@phnx-labs/agents-cli 1.22.40 → 1.22.42

package/dist/lib/plugins/plugins.js

@@ -16,7 +16,7 @@ import { execFileSync } from 'child_process';
 import { getPluginsDir, getTrashPluginsDir, getExtraPluginsDir, getProjectPluginsDir, getSystemPluginsDir } from '../state.js';
 import { IS_WINDOWS, isWindowsAbsolutePath, homeDir } from '../platform/index.js';
 import { assertSafeGitTransport, resolveSnapshotSha } from '../git.js';
-import { listInstalledVersions, getVersionHomePath } from '../installations/versions.js';
+import { listInstalledVersions, getVersionHomePath } from '../installations/store.js';
 import { AGENTS, agentConfigDirName } from '../agents.js';
 import { capableAgents, isCapable } from '../capabilities.js';
 import { shouldInstallCommandAsSkill, installCommandSkillToVersion } from '../command-skills.js';

package/dist/lib/plugins/skills.js

@@ -14,7 +14,7 @@ import { normalizeAliases } from '../resource-aliases.js';
 import { AGENTS, ensureSkillsDir, agentConfigDirName } from '../agents.js';
 import { capableAgents, isCapable } from '../capabilities.js';
 import { getUserSkillsDir, getSkillsDir as getSystemSkillsDir, getProjectAgentsDir, getEnabledExtraRepos, getTrashSkillsDir } from '../state.js';
-import { getEffectiveHome, getVersionHomePath, listInstalledVersions } from '../installations/versions.js';
+import { getEffectiveHome, getVersionHomePath, listInstalledVersions } from '../installations/store.js';
 import { listCommandSkillsInVersion } from '../command-skills.js';
 import { emit } from '../feed/events.js';
 const HOME = os.homedir();

