@phnx-labs/agents-cli 1.22.40 → 1.22.42

package/dist/lib/harness/adapter.js

@@ -0,0 +1,47 @@
+/**
+ * The four config-dir env keys a harness pins to its version home. Every
+ * per-harness branch in the old buildExecEnv deleted the ones it does NOT set,
+ * so its own config pointer never leaks into a foreign harness's invocation.
+ * (XDG_CONFIG_HOME / XDG_DATA_HOME — Muse/Cursor — are deliberately absent: the
+ * old code sets them but never strips them, and this preserves that exactly.)
+ */
+export const CONFIG_DIR_ENV_KEYS = [
+    'CLAUDE_CONFIG_DIR',
+    'CODEX_HOME',
+    'COPILOT_HOME',
+    'KIMI_CODE_HOME',
+];
+/**
+ * Strip every config-dir env key except the one(s) this harness sets. `keep=[]`
+ * (the default / no-config-dir harness) deletes all four — the old `else` arm.
+ */
+export function stripForeignConfigDir(result, keep = []) {
+    for (const key of CONFIG_DIR_ENV_KEYS) {
+        if (!keep.includes(key))
+            delete result[key];
+    }
+}
+const REGISTRY = new Map();
+/**
+ * The no-behavior adapter — a harness with no managed config-dir env and no
+ * launch-arg quirks. buildExecEnv strips all four config-dir keys for it (the old
+ * `else` arm) by falling back to {@link stripForeignConfigDir} when an adapter
+ * omits `applyExecConfigEnv`.
+ */
+function defaultAdapter(id) {
+    return { id };
+}
+export function registerHarnessAdapter(adapter) {
+    REGISTRY.set(adapter.id, adapter);
+}
+/**
+ * The behavior adapter for a harness. Every `AgentId` resolves to an adapter —
+ * one with real behavior when registered, else the id-only default (the old
+ * `else` arm). Callers therefore never name-check a harness.
+ */
+export function resolveHarnessAdapter(id) {
+    return REGISTRY.get(id) ?? defaultAdapter(id);
+}
+export function listHarnessAdapters() {
+    return [...REGISTRY.keys()].sort();
+}

package/dist/lib/harness/adapters/claude.d.ts

@@ -0,0 +1,2 @@
+import type { HarnessAdapter } from '../adapter.js';
+export declare const claudeAdapter: HarnessAdapter;

