@agentsdock/server 1.0.9 → 1.0.10-beta.4

package/server/codex_response_stream.py

@@ -0,0 +1,229 @@
+"""Keep nonstandard custom Responses errors visible to native Codex.
+
+An owned loopback transport forwards requests unchanged to one immutable endpoint.
+Only untyped SSE error packets are normalized; native Codex owns all retries.
+"""
+from __future__ import annotations
+
+import asyncio
+from contextlib import contextmanager, suppress
+import hmac
+import json
+import secrets
+import socket
+from urllib.parse import quote
+
+import httpx
+import uvicorn
+from fastapi import FastAPI, Request
+from fastapi.responses import Response, StreamingResponse
+
+from codex_app_server import CodexAppServerManager
+from codex_provider import ENV_KEY, PROVIDER_ID, config_args
+
+# Larger frames pass through unchanged, rather than buffering arbitrary output.
+# This is a parser memory bound, not a response or content size limit.
+_ERROR_FRAME_BYTES = 64 * 1024
+_HOP_HEADERS = {'connection', 'keep-alive', 'proxy-authenticate', 'proxy-authorization',
+                'te', 'trailer', 'transfer-encoding', 'upgrade', 'host', 'content-length'}
+
+
+class ErrorFrames:
+    def __init__(self, secret: str):
+        self.secret = secret
+        self.pending = bytearray()
+        self.passthrough = False
+        self.response_id = 'resp_custom_endpoint_error'
+
+    def frame(self, raw: bytes) -> bytes:
+        try:
+            data = b'\n'.join(line[5:].lstrip(b' ') for line in raw.splitlines() if line.startswith(b'data:'))
+            packet = json.loads(data)
+        except (ValueError, UnicodeError):
+            return raw
+        if not isinstance(packet, dict):
+            return raw
+        response = packet.get('response')
+        if isinstance(response, dict) and isinstance(response.get('id'), str):
+            self.response_id = response['id']
+        error = packet.get('error')
+        if packet.get('type') or not error:
+            return raw
+        if isinstance(error, dict):
+            message = error.get('message')
+            if not isinstance(message, str) or not message:
+                return raw
+            code = str(error.get('code') or error.get('type') or 'server_error')
+        elif isinstance(error, str):
+            message, code = error, 'server_error'
+        else:
+            return raw
+        code = {'429': 'rate_limit_exceeded', '401': 'invalid_api_key',
+                '403': 'permission_denied', '400': 'invalid_request_error',
+                '500': 'server_error', '502': 'server_error', '503': 'server_error'}.get(code, code)
+        for value in (self.secret, quote(self.secret, safe='')):
+            if value:
+                message = message.replace(value, '[redacted]')
+        failed = {'type': 'response.failed', 'response': {
+            'id': self.response_id, 'object': 'response', 'created_at': 0,
+            'status': 'failed', 'output': [], 'error': {'code': code, 'message': message}}}
+        return b'event: response.failed\ndata: ' + json.dumps(failed, ensure_ascii=False).encode() + b'\n\n'
+
+    async def stream(self, chunks):
+        # Split at SSE blank lines, including CRLF boundaries across chunks.
+        async for chunk in chunks:
+            self.pending.extend(chunk)
+            while self.pending:
+                lf = self.pending.find(b'\n\n')
+                crlf = self.pending.find(b'\r\n\r\n')
+                endings = [(i, n) for i, n in ((lf, 2), (crlf, 4)) if i >= 0]
+                if endings:
+                    i, n = min(endings)
+                    raw = bytes(self.pending[:i+n]); del self.pending[:i+n]
+                    yield raw if self.passthrough or len(raw) > _ERROR_FRAME_BYTES else self.frame(raw)
+                    self.passthrough = False
+                elif len(self.pending) > _ERROR_FRAME_BYTES:
+                    # Retain only a delimiter tail; do not truncate a large frame.
