@phnx-labs/agents-cli 1.22.96 → 1.22.98

package/CHANGELOG.md

@@ -1,9 +1,21 @@
 # Changelog
 
+## 1.22.98
+
+- `agents run codex#<account>` on macOS now runs as that account. The SUN_LEN short-home relocation keyed `CODEX_HOME` by version alone, so an account slot (long enough to overflow too) was silently redirected to the default version's `~/.agents/.codex-homes/<version>/.codex` and its login — `agents run codex#getrush` opened the gmail session while the banner still said `getrush`. The short home is now keyed by the origin (`a-<account id>` for a slot). A version/account reinstall that recreates a fresh `.codex` adopts its existing short home (which holds the login) instead of failing, and a slot mis-linked onto a foreign home by the old layout is repointed to its own home rather than run as the wrong account.
+
+- **A Firefox task no longer parks the browser-task reaper, and `record` on Firefox says "recording" (PHNX-4043).** The daemon's idle reaper asks every live task for its recording status before closing it; on a Firefox (or native Arc) task that query threw a capability error, so one Firefox task failed every reap tick and the `browser-task-reap` service parked after three failures, leaving abandoned tabs open for every profile on that box. Recording status on a backend that cannot record is now a truthful "not recording". `agents browser record start`/`stop` and `start --record` on a Firefox profile still fail loud, now naming `recording` instead of `screenshot` (screenshots do work on Firefox). Source: `cli/src/lib/browser/service.ts` `recordStart`/`recordStop`/`recordStatus`.
+
+## 1.22.97
+
+- `agents browser --help` and the `agents setup browser` install hint no longer claim Firefox is unsupported: they now state Chromium-family over CDP, Arc natively, and Firefox over WebDriver BiDi (Safari stays unsupported). `tabs --all` gains a help example and rows in the Arc and Firefox capability tables.
+
 ## 1.22.96
 
 - **`agents browser tabs --all` shows every tab open in the profile browser, yours included (PHNX-4043).** Until now `tabs` listed only the task's own tabs, so an agent sharing an Arc Space, a Comet store, or a Firefox profile with you could not see what else was open. `--all` lists every top-level tab: OWNER names the agents-cli task that owns it, or `you` for a tab no task owns; `*` still marks the task's current tab. Read-only on every backend (Chromium `Target.getTargets`, the Arc Space's tabs, Firefox `browsingContext.getTree`). Source: `cli/src/lib/browser/service.ts` `profileTabs`, `cli/src/commands/browser.ts`.
 
+## 1.22.95
+
 - **Firefox automation over WebDriver BiDi (PHNX-4043).** `agents browser` now drives
   Firefox, which dropped the Chrome DevTools Protocol in 129. Every Firefox profile in
   `profiles.ini` is discovered read-only as a `firefox-<name>` browser profile

package/dist/commands/browser.js

@@ -329,6 +329,9 @@ export function registerBrowserCommand(program) {
       agents browser navigate https://example.com
       agents browser screenshot
 
+      # Every tab open in the profile browser, yours next to the task's (OWNER column)
+      agents browser tabs --all
+
       # Keep one process and browser-service socket warm for repeated actions
       agents browser stream --task "$AGENTS_BROWSER_TASK"
 
@@ -358,9 +361,10 @@ export function registerBrowserCommand(program) {
       Most agent workflows should use the 'browser' skill instead of raw subcommands.
       The skill wraps profile selection, snapshotting, and tunneling.
 