package/dist/lib/prix-account.d.ts

@@ -0,0 +1,158 @@
+/**
+ * Client for the Rush account layer (`api.prix.dev`) — backs `agents auth` and
+ * `agents org`. `agents org` maps to `/api/v1/spaces`, not `/api/v1/orgs`: spaces
+ * already carry the free-tier caps (1 owned space, 3 members) and can exist
+ * standalone with no parent organization, matching a "just want a team" CLI flow
+ * better than the heavier enterprise-tenancy `orgs` routes (domain, SSO). See
+ * `.agents/artifacts/2026-08-20/agi-cli-client-integration-spec.md` §4.2 in the
+ * agi-cli-web repo for the full reasoning and the live-confirmed route/shape audit.
+ *
+ * Token custody: `agents auth login` writes its own session file
+ * (`getPrixSessionFile()`), separate from `~/.rush/user.yaml`, so `agents auth
+ * logout` never signs the user out of `rush` (the two CLIs share a backend
+ * account, not a credential store). Reads fall back to `~/.rush/user.yaml`
+ * (the pattern `readRushToken` in `lib/secrets/drivers/rush.ts` already uses)
+ * so a user who is only signed in via `rush login` still gets a working
+ * `agents auth whoami` / `agents org` with zero extra login step.
+ */
+export declare const PRIX_API_BASE = "https://api.prix.dev";
+/** The session `agents auth login` owns. */
+export interface PrixSession {
+    access_token: string;
+    refresh_token?: string;
+    /** Unix ms. */
+    expires_at?: number;
+    email?: string;
+    userId?: string;
+}
+export declare function getPrixSessionFile(): string;
+export declare function readPrixSession(): PrixSession | null;
+export declare function writePrixSession(session: PrixSession): void;
+export declare function clearPrixSession(): boolean;
+/** Where the caller's Bearer token came from — surfaced by `whoami` so the user knows which login is live. */
+export type PrixTokenSource = 'agents' | 'rush';
+export declare function resolvePrixToken(): {
+    token: string;
+    source: PrixTokenSource;
+} | null;
+export declare class PrixApiError extends Error {
+    status: number;
+    constructor(status: number, message: string);
+}
+export interface WhoAmI {
+    userId: string;
+    email: string;
+    valid: true;
+}
+/** `GET /api/v1/auth/me` — live-confirmed shape: `{email, userId, valid}`. */
+export declare function fetchWhoAmI(token?: string): Promise<WhoAmI>;
+export interface DeviceAuthorization {
+    device_code: string;
+    user_code: string;
+    verification_uri: string;
+    verification_uri_complete: string;
+    expires_in: number;
+    interval: number;
+}
+/** `POST /api/v1/auth/device/authorization` — public, no token. */
+export declare function startDeviceAuthorization(): Promise<DeviceAuthorization>;
+export type DeviceTokenPoll = {
+    status: 'authorized';
+    access_token: string;
+    refresh_token?: string;
+    expires_in?: number;
+    user: {
+        email: string;
+        id: string;
+    };
+} | {
+    status: 'pending';
+} | {
+    status: 'slow_down';
+} | {
+    status: 'expired';
+} | {
+    status: 'denied';
+};
+/** `POST /api/v1/auth/device/token` — one poll attempt. Callers own the interval loop. */
+export declare function pollDeviceToken(deviceCode: string): Promise<DeviceTokenPoll>;
+export interface SpaceSummary {
+    id: string;
+    slug: string;
+    name: string;
+    organization_id: string | null;
+    owner_user_id: string;
+    invite_code?: string;
+    user_role: 'owner' | 'admin' | 'member';
+    created_at: string;
+}
+export interface SpaceMember {
+    user_id: string;
+    email: string;
+    name?: string;
+    avatar_url?: string;
+    role: 'owner' | 'admin' | 'member';
+    joined_at: string;
+}
+/** `GET /api/v1/spaces` — live-confirmed: array of `SpaceSummary`. */
+export declare function listSpaces(): Promise<SpaceSummary[]>;
+/** `POST /api/v1/spaces` — 403 if the caller already owns a space (free tier: 1). */
+export declare function createSpace(input: {
+    name: string;
+    slug: string;
+    description?: string;
+}): Promise<SpaceSummary>;
+/** `GET /api/v1/spaces/:id` — requires membership. */
+export declare function getSpace(spaceId: string): Promise<SpaceSummary>;
+/** `GET /api/v1/spaces/:id/members`. */
+export declare function listSpaceMembers(spaceId: string): Promise<SpaceMember[]>;
+export type CreateSpaceInviteResult = {
+    invited: true;
+    email: string;
+    role: string;
+    member_added: true;
+} | {
+    invited: true;
+    email: string;
+    role: string;
+    invite_code: string;
+    member_added?: false;
+};
+/** `POST /api/v1/spaces/:id/invites` — sends a real email for the pending-invite path. */
+export declare function createSpaceInvite(spaceId: string, email: string, role?: 'admin' | 'member'): Promise<CreateSpaceInviteResult>;
+export interface SpaceInvite {
+    id: string;
+    space_id: string;
+    email: string;
+    role: 'admin' | 'member';
+    invite_code: string;
+    created_at: string;
+}
+/** `GET /api/v1/spaces/:id/invites`. */
+export declare function listSpaceInvites(spaceId: string): Promise<SpaceInvite[]>;
+/** `DELETE /api/v1/spaces/:id/invites/:inviteId`. */
+export declare function revokeSpaceInvite(spaceId: string, inviteId: string): Promise<{
+    revoked: true;
+}>;
+/** `PATCH /api/v1/spaces/:id/members/:userId` — owner-only for admin changes. Route takes userId, not email. */
+export declare function updateSpaceMemberRole(spaceId: string, userId: string, role: 'admin' | 'member'): Promise<{
+    user_id: string;
+    role: string;
+    updated: true;
+}>;
+/** `DELETE /api/v1/spaces/:id/members/:userId` — owner, admin, or the member themself (leave). */
+export declare function removeSpaceMember(spaceId: string, userId: string): Promise<void>;
+/** `DELETE /api/v1/spaces/:id` — soft delete, 30-day restore window. */
+export declare function deleteSpace(spaceId: string): Promise<void>;
+/** `agents-cli-space-name` -> `agi-cli-space-name`; lowercase, hyphenated, matches the backend's `^[a-z0-9-]+$` slug rule. */
+export declare function slugify(name: string): string;
+/**
+ * Resolve the `--space` a command should act on: an explicit id/slug match
+ * against the caller's own space list, or — with nothing passed — the
+ * caller's sole space (free tier caps ownership at one, so this is almost
+ * always unambiguous). Pure over an already-fetched list so it's cheaply
+ * unit-testable with a fixture.
+ */
+export declare function resolveSpaceFromList(spaces: SpaceSummary[], explicit?: string): SpaceSummary;
+/** Resolve a member's email to their `user_id` from an already-fetched member list. */
+export declare function resolveMemberFromList(members: SpaceMember[], email: string): SpaceMember;