+                    yield bytes(self.pending[:-3]); del self.pending[:-3]
+                    self.passthrough = True
+                else:
+                    break
+        if self.pending:
+            raw = bytes(self.pending); self.pending.clear()
+            yield raw if self.passthrough else self.frame(raw)
+
+
+class _OwnedConfig(uvicorn.Config):
+    def configure_logging(self):
+        # Do not change the host server's process-wide logging configuration.
+        pass
+
+
+class _OwnedServer(uvicorn.Server):
+    @contextmanager
+    def capture_signals(self):
+        # This transport must never take over its host server's signal handlers.
+        yield
+
+
+class ResponseStreamBridge:
+    def __init__(self, selected: dict):
+        self.upstream = selected['base_url'].rstrip('/')
+        self.key = selected['api_key']
+        self.token = secrets.token_urlsafe(32)
+        self.url = ''
+        self.task = self.server = self.client = self.socket = None
+        app = FastAPI(docs_url=None, redoc_url=None, openapi_url=None)
+        app.add_api_route('/v1/{path:path}', self.forward, methods=['POST', 'GET', 'DELETE'])
+        self.app = app
+
+    async def start(self):
+        if self.task is not None and not self.task.done():
+            return
+        self.client = httpx.AsyncClient(timeout=None, follow_redirects=False, trust_env=False)
+        self.socket = socket.socket()
+        self.socket.bind(('127.0.0.1', 0)); self.socket.listen(128); self.socket.setblocking(False)
+        self.url = f'http://127.0.0.1:{self.socket.getsockname()[1]}/v1'
+        self.server = _OwnedServer(_OwnedConfig(self.app, log_config=None, access_log=False, lifespan='off', log_level='critical'))
+        self.task = asyncio.create_task(self.server.serve(sockets=[self.socket]))
+        try:
+            while not self.server.started:
+                if self.task.done():
+                    await self.task
+                    raise RuntimeError('Custom response transport could not start')
+                await asyncio.sleep(0)
+        except BaseException:
+            await self.close()
+            raise
+
+    async def forward(self, request: Request, path: str):
+        if not hmac.compare_digest(request.headers.get('authorization', ''), 'Bearer ' + self.token):
+            return Response(status_code=401)
+        # The destination is immutable. A request cannot name a different origin.
+        if not (path == 'responses' or path.startswith('responses/')) or '..' in path.split('/'):
+            return Response(status_code=404)
+        headers = {k: v for k, v in request.headers.items() if k.lower() not in _HOP_HEADERS | {'authorization', 'accept-encoding', 'cookie'}}
+        headers.update(authorization='Bearer ' + self.key, **{'accept-encoding': 'identity'})
+        if 'content-length' in request.headers:
+            headers['content-length'] = request.headers['content-length']
+        uploaded = asyncio.Event()
+        async def upload():
+            try:
+                async for chunk in request.stream(): yield chunk
+            finally:
+                uploaded.set()
+        async def disconnected():
+            # Wait for the upload reader to finish before reading disconnects.
+            # No polling, execution deadline, or competing request-body reader.
