@phnx-labs/agents-cli 1.22.40 → 1.22.42

package/dist/lib/settings-manifest.js

@@ -13,16 +13,26 @@
  * version home. It never overwrites a value the target already has: scalars
  * keep the target's value, objects merge recursively, arrays union. That makes
  * the operation idempotent and safe to run on every `agents add` / `agents use`.
+ * (One scoped exception: the 'claude-trust' strategy promotes a stamped-default
+ * `hasTrustDialogAccepted: false` to `true` — see the note on that entry.)
  */
 import * as fs from 'fs';
 import * as path from 'path';
 import * as TOML from 'smol-toml';
+import { atomicWriteFileSync } from './fs-atomic.js';
 import { getBackupsDir } from './state.js';
 const SETTINGS_MANIFEST = {
     claude: [
         { rel: '.claude/settings.json', strategy: 'json-merge' },
         { rel: '.claude/settings.local.json', strategy: 'copy-if-absent' },
         { rel: '.claude/keybindings.json', strategy: 'copy-if-absent' },
+        // `.claude.json` holds the login (oauthAccount) and per-session stats, so it
+        // must never merge wholesale — but it is also where Claude records workspace
+        // trust (`projects[<path>].hasTrustDialogAccepted`). Without carrying that,
+        // every newly pinned version re-shows the trust dialog once per project
+        // (issue #2776). The 'claude-trust' strategy projects ONLY the trust flags
+        // out of the source file; credentials and stats stay per-version.
+        { rel: '.claude.json', strategy: 'claude-trust' },
     ],
     codex: [
         {
@@ -33,9 +43,10 @@ const SETTINGS_MANIFEST = {
         // `.codex/auth.json` is deliberately NOT carried forward. Copying it seeded
         // every new Codex version with the current default's ChatGPT token, so two
         // installed versions always reported the same account and could never sign
-        // into separate accounts. Claude omits its credential (`.claude.json`) for
-        // the same reason — a version home holds its own login, keeping accounts
-        // per-version. A fresh Codex version installs signed-out; run `codex login`
+        // into separate accounts. Claude never merges `.claude.json` for the same
+        // reason (its 'claude-trust' entry extracts only the trust flags) — a
+        // version home holds its own login, keeping accounts per-version. A fresh
+        // Codex version installs signed-out; run `codex login`
         // (or `agents run codex --version <v>`) inside it to authenticate.
         { rel: '.codex/instructions.md', strategy: 'copy-if-absent' },
         { rel: '.codex/hooks.json', strategy: 'copy-if-absent' },
@@ -70,6 +81,21 @@ export function fillGaps(target, source) {
     }
     return out;
 }
+/**
+ * Project paths the source `.claude.json` records an accepted trust dialog for.
+ * Only an explicit `true` counts: Claude Code never persists a decline (the
+ * dialog exits without writing), so `false` is only ever the stamped default —
+ * not a user decision worth propagating. Verified against Claude Code
+ * 2.1.219/2.1.220 (decline paths exit via code 1 / code 0 without a config
+ * write); if a future Claude Code starts persisting declines, this premise —
+ * and the false→true promotion in the 'claude-trust' case — must be revisited.
+ */
+function trustedClaudeProjects(source) {
+    const projects = isPlainObject(source.projects) ? source.projects : {};
+    return Object.entries(projects)
+        .filter(([, project]) => isPlainObject(project) && project.hasTrustDialogAccepted === true)
+        .map(([projectPath]) => projectPath);
+}
 function stripStateKeys(obj, stateKeys) {
     if (!stateKeys?.length)
         return obj;
@@ -128,6 +154,58 @@ export function carryForwardSettings(agent, fromHome, toHome) {
                         result.applied.push(entry.rel);
                     break;
                 }
+                case 'claude-trust': {
+                    // Projection, not a merge: pull ONLY `projects[<path>].hasTrustDialogAccepted`
+                    // out of the source `.claude.json`. Everything else in that file
+                    // (oauthAccount, onboarding state, per-session stats) stays per-version.
+                    // Trust granted anywhere wins over the target's stamped-default `false`
+                    // (headless runs create project entries with the flag unset-as-false
+                    // without ever showing the dialog), but a target entry's other keys
+                    // are preserved untouched.
+                    const source = JSON.parse(fs.readFileSync(sourcePath, 'utf-8'));
+                    const trusted = trustedClaudeProjects(source);
+                    if (trusted.length === 0)
+                        break;
+                    const targetExists = fs.existsSync(targetPath);
+                    const parsedTarget = targetExists
+                        ? JSON.parse(fs.readFileSync(targetPath, 'utf-8'))
+                        : {};
+                    // A target that isn't an object (or whose `projects` isn't) is not
+                    // ours to repair — skip rather than clobber it with a rebuilt shape.
+                    if (!isPlainObject(parsedTarget))
+                        break;
+                    const targetObj = parsedTarget;
+                    if ('projects' in targetObj && !isPlainObject(targetObj.projects))
+                        break;
+                    const targetProjects = isPlainObject(targetObj.projects) ? { ...targetObj.projects } : {};
+                    let changed = false;
+                    for (const projectPath of trusted) {
+                        const existing = isPlainObject(targetProjects[projectPath])
+                            ? targetProjects[projectPath]
+                            : {};
+                        if (existing.hasTrustDialogAccepted === true)
+                            continue;
+                        targetProjects[projectPath] = { ...existing, hasTrustDialogAccepted: true };
+                        changed = true;
+                    }
+                    if (!changed)
+                        break;
+                    if (targetExists) {
+                        backupFile(backupRoot, toHome, entry.rel);
+                        result.backupDir = backupRoot;
+                    }
+                    else {
+                        fs.mkdirSync(path.dirname(targetPath), { recursive: true });
+                    }
+                    // Atomic (tmp + rename): a running Claude session rewrites this exact
+                    // file (it holds the login and session stats), so a plain write risks
+                    // a reader seeing a partial file. The OUTSIDE `.claude.json` is the
+                    // real file (the INSIDE `.claude/.claude.json` symlink resolves to it
+                    // and survives the rename).
+                    atomicWriteFileSync(targetPath, JSON.stringify({ ...targetObj, projects: targetProjects }, null, 2) + '\n');
+                    result.applied.push(entry.rel);
+                    break;
+                }
                 case 'json-merge':
                 case 'toml-merge': {
                     const parse = entry.strategy === 'json-merge'