package/dist/lib/harness/adapters/claude.js

@@ -0,0 +1,110 @@
+import * as path from 'path';
+import { stripForeignConfigDir } from '../adapter.js';
+export const claudeAdapter = {
+    id: 'claude',
+    applyExecConfigEnv(result, ctx) {
+        const { versionHome } = ctx;
+        // The per-account `claude setup-token` only resolves when there is a version
+        // home to key it to; version===null (claude unresolved / not installed) yields
+        // null, exactly as the routines path treats it (`runner.ts:1017-1021`). The
+        // token decision below runs even then, so an ambient inherited value is stripped
+        // on the routines/provisioned path regardless of whether a version resolved.
+        // resolveClaudeSetupToken is injected (see ExecConfigEnvCtx) to keep this
+        // adapter import-leaf — importing claude-account-token here would drag the
+        // secrets/sqlite graph into shims.ts.
+        const setupToken = versionHome ? ctx.resolveClaudeSetupToken(versionHome) : null;
+        if (versionHome) {
+            result.CLAUDE_CONFIG_DIR = path.join(versionHome, '.claude');
+            // A managed pin lives in a per-version dir; Claude Code's own background
+            // auto-updater would rewrite that pinned binary in place (and has left it
+            // half-swapped and broken). Disable it so a pin stays a pin. Honor an
+            // explicit user value — from process.env (already in result) or from
+            // options.env (spread over result below).
+            if (result.DISABLE_AUTOUPDATER === undefined) {
+                result.DISABLE_AUTOUPDATER = '1';
+            }
+        }
+        // The `auth` bundle's setup-token exists so a run with NO human present
+        // authenticates without the Touch-ID-gated login item — usage probes,
+        // routines, dispatched runs (claude-account-token.ts). An interactive run
+        // has a human at the TTY, and their own per-version login is the credential
+        // they established and expect; overriding it made `/status` report
+        // `Auth token: CLAUDE_CODE_OAUTH_TOKEN` on a personal machine and took every
+        // hand-driven session off that login. macOS cannot cheaply confirm a home's
+        // login first (probing the Keychain raises an authorization sheet per
+        // installed version on the `agents run` hot path — agents.ts
+        // `isClaudeCredentialFileBlank`), so interactive simply defers to Claude
+        // Code, which prompts a present human to log in if the login is missing.
+        if (ctx.interactive) {
+            // Drop an INHERITED copy of OUR OWN setup-token: an interactive launch from
+            // inside a headless agent's shell inherits that agent's injected value via
+            // sanitizeProcessEnv(process.env) and would keep authenticating as it.
+            // Matched by VALUE, so a token the user exported deliberately is a different
+            // string and is left alone (#2383). This is NARROWER than the non-interactive
+            // path below, which overwrites-or-deletes unconditionally and never inspects
+            // the inherited value — a DIFFERENT account's inherited setup-token passing
+            // through this equality check is the adjacent hole RUSH-2360 leaves as
+            // follow-up (it does not silently run on a *shared, rotating* token, which is
+            // what caused the RUSH-1822 logout storm).
+            if (setupToken && result.CLAUDE_CODE_OAUTH_TOKEN === setupToken) {
+                delete result.CLAUDE_CODE_OAUTH_TOKEN;
+            }
+        }
+        else {
+            // Non-interactive (routines, dispatched, provisioned box): mirror the routines
+            // path (`runner.ts:1017-1021`) UNCONDITIONALLY. Inject the per-account
+            // setup-token when one resolves — it replaces any ambient shared value
+            // inherited from the launcher. When NONE resolves, STRIP the ambient
+            // CLAUDE_CODE_OAUTH_TOKEN so a run on a provisioned box can never silently
+            // authenticate as the shared, rotating token an earlier version of this path
+            // let through — the RUSH-1822 fleet-wide-logout hazard, tracked by RUSH-2360.
+            // A missing login then fails loud (401) against this home's own credential
+            // instead of quietly borrowing another's. options.env still wins below for an
+            // explicit caller override.
+            if (setupToken) {
+                result.CLAUDE_CODE_OAUTH_TOKEN = setupToken;
+            }
+            else {
+                delete result.CLAUDE_CODE_OAUTH_TOKEN;
+            }
+        }
+        stripForeignConfigDir(result, ['CLAUDE_CONFIG_DIR']);
+    },
+    shimConfigEnvBash(ctx) {
+        return `
+# Claude stores OAuth credentials in the macOS keychain. Scope them to the
+# selected version's config directory so switching versions also switches the
+# live Claude account.
+export CLAUDE_CONFIG_DIR="$VERSION_DIR/home/${ctx.configDirName}"
+# Managed installs are pinned in a per-version dir; Claude Code's background
+# auto-updater would rewrite the pinned binary in place. Disable it so a pin
+# stays a pin. An explicit user value always wins.
+export DISABLE_AUTOUPDATER="\${DISABLE_AUTOUPDATER:-1}"
+# On Linux sandboxes (no keychain), fall back to a per-version token file.
+# The env var always wins if already set; no-op on macOS.
+if [ "\$(uname -s)" = "Linux" ] && [ -z "\${CLAUDE_CODE_OAUTH_TOKEN:-}" ] && [ -f "\$CLAUDE_CONFIG_DIR/.oauth_token" ]; then
+  CLAUDE_CODE_OAUTH_TOKEN=\$(cat "\$CLAUDE_CONFIG_DIR/.oauth_token")
+  export CLAUDE_CODE_OAUTH_TOKEN
+fi
+`;
+    },
+    routineModeArgs(cmd, ctx) {
+        const mode = ctx.mode;
+        if (mode === 'edit') {
+            const planIndex = cmd.indexOf('plan');
+            if (planIndex !== -1)
+                cmd[planIndex] = 'acceptEdits';
+        }
+        else if (mode === 'auto') {
+            const planIndex = cmd.indexOf('plan');
+            if (planIndex !== -1)
+                cmd[planIndex] = 'auto';
+        }
+        else if (mode === 'skip') {
+            // Replace --permission-mode plan with --dangerously-skip-permissions
+            const pmIndex = cmd.indexOf('--permission-mode');
+            if (pmIndex !== -1)
+                cmd.splice(pmIndex, 2, '--dangerously-skip-permissions');
+        }
+    },
+};

package/dist/lib/harness/adapters/codex.d.ts

@@ -0,0 +1,2 @@
+import type { HarnessAdapter } from '../adapter.js';
+export declare const codexAdapter: HarnessAdapter;

