@phnx-labs/agents-cli 1.22.45 → 1.22.47

package/dist/commands/accounts.js

@@ -3,7 +3,7 @@ import { password } from '@inquirer/prompts';
 import { setHelpSections } from '../lib/help.js';
 import { readMeta, updateMeta } from '../lib/state.js';
 import { ALL_AGENT_IDS, getAccountInfo, resolveAgentName } from '../lib/agents.js';
-import { getVersionHomePath, listInstalledVersions } from '../lib/installations/versions.js';
+import { getGlobalDefault, getVersionHomePath, listInstalledVersions } from '../lib/installations/versions.js';
 import { assertNativeAccountNameable, nativeAccountCapability, nativeIdentityKey } from '../lib/account-capabilities.js';
 import { collectRunCandidates } from '../lib/accounting/rotate.js';
 import { isInteractiveTerminal } from './utils.js';
@@ -16,7 +16,10 @@ import { runDevicesAccounts } from './ssh.js';
 import { discoverNativeAccounts } from '../lib/account-catalog.js';
 import { readAndResolveBundleEnv } from '../lib/secrets/bundles.js';
 import { getAccountProvider, listAccountProviders } from '../lib/account-provider-registry.js';
-import { accountBindings, addAccount, addNativeAccount, bindAccount, findAccount, findUnifiedAccount, inspectAccount, listNativeAccounts, readAccountRegistry, removeAccount, renameAccount, setAccountSecret, unbindAccount } from '../lib/account-registry.js';
+import { accountBindings, addAccount, addNativeAccount, bindAccount, findAccount, findUnifiedAccount, inspectAccount, labelNativeAccount, listNativeAccounts, readAccountRegistry, removeAccount, renameAccount, setAccountSecret, unbindAccount } from '../lib/account-registry.js';
+function cleanCommandError(command, err) {
+    command.error(err instanceof Error ? err.message : String(err), { exitCode: 1, code: 'accounts.error' });
+}
 function parseInstallation(raw) {
     const at = raw.lastIndexOf('@');
     if (at < 1 || at === raw.length - 1)
@@ -273,12 +276,43 @@ export function registerAccountsCommand(program) {
     });
     accounts.command('name <source> <name>')
         .description('Name a signed-in native installation without copying its OAuth credentials')
-        .action(async (source, name) => {
-        const identity = await nativeIdentityFromSource(source);
-        const account = addNativeAccount(name, identity.agent, identity.identityKey, identity.identityLabel, identity.scope);
-        console.log(chalk.green(`Named ${source} as ${account.name}.`));
-        if (account.scope === 'device')
-            console.log(chalk.gray(`${identity.agent} authentication is device-scoped; attach '${account.name}' to '${identity.agent}', not an individual version.`));
+        .action(async (source, name, _o, command) => {
+        try {
+            const identity = await nativeIdentityFromSource(source);
+            const account = addNativeAccount(name, identity.agent, identity.identityKey, identity.identityLabel, identity.scope);
+            console.log(chalk.green(`Named ${source} as ${account.name}.`));
+            if (account.scope === 'device')
+                console.log(chalk.gray(`${identity.agent} authentication is device-scoped; attach '${account.name}' to '${identity.agent}', not an individual version.`));
+        }
+        catch (err) {
+            cleanCommandError(command, err);
+        }
+    });
+    accounts.command('label <harness> [label]')
+        .description('Label a native login independently of its installed harness version')
+        .option('--account <email-or-id>', 'Native identity to label when the harness has multiple logins')
+        .action(async (harness, label, o, command) => {
+        try {
+            const agent = parseHarness(harness);
+            assertNativeAccountNameable(agent);
+            const candidates = (await collectRunCandidates(agent)).filter(candidate => candidate.signedIn);
+            const needle = o.account?.toLowerCase();
+            const selected = needle
+                ? candidates.find(candidate => candidate.email?.toLowerCase() === needle || candidate.accountKey?.toLowerCase() === needle)
+                : candidates.find(candidate => candidate.version === getGlobalDefault(agent)) ?? (candidates.length === 1 ? candidates[0] : undefined);
+            if (!selected)
+                throw new Error(needle
+                    ? `Unknown ${agent} account '${o.account}'.`
+                    : `Multiple ${agent} accounts are connected; pass --account <email|id>.`);
+            const identityKey = selected.accountKey ?? selected.email?.toLowerCase();
+            if (!identityKey)
+                throw new Error(`${agent} account '${selected.version}' has no stable identity.`);
+            const account = labelNativeAccount(agent, identityKey, selected.email ?? undefined, label, nativeAccountCapability(agent).scope);
+            console.log(chalk.green(`Labeled ${agent} account ${selected.email ?? identityKey} as '${account.name}'.`));
+        }
+        catch (err) {
+            cleanCommandError(command, err);
+        }
     });
     accounts.command('attach <account> <target>')
         .description('Attach a named account to a native installation or custom harness')
@@ -329,15 +363,25 @@ export function registerAccountsCommand(program) {
     accounts.command('remove <name>').description('Remove an account and its device-local credential').action((name) => removeAccount(name));
     accounts.command('set-default <agent> <name>')
         .description('Use this account for a harness when --account is omitted')
-        .action((agentRaw, name) => {
-        const { agent, account } = setDefaultAccount(agentRaw, name);
-        console.log(chalk.green(`${agent} now uses account '${account.name}' unless --account overrides it.`));
+        .action((agentRaw, name, _o, command) => {
+        try {
+            const { agent, account } = setDefaultAccount(agentRaw, name);
+            console.log(chalk.green(`${agent} now uses account '${account.name}' unless --account overrides it.`));
+        }
+        catch (err) {
+            cleanCommandError(command, err);
+        }
     });
     const switchCmd = accounts.command('switch <harness> [account]')
         .description('Pick the default account for a harness')
         .option('--json', 'Machine-readable account list or the resulting default')
         .action(async (harness, account, o, command) => {
-        await runAccountsSwitch(harness, account, { json: !!(o.json || command.optsWithGlobals().json) });
+        try {
+            await runAccountsSwitch(harness, account, { json: !!(o.json || command.optsWithGlobals().json) });
+        }
+        catch (err) {
+            cleanCommandError(command, err);
+        }
     });
     accounts.command('clear-default <agent>')
         .description('Return a harness to native login or balanced account selection')