package/dist/lib/share/publish.d.ts

@@ -129,6 +129,25 @@ export declare function assertMetadataSize(customMetadata: Record<string, string
  * an unhandled `TypeError: Invalid value` and crashes the publish outright.
  */
 export declare function sanitizeLabel(text: string): string;
+/**
+ * Make a free-text value safe to put in an HTTP header.
+ *
+ * `fetch` encodes header values as a **ByteString**, so any code point above 255
+ * throws `TypeError: Cannot convert argument to a ByteString` — an unhandled
+ * crash with a stack trace, mid-publish, after the body has already been read.
+ * Reproduced by publishing a session whose title ended in `…` (U+2026), and
+ * reachable by any emoji, curly quote, accented name, or CJK text in a `--label`,
+ * a `--meta` value, or a repo name.
+ *
+ * The transliterations above cover what actually shows up; anything else outside
+ * latin1 is dropped, and a value that transliterates to nothing at all (a title
+ * written entirely in a non-latin script) degrades to a marker rather than an
+ * empty header. Lossy on purpose: carrying full Unicode needs percent-encoding
+ * here AND a matching decode in the Worker, which every already-deployed Worker
+ * would render as `%E2%80%A6` until its operator ran `agents artifacts share
+ * update` — tracked as RUSH-2786.
+ */
+export declare function toHeaderValue(text: string): string;
 /**
  * Best-effort human title when `--label` is omitted: the HTML `<title>`, else a
  * Markdown frontmatter `title:`, else the filename. Always returns something —
@@ -150,6 +169,25 @@ export interface SensitiveHit {
     /** Short redacted sample so the error names *what* was found without dumping it. */
     sample: string;
 }
+/**
+ * Mask every email address in `text`, so a page can be published without tripping
+ * {@link scanShareContent}.
+ *
+ * Lives here, beside the scanner, rather than in `lib/redact.ts`: it exists solely
+ * to satisfy this gate, and sharing {@link EMAIL_RE} is what makes the masking
+ * *sufficient* to clear it rather than merely reducing the hit count. Two copies of
+ * the pattern in two modules would drift, and the failure mode of that drift is a
+ * refused publish at runtime.
+ *
+ * Deliberately NOT part of `redactSecrets`: an email is not a credential, and a
+ * transcript rendered for a private gist or local review reads better with the real
+ * author addresses intact. It only becomes a leak once the text is PUBLISHED — a
+ * world-readable page carrying seven of them is the RUSH-2428 incident.
+ *
+ * The whole address goes, domain included — a personal domain identifies its owner
+ * as surely as the local part does, and keeping it would buy the reader nothing.
+ */
+export declare function redactEmails(text: string): string;
 /**
  * Scan a text body for email addresses and credential-shaped strings. Returns
  * the first few hits (deduped by kind+sample). Binary / non-text bodies yield