-      Browser support: Chromium-family only (Chrome, Comet, Chromium, Brave, Edge, Arc).
-      Safari and Firefox are not supported — they don't speak the Chrome DevTools
-      Protocol the way agents browser expects. On Windows, Edge is the default
+      Browser support: Chromium-family over the Chrome DevTools Protocol (Chrome,
+      Comet, Chromium, Brave, Edge), Arc natively (one profile per Space), and
+      Firefox over WebDriver BiDi (one profile per profiles.ini entry; Firefox 129+
+      dropped CDP). Safari is not supported. On Windows, Edge is the default
       because it's preinstalled. On macOS and Linux, Chrome is preferred when
       installed; otherwise the first Chromium-family binary on disk wins.
     `,

package/dist/commands/setup-browser.js

@@ -15,7 +15,8 @@ import { DEFAULT_VIEWPORT } from '../lib/browser/devices.js';
 import { isInteractiveTerminal, isPromptCancelled } from './utils.js';
 import { defaultBrowserChoice } from './setup-preferences.js';
 const INSTALL_HINT = 'Install one of: Google Chrome, Brave, Microsoft Edge, Chromium, Comet, or Arc, then re-run `agents setup browser`.\n' +
-    '(Safari and Firefox are not supported — agents browser drives over the Chrome DevTools Protocol.)';
+    '(This wizard picks a Chromium-family browser. An installed Firefox is not auto-picked here; its profiles are ' +
+    'discovered from profiles.ini and selected with `agents browser use firefox-<name>`. Safari is not supported.)';
 /**
  * Interactive browser setup. Returns true if a usable default profile exists
  * afterwards, false if none exists / the user backed out. Non-interactively it

package/dist/lib/browser/chrome.js

@@ -187,9 +187,10 @@ export function findBrowserPath(browserType, customBinary) {
     throw new Error(`Browser "${browserType}" not found. Install it first.`);
 }
 // Per-platform Chromium-family priority list for "no --profile" auto-pick.
-// Order is: most-likely-installed-and-stable first. Safari and Firefox are
-// intentionally excluded — they don't speak the Chrome DevTools Protocol the
-// way cdp.ts expects, so they'd need separate drivers.
+// Order is: most-likely-installed-and-stable first. Firefox is intentionally
+// absent: it has its own WebDriver BiDi driver (drivers/firefox.ts) and its
+// profiles come from profiles.ini discovery, never from this binary pick.
+// Safari has no driver at all.
 const DEFAULT_BROWSER_PRIORITY = {
     // macOS: Chrome leads (>70% of dev machines), then the rest of the family.
     // Arc is last: it's in maintenance mode and needs a blank tab to drive, so it

package/dist/lib/browser/service.js

@@ -1592,7 +1592,7 @@ export class BrowserService {
             throw new Error(`Task "${taskId}" is already recording. Call record stop first.`);
         }
         const { conn, task, key: runtimeKey } = await this.findTask(taskId);
-        requireCdp(conn, 'screenshot');
+        requireCdp(conn, 'recording');
         const shortId = tabHint ? await this.resolveTabHint(conn, task, tabHint) : this.resolveCurrentTab(task);
         const cdpTargetId = this.getCdpTargetId(task, shortId);
         const target = await this.getTarget(conn, cdpTargetId);
@@ -1796,7 +1796,7 @@ export class BrowserService {
     async recordStop(taskId, reason = 'manual') {
         const activeTask = await this.findTask(taskId).catch(() => undefined);
         if (activeTask)
-            requireCdp(activeTask.conn, 'screenshot');
+            requireCdp(activeTask.conn, 'recording');
         const rec = this.recordings.get(taskId);
         if (!rec) {
             throw new Error(`Task "${taskId}" is not currently recording`);
@@ -1883,9 +1883,12 @@ export class BrowserService {
         // not route an already-live task through findTask(), which stamps it as
         // active and defeats idle detection. A cold daemon may still rehydrate for
         // an explicit user query.
+        // A status query, not an action: a backend that cannot record (Arc native,
+        // Firefox BiDi) is truthfully "not recording". Throwing here took the
+        // idle reaper down with it — one Firefox task parked reaping for every task.
         const live = this.findTaskByHandle(taskId) ?? await this.findTask(taskId).catch(() => undefined);
-        if (live)
-            requireCdp(live.conn, 'screenshot');
+        if (live && (live.conn.backend === 'arc-native' || live.conn.backend === 'bidi'))
+            return { recording: false };
         const rec = this.recordings.get(taskId);
         if (!rec)
             return { recording: false };