package/dist/lib/harness/adapters/codex.js

@@ -0,0 +1,83 @@
+import * as os from 'os';
+import * as path from 'path';
+import { getHistoryDir } from '../../state.js';
+import { resolveCodexHome, codexHomeShimBash } from '../../codex-home.js';
+import { codexEditWritableRoots, codexPolicyArgs } from '../../codex-policy.js';
+import { stripForeignConfigDir } from '../adapter.js';
+/**
+ * Shim-script single-quoting — identical to the local `shellQuote` in shims.ts
+ * (always wraps in single quotes), NOT ssh-exec's variant (which leaves
+ * shell-safe strings unquoted). The generated shim's codex launch args must stay
+ * byte-for-byte what shims.ts produced, so the quoting moves with the logic.
+ */
+function shimShellQuote(value) {
+    return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+export const codexAdapter = {
+    id: 'codex',
+    applyExecConfigEnv(result, ctx) {
+        if (ctx.version && ctx.versionHome) {
+            // On macOS the deep versioned home overflows the Unix-socket SUN_LEN
+            // limit for codex's app-server control socket; resolve to a short,
+            // SUN_LEN-safe home (migrating once if needed). See codex-home.ts.
+            const versionedHome = path.join(ctx.versionHome, '.codex');
+            const agentsUserDir = path.dirname(getHistoryDir());
+            result.CODEX_HOME = resolveCodexHome(versionedHome, agentsUserDir, ctx.version);
+        }
+        stripForeignConfigDir(result, ['CODEX_HOME']);
+    },
+    shimConfigEnvBash(ctx) {
+        return codexHomeShimBash(`$VERSION_DIR/home/${ctx.configDirName}`, `$AGENTS_USER_DIR/.codex-homes/$VERSION`);
+    },
+    shimLaunchArgs() {
+        return ` ${[
+            '-c',
+            'check_for_update_on_startup=false',
+            ...codexPolicyArgs('edit'),
+        ].map(shimShellQuote).join(' ')}`;
+    },
+    shimExecTail(launchArgs) {
+        // Codex is special: its `workspace-write` sandbox hardcodes any `.agents/`
+        // (and `.codex/`) directory read-only, but agents-cli keeps every worktree at
+        // `<repo>/.agents/worktrees/<slug>`, so an in-repo build under a static shim
+        // would hit `EROFS`. The shim resolves the repo's `.agents` from `$PWD` at RUN
+        // time — worktree-aware, mirroring repoAgentsDirForCwd — and passes it via
+        // Codex's own `--add-dir`. `--add-dir` is added only when the resolved
+        // `.agents` exists.
+        return `_repo_agents=""
+case "$PWD" in
+  */.agents/worktrees/*) _repo_agents="\${PWD%%/.agents/worktrees/*}/.agents" ;;
+  *)
+    _d="$PWD"
+    # Stop before $HOME so a dotfiles repo at $HOME is not treated as the project
+    # root (mirrors repoRootForCwd's home exclusion in project-key.ts).
+    while [ -n "$_d" ] && [ "$_d" != "/" ] && [ "$_d" != "$HOME" ]; do
+      if [ -e "$_d/.git" ]; then _repo_agents="$_d/.agents"; break; fi
+      _d=$(dirname "$_d")
+    done
+    ;;
+esac
+if [ -n "$_repo_agents" ] && [ -d "$_repo_agents" ]; then
+  exec "$BINARY"${launchArgs} --add-dir "$_repo_agents" "$@"
+fi
+exec "$BINARY"${launchArgs} "$@"`;
+    },
+    execModeArgs(ctx) {
+        const policyMode = ctx.resolvedMode === 'plan' || ctx.resolvedMode === 'skip' ? ctx.resolvedMode : 'edit';
+        const writableRoots = [
+            ...codexEditWritableRoots(ctx.cwd),
+            ...ctx.addDirs,
+        ];
+        return codexPolicyArgs(policyMode, writableRoots);
+    },
+    routineModeArgs(cmd, ctx) {
+        const policyMode = ctx.mode === 'plan' || ctx.mode === 'skip' ? ctx.mode : 'edit';
+        const routineRoots = (ctx.config.allow?.dirs ?? []).map((dir) => {
+            if (dir.startsWith('-')) {
+                throw new Error(`allow.dirs entries must not start with '-': ${JSON.stringify(dir)}`);
+            }
+            return dir.replace(/^~/, os.homedir());
+        });
+        cmd.push(...codexPolicyArgs(policyMode, [...codexEditWritableRoots(), ...routineRoots]));
+    },
+};