+            await uploaded.wait()
+            while (await request.receive()).get('type') != 'http.disconnect':
+                pass
+        req = self.client.build_request(request.method, self.upstream + '/' + path,
+            params=request.query_params.multi_items(), headers=headers, content=upload())
+        sending = asyncio.create_task(self.client.send(req, stream=True))
+        disconnect = asyncio.create_task(disconnected())
+        try:
+            done, _ = await asyncio.wait((sending, disconnect), return_when=asyncio.FIRST_COMPLETED)
+            if disconnect in done:
+                if sending.done() and not sending.cancelled() and sending.exception() is None:
+                    await sending.result().aclose()
+                return Response(status_code=499)
+            upstream = sending.result()
+        except httpx.HTTPError:
+            return Response('Custom endpoint connection failed', status_code=502)
+        finally:
+            for task in (sending, disconnect):
+                if not task.done(): task.cancel()
+            await asyncio.gather(sending, disconnect, return_exceptions=True)
+        headers = {k: v for k, v in upstream.headers.items() if k.lower() not in _HOP_HEADERS | {'content-encoding', 'set-cookie'}}
+        async def body():
+            try:
+                chunks = upstream.aiter_bytes()
+                if upstream.status_code == 200 and 'text/event-stream' in upstream.headers.get('content-type', '').lower():
+                    chunks = ErrorFrames(self.key).stream(chunks)
+                async for chunk in chunks:
+                    yield chunk
+            finally:
+                await upstream.aclose()
+        return StreamingResponse(body(), status_code=upstream.status_code, headers=headers)
+
+    async def close(self):
+        if self.server is not None:
+            self.server.should_exit = True
+            # The owning native process has already closed; cancel only this
+            # listener's in-flight transports, including a silent upstream.
+            tasks = tuple(self.server.server_state.tasks)
+            for task in tasks: task.cancel()
+            if tasks: await asyncio.gather(*tasks, return_exceptions=True)
+        if self.task is not None:
+            # Let Uvicorn close its asyncio listeners and remove their readers.
+            # Cancelling serve() skips shutdown and can leave a stale selector
+            # entry when the next provider reuses the same socket descriptor.
+            with suppress(asyncio.CancelledError): await self.task
+        if self.client is not None: await self.client.aclose()
+        if self.socket is not None: self.socket.close()
+        self.task = self.server = self.client = self.socket = None
+
+
+class CustomCodexAppServerManager(CodexAppServerManager):
+    """Native manager with an owned, credential-scoped stream normalizer."""
+    def __init__(self, *args, selected: dict, **kwargs):
+        self.response_bridge = ResponseStreamBridge(selected)
+        prepare = kwargs.pop('before_start', None)
+        environment = kwargs.pop('env_factory')
+        original_args = tuple(kwargs.get('app_server_args', ()))
+        async def before_start():
+            if prepare is not None: await prepare()
+            await self.response_bridge.start()
+            self.client.app_server_args = (*original_args, *config_args({
+                f'model_providers.{PROVIDER_ID}.base_url': self.response_bridge.url}))
+        def env_factory():
+            return {**environment(), ENV_KEY: self.response_bridge.token}
+        kwargs['sensitive_values'] = (*kwargs.get('sensitive_values', ()), self.response_bridge.token)
+        super().__init__(*args, before_start=before_start, env_factory=env_factory, **kwargs)
+
+    async def close(self):
+        try:
+            await super().close()
+        finally:
+            await self.response_bridge.close()

package/server/install.sh

@@ -1839,7 +1839,7 @@ if [[ "$TEAM_HUB_MODE" == "host" && "$TEAM_HUB_OPERATION_PENDING" != "true" \
   fi
 fi
 
-RELEASE_FILES=(activation_transaction.py execution_activation.py execution_legacy_runner.py execution_preparation.py update_preparation.py update_handoff.py update_recovery.py execution_update_status.py execution_uninstall.py execution_recovery.py execution_recovery_status.py execution_http.py execution_durability.py execution_control.py execution_install.py execution_maintenance.py execution_manage.py execution_ownership.py execution_service.py execution_transport.py agent_server.py local_session_ownership.py cursor_history.py workspace_git.py team_hub_host.py secure_peer_runtime.py team_mail_runtime.py team_mail_websocket.py team_mail_grants.py secure_peer_delivery.py agentsdock_jobs.py agentsdock_chats.py chat_mailbox.py agentsdock_emergency.py agentsdock_publish.py agentsdock_mail.py agentsdock_team.py provider_commands.py provider_usage.py claude_sdk_client.py claude_model_catalog.py claude_goals.py claude_background_reconciliation.py codex_app_server.py codex_auth.py codex_provider.py provider_connections.py cursor_api_key.py side_questions.py title_generation.py codex_side_question.py codex_side_chat_progress.py claude_side_question.py cursor_agent_client.py cursor_provider_mcp.py opencode_agent_client.py cursor_process_guard.py claude_history_repair.py claude_history_provenance.py codex_history_repair.py public_chat_shares.py public_chat_transcript.py public_chat_share_routes.py interactive_chat_shares.py interactive_chat_share_routes.py interactive_chat_share_web.py interactive_chat_projection.py interactive_chat_runtime.py interactive_chat_native.py shared_chat_videos.py shared_chat_video_stream.py interactive_chat_controls.py install.sh uninstall.sh instances.sh server_instances.py update_runner.py pyproject.toml uv.lock VERSION release-public-key.pem LICENSE NOTICE)
+RELEASE_FILES=(activation_transaction.py execution_activation.py execution_legacy_runner.py execution_preparation.py update_preparation.py update_handoff.py update_recovery.py execution_update_status.py execution_uninstall.py execution_recovery.py execution_recovery_status.py execution_http.py execution_durability.py execution_control.py execution_install.py execution_maintenance.py execution_manage.py execution_ownership.py execution_service.py execution_transport.py agent_server.py local_session_ownership.py cursor_history.py workspace_git.py team_hub_host.py secure_peer_runtime.py team_mail_runtime.py team_mail_websocket.py team_mail_grants.py secure_peer_delivery.py agentsdock_jobs.py agentsdock_chats.py chat_mailbox.py agentsdock_emergency.py agentsdock_publish.py agentsdock_mail.py agentsdock_team.py provider_commands.py provider_usage.py claude_sdk_client.py claude_model_catalog.py claude_goals.py claude_background_reconciliation.py codex_app_server.py codex_auth.py codex_provider.py codex_response_stream.py provider_connections.py cursor_api_key.py side_questions.py title_generation.py codex_side_question.py codex_side_chat_progress.py claude_side_question.py cursor_agent_client.py cursor_provider_mcp.py opencode_agent_client.py cursor_process_guard.py claude_history_repair.py claude_history_provenance.py codex_history_repair.py public_chat_shares.py public_chat_transcript.py public_chat_share_routes.py interactive_chat_shares.py interactive_chat_share_routes.py interactive_chat_share_web.py interactive_chat_projection.py interactive_chat_runtime.py interactive_chat_native.py shared_chat_videos.py shared_chat_video_stream.py interactive_chat_controls.py install.sh uninstall.sh instances.sh server_instances.py update_runner.py pyproject.toml uv.lock VERSION release-public-key.pem LICENSE NOTICE)
 RELEASE_DIRECTORIES=(agentsdock_team_hub)
 TEAM_HUB_RELEASE_FILES=(
   __init__.py
@@ -3751,7 +3751,7 @@ validate_staged_release_runtime() (
     "$STAGE_DIR/claude_background_reconciliation.py" \
     "$STAGE_DIR/codex_app_server.py" \
     "$STAGE_DIR/codex_auth.py" \
-    "$STAGE_DIR/codex_provider.py" \
+    "$STAGE_DIR/codex_provider.py" "$STAGE_DIR/codex_response_stream.py" \
     "$STAGE_DIR/provider_connections.py" "$STAGE_DIR/cursor_api_key.py" \