package/dist/lib/share/publish.js

@@ -91,6 +91,49 @@ export function assertMetadataSize(customMetadata) {
 export function sanitizeLabel(text) {
     return text.replace(/\s+/g, ' ').trim();
 }
+/**
+ * Typographic characters that reach a header constantly — a curly quote from a
+ * pasted prompt, an em dash from prose, the ellipsis a truncated title ends on —
+ * each mapped to the ASCII form a reader loses nothing by seeing.
+ */
+const HEADER_TRANSLITERATIONS = [
+    [/[‘’‚‛]/g, "'"],
+    [/[“”„‟]/g, '"'],
+    [/[–—―]/g, '-'],
+    [/…/g, '...'],
+    [/[    ]/g, ' '],
+    [/[•·]/g, '-'],
+];
+/**
+ * Make a free-text value safe to put in an HTTP header.
+ *
+ * `fetch` encodes header values as a **ByteString**, so any code point above 255
+ * throws `TypeError: Cannot convert argument to a ByteString` — an unhandled
+ * crash with a stack trace, mid-publish, after the body has already been read.
+ * Reproduced by publishing a session whose title ended in `…` (U+2026), and
+ * reachable by any emoji, curly quote, accented name, or CJK text in a `--label`,
+ * a `--meta` value, or a repo name.
+ *
+ * The transliterations above cover what actually shows up; anything else outside
+ * latin1 is dropped, and a value that transliterates to nothing at all (a title
+ * written entirely in a non-latin script) degrades to a marker rather than an
+ * empty header. Lossy on purpose: carrying full Unicode needs percent-encoding
+ * here AND a matching decode in the Worker, which every already-deployed Worker
+ * would render as `%E2%80%A6` until its operator ran `agents artifacts share
+ * update` — tracked as RUSH-2786.
+ */
+export function toHeaderValue(text) {
+    let safe = text;
+    for (const [pattern, replacement] of HEADER_TRANSLITERATIONS)
+        safe = safe.replace(pattern, replacement);
+    safe = safe.replace(/[^\x20-\x7E\xA0-\xFF]/g, '').replace(/\s+/g, ' ').trim();
+    // An input that was empty to begin with stays empty — `--meta note=` means an
+    // empty note, not an unnamed one. The marker is only for a value that HAD
+    // content and lost all of it to the latin1 fold.
+    if (safe)
+        return safe;
+    return text.trim() ? '(unnamed)' : '';
+}
 /**
  * Best-effort human title when `--label` is omitted: the HTML `<title>`, else a
  * Markdown frontmatter `title:`, else the filename. Always returns something —
@@ -141,6 +184,27 @@ export function resolveExpire(spec) {
 }
 /** Email addresses — the RUSH-2428 incident page carried seven of these. */
 const EMAIL_RE = /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g;
+/**
+ * Mask every email address in `text`, so a page can be published without tripping
+ * {@link scanShareContent}.
+ *
+ * Lives here, beside the scanner, rather than in `lib/redact.ts`: it exists solely
+ * to satisfy this gate, and sharing {@link EMAIL_RE} is what makes the masking
+ * *sufficient* to clear it rather than merely reducing the hit count. Two copies of
+ * the pattern in two modules would drift, and the failure mode of that drift is a
+ * refused publish at runtime.
+ *
+ * Deliberately NOT part of `redactSecrets`: an email is not a credential, and a
+ * transcript rendered for a private gist or local review reads better with the real
+ * author addresses intact. It only becomes a leak once the text is PUBLISHED — a
+ * world-readable page carrying seven of them is the RUSH-2428 incident.
+ *
+ * The whole address goes, domain included — a personal domain identifies its owner
+ * as surely as the local part does, and keeping it would buy the reader nothing.
+ */
+export function redactEmails(text) {
+    return text.replace(EMAIL_RE, '[EMAIL]');
+}
 /**
  * Credential-shaped strings that an agent routinely dumps into reports: GitHub
  * PATs, OpenAI/Anthropic/etc. API keys, AWS access keys, Slack tokens, and a
@@ -430,20 +494,29 @@ export async function publishToEndpoint(filePath, endpoint, opts = {}) {
             h['x-share-expires-at'] = expiresAt;
         if (unlisted)
             h['x-share-visibility'] = 'unlisted';
+        // Every free-text header goes through toHeaderValue: a non-latin1 code point
+        // anywhere in a label, a repo name, or a --meta value throws inside fetch and
+        // crashes the publish outright.
         if (provenance.agent)
-            h['x-share-agent'] = provenance.agent;
+            h['x-share-agent'] = toHeaderValue(provenance.agent);
         if (provenance.session)
-            h['x-share-session'] = provenance.session;
+            h['x-share-session'] = toHeaderValue(provenance.session);
         if (provenance.host)
-            h['x-share-host'] = provenance.host;
+            h['x-share-host'] = toHeaderValue(provenance.host);
         if (provenance.repo)
-            h['x-share-repo'] = provenance.repo;
+            h['x-share-repo'] = toHeaderValue(provenance.repo);
         if (provenance.date)
-            h['x-share-date'] = provenance.date;
-        h['x-share-label'] = label;
+            h['x-share-date'] = toHeaderValue(provenance.date);
+        h['x-share-label'] = toHeaderValue(label);
         h['x-share-label-source'] = labelSource;
-        if (Object.keys(meta).length > 0)
-            h['x-share-meta'] = JSON.stringify(meta);
+        // Per VALUE, before JSON.stringify — folding the serialized form would rewrite
+        // a curly quote inside a value into a bare `"`, which is structural in JSON and
+        // makes the Worker's JSON.parse throw. It swallows that error, so every --meta
+        // key would silently vanish on a 200.
+        if (Object.keys(meta).length > 0) {
+            const headerMeta = Object.fromEntries(Object.entries(meta).map(([k, v]) => [toHeaderValue(k), toHeaderValue(v)]));
+            h['x-share-meta'] = JSON.stringify(headerMeta);
+        }
         if (opts.noRevision)
             h['x-share-no-revision'] = '1';
         return h;

