@phnx-labs/agents-cli 1.20.26 → 1.20.28

package/dist/commands/hosts.d.ts

@@ -0,0 +1,11 @@
+/**
+ * `agents hosts` — register and inspect agent hosts (machines you offload runs to).
+ *
+ * The registry is a thin overlay: ssh-config hosts are dispatchable with zero
+ * registration (connection details stay in ~/.ssh/config); enrollment only adds
+ * capability metadata or bootstraps agents-cli, plus inline (non-ssh-config)
+ * hosts. Dispatch itself is `agents run --host <name>` (see commands/exec.ts).
+ */
+import type { Command } from 'commander';
+/** Register the `agents hosts` command tree. */
+export declare function registerHostsCommand(program: Command): void;

package/dist/commands/hosts.js

@@ -0,0 +1,229 @@
+/**
+ * `agents hosts` — register and inspect agent hosts (machines you offload runs to).
+ *
+ * The registry is a thin overlay: ssh-config hosts are dispatchable with zero
+ * registration (connection details stay in ~/.ssh/config); enrollment only adds
+ * capability metadata or bootstraps agents-cli, plus inline (non-ssh-config)
+ * hosts. Dispatch itself is `agents run --host <name>` (see commands/exec.ts).
+ */
+import chalk from 'chalk';
+import { checkbox, confirm } from '@inquirer/prompts';
+import { assertValidSshTarget } from '../lib/ssh-exec.js';
+import { getProvider, listAllHosts, resolveHost } from '../lib/hosts/registry.js';
+import { sshTargetFor } from '../lib/hosts/types.js';
+import { listSshConfigHosts, listKnownHosts, isSshConfigHost } from '../lib/hosts/ssh-config.js';
+import { probeHost, remoteAgentsVersion, bootstrapAgentsCli, localCliVersion, } from '../lib/hosts/ready.js';
+import { listTasks, loadTask, localLogPath } from '../lib/hosts/tasks.js';
+import { followHostTask } from '../lib/hosts/progress.js';
+import * as fs from 'fs';
+/** Parse `user@host` or `host` into its pieces. */
+function parseTarget(target) {
+    const at = target.indexOf('@');
+    if (at === -1)
+        return { address: target };
+    return { user: target.slice(0, at), address: target.slice(at + 1) };
+}
+/** Bootstrap/verify agents-cli on a freshly-enrolled host (best-effort, prompts). */
+async function maybeBootstrap(target, hostName) {
+    const probe = probeHost(target);
+    if (!probe.reachable) {
+        console.log(chalk.yellow(`  Not reachable over SSH yet — skipping bootstrap. Fix key auth, then: agents hosts check ${hostName}`));
+        return;
+    }
+    const remoteVer = remoteAgentsVersion(target);
+    const localVer = localCliVersion();
+    if (!remoteVer) {
+        const ok = await confirm({ message: `  agents-cli not found on ${hostName}. Install ${localVer ? `v${localVer}` : 'latest'} now?`, default: true });
+        if (ok) {
+            console.log(chalk.gray('  Installing agents-cli on the host…'));
+            const r = bootstrapAgentsCli(target, localVer);
+            console.log(r.ok ? chalk.green('  Installed.') : chalk.red(`  Install failed:\n${r.output}`));
+        }
+        return;
+    }
+    const remoteClean = remoteVer.replace(/^v/, '');
+    if (localVer && remoteClean !== localVer) {
+        const ok = await confirm({ message: `  ${hostName} has agents-cli ${remoteClean}, you have ${localVer}. Upgrade to match?`, default: false });
+        if (ok) {
+            const r = bootstrapAgentsCli(target, localVer);
+            console.log(r.ok ? chalk.green('  Upgraded.') : chalk.red(`  Upgrade failed:\n${r.output}`));
+        }
+    }
+}
+async function registerHost(spec) {
+    const provider = getProvider('local');
+    await provider.register(spec);
+}
+async function doAdd(name, target, opts) {
+    // No name + no target → interactive scan of ssh sources.
