@phnx-labs/agents-cli 1.22.26 → 1.22.27

package/dist/lib/secrets/lease.js

@@ -0,0 +1,44 @@
+import { randomBytes } from 'crypto';
+import { GLOBAL_HARNESS } from './scope.js';
+export const MIN_LEASE_MS = 60 * 1000;
+export const MAX_LEASE_MS = 30 * 24 * 60 * 60 * 1000;
+export function clampLeaseTtlMs(ttlMs) {
+    if (!Number.isFinite(ttlMs) || ttlMs <= 0) {
+        throw new Error('Lease duration must be a positive finite number.');
+    }
+    return Math.min(Math.max(Math.floor(ttlMs), MIN_LEASE_MS), MAX_LEASE_MS);
+}
+export function normalizeLeaseKeys(keys, availableKeys) {
+    const requested = [...new Set(keys.map((key) => key.trim()).filter(Boolean))].sort();
+    if (requested.length === 0)
+        throw new Error('A secret lease requires at least one key.');
+    const available = new Set(availableKeys);
+    const missing = requested.filter((key) => !available.has(key));
+    if (missing.length > 0)
+        throw new Error(`Unknown secret lease key(s): ${missing.join(', ')}`);
+    return requested;
+}
+export function createSecretLease(input) {
+    const createdAt = input.now ?? Date.now();
+    const ttlMs = clampLeaseTtlMs(input.ttlMs);
+    return {
+        id: input.id ?? randomBytes(12).toString('hex'),
+        bundle: input.bundle,
+        keys: normalizeLeaseKeys(input.keys, input.availableKeys),
+        createdAt,
+        expiresAt: createdAt + ttlMs,
+        harness: input.harness ?? GLOBAL_HARNESS,
+        sleepPersist: input.sleepPersist ?? false,
+    };
+}
+export function leaseIsActive(lease, now = Date.now()) {
+    return now < lease.expiresAt;
+}
+export function selectLeasedEnv(lease, env, now = Date.now()) {
+    if (!leaseIsActive(lease, now))
+        throw new Error(`Secret lease '${lease.id}' has expired.`);
+    const missing = lease.keys.filter((key) => typeof env[key] !== 'string');
+    if (missing.length > 0)
+        throw new Error(`Secret lease '${lease.id}' is missing value(s): ${missing.join(', ')}`);
+    return Object.fromEntries(lease.keys.map((key) => [key, env[key]]));
+}

package/dist/lib/self-update.d.ts

@@ -136,15 +136,30 @@ export declare function verifyInstalledVersion(packageRoot: string, expectedVers
  */
 export declare function refreshAliasShims(packageRoot: string): void;
 export interface AgentsCliInstall {
-    /** The PATH entry (`<dir>/agents`) that resolves to this install. */
-    binPath: string;
+    /** The PATH entry (`<dir>/agents`) that resolves to this install, when found through PATH. */
+    binPath?: string;
     /** Package root containing package.json and dist/. */
     packageRoot: string;
     version: string;
+    /** Whether this copy uses the serialized, atomic helper-bundle installer. */
+    atomicHelperInstall: boolean;
 }
+export interface FindAgentsCliInstallsOptions {
+    homeDir?: string;
+    fnmDir?: string;
+    npmCacheDir?: string;
+    globalNodeModulesDirs?: string[];
+}
+export interface MultiInstallInventoryEntry {
+    packageRoot: string;
+    version: string;
+    note: string;
+}
+export declare function buildMultiInstallInventory(runningRoot: string, runningVersion: string, installs: AgentsCliInstall[]): MultiInstallInventoryEntry[];
 /**
- * Scan PATH for `agents` entrypoints and resolve each to the agents-cli
- * package root it executes. More than one distinct root means upgrades,
+ * Resolve every `agents` entrypoint on PATH, then inspect the bounded global
+ * install layouts used by NVM, fnm, Volta, Bun, npm, and npx. More than one
+ * distinct package root means upgrades,
  * shims, and the command the user types can act on different copies — the
  * divergence behind silently-failing self-updates.
  *
@@ -158,4 +173,4 @@ export interface AgentsCliInstall {
  * @phnx-labs/agents-cli is some other tool and is skipped.
  * POSIX-only: Windows npm bins are .cmd wrappers, not symlinks.
  */
-export declare function findAgentsCliInstalls(pathEnv: string): AgentsCliInstall[];
+export declare function findAgentsCliInstalls(pathEnv: string, opts?: FindAgentsCliInstallsOptions): AgentsCliInstall[];

