@xenosystem/agent-cli 0.5.17 → 0.5.19

package/LICENSE

@@ -1,15 +1,15 @@
-Copyright (c) 2026 XENO Corporation
-All rights reserved.
-
-This software and the accompanying documentation are proprietary and
-confidential. No license or other right is granted to use, copy, modify,
-merge, publish, distribute, sublicense, sell, reverse engineer, create
-derivative works from, or otherwise exploit this software or any portion of it
-without prior written permission from XENO Corporation.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, OR TITLE. IN NO EVENT
-SHALL XENO CORPORATION OR ITS LICENSORS BE LIABLE FOR ANY CLAIM, DAMAGES, OR
-OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT, OR OTHERWISE, ARISING
-FROM, OUT OF, OR IN CONNECTION WITH THE SOFTWARE OR THE USE OF THE SOFTWARE.
+Copyright (c) 2026 XENO Corporation
+All rights reserved.
+
+This software and the accompanying documentation are proprietary and
+confidential. No license or other right is granted to use, copy, modify,
+merge, publish, distribute, sublicense, sell, reverse engineer, create
+derivative works from, or otherwise exploit this software or any portion of it
+without prior written permission from XENO Corporation.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, OR TITLE. IN NO EVENT
+SHALL XENO CORPORATION OR ITS LICENSORS BE LIABLE FOR ANY CLAIM, DAMAGES, OR
+OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT, OR OTHERWISE, ARISING
+FROM, OUT OF, OR IN CONNECTION WITH THE SOFTWARE OR THE USE OF THE SOFTWARE.

package/README.md

@@ -1,157 +1,88 @@
-# XENO Agent CLI
-
-Production terminal AI agent CLI from XENO Corporation.
-
-> **EXPERIMENTAL BUILD — not code-signed.** This release is published unsigned
-> pending code-signing certificates. Windows SmartScreen will warn on the
-> standalone installers, and the native interactive terminal is **opt-in** (see
-> below). Everything else — agent runs, tools, pipe-mode command execution — is
-> unaffected.
-
-## Platform support — interactive terminal
-
-The CLI itself runs anywhere Node.js >= 20 runs. The **interactive terminal**
-(the native `xeno_pty` module that gives shell commands a real TTY) is a
-per-platform native artifact, and its coverage is *not* uniform:
-
-| Platform       | Native terminal | How this build was produced                                   |
-| -------------- | --------------- | ------------------------------------------------------------- |
-| `linux-x64`    | Yes             | Built for this release (Debian 12, g++ 12.2; glibc floor 2.34) |
-| `linux-arm64`  | Yes             | Built for this release (Debian 12, g++ 12.2; glibc floor 2.34) |
-| `win32-x64`    | Yes<sup>1</sup> | Built for this release (MSVC 19.44, ConPTY)                    |
-| `darwin-arm64` | Yes<sup>2</sup> | Carried forward from 0.4.45 (Apple clang 17) — see note 2      |
-| `darwin-x64`   | Yes<sup>2</sup> | Carried forward from 0.4.45 (Apple clang 17) — see note 2      |
-| `win32-arm64`  | **No**          | **Not shipped in this release** — see note 3                   |
-
-<sup>1</sup> On `win32-x64` the terminal supports TTY startup, Unicode I/O,
-resize, and process-tree termination. **Ctrl+C delivered through the terminal
-input channel does not raise SIGINT in the child process** — a known ConPTY
-defect, tracked and reproducible. Use `/processes` to stop a task.
-
-<sup>2</sup> The macOS artifacts are **not rebuilt for 0.5.17**. They are the
-artifacts published in 0.4.45, carried forward because the native source
-(`xeno_pty_posix.cpp`) is byte-identical: the manifests record
-`sourceSha256 = 6ba69e62…`, which is exactly this release's source. They were
-compiled by the last macOS CI run (Apple clang 17) and are verified here as
-correct 64-bit Mach-O bundles for their CPU type, with their recorded hashes
-intact. They could **not** be re-executed during release preparation because
-building or running macOS binaries requires Apple hardware, which this release
-did not have. Treat macOS as source-verified, not run-verified, for 0.5.17.
