@phnx-labs/agents-cli 1.22.35 → 1.22.37

package/scripts/postinstall.js

@@ -375,49 +375,52 @@ function retargetManagedLinksToNativeBin() {
 }
 
 /**
- * Self-heal long-running processes onto the just-installed code (macOS).
+ * Self-heal long-running processes onto the just-installed code (darwin + linux).
  *
  * The root cause behind stale-behavior bugs is a daemon/broker that keeps
  * running pre-upgrade code for days. An in-place `npm i -g` swaps the files but
  * not the running processes — so we bounce them here, the one moment we know the
- * code just changed. Best-effort and non-fatal: a failure must never break the
- * install. Skipped in CI and when AGENTS_NO_HEAL=1.
+ * code just changed. Always start (or restart) the supervised daemon so a fresh
+ * install gets launchd/systemd KeepAlive without waiting for routines add.
+ * Best-effort and non-fatal: a failure must never break the install. Skipped in
+ * CI and when AGENTS_NO_HEAL=1. Windows is out of scope (detached-only, no KeepAlive).
  */
 async function healLongRunningProcesses() {
-  if (process.platform !== 'darwin') return;
+  if (process.platform !== 'darwin' && process.platform !== 'linux') return;
   if (process.env.CI || process.env.AGENTS_NO_HEAL === '1') return;
 
   // Retire the legacy standalone secrets-agent service FIRST (#416 step 2) so
   // that when the daemon (re)starts below its coexistence guard sees no
   // standalone broker and hosts the broker socket itself. No-op if no legacy
-  // plist is present; never blocks.
-  let retiredLegacyBroker = false;
+  // plist is present; never blocks. Darwin-only in practice (launchd service).
   try {
     const a = await import('../dist/lib/secrets/agent.js');
     if (a.secretsAgentServiceInstalled?.()) {
       a.retireLegacySecretsAgentService?.();
-      retiredLegacyBroker = true;
       console.log('  Retired the standalone secrets-agent service — the daemon now hosts the broker.');
     }
   } catch { /* best effort */ }
 
-  // Routines daemon: restart so it reloads new code (e.g. picks up keychain
-  // read-memoization / broker fast-path that a stale daemon wouldn't have) and
-  // (re)hosts the broker socket now the legacy service is gone. If it wasn't
-  // running but we just retired a broker the user relied on, start it so the
-  // socket has a host.
+  // Always (re)start so first install writes the LaunchAgent/systemd unit and
+  // upgrades bounce onto the new binary — but honor daemon.enabled for cold
+  // starts (SING-4a). If it was already running under a disable, stop and leave
+  // it down so upgrade does not resurrect a killed switch.
   try {
     const d = await import('../dist/lib/daemon.js');
-    if (d.isDaemonRunning?.()) {
+    const { isDaemonEnabled } = await import('../dist/lib/device-config.js');
+    const wasRunning = Boolean(d.isDaemonRunning?.());
+    const enabled = typeof isDaemonEnabled === 'function' ? isDaemonEnabled() : true;
+    if (wasRunning) {
       d.stopDaemon?.();
-      // This lifecycle script is process.argv[1] while npm is installing. Pin
-      // the restart to the installed CLI entrypoint so the service manifest
-      // never records scripts/postinstall.js as the daemon command.
-      d.startDaemon?.(AGENTS_BIN);
-      console.log('  Restarted the routines daemon onto this version.');
-    } else if (retiredLegacyBroker) {
+      if (enabled) {
+        d.startDaemon?.(AGENTS_BIN);
+        console.log('  Restarted the routines daemon onto this version.');
+      } else {
+        console.log('  Stopped the routines daemon (daemon.enabled=false — not restarted).');
+      }
+    } else if (enabled) {
       d.startDaemon?.(AGENTS_BIN);
-      console.log('  Started the daemon to host the secrets broker.');
+      console.log('  Started the always-on agents daemon.');
     }
   } catch { /* best effort */ }
 }

package/dist/commands/defaults.d.ts

@@ -1,7 +0,0 @@
-/**
- * Defaults command tree.
- *
- * `agents defaults run ...` manages selector-based defaults for `agents run`.
- */
-import type { Command } from 'commander';
-export declare function registerDefaultsCommands(program: Command): void;

