@phnx-labs/agents-cli 1.22.13 → 1.22.14

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## 1.22.14
+
+- **`agents secrets view <bundle> --reveal` now resolves a locked keychain bundle
+  interactively at a real terminal.** The command hardcoded `agentOnly: true` on
+  both reveal call sites (`commands/secrets.ts`), so an explicit human `--reveal`
+  on a locked bundle went through the broker-only path and errored with an unlock
+  hint instead of raising the one Touch ID sheet the human just asked for. The
+  `agentOnly` flag is now `isHeadlessSecretsContext() || !isInteractiveTerminal()`
+  — under an agent (`AGENTS_RUNTIME`) or with no TTY it stays broker-only and
+  never prompts, but a deliberate `--reveal` typed at an interactive terminal
+  resolves the value with a single biometric sheet. This mirrors the existing
+  `reveal && !isInteractiveTerminal()` guard a few lines up. `export --plaintext`
+  and `exec` are untouched — they stay intentionally silent for release/CI
+  scripts. Source: `apps/cli/src/commands/secrets.ts`.
+
+- **`agents sessions optimize` — compact the FTS5 session search index.** The scanner delete+inserts a session's docs into the `tool_call_text` / `session_text` full-text indexes on every rescan, and FTS5 never merges the resulting segments on its own — so over thousands of sessions the `%_data` shadow tables bloat with hundreds of thousands of unmerged segments (observed on a real fleet box: 701 MB of index for ~69 MB of content, 196K segments) and `agents sessions` slows to a crawl / hangs. The new command runs FTS5 `'optimize'` (merge all segments, purge tombstones), non-destructively — no searchable content is lost. Reclaimed space frees as reusable pages inside the DB file (VACUUM with the daemon stopped returns it to disk); wireable to a weekly routine so the index never re-bloats. Source: `apps/cli/src/lib/session/db.ts` (`optimizeSessionSearchIndex`), `apps/cli/src/commands/sessions-optimize.ts`.
+
 ## 1.22.13
 
 - **`agents sessions` accepts direct live-state flags and remains fleet-wide by default.** `--working`, `--idle`, `--waiting`, `--orphan`/`--orphaned`, `--crashed`, `--closed`, `--abandoned`, `--queued`, and `--unknown` each imply the live scan; multiple flags form a union. `--working` is narrower than `--active`: it excludes idle, waiting, and lifecycle-failure rows. Cross-device collection was already the default and stays that way; `--local` opts out, while `--all` continues to widen historical directory and time scope. Source: `apps/cli/src/commands/sessions.ts`, `apps/cli/src/commands/sessions.test.ts`.

package/dist/commands/secrets.js

@@ -18,7 +18,7 @@ import { ensureDaemonStarted, isDaemonRunning } from '../lib/daemon.js';
 import { parseHostsOption, remoteResolveEnv, remoteSecretsRaw, remoteSecretsStream, resolveHostSshTarget, verifyRemoteKeychainPush, keychainWriteFailureMessage, } from '../lib/secrets/remote.js';
 import { remoteShellFor, buildWindowsStdinImportCommand } from '../lib/hosts/remote-cmd.js';
 import { resolveRemoteOsSync } from '../lib/hosts/remote-os.js';
-import { bundleBackend, bundleExists, bundleItemStore, bundlePolicy, deleteBundle, describeBundle, keychainItemsForBundle, keychainRef, listBundles, healKeychainBundleMetadataAclOnce, migrateLegacyBundles, parseDotenv, readAndResolveBundleEnv, readBundle, readBundleIfDecryptable, reAclBundleItems, renameBundle, rotateBundleSecret, sanitizeProcessEnv, validateBundleName, validateEnvKey, validateExpiresFutureDated, validateSecretType, writeBundle, writeBundleWithItems, SECRET_TYPES, } from '../lib/secrets/bundles.js';
+import { bundleBackend, bundleExists, bundleItemStore, bundlePolicy, deleteBundle, describeBundle, keychainItemsForBundle, keychainRef, listBundles, healKeychainBundleMetadataAclOnce, isHeadlessSecretsContext, migrateLegacyBundles, parseDotenv, readAndResolveBundleEnv, readBundle, readBundleIfDecryptable, reAclBundleItems, renameBundle, rotateBundleSecret, sanitizeProcessEnv, validateBundleName, validateEnvKey, validateExpiresFutureDated, validateSecretType, writeBundle, writeBundleWithItems, SECRET_TYPES, } from '../lib/secrets/bundles.js';
 import { parseListFilters, bundleMatchesFilter, bundleExpiry, filterIsActive, describeFilter, parseSortField, sortBundles, SORT_FIELDS, REF_KINDS, DEFAULT_EXPIRING_DAYS, } from '../lib/secrets/list-filter.js';
 import { encryptForFallback, decryptForFallback } from '../lib/secrets/filestore.js';
 import { getKeychainToken, hasKeychainToken, secretsKeychainItem, setKeychainToken, maybeAutoRekey, } from '../lib/secrets/index.js';
@@ -1254,7 +1254,10 @@ export function registerSecretsCommands(program) {
                     const { env } = readAndResolveBundleEnv(bundle.name, {
                         caller: 'view --reveal --json',
                         keyMode: 'storage',
-                        agentOnly: true,
+                        // An explicit human `--reveal` at a terminal is a deliberate value
+                        // access → resolve interactively (one Touch ID). Under an agent
+                        // (AGENTS_RUNTIME) or headless (no TTY) it stays broker-only.
+                        agentOnly: isHeadlessSecretsContext() || !isInteractiveTerminal(),
                     });
                     for (const entry of entries) {
                         if (entry.kind === 'keychain' && env[entry.key] !== undefined) {
@@ -1369,15 +1372,16 @@ export function registerSecretsCommands(program) {
                 console.error(chalk.red('--reveal in a non-TTY requires --plaintext.'));
                 process.exit(1);
             }
-            // Resolve through the broker / durable-session path. A locked keychain
-            // bundle errors with the explicit unlock hint; viewing never raises a
-            // Touch ID sheet itself.
+            // An explicit human `view --reveal` at a terminal is a deliberate value
+            // access: resolve interactively (one Touch ID) so a locked bundle shows
+            // its values. Under an agent (AGENTS_RUNTIME) or headless (no TTY) it
+            // stays broker-only and errors with the unlock hint — never a sheet.
             const revealedValues = new Map();
             if (reveal) {
                 const { env } = readAndResolveBundleEnv(bundle.name, {
                     caller: 'view --reveal',
                     keyMode: 'storage',
-                    agentOnly: true,
+                    agentOnly: isHeadlessSecretsContext() || !isInteractiveTerminal(),
                 });
                 for (const entry of entries) {
                     if (entry.kind === 'keychain' && env[entry.key] !== undefined) {

