe keeps the previous verdict within 20 min, otherwise `unverified` with `probe throttled (HTTP 429)`; `LIMITED` only when the local usage snapshot is `rate_limited`/`out_of_credits`, remote `rate_limited` only when no local snapshot). WHERE is `this box` when only this device reports; otherwise `on N boxes` when every provisioned device is usable (`live`/`rate_limited`/`unverified`), `on N of M boxes` when some are not, `—` when nothing is provisioned; per-device accounts list present devices. USAGE is the bar + percent (`*` stale). FIX is the exact repair command — empty when there is none. Reserved credential stores are not listed here; `agents secrets` is the place those show.',
+        notes: 'One row per account per harness: the account name, its usage bars (`*` stale), then nothing at all when the account is healthy. A state worth acting on trails the row — `rate-limited` (the usage snapshot via `deriveUsageStatusFromSnapshot`/`applyUsageHonesty`, never a probe 429), `expired`/`revoked`/`missing`, partial fleet coverage (`usable on 3 of 5 boxes`), then the exact repair command. `live`, `unverified`, `ready` and `per-device` are the ordinary cases and print nothing. For the identity behind an account use `agents accounts view <name>`; for per-device state use `--fleet`; for everything use `--json`. Reserved credential stores are not listed here; `agents secrets` is the place those show.',
     });
     registerMintCommand(accounts, undefined, { hidden: true });
     const addCmd = accounts.command('add <target> [name]')

package/dist/commands/computer.d.ts

@@ -1,5 +1,56 @@
+/**
+ * `agents computer` — the consumer surface over the standalone `computer` CLI
+ * (PHNX-4075).
+ *
+ * WHAT THIS FILE IS NOW. Every verb below forwards its arguments verbatim to the
+ * standalone engine and propagates its exit code. agents-cli contributes four
+ * things the engine cannot know:
+ *
+ *   1. the permissions allow list, rendered from `Computer(<bundle-id>)` rules
+ *      in the agents resource layer (`lib/computer/policy.ts`);
+ *   2. the peer allow list, and `--device <name>` resolved against the fleet —
+ *      both carried in the fd-3 context (`lib/computer/context.ts`);
+ *   3. the acting actor and agent session, likewise on fd 3;
+ *   4. a recorder for the action events the engine streams back on fd 4, so
+ *      `agents computer sessions` and `agents sessions --computer` keep their
+ *      history (`lib/computer/record.ts`).
+ *
+ * The remote path is the ENGINE's. `--device <name>` is resolved against the
+ * fleet here — that is what the registry, ssh identity and platform check are
+ * for — and then forwarded to the engine verbatim, which matches the alias
+ * against `context.target` and owns everything downstream of it: pushing the
+ * Windows helper, minting and storing its auth token, opening the `ssh -L`
+ * tunnel, and hydrating its own transport from the state it wrote. agents-cli
+ * keeps no tunnel state and publishes no endpoint: a `COMPUTER_HELPER_TCP` from
+ * here would carry a port without the token the daemon demands, so the verb
+ * would fail `auth_failed` against a tunnel that was up the whole time.
+ *
+ * WHY VERB FLAGS ARE NOT REDECLARED HERE. Each passthrough verb declares only
+ * `--device` — the one flag the consumer must intercept — and takes everything
+ * else as opaque operands via `allowUnknownOption`. Mirroring the engine's flags
+ * would create a second, silently drifting copy of its surface: a flag added
+ * upstream would be rejected here as unknown until someone noticed. The engine
+ * also owns per-verb `--help` for the same reason. What agents-cli keeps is the
+ * verb CATALOG — names, one-line descriptions, help groups — because that is
+ * what makes the surface discoverable from `agents computer --help`, and a
+ * verb the engine drops should fail loud here rather than silently vanish.
+ *
+ * `sessions` is the one verb that never reaches the engine: it reads agents-cli's
+ * own event ledger.