package/dist/lib/codex-home.d.ts

@@ -8,24 +8,56 @@ export declare const CODEX_CONTROL_SOCKET_SUFFIX = "/app-server-control/app-serv
  */
 export declare function codexHomeOverflowsSunLen(home: string): boolean;
 /**
- * The short, per-version codex home used when the versioned home overflows.
- * `~/.agents/.codex-homes/<version>/.codex` keeps the socket path well under
- * SUN_LEN while staying stable across reboots (unlike $TMPDIR) and per-version
- * isolated.
+ * The short codex home used when an origin home overflows.
+ * `~/.agents/.codex-homes/<key>/.codex` keeps the socket path well under
+ * SUN_LEN while staying stable across reboots (unlike $TMPDIR) and isolated
+ * per origin.
  */
-export declare function shortCodexHome(agentsUserDir: string, version: string): string;
+export declare function shortCodexHome(agentsUserDir: string, key: string): string;
 /**
- * Resolve a macOS SUN_LEN-safe CODEX_HOME for the given versioned home,
- * migrating the home to a short real path (once, idempotently) when needed.
+ * The short-home key for a codex config home: the version for a version home,
+ * `a-<accountId prefix>` for an account slot under `<historyDir>/accounts/codex/`.
+ * Twelve hex characters keep the socket path under SUN_LEN for any home dir
+ * (`~/.agents/.codex-homes/a-XXXXXXXXXXXX/.codex` + suffix = 99 bytes on a
+ * `/Users/<user>` prefix); the origin-link check in {@link resolveCodexHome}
+ * is what rules out two accounts sharing a prefix.
+ */
+export declare function codexShortKey(home: string, version: string, historyDir: string): string;
+/**
+ * Resolve a macOS SUN_LEN-safe CODEX_HOME for the given origin home, migrating
+ * the home to a short real path (once, idempotently) when needed. `key` is the
+ * short-home key from {@link codexShortKey} — it uniquely identifies the origin
+ * (the version for a version home, `a-<accountId>` for a slot), so
+ * `.codex-homes/<key>` can only ever be THIS origin's own short home. Two
+ * different origins never map to one key, which is what makes every branch
+ * below safe without guessing whose login a short home holds.
  *
- * On non-darwin platforms, or when the versioned home already fits, the
- * versioned home is returned unchanged. If migration fails for any reason the
- * versioned home is returned (no worse than the pre-fix behavior).
+ * On non-darwin platforms, or when the origin already fits, the origin is
+ * returned unchanged. Otherwise the short home is authoritative for `key`, and
+ * the origin is made a symlink onto it:
+ *  - already linked onto it → return it (healthy, the common path).
+ *  - linked onto a DIFFERENT target (a pre-fix layout where a slot's `.codex`
+ *    was captured into a foreign version short home) → REPOINT to this key's own
+ *    short home and warn; the foreign login is never run. The account may need a
+ *    re-login, which is correct — its login was never isolated.
+ *  - a real directory with the short home ALREADY present → a version/account
+ *    reinstall recreated a fresh `.codex`; adopt the short home (which holds the
+ *    real login), backing the fresh dir aside so freshly-synced resources are
+ *    not lost. This is the case the earlier refuse-and-throw broke
+ *    (`agents remove codex@x && agents add codex@x` then `agents run`).
+ *  - a real directory with no short home yet → first migration: rename it into
+ *    the short home and leave a symlink.
+ *  - absent → create/adopt the short home and link the origin to it.
+ * If any filesystem step fails the origin is returned (no worse than the pre-fix
+ * behavior).
  */
-export declare function resolveCodexHome(versionedHome: string, agentsUserDir: string, version: string, platform?: NodeJS.Platform): string;
+export declare function resolveCodexHome(originHome: string, agentsUserDir: string, key: string, platform?: NodeJS.Platform): string;
 /**
  * Emit the bash block that a generated codex shim uses to export a
- * SUN_LEN-safe CODEX_HOME. Mirrors {@link resolveCodexHome}.
+ * SUN_LEN-safe CODEX_HOME. Mirrors {@link resolveCodexHome} for the one origin
+ * a shim ever sees, the version home: an account-slot launch reaches the shim
+ * with CODEX_HOME already pinned by `buildExecEnv`, and the block below keeps a
+ * caller-provided CODEX_HOME, so the slot key never has to be derived in bash.
  *
  * @param homeExpr      shell expression for the versioned codex home
  *                      (e.g. `$VERSION_DIR/home/.codex`)

package/dist/lib/codex-home.js

@@ -25,6 +25,14 @@
  * the TS resolver for `agents run`/`agents exec`; `shims.ts` emits the bash
  * equivalent (`codexHomeShimBash`) into the generated codex shims. Keep the two
  * in lockstep.
+ *
+ * The short home is keyed by the ORIGIN it relocates, never by the version
+ * alone. An account slot (`~/.agents/.history/accounts/codex/<id>/.codex`) is
+ * long enough to overflow too, and keying it by version handed every
+ * `agents run codex#<account>` on macOS the default version's short home —
+ * whichever login that happened to hold. `codexShortKey` derives the key; a
+ * short home that is not the resolved link target of its origin is refused
+ * rather than reused.
  */
 import * as fs from 'fs';
 import * as path from 'path';
@@ -40,59 +48,137 @@ export function codexHomeOverflowsSunLen(home) {
     return home.length + CODEX_CONTROL_SOCKET_SUFFIX.length > SUN_LEN;
 }
 /**
- * The short, per-version codex home used when the versioned home overflows.
- * `~/.agents/.codex-homes/<version>/.codex` keeps the socket path well under
- * SUN_LEN while staying stable across reboots (unlike $TMPDIR) and per-version
- * isolated.
+ * The short codex home used when an origin home overflows.
+ * `~/.agents/.codex-homes/<key>/.codex` keeps the socket path well under
+ * SUN_LEN while staying stable across reboots (unlike $TMPDIR) and isolated
+ * per origin.
  */
-export function shortCodexHome(agentsUserDir, version) {
-    return path.join(agentsUserDir, '.codex-homes', version, '.codex');
+export function shortCodexHome(agentsUserDir, key) {
+    return path.join(agentsUserDir, '.codex-homes', key, '.codex');
+}
+/**
+ * The short-home key for a codex config home: the version for a version home,
+ * `a-<accountId prefix>` for an account slot under `<historyDir>/accounts/codex/`.
+ * Twelve hex characters keep the socket path under SUN_LEN for any home dir
+ * (`~/.agents/.codex-homes/a-XXXXXXXXXXXX/.codex` + suffix = 99 bytes on a
+ * `/Users/<user>` prefix); the origin-link check in {@link resolveCodexHome}
+ * is what rules out two accounts sharing a prefix.
+ */
+export function codexShortKey(home, version, historyDir) {
+    const slotsRoot = path.resolve(historyDir, 'accounts', 'codex');
+    const resolved = path.resolve(home);
+    if (!resolved.startsWith(slotsRoot + path.sep))
+        return version;
+    const accountId = resolved.slice(slotsRoot.length + 1).split(path.sep)[0] ?? '';
+    if (!accountId)
+        return version;
+    return `a-${accountId.slice(0, 12)}`;
+}
+function realpathOrNull(p) {
+    try {
+        return fs.realpathSync(p);
+    }
+    catch {
+        return null;
+    }
+}
+function isSymlinkOnto(link, target) {
+    try {
+        if (!fs.lstatSync(link).isSymbolicLink())
+            return false;
+        const t = realpathOrNull(target);
+        return t !== null && realpathOrNull(link) === t;
+    }
+    catch {
+        return false;
+    }
 }
 /**
- * Resolve a macOS SUN_LEN-safe CODEX_HOME for the given versioned home,
- * migrating the home to a short real path (once, idempotently) when needed.
+ * Resolve a macOS SUN_LEN-safe CODEX_HOME for the given origin home, migrating
+ * the home to a short real path (once, idempotently) when needed. `key` is the
+ * short-home key from {@link codexShortKey} — it uniquely identifies the origin
+ * (the version for a version home, `a-<accountId>` for a slot), so
+ * `.codex-homes/<key>` can only ever be THIS origin's own short home. Two
+ * different origins never map to one key, which is what makes every branch
+ * below safe without guessing whose login a short home holds.
  *
- * On non-darwin platforms, or when the versioned home already fits, the
- * versioned home is returned unchanged. If migration fails for any reason the
- * versioned home is returned (no worse than the pre-fix behavior).
+ * On non-darwin platforms, or when the origin already fits, the origin is
+ * returned unchanged. Otherwise the short home is authoritative for `key`, and
+ * the origin is made a symlink onto it:
+ *  - already linked onto it → return it (healthy, the common path).
+ *  - linked onto a DIFFERENT target (a pre-fix layout where a slot's `.codex`
+ *    was captured into a foreign version short home) → REPOINT to this key's own
+ *    short home and warn; the foreign login is never run. The account may need a
+ *    re-login, which is correct — its login was never isolated.
+ *  - a real directory with the short home ALREADY present → a version/account
+ *    reinstall recreated a fresh `.codex`; adopt the short home (which holds the
+ *    real login), backing the fresh dir aside so freshly-synced resources are
+ *    not lost. This is the case the earlier refuse-and-throw broke
+ *    (`agents remove codex@x && agents add codex@x` then `agents run`).
+ *  - a real directory with no short home yet → first migration: rename it into