package/dist/commands/auth.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from 'commander';
+export declare function registerAuthCommand(program: Command): void;

package/dist/commands/auth.js

@@ -0,0 +1,229 @@
+import chalk from 'chalk';
+import { PhoenixApiError, clearSession, createSpace, createSpaceInvite, fetchWhoAmI, listSpaceMembers, listSpaces, pollDeviceToken, readSession, removeSpaceMember, resolveMemberFromList, resolveSpaceFromList, slugify, startDeviceAuthorization, updateSpaceMemberRole, writeSession, } from '../lib/identity/index.js';
+import { setHelpSections } from '../lib/help.js';
+import { runOrDie } from '../lib/format.js';
+/**
+ * `agents auth` — sign in to Phoenix ID, the account layer behind team spaces.
+ * Signing in is optional: every local feature works with no account. Everything
+ * here goes through `lib/identity`; this file builds no URLs and reads no
+ * credential files of its own.
+ */
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+async function login() {
+    const grant = await startDeviceAuthorization();
+    console.log('');
+    console.log(`  Your code:  ${chalk.bold.cyan(grant.user_code)}`);
+    console.log(`  Open:       ${chalk.underline(grant.verification_uri_complete)}`);
+    console.log('');
+    console.log(chalk.gray('  Waiting for you to approve it in the browser…'));
+    // The server sets the pace; `slow_down` widens it (RFC 8628 §3.5).
+    let interval = Math.max(1, grant.interval) * 1000;
+    const deadline = Date.now() + grant.expires_in * 1000;
+    while (Date.now() < deadline) {
+        await sleep(interval);
+        const poll = await pollDeviceToken(grant.device_code);
+        if (poll.status === 'authorized') {
+            writeSession({ access_token: poll.access_token, email: poll.user.email, userId: poll.user.id });
+            console.log(chalk.green(`\n  Signed in as ${poll.user.email}.`));
+            return;
+        }
+        if (poll.status === 'slow_down') {
+            interval += 5000;
+            continue;
+        }
+        if (poll.status === 'denied')
+            throw new Error('Sign-in was denied in the browser.');
+        if (poll.status === 'expired')
+            throw new Error("That code expired. Run 'agents auth login' again.");
+    }
+    throw new Error("Timed out waiting for approval. Run 'agents auth login' again.");
+}
+async function whoami(json) {
+    const session = readSession();
+    if (!session) {
+        if (json) {
+            console.log(JSON.stringify({ signedIn: false }, null, 2));
+            return;
+        }
+        console.log(chalk.gray("Not signed in. Run 'agents auth login'."));
+        process.exitCode = 1;
+        return;
+    }
+    try {
+        const me = await fetchWhoAmI();
+        if (json) {
+            console.log(JSON.stringify({ signedIn: true, ...me }, null, 2));
+            return;
+        }
+        console.log(`${chalk.bold(me.email)}  ${chalk.gray(me.userId)}`);
+    }
+    catch (err) {
+        if (err instanceof PhoenixApiError && err.status === 401) {
+            throw new Error("Your session is no longer valid. Run 'agents auth login' again.");
+        }
+        throw err;
+    }
+}
+function printSpaces(spaces) {
+    if (!spaces.length) {
+        console.log(chalk.gray("  No spaces yet. Create one with 'agents auth space create <name>'."));
+        return;
+    }
+    for (const space of spaces) {
+        console.log(`  ${chalk.cyan(space.slug)}  ${space.name}  ${chalk.gray(space.user_role)}`);
+    }
+}
+/** Resolve a space reference (or the caller's only space) to a concrete space. */
+async function requireSpace(ref) {
+    const spaces = await listSpaces();
+    const space = resolveSpaceFromList(spaces, ref);
+    if (space)
+        return space;
+    if (!ref) {
+        throw new Error(spaces.length
+            ? `You are in ${spaces.length} spaces — name one: ${spaces.map((s) => s.slug).join(', ')}.`
+            : "You are not in a space yet. Create one with 'agents auth space create <name>'.");
+    }
+    throw new Error(`No space named '${ref}'.`);
+}
+export function registerAuthCommand(program) {
+    const auth = program
+        .command('auth')
+        .description('Sign in to Phoenix ID — the account layer behind team spaces');
+    setHelpSections(auth, {
+        examples: `agents auth login                         # device-code sign-in via your browser
+agents auth whoami                        # who this machine is signed in as
+agents auth space create "Design Team"    # start a space
+agents auth space invite ada@example.com  # add a teammate
+agents auth logout                        # clear this machine only`,
+        notes: `Signing in is optional — every local feature works with no account; team spaces are what it unlocks.
+Sign-in is Google-only and opens a Phoenix-branded page; the CLI never sees a password.
+The session lives in this machine's agents state dir, so logging out here signs out nothing else.
+Point at a different backend with PHOENIX_ID_BASE (defaults to the production service).`,
+    });
+    auth
+        .command('login')
+        .description('Sign in with the device-code flow')
+        .action(() => runOrDie(() => login()));
+    auth
+        .command('whoami')
+        .description('Show the signed-in account')
+        .option('--json', 'Machine-readable output')
+        .action((o, command) => {
+        const json = !!o.json || !!command.optsWithGlobals().json;