package/dist/lib/prix-account.js

@@ -0,0 +1,214 @@
+/**
+ * Client for the Rush account layer (`api.prix.dev`) — backs `agents auth` and
+ * `agents org`. `agents org` maps to `/api/v1/spaces`, not `/api/v1/orgs`: spaces
+ * already carry the free-tier caps (1 owned space, 3 members) and can exist
+ * standalone with no parent organization, matching a "just want a team" CLI flow
+ * better than the heavier enterprise-tenancy `orgs` routes (domain, SSO). See
+ * `.agents/artifacts/2026-08-20/agi-cli-client-integration-spec.md` §4.2 in the
+ * agi-cli-web repo for the full reasoning and the live-confirmed route/shape audit.
+ *
+ * Token custody: `agents auth login` writes its own session file
+ * (`getPrixSessionFile()`), separate from `~/.rush/user.yaml`, so `agents auth
+ * logout` never signs the user out of `rush` (the two CLIs share a backend
+ * account, not a credential store). Reads fall back to `~/.rush/user.yaml`
+ * (the pattern `readRushToken` in `lib/secrets/drivers/rush.ts` already uses)
+ * so a user who is only signed in via `rush login` still gets a working
+ * `agents auth whoami` / `agents org` with zero extra login step.
+ */
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+import * as yaml from 'yaml';
+import { getRuntimeStateDir } from './state.js';
+export const PRIX_API_BASE = 'https://api.prix.dev';
+const RUSH_USER_YAML = path.join(os.homedir(), '.rush', 'user.yaml');
+/** Computed per-call (not cached at module load) so `AGENTS_STATE_DIR` overrides in tests take effect. */
+function prixSessionFile() {
+    return path.join(getRuntimeStateDir(), 'prix-account.json');
+}
+/** Read the token `rush login` wrote, with no expiry check — the same shape `readRushToken` reads. */
+function readRushSessionToken() {
+    if (!fs.existsSync(RUSH_USER_YAML))
+        return null;
+    try {
+        const data = yaml.parse(fs.readFileSync(RUSH_USER_YAML, 'utf-8'));
+        return data?.session?.access_token ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+export function getPrixSessionFile() {
+    return prixSessionFile();
+}
+export function readPrixSession() {
+    const file = prixSessionFile();
+    if (!fs.existsSync(file))
+        return null;
+    try {
+        const parsed = JSON.parse(fs.readFileSync(file, 'utf-8'));
+        if (!parsed || typeof parsed.access_token !== 'string')
+            return null;
+        return parsed;
+    }
+    catch {
+        return null;
+    }
+}
+export function writePrixSession(session) {
+    const file = prixSessionFile();
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    const tmp = `${file}.${process.pid}.tmp`;
+    fs.writeFileSync(tmp, JSON.stringify(session, null, 2), { mode: 0o600 });
+    fs.renameSync(tmp, file);
+}
+export function clearPrixSession() {
+    const file = prixSessionFile();
+    if (!fs.existsSync(file))
+        return false;
+    fs.rmSync(file);
+    return true;
+}
+export function resolvePrixToken() {
+    const own = readPrixSession();
+    if (own?.access_token)
+        return { token: own.access_token, source: 'agents' };
+    const rushToken = readRushSessionToken();
+    if (rushToken)
+        return { token: rushToken, source: 'rush' };
+    return null;
+}
+export class PrixApiError extends Error {
+    status;
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+        this.name = 'PrixApiError';
+    }
+}
+async function prixRequest(method, endpoint, opts = {}) {
+    const auth = opts.auth !== false;
+    let token = opts.token;
+    if (auth && !token) {
+        const resolved = resolvePrixToken();
+        if (!resolved)
+            throw new Error("Not signed in. Run 'agents auth login' first.");
+        token = resolved.token;
+    }
+    const headers = { 'Content-Type': 'application/json' };
+    if (token)
+        headers.Authorization = `Bearer ${token}`;
+    const res = await fetch(`${PRIX_API_BASE}${endpoint}`, {
+        method,
+        headers,
+        body: opts.body === undefined ? undefined : JSON.stringify(opts.body),
+    });
+    const text = await res.text();
+    const data = text ? JSON.parse(text) : undefined;
+    if (!res.ok) {
+        const message = (data && typeof data === 'object' && 'error' in data) ? String(data.error) : `${res.status} ${res.statusText}`;
+        throw new PrixApiError(res.status, message);
+    }
+    return data;
+}
+/** `GET /api/v1/auth/me` — live-confirmed shape: `{email, userId, valid}`. */
+export async function fetchWhoAmI(token) {
+    return prixRequest('GET', '/api/v1/auth/me', { token });
+}
+/** `POST /api/v1/auth/device/authorization` — public, no token. */
+export async function startDeviceAuthorization() {
+    return prixRequest('POST', '/api/v1/auth/device/authorization', { auth: false, body: {} });
+}