+ *    the short home and leave a symlink.
+ *  - absent → create/adopt the short home and link the origin to it.
+ * If any filesystem step fails the origin is returned (no worse than the pre-fix
+ * behavior).
  */
-export function resolveCodexHome(versionedHome, agentsUserDir, version, platform = process.platform) {
+export function resolveCodexHome(originHome, agentsUserDir, key, platform = process.platform) {
     if (platform !== 'darwin')
-        return versionedHome;
-    if (!codexHomeOverflowsSunLen(versionedHome))
-        return versionedHome;
-    const short = shortCodexHome(agentsUserDir, version);
+        return originHome;
+    if (!codexHomeOverflowsSunLen(originHome))
+        return originHome;
+    const short = shortCodexHome(agentsUserDir, key);
+    if (isSymlinkOnto(originHome, short))
+        return short;
+    const origin = fs.lstatSync(originHome, { throwIfNoEntry: false });
     try {
-        if (!fs.existsSync(short)) {
-            fs.mkdirSync(path.dirname(short), { recursive: true });
-            const st = fs.lstatSync(versionedHome, { throwIfNoEntry: false });
-            if (st && st.isDirectory() && !st.isSymbolicLink()) {
-                // Migrate the existing deep home so config/auth/state stay intact,
-                // then leave a symlink so anything referencing the versioned path
-                // still resolves.
-                fs.renameSync(versionedHome, short);
-                fs.symlinkSync(short, versionedHome);
-            }
-            else if (!st) {
-                // Fresh install: create the short home and link the versioned path to it.
+        fs.mkdirSync(path.dirname(short), { recursive: true });
+        if (origin?.isSymbolicLink()) {
+            // Mis-linked onto a foreign target (pre-fix bug): never run that identity.
+            // Repoint onto this key's own short home, creating it if absent.
+            process.stderr.write(`[codex] ${originHome} was linked to a foreign home; repointing to ${short} `
+                + `(this account may need to log in again).\n`);
+            if (!fs.existsSync(short))
                 fs.mkdirSync(short, { recursive: true });
-                fs.symlinkSync(short, versionedHome);
+            fs.rmSync(originHome); // removes the symlink only, never its target
+            fs.symlinkSync(short, originHome);
+        }
+        else if (origin?.isDirectory()) {
+            if (fs.existsSync(short)) {
+                // Reinstall: the fresh real `.codex` has re-derivable resources but no
+                // login; the short home holds the real login. Adopt the short home and
+                // set the fresh dir aside (non-destructive) rather than lose either.
+                const superseded = `${originHome}.superseded-${Date.now()}`;
+                fs.renameSync(originHome, superseded);
+                fs.symlinkSync(short, originHome);
             }
-            // If versionedHome is already a symlink (migrated by a prior run or the
-            // shim), leave it; `short` will be populated below.
+            else {
+                // First migration: relocate the deep home so config/auth/state stay
+                // intact, then leave a symlink behind so anything referencing the origin
+                // path still resolves (session discovery, the slot record, the shim).
+                fs.renameSync(originHome, short);
+                fs.symlinkSync(short, originHome);
+            }
+        }
+        else {
+            // Fresh origin: create (or adopt) the short home and link the origin to it.
+            fs.mkdirSync(short, { recursive: true });
+            fs.mkdirSync(path.dirname(originHome), { recursive: true });
+            fs.symlinkSync(short, originHome);
         }
     }
     catch {
-        // Migration lost a race or hit a permission error. Fall back to the
-        // versioned home rather than crash the invocation.
-        if (!fs.existsSync(short))
-            return versionedHome;
+        // A filesystem step lost a race or hit a permission error. Fall back to the
+        // origin rather than crash the invocation.
+        return originHome;
     }
-    return fs.existsSync(short) ? short : versionedHome;
+    return isSymlinkOnto(originHome, short) ? short : originHome;
 }
 /**
  * Emit the bash block that a generated codex shim uses to export a
- * SUN_LEN-safe CODEX_HOME. Mirrors {@link resolveCodexHome}.
+ * SUN_LEN-safe CODEX_HOME. Mirrors {@link resolveCodexHome} for the one origin
+ * a shim ever sees, the version home: an account-slot launch reaches the shim
+ * with CODEX_HOME already pinned by `buildExecEnv`, and the block below keeps a
+ * caller-provided CODEX_HOME, so the slot key never has to be derived in bash.
  *
  * @param homeExpr      shell expression for the versioned codex home
  *                      (e.g. `$VERSION_DIR/home/.codex`)