+    if (!name && !target) {
+        const existing = new Set((await listAllHosts()).filter((h) => h.enrolled).map((h) => h.name));
+        const candidates = [...new Set([...listSshConfigHosts(), ...listKnownHosts()])].filter((c) => !existing.has(c));
+        if (candidates.length === 0) {
+            console.log(chalk.yellow('No SSH hosts found in ~/.ssh/config or ~/.ssh/known_hosts. Add one explicitly: agents hosts add <name> <user@host>'));
+            return;
+        }
+        const picked = await checkbox({
+            message: 'Select hosts to enroll (connection details come from ~/.ssh/config)',
+            choices: candidates.map((c) => ({ value: c, name: c })),
+        });
+        for (const c of picked) {
+            // The ssh target is the candidate name itself either way: ssh resolves it
+            // for ssh-config hosts, and it's a reachable hostname for known_hosts ones.
+            const source = isSshConfigHost(c) ? 'ssh-config' : 'inline';
+            const probe = probeHost(c);
+            await registerHost({ name: c, provider: 'local', source, ...(source === 'inline' ? { address: c } : {}), os: probe.os, caps: opts.cap });
+            console.log(chalk.green(`Enrolled ${c}`) + chalk.gray(` (${source}${probe.os ? `, ${probe.os}` : ''})`));
+            if (opts.enroll !== false)
+                await maybeBootstrap(c, c);
+        }
+        return;
+    }
+    if (!name) {
+        console.log(chalk.red('Usage: agents hosts add <name> [user@host]'));
+        process.exitCode = 1;
+        return;
+    }
+    let spec;
+    let sshTarget;
+    if (target) {
+        assertValidSshTarget(target);
+        const { address, user } = parseTarget(target);
+        spec = { name, provider: 'local', source: 'inline', address, user, caps: opts.cap, os: opts.os };
+        sshTarget = target;
+    }
+    else if (isSshConfigHost(name)) {
+        spec = { name, provider: 'local', source: 'ssh-config', caps: opts.cap, os: opts.os };
+        sshTarget = name;
+    }
+    else {
+        console.log(chalk.red(`"${name}" is not in ~/.ssh/config. Pass a target: agents hosts add ${name} <user@host>`));
+        process.exitCode = 1;
+        return;
+    }
+    const probe = probeHost(sshTarget);
+    if (!spec.os && probe.os)
+        spec.os = probe.os;
+    await registerHost(spec);
+    console.log(chalk.green(`Enrolled ${name}`) + chalk.gray(` (${spec.source}${spec.os ? `, ${spec.os}` : ''}${spec.caps?.length ? `, caps: ${spec.caps.join(',')}` : ''})`));
+    if (opts.enroll !== false)
+        await maybeBootstrap(sshTarget, name);
+}
+async function doList(json) {
+    const hosts = await listAllHosts();
+    if (json) {
+        console.log(JSON.stringify(hosts, null, 2));
+        return;
+    }
+    if (hosts.length === 0) {
+        console.log(chalk.gray('No hosts. Enroll one: agents hosts add <name> <user@host>  (or just: agents hosts add)'));
+        return;
+    }
+    console.log(chalk.bold('NAME').padEnd(20) + chalk.bold('SOURCE').padEnd(13) + chalk.bold('TARGET').padEnd(28) + chalk.bold('CAPS'));
+    for (const h of hosts) {
+        const tgt = h.source === 'ssh-config' ? chalk.gray('(ssh-config)') : `${h.user ? h.user + '@' : ''}${h.address ?? ''}`;
+        const mark = h.enrolled ? '' : chalk.gray(' ·available');
+        console.log(h.name.padEnd(20) + h.source.padEnd(13) + tgt.padEnd(28) + (h.caps?.join(',') ?? '') + mark);
+    }
+}
+async function doCheck(name) {
+    const host = await resolveHost(name);
+    if (!host) {
+        console.log(chalk.red(`Unknown host "${name}". Known: ${(await listAllHosts()).map((h) => h.name).join(', ') || '(none)'}`));
+        process.exitCode = 1;
+        return;
+    }
+    const target = sshTargetFor(host);
+    process.stdout.write(`Probing ${chalk.cyan(name)} (${target})… `);
+    const probe = probeHost(target);
+    if (!probe.reachable) {
+        console.log(chalk.red('unreachable'));
+        process.exitCode = 1;
+        return;
+    }
+    console.log(chalk.green('reachable') + chalk.gray(probe.os ? ` · ${probe.os}` : ''));
+    const ver = remoteAgentsVersion(target);
+    console.log(`  agents-cli: ${ver ? chalk.green(ver) : chalk.yellow('not installed')}`);
+}
+async function doRemove(name) {
+    const host = await resolveHost(name);
+    if (!host || !host.enrolled) {
+        console.log(chalk.yellow(`"${name}" is not enrolled (nothing to remove).`));
+        return;
+    }
+    await getProvider('local').remove(name);
+    console.log(chalk.green(`Removed ${name}`));
+}
+async function doPs(json) {
+    const tasks = listTasks();
+    if (json) {
+        console.log(JSON.stringify(tasks, null, 2));
+        return;
+    }
+    if (tasks.length === 0) {
+        console.log(chalk.gray('No host tasks yet. Dispatch one: agents run <agent> "<task>" --host <name>'));
+        return;
+    }
+    console.log(chalk.bold('ID').padEnd(11) + chalk.bold('HOST').padEnd(16) + chalk.bold('AGENT').padEnd(10) + chalk.bold('STATUS').padEnd(11) + chalk.bold('PROMPT'));
+    for (const t of tasks) {
+        const status = t.status === 'completed' ? chalk.green(t.status) : t.status === 'failed' ? chalk.red(t.status) : chalk.yellow(t.status);
+        console.log(t.id.padEnd(11) + t.host.padEnd(16) + t.agent.padEnd(10) + status.padEnd(11) + t.prompt.slice(0, 50));
+    }
+}
+async function doLogs(id, follow) {
+    const task = loadTask(id);
+    if (!task) {
+        console.log(chalk.red(`Unknown task "${id}".`));
+        process.exitCode = 1;
+        return;
+    }
+    if (follow && task.status === 'running') {
+        const code = await followHostTask(task.target, { remoteLog: task.remoteLog, remoteExit: task.remoteExit, taskId: id, echo: true });
+        process.exitCode = code === -1 ? 1 : code;
+        return;
+    }
+    try {
+        process.stdout.write(fs.readFileSync(localLogPath(id), 'utf-8'));
+    }
+    catch {
+        console.log(chalk.gray('(no local log captured for this task)'));
+    }
+}
+/** Register the `agents hosts` command tree. */
+export function registerHostsCommand(program) {
+    const hosts = program
+        .command('hosts')
+        .description('Register and inspect agent hosts (machines you offload runs to with `agents run --host <name>`).');
+    hosts
+        .command('add [name] [target]')
+        .description('Enroll a host. With no args, pick from ~/.ssh/config + known_hosts. `target` is user@host for hosts not in ssh config.')
+        .option('--cap <cap...>', 'Capability tag(s) for routing (e.g. --cap gpu)')
+        .option('--os <os>', 'Override detected OS label')
+        .option('--no-enroll', 'Register only — skip the remote agents-cli bootstrap/version check')
+        .action((name, target, opts) => doAdd(name, target, opts));
+    hosts
+        .command('list')
+        .alias('ls')
+        .description('List enrolled + ssh-config hosts (metadata only, no probing).')
+        .option('--json', 'Output JSON')
+        .action((opts) => doList(!!opts.json));
+    hosts
+        .command('check <name>')
+        .description('Probe one host: reachable? agents-cli version?')
+        .action((name) => doCheck(name));
+    hosts
+        .command('remove <name>')
+        .alias('rm')
+        .description('Remove a host from the registry (does not touch ~/.ssh/config).')
+        .action((name) => doRemove(name));
+    hosts
+        .command('ps')
+        .description('List dispatched host tasks.')
+        .option('--json', 'Output JSON')
+        .action((opts) => doPs(!!opts.json));
+    hosts
+        .command('logs <id>')
+        .description('Show a host task log; -f to follow a running one.')
+        .option('-f, --follow', 'Follow live output')
+        .action((id, opts) => doLogs(id, !!opts.follow));
+}

package/dist/commands/repo.d.ts

@@ -11,5 +11,34 @@
  * agent version homes after the user repo's (user-wins on name collisions).
  */
 import type { Command } from 'commander';
+/**
+ * These are DotAgent *resource* repos, so changes are reported at the resource
+ * level ("2 skills, 1 hook") rather than the raw-file level. A resource is the
+ * unit a user reasons about: one skill, one command, one plugin — even if it
+ * spans several files on disk.
+ */
+type RepoResourceKind = 'skill' | 'command' | 'plugin' | 'hook' | 'mcp' | 'subagent' | 'rule' | 'workflow' | 'routine' | 'profile' | 'permission' | 'cli' | 'config' | 'other';
+export type ChangeAction = 'new' | 'changed' | 'removed';
+/**
+ * Map a repo-relative path to the resource unit it belongs to. Directory-based
+ * resources (skills/foo/SKILL.md) collapse to `skills/foo` so all their files
+ * count as one unit; flat config files (agents.yaml, hooks.yaml) count alone.
+ */
+export declare function resourceUnit(file: string): {
+    kind: RepoResourceKind;
+    unit: string;
+};
+/**
+ * Render a set of changed files as a resource-level summary, e.g.
+ * `2 new skills, 1 changed hook`. Counts distinct resource units (a skill whose
+ * three files all changed is "1 changed skill"), grouped by action then kind,
+ * and colors each phrase green/yellow/red for new/changed/removed. Caps at
+ * `maxParts` phrases, appending `+N more` so a big diff stays scannable.
+ */
+export declare function formatResourceDelta(entries: {
+    action: ChangeAction;
+    file: string;
+}[], maxParts?: number): string;
 /** Register the `agents repo` command tree. */
 export declare function registerRepoCommands(program: Command): void;
+export {};

package/dist/commands/repo.js

@@ -68,26 +68,117 @@ function deriveAlias(source) {
     // becomes ~/.agents-<alias>/ on disk (e.g. ".agents-work" -> "work").
     return base.replace(/^\.+/, '').replace(/^agents-/, '') || 'repo';
 }
+/** Top-level dir -> resource kind. Directory-based resources collapse to one unit. */
+const RESOURCE_DIRS = {
+    skills: 'skill', commands: 'command', prompts: 'command', plugins: 'plugin',
+    hooks: 'hook', mcp: 'mcp', subagents: 'subagent', rules: 'rule',
+    workflows: 'workflow', routines: 'routine', profiles: 'profile',
+    permissions: 'permission', cli: 'cli',
+};
+/** [singular, plural] display labels per kind. */
+const RESOURCE_LABELS = {
+    skill: ['skill', 'skills'], command: ['command', 'commands'],
+    plugin: ['plugin', 'plugins'], hook: ['hook', 'hooks'], mcp: ['MCP', 'MCPs'],
+    subagent: ['subagent', 'subagents'], rule: ['rule', 'rules'],
+    workflow: ['workflow', 'workflows'], routine: ['routine', 'routines'],
+    profile: ['profile', 'profiles'], permission: ['permission', 'permissions'],
+    cli: ['CLI', 'CLIs'], config: ['config file', 'config files'],
+    other: ['other file', 'other files'],
+};
+/** Display order — the resources a user cares about most come first. */
+const RESOURCE_ORDER = [
+    'skill', 'command', 'plugin', 'hook', 'mcp', 'subagent', 'rule',
+    'workflow', 'routine', 'profile', 'permission', 'cli', 'config', 'other',
+];
 /**
- * Categorized working-tree summary: `M:2 A:1 D:1 ?:3` — letters match the git
- * porcelain shorthand (Modified / Added / Deleted / Renamed / Unmerged /
- * Untracked). Zero counts are omitted so the column stays compact.
+ * Map a repo-relative path to the resource unit it belongs to. Directory-based
+ * resources (skills/foo/SKILL.md) collapse to `skills/foo` so all their files
+ * count as one unit; flat config files (agents.yaml, hooks.yaml) count alone.
  */
-function formatDirtyCounts(status) {
+export function resourceUnit(file) {
+    const parts = file.split('/');
+    const top = parts[0];
+    if (top === 'agents.yaml' || top === 'hooks.yaml')
+        return { kind: 'config', unit: top };
+    const kind = RESOURCE_DIRS[top];
+    if (kind)
+        return { kind, unit: parts.length > 1 ? `${top}/${parts[1]}` : file };
+    return { kind: 'other', unit: file };
+}
+/**
+ * Render a set of changed files as a resource-level summary, e.g.
+ * `2 new skills, 1 changed hook`. Counts distinct resource units (a skill whose
+ * three files all changed is "1 changed skill"), grouped by action then kind,
+ * and colors each phrase green/yellow/red for new/changed/removed. Caps at
+ * `maxParts` phrases, appending `+N more` so a big diff stays scannable.
+ */
+export function formatResourceDelta(entries, maxParts = 5) {
+    // Gather every action seen across a unit's files, then collapse to one action.
+    const units = new Map();
+    for (const { action, file } of entries) {
+        const { kind, unit } = resourceUnit(file);
+        const key = `${kind} ${unit}`;
+        const cur = units.get(key) ?? { kind, actions: new Set() };
+        cur.actions.add(action);
+        units.set(key, cur);
+    }
+    const counts = new Map(); // `${action} ${kind}` -> count
+    for (const { kind, actions } of units.values()) {
+        let action;
+        if (actions.size === 1)
+            action = [...actions][0];
+        else if ([...actions].every((a) => a === 'new'))
+            action = 'new';
+        else if ([...actions].every((a) => a === 'removed'))
+            action = 'removed';
+        else
+            action = 'changed'; // mixed add+modify within one unit reads as a change
+        const key = `${action} ${kind}`;
+        counts.set(key, (counts.get(key) ?? 0) + 1);
+    }
+    const COLOR = {
+        new: chalk.green, changed: chalk.yellow, removed: chalk.red,
+    };
     const parts = [];
-    if (status.modified.length)
-        parts.push(chalk.yellow(`M:${status.modified.length}`));
-    if (status.created.length)
-        parts.push(chalk.green(`A:${status.created.length}`));
-    if (status.deleted.length)
-        parts.push(chalk.red(`D:${status.deleted.length}`));
-    if (status.renamed.length)
-        parts.push(chalk.cyan(`R:${status.renamed.length}`));
-    if (status.conflicted.length)
-        parts.push(chalk.magenta(`U:${status.conflicted.length}`));
-    if (status.not_added.length)
-        parts.push(chalk.gray(`?:${status.not_added.length}`));
-    return parts.join(' ');
+    for (const action of ['new', 'changed', 'removed']) {
+        for (const kind of RESOURCE_ORDER) {
+            const n = counts.get(`${action} ${kind}`);
+            if (!n)
+                continue;
+            const [singular, plural] = RESOURCE_LABELS[kind];
+            parts.push(COLOR[action](`${n} ${action} ${n === 1 ? singular : plural}`));
+        }
+    }
+    if (parts.length > maxParts) {
+        const shown = parts.slice(0, maxParts);
+        shown.push(chalk.gray(`+${parts.length - maxParts} more`));
+        return shown.join(', ');
+    }
+    return parts.join(', ');
+}
+/** Parse `git diff --name-status <range>` into resource-delta entries. */
+async function diffResourceEntries(git, range) {
+    let raw;
+    try {
+        raw = await git.diff(['--name-status', range]);
+    }
+    catch {
+        return []; // no upstream resolvable / range invalid — caller falls back to counts
+    }
+    const out = [];
+    for (const line of raw.split('\n')) {
+        if (!line.trim())
+            continue;
+        const cols = line.split('\t');
+        const code = cols[0] ?? '';
+        const file = cols[cols.length - 1] ?? ''; // renames put the new path last
+        if (!file)
+            continue;
+        const c = code[0];
+        const action = c === 'A' ? 'new' : c === 'D' ? 'removed' : 'changed';
+        out.push({ action, file });
+    }
+    return out;
 }
 /** Visible character width of a string with embedded ANSI color codes. */
 function visibleWidth(s) {
@@ -98,46 +189,75 @@ function padVisible(s, width) {
     return s + ' '.repeat(Math.max(0, width - visibleWidth(s)));
 }
 /**
- * Render one row of the unified repo table: alias / branch / ahead-behind /
- * dirty counts / url+commit. Used by `agents repo list` and the hidden
- * `agents repo status` alias.
+ * Render one repo's row data: branch, resource-level sync (what a pull/push would
+ * move), resource-level local edits, and the remote URL + commit. Used by
+ * `agents repo list` and the hidden `agents repo status` alias.
  */
 async function renderRepoRow(t) {
-    const aliasCol = chalk.cyan(t.alias.padEnd(12));
     if (!fs.existsSync(t.dir)) {
-        return `  ${aliasCol} ${chalk.red('missing')} ${chalk.gray(t.dir)}`;
+        return { alias: t.alias, raw: `${chalk.red('missing')} ${chalk.gray(t.dir)}` };
     }
     if (!isGitRepo(t.dir)) {
-        return `  ${aliasCol} ${chalk.gray('local (no git remote)')} ${chalk.gray(t.dir)}`;
+        return { alias: t.alias, raw: `${chalk.gray('local (no git remote)')} ${chalk.gray(t.dir)}` };
     }
     try {
         const git = simpleGit(t.dir);
         const status = await git.status();
-        const branch = status.tracking || status.current || '(detached)';
-        const inSync = (status.ahead ?? 0) === 0 && (status.behind ?? 0) === 0;
-        const remoteRaw = inSync ? 'in sync' : `+${status.ahead ?? 0} -${status.behind ?? 0}`;
-        const remoteColored = inSync ? chalk.green(remoteRaw) : chalk.yellow(remoteRaw);
-        const remotePad = ' '.repeat(Math.max(0, 12 - remoteRaw.length));
-        const tree = status.isClean() ? chalk.green('clean') : formatDirtyCounts(status);
+        // Show the local branch name; the upstream remote is already implied by URL.
+        const branch = status.current || (status.tracking ? status.tracking.replace(/^origin\//, '') : '(detached)');
+        // SYNC: what a pull brings in / a push sends out, described by resource.
+        const ahead = status.ahead ?? 0;
+        const behind = status.behind ?? 0;
+        let sync;
+        if (!status.tracking) {
+            sync = chalk.gray('no upstream');
+        }
+        else if (ahead === 0 && behind === 0) {
+            sync = chalk.green('up to date');
+        }
+        else {
+            const pieces = [];
+            if (behind > 0) {
+                // Three-dot isolates upstream's side via the merge-base, so a diverged
+                // branch reports exactly what a pull adds (not the inverse of local commits).
+                const incoming = formatResourceDelta(await diffResourceEntries(git, 'HEAD...@{upstream}'));
+                pieces.push(`${incoming || chalk.yellow(`${behind} commit${behind > 1 ? 's' : ''}`)} ${chalk.gray('to pull')}`);
+            }
+            if (ahead > 0) {
+                const outgoing = formatResourceDelta(await diffResourceEntries(git, '@{upstream}...HEAD'));
+                pieces.push(`${outgoing || chalk.yellow(`${ahead} commit${ahead > 1 ? 's' : ''}`)} ${chalk.gray('to push')}`);
+            }
+            sync = pieces.join(chalk.gray('  ·  '));
+        }
+        // CHANGES: uncommitted working-tree edits, described by resource.
+        const localEntries = [
+            ...status.created.map((f) => ({ action: 'new', file: f })),
+            ...status.not_added.map((f) => ({ action: 'new', file: f })),
+            ...status.modified.map((f) => ({ action: 'changed', file: f })),
+            ...status.conflicted.map((f) => ({ action: 'changed', file: f })),
+            ...status.renamed.map((r) => ({ action: 'changed', file: r.to })),
+            ...status.deleted.map((f) => ({ action: 'removed', file: f })),
+        ];
+        const changes = status.isClean() ? chalk.green('clean') : formatResourceDelta(localEntries);
         const remotes = await git.getRemotes(true);
         const origin = remotes.find((r) => r.name === 'origin');
         const url = origin?.refs?.fetch || '';
         const commit = (await git.log({ maxCount: 1 })).latest?.hash.slice(0, 8) || '';
-        const tail = url
+        const remote = url
             ? chalk.gray(`${url}${commit ? ` (${commit})` : ''}`)
             : commit
                 ? chalk.gray(`(${commit})`)
                 : '';
-        return `  ${aliasCol} ${branch.padEnd(28)}  ${remoteColored}${remotePad}  ${padVisible(tree, 14)}  ${tail}`;
+        return { alias: t.alias, cells: [branch, sync, changes, remote] };
     }
     catch (err) {
-        return `  ${aliasCol} ${chalk.red('error')} ${err.message}`;
+        return { alias: t.alias, raw: `${chalk.red('error')} ${err.message}` };
     }
 }
 /**
  * Shared action body for `agents repo list` and the hidden `agents repo status`
- * alias. Prints a unified table: alias, branch, ahead/behind, dirty counts,
- * remote URL and short commit hash.
+ * alias. Prints an aligned table: repo, branch, resource-level sync (to pull /
+ * to push), resource-level local changes, and remote URL + short commit.
  */
 async function listRepos(alias) {
     const targets = collectRepoTargets(alias);
@@ -149,10 +269,26 @@ async function listRepos(alias) {
         console.log(chalk.gray('No repos to show.'));
         return;
     }
+    const rows = await Promise.all(targets.map(renderRepoRow));
+    const tableRows = rows.filter((r) => r.cells);
+    // Column widths grow to fit the widest visible content (resource summaries vary
+    // a lot in length), so the table stays aligned without truncating detail.
