@phnx-labs/agents-cli 1.20.32 → 1.20.34

package/dist/lib/browser/chrome.js

@@ -51,6 +51,7 @@ const BROWSER_PATHS = {
         edge: [
             `${WIN_PROGRAMFILES}\\Microsoft\\Edge\\Application\\msedge.exe`,
             `${WIN_PROGRAMFILES_X86}\\Microsoft\\Edge\\Application\\msedge.exe`,
+            `${WIN_LOCALAPPDATA}\\Microsoft\\Edge\\Application\\msedge.exe`,
         ],
         custom: [],
     },
@@ -282,6 +283,25 @@ export async function attachToChrome(port) {
     return wsUrl;
 }
 export function killChrome(pid) {
+    if (process.platform === 'win32') {
+        // On Windows `process.kill(pid, 'SIGINT')` maps to TerminateProcess — a
+        // hard kill that skips Chromium's on-exit profile flush (leaving a dirty
+        // "Chrome didn't shut down correctly" state). Ask taskkill for a graceful
+        // stop first (no /F → posts WM_CLOSE), and only force-kill the tree if that
+        // fails or the process is still around.
+        try {
+            execFileSync('taskkill', ['/pid', String(pid)], { stdio: 'ignore' });
+        }
+        catch {
+            try {
+                execFileSync('taskkill', ['/pid', String(pid), '/t', '/f'], { stdio: 'ignore' });
+            }
+            catch {
+                // Process already dead
+            }
+        }
+        return;
+    }
     try {
         process.kill(pid, 'SIGINT');
     }

package/dist/lib/browser/drivers/ssh.d.ts

@@ -54,3 +54,22 @@ export declare function buildLaunchCmd(remoteOs: RemoteOs, browserType: string,
  */
 export declare function buildKillCmd(remoteOs: RemoteOs, port: number): string;
 export declare function restartRemoteBrowser(user: string, host: string, browserType: string, port: number, remoteOs: RemoteOs, customBinary?: string): Promise<void>;
+/**
+ * Identify whether a pid listening on our target local port is an SSH
+ * tunnel WE would have spawned for `host:remotePort`. Used so that two
+ * agents-browser invocations of the same SSH profile share a tunnel
+ * rather than failing the second one with "port in use".
+ *
+ * Best-effort match against the ssh -L command line via `ps`. If we
+ * can't read the cmd or the args don't look like ours, treat as not-ours.
+ *
+ * Windows has no `ps`, so the POSIX branch below always throws there and every
+ * reuse check returned false — the second invocation to the same host:port then
+ * failed "port in use". On win32 we instead reuse the netstat -ano + tasklist
+ * occupant lookup (getPortOccupant): the tunnel binds `remotePort` locally
+ * (localPort === remotePort in the caller), so the pid holding that port is our
+ * ssh.exe. tasklist only exposes the image name, not the full command line, so
+ * we can't match host/remotePort as tightly as the POSIX branch — an ssh
+ * process on our exact local port is our tunnel in practice.
+ */
+export declare function isOwnTunnel(pid: number, host: string, remotePort: number): boolean;

package/dist/lib/browser/drivers/ssh.js

@@ -12,6 +12,7 @@ export { shellQuote };
 // the single ssh-tunnel helper. Calling it with no options preserves this
 // driver's original foreground, stderr-captured behavior exactly.
 import { startSSHTunnel } from '../../ssh-tunnel.js';
+import { encodePwshBase64 } from '../../pwsh.js';
 export async function connectSSH(endpoint, profile) {
     const url = new URL(endpoint);
     if (url.protocol !== 'ssh:') {
@@ -159,8 +160,7 @@ function psSingleQuote(s) {
  * `powershell -Command "…"` is fragile the moment a path or URL is involved).
  */
 export function encodePowerShell(script) {
-    const b64 = Buffer.from(script, 'utf16le').toString('base64');
-    return `powershell -NoProfile -EncodedCommand ${b64}`;
+    return `powershell -NoProfile -EncodedCommand ${encodePwshBase64(script)}`;
 }
 /**
  * The PowerShell that launches the browser on a Windows remote. Two hard
@@ -290,8 +290,23 @@ function sleep(ms) {
  *
  * Best-effort match against the ssh -L command line via `ps`. If we
  * can't read the cmd or the args don't look like ours, treat as not-ours.
+ *
+ * Windows has no `ps`, so the POSIX branch below always throws there and every
+ * reuse check returned false — the second invocation to the same host:port then
+ * failed "port in use". On win32 we instead reuse the netstat -ano + tasklist
+ * occupant lookup (getPortOccupant): the tunnel binds `remotePort` locally
+ * (localPort === remotePort in the caller), so the pid holding that port is our
+ * ssh.exe. tasklist only exposes the image name, not the full command line, so
+ * we can't match host/remotePort as tightly as the POSIX branch — an ssh
+ * process on our exact local port is our tunnel in practice.
  */
-function isOwnTunnel(pid, host, remotePort) {
+export function isOwnTunnel(pid, host, remotePort) {
+    if (process.platform === 'win32') {
+        const occupant = getPortOccupant(remotePort);
+        if (!occupant || occupant.pid !== pid)
+            return false;
+        return occupant.command.toLowerCase().startsWith('ssh');
+    }
     try {
         const out = execFileSync('ps', ['-p', String(pid), '-o', 'command='], {
             encoding: 'utf-8',

package/dist/lib/crabbox/cli.d.ts

@@ -0,0 +1,98 @@
+/**
+ * Typed wrapper over the external `crabbox` binary (github.com/openclaw/crabbox).
+ *
+ * crabbox leases ephemeral cloud boxes (Hetzner/DO/EC2/…), syncs the dirty
+ * checkout, and runs commands on them. We use it as the transport for
+ * `agents run --lease`: warm a box → run the agent on it via `crabbox run` →
+ * stop it. crabbox owns the SSH connection, so agents-cli never needs a direct
+ * ssh target (unlike the `agents hosts` model).
+ *
+ * crabbox talks to its cloud provider's API for list/status/warmup/stop, which
+ * needs a provider token (e.g. HCLOUD_TOKEN) in the environment. We inject it
+ * from a secrets bundle when one is configured (see `crabboxEnv`).
+ */
+/** A crabbox machine as reported by `crabbox list --json`. */
+export interface CrabboxBox {
+    /** Provider machine name, e.g. `crabbox-blue-hermit-1039689b`. */
+    name: string;
+    /** Provider run state, e.g. `running`. */
+    status: string;
+    /** Friendly slug used with `--id`, e.g. `blue-hermit`. */
+    slug: string;
+    /** Lease id, e.g. `cbx_9968746bb15c`. */
+    lease: string;
+    /** crabbox bootstrap state; `ready` once the box is usable. */
+    state: string;
+    /** Public IPv4, when the provider exposes one. */
+    ip?: string;
+    profile?: string;
+    class?: string;
+    /** True when running + bootstrap-complete. */
+    ready: boolean;
+}
+export interface CrabboxOptions {
+    /**
+     * Name of a secrets bundle whose env (e.g. `HCLOUD_TOKEN`) crabbox needs to
+     * reach its cloud provider. Resolved via agents-cli's own keychain-backed
+     * secrets. When unset, crabbox runs with the ambient environment / its own
+     * `crabbox login` credentials.
+     */
+    secretsBundle?: string;
+}
+/** Locate the crabbox binary, or throw an actionable error. */
+export declare function findCrabbox(): string;
+/** Build the child env for crabbox, injecting a secrets bundle when configured. */
+export declare function crabboxEnv(opts: CrabboxOptions): NodeJS.ProcessEnv;
+/** All crabbox machines the broker knows about. */
+export declare function crabboxList(opts?: CrabboxOptions): CrabboxBox[];
+/** Find one box by slug, or null. */
+export declare function crabboxFind(slug: string, opts?: CrabboxOptions): CrabboxBox | null;
+export interface WarmupOptions extends CrabboxOptions {
+    class?: string;
+    profile?: string;
+    /** Provision web code-server capability on the box. */
+    code?: boolean;
+    /** Cloud backend override (crabbox provider id, e.g. hetzner/aws/do). */
+    provider?: string;
+}
+/**
+ * Lease a box and block until it is ready. Returns the leased box.
+ *
+ * We diff `crabbox list` before/after so we reliably identify the box this call
+ * created even if warmup's stdout format changes — the new lease id is the one
+ * that wasn't present before.
+ */
+export declare function crabboxWarmup(opts?: WarmupOptions): CrabboxBox;
+/**
+ * Poll until the box reports ready, or throw after timeoutMs.
+ * `sleep` is injectable so tests don't wall-clock wait.
+ */
+export declare function crabboxWaitReady(slug: string, opts?: CrabboxOptions & {
+    timeoutMs?: number;
+    intervalMs?: number;
+    sleep?: (ms: number) => Promise<void>;
+}): Promise<CrabboxBox>;
+export interface CrabboxRunOptions extends CrabboxOptions {
+    /** Called with each chunk of combined stdout/stderr as it streams. */
+    onData?: (chunk: string) => void;
+    /** Force a full remote resync before running. */
+    fullResync?: boolean;
+}
+/**
+ * Run `remoteCmd` on the leased box via `crabbox run` (crabbox syncs the dirty
+ * checkout and owns the SSH). Streams combined output; resolves with the remote
+ * exit code (or null if crabbox itself failed to dispatch).
+ */
+export declare function crabboxRun(slug: string, remoteCmd: string, opts?: CrabboxRunOptions): Promise<number | null>;
+/**
+ * Upload `script` to the box via `crabbox run --script-stdin` and run it.
+ *
+ * The script body travels over stdin and is written to a file on the box before
+ * execution — it never appears in argv / `ps` / shell history, which is why this
+ * is the transport for credential provisioning (the token contents live only in
+ * the uploaded script, then the file is removed by the script itself).
+ * Streams combined output; resolves with the remote exit code (null on dispatch failure).
+ */
+export declare function crabboxRunScript(slug: string, script: string, opts?: CrabboxRunOptions): Promise<number | null>;
+/** Release the lease / delete the box. Best-effort; never throws. */
+export declare function crabboxStop(slug: string, opts?: CrabboxOptions): boolean;

package/dist/lib/crabbox/cli.js

@@ -0,0 +1,218 @@
+/**
+ * Typed wrapper over the external `crabbox` binary (github.com/openclaw/crabbox).
+ *
+ * crabbox leases ephemeral cloud boxes (Hetzner/DO/EC2/…), syncs the dirty
+ * checkout, and runs commands on them. We use it as the transport for
+ * `agents run --lease`: warm a box → run the agent on it via `crabbox run` →
+ * stop it. crabbox owns the SSH connection, so agents-cli never needs a direct
+ * ssh target (unlike the `agents hosts` model).
+ *
+ * crabbox talks to its cloud provider's API for list/status/warmup/stop, which
+ * needs a provider token (e.g. HCLOUD_TOKEN) in the environment. We inject it
+ * from a secrets bundle when one is configured (see `crabboxEnv`).
+ */
+import { spawn, spawnSync } from 'child_process';
+import { readAndResolveBundleEnv } from '../secrets/bundles.js';
+/** Locate the crabbox binary, or throw an actionable error. */
+export function findCrabbox() {
+    const r = spawnSync('crabbox', ['--help'], { encoding: 'utf-8' });
+    if (r.error) {
+        throw new Error('crabbox is not installed or not on PATH. Install it and run `crabbox login`, then `crabbox doctor` to verify provider access.');
+    }
+    return 'crabbox';
+}
+/** Build the child env for crabbox, injecting a secrets bundle when configured. */
+export function crabboxEnv(opts) {
+    const bundle = opts.secretsBundle ?? process.env.AGENTS_LEASE_SECRETS_BUNDLE;
+    if (!bundle)
+        return process.env;
+    try {
+        // Reuse the same resolver `agents secrets exec` uses so a keychain-backed
+        // bundle (e.g. hetzner.com → HCLOUD_TOKEN) reaches crabbox without ever
+        // touching disk.
+        const { env } = readAndResolveBundleEnv(bundle, { caller: 'agents run --lease (crabbox)' });
+        return { ...process.env, ...env };
+    }
+    catch (e) {
+        throw new Error(`Could not load secrets bundle "${bundle}" for crabbox: ${e.message}. ` +
+            `Fix the bundle (agents secrets view ${bundle}) or unset lease.secretsBundle to use crabbox's own login.`);
+    }
+}
+function normalizeBox(raw) {
+    const labels = (raw.labels ?? {});
+    const slug = labels.slug ?? '';
+    if (!slug)
+        return null;
+    const status = String(raw.status ?? '');
+    const state = String(labels.state ?? '');
+    const publicNet = (raw.public_net ?? {});
+    return {
+        name: String(raw.name ?? ''),
+        status,
+        slug,
+        lease: labels.lease ?? '',
+        state,
+        ip: publicNet.ipv4?.ip || undefined,
+        profile: labels.profile,
+        class: labels.class,
+        ready: status === 'running' && state === 'ready',
+    };
+}
+/** All crabbox machines the broker knows about. */
+export function crabboxList(opts = {}) {
+    findCrabbox();
+    const r = spawnSync('crabbox', ['list', '--json'], { encoding: 'utf-8', env: crabboxEnv(opts) });
+    if (r.status !== 0) {
+        throw new Error(`crabbox list failed: ${(r.stderr || r.stdout || '').trim() || 'unknown error'}`);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(r.stdout || '[]');
+    }
+    catch {
+        return [];
+    }
+    if (!Array.isArray(parsed))
+        return [];
+    return parsed.map((b) => normalizeBox(b)).filter((b) => b !== null);
+}
+/** Find one box by slug, or null. */
+export function crabboxFind(slug, opts = {}) {
+    return crabboxList(opts).find((b) => b.slug === slug) ?? null;
+}
+/**
+ * Lease a box and block until it is ready. Returns the leased box.
+ *
+ * We diff `crabbox list` before/after so we reliably identify the box this call
+ * created even if warmup's stdout format changes — the new lease id is the one
+ * that wasn't present before.
+ */
+export function crabboxWarmup(opts = {}) {
+    findCrabbox();
+    const env = crabboxEnv(opts);
+    const before = new Set(crabboxList(opts).map((b) => b.lease));
+    const args = ['warmup'];
+    if (opts.class)
+        args.push('--class', opts.class);
+    if (opts.profile)
+        args.push('--profile', opts.profile);
+    if (opts.provider)
+        args.push('--provider', opts.provider);
+    if (opts.code)
+        args.push('--code');
+    const r = spawnSync('crabbox', args, { encoding: 'utf-8', env, stdio: ['ignore', 'pipe', 'pipe'] });
+    if (r.status !== 0) {
+        const detail = (r.stderr || r.stdout || '').trim();
+        throw new Error(`crabbox warmup failed: ${detail || 'unknown error'}. ` +
+            `Check provider access with \`crabbox doctor\`; a missing cloud token often means \`crabbox login\` or a lease.secretsBundle is needed.`);
