@phnx-labs/agents-cli 1.22.84 → 1.22.85

package/dist/index.js

@@ -2,28 +2,27 @@
 /**
  * CLI entry point for agents-cli.
  *
- * Slim shell (RUSH-2335): only the leaf `lib/secrets/sync-commands.js` is a
- * static import, so the argv fast paths below can answer without evaluating the
- * commander + self-update + command-registry graph that used to be hoisted
- * above every intercept (~140ms of cold bootstrap per synchronous secrets-
- * broker read). The full CLI loads via `await import('./bootstrap.js')` once
- * none of the fast paths match.
+ * Slim shell (RUSH-2335): no static imports at all, so the argv fast paths
+ * below can answer without evaluating the commander + self-update +
+ * command-registry graph. The full CLI loads via `await import('./bootstrap.js')`
+ * once none of the fast paths match.
  *
  * Fast paths (must stay above the bootstrap import — ESM does not hoist dynamic
  * `import()`, but any static import here would still evaluate first):
- *   - `__vault-age-helper`
- *   - `__secrets-get` / `__secrets-ping` / `__secrets-lock` (SYNC_* tokens)
+ *   - `__launch-lease`
  *   - `__shim`
+ *   - `__gh`
  *   - `__claude-statusline`
  *   - `__usage-ingest` / `__usage-export`
+ *   - `__harness-update-run`
  *   - `__daemon-run`
  *
- * The tokens are imported from the leaf module sync-commands.ts — the SAME
- * bindings the clients spawn with, so this dispatch and those spawns cannot
- * drift apart. It is a leaf precisely so binding them here is free: importing
- * agent.js would pull the whole secrets graph into every invocation.
+ * The synchronous secrets-broker fast paths (`__secrets-get` / `__secrets-ping`
+ * / `__secrets-lock`) and `__vault-age-helper` moved out of this CLI entirely
+ * with the standalone `secrets` engine (PHNX-3989) — agents-cli now talks to
+ * it only through the bounded process client (`lib/secrets-client.ts`), never
+ * through a hidden subcommand of its own.
  */
-import { SYNC_GET_CMD, SYNC_PING_CMD, SYNC_LOCK_CMD } from './lib/secrets/sync-commands.js';
 // Force exit on Ctrl+C when no interactive prompt is handling it — UNLESS a
 // guarded harness auto-update pass is mutating this process transactionally
 // (PHNX-3940). A hard exit mid-swap can leave an installation whose directory
@@ -42,35 +41,6 @@ process.on('SIGINT', () => {
 // Ignore SIGPIPE — prevents exit code 13 crashes in piped environments
 // (e.g. `agents sessions | head`, or when stdout is captured by another process).
 process.on('SIGPIPE', () => { });
-if (process.argv[2] === '__vault-age-helper') {
-    const { runVaultAgeHelperCli } = await import('./lib/secrets/vault-age-helper.js');
-    await runVaultAgeHelperCli();
-    process.exit(process.exitCode ?? 0);
-}
-// Synchronous secrets-broker clients (src/lib/secrets/agent.ts). These are the
-// hot read path: `readAndResolveBundleEnv` is synchronous all the way down, so
-// it can't await a socket round-trip — it spawns one of these and reads the
-// exit code (0 = hit/alive, 3 = miss/down).
-//
-// Intercepted HERE, before bootstrap, for the same reason as __daemon-run and
-// __vault-age-helper. Everything in bootstrap runs `checkForUpdates()` and
-// `spawnDetachedSync()` on every non-help invocation — so registering these as
-// ordinary hidden subcommands would fire an update check and fork a detached
-// background sync on *every cache hit*, which is both a fork storm on the hot
-// path and a source of stdout writes that could corrupt the JSON payload. Keep
-// them above the line; agent.test.ts asserts this ordering so the block can't
-// drift into bootstrap.
-if (process.argv[2] === SYNC_GET_CMD ||
-    process.argv[2] === SYNC_PING_CMD ||
-    process.argv[2] === SYNC_LOCK_CMD) {
-    const { runAgentGetSync, runAgentPingSync, runAgentLockSync } = await import('./lib/secrets/agent.js');
-    const name = process.argv[3] ?? '';
-    const harness = process.argv[4] ?? 'cli';
-    const code = process.argv[2] === SYNC_GET_CMD ? await runAgentGetSync(name, harness)
-        : process.argv[2] === SYNC_PING_CMD ? await runAgentPingSync()
-            : await runAgentLockSync(name);
-    process.exit(code);
-}
 // Launch-lease delegate: every generated native shim/alias calls
 // `agents __launch-lease <agent> <label> <pid>` right before its final `exec`
 // (PHNX-3940) — on the hot launch path of every managed agent, so it must skip
@@ -164,3 +134,4 @@ if (process.argv[2] === '__daemon-run') {
 // Full CLI: commander tree, update checks, migrations, parse. Static imports
 // inside bootstrap.js evaluate only when we reach this line.
 await import('./bootstrap.js');
+export {};

