@phnx-labs/agents-cli 1.22.91 → 1.22.92

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## 1.22.92
+
+- **AGI Menu 1.1.0 is the helper the CLI installs (PHNX-4007).** The menu-bar
+  helper floor moves from 1.0.0 to 1.1.0, so `agents menubar setup` and
+  `agents menubar enable` download and install the release that carries the
+  dispatch form, the Sessions window, actionable notification banners, the
+  screenshot OCR index, and the FeedStream data layer (PHNX-3999). The startup
+  self-heal stays network-free: it reinstalls only from a bundled or cached copy,
+  so an existing 1.0.0 install upgrades on the next `agents menubar setup`.
+  Source: `src/lib/helper-versions.ts`.
+
 ## 1.22.91
 
 - **`agents sessions` search/list execs the standalone `sessions` CLI (PHNX-4012).** Read queries intercept in `index.ts` before bootstrap so they skip the 6K-line in-process engine. Lifecycle verbs (`resume`, `stop`, `inject`, `watch`, `--active`, `--markdown`) still load the in-repo command. The `sessions` alias shim is retired like `secrets` so it cannot recurse. Install: `npm i -g @phnx-labs/sessions-cli`. Source: `cli/src/index.ts`, `cli/src/lib/sessions-client.ts`, `cli/scripts/postinstall.js`.

package/dist/commands/exec.js

@@ -2234,7 +2234,7 @@ agents run auto --device yosemite-s0 "fix the flaky test"   # pin the device
                 // dispatch time; the peer resolves ITS slot. This block is local-only.
                 const remoteTarget = options.host || options.device;
                 if (!remoteTarget) {
-                    const { adoptedConfigPointsAtHome, adoptedSymlinkMismatchError, isSymlinkAdoptedHarness, resolveNativeSpawnHome, symlinkAdoptedAccountError, } = await import('../lib/exec-account-home.js');
+                    const { adoptedConfigPointsAtHome, adoptedSymlinkMismatchError, durableSlotEnv, isSymlinkAdoptedHarness, resolveNativeSpawnHome, symlinkAdoptedAccountError, } = await import('../lib/exec-account-home.js');
                     const { readMeta } = await import('../lib/state.js');
                     const meta = readMeta();
                     if (isSymlinkAdoptedHarness(agent)) {
@@ -2251,6 +2251,11 @@ agents run auto --device yosemite-s0 "fix the flaky test"   # pin the device
                             process.exit(1);
                         }
                         execHome = resolved.execHome;
+                        // A worker's durable api-key slot holds no file: the pushed key
+                        // rides the harness env var (CURSOR_API_KEY, …) on this launch.
+                        const durable = durableSlotEnv(agent, spawnAccount, resolved, meta);
+                        if (Object.keys(durable).length > 0)
+                            accountEnv = { ...accountEnv, ...durable };
                         if (resolved.source === 'legacy-home') {
                             accountConfigVersion = resolved.label;
                             // A leftover version-labeled home is both the spawn HOME and

package/dist/lib/exec-account-home.d.ts

@@ -1,3 +1,4 @@
+import { selfConfiguredDeviceRole } from './device-config.js';
 import { isSymlinkAdoptedHarness } from './installations/shims.js';
 import type { AgentId, DeviceAccountSlot, Meta } from './types.js';
 export { isAccountSlotDir } from './agents.js';
@@ -10,6 +11,24 @@ export interface NativeSpawnHome {
     /** Installation label when `source` is `legacy-home`. */
     label?: string;
 }
+/**
+ * The env a DURABLE slot injects at spawn (PHNX-3940 T5/T6). A worker's slot
+ * for an api-key harness (codex/grok/cursor/opencode/droid) holds no file — the
+ * daemon pushed the account's worker API key into the reserved
+ * `__<harness>__` store and `provisionWorkerSlot` recorded the slot as
+ * `durable`; the key rides the harness's own env var (`CURSOR_API_KEY`, …)
+ * on every launch. Anything else — a native login in the slot on a headed
+ * device, a claude durable slot (its setup-token is a `.oauth_token` file the
+ * adapter reads), a harness with no api-key worker kind, a headed device — injects
+ * nothing.
+ * Without this, `agents run cursor#gmail` on a worker reached Cursor with an
+ * empty env and got `Authentication required … set CURSOR_API_KEY`.
+ */
+export declare function durableSlotEnv(agent: AgentId, account: {
+    id: string;
+}, resolved: Pick<NativeSpawnHome, 'slot'>, meta: Pick<Meta, 'accounts' | 'deviceAccounts'>, deps?: {
+    selfRole?: () => ReturnType<typeof selfConfiguredDeviceRole>;
+}): Record<string, string>;
 export declare function missingSlotHint(agent: AgentId, name: string): string;
 export declare function symlinkAdoptedAccountError(agent: AgentId, name: string, defaultName: string | undefined): string;
 export declare function adoptedSymlinkMismatchError(agent: AgentId, name: string, execHome: string): string;