+/** `POST /api/v1/auth/device/token` — one poll attempt. Callers own the interval loop. */
+export async function pollDeviceToken(deviceCode) {
+    try {
+        const data = await prixRequest('POST', '/api/v1/auth/device/token', { auth: false, body: { grant_type: 'urn:ietf:params:oauth:grant-type:device_code', device_code: deviceCode } });
+        return { status: 'authorized', ...data };
+    }
+    catch (err) {
+        if (err instanceof PrixApiError) {
+            if (err.message.includes('authorization_pending'))
+                return { status: 'pending' };
+            if (err.message.includes('slow_down'))
+                return { status: 'slow_down' };
+            if (err.message.includes('expired_token'))
+                return { status: 'expired' };
+            if (err.message.includes('access_denied'))
+                return { status: 'denied' };
+        }
+        throw err;
+    }
+}
+/** `GET /api/v1/spaces` — live-confirmed: array of `SpaceSummary`. */
+export async function listSpaces() {
+    return prixRequest('GET', '/api/v1/spaces');
+}
+/** `POST /api/v1/spaces` — 403 if the caller already owns a space (free tier: 1). */
+export async function createSpace(input) {
+    return prixRequest('POST', '/api/v1/spaces', { body: input });
+}
+/** `GET /api/v1/spaces/:id` — requires membership. */
+export async function getSpace(spaceId) {
+    return prixRequest('GET', `/api/v1/spaces/${encodeURIComponent(spaceId)}`);
+}
+/** `GET /api/v1/spaces/:id/members`. */
+export async function listSpaceMembers(spaceId) {
+    return prixRequest('GET', `/api/v1/spaces/${encodeURIComponent(spaceId)}/members`);
+}
+/** `POST /api/v1/spaces/:id/invites` — sends a real email for the pending-invite path. */
+export async function createSpaceInvite(spaceId, email, role = 'member') {
+    return prixRequest('POST', `/api/v1/spaces/${encodeURIComponent(spaceId)}/invites`, { body: { email, role } });
+}
+/** `GET /api/v1/spaces/:id/invites`. */
+export async function listSpaceInvites(spaceId) {
+    return prixRequest('GET', `/api/v1/spaces/${encodeURIComponent(spaceId)}/invites`);
+}
+/** `DELETE /api/v1/spaces/:id/invites/:inviteId`. */
+export async function revokeSpaceInvite(spaceId, inviteId) {
+    return prixRequest('DELETE', `/api/v1/spaces/${encodeURIComponent(spaceId)}/invites/${encodeURIComponent(inviteId)}`);
+}
+/** `PATCH /api/v1/spaces/:id/members/:userId` — owner-only for admin changes. Route takes userId, not email. */
+export async function updateSpaceMemberRole(spaceId, userId, role) {
+    return prixRequest('PATCH', `/api/v1/spaces/${encodeURIComponent(spaceId)}/members/${encodeURIComponent(userId)}`, { body: { role } });
+}
+/** `DELETE /api/v1/spaces/:id/members/:userId` — owner, admin, or the member themself (leave). */
+export async function removeSpaceMember(spaceId, userId) {
+    await prixRequest('DELETE', `/api/v1/spaces/${encodeURIComponent(spaceId)}/members/${encodeURIComponent(userId)}`);
+}
+/** `DELETE /api/v1/spaces/:id` — soft delete, 30-day restore window. */
+export async function deleteSpace(spaceId) {
+    await prixRequest('DELETE', `/api/v1/spaces/${encodeURIComponent(spaceId)}`);
+}
+/** `agents-cli-space-name` -> `agi-cli-space-name`; lowercase, hyphenated, matches the backend's `^[a-z0-9-]+$` slug rule. */
+export function slugify(name) {
+    const slug = name.toLowerCase().trim().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '');
+    return slug || 'space';
+}
+/**
+ * Resolve the `--space` a command should act on: an explicit id/slug match
+ * against the caller's own space list, or — with nothing passed — the
+ * caller's sole space (free tier caps ownership at one, so this is almost
+ * always unambiguous). Pure over an already-fetched list so it's cheaply
+ * unit-testable with a fixture.
+ */
+export function resolveSpaceFromList(spaces, explicit) {
+    if (explicit) {
+        const match = spaces.find(s => s.id === explicit || s.slug === explicit);
+        if (!match)
+            throw new Error(`No space matching '${explicit}'. Run 'agents org list' to see your spaces.`);
+        return match;
+    }
+    if (spaces.length === 0)
+        throw new Error("You have no spaces. Create one with 'agents org create <name>'.");
+    if (spaces.length > 1) {
+        throw new Error(`You belong to ${spaces.length} spaces — pass --space <id-or-slug>: ${spaces.map(s => s.slug).join(', ')}`);
+    }
+    return spaces[0];
+}
+/** Resolve a member's email to their `user_id` from an already-fetched member list. */
+export function resolveMemberFromList(members, email) {
+    const match = members.find(m => m.email.toLowerCase() === email.toLowerCase());
+    if (!match)
+        throw new Error(`'${email}' is not a member of this space. Run 'agents org members' to see who is.`);
+    return match;
+}