package/dist/lib/account-capabilities.d.ts

@@ -39,7 +39,7 @@ export declare function nativeAccountNamingRefusal(agent: AgentId): string | nul
 /** Fail loud on the native name/attach path for an unsupported harness. */
 export declare function assertNativeAccountNameable(agent: AgentId): void;
 /**
- * The single identity key used at `accounts name`, attach, exec validation,
+ * The single identity key used at `accounts add`, exec validation,
  * view, and inventory. Prefer the harness's stable `accountKey`. For an
  * email-only (`conditional`) harness, email is a presence gate — the stored
  * key is still `accountKey` (e.g. `muse:email=user@x.com`), never the bare

package/dist/lib/account-capabilities.js

@@ -79,7 +79,7 @@ export function assertNativeAccountNameable(agent) {
         throw new Error(reason);
 }
 /**
- * The single identity key used at `accounts name`, attach, exec validation,
+ * The single identity key used at `accounts add`, exec validation,
  * view, and inventory. Prefer the harness's stable `accountKey`. For an
  * email-only (`conditional`) harness, email is a presence gate — the stored
  * key is still `accountKey` (e.g. `muse:email=user@x.com`), never the bare

package/dist/lib/account-catalog.d.ts

@@ -1,5 +1,10 @@
 import { type AccountInfo } from './agents.js';
+import { type CredentialAccount } from './account-registry.js';
 import type { AgentId, Meta } from './types.js';
+import { type AuthVerdict } from './auth-health.js';
+import { applyUsageHonesty, type QuotaSummary } from './devices/harness-inventory.js';
+import { type AccountProvisioning, type AccountVerdict } from './signin-badge.js';
+export { applyUsageHonesty };
 /**
  * Strict "is this home actually connected?" — a live CREDENTIAL in that exact
  * version home, not just a metadata identity claim (PHNX-3940). A `.claude.json`
@@ -39,9 +44,9 @@ export interface AccountHome {
 /**
  * A live credential state, derived from the homes rather than the registry:
  * - `connected` — at least one home for this identity is signed in.
- * - `reconnect-needed` — the account is registered (or was created by connect)
- *   but no home currently holds a live credential; the label alone is not a
- *   connection. `agents accounts connect <name>` re-authenticates it.
+ * - `reconnect-needed` — the account is registered but no home currently
+ *   holds a live credential; the label alone is not a connection.
+ *   `agents accounts login <harness>#<name>` re-authenticates it.
  */
 export type AccountConnectionState = 'connected' | 'reconnect-needed';
 /** Account-first row for a native (harness-owned OAuth) identity. */
@@ -67,8 +72,21 @@ export interface NativeAccountCatalogRow {
     /** Whether the harness's configured default account points at this identity. */
     isDefault: boolean;
     state: AccountConnectionState;
+    identityLabel: string;
+    provisioning: AccountProvisioning;
+    verdict: AccountVerdict;
+    checkedAt: string | null;
+    devices: AccountDeviceVerdict[];
+    usage: QuotaSummary | null;
+    fix: string | null;
 }
-/** Account-first row for a durable provider (API-key / token) account bundle. */
+export interface AccountDeviceVerdict {
+    device: string;
+    authMode: 'native' | 'durable' | 'per-device';
+    verdict: Exclude<AccountVerdict, 'per-device'>;
+    checkedAt?: string;
+}
+/** Account-first row for a durable provider (API-key / token) account. */
 export interface ProviderAccountCatalogRow {
     kind: 'provider';
     name: string;
@@ -76,11 +94,58 @@ export interface ProviderAccountCatalogRow {
     provider: string;
     auth: string;
     baseUrl?: string;
+    /** Harnesses this credential can authenticate. Empty = listed under Other accounts. */
+    harnesses: AgentId[];
+    /** Harnesses whose configured default points at this account. */
+    defaultFor: AgentId[];
+    identityLabel: string;
+    verdict: Extract<AccountVerdict, 'ready' | 'missing'>;
+    fix: string | null;
 }
 export type AccountCatalogRow = NativeAccountCatalogRow | ProviderAccountCatalogRow;
 export interface AccountCatalog {
     native: NativeAccountCatalogRow[];
     provider: ProviderAccountCatalogRow[];
+    /**
+     * Set when the standalone `secrets` CLI could not be reached to read the
+     * provider (durable-credential) accounts — missing, unreachable, or timed out
+     * on this box. The native rows (harness OAuth logins, read from config files,
+     * not `secrets`) still render; only the provider section is unavailable. A
+     * read-only surface (`agents view`, `agents accounts`) surfaces this as one