package/dist/commands/defaults.js

@@ -1,107 +0,0 @@
-/**
- * Defaults command tree.
- *
- * `agents defaults run ...` manages selector-based defaults for `agents run`.
- */
-import chalk from 'chalk';
-import { setHelpSections } from '../lib/help.js';
-import { formatRunDefaultEntry, listRunDefaults, setRunDefault, unsetRunDefault, } from '../lib/run-defaults.js';
-import { getProjectRoot, setProjectRoot } from '../lib/project-root.js';
-export function registerDefaultsCommands(program) {
-    const defaults = program
-        .command('defaults')
-        .description('Manage default options for agents-cli commands');
-    const run = defaults
-        .command('run')
-        .description('Manage selector-based defaults for `agents run`');
-    setHelpSections(run, {
-        examples: `
-      agents defaults run list
-      agents defaults run set 'claude:*' --mode auto --model opus
-      agents defaults run set claude@2.1.45 --mode plan --model sonnet
-      agents defaults run unset 'claude:*'
-    `,
-        notes: `
-      Selectors use <agent>:<version>. Use * for all versions of an agent.
-      Exact selectors override wildcard selectors field by field.
-      Explicit flags on agents run always win over configured defaults.
-    `,
-    });
-    run
-        .command('list')
-        .description('List configured run defaults')
-        .action(() => {
-        const entries = listRunDefaults();
-        if (entries.length === 0) {
-            console.log(chalk.gray('No run defaults configured.'));
-            console.log(chalk.gray("Set one with: agents defaults run set 'claude:*' --mode auto --model opus"));
-            return;
-        }
-        console.log(chalk.bold('Run Defaults\n'));
-        for (const entry of entries) {
-            console.log(`  ${formatRunDefaultEntry(entry)}`);
-        }
-    });
-    run
-        .command('set <selector>')
-        .description('Set defaults for an agent/version selector')
-        .option('--mode <mode>', "Default mode: plan, edit, auto, skip. 'full' accepted as alias for skip.")
-        .option('--model <model>', 'Default model or model alias, forwarded via --model')
-        .option('--effort <effort>', 'Default reasoning effort: low, medium, high, xhigh, max, or auto')
-        .action((selector, options) => {
-        try {
-            const entry = setRunDefault(selector, {
-                ...(options.mode !== undefined ? { mode: options.mode } : {}),
-                ...(options.model !== undefined ? { model: options.model } : {}),
-                ...(options.effort !== undefined ? { effort: options.effort } : {}),
-            });
-            console.log(chalk.green('Set run default:'));
-            console.log(`  ${formatRunDefaultEntry(entry)}`);
-        }
-        catch (err) {
-            console.error(chalk.red(err.message));
-            process.exit(1);
-        }
-    });
-    run
-        .command('unset <selector>')
-        .description('Remove defaults for an agent/version selector')
-        .action((selector) => {
-        try {
-            const removed = unsetRunDefault(selector);
-            if (removed) {
-                console.log(chalk.green(`Removed run default ${selector}`));
-            }
-            else {
-                console.log(chalk.gray(`No run default matched ${selector}`));
-            }
-        }
-        catch (err) {
-            console.error(chalk.red(err.message));
-            process.exit(1);
-        }
-    });
-    defaults
-        .command('project-root [path]')
-        .description('Show or set the projects root for `agents run --project` (auto-inferred when unset)')
-        .action((rootPath) => {
-        try {
-            if (!rootPath) {
-                const current = getProjectRoot();
-                if (current) {
-                    console.log(`Projects root: ${chalk.white(current)}`);
-                }
-                else {
-                    console.log(chalk.gray('Projects root not set — auto-inferred and cached on first `--project` use.'));
-                }
-                return;
-            }
-            const stored = setProjectRoot(rootPath);
-            console.log(chalk.green(`Set projects root: ${stored}`));
-        }
-        catch (err) {
-            console.error(chalk.red(err.message));
-            process.exit(1);
-        }
-    });
-}