package/dist/lib/project-key.js

@@ -55,6 +55,13 @@ export function repoRootForCwd(dir, home = os.homedir()) {
     for (;;) {
         if (fs.existsSync(path.join(current, '.git')))
             return current === stop ? undefined : current;
+        // Never climb past $HOME: an ancestor of home (/tmp, /, ...) is not part of
+        // any project this cwd belongs to, and treating one as the repo root would
+        // let unrelated host state (e.g. a stray /tmp/.git) swallow every loose
+        // directory under home. Mirrors the shim's own home boundary — see the codex
+        // adapter's shimExecTail (lib/harness/adapters/codex.ts).
+        if (current === stop)
+            return undefined;
         const parent = path.dirname(current);
         if (parent === current)
             return undefined;

package/dist/lib/project-launch.js

@@ -86,7 +86,7 @@ export function runLaunchSync(opts) {
 }
 /**
  * Path of the shim's skip-fast sentinel for this (agent, version, cwd) tuple.
- * Must match the SHIM-SIDE format in src/lib/shims.ts (PROJECT_SLUG derivation),
+ * Must match the SHIM-SIDE format in src/lib/installations/shims.ts (PROJECT_SLUG derivation),
  * which is the canonical `toPortableKey` mapping: drop the Windows drive colon
  * and fold `\`, `/`, and ` ` → `_`. On POSIX this is byte-identical to the old
  * `/` and ` ` → `_` slug; on Windows it yields a legal filename (no `C:\`).

package/dist/lib/refresh.js

@@ -20,8 +20,8 @@ import { readManifest, MANIFEST_FILENAME } from './manifest.js';
 import { getUserAgentsDir } from './state.js';
 import { installVersion, listInstalledVersions, isVersionIsolated, getGlobalDefault, setGlobalDefault, getVersionHomePath, syncResourcesToVersion, getAvailableResources, getActuallySyncedResources, getNewResources, getProjectOnlyResources, hasNewResources, promptNewResourceSelection, promptResourceSelection, resolveConfiguredAgentTargets, } from './installations/versions.js';
 import { listCliStatus, installCli, describeMethod, describeCheck, selectInstallMethod, } from './cli-resources.js';
-import { ensureShimCurrent, isShimsInPath, addShimsToPath, getPathSetupInstructions, switchConfigSymlink, switchHomeFileSymlinks, } from './shims.js';
-import { parseHookManifest, registerHooksToSettings } from './hooks.js';
+import { ensureShimCurrent, isShimsInPath, addShimsToPath, getPathSetupInstructions, switchConfigSymlink, switchHomeFileSymlinks, } from './installations/shims.js';
+import { parseHookManifest, registerHooksToSettings } from './hooks/install.js';
 import { isPromptCancelled } from './format.js';
 /**
  * Old repo layout stored promptcuts under claude/promptcuts.yaml (agent-scoped).