package/dist/lib/harness/adapters/copilot.d.ts

@@ -0,0 +1,2 @@
+import type { HarnessAdapter } from '../adapter.js';
+export declare const copilotAdapter: HarnessAdapter;

package/dist/lib/harness/adapters/copilot.js

@@ -0,0 +1,23 @@
+import * as path from 'path';
+import { stripForeignConfigDir } from '../adapter.js';
+export const copilotAdapter = {
+    id: 'copilot',
+    // Copilot honors COPILOT_HOME (relocates ~/.copilot, including settings,
+    // mcp-config.json, sessions, logs). Pin it at the per-version home so
+    // version switches isolate MCP servers, auth, and session history.
+    applyExecConfigEnv(result, ctx) {
+        if (ctx.versionHome) {
+            result.COPILOT_HOME = path.join(ctx.versionHome, '.copilot');
+        }
+        stripForeignConfigDir(result, ['COPILOT_HOME']);
+    },
+    shimConfigEnvBash(ctx) {
+        return `
+# GitHub Copilot CLI honors COPILOT_HOME to relocate its config and state
+# (settings.json, mcp-config.json, session-state/, logs/, plugins/). Point
+# it at the versioned home so MCP servers, custom agents, and session
+# history are isolated per copilot version.
+export COPILOT_HOME="$VERSION_DIR/home/${ctx.configDirName}"
+`;
+    },
+};

package/dist/lib/harness/adapters/cursor.d.ts

@@ -0,0 +1,2 @@
+import type { HarnessAdapter } from '../adapter.js';
+export declare const cursorAdapter: HarnessAdapter;

package/dist/lib/harness/adapters/cursor.js

@@ -0,0 +1,38 @@
+import * as path from 'path';
+import { stripForeignConfigDir } from '../adapter.js';
+export const cursorAdapter = {
+    id: 'cursor',
+    // Cursor has no config-dir env var (only CURSOR_API_KEY / CURSOR_API_ENDPOINT).
+    // Its OAuth token — the login gate — lives at $XDG_CONFIG_HOME/cursor/auth.json
+    // (verified empirically: relocating XDG_CONFIG_HOME relocates the login;
+    // ~/.cursor/cli-config.json holds only account metadata, not the token). Pin
+    // XDG_CONFIG_HOME into the version home so each installed Cursor account
+    // authenticates from its own token, isolated per run — no global ~/.cursor
+    // symlink swap, so concurrent runs on different accounts never clobber one
+    // another. cli-config.json (HOME-relative) has no override and stays on the
+    // shared home; only the token is per-account, which is what gates the login.
+    applyExecConfigEnv(result, ctx) {
+        if (ctx.versionHome) {
+            result.XDG_CONFIG_HOME = path.join(ctx.versionHome, '.config');
+        }
+        stripForeignConfigDir(result);
+    },
+    execPreModeArgs(ctx) {
+        // A configured headless run is the workspace trust decision. Keep this
+        // narrower than --yolo/-f, which also bypasses permission checks.
+        return ctx.resolvedMode === 'edit' && !ctx.interactive ? ['--trust'] : undefined;
+    },
+    routineModeArgs(cmd, ctx) {
+        if (ctx.mode === 'plan') {
+            cmd.push('--plan');
+        }
+        else if (ctx.mode === 'skip') {
+            cmd.push('-f');
+        }
+        else {
+            // The configured cwd is the user's workspace trust decision. --trust is
+            // narrower than --yolo/-f because it does not bypass tool permissions.
+            cmd.push('--trust');
+        }
+    },
+};

package/dist/lib/harness/adapters/droid.d.ts

@@ -0,0 +1,2 @@
+import type { HarnessAdapter } from '../adapter.js';
+export declare const droidAdapter: HarnessAdapter;

package/dist/lib/harness/adapters/droid.js

@@ -0,0 +1,17 @@
+// Droid has no config-dir env pin (exec strips the foreign keys via the registry
+// fallback) and no shim config env. Its only harness quirk is routine autonomy.
+export const droidAdapter = {
+    id: 'droid',
+    // droid exec defaults to read-only (plan). Escalate autonomy per mode.
+    routineModeArgs(cmd, ctx) {
+        if (ctx.mode === 'edit') {
+            cmd.push('--auto', 'low');
+        }
+        else if (ctx.mode === 'auto') {
+            cmd.push('--auto', 'high');
+        }
+        else if (ctx.mode === 'skip') {
+            cmd.push('--skip-permissions-unsafe');
+        }
+    },
+};

