@phnx-labs/agents-cli 1.20.51 → 1.20.52

package/dist/commands/teams.js

@@ -5,6 +5,7 @@ import { addHostOption } from '../lib/hosts/option.js';
 import * as path from 'path';
 import { AgentManager, checkCliSignedIn, collectTeamsDoctorData, getAgentsDir, VALID_TASK_TYPES, } from '../lib/teams/agents.js';
 import { resolveProvider } from '../lib/cloud/registry.js';
+import { emit } from '../lib/events.js';
 import { runSupervisor } from '../lib/teams/supervisor.js';
 import { debug } from '../lib/teams/debug.js';
 import { runPrWatch, DEFAULT_MAX_WAVES, } from '../lib/teams/pr-watch.js';
@@ -1317,6 +1318,7 @@ export function registerTeamsCommands(program) {
         }
         try {
             const result = await handleSpawn(mgr, team, agent, effectiveTask, cwd, opts.mode, opts.effort, null, cwd, version, opts.name ?? null, after, opts.model ?? null, envOverrides ?? null, taskType, cloudProviderId, cloudSessionId, opts.repo ?? null, opts.branch ?? null, worktreeName, worktreePath, profileName, hostName, hostTarget, hostRepoPath);
+            emit('teams.add', { module: 'teams', team, agent, name: result.name, agent_id: result.agent_id, status: result.status });
             if (isJsonMode(opts)) {
                 console.log(JSON.stringify(result, null, 2));
                 return;
@@ -1487,6 +1489,7 @@ export function registerTeamsCommands(program) {
             await warnUnsignedTeammates(mgr, team);
             await warnThrottledTeammates(mgr, team);
         }
+        emit('teams.start', { module: 'teams', team, watch: Boolean(opts.watch) });
         if (!opts.watch) {
             await runOneWave(mgr, team, Boolean(opts.json));
             return;
@@ -1526,6 +1529,7 @@ export function registerTeamsCommands(program) {
             },
         });
         const elapsed = Math.floor(result.elapsed_ms / 1000);
+        emit('teams.complete', { module: 'teams', team, stoppedBy: result.stoppedBy, waves: result.waves, durationMs: result.elapsed_ms });
         if (result.stoppedBy === 'drained') {
             console.log(chalk.green(`Factory drained in ${elapsed}s (${result.waves} waves).`));
         }

package/dist/index.js

@@ -50,7 +50,7 @@ if (IS_DEV_BUILD) {
 // module on each invocation (which loaded the whole ~50-module tree before the
 // first byte of output), the registry maps a command name to a thunk that
 // imports only what that command needs. See src/lib/startup/command-registry.ts.
-import { COMMAND_LOADERS, LAZY_COMMAND_NAMES, loadView, loadInspect, loadFeedback, loadCommands, loadHooks, loadSkills, loadRules, loadPermissions, loadMcp, loadCli, loadSubagents, loadPlugins, loadWorkflows, loadWorktree, loadVersions, loadImport, loadPackages, loadDaemon, loadRoutines, loadRun, loadDefaults, loadModels, loadPrune, loadTrash, loadRestore, loadDoctor, loadCheck, loadStatus, loadProfiles, loadSecrets, loadWallet, loadHelper, loadMenubar, loadBeta, loadSync, loadLock, loadRefreshRules, loadDrive, loadFactory, loadUsage, loadCost, loadBudget, loadAlias, loadPty, loadTmux, loadWatchdog, loadBrowser, loadComputer, loadHosts, loadLogs, loadEvents, loadAudit, loadSsh, loadPull, loadPush, loadRepo, loadSetup, } from './lib/startup/command-registry.js';
+import { COMMAND_LOADERS, LAZY_COMMAND_NAMES, loadView, loadInspect, loadFeedback, loadCommands, loadHooks, loadSkills, loadRules, loadPermissions, loadMcp, loadCli, loadSubagents, loadPlugins, loadWorkflows, loadWorktree, loadVersions, loadImport, loadPackages, loadDaemon, loadRoutines, loadRun, loadDefaults, loadModels, loadPrune, loadTrash, loadRestore, loadDoctor, loadCheck, loadStatus, loadProfiles, loadSecrets, loadWallet, loadHelper, loadMenubar, loadBeta, loadSync, loadLock, loadRefreshRules, loadDrive, loadFactory, loadUsage, loadCost, loadBudget, loadAlias, loadPty, loadTmux, loadWatchdog, loadBrowser, loadComputer, loadHosts, loadLogs, loadEvents, loadAudit, loadSsh, loadPull, loadPush, loadRepo, loadSetup, loadFeed, } from './lib/startup/command-registry.js';
 import { applyGlobalHelpConventions } from './lib/help.js';
 import { renderWhatsNew } from './lib/whats-new.js';
 import { emit, redactArgs } from './lib/events.js';
@@ -101,7 +101,10 @@ program.hook('preAction', (_thisCommand, actionCommand) => {
         emit('command.start', {
             module: parts[0],
             command: parts.join(' '),
-            args: redactArgs(actionCommand.args),
+            // Commander exposes positional operands in actionCommand.args but omits
+            // parsed option values. Audit the real argv so sensitive flags are seen
+            // and redacted instead of silently bypassing the policy.
+            args: redactArgs(process.argv.slice(2, 22)),
             cwd: process.cwd(),
         });
     }
@@ -704,6 +707,7 @@ async function registerAllEagerCommands() {
     await reg(loadLogs);
     await reg(loadEvents);
     await reg(loadAudit);
+    await reg(loadFeed);
     await reg(loadSsh);
     registerJobsCronAliasCommand(program, 'jobs');
     registerJobsCronAliasCommand(program, 'cron');