     "$STAGE_DIR/side_questions.py" \
     "$STAGE_DIR/workspace_git.py" \
@@ -3781,7 +3781,7 @@ validate_staged_release_runtime() (
     "$STAGE_DIR/update_runner.py"
   "$STAGE_DIR/.venv/bin/python" -m py_compile "$STAGE_DIR/server_instances.py"
   "$STAGE_DIR/.venv/bin/python" -m compileall -q "$STAGE_DIR/agentsdock_team_hub"
-  PYTHONPATH="$STAGE_DIR" "$STAGE_DIR/.venv/bin/python" -c 'import execution_activation, execution_preparation, update_preparation, update_handoff, update_recovery, execution_update_status, execution_uninstall, execution_recovery, execution_recovery_status, execution_http, execution_durability, execution_control, execution_install, execution_maintenance, execution_manage, execution_ownership, execution_service, execution_transport; import workspace_git, claude_model_catalog, server_instances, local_session_ownership, cursor_history; import codex_auth, codex_provider, provider_connections, cursor_api_key, side_questions, title_generation, codex_side_question, codex_side_chat_progress, claude_side_question, agentsdock_team_hub, cursor_agent_client, cursor_provider_mcp, opencode_agent_client, cursor_process_guard, secure_peer_delivery, secure_peer_runtime, team_mail_runtime, team_mail_websocket, team_mail_grants, team_hub_host, agentsdock_mail, agentsdock_team, claude_history_repair, claude_history_provenance, claude_goals, claude_background_reconciliation, codex_history_repair, public_chat_shares, public_chat_transcript, public_chat_share_routes, interactive_chat_shares, interactive_chat_share_routes, interactive_chat_share_web, interactive_chat_projection, interactive_chat_runtime, interactive_chat_native, shared_chat_videos, shared_chat_video_stream, interactive_chat_controls, chat_mailbox, provider_commands, provider_usage; from agentsdock_team_hub import secure_peer, secure_peer_hub' >/dev/null
+  PYTHONPATH="$STAGE_DIR" "$STAGE_DIR/.venv/bin/python" -c 'import execution_activation, execution_preparation, update_preparation, update_handoff, update_recovery, execution_update_status, execution_uninstall, execution_recovery, execution_recovery_status, execution_http, execution_durability, execution_control, execution_install, execution_maintenance, execution_manage, execution_ownership, execution_service, execution_transport; import workspace_git, claude_model_catalog, server_instances, local_session_ownership, cursor_history; import codex_auth, codex_provider, codex_response_stream, provider_connections, cursor_api_key, side_questions, title_generation, codex_side_question, codex_side_chat_progress, claude_side_question, agentsdock_team_hub, cursor_agent_client, cursor_provider_mcp, opencode_agent_client, cursor_process_guard, secure_peer_delivery, secure_peer_runtime, team_mail_runtime, team_mail_websocket, team_mail_grants, team_hub_host, agentsdock_mail, agentsdock_team, claude_history_repair, claude_history_provenance, claude_goals, claude_background_reconciliation, codex_history_repair, public_chat_shares, public_chat_transcript, public_chat_share_routes, interactive_chat_shares, interactive_chat_share_routes, interactive_chat_share_web, interactive_chat_projection, interactive_chat_runtime, interactive_chat_native, shared_chat_videos, shared_chat_video_stream, interactive_chat_controls, chat_mailbox, provider_commands, provider_usage; from agentsdock_team_hub import secure_peer, secure_peer_hub' >/dev/null
 )
 
 abort_unclaimed_team_hub_reactivation() {

package/server/server_instances.py

@@ -17,6 +17,7 @@ import os
 from pathlib import Path
 import plistlib
 import re
+import select
 import shlex
 import shutil
 import socket
@@ -24,7 +25,9 @@ import stat
 import subprocess
 import sys
 import tempfile
+import termios
 import time
+import tty
 from urllib.parse import urlsplit
 
 INSTANCE_PROTOCOL = 1
@@ -611,6 +614,147 @@ def show(instance: Instance, *, network: dict[str, str] | None = None):
     print()
 
 
+def show_status(instance: Instance, *, network: dict[str, str]) -> None:
+    """Read-only per-instance summary; never print configuration or tokens."""