+    }
+    // Prefer the freshly-created box (lease absent from the pre-warmup snapshot).
+    const after = crabboxList(opts);
+    const fresh = after.filter((b) => !before.has(b.lease));
+    if (fresh.length === 1)
+        return fresh[0];
+    // Fallback: parse the cbx_ lease id crabbox prints and match it.
+    const m = (r.stdout || '').match(/cbx_[0-9a-f]+/i);
+    if (m) {
+        const byLease = after.find((b) => b.lease === m[0]);
+        if (byLease)
+            return byLease;
+    }
+    if (fresh.length > 1) {
+        // Multiple new boxes (concurrent warmups) — pick the newest ready one.
+        const ready = fresh.filter((b) => b.ready);
+        if (ready.length)
+            return ready[ready.length - 1];
+        return fresh[fresh.length - 1];
+    }
+    throw new Error('crabbox warmup succeeded but the new box could not be located in `crabbox list`.');
+}
+/**
+ * Poll until the box reports ready, or throw after timeoutMs.
+ * `sleep` is injectable so tests don't wall-clock wait.
+ */
+export async function crabboxWaitReady(slug, opts = {}) {
+    const timeoutMs = opts.timeoutMs ?? 180_000;
+    const intervalMs = opts.intervalMs ?? 5_000;
+    const sleep = opts.sleep ?? ((ms) => new Promise((res) => setTimeout(res, ms)));
+    const deadline = Date.now() + timeoutMs;
+    let last = null;
+    // First check is immediate (warmup usually returns an already-ready box).
+    for (;;) {
+        last = crabboxFind(slug, opts);
+        if (last?.ready)
+            return last;
+        if (Date.now() >= deadline)
+            break;
+        await sleep(intervalMs);
+    }
+    throw new Error(`crabbox box "${slug}" did not become ready within ${Math.round(timeoutMs / 1000)}s (state: ${last?.state ?? 'gone'}).`);
+}
+/**
+ * Run `remoteCmd` on the leased box via `crabbox run` (crabbox syncs the dirty
+ * checkout and owns the SSH). Streams combined output; resolves with the remote
+ * exit code (or null if crabbox itself failed to dispatch).
+ */
+export function crabboxRun(slug, remoteCmd, opts = {}) {
+    findCrabbox();
+    const args = ['run', '--id', slug, '--reclaim'];
+    if (opts.fullResync)
+        args.push('--full-resync');
+    args.push('--', 'bash', '-lc', remoteCmd);
+    return new Promise((resolve) => {
+        const proc = spawn('crabbox', args, { env: crabboxEnv(opts), stdio: ['ignore', 'pipe', 'pipe'] });
+        const pump = (chunk) => {
+            const s = chunk.toString('utf-8');
+            if (opts.onData)
+                opts.onData(s);
+            else
+                process.stdout.write(s);
+        };
+        proc.stdout.on('data', pump);
+        proc.stderr.on('data', pump);
+        proc.on('error', () => resolve(null));
+        proc.on('close', (code) => resolve(code));
+    });
+}
+/**
+ * Upload `script` to the box via `crabbox run --script-stdin` and run it.
+ *
+ * The script body travels over stdin and is written to a file on the box before
+ * execution — it never appears in argv / `ps` / shell history, which is why this
+ * is the transport for credential provisioning (the token contents live only in
+ * the uploaded script, then the file is removed by the script itself).
+ * Streams combined output; resolves with the remote exit code (null on dispatch failure).
+ */
+export function crabboxRunScript(slug, script, opts = {}) {
+    findCrabbox();
+    const args = ['run', '--id', slug, '--reclaim'];
+    if (opts.fullResync)
+        args.push('--full-resync');
+    args.push('--script-stdin');
+    return new Promise((resolve) => {
+        const proc = spawn('crabbox', args, { env: crabboxEnv(opts), stdio: ['pipe', 'pipe', 'pipe'] });
+        const pump = (chunk) => {
+            const s = chunk.toString('utf-8');
+            if (opts.onData)
+                opts.onData(s);
+            else
+                process.stdout.write(s);
+        };
+        proc.stdout.on('data', pump);
+        proc.stderr.on('data', pump);
+        proc.on('error', () => resolve(null));
+        proc.on('close', (code) => resolve(code));
+        proc.stdin.write(script);
+        proc.stdin.end();
+    });
+}
+/** Release the lease / delete the box. Best-effort; never throws. */
+export function crabboxStop(slug, opts = {}) {
+    try {
+        const r = spawnSync('crabbox', ['stop', '--id', slug], { encoding: 'utf-8', env: crabboxEnv(opts) });
+        return r.status === 0;
+    }
+    catch {
+        return false;
+    }
+}