+ */
 import { Command } from 'commander';
-import { resolveHelperExec, resolveSocketPath } from '../lib/computer/computer-rpc.js';
+/**
+ * The verb catalog. Descriptions are the consumer's (they appear in
+ * `agents computer --help`); flags are the engine's.
+ *
+ * This list is the contract with the engine: `computer --verbs` must report the
+ * same names. `computer.test.ts` pins it so a drift shows up as a failing test
+ * rather than a verb that quietly stops existing.
+ */
+export declare const COMPUTER_PASSTHROUGH_VERBS: ReadonlyArray<{
+    name: string;
+    description: string;
+}>;
 /**
  * Pure platform gate. The computer subsystem is macOS-only for LOCAL driving
  * (Accessibility / launchctl). It is NOT blocked off macOS when a remote daemon
@@ -14,97 +65,67 @@ export declare function shouldBlockOffPlatform(opts: {
     device?: string;
 }): boolean;
 /**
- * Sniff the image format from the leading magic bytes: PNG starts with the
- * 8-byte signature `89 50 4E 47` ("\x89PNG"), JPEG with `FF D8 FF`. Returns the
- * canonical file extension, or null for anything else.
+ * Put `--device <name>` back on the argv handed to the engine.
+ *
+ * commander CONSUMES the `--device` it declares, so a verb that only read
+ * `opts.device` forwarded an argv with no remote selector in it and the engine
+ * — which selects the remote path from its own argv — ran the invocation
+ * LOCALLY. That is how `setup --device win-mini` installed the macOS helper on
+ * the laptop. The flag is re-inserted immediately after the verb rather than
+ * appended, so a verb whose operands are variadic cannot swallow it.
+ *
+ * Pure, so the re-insertion is testable without spawning the engine.
  */
-export declare function detectImageFormat(buf: Buffer): '.png' | '.jpg' | null;
+export declare function withDeviceFlag(argv: string[], device?: string): string[];
 /**
- * Make the screenshot filename honest about its bytes. The two helper backends
- * encode DIFFERENT formats and neither re-encodes to match the requested name:
- * the macOS helper (ScreenCaptureKit) returns JPEG
- * (native/computer-mac/Sources/ComputerHelper/Screenshot.swift:207,212),
- * the Windows helper returns PNG
- * (native/computer-win/Screenshot.cs:33). So a fixed default extension
- * cannot be correct for both — the only honest path is to sniff the real format
- * and swap the extension to match. Pure so it's unit-testable.
+ * Forward one invocation to the engine and propagate its exit code.
  *
- * Returns the path to write to (caller's path with its extension corrected) and
- * whether a correction was made. Unknown formats pass through unchanged.
+ * A missing standalone is the one failure agents-cli reports itself, because it
+ * is the one the engine cannot: it prints the install line and exits 1. There is
+ * no fallback engine to reach for — that is the point of the extraction.
  */
-export declare function reconcileScreenshotExt(outPath: string, buf: Buffer): {
-    path: string;
-    corrected: boolean;
-};
+export declare function forwardToComputer(opts: {
+    argv: string[];
+    device?: string;
+    /** Skip recording — lifecycle verbs are not user actions. */
+    record?: boolean;
+    /** Read the engine's stdout instead of letting it reach the terminal. */
+    capture?: boolean;
+}): Promise<{
+    exitCode: number;
+    stdout: string;
+}>;
 export declare function registerComputerCommand(program: Command): void;
 export declare function registerComputerSubcommands(program: Command): void;
-export declare function buildRestartTaskScript(taskName: string, exeName: string): string;
 /**
- * Emit a `computer.action` marker for `computer run`'s whole loop process, so
- * `agents computer sessions` groups every verb the loop drives under one
- * task-labeled row instead of a bare pid with no task text (see
- * lib/computer/sessions-list.ts's "Grouping key" docblock note). The task
- * text is bounded to `TASK_PREVIEW_MAX_CHARS` — never the full unbounded
- * `--task` string — matching that module's retention/privacy note. Exported
- * so the truncation behavior is directly unit-testable against the real
- * event ledger, the same seam `computer-actions.test.ts` already uses for
- * `emitComputerAction`.