+        return runOrDie(() => whoami(json), { json });
+    });
+    auth
+        .command('logout')
+        .description("Clear this machine's session (no other device is affected)")
+        .action(() => runOrDie(() => {
+        const session = readSession();
+        clearSession();
+        console.log(session ? chalk.green(`Signed out ${session.email ?? 'this machine'}.`) : chalk.gray('Already signed out.'));
+    }));
+    const space = auth.command('space').description('Spaces — share work with teammates');
+    space
+        .command('list', { isDefault: true })
+        .description('Spaces you belong to')
+        .option('--json', 'Machine-readable output')
+        .action((o, command) => {
+        const json = !!o.json || !!command.optsWithGlobals().json;
+        return runOrDie(async () => {
+            const spaces = await listSpaces();
+            if (json)
+                return console.log(JSON.stringify(spaces, null, 2));
+            printSpaces(spaces);
+        }, { json });
+    });
+    space
+        .command('create <name>')
+        .description('Create a space')
+        .option('--slug <slug>', 'URL-safe name (defaults to a slug of <name>)')
+        .option('--json', 'Machine-readable output')
+        .action((name, o, command) => {
+        const json = !!o.json || !!command.optsWithGlobals().json;
+        return runOrDie(async () => {
+            const created = await createSpace({ name, slug: o.slug ?? slugify(name) });
+            if (json)
+                return console.log(JSON.stringify(created, null, 2));
+            console.log(chalk.green(`Created ${created.name} (${created.slug}).`));
+        }, { json });
+    });
+    space
+        .command('members [space]')
+        .description('Who is in a space')
+        .option('--json', 'Machine-readable output')
+        .action((ref, o, command) => {
+        const json = !!o.json || !!command.optsWithGlobals().json;
+        return runOrDie(async () => {
+            const target = await requireSpace(ref);
+            const members = await listSpaceMembers(target.id);
+            if (json)
+                return console.log(JSON.stringify(members, null, 2));
+            for (const m of members)
+                console.log(`  ${m.email}  ${chalk.gray(m.role)}`);
+        }, { json });
+    });
+    space
+        .command('invite <email>')
+        .description('Invite someone to a space')
+        .option('--space <space>', 'Which space (defaults to your only one)')
+        .option('--role <role>', 'admin or member', 'member')
+        .option('--json', 'Machine-readable output')
+        .action((email, o, command) => {
+        const json = !!o.json || !!command.optsWithGlobals().json;
+        return runOrDie(async () => {
+            if (o.role !== 'admin' && o.role !== 'member') {
+                throw new Error(`--role must be admin or member (got '${o.role}').`);
+            }
+            const target = await requireSpace(o.space);
+            const result = await createSpaceInvite(target.id, { email, role: o.role });
+            if (json)
+                return console.log(JSON.stringify(result, null, 2));
+            console.log(result.member_added
+                ? chalk.green(`Added ${email} to ${target.name} as ${o.role}.`)
+                : chalk.green(`Invited ${email} to ${target.name} as ${o.role}. Invite code: ${result.invite_code}`));
+        }, { json });
+    });
+    space
+        .command('role <email> <role>')
+        .description('Change a member\'s role (owner only for admin)')
+        .option('--space <space>', 'Which space (defaults to your only one)')
+        .option('--json', 'Machine-readable output')
+        .action((email, role, o, command) => {
+        const json = !!o.json || !!command.optsWithGlobals().json;
+        return runOrDie(async () => {
+            if (role !== 'admin' && role !== 'member') {
+                throw new Error(`role must be admin or member (got '${role}').`);
+            }
+            const target = await requireSpace(o.space);
+            const member = resolveMemberFromList(await listSpaceMembers(target.id), email);
+            if (!member)
+                throw new Error(`${email} is not in ${target.name}.`);
+            const updated = await updateSpaceMemberRole(target.id, member.user_id, role);
+            if (json)
+                return console.log(JSON.stringify(updated, null, 2));
+            console.log(chalk.green(`${email} is now ${role} in ${target.name}.`));
+        }, { json });
+    });
+    space
+        .command('remove <email>')
+        .description('Remove a member (or yourself) from a space')
+        .option('--space <space>', 'Which space (defaults to your only one)')
+        .option('--json', 'Machine-readable output')
+        .action((email, o, command) => {
+        const json = !!o.json || !!command.optsWithGlobals().json;
+        return runOrDie(async () => {
+            const target = await requireSpace(o.space);
+            const member = resolveMemberFromList(await listSpaceMembers(target.id), email);
+            if (!member)
+                throw new Error(`${email} is not in ${target.name}.`);
+            await removeSpaceMember(target.id, member.user_id);
+            if (json)
+                return console.log(JSON.stringify({ removed: true, email, space: target.slug }, null, 2));
+            console.log(chalk.green(`Removed ${email} from ${target.name}.`));
+        }, { json });
+    });
+}