package/dist/lib/crabbox/lease.d.ts

@@ -0,0 +1,41 @@
+/**
+ * `agents run --lease` orchestrator.
+ *
+ * Lease an ephemeral crabbox → provision the picked runtime(s) + their
+ * credentials → run the agent on the box (via `crabbox run`, which owns the
+ * SSH) → tear the box down. The whole box-side sequence rides a single
+ * `--script-stdin` body so the token contents never touch argv.
+ */
+import type { AgentId } from '../types.js';
+import { type CrabboxBox } from './cli.js';
+import { type DetectedRuntime } from './runtimes.js';
+export interface LeaseRunOptions {
+    agent: string;
+    prompt: string;
+    mode?: string;
+    model?: string;
+    /** Cloud backend crabbox provisions on (hetzner/aws/do/…). */
+    backend?: string;
+    boxClass?: string;
+    profile?: string;
+    /** Runtimes to install + authenticate on the box (from the picker). */
+    runtimes: AgentId[];
+    detected: DetectedRuntime[];
+    /** Secrets bundle providing crabbox's provider token. */
+    secretsBundle?: string;
+    onData?: (s: string) => void;
+    /** Keep the box after the run instead of stopping it. */
+    keep?: boolean;
+}
+export interface LeaseRunResult {
+    box: CrabboxBox;
+    exitCode: number | null;
+    toreDown: boolean;
+}
+/**
+ * Build the single bootstrap script run on the box: ensure agents-cli, install
+ * the picked runtime CLIs, write their credentials, run the agent, then shred
+ * the credential files. Best-effort install steps never abort the run.
+ */
+export declare function buildBootstrapScript(opts: LeaseRunOptions): string;
+export declare function leaseAndRun(opts: LeaseRunOptions): Promise<LeaseRunResult>;

package/dist/lib/crabbox/lease.js

@@ -0,0 +1,73 @@
+/**
+ * `agents run --lease` orchestrator.
+ *
+ * Lease an ephemeral crabbox → provision the picked runtime(s) + their
+ * credentials → run the agent on the box (via `crabbox run`, which owns the
+ * SSH) → tear the box down. The whole box-side sequence rides a single
+ * `--script-stdin` body so the token contents never touch argv.
+ */
+import { crabboxWarmup, crabboxWaitReady, crabboxRunScript, crabboxStop } from './cli.js';
+import { buildCredentialScript } from './runtimes.js';
+/** POSIX single-quote for safe embedding in the generated bootstrap script. */
+function q(s) {
+    return "'" + s.replace(/'/g, "'\\''") + "'";
+}
+/**
+ * Build the single bootstrap script run on the box: ensure agents-cli, install
+ * the picked runtime CLIs, write their credentials, run the agent, then shred
+ * the credential files. Best-effort install steps never abort the run.
+ */
+export function buildBootstrapScript(opts) {
+    const credScript = buildCredentialScript(opts.runtimes, opts.detected);
+    const runParts = ['agents', 'run', q(opts.agent), q(opts.prompt), '--quiet'];
+    if (opts.mode)
+        runParts.push('--mode', q(opts.mode));
+    if (opts.model)
+        runParts.push('--model', q(opts.model));
+    // Credential files to shred after the run (home-level paths written above).
+    const shred = opts.runtimes
+        .map((id) => {
+        const cred = { claude: '.claude.json', codex: '.codex/auth.json', gemini: '.gemini/google_accounts.json', grok: '.grok/auth.json' }[id];
+        return cred ? `rm -f "$HOME/${cred}" 2>/dev/null || true` : '';
+    })
+        .filter(Boolean)
+        .join('\n');
+    const installRuntimes = opts.runtimes.map((id) => `agents add ${q(id)} >/dev/null 2>&1 || true`).join('\n');
+    return [
+        'set -uo pipefail',
+        'if ! command -v agents >/dev/null 2>&1; then npm install -g @phnx-labs/agents-cli >/dev/null 2>&1 || true; fi',
+        installRuntimes,
+        credScript,
+        `${runParts.join(' ')}`,
+        'rc=$?',
+        shred,
+        'exit $rc',
+    ]
+        .filter((l) => l.length > 0)
+        .join('\n');
+}
+export async function leaseAndRun(opts) {
+    const box = crabboxWarmup({
+        class: opts.boxClass,
+        profile: opts.profile,
+        provider: opts.backend,
+        secretsBundle: opts.secretsBundle,
+    });
+    await crabboxWaitReady(box.slug, { secretsBundle: opts.secretsBundle });
+    const script = buildBootstrapScript(opts);
+    let exitCode = null;
+    let toreDown = false;
+    try {
+        exitCode = await crabboxRunScript(box.slug, script, {
+            secretsBundle: opts.secretsBundle,
+            onData: opts.onData,
+        });
+    }
+    finally {
+        // Always attempt teardown (bounds credential lifetime to the run) unless the
+        // caller explicitly asked to keep the box.
+        if (!opts.keep)
+            toreDown = crabboxStop(box.slug, { secretsBundle: opts.secretsBundle });
+    }
+    return { box, exitCode, toreDown };
+}