package/dist/lib/harness/adapters/grok.d.ts

@@ -0,0 +1,2 @@
+import type { HarnessAdapter } from '../adapter.js';
+export declare const grokAdapter: HarnessAdapter;

package/dist/lib/harness/adapters/grok.js

@@ -0,0 +1,14 @@
+// Grok has no exec-time config-dir env pin (buildExecEnv's `else` strips the
+// foreign keys — the registry fallback preserves that). It DOES relocate its
+// whole config tree via GROK_HOME in the generated shim.
+export const grokAdapter = {
+    id: 'grok',
+    shimConfigEnvBash() {
+        return `
+# Grok Build uses GROK_HOME to isolate its entire configuration tree
+# (skills, hooks, plugins, agents, memory, sessions, config.toml, MCP, etc.).
+# This gives agents-cli full versioned isolation + resource sync for grok.
+export GROK_HOME="$VERSION_DIR/home/.grok"
+`;
+    },
+};

package/dist/lib/harness/adapters/kimi.d.ts

@@ -0,0 +1,2 @@
+import type { HarnessAdapter } from '../adapter.js';
+export declare const kimiAdapter: HarnessAdapter;

package/dist/lib/harness/adapters/kimi.js

@@ -0,0 +1,49 @@
+import * as path from 'path';
+import { stripForeignConfigDir } from '../adapter.js';
+export const kimiAdapter = {
+    id: 'kimi',
+    // Kimi honors KIMI_CODE_HOME (relocates ~/.kimi-code, including config,
+    // skills, hooks, sessions). Pin it at the per-version home.
+    applyExecConfigEnv(result, ctx) {
+        if (ctx.versionHome) {
+            result.KIMI_CODE_HOME = path.join(ctx.versionHome, '.kimi-code');
+        }
+        stripForeignConfigDir(result, ['KIMI_CODE_HOME']);
+    },
+    shimConfigEnvBash(ctx) {
+        return `
+# Kimi Code CLI honors KIMI_CODE_HOME to relocate ~/.kimi-code (config.toml,
+# mcp.json, sessions, skills, hooks). Point it at the versioned home.
+export KIMI_CODE_HOME="$VERSION_DIR/home/${ctx.configDirName}"
+`;
+    },
+    execModeArgs(ctx) {
+        // kimi's headless prompt mode (`-p`/`--prompt`) is self-contained and REFUSES
+        // to be combined with any startup-mode flag: `--plan`, `--auto`, and `--yolo`
+        // all abort with "Cannot combine --prompt with --X" (verified against the live
+        // kimi CLI). The write-capable modes (edit/auto/skip) all collapse to kimi's
+        // default `-p` behavior, which already auto-approves tool calls, so we emit no
+        // mode flag. An interactive kimi run defers to the generic modeFlags path.
+        if (ctx.interactive)
+            return undefined;
+        // Plan can't reach here headless — resolveHeadlessMode already downgraded it to
+        // auto (kimi's headlessPlan:false); this asserts that invariant so a plan-mode
+        // run can never silently mutate the workspace.
+        if (ctx.resolvedMode === 'plan') {
+            throw new Error(`Internal error: kimi reached headless command build with resolved mode 'plan'; ` +
+                `resolveHeadlessMode should have downgraded it to auto (capabilities.headlessPlan is false).`);
+        }
+        // edit/auto/skip: emit no mode flag — `kimi -p` auto-runs.
+        return [];
+    },
+    routineModeArgs(_cmd, ctx) {
+        // kimi daemon jobs always run headless via `--prompt`, which cannot be
+        // combined with any startup-mode flag (--plan/--auto/--yolo all abort with
+        // "Cannot combine --prompt with --X"). edit/auto/skip reduce to kimi's default
+        // headless auto-run, so emit no flag. plan has no headless read-only
+        // equivalent, so resolveHeadlessMode downgrades a plan request to auto with a
+        // stderr warning (kimi's headlessPlan is false) — routines run headless, so
+        // interactive is always false here. The returned mode carries no flag either.
+        ctx.resolveHeadlessMode('kimi', ctx.mode, false);
+    },
+};

package/dist/lib/harness/adapters/muse.d.ts

@@ -0,0 +1,2 @@
+import type { HarnessAdapter } from '../adapter.js';
+export declare const museAdapter: HarnessAdapter;