package/dist/lib/staleness/prune.d.ts

@@ -42,7 +42,7 @@ import type { SyncManifest } from './types.js';
  *   - hooks — a version-home hook script is coupled to a settings.json /
  *     hooks.json REGISTRATION. Pruning the last hook to zero would delete the
  *     script but must also GC its registration in the same pass, and that lands
- *     in `src/lib/hooks.ts` — a Windows-portable-path surface the CI windows leg
+ *     in `src/lib/hooks/install.ts` — a Windows-portable-path surface the CI windows leg
  *     gates on. Split to RUSH-2456 so this PR stays Linux-only-green; hook FILES
  *     are still reconciled by the in-write orphan sweep (versions.ts, gated on
  *     `hooksToSync > 0`).

package/dist/lib/staleness/prune.js

@@ -5,7 +5,7 @@ import { getWriter, getDetector } from './registry.js';
  *   - hooks — a version-home hook script is coupled to a settings.json /
  *     hooks.json REGISTRATION. Pruning the last hook to zero would delete the
  *     script but must also GC its registration in the same pass, and that lands
- *     in `src/lib/hooks.ts` — a Windows-portable-path surface the CI windows leg
+ *     in `src/lib/hooks/install.ts` — a Windows-portable-path surface the CI windows leg
  *     gates on. Split to RUSH-2456 so this PR stays Linux-only-green; hook FILES
  *     are still reconciled by the in-write orphan sweep (versions.ts, gated on
  *     `hooksToSync > 0`).