package/dist/lib/browser/login-detection.d.ts

@@ -0,0 +1,94 @@
+/**
+ * Best-effort login-state detection for browser profiles.
+ *
+ * Reads a profile's Chromium cookie store (presence only — never decrypts the
+ * Keychain-encrypted values) to tell which login-gated services have a live
+ * session in that profile. Powers the `agents browser start` guardrail (warn
+ * when an agent opens a logged-out profile for a login-gated URL) and the
+ * `agents browser profiles logins` view.
+ *
+ * Everything here is advisory: any failure (missing DB, locked file, unknown
+ * schema) degrades to "no known session" and NEVER throws to callers — browser
+ * start must not slow down or break because cookie inspection hiccuped.
+ */
+/** A login-gated service signature: host substrings + the auth-cookie names
+ *  whose presence indicates a live session, plus optional login metadata. */
+interface ServiceSignature {
+    hosts: string[];
+    cookies: string[];
+    /**
+     * Where an interactive login for this service starts, and the bundle key
+     * PREFIX its credentials live under. By convention a profile's `--secrets`
+     * bundle holds `<PREFIX>_USERNAME` / `<PREFIX>_PASSWORD` (see
+     * `credKeysForService`). The prefix is explicit — never string-munged from the
+     * service id — so e.g. `x` → `X`, `google` → `GOOGLE`.
+     */
+    login?: {
+        loginUrl: string;
+        keyPrefix: string;
+    };
+}
+/**
+ * Known login-gated services. Presence of ANY listed cookie on a matching host
+ * (unexpired, or a session cookie) = logged in. Deliberately conservative: a
+ * service absent from this map simply never triggers a warning — we do not
+ * guess. Each cookie name here is the definitive authenticated-session token for
+ * that service (e.g. LinkedIn's `li_at` is only set for a signed-in member;
+ * visitor cookies like `bcookie`/`JSESSIONID` are NOT auth). Services whose
+ * session is not reliably expressed as a recognizable cookie (e.g. Attio, whose
+ * only same-site cookies are third-party analytics) are deliberately omitted so
+ * we never emit a false "logged out" warning. Extend as needed.
+ */
+export declare const AUTH_SIGNATURES: Record<string, ServiceSignature>;
+/**
+ * The bundle keys a profile's `--secrets` bundle should hold to log into
+ * `service`: `<PREFIX>_USERNAME` / `<PREFIX>_PASSWORD`. Null for services with no
+ * login metadata. Feed a resolved value to the page with
+ * `agents browser type <ref> --secret <bundle>/<KEY>` (never printed).
+ */
+export declare function credKeysForService(service: string): {
+    user: string;
+    pass: string;
+} | null;
+/** The interactive login URL for a service, or null. */
+export declare function loginUrlForService(service: string): string | null;
+export interface CookieRow {
+    host_key: string;
+    name: string;
+}
+/**
+ * Pure core: given a profile's (already expiry-filtered) cookie rows, return the
+ * services with a live session. Exported for direct unit testing without disk.
+ */
+export declare function detectServices(rows: CookieRow[]): string[];
+/** Map a URL to a known login-gated service key, or null. */
+export declare function serviceForUrl(url: string): string | null;
+/** A saved-login row from Chromium `Login Data` (username plaintext; password
+ *  encrypted and never read). */
+export interface LoginRow {
+    origin_url: string;
+    username_value: string;
+    signon_realm: string;
+}
+/**
+ * Map a profile's saved logins to service → account username (identity, not
+ * session). Best-effort; `{}` if `Login Data` is unreadable. The first non-empty
+ * username per service wins.
+ */
+export declare function accountsForProfile(profileName: string): Promise<Record<string, string>>;
+/**
+ * For each service with a LIVE session in the profile (cookie-gated), the
+ * account it is signed in as (from saved logins). Intersecting with live
+ * sessions means a stale saved-login for a service you've since logged out of
+ * never shows.
+ */
+export declare function loginsWithAccountsForProfile(profileName: string): Promise<Array<{
+    service: string;
+    username?: string;
+}>>;
+/** Services with a live session in the given profile (best-effort; [] if none
+ *  detected or the cookie store is unreadable). */
+export declare function loginsForProfile(profileName: string): Promise<string[]>;
+/** Profile names that have a live session for the given service. */
+export declare function profilesLoggedInto(service: string): Promise<string[]>;
+export {};

package/dist/lib/browser/login-detection.js

@@ -0,0 +1,274 @@
+/**
+ * Best-effort login-state detection for browser profiles.
+ *
+ * Reads a profile's Chromium cookie store (presence only — never decrypts the
+ * Keychain-encrypted values) to tell which login-gated services have a live
+ * session in that profile. Powers the `agents browser start` guardrail (warn
+ * when an agent opens a logged-out profile for a login-gated URL) and the
+ * `agents browser profiles logins` view.
+ *
+ * Everything here is advisory: any failure (missing DB, locked file, unknown
+ * schema) degrades to "no known session" and NEVER throws to callers — browser
+ * start must not slow down or break because cookie inspection hiccuped.
+ */
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+import Database from '../sqlite.js';
+import { getBrowserRuntimeDir, listProfiles } from './profiles.js';
+/**
+ * Known login-gated services. Presence of ANY listed cookie on a matching host
+ * (unexpired, or a session cookie) = logged in. Deliberately conservative: a
+ * service absent from this map simply never triggers a warning — we do not
+ * guess. Each cookie name here is the definitive authenticated-session token for
+ * that service (e.g. LinkedIn's `li_at` is only set for a signed-in member;
+ * visitor cookies like `bcookie`/`JSESSIONID` are NOT auth). Services whose
+ * session is not reliably expressed as a recognizable cookie (e.g. Attio, whose
+ * only same-site cookies are third-party analytics) are deliberately omitted so
+ * we never emit a false "logged out" warning. Extend as needed.
+ */
+export const AUTH_SIGNATURES = {
+    linkedin: {
+        hosts: ['linkedin.com'],
+        cookies: ['li_at'],
+        login: { loginUrl: 'https://www.linkedin.com/login', keyPrefix: 'LINKEDIN' },
+    },
+    google: {
+        hosts: ['google.com'],
+        cookies: ['SID', 'SAPISID', '__Secure-1PSID', '__Secure-3PSID'],
+        login: { loginUrl: 'https://accounts.google.com/', keyPrefix: 'GOOGLE' },
+    },
+    x: {
+        hosts: ['x.com', 'twitter.com'],
+        cookies: ['auth_token'],
+        login: { loginUrl: 'https://x.com/login', keyPrefix: 'X' },
+    },
+    reddit: {
+        hosts: ['reddit.com'],
+        cookies: ['reddit_session', 'token_v2'],
+        login: { loginUrl: 'https://www.reddit.com/login', keyPrefix: 'REDDIT' },
+    },
+    github: {
+        hosts: ['github.com'],
+        cookies: ['user_session'],
+        login: { loginUrl: 'https://github.com/login', keyPrefix: 'GITHUB' },
+    },
+};
+/**
+ * The bundle keys a profile's `--secrets` bundle should hold to log into
+ * `service`: `<PREFIX>_USERNAME` / `<PREFIX>_PASSWORD`. Null for services with no
+ * login metadata. Feed a resolved value to the page with
+ * `agents browser type <ref> --secret <bundle>/<KEY>` (never printed).
+ */
+export function credKeysForService(service) {
+    const login = AUTH_SIGNATURES[service]?.login;
+    if (!login)
+        return null;
+    return { user: `${login.keyPrefix}_USERNAME`, pass: `${login.keyPrefix}_PASSWORD` };
+}
+/** The interactive login URL for a service, or null. */
+export function loginUrlForService(service) {
+    return AUTH_SIGNATURES[service]?.login?.loginUrl ?? null;
+}
+/**
+ * Current time as microseconds since 1601-01-01 (Chromium's `expires_utc`
+ * epoch), as a BigInt. Chromium expiries routinely exceed 2^53, so this is
+ * bound into SQL as a BigInt and the comparison happens IN SQLite — the huge
+ * integer never marshals back to JS (node:sqlite throws RangeError if it does).