package/dist/commands/browser-sessions-picker.js

@@ -10,12 +10,13 @@
  * second renderer. Interactive routing and the browse loop live in
  * `sessions-picker-factory.ts` (shared with the computer twin).
  */
+import { showFile } from '../lib/open-url.js';
 import chalk from 'chalk';
 import { itemPicker } from '../lib/picker.js';
 import { isPromptCancelled } from './utils.js';
 import { buildPreview } from './sessions-picker.js';
 import { createSessionsPickerCommand } from './sessions-picker-factory.js';
-import { runBrowserSessions, buildBrowserSessionRows, matchesBrowserSessionRow, openArtifact, formatBytes, } from '../lib/browser/sessions-list.js';
+import { runBrowserSessions, buildBrowserSessionRows, matchesBrowserSessionRow, formatBytes, } from '../lib/browser/sessions-list.js';
 import { formatRelativeTime } from '../lib/session/relative-time.js';
 const KIND_LABEL = {
     screenshot: 'shots',
@@ -89,11 +90,12 @@ function formatArtifactLabel(a) {
     const age = formatRelativeTime(new Date(a.mtimeMs).toISOString());
     return `${age.padEnd(11)}  ${a.name.padEnd(34)}  ${formatBytes(a.bytes).padStart(8)}`;
 }
-/** Open one artifact in the OS default app, printing its path (matches the
- *  non-interactive `--open` behavior) and any open failure. */
-function openAndReport(a) {
+/** Open one artifact, printing its path (matches the non-interactive `--open`
+ *  behavior) and any open failure. Routes through the same viewer seam as
+ *  `--open`, so the interactive and non-interactive halves cannot diverge. */
+async function openAndReport(a) {
     console.log(a.path);
-    if (!openArtifact(a.path))
+    if ((await showFile(a.path)).via === 'none')
         console.error(`Could not open ${a.path}`);
 }
 /** Second-level picker over one row's captures, newest first. Enter opens the
@@ -136,12 +138,12 @@ const browserSessionsPicker = createSessionsPickerCommand({
             return;
         }
         if (row.artifacts.length === 1) {
-            openAndReport(row.artifacts[0]);
+            await openAndReport(row.artifacts[0]);
             return;
         }
         const artifact = await pickArtifact(row);
         if (artifact)
-            openAndReport(artifact);
+            await openAndReport(artifact);
     },
 });
 /** True when the interactive picker should open instead of the printed table: