@phnx-labs/agents-cli 1.20.51 → 1.20.52

package/CHANGELOG.md

@@ -2,6 +2,22 @@
 
 ## Unreleased
 
+## 1.20.52
+
+- **Re-pinned the keychain helper to a freshly notarized build carrying the new iCloud verbs.** The #904 session changed `keychain-helper.swift` (legacy iCloud/synchronizable item verbs) and re-pinned the sha, but the notarized binary it pinned lived only in that session's since-removed worktree — the release prepack gate (`verify-keychain-helper.sh`) then failed on every machine (`SHA256 mismatch`) because no reachable `bin/Agents CLI.app` matched the pin. Rebuilt the helper from current source on the release machine (universal, signed, notarized: Gatekeeper `Notarized Developer ID`, submission accepted) and pinned that binary. Same class of fix as #835.
+- **Fix: version-skewed CLI invocations no longer wipe the secrets-agent's hot cache — the recurring Touch ID storm on version-churning machines is closed.** `ensureAgentRunning` tore down a reachable broker whenever the broker's running version differed from the caller's on-disk version — unconditionally, via `launchctl kickstart -k`, wiping every unlocked bundle. On a machine where installed versions churn (dev builds stamp a fresh `0.0.0-dev.<sha>` per install; an npm copy and a dev copy invoke in turn), that meant constant wipes, and the next read of *each* held bundle popped a fresh Touch ID prompt — the exact storm #435 fixed on the server side, reintroduced client-side. The client now accepts a protocol-compatible, version-skewed broker while it holds real unlocks (`shouldTeardownVersionSkewedBroker`); the broker's own sweep still adopts new code at the next quiet moment (store empty), so upgrades land without ever costing a re-prompt. Source: `apps/cli/src/lib/secrets/agent.ts` (`ensureAgentRunning`, `shouldTeardownVersionSkewedBroker`).
+- **Fix: mutating a bundle now evicts the broker-held copy — `rotate` no longer serves the old secret for up to 7 days.** Only `secrets policy` invalidated the secrets-agent after a write; `add`, `rotate`, `remove`, `rename`, `delete`, and `import` updated the keychain while a broker-held snapshot kept serving the pre-write values for the rest of the ~7d hold — a rotated credential silently kept injecting the OLD value into every run. `writeBundle` and `deleteBundle` now evict the bundle from the broker after every mutating write (`agentEvictSync`, a synchronous socket client mirroring the read fast-path), so the next read re-resolves fresh from the keychain (one prompt) and re-caches. The usage-telemetry stamp (`stampLastUsed`, fired on every broker HIT) opts out — evicting there would make the cache destroy itself on first use — and the eviction honors `AGENTS_SECRETS_NO_AGENT` plus the test-backend override so suites never evict a user's real unlocks (`shouldEvictAfterBundleWrite`). The `policy` command's bespoke eviction is superseded by the chokepoint. Source: `apps/cli/src/lib/secrets/bundles.ts` (`writeBundle`, `deleteBundle`, `shouldEvictAfterBundleWrite`), `apps/cli/src/lib/secrets/agent.ts` (`agentEvictSync`), `apps/cli/src/commands/secrets.ts`.
+- **`agents secrets import` gains a unified `--from <source>` and recovers bundles stranded in the iCloud Keychain.** One axis for every source: a .env path (`-` reads stdin), `1password:<vault>` (the boolean `--from-1password --vault <name>` pair still works as a hidden deprecated alias), and the new `icloud`. Bundles created in the pre-biometry era were synced via iCloud Keychain; the device-local cutover pinned every query to `kSecAttrSynchronizable: false`, which orphaned those items — visible in Keychain Access under iCloud, invisible to `secrets list` and `migrate-acl`. `agents secrets import --from icloud` discovers them (bundle metadata *and* bare per-key secret items whose metadata never synced), offers an interactive multi-select (or takes an explicit bundle name for non-interactive use), re-imports them as normal device-local biometry-gated bundles, and with `--purge` deletes the successfully-read iCloud copies (never an unreadable one). `secrets view <name>` on a missing bundle now points at the recovery command when an iCloud copy of that name exists. Three new keychain-helper verbs (`list-synced`, `get-batch-synced`, `delete-synced`) match synchronizable items exclusively, so the live device-local store is untouchable from the recovery path. Source: `apps/cli/src/lib/secrets/icloud-import.ts`, `apps/cli/src/lib/secrets/keychain-helper.swift`, `apps/cli/src/commands/secrets.ts` (`parseImportSource`).
+- **`agents feed` surfaces every top-level agent question that is waiting on the user.** `AskUserQuestion` hooks publish atomic open-block records with the full question and option set, mailbox/session identity, host, and runtime; Task subagents are gated out so their internal questions do not flood the operator view. The command renders those blocks locally or as JSON, forwards across configured hosts, and registers its runtime-managed hook from the CLI-writable user layer without dirtying the auto-pulled system repository. Source: `apps/cli/src/commands/feed.ts`, `apps/cli/src/lib/feed.ts`, runtime labelling in `apps/cli/src/lib/exec.ts` and `apps/cli/src/lib/teams/agents.ts`. (RUSH-1473)
+- **Browser-profile credentials: account identity, `secrets get <bundle> <KEY>`, and `browser type --secret` for leak-free login.** `agents browser profiles logins` now shows, per profile, the account signed into each live service (plaintext username from Chromium `Login Data` — never decrypts the encrypted password) and whether login creds are declared in the profile's secrets bundle (columns `SERVICE | ACCOUNT | CREDS`); `profiles show` gains a `Logins:` block. `agents secrets get <bundle> <KEY>` prints one resolved value from a bundle (arg-count overload of the existing raw `get <item>`; ungated like it, and the `secrets.get` audit event fires inside the resolver). `agents browser type <ref> --secret <bundle>/<KEY>` resolves a credential in-process and types it into the page — the value never crosses stdout or the agent transcript — so an agent can drive a login by composing `profiles logins` → `browser start <loginUrl>` → `refs` → `type --secret` → `screenshot`, handling 2FA/selectors itself (no fragile CLI auto-login engine; Google/X block automation anyway). A profile's `--secrets` bundle is the credential store, keyed by the `<PREFIX>_USERNAME`/`<PREFIX>_PASSWORD` convention (per-service prefixes in `AUTH_SIGNATURES`); `profiles create --secrets` now warns if the bundle doesn't exist yet. Cookie-persistence-first remains the headline (the `browser` skill's credential guidance was corrected — the bundle only injected env vars into the browser process before, inert for web login). Source: `apps/cli/src/lib/browser/login-detection.ts`, `apps/cli/src/lib/browser/secret-ref.ts`, `apps/cli/src/commands/browser.ts`, `apps/cli/src/commands/secrets.ts`.
+- **`agents logs audit` / `agents logs stats` / `agents logs rotate` — user-facing audit trail viewer.** The append-only local event log (`~/.agents/events.jsonl`) is now a first-class audit surface. `agents logs audit` queries events with filters (`--module`, `--command`, `--event`, `--agent`, `--caller`, `--level`, `--since`, `--limit`, `--json`) and `--follow` for live tailing; `agents logs stats` shows aggregate breakdowns by level, event type, module, and user; `agents logs rotate` prunes old numbered archives (`--days`, default 7). Events carry `level` (audit/warn/info/debug) and an environment-derived `caller` (`claude-code`, Factory agent kind, terminal, or script). Sensitive flag values, secret-shaped payload fields, token-like strings, and raw prompts are redacted before append. Security-relevant operations (secrets, teams lifecycle, cloud dispatch) auto-classify as `audit`. At 10 MB the active file rotates losslessly through `events.1.jsonl.gz`, `events.2.jsonl.gz`, and so on; `query()` reads every archive transparently. New instrumentation in `cloud.ts`, `factory.ts`, `teams.ts`, `secrets.ts`, `mcp.ts`, and `rotate.ts`. Source: `apps/cli/src/lib/events.ts`, `apps/cli/src/commands/logs.ts`, instrumentation call sites. (RUSH-460)
+- **`agents run claude --lease` now runs the box logged-in — the Claude OAuth token ships alongside the config.** The lease copied `~/.claude.json` (config/account-metadata) but never the OAuth token, so Claude booted "Not logged in" on every leased box. The token lives in the macOS Keychain (hash-suffixed service for an agents-cli managed home, bare for a default install) and on Linux at `~/.claude/.credentials.json`. `resolveClaudeCredentialsBlob()` now reads the raw wrapped Keychain payload **silently** (`/usr/bin/security … -w` — Claude's item trusts it, no Touch ID): bare service first, then enumerate installed version homes, preferring the account whose email matches the copied config; off-darwin it reuses the existing `.credentials.json` file branch. `buildCredentialScript` writes that blob to `~/.claude/.credentials.json` (0600) via the same quoted-heredoc that carries every other cred (the box's `~/.claude` is a symlink into the versioned home, so it lands exactly where the shim's `CLAUDE_CONFIG_DIR` reads it); it is shredded after the run **regardless of `--keep-box`**. Resolved in the command layer after the existing per-run consent prompt, whose text now names the token explicitly. Scope is Claude-only — Codex/Grok already ship their token in the copied auth file. Verified live on Hetzner: a leased box ran `agents run claude` and returned a real model reply (`LOGIN_OK`, exit 0), and the token file was absent (shredded) afterward. Source: `apps/cli/src/lib/crabbox/runtimes.ts` (`resolveClaudeCredentialsBlob`, `buildCredentialScript`), `apps/cli/src/lib/crabbox/lease.ts`, `apps/cli/src/commands/exec.ts`.
+- **`agents browser profiles set-default <name>` picks the profile a bare `agents browser start` uses — so agents stop opening a logged-out Chrome.** With no `--profile`, `start` used to auto-detect the first installed Chromium-family browser (Chrome first on macOS) and save it as `default`, ignoring a profile you'd actually logged into. Now `start` resolves in order: (1) your configured default, (2) an existing `default` profile, (3) auto-detect. The configured default ALSO re-points an explicit `--profile default`, so an agent that hardcodes `default` still lands on your chosen profile. The setting is **device-local** — stored in `~/.agents/devices/<machine>/agents.yaml`, never synced to other machines (the target profile may hold machine-local logins). `profiles list`/`show` mark it; `set-default --unset` reverts to auto-detect; a missing target warns and falls back rather than hard-failing. Source: `apps/cli/src/lib/browser/profiles.ts` (`ensureDefaultBrowserProfile`, `getConfiguredDefaultProfileName`), `apps/cli/src/lib/state.ts` (`writeMetaUnlocked`, `overlayMachineLocal`), `apps/cli/src/lib/types.ts` (`Meta.defaultBrowserProfile`), `apps/cli/src/commands/browser.ts`.
+- **`agents browser` now warns when a task opens a login-gated site on a logged-out profile — grounded in real session state.** New `apps/cli/src/lib/browser/login-detection.ts` reads a profile's Chromium cookie store (presence only — never decrypts the Keychain-encrypted values, and filters expiry in SQL so Chromium's >2^53 microsecond timestamps never trip `node:sqlite`'s integer range) to tell which login-gated services (LinkedIn, Google, X, GitHub, Reddit) have a live session. `agents browser start --url <login-gated>` prints a stderr hint like `profile "default" has no linkedin.com session. logged in elsewhere: comet-local. try: --profile comet-local` when the chosen profile is logged out; it never blocks or slows start. `agents browser profiles logins` shows a profile-by-service table. Source: `apps/cli/src/lib/browser/login-detection.ts`, `apps/cli/src/commands/browser.ts`.
+- **Fix: a finished session that signed off with a trailing "?" no longer reads as `input_required` forever (RUSH-1522).** The session state engine's prose-question heuristic (last assistant message ends with a question) now decays after 30 minutes without a session write: an unanswered prose question older than that classifies as `idle`, not `waiting_input` — so `agents sessions --active` and the Factory Floor's NEEDS YOU lane stop surfacing long-finished sessions as needing input. The structural signals are exempt and never decay: a genuinely pending `ExitPlanMode` (plan review) or `AskUserQuestion` still classifies as `waiting_input` at any age. Source: `apps/cli/src/lib/session/state.ts` (`inferActivity`, `PROSE_QUESTION_FRESH_MS`).
+- **The post-upgrade "What's new" summary shows the release notes again.** The summary parser only recognized the old changelog format (standalone `**Heading**` lines with sub-bullets); every release since the changelog moved to single-line `- **Title.** prose…` entries rendered as a bare version header with zero bullets, so upgrades looked like they shipped nothing. The parser now extracts the bold heading from both formats (prose still dropped — full notes stay in the changelog). Verified against the real changelog: the 1.20.49 → 1.20.50 range renders all four 1.20.50 entry titles. Source: `apps/cli/src/lib/whats-new.ts`.
+- **Fix: daemon no longer crash-loops when started from the bare `browser` or `computer` shim.** Daemon launch resolution now maps installed sibling shims to the `agents` launcher and compiled shims to `index.js` before generating launchd/systemd commands, and fails clearly if that invariant is broken. Headless auto-start reads the long-lived Claude token only from an already-unlocked secrets-agent snapshot, so it cannot hang on a biometric prompt nobody can answer; an interactive start can still prompt normally. Source: `apps/cli/src/lib/daemon.ts` (`getAgentsBinPath`, `readDaemonClaudeOAuthToken`), `apps/cli/src/lib/secrets/bundles.ts` (`agentOnly`). (RUSH-1527)
+
 ## 1.20.51
 
 - **Fix: `agents run --lease` bootstraps a fresh crabbox image and no longer leaks the box after the run.** Three failures compounded on a stock Hetzner lease (Ubuntu 24.04, no node preinstalled): (1) the bootstrap's `npm install -g @phnx-labs/agents-cli` ran with no node/npm on the box and swallowed the failure with `|| true`, so every run died deep in the script with `agents: command not found` (exit 127) and no hint why; (2) even with the CLI installed, a fresh install refuses `agents run` with "agents-cli is not set up" until `agents setup` has run; (3) teardown called `crabbox stop --id <slug>`, but crabbox's `stop` takes a positional target (unlike `status`/`run`/`ssh`) and died with `flag provided but not defined: -id` — silently, because `crabboxStop` is best-effort — so every one-shot lease box was **kept, billed, and left carrying the run's working data** until someone noticed (`Box … kept` instead of destroyed). The bootstrap now: exports `~/.local/bin` onto PATH, installs node user-level from the official `latest-v22.x` tarball when missing (arch-aware, satisfies `engines.node >=22.5.0`, no sudo needed), points the npm prefix at `~/.local`, fails loud with exit 96 and a diagnostic when the CLI still isn't runnable, and runs `agents setup` behind the same `[ ! -d ~/.agents/.system ]` first-run guard the hosts bootstrap uses; `crabboxStop` passes the slug positionally. Verified live on a fresh Hetzner cpx62 by the run's own progression across builds: the pre-fix lease exited 127 (`agents: command not found`) with `Box … kept`; after the node/npm fix it reached `agents-cli is not set up`; after the setup fix it reached the agent's login check (`Not logged in`); and every post-fix run ends with `Box <slug> destroyed.` instead of leaking. Source: `apps/cli/src/lib/crabbox/lease.ts` (`ENSURE_AGENTS_CLI`, `buildBootstrapScript`), `apps/cli/src/lib/crabbox/cli.ts` (`crabboxStop`). Known follow-up: leasing a **Claude** runtime from a Mac whose Claude Code credential lives in the login Keychain (the default install, and any agents-cli managed home — service name is hash-suffixed) still lands "Not logged in" on the box, because the picker copies `~/.claude.json` (config/state) but not the OAuth token, and extracting the token from the Keychain needs an interactive ACL approval; tracked separately.

package/dist/commands/browser.js

@@ -1,6 +1,10 @@
 import * as fs from 'fs';
 import * as path from 'path';
-import { listProfiles, getProfile, createProfile, deleteProfile, ensureDefaultBrowserProfile, getProfileRuntimeDir, extractConfiguredPort, findFreeProfilePort, getEndpointPresets, } from '../lib/browser/profiles.js';
+import { listProfiles, getProfile, createProfile, deleteProfile, ensureDefaultBrowserProfile, getConfiguredDefaultProfileName, DEFAULT_BROWSER_PROFILE_NAME, getProfileRuntimeDir, extractConfiguredPort, findFreeProfilePort, getEndpointPresets, } from '../lib/browser/profiles.js';
+import { updateMeta } from '../lib/state.js';
+import { loginsForProfile, profilesLoggedInto, serviceForUrl, loginsWithAccountsForProfile, accountsForProfile, credKeysForService, AUTH_SIGNATURES, } from '../lib/browser/login-detection.js';
+import { parseSecretRef } from '../lib/browser/secret-ref.js';
+import { readAndResolveBundleEnv, bundleExists, readBundle, describeBundle } from '../lib/secrets/bundles.js';
 import { findBrowserPath, getPortOccupant, isLauncherScript } from '../lib/browser/chrome.js';
 import { listProfileCacheDirs, removeProfileCache, listAllProfileSnapshots, } from '../lib/browser/runtime-state.js';
 import { DEFAULT_VIEWPORT } from '../lib/browser/devices.js';
@@ -94,6 +98,29 @@ export function registerBrowserSubcommands(program) {
     registerTaskCommands(program);
     registerCommandGroups(program, BROWSER_HELP_GROUPS);
 }
+/**
+ * Whether a profile's secrets bundle holds login creds for `service`
+ * (`<PREFIX>_USERNAME` + `<PREFIX>_PASSWORD`). Reads bundle METADATA only (key
+ * names, never values) so it doesn't decrypt. Returns the bundle name when both
+ * keys exist, '-' when not, or '(unknown)' if the metadata read would prompt or
+ * fails — the view must never block on Touch ID.
+ */
+function credAvailability(bundleName, service) {
+    if (!bundleName)
+        return '-';
+    const keys = credKeysForService(service);
+    if (!keys)
+        return '-';
+    try {
+        if (!bundleExists(bundleName))
+            return '-';
+        const present = new Set(describeBundle(readBundle(bundleName)).map((e) => e.key));
+        return present.has(keys.user) && present.has(keys.pass) ? bundleName : '-';
+    }
+    catch {
+        return '(unknown)';
+    }
+}
 function registerProfilesCommands(browser) {
     const profiles = browser
         .command('profiles')
@@ -109,6 +136,10 @@ function registerProfilesCommands(browser) {
             console.log('Create one with: agents browser profiles create <name> --endpoint <url>');
             return;
         }
+        // The configured default is what a bare `agents browser start` (and an
+        // explicit `--profile default`) resolves to on THIS machine — mark it.
+        const configuredDefault = getConfiguredDefaultProfileName();
+        const marker = (name) => (name === configuredDefault ? '   (default)' : '');
         const hasDescriptions = allProfiles.some(p => p.description);
         if (hasDescriptions) {
             console.log('NAME'.padEnd(20) + 'BROWSER'.padEnd(12) + 'DESCRIPTION'.padEnd(38) + 'ENDPOINTS');
@@ -119,7 +150,7 @@ function registerProfilesCommands(browser) {
                     .map(([name, ep]) => (name.startsWith('endpoint-') ? ep.target : `${name}=${ep.target}`))
                     .join(', ');
                 const desc = (p.description ?? '').slice(0, 36).padEnd(38);
-                console.log(p.name.padEnd(20) + (p.browser || '-').padEnd(12) + desc + endpoints);
+                console.log(p.name.padEnd(20) + (p.browser || '-').padEnd(12) + desc + endpoints + marker(p.name));
             }
         }
         else {
@@ -130,7 +161,78 @@ function registerProfilesCommands(browser) {
                 const endpoints = Object.entries(presets)
                     .map(([name, ep]) => (name.startsWith('endpoint-') ? ep.target : `${name}=${ep.target}`))
                     .join(', ');
-                console.log(p.name.padEnd(20) + (p.browser || '-').padEnd(12) + endpoints);
+                console.log(p.name.padEnd(20) + (p.browser || '-').padEnd(12) + endpoints + marker(p.name));
+            }
+        }
+        if (configuredDefault) {
+            console.log('');
+            console.log(`Default profile (this machine): ${configuredDefault}`);
+        }
+    });
+    profiles
+        .command('set-default [name]')
+        .description('Set the profile `agents browser start` uses when no --profile is passed (also re-points an explicit `--profile default`). Device-local — each machine has its own. No name prints the current value.')
+        .option('--unset', 'Clear the configured default (revert to auto-detecting an installed browser)')
+        .action(async (name, opts) => {
+        if (opts.unset) {
+            updateMeta((m) => {
+                const { defaultBrowserProfile, ...rest } = m;
+                void defaultBrowserProfile;
+                return rest;
+            });
+            console.log('Default browser profile cleared. `agents browser start` will auto-detect an installed Chromium-family browser.');
+            return;
+        }
+        if (!name) {
+            const current = getConfiguredDefaultProfileName();
+            if (current) {
+                console.log(`Default browser profile (this machine): ${current}`);
+            }
+            else {
+                console.log('No default browser profile set. `agents browser start` auto-detects an installed Chromium-family browser.');
+                console.log('Set one with: agents browser profiles set-default <name>');
+            }
+            return;
+        }
+        const target = await getProfile(name);
+        if (!target) {
+            console.error(`Profile "${name}" not found.`);