package/dist/lib/staleness/writers/hooks.js

@@ -9,7 +9,7 @@ import { agentConfigDirName } from '../../agents.js';
 import * as path from 'path';
 import { capableAgents } from '../../capabilities.js';
 import { safeJoin } from '../../paths.js';
-import { registerHooksToSettings } from '../../hooks.js';
+import { registerHooksToSettings } from '../../hooks/install.js';
 import { resolveHookSource } from './sources.js';
 import { lazyAgentMap } from './lazy-map.js';
 function removePath(target) {

package/dist/lib/startup/command-registry.d.ts

@@ -20,7 +20,8 @@ export declare const KNOWN_TOP_LEVEL_COMMANDS: ReadonlySet<string>;
  * `set` moved under `agents models`/`agents config` (RUSH-2579); `share` moved
  * under `agents artifacts share` (RUSH-2580). login/logout/budget/bench/mine/
  * cost/output/profiles/snapshot/cp/resume/roster moved under nested homes
- * (cli-surface-consolidate).
+ * (cli-surface-consolidate). `timeline` was removed as a duplicated surface —
+ * use `agents feed --filter updates` (RUSH-2692).
  */
 export declare const RETIRED_TOP_LEVEL_COMMANDS: ReadonlySet<string>;
 export declare function isKnownTopLevelCommand(name: string): boolean;

package/dist/lib/startup/command-registry.js

@@ -1,5 +1,5 @@
 const LOADED_COMMAND_NAMES = [
-    'accounts', 'view', 'inspect', 'feedback', 'commands', 'hooks', 'skills', 'rules', 'memory',
+    'accounts', 'auth', 'org', 'view', 'inspect', 'feedback', 'commands', 'hooks', 'skills', 'rules', 'memory',
     'permissions', 'mcp', 'clis', 'subagents', 'plugins', 'workflows', 'add', 'use', 'list',
     'remove', 'rm', 'purge', 'update', 'prune', 'import', 'registry', 'search', 'install',
     'routines', 'monitors', 'projects', 'run', 'open', 'reconnect', 'fork', 'config',
@@ -9,7 +9,7 @@ const LOADED_COMMAND_NAMES = [
     'alias', 'pty', 'tmux', 'watchdog', 'browser', 'computer', 'logs', 'events',
     'ssh', 'devices', 'fleet', 'repos', 'repo', 'setup', 'uninstall', 'upgrade', 'sessions',
     'teams', 'tickets', 'cloud', 'message', 'send', 'notify', 'feed', 'inbox',
-    'timeline', 'mailboxes', 'mailbox', 'serve', 'artifacts', 'unshare', 'audit', 'webhooks',
+    'mailboxes', 'mailbox', 'serve', 'artifacts', 'unshare', 'audit', 'webhooks',
     'humans', 'daemon',
 ];
 const INLINE_COMMAND_NAMES = [
@@ -40,7 +40,8 @@ export const KNOWN_TOP_LEVEL_COMMANDS = new Set([
  * `set` moved under `agents models`/`agents config` (RUSH-2579); `share` moved
  * under `agents artifacts share` (RUSH-2580). login/logout/budget/bench/mine/
  * cost/output/profiles/snapshot/cp/resume/roster moved under nested homes
- * (cli-surface-consolidate).
+ * (cli-surface-consolidate). `timeline` was removed as a duplicated surface —
+ * use `agents feed --filter updates` (RUSH-2692).
  */
 export const RETIRED_TOP_LEVEL_COMMANDS = new Set([
     'webhook',
@@ -58,6 +59,7 @@ export const RETIRED_TOP_LEVEL_COMMANDS = new Set([
     'roster',
     'set',
     'share',
+    'timeline',
 ]);
 export function isKnownTopLevelCommand(name) {
     return KNOWN_TOP_LEVEL_COMMANDS.has(name);

