@phnx-labs/agents-cli 1.22.41 → 1.22.43

package/dist/lib/daemon/daemon.js

@@ -11,13 +11,13 @@ import * as fs from 'fs';
 import * as path from 'path';
 import * as os from 'os';
 import { getDaemonDir } from '../state.js';
-import { isolatedHomeSuffix, namespacedServiceLabel, serviceManifestHomeEnv } from '../service-manifest.js';
+import { isolatedHomeSuffix, namespacedServiceLabel, serviceManifestHomeEnv, serviceManagerRegistrationAllowed } from '../service-manifest.js';
 import { isAlive, killTree, backgroundSpawnOptions, waitForExit } from '../platform/index.js';
 import { listJobs as listAllJobs } from '../scheduling/routines.js';
 import { syncAllProjectRoutines } from '../routines-project.js';
 import { JobScheduler } from '../scheduler.js';
 import { MonitorEngine } from '../monitors/engine.js';
-import { executeJobDetached, monitorRunningJobs, listLiveRoutineChildren } from '../runner.js';
+import { executeJobDetached, monitorRunningJobs, listLiveRoutineChildren } from './runner.js';
 import { detectOverdueJobs, notifyOverdue } from '../overdue.js';
 import { runCatchup } from '../catchup.js';
 import { notifyRoutineStart, notifyRoutineFinish, notifyRoutineStartFailed } from '../routine-notify.js';
@@ -1763,6 +1763,9 @@ export { getAgentsBinPath };
  * in fact up. Returns null when the service isn't running or the query fails.
  */
 function readServiceManagerPid(platform = os.platform()) {
+    const reg = serviceManagerRegistrationAllowed();
+    if (!reg.allowed)
+        return null;
     try {
         if (platform === 'linux') {
             const out = execFileSync('systemctl', ['--user', 'show', '-p', 'MainPID', '--value', daemonSystemdUnitName()], { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
@@ -1912,61 +1915,72 @@ function startDaemonLocked(agentsBin, releaseLock) {
         releaseLock();
         return startDetached({ agentsBin });
     };
+    const reg = serviceManagerRegistrationAllowed();
     if (platform === 'darwin') {
-        try {
-            const plistPath = getLaunchdPlistPath();
-            const plistDir = path.dirname(plistPath);
-            if (!fs.existsSync(plistDir)) {
-                fs.mkdirSync(plistDir, { recursive: true });
-            }
-            // The plist carries no credential (RUSH-1759 — the daemon reads the OAuth
-            // token itself at startup); still create owner-only atomically to match the
-            // detached path and keep the log/PATH surface owner-private.
-            writeOwnerOnlyServiceManifest(plistPath, generateLaunchdPlist(agentsBin));
+        if (reg.allowed) {
             try {
-                execFileSync('launchctl', ['unload', plistPath], { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'] });
+                const plistPath = getLaunchdPlistPath();
+                const plistDir = path.dirname(plistPath);
+                if (!fs.existsSync(plistDir)) {
+                    fs.mkdirSync(plistDir, { recursive: true });
+                }
+                // The plist carries no credential (RUSH-1759 — the daemon reads the OAuth
+                // token itself at startup); still create owner-only atomically to match the
+                // detached path and keep the log/PATH surface owner-private.
+                writeOwnerOnlyServiceManifest(plistPath, generateLaunchdPlist(agentsBin));
+                try {
+                    execFileSync('launchctl', ['unload', plistPath], { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'] });
+                }
+                catch { /* not loaded, expected */ }
+                // launchctl prints `Load failed:` and exits 0 when the label is in a
+                // stuck state from a prior session — so a zero exit code isn't proof
+                // of success. If no pid materializes within the window, give up on
+                // launchd and fall through to a plain detached spawn.
+                execFileSync('launchctl', ['load', plistPath], { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'] });
+                // Launch issued — the child needs this lock to claim (RUSH-2417).
+                releaseLock();
+                const pid = waitForPid(3000) ?? readServiceManagerPid();
+                if (pid)
+                    return { pid, method: 'launchd' };
+                // launchctl claimed success but nothing ran. Fall through.
+            }
+            catch {
+                // load threw — fall through to detached spawn
             }
-            catch { /* not loaded, expected */ }
-            // launchctl prints `Load failed:` and exits 0 when the label is in a
-            // stuck state from a prior session — so a zero exit code isn't proof
-            // of success. If no pid materializes within the window, give up on
-            // launchd and fall through to a plain detached spawn.
-            execFileSync('launchctl', ['load', plistPath], { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'] });
-            // Launch issued — the child needs this lock to claim (RUSH-2417).
-            releaseLock();
-            const pid = waitForPid(3000) ?? readServiceManagerPid();
-            if (pid)
-                return { pid, method: 'launchd' };
-            // launchctl claimed success but nothing ran. Fall through.