+            const all = await listProfiles();
+            if (all.length > 0)
+                console.error(`Available profiles: ${all.map((p) => p.name).join(', ')}`);
+            process.exit(1);
+        }
+        updateMeta((m) => ({ ...m, defaultBrowserProfile: name }));
+        const eps = getEndpointPresets(target);
+        const epStr = Object.values(eps)[0]?.target ?? '';
+        console.log(`Default browser profile (this machine) is now "${name}" (${target.browser}${epStr ? `, ${epStr}` : ''}).`);
+        console.log('Bare `agents browser start` and `--profile default` will use it.');
+    });
+    profiles
+        .command('logins')
+        .description('Show which login-gated services each profile has a live session for, the account signed in, and whether login creds are available in the profile\'s secrets bundle (reads cookie/username presence only, never decrypts).')
+        .action(async () => {
+        const allProfiles = await listProfiles();
+        if (allProfiles.length === 0) {
+            console.log('No browser profiles configured.');
+            return;
+        }
+        console.log('PROFILE'.padEnd(20) + 'SERVICE'.padEnd(12) + 'ACCOUNT'.padEnd(32) + 'CREDS');
+        console.log('-'.repeat(80));
+        for (const p of allProfiles) {
+            const rows = await loginsWithAccountsForProfile(p.name);
+            if (rows.length === 0) {
+                console.log(p.name.padEnd(20) + '(none detected)');
+                continue;
+            }
+            let first = true;
+            for (const r of rows) {
+                const name = first ? p.name : '';
+                console.log(name.padEnd(20) +
+                    r.service.padEnd(12) +
+                    (r.username ?? '(unknown)').padEnd(32) +
+                    credAvailability(p.secrets, r.service));
+                first = false;
             }
         }
     });
@@ -220,6 +322,11 @@ function registerProfilesCommands(browser) {
         };
         await createProfile(profile);
         console.log(`Created profile: ${name}`);
+        // Warn (don't fail) if the declared secrets bundle doesn't exist yet — it
+        // may be created later, but a typo should surface now.
+        if (opts.secrets && !bundleExists(opts.secrets)) {
+            console.error(`warning: secrets bundle "${opts.secrets}" does not exist yet. Create it with: agents secrets create ${opts.secrets}`);
+        }
     });
     profiles
         .command('show <name>')
@@ -242,6 +349,9 @@ function registerProfilesCommands(browser) {
         }
         console.log(`Name: ${profile.name}`);
         console.log(`Browser: ${profile.browser}`);
+        if (getConfiguredDefaultProfileName() === profile.name) {
+            console.log('Default: yes (this machine — used by `agents browser start`)');
+        }
         if (profile.binary)
             console.log(`Binary: ${profile.binary}`);
         if (profile.electron)
@@ -273,6 +383,27 @@ function registerProfilesCommands(browser) {
             console.log(`Secrets: ${profile.secrets}`);
         if (profile.chrome?.headless)
             console.log(`Headless: true`);
+        // Login state per known service: live session + account identity + whether
+        // login creds are declared in the profile's secrets bundle.
+        const active = await loginsForProfile(profile.name);
+        const accounts = await accountsForProfile(profile.name);
+        const lines = [];
+        for (const service of Object.keys(AUTH_SIGNATURES)) {
+            const isActive = active.includes(service);
+            const creds = credAvailability(profile.secrets, service);
+            if (!isActive && creds === '-')
+                continue; // nothing interesting to show
+            const status = isActive
+                ? `logged in${accounts[service] ? ` as ${accounts[service]}` : ''}`
+                : 'logged out';
+            const credNote = creds !== '-' ? `  creds: ${creds}` : '';
+            lines.push(`  ${service.padEnd(10)} ${status}${credNote}`);
+        }
+        if (lines.length > 0) {
+            console.log('Logins:');
+            for (const l of lines)
+                console.log(l);
+        }
     });
     profiles
         .command('delete <name>')
@@ -302,6 +433,10 @@ function registerProfilesCommands(browser) {
         }
         console.log(`Deleted profile: ${name}` +
             (removed > 0 ? ` (and ${removed} cache dir${removed === 1 ? '' : 's'})` : ''));
+        if (getConfiguredDefaultProfileName() === name) {
+            console.error(`warning: "${name}" was this machine's default browser profile; ` +
+                `\`agents browser start\` will auto-detect until you run: agents browser profiles set-default <name>`);
+        }
     });
     profiles
         .command('doctor <name>')
@@ -475,8 +610,8 @@ function registerProfilesCommands(browser) {
 function registerTaskCommands(browser) {
     browser
         .command('start')
-        .description('Start a browser task. Pass --profile <name>, or omit to auto-pick a Chromium-family browser already installed on this machine.')
-        .option('-p, --profile <name>', 'Browser profile to use (auto-picks from installed Chromium-family browsers if omitted)')
+        .description('Start a browser task. Pass --profile <name>; omit to use your configured default (`agents browser profiles set-default`), else auto-pick an installed Chromium-family browser.')
+        .option('-p, --profile <name>', 'Browser profile to use (omit to use the configured default, else auto-pick an installed Chromium-family browser)')
         .option(TASK_OPTION_FLAG, 'Task name (auto-generated if omitted)')
         .option('-e, --endpoint <name>', 'Endpoint preset (defaults to the profile\'s default)')
