praxis-agent 0.43.1 → 0.45.0

package/dist/cli/provider-auth-command.js

@@ -0,0 +1,249 @@
+import { ProviderCredentialVault, } from '../persistence/provider-credential-vault.js';
+import { deviceLoginWithCodexOAuth, loginWithCodexOAuth, } from '../providers/codex-oauth.js';
+import { resolveProviderTarget } from '../providers/provider-settings.js';
+import { resolveDataPlaneRoot } from '../persistence/data-plane.js';
+const IDENTIFIER = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u;
+const MAX_SECRET_BYTES = 64 * 1024;
+function fail(message) {
+    throw new Error(message);
+}
+function identifier(value, label) {
+    if (!IDENTIFIER.test(value))
+        fail(`${label} must match [A-Za-z0-9][A-Za-z0-9._-]{0,127}`);
+    return value;
+}
+function parse(args, options) {
+    if (args[0] === 'auth')
+        args = args.slice(1);
+    const action = args[0];
+    if (action !== 'status' &&
+        action !== 'set-key' &&
+        action !== 'login' &&
+        action !== 'logout') {
+        fail('auth requires status, set-key, login, or logout');
+    }
+    let provider;
+    let profile;
+    let json = options.json ?? false;
+    let noBrowser = options.noBrowser ?? false;
+    let device = options.device ?? false;
+    for (let index = 1; index < args.length; index += 1) {
+        const value = args[index];
+        if (value === '--json') {
+            if (json)
+                fail('--json may only be specified once');
+            json = true;
+            continue;
+        }
+        if (value === '--device') {
+            if (device)
+                fail('--device may only be specified once');
+            device = true;
+            continue;
+        }
+        if (value === '--no-browser') {
+            if (noBrowser)
+                fail('--no-browser may only be specified once');
+            noBrowser = true;
+            continue;
+        }
+        if (value === '--profile' || value?.startsWith('--profile=')) {
+            if (profile !== undefined)
+                fail('--profile may only be specified once');
+            const selected = value === '--profile' ? args[++index] : value.slice('--profile='.length);
+            if (typeof selected !== 'string' || selected.length === 0)
+                fail('--profile requires a value');
+            profile = identifier(selected, 'profile');
+            continue;
+        }
+        if (value?.startsWith('-'))
+            fail(`Unknown option: ${value}`);
+        if (typeof value !== 'string')
+            fail(`Unexpected operand for auth ${action}`);
+        if (provider !== undefined)
+            fail(`Unexpected operand for auth ${action}: ${value}`);
+        provider = identifier(value, 'provider');
+    }
+    if (options.profile !== undefined &&
+        profile !== undefined &&
+        options.profile !== profile)
+        fail('auth --profile conflicts with the selected profile');
+    if (options.providerProfile !== undefined &&
+        profile !== undefined &&
+        options.providerProfile !== profile)
+        fail('auth --profile conflicts with --provider-profile');
+    if (options.profile !== undefined &&
+        options.providerProfile !== undefined &&
+        options.profile !== options.providerProfile)
+        fail('auth --profile conflicts with --provider-profile');
+    const selectedProfile = profile ?? options.profile ?? options.providerProfile;
+    profile =
+        action === 'status' && selectedProfile === undefined
+            ? undefined
+            : identifier(selectedProfile ?? 'default', 'profile');
+    if (action === 'status' && provider === undefined) {
+        // status accepts zero or one provider operand.
+    }
+    else if (action !== 'status' && provider === undefined) {
+        fail(`auth ${action} requires a provider`);
+    }
+    if (action === 'set-key' && provider === 'openai-codex')
+        fail('auth set-key does not support openai-codex; use auth login');
+    if (action === 'login' && provider !== 'openai-codex')
+        fail('auth login only supports openai-codex');
+    if (action !== 'login' && (device || noBrowser))
+        fail('--device and --no-browser are only valid with auth login');
+    return {
+        action,
+        ...(provider === undefined ? {} : { provider }),
+        ...(profile === undefined ? {} : { profile }),
+        json,
+        device,
+        noBrowser,
+    };
+}
+function defaultVault(options) {
+    const environment = options.environment ?? process.env;
+    const vaultOptions = {
+        configRoot: options.configRoot ?? resolveDataPlaneRoot({ environment }),
+        environment,
+    };
+    return new ProviderCredentialVault(vaultOptions);
+}
+async function assertCodexLoginEnabled(options, profileId) {
+    const environment = options.environment ?? process.env;
+    await resolveProviderTarget({
+        configRoot: options.configRoot ?? resolveDataPlaneRoot({ environment }),
+        cwd: options.cwd ?? process.cwd(),
+        environment,
+        provider: 'openai-codex',
+        profile: profileId,
+        model: 'codex-authentication',
+    });
+}
+function json(io, value) {
+    io.stdout(`${JSON.stringify(value)}\n`);
+}
+function text(io, message) {
+    io.stdout(`${message}\n`);
+}
+function metadata(value) {
+    return {
+        provider: value.key.providerId,
+        profile: value.key.profileId,
+        type: value.type,
+        updatedAt: value.updatedAt,
+        ...(value.expiresAt === undefined
+            ? {}
+            : { expiry: value.expiresAt > Date.now() ? 'valid' : 'expired' }),
+    };
+}
+function sortedMetadata(records, provider, profile) {
+    return records
+        .filter((record) => (provider === undefined || record.key.providerId === provider) &&
+        (profile === undefined || record.key.profileId === profile))
+        .sort((left, right) => {
+        const providerOrder = left.key.providerId.localeCompare(right.key.providerId);
+        return (providerOrder || left.key.profileId.localeCompare(right.key.profileId));
+    })
+        .map(metadata);
+}
+export function secretLine(value) {
+    if (Buffer.byteLength(value, 'utf8') > MAX_SECRET_BYTES)
+        fail('Credential exceeds the 64 KiB limit');
+    const stripped = value.endsWith('\r\n')
+        ? value.slice(0, -2)
+        : value.endsWith('\r') || value.endsWith('\n')
+            ? value.slice(0, -1)
+            : value;
+    if (/[\r\n]/u.test(stripped) || stripped.trim().length === 0)
+        fail('Credential must be exactly one non-blank line');
+    return stripped;
+}
+export async function executeProviderAuthCommand(args, options) {
+    const parsed = parse(args, options);
+    const vault = options.vault ?? defaultVault(options);
+    if (parsed.action === 'status') {
+        const credentials = sortedMetadata(await vault.list(), parsed.provider, parsed.profile);
+        if (parsed.json) {
+            json(options.io, { type: 'provider-auth-status', credentials });
+        }
+        else if (credentials.length === 0) {
+            text(options.io, 'No provider credentials configured.');
+        }
+        else {
+            text(options.io, credentials
+                .map((credential) => `${credential.provider}/${credential.profile}: ${credential.type}${credential.expiry === undefined ? '' : ` (${credential.expiry})`}`)
+                .join('\n'));
+        }
+        return 0;
+    }
+    const provider = parsed.provider;
+    if (provider === undefined)
+        fail(`auth ${parsed.action} requires a provider`);
+    const key = {
+        providerId: provider,
+        profileId: parsed.profile ?? 'default',
+    };
+    if (parsed.action === 'set-key') {
+        if (!options.io.readSecret)
+            fail('auth set-key requires an interactive secret reader');
+        const secret = secretLine(await options.io.readSecret('API key: ', options.signal));
+        await vault.modify(key, () => ({ type: 'api-key', secret }));
+        const result = {
+            provider: key.providerId,
+            profile: key.profileId,
+            type: 'api-key',
+        };
+        if (parsed.json)
+            json(options.io, result);
+        else
+            text(options.io, `Stored api-key credential for ${key.providerId}/${key.profileId}.`);
+        return 0;
+    }
+    if (parsed.action === 'logout') {
+        const existing = await vault.read(key);
+        if (existing !== undefined)
+            await vault.delete(key);
+        const result = {
+            provider: key.providerId,
+            profile: key.profileId,
+            deleted: true,
+        };
+        if (parsed.json)
+            json(options.io, result);
+        else
+            text(options.io, `Logged out ${key.providerId}/${key.profileId}.`);
+        return 0;
+    }
+    await (options.assertCodexLoginEnabled ??
+        ((profileId) => assertCodexLoginEnabled(options, profileId)))(key.profileId);
+    const loginOptions = {
+        profileId: key.profileId,
+        vault: createCodexOAuthVault(vault),
+        ...(options.signal === undefined ? {} : { signal: options.signal }),
+        ...(parsed.noBrowser ? { noBrowser: true } : {}),
+        write: (message) => options.io.stderr?.(message),
+    };
+    const login = parsed.device
+        ? (options.deviceLoginWithCodexOAuth ?? deviceLoginWithCodexOAuth)
+        : (options.loginWithCodexOAuth ?? loginWithCodexOAuth);
+    await login(loginOptions);
+    const result = {
+        provider: key.providerId,
+        profile: key.profileId,
+        type: 'oauth',
+    };
+    if (parsed.json)
+        json(options.io, result);
+    else
+        text(options.io, `Logged in ${key.providerId}/${key.profileId}.`);
+    return 0;
+}
+function createCodexOAuthVault(vault) {
+    return {
+        read: (key) => vault.read(key),
+        modify: (key, callback) => vault.modify(key, async (current) => callback(current)),
+    };
+}
+//# sourceMappingURL=provider-auth-command.js.map

package/dist/cli/tui/quiet-frame.js

@@ -272,18 +272,18 @@ export function projectQuietFrame(input) {
                 : cleanActiveTail(body.transcript.active.text, viewportRows === undefined ? 200 : Math.max(1, viewportRows - 2));
             const activeText = activeTail.lines;
             if (activeText.some(({ text }) => Boolean(text)))
-                activeText.forEach(({ text: part, start }, index) => lines.push(createQuietFrameRow(`quiet:active:text:${start}`, `${index === 0 ? 'praxis> ' : '        '}${index === 0 && activeTail.hidden ? '… ' : ''}${part}`, 'active', 'body', `${index === 0 ? 'Praxis: ' : ''}${part}`)));
+                activeText.forEach(({ text: part, start }, index) => lines.push(createQuietFrameRow(`quiet:active:text:${start}`, `${index === 0 ? '⏺ ' : '        '}${index === 0 && activeTail.hidden ? '… ' : ''}${part}`, 'active', 'body', `${index === 0 ? 'Praxis: ' : ''}${part}`)));
             const thinking = screenReader
                 ? cleanActiveTail(body.transcript.active.thinking, Number.POSITIVE_INFINITY)
                 : cleanActiveTail(body.transcript.active.thinking, viewportRows === undefined ? 200 : Math.max(1, viewportRows - 2));
             if (thinking.lines.some(({ text }) => Boolean(text)))
-                thinking.lines.forEach(({ text: part, start }, index) => lines.push(createQuietFrameRow(`quiet:active:thinking:${start}`, `${index === 0 ? '… ' : '  '}${part}`, 'active', 'muted', `${index === 0 ? 'Thinking: ' : ''}${part}`)));
+                thinking.lines.forEach(({ text: part, start }, index) => lines.push(createQuietFrameRow(`quiet:active:thinking:${start}`, `${index === 0 ? '✻ ' : '  '}${part}`, 'active', 'muted', `${index === 0 ? 'Thinking: ' : ''}${part}`)));
         }
     }
     const focus = input.focusRows.length > 0
         ? input.focusRows.map((item) => withRegion(item, 'focus'))
         : [
-            createQuietFrameRow('quiet:composer', `${input.shellMode ? 'shell>' : 'you>'} ${clean(input.composerText)}`, 'composer', 'input', `${input.shellMode ? 'Shell' : 'Composer'} input field`),
+            createQuietFrameRow('quiet:composer', `${input.shellMode ? '! ' : '❯ '}${clean(input.composerText)}`, 'composer', 'input', `${input.shellMode ? 'Shell' : 'Composer'} input field`),
         ];
     lines.push(...focus);
     const statusText = `${input.busy ? 'Working · ' : ''}${clean(input.status) || (input.busy ? 'In progress' : 'Ready')}`;
@@ -302,7 +302,7 @@ export function projectQuietFrame(input) {
         const compact = [...retained, ...focusRows, status];
         lines.splice(0, lines.length, ...compact);
     }
-    const composerPrefix = `${input.shellMode ? 'shell>' : 'you>'} `;
+    const composerPrefix = input.shellMode ? '! ' : '❯ ';
     if (!screenReader) {
         for (let index = 0; index < lines.length; index += 1) {
             const row = lines[index];

package/dist/cli/tui/transcript-viewport.js

@@ -497,7 +497,7 @@ function estimateRenderedTranscriptEntryLines(entry, width, mode) {
         if (item.kind === 'user')
             return (1 +
                 (mode === 'screen-reader' ? 1 : 0) +
-                wrappedLineCount(`${mode === 'screen-reader' ? 'You: ' : 'you> '}${item.text}`, width));
+                wrappedLineCount(`${mode === 'screen-reader' ? 'You: ' : '❯ '}${item.text}`, width));
         if (item.kind === 'assistant')
             return (1 +
                 (mode === 'screen-reader' ? 1 : 0) +
@@ -667,7 +667,7 @@ function entryViewportRows(entry, width, mode) {
             return [
                 '',
                 ...(mode === 'screen-reader' ? [''] : []),
-                ...textVisualRows(`${mode === 'screen-reader' ? 'You: ' : 'you> '}${item.text}`, width),
+                ...textVisualRows(`${mode === 'screen-reader' ? 'You: ' : '❯ '}${item.text}`, width),
             ];
         if (item.kind === 'assistant')
             return [
@@ -818,7 +818,7 @@ function assistantMarkdownProjectionRows(text, width, mode) {
         fenceAfter: false,
         fenceLabel: 'code',
     };
-    const prefixed = textVisualRows(`praxis> ${first.text.trimEnd()}`, width).map((rowText) => ({ ...first, text: rowText }));
+    const prefixed = textVisualRows(`⏺ ${first.text.trimEnd()}`, width).map((rowText) => ({ ...first, text: rowText }));
     return [...prefixed, ...rows.slice(1)];
 }
 export function createTranscriptEntryViewportIndex(entry, width, mode) {

package/dist/cli/workspace-trust-prompt.js

@@ -23,10 +23,10 @@ export async function promptWorkspaceTrust(inventory, io = {}) {
     const output = io.output ?? ((text) => process.stderr.write(text));
     if (io.signal?.aborted)
         return false;
-    output(`Workspace executable resources found for ${safeWorkspaceTrustDisplayField(inventory.canonicalPath)}\n`);
+    output(`Workspace-controlled resources/configuration found for ${safeWorkspaceTrustDisplayField(inventory.canonicalPath)}\n`);
     for (const origin of inventory.origins)
         output(`  ${origin.kind} (${origin.scope}) ${safeWorkspaceTrustDisplayField(origin.path)}: ${safeWorkspaceTrustDisplayField(origin.label)}\n`);
-    output('Trust these workspace executables? [y/N] ');
+    output('Trust these workspace-controlled resources/configuration? [y/N] ');
     const input = io.input ?? process.stdin;
     const iterator = input[Symbol.asyncIterator]();
     const abortedResult = Symbol('workspace-trust-prompt-aborted');

package/dist/cli-runtime.d.ts

@@ -11,7 +11,7 @@ import type { TuiSlashCommand } from './cli/tui/slash-commands.js';
 import { type TuiHookConfiguration } from './cli/tui/hook-settings.js';
 import { type PraxisRuntimeSettings } from './cli/tui/runtime-settings.js';
 import { type ClaudePermissionMode } from './permissions/claude-permission-resolver.js';
-import { type WorkspaceTrustInventory } from './security/workspace-trust.js';
+import { type WorkspaceTrustAssessment, type WorkspaceTrustInventory } from './security/workspace-trust.js';
 import { type ClaudeMcpServerStatus, type ClaudeMcpToolInspection } from './mcp/claude-mcp-tools.js';
 import { authenticateMcpServer } from './mcp/claude-mcp-oauth.js';
 import { servePraxisMcpStdio } from './mcp/praxis-mcp-server.js';
@@ -20,6 +20,7 @@ import { type ClaudeInteractiveToolCallbacks } from './tools/claude-interactive-
 import { type TopLevelAgentSummary } from './application/top-level-agent-manager.js';
 import { launchTmuxWorktree } from './platform/tmux-worktree.js';
 import { type CliControls, type CliRuntimeInfo, type CliElicitationRequest, type CliElicitationResult } from './cli/protocol.js';
+import { executeProviderAuthCommand } from './cli/provider-auth-command.js';
 import { type PluginEvalDependencies } from './plugins/claude-plugin-eval.js';
 import { type SelfUpdateResult } from './maintenance/self-update.js';
 export { parseContextEnvironment, parseProviderEnvironment };
@@ -28,6 +29,7 @@ export interface CliIO {
     stderr(message: string): void;
     isTTY?: boolean;
     readStdinLines?: () => AsyncIterable<string | Uint8Array>;
+    readSecret?: (prompt: string, signal?: AbortSignal) => Promise<string>;
 }
 interface SessionCommands {
     teamLeadOperations?: TeamLeadOperations;
@@ -143,6 +145,8 @@ export interface CliDependencies extends InteractiveServiceFactory {
     }): Promise<SessionCommands>;
     createAutoModeCritic?(options: {
         model?: string;
+        provider?: string;
+        providerProfile?: string;
         dataPlane?: DataPlane;
         configRoot?: string;
         statePath?: string;
@@ -170,6 +174,7 @@ export interface CliDependencies extends InteractiveServiceFactory {
     launchTmux?: typeof launchTmuxWorktree;
     mcpAuthenticate?: typeof authenticateMcpServer;
     mcpServe?: typeof servePraxisMcpStdio;
+    executeProviderAuthCommand?: typeof executeProviderAuthCommand;
     selfUpdate?: (options: {
         operation: 'install' | 'update';
         target?: string;
@@ -177,6 +182,20 @@ export interface CliDependencies extends InteractiveServiceFactory {
         signal?: AbortSignal;
     }) => Promise<SelfUpdateResult>;
 }
+interface ConsoleSecretInput extends AsyncIterable<string | Uint8Array> {
+    readonly isTTY?: boolean;
+    readonly isRaw?: boolean;
+    isPaused(): boolean;
+    setRawMode?(enabled: boolean): unknown;
+    pause(): unknown;
+    resume(): unknown;
+    on(event: 'data', listener: (chunk: Buffer | string) => void): unknown;
+    removeListener(event: 'data', listener: (chunk: Buffer | string) => void): unknown;
+}
+interface ConsoleSecretOutput {
+    write(message: string): unknown;
+}
+export declare function readConsoleSecret(prompt: string, signal?: AbortSignal, input?: ConsoleSecretInput, output?: ConsoleSecretOutput): Promise<string>;
 /**
  * Shared runtime model precedence used by every consumer (provider
  * construction, status/doctor output, and the interactive display):
@@ -194,9 +213,23 @@ export declare function resolveInteractiveRuntimeSettingsLocation(dataPlane: Dat
     statePath: string;
 };
 export declare function resolveUnknownCostSidecarPath(dataPlane: DataPlane, configRoot: string): string;
+export declare function resolveInteractiveProviderStartup(options: {
+    controls: CliControls;
+    configRoot: string;
+    statePath: string;
+    cwd: string;
+    environment?: NodeJS.ProcessEnv;
+    approveWorkspaceTrust?: (assessment: WorkspaceTrustAssessment) => boolean | Promise<boolean>;
+}): Promise<{
+    effectiveModel: string | undefined;
+    trustProjectRequestAvailable: boolean;
+}>;
 export declare function createDefaultDependencies(entrypoint?: string): CliDependencies;
 export declare function createBackgroundWorkerRuntime(workerSink: RuntimeEventSink, dispatch: {
     argv: string[];
 }, createService?: CliDependencies['createService']): Promise<Awaited<ReturnType<CliDependencies['createService']>>>;
+export declare function agentDashboardWorkerArgv(invocation: CliControls & {
+    agent: string | undefined;
+}): string[];
 export declare function run(argv: readonly string[], io?: CliIO, dependencies?: CliDependencies, signal?: AbortSignal): Promise<number>;
 //# sourceMappingURL=cli-runtime.d.ts.map