package/dist/lib/self-update.js

@@ -327,9 +327,89 @@ function packageRootForEntry(real) {
     }
     return null;
 }
+export function buildMultiInstallInventory(runningRoot, runningVersion, installs) {
+    const byRoot = new Map();
+    byRoot.set(runningRoot, { packageRoot: runningRoot, version: runningVersion, note: 'running' });
+    for (const install of installs) {
+        const notes = [install.packageRoot === runningRoot
+                ? 'running'
+                : install.binPath
+                    ? `agents on PATH: ${install.binPath}`
+                    : 'discovered install'];
+        if (!install.atomicHelperInstall)
+            notes.push('unsafe legacy helper installer — remove this copy');
+        byRoot.set(install.packageRoot, {
+            packageRoot: install.packageRoot,
+            version: install.version,
+            note: notes.join('; '),
+        });
+    }
+    return [...byRoot.values()];
+}
+function childDirectories(parent) {
+    try {
+        return fs.readdirSync(parent, { withFileTypes: true })
+            .filter((entry) => entry.isDirectory())
+            .map((entry) => path.join(parent, entry.name));
+    }
+    catch {
+        return [];
+    }
+}
+function knownPackageRoots(opts) {
+    const homeDir = opts.homeDir ?? os.homedir();
+    const fnmRoots = opts.fnmDir !== undefined
+        ? [opts.fnmDir]
+        : [process.env.FNM_DIR, path.join(homeDir, '.local', 'share', 'fnm')]
+            .filter((value) => Boolean(value));
+    const roots = [];
+    const packageTail = path.join('lib', 'node_modules', ...NPM_PACKAGE_NAME.split('/'));
+    for (const nodeDir of childDirectories(path.join(homeDir, '.nvm', 'versions', 'node'))) {
+        roots.push(path.join(nodeDir, packageTail));
+    }
+    for (const fnmRoot of fnmRoots) {
+        for (const versionDir of childDirectories(path.join(fnmRoot, 'node-versions'))) {
+            roots.push(path.join(versionDir, 'installation', packageTail));
+        }
+    }
+    roots.push(path.join(homeDir, '.volta', 'tools', 'image', 'packages', ...NPM_PACKAGE_NAME.split('/'), packageTail), path.join(homeDir, '.local', packageTail), path.join(homeDir, '.bun', 'install', 'global', 'node_modules', ...NPM_PACKAGE_NAME.split('/')));
+    const npmCacheDir = opts.npmCacheDir ?? process.env.npm_config_cache ?? path.join(homeDir, '.npm');
+    for (const npxRunDir of childDirectories(path.join(npmCacheDir, '_npx'))) {
+        roots.push(path.join(npxRunDir, 'node_modules', ...NPM_PACKAGE_NAME.split('/')));
+    }
+    const globalNodeModulesDirs = opts.globalNodeModulesDirs ?? [
+        '/opt/homebrew/lib/node_modules',
+        '/usr/local/lib/node_modules',
+        '/usr/lib/node_modules',
+    ];
+    for (const nodeModulesDir of globalNodeModulesDirs) {
+        roots.push(path.join(nodeModulesDir, ...NPM_PACKAGE_NAME.split('/')));
+    }
+    return roots;
+}
+function readAgentsCliInstall(packageRoot, binPath) {
+    let canonicalRoot;
+    let pkg;
+    try {
+        canonicalRoot = fs.realpathSync(packageRoot);
+        pkg = JSON.parse(fs.readFileSync(path.join(canonicalRoot, 'package.json'), 'utf-8'));
+    }
+    catch {
+        return null;
+    }
+    if (pkg.name !== NPM_PACKAGE_NAME || typeof pkg.version !== 'string')
+        return null;
+    return {
+        ...(binPath ? { binPath } : {}),
+        packageRoot: canonicalRoot,
+        version: pkg.version,
+        atomicHelperInstall: fs.existsSync(path.join(canonicalRoot, 'dist', 'lib', 'app-bundle-install.js')),
+    };
+}
 /**
- * Scan PATH for `agents` entrypoints and resolve each to the agents-cli
- * package root it executes. More than one distinct root means upgrades,
+ * Resolve every `agents` entrypoint on PATH, then inspect the bounded global
+ * install layouts used by NVM, fnm, Volta, Bun, npm, and npx. More than one
+ * distinct package root means upgrades,
  * shims, and the command the user types can act on different copies — the
  * divergence behind silently-failing self-updates.
  *
@@ -343,11 +423,17 @@ function packageRootForEntry(real) {
  * @phnx-labs/agents-cli is some other tool and is skipped.
  * POSIX-only: Windows npm bins are .cmd wrappers, not symlinks.
  */
-export function findAgentsCliInstalls(pathEnv) {
+export function findAgentsCliInstalls(pathEnv, opts = {}) {
     if (process.platform === 'win32')
         return [];
     const installs = [];
     const seenRoots = new Set();
+    const addInstall = (install) => {
+        if (!install || seenRoots.has(install.packageRoot))
+            return;
+        seenRoots.add(install.packageRoot);
+        installs.push(install);
+    };
     for (const dir of pathEnv.split(path.delimiter).filter(Boolean)) {
         const candidate = path.join(dir, 'agents');
         let real;
@@ -360,19 +446,10 @@ export function findAgentsCliInstalls(pathEnv) {
         const packageRoot = packageRootForEntry(real);
         if (!packageRoot)
             continue;
-        if (seenRoots.has(packageRoot))
-            continue;
-        let pkg;
-        try {
-            pkg = JSON.parse(fs.readFileSync(path.join(packageRoot, 'package.json'), 'utf-8'));
-        }
-        catch {
-            continue;
-        }
-        if (pkg.name !== NPM_PACKAGE_NAME || typeof pkg.version !== 'string')
-            continue;
-        seenRoots.add(packageRoot);
-        installs.push({ binPath: candidate, packageRoot, version: pkg.version });
+        addInstall(readAgentsCliInstall(packageRoot, candidate));
+    }
+    for (const packageRoot of knownPackageRoots(opts)) {
+        addInstall(readAgentsCliInstall(packageRoot));
     }
     return installs;
 }