package/dist/lib/harness/adapters/muse.js

@@ -0,0 +1,44 @@
+import * as path from 'path';
+import { stripForeignConfigDir } from '../adapter.js';
+export const museAdapter = {
+    id: 'muse',
+    // Muse has no MUSE_CONFIG_DIR. Config is XDG-based:
+    //   $XDG_CONFIG_HOME/muse  (settings, skills, hooks, auth)
+    //   $XDG_DATA_HOME/muse    (sessions, plugins)
+    // Pin both into the version home so multi-version isolation matches
+    // Claude's CLAUDE_CONFIG_DIR / Codex's CODEX_HOME, and so Muse never
+    // resolves through the adopt-time ~/.config/muse symlink (SymlinkOrReparse).
+    applyExecConfigEnv(result, ctx) {
+        if (ctx.versionHome) {
+            result.XDG_CONFIG_HOME = path.join(ctx.versionHome, '.config');
+            result.XDG_DATA_HOME = path.join(ctx.versionHome, '.local', 'share');
+        }
+        stripForeignConfigDir(result);
+    },
+    shimConfigEnvBash() {
+        return `
+# Muse Code has no MUSE_CONFIG_DIR. It resolves config via XDG:
+#   $XDG_CONFIG_HOME/muse  (settings, skills, hooks, auth)
+#   $XDG_DATA_HOME/muse    (sessions, plugins)
+# Pin XDG into the version home so managed runs never walk the adopt-time
+# ~/.config/muse -> version-home symlink — Muse refuses agent-definition
+# sources that are SymlinkOrReparse (exit 1). Same idea as CLAUDE_CONFIG_DIR.
+export XDG_CONFIG_HOME="$VERSION_DIR/home/.config"
+export XDG_DATA_HOME="$VERSION_DIR/home/.local/share"
+`;
+    },
+    // muse exec: plan ≈ no non-shell writes; auto skips approval prompts but
+    // keeps the OS sandbox; skip is --yolo (no approval, no sandbox, trust).
+    routineModeArgs(cmd, ctx) {
+        if (ctx.mode === 'plan') {
+            cmd.push('--disable-write');
+        }
+        else if (ctx.mode === 'auto') {
+            cmd.push('--disable-approval');
+        }
+        else if (ctx.mode === 'skip') {
+            cmd.push('--yolo');
+        }
+        // edit: default on-request approval + sandbox
+    },
+};

package/dist/lib/harness/adapters/opencode.d.ts

@@ -0,0 +1,2 @@
+import type { HarnessAdapter } from '../adapter.js';
+export declare const opencodeAdapter: HarnessAdapter;

package/dist/lib/harness/adapters/opencode.js

@@ -0,0 +1,14 @@
+// OpenCode has no exec-time config-dir env pin (buildExecEnv's `else` strips the
+// foreign keys — the registry fallback preserves that). It reads config-directory
+// resources from OPENCODE_CONFIG_DIR, pinned in the generated shim.
+export const opencodeAdapter = {
+    id: 'opencode',
+    shimConfigEnvBash() {
+        return `
+# OpenCode reads plugins, agents, commands, and other config-directory
+# resources from OPENCODE_CONFIG_DIR. Point it at the versioned global config
+# tree where agents-cli syncs OpenCode resources.
+export OPENCODE_CONFIG_DIR="$VERSION_DIR/home/.config/opencode"
+`;
+    },
+};

package/dist/lib/harness/exec-config-version.d.ts

@@ -0,0 +1,8 @@
+import type { AgentId } from '../types.js';
+export interface ResolvedConfigVersion {
+    /** The version to pin, or null when unresolved / not installed. */
+    version: string | null;
+    /** The version home for that version, or null. */
+    versionHome: string | null;
+}
+export declare function resolveConfigVersion(agent: AgentId, cwd: string, optionsVersion?: string): ResolvedConfigVersion;

package/dist/lib/harness/exec-config-version.js

@@ -0,0 +1,22 @@
+/**
+ * Shared version resolution for the exec-time config-dir env pin. Every
+ * config-dir harness branch in the old buildExecEnv computed this identically:
+ * an explicit `--version` is used unconditionally; an auto-resolved version is
+ * only pinned when it is actually installed on disk.
+ *
+ * The caller (buildExecEnv) invokes this and passes the result into the adapter
+ * via ExecConfigEnvCtx — the adapters MUST NOT import installations/versions
+ * themselves, because that module imports shims.ts and shims.ts imports the
+ * harness barrel, which would close an import cycle (versions → shims → harness →
+ * adapter → versions). That cycle forced esbuild/tsx to emit CJS for part of the
+ * graph and broke sqlite.ts's top-level await in subprocess-spawning tests.
+ */
+import { getVersionHomePath, isVersionInstalled, resolveVersion } from '../installations/versions.js';
+export function resolveConfigVersion(agent, cwd, optionsVersion) {
+    const resolvedVersion = optionsVersion ?? resolveVersion(agent, cwd);
+    const version = optionsVersion
+        ? resolvedVersion
+        : (resolvedVersion && isVersionInstalled(agent, resolvedVersion) ? resolvedVersion : null);
+    const versionHome = version ? getVersionHomePath(agent, version) : null;
+    return { version: version ?? null, versionHome };
+}