+    item = describe(instance)
+    print(terminal_color(f"Server ({item['name']}):", "34"))
+    print(f"  Status:   {item['status']}")
+    addresses = []
+    if item["port"]:
+        choices = connection_choices(read_config(instance).get("AGENTSDOCK_AGENT_BIND", "0.0.0.0"),
+                                     item["port"], item["addresses"], network)
+        if choices["tailscale"]:
+            addresses.append(f"{choices['tailscale']} (Tailscale / other networks)")
+        for key, label in (("lan", "Same Wi-Fi / LAN"), ("local", "This machine only"),
+                           ("other", "Other / unverified")):
+            addresses.extend(f"{url} ({label})" for url in choices[key])
+    print("  Address:  " + (addresses[0] if addresses else "Not configured"))
+    for address in addresses[1:]:
+        print("            " + address)
+    print(f"  Version:  {item['version'] or 'unknown'}")
+    print(f"  Port:     {item['port'] or 'Not configured'}")
+    print()
+
+
+def read_token_menu_key(fd: int) -> str:
+    key = os.read(fd, 1)
+    if key in (b"", b"\x03", b"\x04"):
+        return "cancel"
+    if key in (b"\r", b"\n"):
+        return "enter"
+    if key != b"\x1b":
+        return "other"
+    sequence = b""
+    while len(sequence) < 16 and select.select([fd], [], [], 0.15)[0]:
+        part = os.read(fd, 1)
+        if not part:
+            return "cancel"
+        sequence += part
+        if sequence in (b"[A", b"OA"):
+            return "up"
+        if sequence in (b"[B", b"OB"):
+            return "down"
+        if sequence[:1] not in (b"[", b"O") or (len(sequence) > 1 and 0x40 <= part[0] <= 0x7e):
+            return "other"
+    return "cancel" if not sequence else "other"
+
+
+def arrow_token_choice(rows: list[str], fd: int, settings: list) -> int | None:
+    """Render a bounded terminal menu and restore input mode before token output."""
+    size = shutil.get_terminal_size(fallback=(80, 24))
+    visible = min(len(rows), max(1, size.lines - 6), 10)
+    width = max(1, size.columns - 1)
+    selected, start = 0, 0
+    hint = "Use ↑/↓ to choose; Enter to select; Esc to cancel."
+
+    def render(redraw=False):
+        if redraw:
+            sys.stdout.write(f"\x1b[{visible + 1}A")
+        for index in range(start, start + visible):
+            row = ("  > " if index == selected else "    ") + rows[index]
+            row = row[:width]
+            if index == selected:
+                row = terminal_color(row, "1;36")
+            sys.stdout.write("\r\x1b[2K" + row + "\n")
+        sys.stdout.write("\r\x1b[2K" + hint[:width] + "\n")
+        sys.stdout.flush()
+
+    try:
+        tty.setcbreak(fd, termios.TCSANOW)
+        sys.stdout.write("\x1b[?25l")
+        render()
+        while True:
+            key = read_token_menu_key(fd)
+            if key == "cancel":
+                return None
+            if key == "enter":
+                return selected
+            if key not in ("up", "down"):
+                continue
+            selected = (selected + (1 if key == "down" else -1)) % len(rows)
+            start = min(start, selected) if selected < start else max(start, selected - visible + 1)
+            render(redraw=True)
+    except KeyboardInterrupt:
+        return None
+    finally:
+        termios.tcsetattr(fd, termios.TCSANOW, settings)
+        sys.stdout.write("\x1b[?25h\n")
+        sys.stdout.flush()
+
+
+def choose_token_instance(registry: Registry) -> Instance | None:
+    """Select by stable instance name; never default or expose unselected tokens."""
+    items = registry.instances()
+    if not items:
+        print("No installations found. Run agentsdock setup to create your first server.")
+        return None
+    if not (sys.stdin.isatty() and sys.stdout.isatty()):
+        raise ValueError("Choose a server in an interactive terminal, or run agentsdock token NAME "
+                         "(for example: agentsdock token default). No token was shown.")