         .option('-u, --url <url>', 'Open URL in first tab')
@@ -497,6 +632,23 @@ function registerTaskCommands(browser) {
                 process.exit(1);
             }
         }
+        else if (profileName === DEFAULT_BROWSER_PROFILE_NAME) {
+            // Explicit `--profile default` honors the configured default too, so an
+            // agent that hardcodes the reserved `default` name still lands on the
+            // user's chosen profile (e.g. their logged-in Comet) rather than a
+            // literal `default` (which auto-detects Chrome). Narrowly scoped: only
+            // the reserved name, only here in `start`.
+            const configured = getConfiguredDefaultProfileName();
+            if (configured && configured !== DEFAULT_BROWSER_PROFILE_NAME) {
+                const target = await getProfile(configured);
+                if (target) {
+                    profileName = target.name;
+                }
+                else {
+                    console.error(`warning: configured default profile "${configured}" not found; using "${DEFAULT_BROWSER_PROFILE_NAME}".`);
+                }
+            }
+        }
         // Pre-check the profile locally so we fail fast with a helpful error
         // instead of round-tripping a generic "Profile not found" through the daemon.
         const profile = await getProfile(profileName);
@@ -518,6 +670,26 @@ function registerTaskCommands(browser) {
                 process.exit(1);
             }
         }
+        // Grounded login guardrail: if the opening URL is a known login-gated
+        // service and the resolved profile has no session for it, say so on stderr
+        // and name a profile that IS logged in. Reads the profile's real cookie DB
+        // (presence only) — never blocks or slows start; any failure is silent.
+        if (opts.url) {
+            try {
+                const service = serviceForUrl(opts.url);
+                if (service) {
+                    const here = await loginsForProfile(profileName);
+                    if (!here.includes(service)) {
+                        const elsewhere = (await profilesLoggedInto(service)).filter((p) => p !== profileName);
+                        const hint = elsewhere.length
+                            ? `logged in elsewhere: ${elsewhere.join(', ')}. try: --profile ${elsewhere[0]}`
+                            : `no profile on this machine has a ${service} session.`;
+                        console.error(`warning: profile "${profileName}" (${profile.browser}) has no ${service} session. ${hint}`);
+                    }
+                }
+            }
+            catch { /* login detection is best-effort; never block start */ }
+        }
         const response = await sendIPCRequest({
             action: 'start',
             profile: profileName,
@@ -1219,7 +1391,8 @@ function registerTaskCommands(browser) {
         .description('Type text into an element by ref')
         .option(TASK_OPTION_FLAG, TASK_OPTION_DESC)
         .option('-t, --tab <tabId>', 'Tab ID (defaults to current)')
-        .requiredOption('--text <text>', 'Text to type (use quotes for spaces/special chars)')
+        .option('--text <text>', 'Text to type (use quotes for spaces/special chars)')
+        .option('--secret <ref>', 'Resolve <bundle>/<KEY> from `agents secrets` and type the value. The secret is resolved in-process and never printed to stdout or the transcript. Alternative to --text.')
         .option('--clear', 'Clear editor content before typing')
         .action(async (ref, opts) => {
         const task = resolveTaskName(opts);
@@ -1228,18 +1401,53 @@ function registerTaskCommands(browser) {
             console.error(`<ref> must be an integer, got: ${ref}`);
             process.exit(1);
         }
+        // Resolve the text to type: literal --text, or a --secret <bundle>/<KEY>
+        // reference resolved in-process so the value never crosses stdout/transcript.
+        let text = opts.text;
+        if (opts.secret) {
+            if (opts.text !== undefined) {
+                console.error('Pass either --text or --secret, not both.');
+                process.exit(1);
+            }
+            const parsed = parseSecretRef(opts.secret);
+            if (!parsed) {
+                console.error(`--secret must be <bundle>/<KEY>, got: ${opts.secret}`);
+                process.exit(1);
+            }
+            if (!bundleExists(parsed.bundle)) {
+                console.error(`Secrets bundle "${parsed.bundle}" not found.`);
+                process.exit(1);
+            }
+            try {
+                const { env } = readAndResolveBundleEnv(parsed.bundle, { caller: 'browser type', keys: [parsed.key] });
+                if (!(parsed.key in env)) {
+                    console.error(`Key "${parsed.key}" not in bundle "${parsed.bundle}".`);
+                    process.exit(1);
+                }
+                text = env[parsed.key];
+            }
+            catch (err) {
+                console.error(err.message);
+                process.exit(1);
+            }
+        }
+        if (text === undefined) {
+            console.error('Provide --text <text> or --secret <bundle>/<KEY>.');
+            process.exit(1);
+        }
         const response = await sendIPCRequest({
             action: 'type',
             task,
             tabId: opts.tab,
             ref: refNum,
-            text: opts.text,
+            text,
             clear: opts.clear,
         });
         if (!response.ok) {
             console.error(response.error);
             process.exit(1);
         }
+        // Never echo the typed text — with --secret it would leak the credential.
         console.log('Typed');
     });
     browser