package/dist/lib/harness/index.d.ts

@@ -0,0 +1 @@
+export { type HarnessAdapter, type ExecConfigEnvCtx, type ShimConfigEnvCtx, type ExecLaunchArgsCtx, type RoutineLaunchCtx, CONFIG_DIR_ENV_KEYS, stripForeignConfigDir, registerHarnessAdapter, resolveHarnessAdapter, listHarnessAdapters, } from './adapter.js';

package/dist/lib/harness/index.js

@@ -0,0 +1,34 @@
+/**
+ * Harness adapter barrel — importing this registers every built-in adapter, the
+ * same pattern as lib/channels/providers/index.ts. Consumers import
+ * `resolveHarnessAdapter` from here (not from ./adapter.js directly) so the
+ * registration side-effect has run before the first resolve.
+ *
+ * A harness with no config-env / launch quirks needs no adapter file: every
+ * `AgentId` still resolves (to the id-only default), so call sites never
+ * name-check a harness.
+ */
+import { registerHarnessAdapter } from './adapter.js';
+import { claudeAdapter } from './adapters/claude.js';
+import { codexAdapter } from './adapters/codex.js';
+import { copilotAdapter } from './adapters/copilot.js';
+import { kimiAdapter } from './adapters/kimi.js';
+import { museAdapter } from './adapters/muse.js';
+import { cursorAdapter } from './adapters/cursor.js';
+import { grokAdapter } from './adapters/grok.js';
+import { opencodeAdapter } from './adapters/opencode.js';
+import { droidAdapter } from './adapters/droid.js';
+for (const adapter of [
+    claudeAdapter,
+    codexAdapter,
+    copilotAdapter,
+    kimiAdapter,
+    museAdapter,
+    cursorAdapter,
+    grokAdapter,
+    opencodeAdapter,
+    droidAdapter,
+]) {
+    registerHarnessAdapter(adapter);
+}
+export { CONFIG_DIR_ENV_KEYS, stripForeignConfigDir, registerHarnessAdapter, resolveHarnessAdapter, listHarnessAdapters, } from './adapter.js';

package/dist/lib/{hooks.d.ts → hooks/install.d.ts}

@@ -28,7 +28,7 @@ export declare function toPortableCommand(absPath: string, home?: string, sep?:
  * outside version homes are user-owned and remain untouched.
  */
 export declare function deduplicateVersionHookCommands(commands: string[], activeVersionHome: string): string[];
-import type { AgentId, HookCacheConfig, HookMatches, InstalledHook, ManifestHook } from './types.js';
+import type { AgentId, HookCacheConfig, HookMatches, InstalledHook, ManifestHook } from '../types.js';
 export type HookEntry = {
     name: string;
     scriptPath: string;