+ * 11644473600000 = ms between 1601-01-01 and 1970-01-01.
+ */
+function chromeNowMicrosBigInt() {
+    return (BigInt(Date.now()) + 11644473600000n) * 1000n;
+}
+function hostMatches(hostKey, host) {
+    return hostKey === host || hostKey === '.' + host || hostKey.endsWith('.' + host);
+}
+/**
+ * Pure core: given a profile's (already expiry-filtered) cookie rows, return the
+ * services with a live session. Exported for direct unit testing without disk.
+ */
+export function detectServices(rows) {
+    const services = [];
+    for (const [service, sig] of Object.entries(AUTH_SIGNATURES)) {
+        const found = rows.some((r) => sig.cookies.includes(r.name) && sig.hosts.some((h) => hostMatches(r.host_key, h)));
+        if (found)
+            services.push(service);
+    }
+    return services;
+}
+/** Map a URL to a known login-gated service key, or null. */
+export function serviceForUrl(url) {
+    let host;
+    try {
+        host = new URL(url).hostname;
+    }
+    catch {
+        return null;
+    }
+    for (const [service, sig] of Object.entries(AUTH_SIGNATURES)) {
+        if (sig.hosts.some((h) => host === h || host.endsWith('.' + h)))
+            return service;
+    }
+    return null;
+}
+/**
+ * Locate candidate Chromium DBs for a profile at the given relative paths. The
+ * live runtime dir is keyed by the composite `<profile>@<endpoint>` name, so we
+ * scan the browser cache root for `<profile>` and `<profile>@*` dirs and return
+ * every matching DB found, most-recently-modified first.
+ */
+function profileDbCandidates(profileName, relPaths) {
+    const root = getBrowserRuntimeDir();
+    let entries;
+    try {
+        entries = fs.readdirSync(root);
+    }
+    catch {
+        return [];
+    }
+    const dirs = entries.filter((e) => e === profileName || e.startsWith(profileName + '@'));
+    const found = [];
+    for (const d of dirs) {
+        for (const rel of relPaths) {
+            const p = path.join(root, d, ...rel);
+            try {
+                found.push({ p, mtime: fs.statSync(p).mtimeMs });
+            }
+            catch {
+                /* not present */
+            }
+        }
+    }
+    return found.sort((a, b) => b.mtime - a.mtime).map((f) => f.p);
+}
+function cookieDbCandidates(profileName) {
+    return profileDbCandidates(profileName, [
+        ['chrome-data', 'Default', 'Cookies'],
+        ['chrome-data', 'Default', 'Network', 'Cookies'],
+    ]);
+}
+function loginDbCandidates(profileName) {
+    return profileDbCandidates(profileName, [['chrome-data', 'Default', 'Login Data']]);
+}
+/**
+ * Open a Chromium SQLite store safely: copy the DB (and any WAL/SHM sidecars) to
+ * a temp dir first so a running browser's lock never blocks us and we never
+ * touch the live file, run `fn`, then clean up. Returns `fallback` on any error.
+ */
+function withCopiedDb(dbPath, fn, fallback) {
+    let tmpDir = null;
+    try {
+        tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'agents-browserdb-'));
+        const tmpDb = path.join(tmpDir, 'db');
+        fs.copyFileSync(dbPath, tmpDb);
+        for (const suffix of ['-wal', '-shm']) {
+            if (fs.existsSync(dbPath + suffix))
+                fs.copyFileSync(dbPath + suffix, tmpDb + suffix);
+        }
+        const db = new Database(tmpDb);
+        try {
+            return fn(db);
+        }
+        finally {
+            db.close();
+        }
+    }
+    catch {
+        return fallback;
+    }
+    finally {
+        if (tmpDir) {
+            try {
+                fs.rmSync(tmpDir, { recursive: true, force: true });
+            }