package/dist/commands/cloud.js

@@ -8,6 +8,7 @@ import { insertTask, updateTaskStatus, getTaskById, listTasks as listStoredTasks
 import { renderStream } from '../lib/cloud/stream.js';
 import { MissingTargetError, MAX_IMAGES_PER_DISPATCH } from '../lib/cloud/types.js';
 import { normalizeTriggerEvent, validateTrigger, writeJob, jobExists, GITHUB_TRIGGER_EVENTS } from '../lib/routines.js';
+import { emit } from '../lib/events.js';
 /** Map a supported image file extension to its wire mimeType. Rejects anything else. */
 function imageMimeFromPath(file) {
     const ext = path.extname(file).toLowerCase();
@@ -346,6 +347,7 @@ Examples:
         }
         // Persist locally
         insertTask(task);
+        emit('cloud.dispatch', { module: 'cloud', taskId: task.id, agent: task.agent, provider: task.provider, status: task.status });
         if (json) {
             process.stdout.write(JSON.stringify(task) + '\n');
         }
@@ -371,6 +373,7 @@ Examples:
                 summary: result.summary,
                 prUrl: result.prUrl,
             });
+            emit('cloud.complete', { module: 'cloud', taskId: task.id, status: result.status, prUrl: result.prUrl });
             if (gated?.gate.breached()) {
                 const b = gated.gate.breach();
                 process.stderr.write(`[budget] cap ${b?.cap} exceeded — cancelled cloud task ${task.id}\n`);
@@ -533,6 +536,7 @@ Examples:
                 summary: result.summary,
                 prUrl: result.prUrl,
             });
+            emit('cloud.complete', { module: 'cloud', taskId: id, status: result.status, prUrl: result.prUrl });
             if (gated?.gate.breached()) {
                 process.exitCode = 7;
             }
@@ -553,6 +557,7 @@ Examples:
         try {
             await provider.cancel(id);
             updateTaskStatus(id, 'cancelled');
+            emit('cloud.cancel', { module: 'cloud', taskId: id, provider: task.provider });
             console.log(chalk.green(`Task ${id} cancelled.`));
         }
         catch (err) {
@@ -571,6 +576,7 @@ Examples:
         try {
             await provider.message(id, text);
             updateTaskStatus(id, 'running');
+            emit('cloud.message', { module: 'cloud', taskId: id });
             console.log(chalk.green(`Message sent to task ${id}. Agent is continuing.`));
         }
         catch (err) {

package/dist/commands/events.d.ts

@@ -1,7 +1,7 @@
 /**
  * `agents events` — read the structured audit/event log.
  *
- * The event log (`~/.agents/.cache/logs/events-YYYY-MM-DD.jsonl`) records every
+ * The event log (`~/.agents/events.jsonl`) records every
  * `agents <module> <cmd>` invocation plus richer typed events (secrets access,
  * version installs, ...), each stamped with who ran it and from where (OS user,
  * local vs SSH, remote client IP). This command reads it back — the audit trail

package/dist/commands/events.js

@@ -1,7 +1,7 @@
 /**
  * `agents events` — read the structured audit/event log.
  *
- * The event log (`~/.agents/.cache/logs/events-YYYY-MM-DD.jsonl`) records every
+ * The event log (`~/.agents/events.jsonl`) records every
  * `agents <module> <cmd>` invocation plus richer typed events (secrets access,
  * version installs, ...), each stamped with who ran it and from where (OS user,
  * local vs SSH, remote client IP). This command reads it back — the audit trail
@@ -125,8 +125,7 @@ function collect(value, previous) {
 }
 /** Tail today's event file, printing new lines as they land. */
 async function followLog() {
-    const today = new Date();
-    const file = `${getLogsPath()}/events-${today.getFullYear()}-${String(today.getMonth() + 1).padStart(2, '0')}-${String(today.getDate()).padStart(2, '0')}.jsonl`;
+    const file = getLogsPath();
     let offset = 0;
     try {
         offset = fs.statSync(file).size;

package/dist/commands/exec.js

@@ -327,7 +327,7 @@ export function registerRunCommand(program) {
                 process.exit(1);
             }
             const backend = typeof options.lease === 'string' ? options.lease : undefined;
-            const { detectSignedInRuntimes, pickRuntimes } = await import('../lib/crabbox/runtimes.js');
+            const { detectSignedInRuntimes, pickRuntimes, resolveClaudeCredentialsBlob } = await import('../lib/crabbox/runtimes.js');
             const { leaseAndRun } = await import('../lib/crabbox/lease.js');
             const { confirm } = await import('@inquirer/prompts');
             const detected = await detectSignedInRuntimes();
@@ -344,14 +344,28 @@ export function registerRunCommand(program) {
                 return `${d?.label ?? id}${d?.email ? ` (${d.email})` : ''}`;
             })
                 .join(', ');
+            // Claude ships its OAuth token (not just the .claude.json config) — name it
+            // explicitly so the consent covers the actual credential transferred.
+            const whatShips = runtimes.includes('claude') ? 'credentials + Claude OAuth token' : 'credentials';
             const ok = await confirm({
-                message: `Copy credentials for ${names} to a disposable cloud box, run there, then destroy it?`,
+                message: `Copy ${whatShips} for ${names} to a disposable cloud box, run there, then destroy it?`,
                 default: false,
             });
             if (!ok) {
                 console.error(chalk.yellow('Aborted — no credentials pushed, no box leased.'));
                 process.exit(1);
             }
+            // Read the Claude OAuth token from the local Keychain (silent) so it can be
+            // written to ~/.claude/.credentials.json on the box — otherwise Claude boots
+            // "Not logged in". Consent above already covered this transfer.
+            let claudeCredentialsJson = null;
+            if (runtimes.includes('claude')) {
+                const claudeEmail = detected.find((d) => d.id === 'claude')?.email ?? null;
+                claudeCredentialsJson = await resolveClaudeCredentialsBlob({ preferEmail: claudeEmail });
+                if (!claudeCredentialsJson) {
+                    console.error(chalk.yellow('Warning: could not read the local Claude OAuth token — the box may come up "Not logged in".'));
+                }
+            }
             try {
                 const { exitCode, box, toreDown } = await leaseAndRun({
                     agent: agentSpec.split('@')[0],
@@ -361,6 +375,7 @@ export function registerRunCommand(program) {
                     backend,
                     runtimes,
                     detected,
+                    claudeCredentialsJson,
                     secretsBundle: process.env.AGENTS_LEASE_SECRETS_BUNDLE,
                     keep: options.keepBox,
                 });