package/dist/lib/{hooks.js → hooks/install.js}

@@ -16,10 +16,10 @@ import * as TOML from 'smol-toml';
 import { execFile, execFileSync } from 'child_process';
 import { promisify } from 'util';
 import { fileURLToPath } from 'url';
-import { AGENTS, agentConfigDirName, isAgentHardDeprecated } from './agents.js';
-import { supports, explainSkip, capableAgents } from './capabilities.js';
-import { getHooksDir as getSystemHooksDir, getUserHooksDir, getUserAgentsDir, getSystemAgentsDir, getProjectAgentsDir, getTrashHooksDir, getEnabledExtraRepos, getResolvedRulesDir, getUserRulesDir, getPerfDir } from './state.js';
-import { collectSubruleHooksFromState } from './rules/compose.js';
+import { AGENTS, agentConfigDirName, isAgentHardDeprecated } from '../agents.js';
+import { supports, explainSkip, capableAgents } from '../capabilities.js';
+import { getHooksDir as getSystemHooksDir, getUserHooksDir, getUserAgentsDir, getSystemAgentsDir, getProjectAgentsDir, getTrashHooksDir, getEnabledExtraRepos, getResolvedRulesDir, getUserRulesDir, getPerfDir } from '../state.js';
+import { collectSubruleHooksFromState } from '../rules/compose.js';
 function getCentralHooksDir() { return getUserHooksDir(); }
 /**
  * Resolve a hook script's absolute path. Checks user dir first, then enabled
@@ -267,9 +267,9 @@ function collapseVersionHookEntries(entries, activeVersionHome) {
         return true;
     });
 }
-import { getEffectiveHome, getGlobalDefault, getVersionHomePath, isVersionIsolated, listInstalledVersions, resolveVersion, } from './installations/versions.js';
-import { generateHookShim, getHookShimPath, isValidHookShimName, parseCacheConfig, removeHookShim } from './hooks/cache.js';
-import { getHookShimsDir } from './state.js';
+import { getEffectiveHome, getGlobalDefault, getVersionHomePath, isVersionIsolated, listInstalledVersions, resolveVersion, } from '../installations/versions.js';
+import { generateHookShim, getHookShimPath, isValidHookShimName, parseCacheConfig, removeHookShim } from './cache.js';
+import { getHookShimsDir } from '../state.js';
 function hookContentHash(scriptPath) {
     return crypto.createHash('sha256').update(fs.readFileSync(scriptPath)).digest('hex');
 }
@@ -3250,13 +3250,13 @@ function registerHooksForHermes(versionHome, manifest, resolveScript, managedPre
 const execFileAsync = promisify(execFile);
 function resolveSessionTrackerRoot() {
     const here = path.dirname(fileURLToPath(import.meta.url));
-    // Built/installed layout: dist/lib/ -> dist/session-tracker
-    const built = path.resolve(here, '..', 'session-tracker');
+    // Built/installed layout: dist/lib/hooks/ -> dist/session-tracker
+    const built = path.resolve(here, '..', '..', 'session-tracker');
     if (fs.existsSync(path.join(built, 'dist', 'hook.sh'))) {
         return built;
     }
-    // Source layout: apps/cli/src/lib/ -> repo root -> packages/session-tracker
-    const source = path.resolve(here, '..', '..', '..', '..', 'packages', 'session-tracker');
+    // Source layout: apps/cli/src/lib/hooks/ -> repo root -> packages/session-tracker
+    const source = path.resolve(here, '..', '..', '..', '..', '..', 'packages', 'session-tracker');
     if (fs.existsSync(path.join(source, 'src', 'hook.sh'))) {
         return source;
     }

package/dist/lib/import.js

@@ -22,7 +22,7 @@ import * as path from 'path';
 import { AGENTS, resolveNativeBinaryPath } from './agents.js';
 import { getUserAgentsDir, getVersionsDir } from './state.js';
 import { setGlobalDefault } from './installations/versions.js';
-import { createShim, createVersionedAlias, ensureShimCurrent, switchHomeFileSymlinks, assertIsolationBoundary } from './shims.js';
+import { createShim, createVersionedAlias, ensureShimCurrent, switchHomeFileSymlinks, assertIsolationBoundary } from './installations/shims.js';
 const IMPORT_VERSION_RE = /^(?:latest|[A-Za-z0-9._+-]{1,64})$/;
 export function isValidImportVersion(version) {
     return IMPORT_VERSION_RE.test(version);

package/dist/lib/installations/index.d.ts

@@ -7,8 +7,8 @@
  * it, so the internal split can change without breaking callers (the Cursor
  * per-installation isolation track consumes exactly this).
  */
-export { INSTALLATION_RECORD_FILE, INSTALLATION_SCHEMA, type Installation, type InstallationRelease, type UpdateOutcome, type UpdateStrategyId, } from './types.js';
-export { createInstallation, ensureInstallation, installationDir, installationRecordPath, listInstallationLabels, listInstallations, mintInstallationId, readInstallation, recordRelease, writeInstallation, } from './store.js';
-export { InstallationAmbiguousError, InstallationNotFoundError, describeInstallation, resolveInstallation, type ResolveInstallationOptions, } from './resolve.js';
-export { assertValidRelease, selectUpdateStrategy, supportsPinnedUpdate, type UpdateStrategy, } from './strategies.js';
+export { type Installation, type InstallationRelease, type UpdateOutcome, type UpdateStrategyId, } from './types.js';
+export { createInstallation, listInstallations, recordRelease, } from './store.js';
+export { describeInstallation, resolveInstallation, type ResolveInstallationOptions, } from './resolve.js';
+export { selectUpdateStrategy, supportsPinnedUpdate, type UpdateStrategy, } from './strategies.js';
 export { updateInstallation, type UpdateInstallationOptions } from './update.js';