+            catch {
+                /* temp cleanup best-effort */
+            }
+        }
+    }
+}
+/** Read (expiry-filtered) cookie rows from a Chromium cookie DB. [] on failure. */
+function readCookieRows(dbPath) {
+    return withCopiedDb(dbPath, (db) => {
+        // Filter expiry in SQL (session cookies have expires_utc = 0; otherwise it
+        // must be in the future) and select only text columns, so the huge
+        // microsecond integer never crosses into JS.
+        const rows = db
+            .prepare('SELECT host_key, name FROM cookies WHERE expires_utc = 0 OR expires_utc > ?')
+            .all(chromeNowMicrosBigInt());
+        return rows.map((r) => ({
+            host_key: String(r.host_key ?? ''),
+            name: String(r.name ?? ''),
+        }));
+    }, []);
+}
+/** Read saved-login rows from a Chromium `Login Data` DB. Skips
+ *  user-blacklisted origins ("never save"). Selects only text columns —
+ *  `password_value` (encrypted) is never touched. [] on failure. */
+function readLoginRows(dbPath) {
+    return withCopiedDb(dbPath, (db) => {
+        const rows = db
+            .prepare('SELECT origin_url, username_value, signon_realm FROM logins WHERE blacklisted_by_user = 0')
+            .all();
+        return rows.map((r) => ({
+            origin_url: String(r.origin_url ?? ''),
+            username_value: String(r.username_value ?? ''),
+            signon_realm: String(r.signon_realm ?? ''),
+        }));
+    }, []);
+}
+/**
+ * Map a profile's saved logins to service → account username (identity, not
+ * session). Best-effort; `{}` if `Login Data` is unreadable. The first non-empty
+ * username per service wins.
+ */
+export async function accountsForProfile(profileName) {
+    const candidates = loginDbCandidates(profileName);
+    if (candidates.length === 0)
+        return {};
+    const rows = readLoginRows(candidates[0]);
+    const out = {};
+    for (const r of rows) {
+        if (!r.username_value)
+            continue;
+        const service = serviceForUrl(r.origin_url) ?? serviceForUrl(r.signon_realm);
+        if (service && !out[service])
+            out[service] = r.username_value;
+    }
+    return out;
+}
+/**
+ * For each service with a LIVE session in the profile (cookie-gated), the
+ * account it is signed in as (from saved logins). Intersecting with live
+ * sessions means a stale saved-login for a service you've since logged out of
+ * never shows.
+ */
+export async function loginsWithAccountsForProfile(profileName) {
+    const active = await loginsForProfile(profileName);
+    if (active.length === 0)
+        return [];
+    const accounts = await accountsForProfile(profileName);
+    return active.map((service) => ({ service, username: accounts[service] }));
+}
+/** Services with a live session in the given profile (best-effort; [] if none
+ *  detected or the cookie store is unreadable). */
+export async function loginsForProfile(profileName) {
+    const candidates = cookieDbCandidates(profileName);
+    if (candidates.length === 0)
+        return [];
+    const rows = readCookieRows(candidates[0]);
+    if (rows.length === 0)
+        return [];
+    return detectServices(rows);
+}
+/** Profile names that have a live session for the given service. */
+export async function profilesLoggedInto(service) {
+    const profiles = await listProfiles();
+    const out = [];
+    for (const p of profiles) {
+        const logins = await loginsForProfile(p.name);
+        if (logins.includes(service))
+            out.push(p.name);
+    }
+    return out;
+}