package/dist/lib/session/db.d.ts

@@ -12,7 +12,7 @@ import { type IndexedToolCall } from './tool-calls.js';
 /** Current schema version; bumped when migrations are added. Exported so tests
  * assert against the constant instead of hardcoding a number that every bump
  * then has to chase (docs/05-sessions.md calls the constant the source of truth). */
-export declare const SCHEMA_VERSION = 36;
+export declare const SCHEMA_VERSION = 37;
 /**
  * Bump to force `agents sessions backfill resources` to re-derive every
  * session's skill/slash-command tallies on its next run (resource_scan_ledger
@@ -26,7 +26,8 @@ export declare const RESOURCE_INDEX_VERSION = 1;
  * re-derives on the next `agents insights` instead of silently reporting stale
  * numbers alongside fresh ones. Same role as RESOURCE_INDEX_VERSION.
  */
-export declare const INSIGHTS_EXTRACTOR_VERSION = 4;
+/** Bump when facet extraction changes so cached rows recompute (stalls-by-model v6). */
+export declare const INSIGHTS_EXTRACTOR_VERSION = 6;
 /** Raw row shape returned from the sessions table. */
 export interface SessionRow {
     id: string;
@@ -50,7 +51,11 @@ export interface SessionRow {
     message_count: number | null;
     token_count: number | null;
     output_tokens: number | null;
+    input_tokens: number | null;
+    cache_read_tokens: number | null;
+    cache_write_tokens: number | null;
     cost_usd: number | null;
+    cost_usd_nocache: number | null;
     duration_ms: number | null;
     model: string | null;
     tool_call_count: number | null;
@@ -335,11 +340,23 @@ export interface UsageRollupRow {
      */
     label?: string;
     costUsd: number;
+    /**
+     * USD cost priced as if caching were off (cache read/write at the input rate),
+     * summed from `cost_usd_nocache`. Backs `agents output --pricing no-cache`.
+     * Equals `costUsd` for rows whose sessions record no cache split (RUSH-2287).
+     */
+    costUsdNoCache: number;
     durationMs: number;
     sessionCount: number;
     tokenCount: number;
     /** Real generated (output) tokens — excludes cache-read/-write context. */
     outputTokens: number;
+    /** Uncached input tokens summed across the group (0 where no harness recorded a split). */
+    inputTokens: number;
+    /** Cache-read tokens summed across the group. */
+    cacheReadTokens: number;
+    /** Cache-write (cache-creation) tokens summed across the group. */
+    cacheWriteTokens: number;
 }
 /** What to group a usage rollup by. */
 /**