+    const headers = ['REPO', 'BRANCH', 'SYNC', 'CHANGES'];
+    const aliasW = Math.max(headers[0].length, ...rows.map((r) => r.alias.length));
+    const branchW = Math.max(headers[1].length, 0, ...tableRows.map((r) => visibleWidth(r.cells[0])));
+    const syncW = Math.max(headers[2].length, 0, ...tableRows.map((r) => visibleWidth(r.cells[1])));
+    const changesW = Math.max(headers[3].length, 0, ...tableRows.map((r) => visibleWidth(r.cells[2])));
     console.log('');
-    console.log(`  ${chalk.gray('REPO'.padEnd(12))} ${chalk.gray('BRANCH'.padEnd(28))}  ${chalk.gray('REMOTE'.padEnd(12))}  ${chalk.gray('LOCAL'.padEnd(14))}  ${chalk.gray('URL')}`);
-    for (const t of targets) {
-        console.log(await renderRepoRow(t));
+    console.log(`  ${chalk.gray(headers[0].padEnd(aliasW))}  ${chalk.gray(headers[1].padEnd(branchW))}  ${chalk.gray(headers[2].padEnd(syncW))}  ${chalk.gray(headers[3].padEnd(changesW))}  ${chalk.gray('REMOTE')}`);
+    for (const r of rows) {
+        const aliasCol = chalk.cyan(r.alias.padEnd(aliasW));
+        if (r.cells) {
+            const [branch, sync, changes, remote] = r.cells;
+            console.log(`  ${aliasCol}  ${padVisible(branch, branchW)}  ${padVisible(sync, syncW)}  ${padVisible(changes, changesW)}  ${remote}`);
+        }
+        else {
+            console.log(`  ${aliasCol}  ${r.raw}`);
+        }
     }
     const userDir = getUserAgentsDir();
     if (!isGitRepo(userDir) && fs.existsSync(userDir)) {
@@ -358,7 +494,7 @@ export function registerRepoCommands(program) {
     repoCmd
         .command('list [alias]')
         .alias('ls')
-        .description('Show all repos: branch, ahead/behind, dirty counts, URL, commit.')
+        .description('Show all repos with resource-level sync (skills/commands/plugins to pull or push) and local changes.')
         .action(async (alias) => {
         await listRepos(alias);
     });

package/dist/commands/secrets.d.ts

@@ -6,13 +6,8 @@
  * Keychain. Bundles are injected at run time via `agents run --secrets`.
  */
 import { type Command } from 'commander';
-/**
- * SSH target for `export --to-ssh`: a bare ssh-config host alias (e.g. `yosemite-s0`)
- * or `user@host`. The strict allowlist blocks shell metacharacters and a leading `-`
- * so a target can't be smuggled in as an ssh argv flag.
- */
-export declare const SSH_TARGET_RE: RegExp;
-export declare function assertValidSshTarget(host: string): void;
+import { SSH_TARGET_RE, assertValidSshTarget } from '../lib/ssh-exec.js';
+export { SSH_TARGET_RE, assertValidSshTarget };
 /**
  * Serialize a resolved env map to `.env` lines that round-trip losslessly through
  * `parseDotenv` on the remote: `KEY="VALUE"`. parseDotenv strips exactly one outer

package/dist/commands/secrets.js

@@ -9,6 +9,7 @@ import { Option } from 'commander';
 import chalk from 'chalk';
 import * as fs from 'fs';
 import { spawnSync } from 'child_process';
+import { SSH_TARGET_RE, assertValidSshTarget } from '../lib/ssh-exec.js';
 import { bundleExists, bundleItemStore, bundlePolicy, deleteBundle, describeBundle, keychainItemsForBundle, keychainRef, listBundles, migrateLegacyBundles, parseDotenv, readAndResolveBundleEnv, readBundle, renameBundle, rotateBundleSecret, validateBundleName, validateEnvKey, validateExpiresFutureDated, validateSecretType, writeBundle, } from '../lib/secrets/bundles.js';
 import { getKeychainToken, getKeychainTokens, hasKeychainToken, secretsKeychainItem, setKeychainToken, } from '../lib/secrets/index.js';
 import { assertOpAvailable, createPasswordItem, deleteItemByTitle, extractSecrets, itemExistsByTitle, listItems, listVaults, } from '../lib/onepassword.js';
@@ -134,17 +135,9 @@ function readStdinSync() {
     }
     return Buffer.concat(chunks).toString('utf-8').trim();
 }
-/**
- * SSH target for `export --to-ssh`: a bare ssh-config host alias (e.g. `yosemite-s0`)
- * or `user@host`. The strict allowlist blocks shell metacharacters and a leading `-`
- * so a target can't be smuggled in as an ssh argv flag.