package/dist/lib/teams/agents.js

@@ -34,6 +34,7 @@ import { resolveRemoteOsSync } from '../hosts/remote-os.js';
 import { pullRemoteLogDelta, REMOTE_MIRROR_MAX_BYTES } from '../hosts/progress.js';
 import { createRemoteWorktree, ensureRemoteRepo } from './remoteWorktree.js';
 import { getTeam, isTeamDisbanded } from './registry.js';
+import { atomicWriteJsonSync } from '../fs-atomic.js';
 import { resolvePlacement, classifyExclusions, NoViableDeviceError } from './scheduler.js';
 import { probePoolSignals } from './placement-probe.js';
 import { readMaxConcurrentCaps } from '../device-config.js';
@@ -321,24 +322,6 @@ function extractTimestamp(raw) {
     }
     return null;
 }
-/**
- * Atomic JSON write: writes to a unique sibling tmp file then renames over the
- * target. rename(2) is atomic on POSIX, so a process killed mid-write leaves
- * either the previous valid meta.json or the new one, never a torn,
- * unparseable file (RUSH-2429). Mirrors the identical pattern already used by
- * `teams/registry.ts`'s `atomicWriteJson`.
- */
-async function atomicWriteJson(p, data) {
-    const tmp = `${p}.tmp.${process.pid}.${randomUUID()}`;
-    await fs.writeFile(tmp, JSON.stringify(data, null, 2));
-    try {
-        await fs.rename(tmp, p);
-    }
-    catch (err) {
-        await fs.unlink(tmp).catch(() => { });
-        throw err;
-    }
-}
 /** Resolve a mode string to a validated Mode, falling back to the given default. */
 export function resolveMode(requestedMode, defaultMode = 'plan') {
     const normalizedDefault = normalizeModeValue(defaultMode);
@@ -1011,7 +994,7 @@ export class AgentProcess {
             remote_log_offset: this.remoteLogOffset,
         };
         const metaPath = await this.getMetaPath();
-        await atomicWriteJson(metaPath, meta);
+        atomicWriteJsonSync(metaPath, meta);
     }
     /**
      * Rename an unreadable meta.json out of the way so it stops silently

package/dist/lib/teams/parsers.js

@@ -9,34 +9,28 @@
 import { extractFileOpsFromBash } from './file_ops.js';
 const claudeToolUseMap = new Map();
 const droidToolUseMap = new Map();
+/**
+ * Registry-dispatch table: each teams `AgentType` to its live team-event
+ * normalizer. Replaces the per-type name-chain — the harness axis of Move 3.
+ * warp (and any unlisted type) is absent, so it falls through to the generic
+ * unknown-event shape below, exactly as the old `else` did.
+ */
+const TEAM_EVENT_NORMALIZERS = {
+    codex: normalizeCodex,
+    cursor: normalizeCursor,
+    gemini: normalizeGemini,
+    claude: normalizeClaude,
+    opencode: normalizeOpencode,
+    grok: normalizeGrok,
+    antigravity: normalizeAntigravity,
+    kimi: normalizeKimi,
+    droid: normalizeDroid,
+};
 /** Normalize a raw JSON event from any agent type into an array of unified event objects. */
 export function normalizeEvents(agentType, raw) {
-    if (agentType === 'codex') {
-        return normalizeCodex(raw);
-    }
-    else if (agentType === 'cursor') {
-        return normalizeCursor(raw);
-    }
-    else if (agentType === 'gemini') {
-        return normalizeGemini(raw);
-    }
-    else if (agentType === 'claude') {
-        return normalizeClaude(raw);
-    }
-    else if (agentType === 'opencode') {
-        return normalizeOpencode(raw);
-    }
-    else if (agentType === 'grok') {
-        return normalizeGrok(raw);
-    }
-    else if (agentType === 'antigravity') {
-        return normalizeAntigravity(raw);
-    }
-    else if (agentType === 'kimi') {
-        return normalizeKimi(raw);
-    }
-    else if (agentType === 'droid') {
-        return normalizeDroid(raw);
+    const normalizer = TEAM_EVENT_NORMALIZERS[agentType];
+    if (normalizer) {
+        return normalizer(raw);
     }
     const timestamp = new Date().toISOString();
     return [{