package/dist/lib/session/db.js

@@ -26,7 +26,7 @@ const DB_PATH = getSessionsDbPath();
 /** Current schema version; bumped when migrations are added. Exported so tests
  * assert against the constant instead of hardcoding a number that every bump
  * then has to chase (docs/05-sessions.md calls the constant the source of truth). */
-export const SCHEMA_VERSION = 36;
+export const SCHEMA_VERSION = 37;
 /**
  * Bump to force `agents sessions backfill resources` to re-derive every
  * session's skill/slash-command tallies on its next run (resource_scan_ledger
@@ -81,7 +81,11 @@ CREATE TABLE IF NOT EXISTS sessions (
   message_count INTEGER,
   token_count INTEGER,
   output_tokens INTEGER,
+  input_tokens INTEGER,
+  cache_read_tokens INTEGER,
+  cache_write_tokens INTEGER,
   cost_usd REAL,
+  cost_usd_nocache REAL,
   duration_ms INTEGER,
   model TEXT,
   tool_call_count INTEGER,
@@ -308,7 +312,8 @@ CREATE TABLE IF NOT EXISTS session_insights (
  * re-derives on the next `agents insights` instead of silently reporting stale
  * numbers alongside fresh ones. Same role as RESOURCE_INDEX_VERSION.
  */
-export const INSIGHTS_EXTRACTOR_VERSION = 4;
+/** Bump when facet extraction changes so cached rows recompute (stalls-by-model v6). */
+export const INSIGHTS_EXTRACTOR_VERSION = 6;
 let dbInstance = null;
 /**
  * Apply schema migrations from `fromVersion` → SCHEMA_VERSION. The new
@@ -875,6 +880,25 @@ function migrateSchema(db, fromVersion) {
       FROM tool_calls;
     `);
     }
+    if (fromVersion < 37) {
+        // v36 -> v37: persist the burn SPLIT (uncached input / cache-read /
+        // cache-write) and a second "no-cache" cost per session, so `agents output`
+        // can report the token split and a --pricing no-cache scenario (RUSH-2287).
+        // These are new nullable columns — do NOT flush scan_ledger (adding a column
+        // must keep warm session ledgers warm, the contract the v33->v34 note above
+        // states). Pre-upgrade rows stay NULL for the split until their transcript is
+        // re-scanned; `agents output` reports the split only where it is present, so
+        // an absent split reads as "not available for this session", never as zero.
+        const cols = new Set(db.prepare(`PRAGMA table_info(sessions)`).all().map((c) => c.name));
+        if (!cols.has('input_tokens'))
+            db.exec(`ALTER TABLE sessions ADD COLUMN input_tokens INTEGER`);
+        if (!cols.has('cache_read_tokens'))
+            db.exec(`ALTER TABLE sessions ADD COLUMN cache_read_tokens INTEGER`);
+        if (!cols.has('cache_write_tokens'))
+            db.exec(`ALTER TABLE sessions ADD COLUMN cache_write_tokens INTEGER`);
+        if (!cols.has('cost_usd_nocache'))
+            db.exec(`ALTER TABLE sessions ADD COLUMN cost_usd_nocache REAL`);
+    }
 }
 /**
  * Stamp `account_key` / `account_org` / `account` on every Claude row from its
@@ -1369,7 +1393,8 @@ const upsertSessionStmt = (db) => db.prepare(`
     id, short_id, agent, origin, routine_name, routine_run_id,
     version, account, account_key, account_org, mode, timestamp, last_activity,
     project, cwd, git_branch, topic, label, message_count, token_count,
-    output_tokens, cost_usd, duration_ms, model, tool_call_count,
+    output_tokens, input_tokens, cache_read_tokens, cache_write_tokens,
+    cost_usd, cost_usd_nocache, duration_ms, model, tool_call_count,
     file_path, file_mtime_ms, file_size, scanned_at, is_team_origin,
     pr_url, pr_number, worktree_slug, ticket_id, spawned_team, plan, todos,
     recent_directories_touched, linear_project, linear_project_url, machine,
@@ -1378,7 +1403,8 @@ const upsertSessionStmt = (db) => db.prepare(`
     @id, @short_id, @agent, @origin, @routine_name, @routine_run_id,
     @version, @account, @account_key, @account_org, @mode, @timestamp, @last_activity,
     @project, @cwd, @git_branch, @topic, @label, @message_count, @token_count,
-    @output_tokens, @cost_usd, @duration_ms, @model, @tool_call_count,