- */
-export const SSH_TARGET_RE = /^[a-zA-Z0-9._-]+(@[a-zA-Z0-9._-]+)?$/;
-export function assertValidSshTarget(host) {
-    if (!SSH_TARGET_RE.test(host)) {
-        throw new Error(`Invalid SSH target ${JSON.stringify(host)}. Expected a host alias or user@host (letters, digits, '.', '_', '-').`);
-    }
-}
+// SSH target validation is defined canonically in src/lib/ssh-exec.ts and
+// re-exported here for back-compat with existing importers of these symbols.
+export { SSH_TARGET_RE, assertValidSshTarget };
 /** POSIX single-quote a string for safe interpolation into a remote shell command. */
 function shellQuote(s) {
     return `'${s.replace(/'/g, `'\\''`)}'`;
@@ -414,7 +407,7 @@ export function registerSecretsCommands(program) {
       eval "$(agents secrets export prod --plaintext)"
 
       # Push the bundle to remote machine(s) over SSH (lands as a native bundle there)
-      agents secrets export prod --to-ssh --host yosemite-s0 --host yosemite-s1 --force
+      agents secrets export prod --host yosemite-s0 --host yosemite-s1 --force
 
       # Run a one-off command with secrets injected
       agents secrets exec prod -- ./deploy.sh
@@ -1017,7 +1010,7 @@ Examples:
             const requestedBackend = parseBackendOpt(opts.backend);
             // Read the bundle if it exists (inheriting its backend); otherwise
             // create it with the requested backend so a single `import --backend
-            // file` works (this is what `export --to-ssh --remote-backend file`
+            // file` works (this is what `export --host ... --remote-backend file`
             // drives on the remote).
             let bundle;
             if (bundleExists(resolvedBundleName)) {
@@ -1094,23 +1087,22 @@ Examples:
     });
     cmd
         .command('export [bundle]')
-        .description('Resolve a bundle and print KEY=VALUE lines, push it to a 1Password vault with --to-1password, or push it to remote machine(s) over SSH with --to-ssh.')
+        .description('Resolve a bundle and print KEY=VALUE lines, push it to a 1Password vault with --to-1password, or push it to remote machine(s) over SSH with --host.')
         .option('--plaintext', 'Acknowledge that the resolved values will be printed in the clear (shell export mode)')
         .option('--to-1password', 'Push every key in the bundle as a PASSWORD item in a 1Password vault')
         .option('--vault <name>', '1Password vault name (used with --to-1password)')
-        .option('--to-ssh', 'Push the bundle to remote machine(s) over SSH via their native agents-cli import')
-        .option('--host <target...>', 'SSH target(s) for --to-ssh: host alias or user@host (repeatable)')
-        .option('--remote-backend <backend>', 'Backend for the bundle on the remote: keychain (default) or file (passphrase-encrypted, headless-readable). file forwards AGENTS_SECRETS_PASSPHRASE over stdin.', 'keychain')
-        .option('--force', 'Overwrite existing keys/items on the target (used with --to-1password and --to-ssh)')
+        .option('--host <target...>', 'Push the bundle over SSH to this target (host alias or user@host); repeatable for multiple machines')
+        .option('--remote-backend <backend>', 'Backend for the bundle on the remote (with --host): keychain (default) or file (passphrase-encrypted, headless-readable). file forwards AGENTS_SECRETS_PASSPHRASE over stdin.', 'keychain')
+        .option('--force', 'Overwrite existing keys/items on the target (used with --to-1password and --host)')
         .action(async (bundleName, opts) => {
         try {
             const { readAndResolveBundleEnv, bundleToEnvPrefix, isReservedEnvName } = await import('../lib/secrets/bundles.js');
             const resolvedBundleName = bundleName ?? (await pickBundleName('export'));
-            if (opts.toSsh) {
-                const hosts = opts.host ?? [];
-                if (hosts.length === 0) {
-                    throw new Error('--to-ssh requires at least one --host <target>.');
-                }
+            // The presence of --host selects SSH push: --host is the destination
+            // and carries the mode (no separate --to-ssh needed — it would be
+            // strictly redundant since SSH always requires at least one host).
+            const hosts = opts.host ?? [];
+            if (hosts.length > 0) {
                 for (const h of hosts)
                     assertValidSshTarget(h);
                 const remoteBackend = parseBackendOpt(opts.remoteBackend);