package/dist/commands/export.d.ts

@@ -1,11 +0,0 @@
-/**
- * `agents export <agent>[@<version>]` — copy an isolated install's config out to the
- * user's real `~/.<agent>`.
- *
- * The exit door for `--isolated`. Default is additive: your files are never modified,
- * and anything that collides is written beside yours so you can diff and take what you
- * want. A receipt records what came from the export, so "which of these are mine?" has
- * an answer and the whole thing can be undone.
- */
-import type { Command } from 'commander';
-export declare function registerExportCommand(program: Command): void;

package/dist/commands/export.js

@@ -1,215 +0,0 @@
-import chalk from 'chalk';
-import { execFileSync } from 'child_process';
-import { confirm, select } from '@inquirer/prompts';
-import { AGENTS, agentLabel, formatAgentError, resolveAgentName } from '../lib/agents.js';
-import { listInstalledVersions, isVersionIsolated } from '../lib/versions.js';
-import { planExport, executeExport, CONFLICT_SUFFIX } from '../lib/export.js';
-import { isInteractiveTerminal, isPromptCancelled } from './utils.js';
-function isolatedVersions(agent) {
-    return listInstalledVersions(agent).filter((v) => isVersionIsolated(agent, v));
-}
-/** Explain a blocker in terms of what the user should do instead. */
-function reportBlocker(plan) {
-    const label = agentLabel(plan.agent);
-    const b = plan.blocker;
-    switch (b.kind) {
-        case 'not-installed':
-            console.log(chalk.red(`${label}@${plan.version} is not installed.`));
-            console.log(chalk.gray(`  Installed: ${listInstalledVersions(plan.agent).join(', ') || 'none'}`));
-            break;
-        case 'not-isolated':
-            console.log(chalk.yellow(`${label}@${plan.version} is not an isolated install.`));
-            console.log(chalk.gray(`  A normal install's config already IS ${plan.dest} (adoption symlinks it),`));
-            console.log(chalk.gray('  so there is nothing to export. To un-adopt it, use: agents uninstall'));
-            break;
-        case 'no-config':
-            console.log(chalk.yellow(`${label}@${plan.version} has no config to export yet (${b.source} is empty).`));
-            console.log(chalk.gray(`  Run it once first: agents run ${plan.agent}@${plan.version}`));
-            break;
-        case 'dest-adopted':
-            console.log(chalk.red(`${b.realPath} is managed by agents-cli (adopted by ${label}@${b.adoptedVersion}).`));
-            console.log(chalk.gray('  Exporting would write into that version\'s home, not your real config.'));
-            console.log(chalk.gray(`  Release it first: agents uninstall  (or agents remove ${plan.agent}@${b.adoptedVersion})`));
-            break;
-    }
-}
-/** Unified diff between the user's file and the incoming one, via git. */
-function printDiff(existing, incoming) {
-    try {
-        execFileSync('git', ['diff', '--no-index', '--color', '--', existing, incoming], {
-            stdio: ['ignore', 'inherit', 'ignore'],
-        });
-    }
-    catch {
-        // git diff --no-index exits 1 when files differ; output already streamed.
-    }
-}
-function printPlan(plan, opts) {
-    const label = agentLabel(plan.agent);
-    console.log(chalk.bold(`Export ${label}@${plan.version} -> ${plan.dest}  ${chalk.gray(`[${plan.mode}]`)}\n`));
-    console.log(`  ${chalk.gray('from')}  ${plan.source}`);
-    console.log(`  ${chalk.gray('to')}    ${plan.stagedPath ?? plan.dest}`);
-    console.log();
-    if (plan.mode === 'replace') {
-        console.log(chalk.yellow(`  Replacing ${plan.dest} wholesale — ${plan.writes.length} file(s).`));
-        if (plan.backupPath)
-            console.log(chalk.gray(`  Your current config moves to: ${plan.backupPath}`));
-        else if (plan.destKind === 'foreign-symlink') {
-            console.log(chalk.yellow(`  ${plan.dest} is a symlink agents-cli does not own; it will be removed.`));