package/dist/lib/resource-inventory.d.ts

@@ -18,7 +18,7 @@
  * muse), Grok hooks.json, and Kimi config.toml via checkVersionHookWiring.
  */
 import type { AgentId } from './types.js';
-import { type HookWiringReport } from './hooks.js';
+import { type HookWiringReport } from './hooks/install.js';
 /** Resource kinds the inventory can report. Only 'hooks' is implemented so far
  *  (RUSH-2238); the remaining kinds land with their follow-up tickets. */
 export type InventoryKind = 'hooks' | 'skills' | 'commands' | 'plugins' | 'mcp';

package/dist/lib/resource-inventory.js

@@ -20,7 +20,7 @@
 import { AGENTS } from './agents.js';
 import { supports } from './capabilities.js';
 import { listResources } from './resources.js';
-import { checkVersionHookWiring, listHooksInVersionHome, listInstalledHooksWithScope, } from './hooks.js';
+import { checkVersionHookWiring, listHooksInVersionHome, listInstalledHooksWithScope, } from './hooks/install.js';
 const IMPLEMENTED_KINDS = ['hooks'];
 /**
  * The single inventory API. Harness-scoped (claude/codex/grok/kimi/droid) —

package/dist/lib/rules/rules.js

@@ -10,7 +10,7 @@ import * as fs from 'fs';
 import * as path from 'path';
 import { AGENTS, ALL_AGENT_IDS, agentConfigDirName } from '../agents.js';
 import { getResolvedRulesDir, getUserRulesDir, getProjectAgentsDir } from '../state.js';
-import { getEffectiveHome } from '../installations/versions.js';
+import { getEffectiveHome } from '../installations/store.js';
 /**
  * Central rules filename constant.
  * All agents map to this file in ~/.agents/rules/, renamed per-agent when synced.

package/dist/lib/scheduling/routines.js

@@ -25,7 +25,7 @@ import { enabledRoutineNames, devicesWithRoutineEnabled, replaceEnabledRoutines,
 import { humanizeCron, humanizeNextRun } from '../routines-format.js';
 import { discoverProjectRoutines } from '../routines-project.js';
 import { listProjectDefs } from '../projects.js';
-import { monitorRunningJobs } from '../runner.js';
+import { monitorRunningJobs } from '../daemon/runner.js';
 import { JobScheduler } from '../scheduler.js';
 import { detectOverdueJobs } from '../overdue.js';
 export function fireConditionLabel(job) {

package/dist/lib/secrets/bundles.d.ts

@@ -305,7 +305,7 @@ export declare function resolveBundleEnv(bundle: SecretsBundle, _opts?: ResolveB
  * path in index.ts can share it without a bundles↔index import cycle. See that
  * module for the full contract.
  */
-export { isHeadlessSecretsContext } from './headless.js';
+export { isHeadlessSecretsContext, isAgentInvocationContext } from './headless.js';
 /**
  * Read a bundle's metadata AND resolve its env in a single Touch ID prompt.
  *

package/dist/lib/secrets/bundles.js

@@ -1211,7 +1211,7 @@ export function resolveBundleEnv(bundle, _opts = {}) {
  * path in index.ts can share it without a bundles↔index import cycle. See that
  * module for the full contract.
  */
-export { isHeadlessSecretsContext } from './headless.js';
+export { isHeadlessSecretsContext, isAgentInvocationContext } from './headless.js';
 /**
  * Read a bundle's metadata AND resolve its env in a single Touch ID prompt.
  *

package/dist/lib/secrets/headless.d.ts

@@ -25,3 +25,19 @@
  * the per-caller broker-only pattern used across the headless secrets readers.
  */
 export declare function isHeadlessSecretsContext(env?: NodeJS.ProcessEnv, platform?: NodeJS.Platform): boolean;
+/**
+ * True when this process runs structurally inside a coding-agent session: any
+ * `agents run` launch (AGENTS_RUNTIME / AGENT_SESSION_ID ride the child env —
+ * exec.ts buildExecEnv — and are inherited by every shell the agent spawns), or
+ * a harness's own tool shell launched outside agents-cli (Claude Code stamps
+ * CLAUDECODE on its Bash tool).
+ *
+ * Distinct from isHeadlessSecretsContext above on both axes: it is
+ * platform-independent (no biometry involved), and a TTY does not clear it (an
+ * agent inside tmux has one). Its job is the materialization boundary, not the
+ * prompt boundary: a command that would PRINT a plaintext value refuses under
+ * an agent, because anything printed lands in the agent's context and session
+ * transcript. The agent path to secret values is injection — `secrets exec`,
+ * `run --secrets` — which places them only in a child process env.
+ */
+export declare function isAgentInvocationContext(env?: NodeJS.ProcessEnv): boolean;

