@phnx-labs/agents-cli 1.22.35 → 1.22.37

package/dist/commands/webhook.js

@@ -11,8 +11,8 @@ function positiveInt(value, fallback) {
 }
 function readWebhookSecrets(bundleName) {
     const { env } = readAndResolveBundleEnv(bundleName, {
-        caller: 'webhook serve',
-        // `webhook serve` is a long-running background server started to receive
+        caller: 'webhooks serve',
+        // `webhooks serve` is a long-running background server started to receive
         // signed webhooks, not a human at a Touch ID sheet — so the read is always
         // `agentOnly` (SEC-13: never pop biometry on its own). A `never`/no-ACL or
         // broker-held bundle resolves silently; a locked bundle THROWS the actionable
@@ -50,11 +50,11 @@ function waitForListening(server) {
         server.once('error', onError);
     });
 }
-export function registerWebhookCommand(program) {
-    const webhook = program
-        .command('webhook')
+export function registerWebhooksCommand(program) {
+    const webhooks = program
+        .command('webhooks')
         .description('Run a localhost signed webhook receiver for routine triggers.');
-    webhook
+    webhooks
         .command('serve')
         .description('Receive signed GitHub/Linear webhooks on /hooks/<source> and fire matching routines.')
         .requiredOption('--secrets-bundle <name>', 'agents secrets bundle containing GITHUB_WEBHOOK_SECRET and/or LINEAR_WEBHOOK_SECRET')
@@ -94,7 +94,7 @@ export function registerWebhookCommand(program) {
             await waitForListening(server);
             const address = server.address();
             const bound = typeof address === 'object' && address ? address.port : port;
-            console.log(`${chalk.green('agents webhook')} ${chalk.dim('→')} ${chalk.cyan(`http://${opts.host ?? DEFAULT_HOST}:${bound}`)}`);
+            console.log(`${chalk.green('agents webhooks')} ${chalk.dim('→')} ${chalk.cyan(`http://${opts.host ?? DEFAULT_HOST}:${bound}`)}`);
             console.log(chalk.dim('signed · localhost by default · endpoints: /hooks/github, /hooks/linear · Ctrl-C to stop'));
             const shutdown = () => {
                 server.close(() => process.exit(0));

package/dist/index.d.ts

@@ -2,7 +2,23 @@
 /**
  * CLI entry point for agents-cli.
  *
- * Registers all commands, handles update checks, auto-corrects typos,
- * and launches the first-run interactive setup when appropriate.
+ * Slim shell (RUSH-2335): only the leaf `lib/secrets/sync-commands.js` is a
+ * static import, so the argv fast paths below can answer without evaluating the
+ * commander + self-update + command-registry graph that used to be hoisted
+ * above every intercept (~140ms of cold bootstrap per synchronous secrets-
+ * broker read). The full CLI loads via `await import('./bootstrap.js')` once
+ * none of the fast paths match.
+ *
+ * Fast paths (must stay above the bootstrap import — ESM does not hoist dynamic
+ * `import()`, but any static import here would still evaluate first):
+ *   - `__vault-age-helper`
+ *   - `__secrets-get` / `__secrets-ping` / `__secrets-lock` (SYNC_* tokens)
+ *   - `__shim`
+ *   - `__daemon-run`
+ *
+ * The tokens are imported from the leaf module sync-commands.ts — the SAME
+ * bindings the clients spawn with, so this dispatch and those spawns cannot
+ * drift apart. It is a leaf precisely so binding them here is free: importing
+ * agent.js would pull the whole secrets graph into every invocation.
  */
 export {};