package/dist/lib/browser/profiles.d.ts

@@ -1,20 +1,29 @@
 import type { BrowserProfile } from './types.js';
 export type { BrowserProfile } from './types.js';
 export declare const DEFAULT_BROWSER_PROFILE_NAME = "default";
+/**
+ * The device-local configured default profile name (set via
+ * `agents browser profiles set-default`), or undefined when unset. When set, it
+ * is the profile `agents browser start` resolves to for BOTH the no-`--profile`
+ * path and an explicit `--profile default`. Stored per-machine — see
+ * `Meta.defaultBrowserProfile`.
+ */
+export declare function getConfiguredDefaultProfileName(): string | undefined;
 export declare function getBrowserRuntimeDir(): string;
 export declare function getProfileRuntimeDir(name: string): string;
 export declare function listProfiles(): Promise<BrowserProfile[]>;
 export declare function getProfile(name: string): Promise<BrowserProfile | null>;
 /**
- * Ensure a `default` profile exists, auto-picking the first installed
- * Chromium-family browser per the platform priority list in chrome.ts.
+ * Resolve the profile `agents browser start` uses when no `--profile` is given.
  *
- * Re-uses an existing `default` profile as-is (we don't second-guess the user
- * if they've already customized it). On first run we walk the priority list
- * (macOS: chrome > brave > edge > chromium > comet; Linux: chrome > chromium >
- * brave > edge; Windows: edge > chrome > brave > comet) and pin the profile to the
- * first match. Throws an actionable error if none of those binaries are
- * installed so the user knows exactly which browsers we'd accept.
+ * Order: (1) the device-local configured default (`agents browser profiles
+ * set-default <name>`) when it names an existing profile; (2) an existing
+ * `default` profile as-is; (3) auto-pick the first installed Chromium-family
+ * browser per the platform priority list in chrome.ts (macOS: chrome > brave >
+ * edge > chromium > comet; Linux: chrome > chromium > brave > edge; Windows:
+ * edge > chrome > brave > comet) and pin a new `default` profile to it. Throws an
+ * actionable error if none of those binaries are installed. A configured default
+ * that no longer exists warns and falls through to (2)/(3) — never a hard fail.
  */
 export declare function ensureDefaultBrowserProfile(): Promise<BrowserProfile>;
 /**

package/dist/lib/browser/profiles.js

@@ -3,6 +3,16 @@ import { getBrowserRuntimeDir as getBrowserRuntimeDirRoot, readMeta, writeMeta,
 import { findBrowserPath, findFirstInstalledBrowser, isPortInUse } from './chrome.js';
 import { DEFAULT_VIEWPORT } from './devices.js';
 export const DEFAULT_BROWSER_PROFILE_NAME = 'default';
+/**
+ * The device-local configured default profile name (set via
+ * `agents browser profiles set-default`), or undefined when unset. When set, it
+ * is the profile `agents browser start` resolves to for BOTH the no-`--profile`
+ * path and an explicit `--profile default`. Stored per-machine — see
+ * `Meta.defaultBrowserProfile`.
+ */
+export function getConfiguredDefaultProfileName() {
+    return readMeta().defaultBrowserProfile || undefined;
+}
 export function getBrowserRuntimeDir() {
     return getBrowserRuntimeDirRoot();
 }
@@ -69,17 +79,26 @@ export async function getProfile(name) {
     return configToProfile(name, config);
 }
 /**
- * Ensure a `default` profile exists, auto-picking the first installed
- * Chromium-family browser per the platform priority list in chrome.ts.
+ * Resolve the profile `agents browser start` uses when no `--profile` is given.
  *
- * Re-uses an existing `default` profile as-is (we don't second-guess the user
- * if they've already customized it). On first run we walk the priority list
- * (macOS: chrome > brave > edge > chromium > comet; Linux: chrome > chromium >
- * brave > edge; Windows: edge > chrome > brave > comet) and pin the profile to the
- * first match. Throws an actionable error if none of those binaries are
- * installed so the user knows exactly which browsers we'd accept.
+ * Order: (1) the device-local configured default (`agents browser profiles
+ * set-default <name>`) when it names an existing profile; (2) an existing
+ * `default` profile as-is; (3) auto-pick the first installed Chromium-family
+ * browser per the platform priority list in chrome.ts (macOS: chrome > brave >
+ * edge > chromium > comet; Linux: chrome > chromium > brave > edge; Windows:
+ * edge > chrome > brave > comet) and pin a new `default` profile to it. Throws an
+ * actionable error if none of those binaries are installed. A configured default
+ * that no longer exists warns and falls through to (2)/(3) — never a hard fail.
  */
 export async function ensureDefaultBrowserProfile() {
+    const configured = getConfiguredDefaultProfileName();
+    if (configured) {
+        const chosen = await getProfile(configured);
+        if (chosen)
+            return chosen;
+        console.warn(`warning: configured default browser profile "${configured}" no longer exists; ` +
+            `falling back to auto-detect. Fix with: agents browser profiles set-default <name>  (or --unset)`);
+    }
     const existing = await getProfile(DEFAULT_BROWSER_PROFILE_NAME);
     if (existing)
         return existing;