package/dist/lib/secrets/headless.js

@@ -33,3 +33,24 @@ export function isHeadlessSecretsContext(env = process.env, platform = process.p
         return true;
     return false;
 }
+/**
+ * True when this process runs structurally inside a coding-agent session: any
+ * `agents run` launch (AGENTS_RUNTIME / AGENT_SESSION_ID ride the child env —
+ * exec.ts buildExecEnv — and are inherited by every shell the agent spawns), or
+ * a harness's own tool shell launched outside agents-cli (Claude Code stamps
+ * CLAUDECODE on its Bash tool).
+ *
+ * Distinct from isHeadlessSecretsContext above on both axes: it is
+ * platform-independent (no biometry involved), and a TTY does not clear it (an
+ * agent inside tmux has one). Its job is the materialization boundary, not the
+ * prompt boundary: a command that would PRINT a plaintext value refuses under
+ * an agent, because anything printed lands in the agent's context and session
+ * transcript. The agent path to secret values is injection — `secrets exec`,
+ * `run --secrets` — which places them only in a child process env.
+ */
+export function isAgentInvocationContext(env = process.env) {
+    return Boolean(env.AGENTS_RUNTIME ||
+        env.AGENT_SESSION_ID ||
+        env.AGENTS_SESSION_ID ||
+        env.CLAUDECODE);
+}

package/dist/lib/secrets/remote.d.ts

@@ -169,9 +169,10 @@ export type RemoteKeychainWriteVerification = {
  * metadata `noAcl` last — bundles.ts writeBundleWithItems). The metadata-only bundle
  * then fails every later read with the confusing `Bundle '<b>' key '<k>': stored
  * item '<item>' not found` (bundles.ts resolveBundleEnv). We catch it by reading
- * the bundle back the same way a release will (`secrets export --plaintext --format
- * json`, driven headlessly on the remote so its `agentOnly` guard FAILS FAST before
- * any keychain read — no Touch ID prompt) and confirming every pushed key returned.
+ * the bundle back the same way a later `secrets exec`/resolve will (the marker-gated
+ * json transport, driven headlessly on the remote so its `agentOnly` guard FAILS FAST
+ * before any keychain read — no Touch ID prompt) and confirming every pushed key
+ * returned.
  *
  * Pure so both branches are unit-testable without a real locked keychain: inject the
  * "read-back failed / key absent" condition through `readBack`.
@@ -193,10 +194,11 @@ export declare function keychainWriteFailureMessage(host: string, bundle: string
 /**
  * Read a bundle back from a remote over SSH (headlessly, so it fails fast rather
  * than prompting Touch ID) and confirm the pushed keys materialized. Drives the
- * remote's own `secrets export <bundle> --plaintext --format json` — the same read
- * a headless release performs — but keeps only the KEY NAMES; the plaintext values
- * are dropped immediately and never retained or logged. Returns a verification
- * verdict; the caller renders `keychainWriteFailureMessage` on failure.
+ * remote's marker-gated json transport (`secrets export <bundle> --plaintext
+ * --format json` under AGENTS_SECRETS_REMOTE_TRANSPORT) but keeps only the KEY
+ * NAMES; the plaintext values are dropped immediately and never retained or
+ * logged. Returns a verification verdict; the caller renders
+ * `keychainWriteFailureMessage` on failure.
  */
 export declare function verifyRemoteKeychainPush(target: string, bundle: string, pushedKeys: string[], opts?: {
     osLookupName?: string;