package/dist/lib/harness/adapters/codex.js

@@ -1,7 +1,7 @@
 import * as os from 'os';
 import * as path from 'path';
 import { getHistoryDir } from '../../state.js';
-import { resolveCodexHome, codexHomeShimBash } from '../../codex-home.js';
+import { codexHomeShimBash, codexShortKey, resolveCodexHome } from '../../codex-home.js';
 import { codexEditWritableRoots, codexPolicyArgs } from '../../codex-policy.js';
 import { stripForeignConfigDir } from '../adapter.js';
 /**
@@ -20,9 +20,12 @@ export const codexAdapter = {
             // On macOS the deep versioned home overflows the Unix-socket SUN_LEN
             // limit for codex's app-server control socket; resolve to a short,
             // SUN_LEN-safe home (migrating once if needed). See codex-home.ts.
-            const versionedHome = path.join(ctx.versionHome, '.codex');
-            const agentsUserDir = path.dirname(getHistoryDir());
-            result.CODEX_HOME = resolveCodexHome(versionedHome, agentsUserDir, ctx.version);
+            // ctx.versionHome is the account slot on a `codex#<account>` launch, so
+            // the short home is keyed by that origin, never by the version alone.
+            const originHome = path.join(ctx.versionHome, '.codex');
+            const historyDir = getHistoryDir();
+            const agentsUserDir = path.dirname(historyDir);
+            result.CODEX_HOME = resolveCodexHome(originHome, agentsUserDir, codexShortKey(originHome, ctx.version, historyDir));
         }
         stripForeignConfigDir(result, ['CODEX_HOME']);
     },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@phnx-labs/agents-cli",
-  "version": "1.22.96",
+  "version": "1.22.98",
   "description": "One CLI for all your AI coding agents - versions, config, cloud dispatch, sessions, and teams (now with first-class Grok Build CLI support)",
   "type": "module",
   "main": "dist/index.js",