         }
-        catch {
-            // load threw — fall through to detached spawn
+        else {
+            process.stderr.write(`[agents] ${reg.reason}\n`);
         }
         return detachedFallback();
     }
     if (platform === 'linux') {
-        try {
-            const unitPath = getSystemdUnitPath();
-            const unitDir = path.dirname(unitPath);
-            if (!fs.existsSync(unitDir)) {
-                fs.mkdirSync(unitDir, { recursive: true });
+        if (reg.allowed) {
+            try {
+                const unitPath = getSystemdUnitPath();
+                const unitDir = path.dirname(unitPath);
+                if (!fs.existsSync(unitDir)) {
+                    fs.mkdirSync(unitDir, { recursive: true });
+                }
+                // Carries no credential (RUSH-1759 — the daemon reads the OAuth token
+                // itself at startup); owner-only to keep the PATH/log surface private.
+                writeOwnerOnlyServiceManifest(unitPath, generateSystemdUnit(agentsBin));
+                execFileSync('systemctl', ['--user', 'daemon-reload'], { encoding: 'utf-8' });
+                execFileSync('systemctl', ['--user', 'enable', daemonSystemdUnitName()], { encoding: 'utf-8' });
+                execFileSync('systemctl', ['--user', 'start', daemonSystemdUnitName()], { encoding: 'utf-8' });
+                // Launch issued — the child needs this lock to claim (RUSH-2417).
+                releaseLock();
+                const pid = waitForPid(3000) ?? readServiceManagerPid();
+                if (pid)
+                    return { pid, method: 'systemd' };
+                // systemctl returned success but no PID surfaced — fall through to a
+                // plain detached spawn rather than reporting a null PID.
+            }
+            catch {
+                // start threw — fall through to detached spawn
             }
-            // Carries no credential (RUSH-1759 — the daemon reads the OAuth token
-            // itself at startup); owner-only to keep the PATH/log surface private.
-            writeOwnerOnlyServiceManifest(unitPath, generateSystemdUnit(agentsBin));
-            execFileSync('systemctl', ['--user', 'daemon-reload'], { encoding: 'utf-8' });
-            execFileSync('systemctl', ['--user', 'enable', daemonSystemdUnitName()], { encoding: 'utf-8' });
-            execFileSync('systemctl', ['--user', 'start', daemonSystemdUnitName()], { encoding: 'utf-8' });
-            // Launch issued — the child needs this lock to claim (RUSH-2417).
-            releaseLock();
-            const pid = waitForPid(3000) ?? readServiceManagerPid();
-            if (pid)
-                return { pid, method: 'systemd' };
-            // systemctl returned success but no PID surfaced — fall through to a
-            // plain detached spawn rather than reporting a null PID.
         }
-        catch {
-            // start threw — fall through to detached spawn
+        else {
+            process.stderr.write(`[agents] ${reg.reason}\n`);
         }
         return detachedFallback();
     }
@@ -2261,29 +2275,43 @@ export function stopDaemon() {
     const released = [];
     const surviving = [];
     let escalated = false;
+    const reg = serviceManagerRegistrationAllowed();
     if (platform === 'darwin') {
         const plistPath = getLaunchdPlistPath();
         if (fs.existsSync(plistPath)) {
+            if (reg.allowed) {
+                try {
+                    execFileSync('launchctl', ['unload', plistPath], { encoding: 'utf-8' });
+                }
+                catch (err) {
+                    if (process.env.AGENTS_DEBUG) {
+                        console.error(`[debug] launchctl unload failed: ${err.message}`);
+                    }
+                }
+            }
+            else {
+                process.stderr.write(`[agents] ${reg.reason}\n`);
+            }
             try {
-                execFileSync('launchctl', ['unload', plistPath], { encoding: 'utf-8' });
                 fs.unlinkSync(plistPath);
             }
+            catch { /* plist already removed */ }
+        }
+    }
+    if (platform === 'linux') {
+        if (reg.allowed) {
+            try {
+                execFileSync('systemctl', ['--user', 'stop', daemonSystemdUnitName()], { encoding: 'utf-8' });
+                execFileSync('systemctl', ['--user', 'disable', daemonSystemdUnitName()], { encoding: 'utf-8' });
+            }
             catch (err) {
                 if (process.env.AGENTS_DEBUG) {
-                    console.error(`[debug] launchctl unload failed: ${err.message}`);
+                    console.error(`[debug] systemctl stop failed: ${err.message}`);
                 }
             }
         }
-    }
-    if (platform === 'linux') {
-        try {
-            execFileSync('systemctl', ['--user', 'stop', daemonSystemdUnitName()], { encoding: 'utf-8' });
-            execFileSync('systemctl', ['--user', 'disable', daemonSystemdUnitName()], { encoding: 'utf-8' });
-        }
-        catch (err) {
-            if (process.env.AGENTS_DEBUG) {
-                console.error(`[debug] systemctl stop failed: ${err.message}`);
-            }
+        else {
+            process.stderr.write(`[agents] ${reg.reason}\n`);
         }
         const unitPath = getSystemdUnitPath();
         if (fs.existsSync(unitPath)) {

package/dist/lib/{runner.d.ts → daemon/runner.d.ts}

@@ -13,12 +13,12 @@
  * limit is detected mid-run (foreground `executeJob` only — detached daemon
  * fires once with the pre-flight pick).