package/dist/commands/sessions-optimize.d.ts

@@ -0,0 +1,14 @@
+/**
+ * `agents sessions optimize` — compact the FTS5 session/tool-call search index.
+ *
+ * The scanner delete+inserts a session's docs into the `tool_call_text` /
+ * `session_text` FTS5 indexes on every rescan (and on every extractor-version
+ * bump), and FTS5 never merges the resulting segments on its own. Over thousands
+ * of sessions and re-index passes the `%_data` shadow tables bloat with hundreds
+ * of thousands of unmerged segments — gigabytes of index for tens of MB of
+ * actual content — and `agents sessions` queries slow to a crawl. This runs the
+ * FTS5 `'optimize'` command to merge every segment into one and purge tombstones.
+ * Non-destructive: no searchable content is lost.
+ */
+import type { Command } from 'commander';
+export declare function registerSessionsOptimizeCommand(sessionsCmd: Command): void;

package/dist/commands/sessions-optimize.js

@@ -0,0 +1,41 @@
+import chalk from 'chalk';
+import { optimizeSessionSearchIndex } from '../lib/session/db.js';
+import { setHelpSections } from '../lib/help.js';
+export function registerSessionsOptimizeCommand(sessionsCmd) {
+    const cmd = sessionsCmd
+        .command('optimize')
+        .description('Compact the session search index (FTS5), reclaiming bloat from repeated re-indexing')
+        .option('--json', 'Emit machine-readable JSON')
+        .action((_opts, c) => {
+        const opts = c.optsWithGlobals();
+        const results = optimizeSessionSearchIndex();
+        if (opts.json) {
+            console.log(JSON.stringify(results, null, 2));
+            return;
+        }
+        for (const r of results) {
+            const merged = Math.max(0, r.segmentsBefore - r.segmentsAfter);
+            console.log(`  ${chalk.cyan(r.table)}: ${r.segmentsBefore} -> ${r.segmentsAfter} segments ` +
+                `(${chalk.green(merged)} merged)`);
+        }
+        console.log(chalk.gray('  Reclaimed space stays as reusable pages inside the file; VACUUM (daemon stopped) returns it to disk.'));
+    });
+    setHelpSections(cmd, {
+        examples: `
+      # Compact the session/tool search index once it has grown fragmented
+      agents sessions optimize
+
+      # Machine-readable segment counts
+      agents sessions optimize --json
+
+      # Wire it to a weekly routine so the index never re-bloats
+      agents routines add sessions-optimize --schedule "0 4 * * 0" --agent claude \\
+        --prompt "Run: agents sessions optimize"
+    `,
+        notes: `
+      - FTS5 appends a segment on every insert and tombstones every delete; the scanner delete+inserts a session's docs on each rescan and never self-merges, so \`tool_call_text_data\` / \`session_text_data\` bloat with unmerged segments — GBs of index for tens of MB of content, and queries slow down.
+      - This runs FTS5 \`'optimize'\`: it merges every segment into one and purges tombstones. Non-destructive — no searchable content is lost.
+      - Reclaimed space becomes reusable free pages inside the DB file. To return it to the OS, stop the daemon (\`agents routines stop\`) and run \`VACUUM\` against \`~/.agents/.history/sessions/sessions.db\`.
+    `,
+    });
+}