+ * Install the macOS helper through the engine. Used by the `agents setup
+ * computer` wizard, which still owns the TCC hand-holding — that is a
+ * conversation with the user, not a daemon operation.
  */
-export declare function emitComputerRunTaskMarker(opts: {
-    task: string;
-    bundle?: string;
-    device?: string;
-}): void;
+export declare function installComputerHelperMacLocal(): Promise<void>;
 /**
- * launchd Label for this process's helper — the production identifier for a real
- * invocation, namespaced under a redirected HOME (RUSH-2639). launchd routes
- * bootout/bootstrap/kickstart/print by identifier alone, never by the plist's
- * path, so without this a process running under a sandbox HOME tears down the
- * operator's live helper.
- */
-export declare function helperLabel(): string;
-/**
- * Install the macOS helper locally: resolve (or download + verify) the signed,
- * notarized .app, copy it to /Applications, verify the destination signature,
- * and write the LaunchAgent plist (inactive — activation is a separate opt-in
- * step via `start`). Throws on any failure. Shared by `agents computer setup`
- * and the unified `agents setup computer` wizard so there is one install path.
- */
-export declare function installComputerHelperMacLocal(): Promise<{
-    appDest: string;
-    plistPath: string;
-}>;
-/**
- * Activate the local helper daemon via launchd (render policy + peers, bootout
- * → bootstrap → kickstart, wait for the socket, probe AX trust). Throws on any
- * failure. Returns the trust status so callers can guide the permission grant.
- * Shared by `agents computer start` and the `agents setup computer` wizard.
+ * Activate the local daemon through the engine and report whether Accessibility
+ * trust is granted, so the wizard knows whether to walk the user to System
+ * Settings.
  */
 export declare function activateComputerHelperMacLocal(): Promise<{
     trusted: boolean;
-    socketPath: string;
-    logPath: string;
 }>;
-/** Probe the running daemon's Accessibility trust status without re-activating.
- * Returns false (never throws) if the socket is down or the RPC errors — used to
- * poll while the user grants permissions in System Settings. */
-export declare function probeComputerTrust(): Promise<boolean>;
 /**
- * The helper's launchd plist.
+ * Read `trusted` out of `computer status --json`.
+ *
+ * Tolerant by construction: the engine may print a banner line before its JSON,
+ * so scan for the first parseable object rather than assuming the whole stream
+ * is JSON. Pure, so the parsing contract is testable without a daemon.
+ */
+export declare function parseTrustFromStatusJson(stdout: string): boolean;
+/**
+ * Probe Accessibility trust without re-activating. Returns false (never throws)
+ * when the engine is absent, the daemon is down, or the probe errors — the
+ * wizard polls this while the user grants permissions in System Settings, and a
+ * throw there would abort the very flow that fixes it.
  *
- * The `EnvironmentVariables` dict carries HOME (RUSH-2639, see
- * `lib/service-manifest.ts`): launchd applies this dict on top of the LOGIN
- * SESSION's environment, never the environment of whoever called `launchctl
- * bootstrap`, so a manifest that omits HOME hands the helper the account home no
- * matter which home the caller resolved. That is a silent escape from any
- * redirected HOME — the hermetic test harness's, and an agent's isolated version
- * home alike.
+ * This is the ONE place agents-cli reads engine stdout instead of passing it
+ * through, because it needs an answer rather than a display.
  */
-export declare function renderLaunchAgentPlist(opts: {
-    label: string;
-    exec: string;
-    socketPath: string;
-    logPath: string;
-}): string;
-export { resolveHelperExec as resolveHelperPath };
-export { resolveSocketPath };
+export declare function probeComputerTrust(): Promise<boolean>;