-            console.log(chalk.gray('  Its target is left untouched.'));
-        }
-    }
-    else if (plan.mode === 'staged') {
-        console.log(chalk.gray(`  Writing ${plan.writes.length} file(s) into ${plan.stagedPath}.`));
-        console.log(chalk.gray('  Nothing is activated — your config is untouched.'));
-    }
-    else {
-        if (plan.writes.length > 0) {
-            console.log(chalk.green(`  ${plan.writes.length} new file(s) will be added:`));
-            for (const w of plan.writes.slice(0, 15))
-                console.log(chalk.gray(`      + ${w.rel}`));
-            if (plan.writes.length > 15)
-                console.log(chalk.gray(`      + ${plan.writes.length - 15} more`));
-        }
-        else {
-            console.log(chalk.gray('  No new files to add.'));
-        }
-        if (plan.conflicts.length > 0) {
-            console.log();
-            console.log(chalk.yellow(`  ${plan.conflicts.length} file(s) you already have — YOURS ARE NOT MODIFIED.`));
-            console.log(chalk.gray(`  The incoming version is written beside each as *${CONFLICT_SUFFIX}:`));
-            for (const c of plan.conflicts.slice(0, 15))
-                console.log(chalk.gray(`      ~ ${c.rel}`));
-            if (plan.conflicts.length > 15)
-                console.log(chalk.gray(`      ~ ${plan.conflicts.length - 15} more`));
-        }
-    }
-    if (opts.diff && plan.conflicts.length > 0) {
-        for (const c of plan.conflicts) {
-            console.log(chalk.bold(`\n─── ${c.rel} ───`));
-            printDiff(c.existing, c.source);
-        }
-    }
-    console.log(chalk.gray(`\n  Receipt: ${plan.receiptPath}`));
-}
-export function registerExportCommand(program) {
-    program
-        .command('export <spec>')
-        .description('Copy an isolated install\'s config out to your real ~/.<agent>')
-        .option('--replace', 'Replace your config wholesale (yours is backed up) instead of merging')
-        .option('--staged', 'Write into ~/.<agent>/.agents-export-<ts>/ and activate nothing')
-        .option('--diff', 'Show a unified diff for each file you already have')
-        .option('--dry-run', 'Show what would change without writing anything')
-        .option('-y, --yes', 'Skip the confirmation prompt')
-        .addHelpText('after', `
-Modes:
-  (default)   merge   — additive. Your files are NEVER modified. Anything that
-                        collides is written beside yours as <name>${CONFLICT_SUFFIX}
-                        so you can diff and take the parts you want.
-  --replace           — the isolated config becomes ~/.<agent>; yours is moved to
-                        backups/<agent>/<ts>. For promoting a sandbox wholesale.
-  --staged            — dump the tree into ~/.<agent>/.agents-export-<ts>/ and
-                        activate nothing. For inspecting first.
-
-Every mode writes a receipt to ~/.<agent>/.agents-cli-export.json listing exactly
-what came from the export — so you can tell your settings from the CLI's, and undo it.
-
-Examples:
-  agents export codex --dry-run          # see the plan
-  agents export codex --diff             # ...and the deltas on colliding files
-  agents export codex                    # additive; nothing of yours changes
-  agents export codex@0.144.6 --replace  # promote the sandbox wholesale
-
-Note: file CONTENTS are never auto-merged. The TOML parser here does not preserve
-comments, so merging keys would silently delete them. You get both files and a diff.
-`)
-        .action(async (spec, options) => {
-        if (options.replace && options.staged) {
-            console.error(chalk.red('--replace and --staged are mutually exclusive; pass only one.'));
-            process.exit(1);
-        }
-        const mode = options.replace ? 'replace' : options.staged ? 'staged' : 'merge';
-        const [rawAgent, rawVersion] = spec.split('@');