package/dist/lib/teams/registry.js

@@ -10,32 +10,13 @@
 import * as fs from 'fs/promises';
 import * as fsSync from 'fs';
 import * as path from 'path';
-import { randomBytes } from 'crypto';
 import lockfile from 'proper-lockfile';
 import { getTeamsRegistryPath } from '../state.js';
 import { emit } from '../feed/events.js';
+import { atomicWriteJsonSync } from '../fs-atomic.js';
 async function registryPath() {
     return getTeamsRegistryPath();
 }
-/**
- * Atomic JSON write: writes to a unique sibling tmp file then renames over
- * the target. rename(2) is atomic on POSIX, so a crashed write leaves the
- * old file untouched instead of producing a half-written registry that
- * loadTeams() would reject.
- */
-async function atomicWriteJson(p, data) {
-    await fs.mkdir(path.dirname(p), { recursive: true });
-    const tmp = `${p}.tmp.${process.pid}.${randomBytes(4).toString('hex')}`;
-    const body = JSON.stringify(data, null, 2);
-    await fs.writeFile(tmp, body);
-    try {
-        await fs.rename(tmp, p);
-    }
-    catch (err) {
-        await fs.unlink(tmp).catch(() => { });
-        throw err;
-    }
-}
 /**
  * Run `fn` while holding an exclusive cross-process lock on the registry
  * file. proper-lockfile requires the target to exist, so we touch it first.
@@ -91,7 +72,7 @@ export async function loadTeams() {
 }
 async function saveTeams(reg) {
     const p = await registryPath();
-    await atomicWriteJson(p, reg);
+    atomicWriteJsonSync(p, reg);
 }
 /** Create a new team. Throws if a team with the same name already exists. */
 export async function createTeam(name, options) {

package/dist/lib/triggers/handlers.d.ts

@@ -7,7 +7,7 @@
  */
 import type { JobConfig, RunMeta, WebhookContext } from '../scheduling/routines.js';
 import type { AgentId } from '../types.js';
-import type { IncomingWebhook, WebhookSource } from './webhook.js';
+import type { IncomingWebhook, SlackPayload, WebhookSource } from './webhook.js';
 export interface WebhookHandler {
     name: string;
     enabled?: boolean;
@@ -21,6 +21,11 @@ export interface WebhookHandler {
     label?: string;
     repo?: string;
     branch?: string;
+    /** Slack (source: slack) only — match one slash command, e.g. `/agents`. */
+    command?: string;
+    /** Slack (source: slack) only — restrict to one channel id (`C0…`). Lets a
+     *  channel imply a project via a per-channel handler. */
+    channel?: string;
     /**
      * Where to run the action. A device name (`yosemite-s0`) runs there over SSH;
      * `fleet` picks any eligible online worker; `fleet/<platform>` (or
@@ -92,10 +97,40 @@ export declare function resolveHandlerHost(host: string | undefined): HandlerHos
 export declare function listHandlers(cwd?: string): WebhookHandler[];
 /** Pure matcher: does this handler match the incoming webhook? */
 export declare function handlerMatchesWebhook(handler: WebhookHandler, webhook: IncomingWebhook): boolean;
+/**
+ * The `{{slack.*}}` substitution namespace: a Slack message split into an
+ * agent-actionable project + prompt, plus the coordinates a reply threads into.
+ */
+export interface SlackMessageContext {
+    /** The message with a leading bot mention stripped. */
+    text: string;
+    /** The `PROJECT:` token at the head of the message, or '' when absent. */
+    project: string;
+    /** The request — the text after `PROJECT:`, or the whole message. */
+    prompt: string;
+    /** Channel id to reply into (`C0…`). */
+    channel: string;
+    /** Thread ts to reply into (empty for a slash command → reply to the channel). */
+    thread_ts: string;
+    /** Invoking user id (`U0…`). */
+    user: string;
+    /** Slash command name (`/agents`), or '' for an event delivery. */
+    command: string;
+}
+/**
+ * Split a Slack message into a `{{slack.*}}` context. Strips a leading bot
+ * mention (`<@U0BOT> …`), then reads an optional `PROJECT:` prefix — a single
+ * bare token followed by a colon and a space — as the project, with the
+ * remainder the prompt. `AGI: rebase my PR` → project `AGI`, prompt
+ * `rebase my PR`; a message with no such prefix leaves `project` empty and the
+ * whole text as the prompt. The token pattern forbids slashes, so a project
+ * value can never carry a path into a `cwd`/`project` substitution.
+ */
+export declare function parseSlackMessage(payload: SlackPayload): SlackMessageContext;
 /**
  * Build the variable-substitution context for a webhook. Linear events expose
  * `issue` and `updatedFrom`; GitHub events expose `repository`, `pull_request`,
- * and `issue`.
+ * and `issue`; Slack events expose the `{{slack.*}}` namespace above.
  */
 export declare function buildWebhookContext(webhook: IncomingWebhook): WebhookContext;
 export interface ExecuteHandlerOptions {