+    print("\nChoose a server to view its access token:\n")
+    rows = []
+    for index, instance in enumerate(items, 1):
+        config = read_config(instance)
+        port = config.get("AGENTSDOCK_AGENT_PORT") or "not configured"
+        rows.append(f"{instance.name:<20} {service_status(instance):<10} Port: {port}")
+    if os.environ.get("TERM", "dumb") not in ("", "dumb"):
+        try:
+            fd = sys.stdin.fileno()
+            settings = termios.tcgetattr(fd)
+        except (OSError, ValueError, termios.error):
+            pass  # Basic terminals retain the explicit numbered/name prompt.
+        else:
+            index = arrow_token_choice(rows, fd, settings)
+            if index is None:
+                print("Cancelled; no token was shown.")
+                return None
+            selected = items[index]
+            if selected.name not in {item.name for item in registry.instances()}:
+                raise ValueError("That server is no longer available. Run agentsdock token again. No token was shown.")
+            return selected
+    for index, row in enumerate(rows, 1):
+        print(f"  {index}. {row}")
+    print()
+    names = {item.name: item for item in items}
+    while True:
+        try:
+            answer = input("Enter a number or server name (Enter to cancel): ").strip()
+        except (EOFError, KeyboardInterrupt):
+            print()
+            answer = ""
+        if not answer:
+            print("Cancelled; no token was shown.")
+            return None
+        selected = names.get(answer)
+        if re.fullmatch(r"[1-9][0-9]{0,5}", answer) and int(answer) <= len(items):
+            selected = items[int(answer) - 1]
+        if selected is not None:
+            if selected.name not in {item.name for item in registry.instances()}:
+                raise ValueError("That server is no longer available. Run agentsdock token again. No token was shown.")
+            return selected
+        print(f"Please enter a number from 1 to {len(items)} or a listed server name (Enter cancels).")
+
+
 def terminal_color(text: str, code: str) -> str:
     color = sys.stdout.isatty() and os.environ.get("TERM") != "dumb" and "NO_COLOR" not in os.environ
     return f"\033[{code}m{text}\033[0m" if color else text
@@ -747,8 +891,11 @@ def parser() -> argparse.ArgumentParser:
     result = argparse.ArgumentParser(description="Independent AgentsServer instances for the current OS user. Defaults to list.")
     commands = result.add_subparsers(dest="command")
     commands.add_parser("list")
+    commands.add_parser("token", help="Choose an existing server and display only its access token")
     info = commands.add_parser("info")
     info.add_argument("name", type=instance_name)
+    status = commands.add_parser("status", help="Show readable details for all instances or one name")
+    status.add_argument("name", nargs="?", type=instance_name)
     new = commands.add_parser("new")
     new.add_argument("--name", type=instance_name)
     new.add_argument("--port", type=int)
@@ -785,13 +932,30 @@ def main(argv: list[str] | None = None) -> int:
             validate_binding(instance)
             print(instance.shell_bindings())
             return 0
-        if args.command in {None, "list", "info"}:
+        if args.command == "token":
+            selected = choose_token_instance(registry)
+            if selected is None:
+                return 0
+            try:
+                run(["/bin/bash", str(ROOT / "install.sh"), "--instance", selected.name, "--show-token"],
+                    env=clean_environment(selected), cwd=ROOT)
+                return 0
+            except subprocess.CalledProcessError as exc:
+                return exc.returncode if exc.returncode > 0 else 1
+        if args.command in {None, "list", "info", "status"}:
             items = registry.instances()
-            if args.command == "info":
+            if args.command in {"info", "status"} and args.name:
                 items = [item for item in items if item.name == args.name]
                 if not items:
                     raise ValueError("Unknown instance.")
+            if args.command == "info":
                 print(json.dumps(describe(items[0]), indent=2))
+            elif args.command == "status":
+                network = tailscale_status() if items else None
+                for item in items:
+                    show_status(item, network=network)
+                if not items:
+                    print("No installations found. Run agentsdock setup to create your first server.")
             else:
                 network = tailscale_status() if items else None
                 print("NAME                 STATUS     PORT")