-        const agent = resolveAgentName(rawAgent);
-        if (!agent) {
-            console.error(chalk.red(formatAgentError(rawAgent)));
-            process.exit(1);
-        }
-        let version = rawVersion;
-        if (!version) {
-            const candidates = isolatedVersions(agent);
-            if (candidates.length === 0) {
-                console.log(chalk.yellow(`No isolated ${agentLabel(agent)} installs to export.`));
-                console.log(chalk.gray(`  Create one with: agents add ${agent}@<version> --isolated`));
-                return;
-            }
-            if (candidates.length === 1) {
-                version = candidates[0];
-            }
-            else if (isInteractiveTerminal()) {
-                version = await select({
-                    message: `Which isolated ${agentLabel(agent)} version?`,
-                    choices: candidates.map((v) => ({ name: v, value: v })),
-                }).catch((err) => {
-                    if (isPromptCancelled(err))
-                        process.exit(130);
-                    throw err;
-                });
-            }
-            else {
-                console.error(chalk.red(`${agentLabel(agent)} has several isolated installs; name one.`));
-                console.error(chalk.gray(`  ${candidates.map((v) => `agents export ${agent}@${v}`).join('\n  ')}`));
-                process.exit(1);
-            }
-        }
-        const timestamp = Date.now();
-        const plan = planExport(agent, version, timestamp, mode);
-        if (plan.blocker) {
-            reportBlocker(plan);
-            process.exit(1);
-        }
-        printPlan(plan, { diff: options.diff });
-        if (options.dryRun) {
-            console.log(chalk.gray('\nDry run — nothing was written.'));
-            return;
-        }
-        // Only `--replace` can destroy anything, so it is the only mode that demands
-        // confirmation. merge and staged are additive by construction.
-        if (mode === 'replace' && !options.yes) {
-            if (!isInteractiveTerminal()) {
-                console.error(chalk.red('\nRefusing to replace your config without confirmation in a non-interactive shell.'));
-                console.error(chalk.gray('  Re-run with --yes once you have checked --dry-run.'));
-                process.exit(1);
-            }
-            const ok = await confirm({ message: `Replace ${plan.dest}?`, default: false }).catch((err) => {
-                if (isPromptCancelled(err))
-                    process.exit(130);
-                throw err;
-            });
-            if (!ok) {
-                console.log(chalk.gray('Aborted.'));
-                return;
-            }
-        }
-        const result = executeExport(plan, timestamp);
-        if (!result.exported) {
-            console.error(chalk.red(`Export failed: ${result.errors.join('; ')}`));
-            process.exit(1);
-        }
-        console.log();
-        if (result.written.length > 0)
-            console.log(chalk.green(`Added ${result.written.length} file(s) to ${result.dest}`));
-        if (result.conflicts.length > 0) {
-            console.log(chalk.yellow(`${result.conflicts.length} of your file(s) were left untouched; incoming copies written as *${CONFLICT_SUFFIX}`));
-            console.log(chalk.gray(`  Compare them with: agents export ${agent}@${version} --diff --dry-run`));
-        }
-        if (result.backupPath)
-            console.log(chalk.gray(`Previous config kept at: ${result.backupPath}`));
-        if (result.stagedPath)
-            console.log(chalk.gray(`Staged (nothing activated): ${result.stagedPath}`));
-        console.log(chalk.gray(`Receipt: ${result.receiptPath}`));
-        if (mode !== 'staged') {
-            console.log(chalk.gray(`  ${AGENTS[plan.agent].cliCommand} reads this config directly.`));
-        }
-    });
-}