package/dist/lib/exec-account-home.js

@@ -13,7 +13,7 @@ import * as os from 'node:os';
 import * as path from 'node:path';
 import { listNativeAccounts, nativeAccountHome } from './account-registry.js';
 import { readSlots } from './accounts/slots.js';
-import { workerProvisioningHint } from './accounts/add.js';
+import { workerProvisioningHint, workerApiKeyEnv } from './accounts/add.js';
 import { AGENTS, credentialPresence, getAccountInfo } from './agents.js';
 import { AUTH_BUNDLE, claudeAccountTokenKey, provisionWorkerSlot, readReservedCredential } from './claude-account-token.js';
 import { isHeadedDeviceRole, selfConfiguredDeviceRole } from './device-config.js';
@@ -22,6 +22,40 @@ import { getAgentConfigPath, isSymlinkAdoptedHarness, repointAdoptedConfigToHome
 import { getVersionHomePath, listInstalledVersions } from './installations/versions.js';
 export { isAccountSlotDir } from './agents.js';
 export { isSymlinkAdoptedHarness };
+/**
+ * The env a DURABLE slot injects at spawn (PHNX-3940 T5/T6). A worker's slot
+ * for an api-key harness (codex/grok/cursor/opencode/droid) holds no file — the
+ * daemon pushed the account's worker API key into the reserved
+ * `__<harness>__` store and `provisionWorkerSlot` recorded the slot as
+ * `durable`; the key rides the harness's own env var (`CURSOR_API_KEY`, …)
+ * on every launch. Anything else — a native login in the slot on a headed
+ * device, a claude durable slot (its setup-token is a `.oauth_token` file the
+ * adapter reads), a harness with no api-key worker kind, a headed device — injects
+ * nothing.
+ * Without this, `agents run cursor#gmail` on a worker reached Cursor with an
+ * empty env and got `Authentication required … set CURSOR_API_KEY`.
+ */
+export function durableSlotEnv(agent, account, resolved, meta, deps = {}) {
+    if (resolved.slot?.authMode !== 'durable')
+        return {};
+    // A headed device authenticates from its own native login (invariant 7). A
+    // `durable` record can outlive a role change (`agents devices role … personal`
+    // never rewrites slots), so the gate is the box's CURRENT role, the same
+    // predicate `isProvisionableWorker` applies — never a record on disk.
+    if (isHeadedDeviceRole((deps.selfRole ?? selfConfiguredDeviceRole)()))
+        return {};
+    const envName = workerApiKeyEnv(agent);
+    if (!envName)
+        return {};
+    const row = nativeRow(account.id, meta);
+    const cred = row?.workerCredential;
+    if (!cred || cred.kind !== 'api-key')
+        return {};
+    const value = readReservedCredential(cred.bundle, cred.key);
+    if (!value)
+        return {};
+    return { [envName]: value };
+}
 export function missingSlotHint(agent, name) {
     const role = selfConfiguredDeviceRole();
     if (!isHeadedDeviceRole(role)) {

package/dist/lib/helper-versions.js

@@ -36,7 +36,7 @@
  * helper release now, off this table entirely.
  */
 export const HELPER_RELEASES = {
-    menubar: { tagPrefix: 'menubar', floor: '1.0.0' },
+    menubar: { tagPrefix: 'menubar', floor: '1.1.0' },
     'computer-mac': { tagPrefix: 'computer-mac', floor: '1.0.0' },
     // The Windows helper is a bare .exe, not an .app bundle, so it does not share
     // helper-download.ts's zip/codesign/notarize machinery -- but it has the same

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@phnx-labs/agents-cli",
-  "version": "1.22.91",
+  "version": "1.22.92",
   "description": "One CLI for all your AI coding agents - versions, config, cloud dispatch, sessions, and teams (now with first-class Grok Build CLI support)",
   "type": "module",
   "main": "dist/index.js",