+    @output_tokens, @input_tokens, @cache_read_tokens, @cache_write_tokens,
+    @cost_usd, @cost_usd_nocache, @duration_ms, @model, @tool_call_count,
     @file_path, @file_mtime_ms, @file_size, @scanned_at, @is_team_origin,
     @pr_url, @pr_number, @worktree_slug, @ticket_id, @spawned_team, @plan, @todos,
     @recent_directories_touched, @linear_project, @linear_project_url, @machine,
@@ -1413,7 +1439,11 @@ const upsertSessionStmt = (db) => db.prepare(`
     message_count = excluded.message_count,
     token_count = excluded.token_count,
     output_tokens = excluded.output_tokens,
+    input_tokens = excluded.input_tokens,
+    cache_read_tokens = excluded.cache_read_tokens,
+    cache_write_tokens = excluded.cache_write_tokens,
     cost_usd = excluded.cost_usd,
+    cost_usd_nocache = excluded.cost_usd_nocache,
     duration_ms = excluded.duration_ms,
     model = excluded.model,
     tool_call_count = excluded.tool_call_count,
@@ -1652,7 +1682,11 @@ export function upsertSession(meta, content, scan) {
         message_count: meta.messageCount ?? null,
         token_count: meta.tokenCount ?? null,
         output_tokens: meta.outputTokens ?? null,
+        input_tokens: meta.inputTokens ?? null,
+        cache_read_tokens: meta.cacheReadTokens ?? null,
+        cache_write_tokens: meta.cacheWriteTokens ?? null,
         cost_usd: meta.costUsd ?? null,
+        cost_usd_nocache: meta.costUsdNoCache ?? null,
         duration_ms: meta.durationMs ?? null,
         model: meta.model ?? null,
         tool_call_count: meta.toolCallCount ?? null,
@@ -1832,7 +1866,11 @@ export function upsertSessionsBatch(entries) {
                     message_count: meta.messageCount ?? null,
                     token_count: meta.tokenCount ?? null,
                     output_tokens: meta.outputTokens ?? null,
+                    input_tokens: meta.inputTokens ?? null,
+                    cache_read_tokens: meta.cacheReadTokens ?? null,
+                    cache_write_tokens: meta.cacheWriteTokens ?? null,
                     cost_usd: meta.costUsd ?? null,
+                    cost_usd_nocache: meta.costUsdNoCache ?? null,
                     duration_ms: meta.durationMs ?? null,
                     model: meta.model ?? null,
                     tool_call_count: meta.toolCallCount ?? null,
@@ -2046,7 +2084,11 @@ function rowToMeta(row) {
         messageCount: row.message_count ?? undefined,
         tokenCount: row.token_count ?? undefined,
         outputTokens: row.output_tokens ?? undefined,
+        inputTokens: row.input_tokens ?? undefined,
+        cacheReadTokens: row.cache_read_tokens ?? undefined,
+        cacheWriteTokens: row.cache_write_tokens ?? undefined,
         costUsd: row.cost_usd ?? undefined,
+        costUsdNoCache: row.cost_usd_nocache ?? undefined,
         durationMs: row.duration_ms ?? undefined,
         model: row.model ?? undefined,
         toolCallCount: row.tool_call_count ?? undefined,
@@ -2494,10 +2536,17 @@ export function queryUsageRollup(options) {
                     THEN account_org || ' <' || account || '>' END) AS label,`
         : ''}
       IFNULL(SUM(cost_usd), 0) AS costUsd,
+      -- A session with a cost but no persisted no-cache figure records no cache
+      -- split, so its no-cache cost equals its actual cost — fall back to cost_usd
+      -- so it still contributes to the scenario total rather than dropping to 0.
+      IFNULL(SUM(COALESCE(cost_usd_nocache, cost_usd)), 0) AS costUsdNoCache,
       IFNULL(SUM(duration_ms), 0) AS durationMs,
       COUNT(*) AS sessionCount,
       IFNULL(SUM(token_count), 0) AS tokenCount,
-      IFNULL(SUM(output_tokens), 0) AS outputTokens
+      IFNULL(SUM(output_tokens), 0) AS outputTokens,
+      IFNULL(SUM(input_tokens), 0) AS inputTokens,
+      IFNULL(SUM(cache_read_tokens), 0) AS cacheReadTokens,
+      IFNULL(SUM(cache_write_tokens), 0) AS cacheWriteTokens
     FROM sessions
     ${clause}
     GROUP BY key