package/dist/commands/helper.d.ts

@@ -1,12 +0,0 @@
-/**
- * `agents helper` -- install, inspect, and reinstall the signed macOS
- * Keychain helper at the stable user path.
- *
- * The signed `Agents CLI.app` ships inside the npm package, but its keychain
- * ACLs need a stable signature-pinned location to survive `npm i -g` and
- * version bumps. This command copies it to
- * `~/Library/Application Support/agents-cli/` once and lets users force a
- * reinstall when the trusted-app ACL needs to be re-established.
- */
-import type { Command } from 'commander';
-export declare function registerHelperCommand(program: Command): void;

package/dist/commands/helper.js

@@ -1,87 +0,0 @@
-/**
- * `agents helper` -- install, inspect, and reinstall the signed macOS
- * Keychain helper at the stable user path.
- *
- * The signed `Agents CLI.app` ships inside the npm package, but its keychain
- * ACLs need a stable signature-pinned location to survive `npm i -g` and
- * version bumps. This command copies it to
- * `~/Library/Application Support/agents-cli/` once and lets users force a
- * reinstall when the trusted-app ACL needs to be re-established.
- */
-import chalk from 'chalk';
-import { ensureKeychainHelperInstalled, getKeychainHelperPath, getKeychainHelperStatus, } from '../lib/secrets/install-helper.js';
-function requireDarwin() {
-    if (process.platform !== 'darwin') {
-        console.error(chalk.red('agents helper: macOS only.'));
-        process.exit(1);
-    }
-}
-export function registerHelperCommand(program) {
-    const cmd = program
-        .command('helper')
-        .description('Manage the signed macOS Keychain helper (.app) install');
-    cmd
-        .command('install')
-        .description('Copy the bundled .app to ~/Library/Application Support/agents-cli/')
-        .action(() => {
-        requireDarwin();
-        try {
-            ensureKeychainHelperInstalled({ forceReinstall: true });
-        }
-        catch (err) {
-            console.error(chalk.red(err.message || String(err)));
-            process.exit(1);
-        }
-        const s = getKeychainHelperStatus();
-        console.log(chalk.green('Installed:'), s.destination);
-        console.log(chalk.dim('codesign:'), s.codesignOk ? chalk.green('ok') : chalk.red(s.codesignOutput));
-        console.log(chalk.dim('spctl:   '), s.spctlOk ? chalk.green('ok') : chalk.yellow(s.spctlOutput));
-    });
-    cmd
-        .command('update')
-        .description('Reinstall the .app, overwriting any existing copy (alias of install)')
-        .action(() => {
-        requireDarwin();
-        try {
-            ensureKeychainHelperInstalled({ forceReinstall: true });
-        }
-        catch (err) {
-            console.error(chalk.red(err.message || String(err)));
-            process.exit(1);
-        }
-        const s = getKeychainHelperStatus();
-        console.log(chalk.green('Updated: '), s.destination);
-        console.log(chalk.dim('codesign:'), s.codesignOk ? chalk.green('ok') : chalk.red(s.codesignOutput));
-        console.log(chalk.dim('spctl:   '), s.spctlOk ? chalk.green('ok') : chalk.yellow(s.spctlOutput));
-    });
-    cmd
-        .command('status')
-        .description('Show source, destination, codesign and notarization status')
-        .action(() => {
-        requireDarwin();
-        const s = getKeychainHelperStatus();
-        console.log(chalk.bold('Source:     '), s.source ?? chalk.red('(not found)'));
-        console.log(chalk.bold('Destination:'), s.destination);
-        console.log(chalk.bold('Installed:  '), s.installed ? chalk.green('yes') : chalk.yellow('no'));
-        if (s.installed) {
-            console.log(chalk.bold('codesign:   '), s.codesignOk ? chalk.green('ok') : chalk.red(s.codesignOutput));
-            console.log(chalk.bold('spctl:      '), s.spctlOk ? chalk.green('ok') : chalk.yellow(s.spctlOutput));
-        }
-        else {
-            console.log(chalk.dim('Run `agents helper install` to copy the bundled .app to the destination.'));
-        }
-    });
-    cmd
-        .command('where')
-        .description('Print the absolute path to the installed helper executable')
-        .action(() => {
-        requireDarwin();
-        try {
-            console.log(getKeychainHelperPath());
-        }
-        catch (err) {
-            console.error(chalk.red(err.message || String(err)));
-            process.exit(1);
-        }
-    });
-}

package/dist/commands/hosts.d.ts

@@ -1,11 +0,0 @@
-/**
- * `agents hosts` — register and inspect agent hosts (machines you offload runs to).
- *
- * The registry is a thin overlay: ssh-config hosts are dispatchable with zero
- * registration (connection details stay in ~/.ssh/config); enrollment only adds
- * capability metadata or bootstraps agents-cli, plus inline (non-ssh-config)
- * hosts. Dispatch itself is `agents run --host <name>` (see commands/exec.ts).
- */
-import type { Command } from 'commander';
-/** Register the `agents hosts` command tree. */
-export declare function registerHostsCommand(program: Command): void;