+     * clear line and renders the rest rather than hanging or crashing (PHNX-3989).
+     */
+    secretsUnavailable?: {
+        code: string;
+        message: string;
+    };
+}
+/**
+ * One account in the public JSON v2 projection (`accounts list --json`, `view --json`).
+ * A provider credential that authenticates several harnesses is one entry per
+ * harness (same `id`, each with its own `harness`); an orphan is `harness: null`.
+ */
+export interface AccountListEntryJson {
+    kind: 'native' | 'provider';
+    id: string;
+    /** Null for a provider credential no harness authenticates. */
+    harness: AgentId | null;
+    name: string | null;
+    identityLabel: string;
+    isDefault: boolean;
+    provisioning: AccountProvisioning;
+    verdict: AccountVerdict;
+    checkedAt: string | null;
+    devices: Array<{
+        device: string;
+        authMode: AccountDeviceVerdict['authMode'];
+        verdict: AccountDeviceVerdict['verdict'];
+    }>;
+    usage: QuotaSummary | null;
+    fix: string | null;
+}
+export interface AccountListJson {
+    version: 2;
+    accounts: AccountListEntryJson[];
 }
 /** One installed home probed for its native identity — the raw input to the fold. */
 export interface NativeHomeRow {
@@ -105,10 +170,60 @@ type CatalogMeta = Pick<Meta, 'accounts' | 'deviceAccounts'>;
  * silently dropped from the list nor shown as connected.
  */
 export declare function buildNativeCatalog(rows: NativeHomeRow[], meta: CatalogMeta, globalDefault?: (agent: AgentId) => string | null): NativeAccountCatalogRow[];
+export declare function toProviderRow(account: CredentialAccount, meta: Pick<Meta, 'accounts'>): ProviderAccountCatalogRow;
 /**
  * Wire the real collectors to the pure builder. This is the canonical
  * account-first read model `view.ts` renders: native identities (account +
- * connection first, release/home secondary) plus the durable provider bundles.
+ * connection first, release/home secondary) plus durable provider credentials.
  */
 export declare function loadAccountCatalog(): Promise<AccountCatalog>;
-export {};
+/**
+ * The one clear line a read-only surface prints when the provider section could
+ * not be read (PHNX-3989) — so a missing/broken standalone is stated plainly
+ * while the native rows and the rest of the output still render. Null when the
+ * catalog is complete. Printed to stderr by the command so it never corrupts
+ * `--json` stdout.
+ */
+export declare function secretsUnavailableNote(catalog: Pick<AccountCatalog, 'secretsUnavailable'>): string | null;
+export declare function accountListJson(native: NativeAccountCatalogRow[], providers?: ProviderAccountCatalogRow[], harness?: AgentId): AccountListJson;
+/** Shared text renderer used by both `accounts list` and account-first `view`. */
+export declare function renderAccountRows(rows: NativeAccountCatalogRow[], opts: {
+    heading?: boolean;
+    footer?: boolean;
+    harnessHeadings?: boolean;
+    providers?: ProviderAccountCatalogRow[];
+    /** When set, emit only this harness's group — never a sibling or empty group. */
+    harness?: AgentId;
+    /**
+     * Device name treated as "this box" in WHERE when it is the only reporter.
+     * The command layer passes `machineId()`; this renderer never resolves it.
+     */
+    localDevice: string;
+}): string;
+export declare function readSharedAccountVerdicts(userAgentsDir?: string): Map<string, AccountDeviceVerdict[]>;
+/**
+ * Devices whose daemon-state file exists but carries no account verdicts —
+ * typically an older release that has not started publishing the T3 envelope.
+ * The fleet matrix lists them in a coverage note rather than as blank columns.
+ */
+export declare function listDevicesWithoutAccountVerdicts(userAgentsDir?: string): string[];
+/** The T1 slot store's per-account observation of the local verdict. */
+export interface LocalSlotObservation {
+    authMode: AccountDeviceVerdict['authMode'];
+    verdict: AuthVerdict;
+    checkedAt?: string;
+}
+/**
+ * Merge the two writers of the same local truth — the T1 slot store and the
+ * daemon's auth-health cache — by NEWEST observation. A naive `??` chain lets
+ * an older slot `live` permanently mask a newer daemon `revoked`, so a revoked
+ * account would keep rendering LIVE on its own device. Pure.
+ */
+export declare function resolveLocalAccountObservation(slot: LocalSlotObservation | undefined, cached: {
+    verdict: AuthVerdict;
+    checkedAt: number;
+} | undefined, signedIn: boolean): {
+    verdict: AccountDeviceVerdict['verdict'];
+    authMode?: AccountDeviceVerdict['authMode'];
+    checkedAt?: string;
+};