package/dist/lib/crabbox/runtimes.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Runtime detection + picker + credential-script builder for `agents run --lease`.
+ *
+ * The picker asks which coding-agent runtime(s) to provision on a leased box.
+ * The default selection is whatever the user is currently signed into locally
+ * (via `getAccountInfo`, the same source `agents view` uses). The chosen runtimes
+ * drive both what gets installed on the box and which auth token file is copied
+ * over — the token contents ride the uploaded `--script-stdin` body, never argv.
+ *
+ * SECURITY: copying a runtime's auth token to an ephemeral cloud box is a
+ * credential transfer. It is strictly opt-in (a confirm prompt in the command
+ * layer), the token never appears in argv/`ps`, and `--lease` one-shot runs tear
+ * the box down afterward so the credential's lifetime is bounded by the run.
+ */
+import type { AgentId } from '../types.js';
+/**
+ * Credential file locations per runtime. `localCandidates` are read in order
+ * (first existing wins); `remote` is where the box's CLI reads it by default
+ * (home-level — no per-version shim). Source of truth for these paths is
+ * `getAccountInfo` in src/lib/agents.ts; keep them in sync.
+ */
+interface RuntimeCred {
+    id: AgentId;
+    label: string;
+    localCandidates: string[];
+    remote: string;
+}
+export declare const LEASE_RUNTIMES: RuntimeCred[];
+export interface DetectedRuntime {
+    id: AgentId;
+    label: string;
+    email: string | null;
+    signedIn: boolean;
+    /** Absolute local path of the credential file, if found. */
+    credPath: string | null;
+}
+/** Which lease-capable runtimes the user is signed into on this machine. */
+export declare function detectSignedInRuntimes(): Promise<DetectedRuntime[]>;
+/**
+ * Interactive checkbox: which runtimes to provision on the box. Defaults to the
+ * signed-in ones. Runtimes with no local credential are shown disabled.
+ * `prompt` is injected so tests don't require a TTY.
+ */
+export declare function pickRuntimes(detected: DetectedRuntime[], prompt?: (choices: {
+    name: string;
+    value: AgentId;
+    checked: boolean;
+    disabled: boolean | string;
+}[]) => Promise<AgentId[]>): Promise<AgentId[]>;
+/**
+ * Build a bash snippet that writes each picked runtime's token file to the box's
+ * home-level config path (0600), from the token contents read locally. Returns
+ * `''` when no runtimes were selected. The snippet is meant to be embedded in
+ * the `--script-stdin` body (never argv).
+ */
+export declare function buildCredentialScript(picked: AgentId[], detected: DetectedRuntime[]): string;
+export {};