package/dist/commands/sessions.js

@@ -61,6 +61,7 @@ import { registerSessionsImportCommand } from './sessions-import.js';
 import { registerSessionsMigrateCommand, registerSessionsMigrationsCommand } from './sessions-migrate.js';
 import { registerSessionsBackfillCommand } from './sessions-backfill.js';
 import { registerSessionsStatsCommand } from './sessions-stats.js';
+import { registerSessionsOptimizeCommand } from './sessions-optimize.js';
 import { runBrowserSessions } from '../lib/browser/sessions-list.js';
 import { countToolProgramOccurrences, parseToolProgramCountClause, readToolIndexCoverage, searchToolCalls, TOOL_QUERY_MAX_CLAUSE_BYTES, TOOL_QUERY_MAX_CLAUSES, TOOL_QUERY_MAX_RESULT_SESSIONS, serializeToolSearchEnvelope, toolSearchRemoteReceiveBudget, } from '../lib/session/tool-index.js';
 const SESSION_AGENT_FILTER_HELP = `Filter by agent, e.g. claude, codex, claude@2.0.65`;
@@ -3811,6 +3812,7 @@ export function registerSessionsCommands(program) {
     registerSessionsMigrationsCommand(sessionsCmd);
     registerSessionsBackfillCommand(sessionsCmd);
     registerSessionsStatsCommand(sessionsCmd);
+    registerSessionsOptimizeCommand(sessionsCmd);
     // Observe-umbrella alias (Phase 3): roster → sessions --active.
     registerSessionsObserveAliases(program);
 }

package/dist/lib/session/db.d.ts

@@ -120,6 +120,25 @@ export interface QueryOptions {
 export declare function getDB(): Database.Database;
 /** Close the cached database connection. */
 export declare function closeDB(): void;
+export interface FtsOptimizeResult {
+    table: string;
+    segmentsBefore: number;
+    segmentsAfter: number;
+}
+/**
+ * Compact the session + tool-call full-text-search indexes.
+ *
+ * FTS5 appends a new segment on every insert and leaves a tombstone on every
+ * delete. The scanner delete+inserts a session's docs on each rescan (and on
+ * every extractor-version bump), and FTS5 never merges those segments on its
+ * own — so `tool_call_text_data` / `session_text_data` accumulate hundreds of
+ * thousands of unmerged segments, gigabytes of index for tens of MB of content,
+ * and `agents sessions` queries slow to a crawl. The FTS5 `'optimize'` command
+ * merges every segment into one and purges tombstones. Non-destructive: no
+ * searchable content is lost. Reclaimed space becomes reusable free pages inside
+ * the DB file; run VACUUM (with the daemon stopped) to return it to the OS.
+ */
+export declare function optimizeSessionSearchIndex(): FtsOptimizeResult[];
 /**
  * Try to claim the right to run the incremental scan. Returns true if this
  * process should proceed with scanning, false if another live process is

package/dist/lib/session/db.js

@@ -820,6 +820,30 @@ export function closeDB() {
         cachedStmts = {};
     }
 }
+/**
+ * Compact the session + tool-call full-text-search indexes.
+ *
+ * FTS5 appends a new segment on every insert and leaves a tombstone on every
+ * delete. The scanner delete+inserts a session's docs on each rescan (and on
+ * every extractor-version bump), and FTS5 never merges those segments on its
+ * own — so `tool_call_text_data` / `session_text_data` accumulate hundreds of
+ * thousands of unmerged segments, gigabytes of index for tens of MB of content,
+ * and `agents sessions` queries slow to a crawl. The FTS5 `'optimize'` command
+ * merges every segment into one and purges tombstones. Non-destructive: no
+ * searchable content is lost. Reclaimed space becomes reusable free pages inside
+ * the DB file; run VACUUM (with the daemon stopped) to return it to the OS.
+ */
+export function optimizeSessionSearchIndex() {
+    const db = getDB();
+    // Hardcoded literals — never interpolate caller input into an identifier.
+    const tables = ['tool_call_text', 'session_text'];
+    const segments = (table) => db.prepare(`SELECT count(*) AS n FROM ${table}_data`).get().n;
+    return tables.map((table) => {
+        const segmentsBefore = segments(table);
+        db.prepare(`INSERT INTO ${table}(${table}) VALUES('optimize')`).run();
+        return { table, segmentsBefore, segmentsAfter: segments(table) };
+    });
+}
 // ---------------------------------------------------------------------------
 // Scan coordinator — prevents concurrent full scans across processes
 // ---------------------------------------------------------------------------

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@phnx-labs/agents-cli",
-  "version": "1.22.13",
+  "version": "1.22.14",
   "description": "One CLI for all your AI coding agents - versions, config, cloud dispatch, sessions, and teams (now with first-class Grok Build CLI support)",
   "type": "module",
   "main": "dist/index.js",