package/dist/lib/session/discover.d.ts

@@ -71,8 +71,14 @@ interface ClaudeSessionScan {
     tokenCount?: number;
     /** Real generated (output) tokens, excluding cache-read/-write context. */
     outputTokens?: number;
+    /** Burn split — uncached input / cache-read / cache-write tokens (RUSH-2287). */
+    inputTokens?: number;
+    cacheReadTokens?: number;
+    cacheWriteTokens?: number;
     /** Total USD cost accumulated from per-(model, direction) token usage. */
     costUsd?: number;
+    /** USD cost with cache read/write repriced at the input rate (RUSH-2287). */
+    costUsdNoCache?: number;
     /** Wall-clock duration in ms between the first and last timestamped event. */
     durationMs?: number;
     /** ISO time of the last timestamped event — the session's last activity. */
@@ -122,7 +128,13 @@ interface CodexSessionScan {
     tokenCount?: number;
     /** Real generated (output) tokens, excluding cache-read/-write context. */
     outputTokens?: number;
+    /** Burn split — uncached input / cache-read tokens (Codex has no cache-write) (RUSH-2287). */
+    inputTokens?: number;
+    cacheReadTokens?: number;
+    cacheWriteTokens?: number;
     costUsd?: number;
+    /** USD cost with cache read repriced at the input rate (RUSH-2287). */
+    costUsdNoCache?: number;
     durationMs?: number;
     lastActivity?: string;
     contentText?: string;
@@ -417,8 +429,12 @@ export interface ClaudeParseState {
     toolCallCount: number;
     tokenCount: number;
     outputTokens: number;
+    inputTokens: number;
+    cacheReadTokens: number;
+    cacheWriteTokens: number;
     sawTokenCount: boolean;
     costUsd: number;
+    costUsdNoCache: number;
     sawCost: boolean;
     firstTsMs?: number;
     lastTsMs?: number;
@@ -468,7 +484,7 @@ export declare function scanClaudeSession(filePath: string): Promise<ClaudeSessi
  * exact even when the recent window is smaller than the true count.
  */
 export interface ClaudeParserState {
-    v: 2;
+    v: 3;
     offset: number;
     jsonlDroppingOversizedLine?: boolean;
     timestamp?: string;
@@ -487,9 +503,13 @@ export interface ClaudeParserState {
     toolCallCount: number;
     tokenCount: number;
     outputTokens: number;
+    inputTokens: number;
+    cacheReadTokens: number;
+    cacheWriteTokens: number;
     sawTokenCount: boolean;
     sawCost: boolean;
     costUsd: number;
+    costUsdNoCache: number;
     seenIdsSize: number;
     seenIdsRecent: string[];
     sawPrCreate: boolean;