package/dist/commands/factory.js

@@ -5,6 +5,7 @@ import * as path from 'path';
 import { homedir } from 'os';
 import { betaEnableHint, isBetaEnabled } from '../lib/beta.js';
 import { insertTask } from '../lib/cloud/store.js';
+import { emit } from '../lib/events.js';
 function requireFactoryUrl() {
     const url = process.env.FACTORY_FLOOR_URL;
     if (!url) {
@@ -79,6 +80,13 @@ Examples:
             createdAt: now,
             updatedAt: now,
         });
+        emit('cloud.dispatch', {
+            module: 'factory',
+            taskId: result.cloud_execution_id,
+            ref,
+            linear_identifier: result.linear_identifier,
+            status: 'queued',
+        });
         console.log(chalk.green(`Submitted ${result.linear_identifier} (${result.label})`));
         console.log(`  ticket       ${result.ticket_id}`);
         console.log(`  execution    ${result.cloud_execution_id}`);

package/dist/commands/feed.d.ts

@@ -0,0 +1,9 @@
+/**
+ * `agents feed` -- list open blocks (decisions agents are waiting on).
+ *
+ * Aggregates block records from the local feed store and, with --host, from
+ * reachable remote hosts via SSH passthrough. Each block carries enough
+ * identity for `agents message` to route a reply back to the right agent.
+ */
+import type { Command } from 'commander';
+export declare function registerFeedCommand(program: Command): void;

package/dist/commands/feed.js

@@ -0,0 +1,69 @@
+import chalk from 'chalk';
+import { ensureFeedPublishHook, listBlocks } from '../lib/feed.js';
+import { machineId } from '../lib/machine-id.js';
+import { relTime } from '../lib/format.js';
+function renderBlock(b, localHost) {
+    const host = b.host !== localHost ? chalk.yellow(` [${b.host}]`) : '';
+    const runtime = chalk.gray(b.runtime);
+    const age = chalk.gray(relTime(b.ts));
+    console.log(`${chalk.cyan(b.mailboxId)}${host}  ${runtime}  ${age}`);
+    for (const question of b.questions) {
+        const header = question.header ? chalk.gray(`[${question.header}] `) : '';
+        console.log(`  ${header}${question.text}`);
+        if (question.options?.length) {
+            for (let i = 0; i < question.options.length; i++) {
+                const o = question.options[i];
+                const desc = o.description ? chalk.gray(` -- ${o.description}`) : '';
+                console.log(`    ${chalk.dim(`${i + 1}.`)} ${o.label}${desc}`);
+            }
+        }
+    }
+    if (b.ticket || b.pr) {
+        const meta = [b.ticket, b.pr].filter(Boolean).join('  ');
+        console.log(`  ${chalk.gray(meta)}`);
+    }
+    console.log(`  ${chalk.dim('reply:')} agents message ${b.mailboxId} "<answer>"`);
+    console.log();
+}
+export function registerFeedCommand(program) {
+    program
+        .command('feed')
+        .description('List open blocks -- decisions agents are waiting on')
+        .option('--json', 'Output as JSON')
+        .action(async (opts) => {
+        const setupWarnings = [];
+        const hookInstall = ensureFeedPublishHook();
+        if (hookInstall.error) {
+            setupWarnings.push(hookInstall.error);
+        }
+        else {
+            const [{ iterHooksCapableVersions, parseHookManifest, registerHooksToSettings }, { getVersionHomePath }] = await Promise.all([
+                import('../lib/hooks.js'),
+                import('../lib/versions.js'),
+            ]);
+            const manifest = parseHookManifest({ warn: false });
+            for (const { agent, version } of iterHooksCapableVersions({ agent: 'claude' })) {
+                const result = registerHooksToSettings(agent, getVersionHomePath(agent, version), manifest);
+                if (result.errors.length > 0) {
+                    setupWarnings.push(`${agent}@${version}: ${result.errors.join('; ')}`);
+                }
+            }
+        }
+        const blocks = listBlocks();
+        for (const warning of setupWarnings) {
+            console.error(chalk.yellow(`Feed hook setup warning: ${warning}`));
+        }
+        if (opts.json) {
+            console.log(JSON.stringify(blocks, null, 2));
+            return;
+        }
+        if (blocks.length === 0) {
+            console.log(chalk.gray('No open blocks.'));
+            return;
+        }
+        const local = machineId();
+        console.log(chalk.bold(`${blocks.length} open block${blocks.length === 1 ? '' : 's'}:\n`));
+        for (const b of blocks)
+            renderBlock(b, local);
+    });
+}

package/dist/commands/logs.d.ts

@@ -1,10 +1,14 @@
 /**
- * `agents logs` — unified, discoverable run-log viewer.
+ * `agents logs` — unified, discoverable run-log viewer + audit trail.
  *
  * Resolves a run across two substrates and shows (or `-f` follows) its log:
  *  - host-dispatch tasks (`agents run --host`) → combined-stdout log, offset-tailed
  *  - sessions (the local index) → transcript, tailed via the sessions tailer
  *
+ * Subcommands:
+ *  - `agents logs audit` — read the structured audit/event log
+ *  - `agents logs stats` — show aggregate audit statistics
+ *
  * Concise by default: a bare `agents logs <id>` prints the same summary digest as
  * `agents sessions <id>` — cheap for an agent to glance at. The token-heavy full
  * transcript / raw stdout is opt-in behind `--full` (alias `-m/--markdown`).