  */
-import type { JobConfig, RunMeta } from './scheduling/routines.js';
-import { readMeta } from './state.js';
-import type { AgentId } from './types.js';
-import { type FallbackEntry } from './exec.js';
-import type { LoopDeps } from './loop.js';
-import { resolveRunVersion, resolveAccountVersion, type RotateResult } from './accounting/rotate.js';
+import type { JobConfig, RunMeta } from '../scheduling/routines.js';
+import { readMeta } from '../state.js';
+import type { AgentId } from '../types.js';
+import { type FallbackEntry } from '../exec.js';
+import type { LoopDeps } from '../loop.js';
+import { resolveRunVersion, resolveAccountVersion, type RotateResult } from '../accounting/rotate.js';
 /** Result of a completed job execution, including metadata and optional report. */
 export interface RunResult {
     meta: RunMeta;
@@ -74,6 +74,23 @@ interface RoutineAttempt {
  * but the gate should have paused such a routine before it ever spawned.
  */
 export declare function routineSpawnCwd(config: Pick<JobConfig, 'name' | 'project' | 'cwd' | 'agent' | 'workflow' | 'command'>): string;
+/**
+ * Bake the daemon-job argv skeleton from AGENT_COMMANDS.
+ *
+ * The two tables used to be independent copies of the same launch decision.
+ * Argv now comes from AGENT_COMMANDS.base / promptFlag / jsonFlags / modeFlags.
+ * Two documented exceptions, not a second table:
+ *   - kimi uses `--prompt` (long form). `-p` is the exec alias; combining
+ *     either with --plan/--auto/--yolo aborts, so routineModeArgs emits no
+ *     mode flag. The daemon has always spawned the long form.
+ *   - claude places `--verbose` (from jsonFlags) before the prompt and bakes
+ *     modeFlags.plan so claudeAdapter.routineModeArgs can splice
+ *     plan → acceptEdits / auto / skip.
+ *
+ * Returns undefined when `agent` is outside ROUTINE_AGENT_IDS (gemini, grok,
+ * and every other harness the daemon does not fire locally).
+ */
+export declare function bakeRoutineArgv(agent: string): string[] | undefined;
 /** Build the full CLI argv for executing a job, applying mode, model, and permission flags. */
 export declare function buildJobCommand(config: JobConfig, resolvedPrompt: string, forwardAccount?: boolean): string[];
 /**
@@ -142,11 +159,11 @@ export declare function pinJobBinary(cmd: string[], agent: AgentId, version: str
  * registry or a real dispatch.
  */
 export declare function assertRoutineAccountLocalForPlacement(config: Pick<JobConfig, 'name' | 'account'>, mode: 'host' | 'cloud', deps?: {
-    account?: import('./account-registry.js').UnifiedAccount | null;
+    account?: import('../account-registry.js').UnifiedAccount | null;
     readMeta?: typeof readMeta;
 }): Promise<void>;
-export declare function dispatchPlacedJob(config: JobConfig, target: import('./routines-placement.js').PlacementTarget, attempt: RoutineAttempt, deps?: {
-    account?: import('./account-registry.js').UnifiedAccount | null;
+export declare function dispatchPlacedJob(config: JobConfig, target: import('../routines-placement.js').PlacementTarget, attempt: RoutineAttempt, deps?: {
+    account?: import('../account-registry.js').UnifiedAccount | null;
     host?: typeof executeJobOnHost;
     cloud?: typeof executeJobOnCloud;
 }): Promise<RunResult | undefined>;
@@ -160,8 +177,8 @@ export declare function buildHostDispatchOptions(config: JobConfig, ctx: {
     remoteCwd: string | undefined;
     runDir: string;
     detached: boolean;
-}): import('./hosts/run-target.js').HostPromptRun;
-export declare function dispatchesViaAgentsRun(config: Pick<JobConfig, 'workflow' | 'resume'>): boolean;
+}): import('../hosts/run-target.js').HostPromptRun;
+export declare function dispatchesViaAgentsRun(config: Pick<JobConfig, 'workflow' | 'resume' | 'agent'>): boolean;
 /**
  * Merge sandbox/base env with the canonical per-version exec env
  * (CLAUDE_CONFIG_DIR / CODEX_HOME / …) so routines share account isolation