-
-<sup>3</sup> `win32-arm64` ships **no** native terminal in this release. The
-Windows-on-ARM cross-compiler (`MSVC v143 ARM64 build tools`) was not available
-on the release machine, and the previously published `win32-arm64` artifact was
-built from a *different* source revision, so it was not carried forward. On
-`win32-arm64` the CLI runs normally, and shell commands run in **pipe mode**.
-
-### What "no interactive terminal" actually means
-
-Commands still run. They run through pipes instead of a TTY: no interactive
-prompts (`sudo`, `ssh`, `vim`, REPLs), no terminal size reporting, no Ctrl+C
-signal delivery. The CLI **says so explicitly** — it prints a notice on first
-use, `xeno --version` reports the status on its second line, and `xeno doctor`
-gives the cause and the fix. It never degrades silently.
-
-### The unsigned-artifact gate
-
-Native artifacts in this release are `unsigned-development`, and the package
-ships an empty trust store. On a normal install the loader therefore refuses to
-load them, and the interactive terminal is **off by default on every platform,
-including the ones with a build above.** This is deliberate: an unsigned native
-module is a supply-chain risk the CLI will not take on your behalf.
-
-To opt in on a platform that has a build:
-
-```bash
-XENO_ALLOW_UNSIGNED_NATIVE=1 xeno chat
-```
-
-Related switches: `XENO_DISABLE_PTY=1` turns the terminal off outright,
-`XENO_REQUIRE_SIGNED_NATIVE=1` refuses unsigned artifacts even in a source
-checkout, and `XENO_QUIET_PTY_WARNING=1` silences the unavailability notice.
-Once code signing is in place, signed manifests will load without any opt-in.
-
-## Runtime Ownership
-
-The current ownership level is release-audited and may be lower than the terminal P2 program target. Node is an external host through P2, self-contained release assets embed Node.js or Bun, and the TypeScript/npm development toolchain remains third-party infrastructure. Runtime and toolchain replacement are not roadmap items. The package must not be described as fully proprietary, entirely Xeno-owned, free of third-party runtime code, or built by an owned toolchain. The packaged policy and engineering clean-room controls are in `ownership/`.
-
-Execution security uses the exact levels `policy-only`, `process-hardened`, and `contained`. Windows process hardening is trusted-workspace defense in depth and does not isolate filesystem reads or network access. Unavailable contained or untrusted execution fails closed. The SDK/CLI ship reviewed, digest-pinned MXC 0.7.0 native assets without the Microsoft JavaScript wrapper or its runtime transitives. Standalone candidates embed only their target-native adapter and require an executable-bound signed sidecar before they can report certified containment. Certified archives also carry the corresponding third-party notices and participate in one source-bound five-target candidate set. See [CLI Execution Security](../../docs/SECURITY_BOUNDARIES.md).
-
-## Install
-
-```bash
-curl -fsSL https://unpkg.com/@xenosystem/agent-cli@latest/scripts/install.sh | sh
-```
-
-PowerShell:
-
-```powershell
-irm https://unpkg.com/@xenosystem/agent-cli@latest/scripts/install.ps1 | iex
-```
-
-Or install directly:
-
-```bash
-npm install -g @xenosystem/agent-cli
-```
-
-## Use
-
-Keybindings are versioned, user-owned, conflict-validated, and shared across the TUI and attached terminals. Run `xeno keybindings list`, `xeno keybindings validate`, or `/keybindings`; the full contract is documented in [../../docs/KEYBINDINGS.md](../../docs/KEYBINDINGS.md).
-
-The runtime inspector explains everything the CLI will load and permit without activating extensions or exposing credentials. Run `xeno environment`, `xeno environment --safe-mode`, `xeno environment --json`, or `/environment`; see [../../docs/RUNTIME_ENVIRONMENT_INSPECTOR.md](../../docs/RUNTIME_ENVIRONMENT_INSPECTOR.md).
-
-```bash
-xeno chat
-xeno run "summarize this repo"
-xeno app-server --http
-xeno remote validate --json
-xeno specs init my-feature --title "My feature"
-xeno review --production --staged
-xeno index build
-xeno control-room watch
-xeno share list
-xeno providers catalog
-xeno hosted environment list
-xeno hosted trigger list
-xeno hosted events workspace:<workspace-id>
-xeno hosted run message <run-id> "Continue after verification"
-xeno hosted run controls <run-id>
-xeno hosted run artifacts <run-id>
-xeno hosted handoff pull <run-id> --out .xeno/handoffs/hosted-to-cli.json
-xeno oracle "Should this change ship?" --primary primary --critics critic-a,critic-b
-xeno librarian "Where is auth enforced?" --repo owner/project --connection research
-xeno forge issues --repo owner/project
-xeno recipes run release-check --dry-run
-xeno plugin suggest --marketplace
-```
-
-Assistant is the default runtime profile. Use `xeno --agent swe`,
-`xeno run --agent reviewer "<task>"`, `xeno agents profiles`, or
-`xeno agents profile devops` to select or inspect an enforceable specialist
-profile. See [Agent Profiles](../../docs/AGENT_PROFILES.md).
-
-Durable specs store requirements, design, task dependencies, risks, acceptance criteria, approvals, execution evidence, and drift reports under the shared Artifact Protocol. Production review runs independent specialist and verifier calls and persists a typed review report; model confidence without reproduction remains explicitly unverified. See [Spec Workflows](../../docs/SPEC_WORKFLOWS.md) and [Production Review](../../docs/PRODUCTION_REVIEW.md).
-
-Persistent repository intelligence combines bounded source chunks, symbols, imports, lexical search, optional exact-model semantic vectors, Git provenance, tests, documentation links, and freshness evidence while leaving current direct reads authoritative. The Agent Control Room projects durable agents, tasks, approvals, artifacts, monitors, goals, notifications, usage, and public activity into a hash-bound terminal supervisor. See [Repository Intelligence](../../docs/REPOSITORY_INTELLIGENCE.md) and [Agent Control Room](../../docs/AGENT_CONTROL_ROOM.md).
-
-Secure shares are signed, redacted, expiring, capability-bound, and read-only. Session handoffs request authority but cannot grant it, while provider connections store only credential reference names and use capability-driven routing. See [Secure Sharing and Session Handoff](../../docs/SECURE_SHARING_HANDOFF.md) and [Provider Onboarding](../../docs/PROVIDER_ONBOARDING.md).
-
-Hosted environments bind an exact manifest checksum and OCI digest; triggers are idempotent and event replay is hash-chain verified. Protocol-v2 adapters add durable redacted messages, exact-scope approval/rejection, acknowledgement history, Artifact Protocol evidence, and typed Git/PR results. `xeno hosted handoff push` continues local work remotely, and `xeno hosted handoff pull` verifies the connected service issuer before saving a private return document. Hosted execution fails closed unless the backend has a candidate-certified adapter. See [Hosted Fleet and Cross-Device Handoff](../../docs/HOSTED_FLEET.md).
-
-Oracle, Librarian, Forge browsing, Recipes, automatic Git mutation checkpoints,
-clipboard-image paste, OS-owned voice dictation, plugin signing/locking, and
-repository-aware plugin suggestions are documented in
-[Advanced Agent Surfaces](../../docs/ADVANCED_AGENT_SURFACES.md). These features
-retain their Artifact Protocol, provider, privacy, and release boundaries; none
-of the source-complete hosted adapters imply that a public fleet is deployed.
-
-Interactive prompts soft-wrap and grow to six terminal rows while preserving the exact submitted text. `Up` and `Down` navigate wrapped rows before prompt history, and the file-panel assistant shares the same grapheme-safe cursor and editing behavior. The temporary `XENO_INPUT_SOFT_WRAP=0` process setting restores the single-row horizontal viewport for rollback.
-
-Markdown source labels are clickable in supported interactive terminals and keep their full visible URL in redirected output or when `XENO_DISABLE_TERMINAL_LINKS=1` is set.
-
-Background child sessions notify their parent automatically when they complete, fail, stop, or need input. Headless runs use the same bounded queue; `XENO_AGENT_NOTIFICATIONS=0` disables automatic delivery without deleting queued records.
-
-Foreground model-authored Bash commands are managed operations: Ctrl+B promotes the same process, the footer shows live operation activity, bounded TaskOutput waits do not consume model turns, and awaited completion resumes once from a durable checkpoint. Use `/processes` to inspect, attach, stop, or explicitly detach tasks.
-
-Docs: https://xenostudio.ai
+# XENO Agent CLI
+
+Production terminal AI agent CLI from XENO Corporation.
+
+## Runtime Ownership
+
+The current ownership level is release-audited and may be lower than the terminal P2 program target. Node is an external host through P2, self-contained release assets embed Node.js or Bun, and the TypeScript/npm development toolchain remains third-party infrastructure. Runtime and toolchain replacement are not roadmap items. The package must not be described as fully proprietary, entirely Xeno-owned, free of third-party runtime code, or built by an owned toolchain. The packaged policy and engineering clean-room controls are in `ownership/`.
+
+Execution security uses the exact levels `policy-only`, `process-hardened`, and `contained`. Windows process hardening is trusted-workspace defense in depth and does not isolate filesystem reads or network access. Unavailable contained or untrusted execution fails closed. The SDK/CLI ship reviewed, digest-pinned MXC 0.7.0 native assets without the Microsoft JavaScript wrapper or its runtime transitives. Standalone candidates embed only their target-native adapter and require an executable-bound signed sidecar before they can report certified containment. Certified archives also carry the corresponding third-party notices and participate in one source-bound five-target candidate set. See [CLI Execution Security](../../docs/SECURITY_BOUNDARIES.md).
+
+## Install
+
+```bash
+curl -fsSL https://unpkg.com/@xenosystem/agent-cli@latest/scripts/install.sh | sh
+```
+
+PowerShell:
+
+```powershell
+irm https://unpkg.com/@xenosystem/agent-cli@latest/scripts/install.ps1 | iex
+```
+
+Or install directly:
+
+```bash
+npm install -g @xenosystem/agent-cli
+```
+
+## Use
+
+Keybindings are versioned, user-owned, conflict-validated, and shared across the TUI and attached terminals. Run `xeno keybindings list`, `xeno keybindings validate`, or `/keybindings`; the full contract is documented in [../../docs/KEYBINDINGS.md](../../docs/KEYBINDINGS.md).
+
+The runtime inspector explains everything the CLI will load and permit without activating extensions or exposing credentials. Run `xeno environment`, `xeno environment --safe-mode`, `xeno environment --json`, or `/environment`; see [../../docs/RUNTIME_ENVIRONMENT_INSPECTOR.md](../../docs/RUNTIME_ENVIRONMENT_INSPECTOR.md).
+
+```bash
+xeno chat
+xeno run "summarize this repo"
+xeno app-server --http
+xeno remote validate --json
+xeno specs init my-feature --title "My feature"
+xeno review --production --staged
+xeno index build
+xeno control-room watch
+xeno share list
+xeno providers catalog
+xeno hosted environment list
+xeno hosted trigger list
+xeno hosted events workspace:<workspace-id>
+xeno hosted run message <run-id> "Continue after verification"
+xeno hosted run controls <run-id>
+xeno hosted run artifacts <run-id>
+xeno hosted handoff pull <run-id> --out .xeno/handoffs/hosted-to-cli.json
+xeno oracle "Should this change ship?" --primary primary --critics critic-a,critic-b
+xeno librarian "Where is auth enforced?" --repo owner/project --connection research
+xeno forge issues --repo owner/project
+xeno recipes run release-check --dry-run
+xeno plugin suggest --marketplace
+```
+
+Assistant is the default runtime profile. Use `xeno --agent swe`,
+`xeno run --agent reviewer "<task>"`, `xeno agents profiles`, or
+`xeno agents profile devops` to select or inspect an enforceable specialist
+profile. See [Agent Profiles](../../docs/AGENT_PROFILES.md).
+
+Durable specs store requirements, design, task dependencies, risks, acceptance criteria, approvals, execution evidence, and drift reports under the shared Artifact Protocol. Production review runs independent specialist and verifier calls and persists a typed review report; model confidence without reproduction remains explicitly unverified. See [Spec Workflows](../../docs/SPEC_WORKFLOWS.md) and [Production Review](../../docs/PRODUCTION_REVIEW.md).
+
+Persistent repository intelligence combines bounded source chunks, symbols, imports, lexical search, optional exact-model semantic vectors, Git provenance, tests, documentation links, and freshness evidence while leaving current direct reads authoritative. The Agent Control Room projects durable agents, tasks, approvals, artifacts, monitors, goals, notifications, usage, and public activity into a hash-bound terminal supervisor. See [Repository Intelligence](../../docs/REPOSITORY_INTELLIGENCE.md) and [Agent Control Room](../../docs/AGENT_CONTROL_ROOM.md).
+
+Secure shares are signed, redacted, expiring, capability-bound, and read-only. Session handoffs request authority but cannot grant it, while provider connections store only credential reference names and use capability-driven routing. See [Secure Sharing and Session Handoff](../../docs/SECURE_SHARING_HANDOFF.md) and [Provider Onboarding](../../docs/PROVIDER_ONBOARDING.md).
+
+Hosted environments bind an exact manifest checksum and OCI digest; triggers are idempotent and event replay is hash-chain verified. Protocol-v2 adapters add durable redacted messages, exact-scope approval/rejection, acknowledgement history, Artifact Protocol evidence, and typed Git/PR results. `xeno hosted handoff push` continues local work remotely, and `xeno hosted handoff pull` verifies the connected service issuer before saving a private return document. Hosted execution fails closed unless the backend has a candidate-certified adapter. See [Hosted Fleet and Cross-Device Handoff](../../docs/HOSTED_FLEET.md).
+
+Oracle, Librarian, Forge browsing, Recipes, automatic Git mutation checkpoints,
+clipboard-image paste, OS-owned voice dictation, plugin signing/locking, and
+repository-aware plugin suggestions are documented in
+[Advanced Agent Surfaces](../../docs/ADVANCED_AGENT_SURFACES.md). These features
+retain their Artifact Protocol, provider, privacy, and release boundaries; none
+of the source-complete hosted adapters imply that a public fleet is deployed.
+
+Interactive prompts soft-wrap and grow to six terminal rows while preserving the exact submitted text. `Up` and `Down` navigate wrapped rows before prompt history, and the file-panel assistant shares the same grapheme-safe cursor and editing behavior. The temporary `XENO_INPUT_SOFT_WRAP=0` process setting restores the single-row horizontal viewport for rollback.
+
+Markdown source labels are clickable in supported interactive terminals and keep their full visible URL in redirected output or when `XENO_DISABLE_TERMINAL_LINKS=1` is set.
+
+Background child sessions notify their parent automatically when they complete, fail, stop, or need input. Headless runs use the same bounded queue; `XENO_AGENT_NOTIFICATIONS=0` disables automatic delivery without deleting queued records.
+
+Foreground model-authored Bash commands are managed operations: Ctrl+B promotes the same process, the footer shows live operation activity, bounded TaskOutput waits do not consume model turns, and awaited completion resumes once from a durable checkpoint. Use `/processes` to inspect, attach, stop, or explicitly detach tasks.
+
+Docs: https://xenostudio.ai