package/dist/lib/secrets/remote.js

@@ -212,7 +212,12 @@ export function remoteSecretsStream(target, args, opts = {}) {
  */
 export async function remoteResolveEnv(target, bundle, opts = {}) {
     assertValidSshTarget(target);
-    const remoteCmd = buildRemoteAgentsInvocation(['secrets', 'export', bundle, '--plaintext', '--format', 'json'], undefined, osForTarget(target, opts.osLookupName));
+    // AGENTS_SECRETS_REMOTE_TRANSPORT is the marker that lets the remote's
+    // `export --plaintext --format json` emit at all — the public shell-eval
+    // export mode was removed (RUSH-2774), and this machine-to-machine resolve is
+    // the only surviving caller of the JSON emitter. Riding the legacy argv keeps
+    // a new driver compatible with an old remote during a fleet rollout.
+    const remoteCmd = buildRemoteAgentsInvocation(['secrets', 'export', bundle, '--plaintext', '--format', 'json'], undefined, osForTarget(target, opts.osLookupName), { AGENTS_SECRETS_REMOTE_TRANSPORT: '1' });
     // Resolving a remote bundle streams its plaintext values back over ssh stdout,
     // so this read is secret-bearing: pin the managed host key and never leave a
     // reusable control master to the source (RUSH-2527, `credentialTransportSshOpts`).
@@ -299,9 +304,10 @@ function isLockedKeychainReadBackError(stderr) {
  * metadata `noAcl` last — bundles.ts writeBundleWithItems). The metadata-only bundle
  * then fails every later read with the confusing `Bundle '<b>' key '<k>': stored
  * item '<item>' not found` (bundles.ts resolveBundleEnv). We catch it by reading
- * the bundle back the same way a release will (`secrets export --plaintext --format
- * json`, driven headlessly on the remote so its `agentOnly` guard FAILS FAST before
- * any keychain read — no Touch ID prompt) and confirming every pushed key returned.
+ * the bundle back the same way a later `secrets exec`/resolve will (the marker-gated
+ * json transport, driven headlessly on the remote so its `agentOnly` guard FAILS FAST
+ * before any keychain read — no Touch ID prompt) and confirming every pushed key
+ * returned.
  *
  * Pure so both branches are unit-testable without a real locked keychain: inject the
  * "read-back failed / key absent" condition through `readBack`.
@@ -359,13 +365,16 @@ export function keychainWriteFailureMessage(host, bundle, reason) {
 /**
  * Read a bundle back from a remote over SSH (headlessly, so it fails fast rather
  * than prompting Touch ID) and confirm the pushed keys materialized. Drives the
- * remote's own `secrets export <bundle> --plaintext --format json` — the same read
- * a headless release performs — but keeps only the KEY NAMES; the plaintext values
- * are dropped immediately and never retained or logged. Returns a verification
- * verdict; the caller renders `keychainWriteFailureMessage` on failure.
+ * remote's marker-gated json transport (`secrets export <bundle> --plaintext
+ * --format json` under AGENTS_SECRETS_REMOTE_TRANSPORT) but keeps only the KEY
+ * NAMES; the plaintext values are dropped immediately and never retained or
+ * logged. Returns a verification verdict; the caller renders
+ * `keychainWriteFailureMessage` on failure.
  */
 export function verifyRemoteKeychainPush(target, bundle, pushedKeys, opts = {}) {
-    const remoteCmd = buildRemoteAgentsInvocation(['secrets', 'export', bundle, '--plaintext', '--format', 'json'], undefined, osForTarget(target, opts.osLookupName));
+    const remoteCmd = buildRemoteAgentsInvocation(['secrets', 'export', bundle, '--plaintext', '--format', 'json'], undefined, osForTarget(target, opts.osLookupName), 
+    // Same transport marker as remoteResolveEnv — see the comment there (RUSH-2774).
+    { AGENTS_SECRETS_REMOTE_TRANSPORT: '1' });
     // This read-back streams the just-pushed plaintext over ssh stdout, so it is
     // as secret-bearing as the push itself — the push path passes `secret: true`
     // so it too pins the managed host key and leaves no reusable control master to

package/dist/lib/self-heal/checks/hook-runtime.js

@@ -4,7 +4,7 @@
 // or broken — silent breakage. Repair runs at most once per unique path per
 // pass (no retry, no sync recursion); unresolved findings stay needsAttention.
 import { resultOf } from '../types.js';
-import { repairManagedHookRuntimeArtifacts } from '../../hooks.js';
+import { repairManagedHookRuntimeArtifacts } from '../../hooks/install.js';
 export const hookRuntimeCheck = {
     id: 'hook-runtime',
     title: 'Generated hook runtime shims',

package/dist/lib/self-heal/checks/path.js

@@ -6,7 +6,7 @@
 // Caveat: an already-open shell won't pick up the new rc/PATH entry until it reloads
 // — but new shells will, so the recurring prompt stops.
 import { resultOf } from '../types.js';
-import { isShimsInPath, addShimsToPath, listAgentsWithNonIsolatedInstalledVersions } from '../../shims.js';
+import { isShimsInPath, addShimsToPath, listAgentsWithNonIsolatedInstalledVersions } from '../../installations/shims.js';
 export const pathCheck = {
     id: 'path',
     title: 'Shims directory on PATH',