package/dist/lib/browser/secret-ref.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Parse a `<bundle>/<KEY>` reference (optionally `secret:<bundle>/<KEY>`) used by
+ * `agents browser type --secret` to feed a credential from an `agents secrets`
+ * bundle into a page WITHOUT the value ever crossing stdout or the transcript.
+ * Returns null on a malformed ref.
+ */
+export declare function parseSecretRef(ref: string): {
+    bundle: string;
+    key: string;
+} | null;

package/dist/lib/browser/secret-ref.js

@@ -0,0 +1,14 @@
+/**
+ * Parse a `<bundle>/<KEY>` reference (optionally `secret:<bundle>/<KEY>`) used by
+ * `agents browser type --secret` to feed a credential from an `agents secrets`
+ * bundle into a page WITHOUT the value ever crossing stdout or the transcript.
+ * Returns null on a malformed ref.
+ */
+export function parseSecretRef(ref) {
+    const body = ref.startsWith('secret:') ? ref.slice('secret:'.length) : ref;
+    const slash = body.indexOf('/');
+    // Need a non-empty bundle before the slash and a non-empty key after it.
+    if (slash <= 0 || slash >= body.length - 1)
+        return null;
+    return { bundle: body.slice(0, slash), key: body.slice(slash + 1) };
+}

package/dist/lib/browser/service.js

@@ -8,7 +8,7 @@ import { getProfile, getProfileRuntimeDir, getBrowserRuntimeDir, listProfiles, e
 import { killChrome, getRunningChromeInfo, launchBrowser, allocatePort } from './chrome.js';
 import { connectLocal } from './drivers/local.js';
 import { connectSSH, shellQuote } from './drivers/ssh.js';
-import { clearProfileRuntime } from './runtime-state.js';
+import { clearProfileRuntime, listProfileCacheDirs, readProfileRuntimeMeta, isProcessAlive } from './runtime-state.js';
 import { resolveDomainSkill } from './domain-skills.js';
 import { generateTaskId, generateShortId, generateTaskName, } from './types.js';
 import { getRefs, resolveRefToCoords, describeRefs, healRef } from './refs.js';
@@ -415,6 +415,7 @@ export class BrowserService {
                     killChrome(conn.pid);
                     conn.cleanup?.();
                     this.connections.delete(profileName);
+                    clearProfileRuntime(profileName);
                 }
                 return { ok: true, profile: profileName };
             }
@@ -442,17 +443,18 @@ export class BrowserService {
             killChrome(conn.pid);
             conn.cleanup?.();
             this.connections.delete(key);
-        }
-        const runtimeDir = getProfileRuntimeDir(profileName);
-        const pidFile = path.join(runtimeDir, 'pid');
-        const portFile = path.join(runtimeDir, 'port');
-        if (fs.existsSync(pidFile)) {
-            const pid = parseInt(fs.readFileSync(pidFile, 'utf-8').trim(), 10);
-            killChrome(pid);
-            fs.unlinkSync(pidFile);
-        }
-        if (fs.existsSync(portFile)) {
-            fs.unlinkSync(portFile);
+            clearProfileRuntime(key);
+        }
+        // Kill stale processes and clean runtime dirs for every composite and
+        // fork entry belonging to this profile (including `.N` forks left by
+        // earlier daemon sessions that the connection loop above didn't cover).
+        for (const dir of listProfileCacheDirs(profileName)) {
+            const dirName = path.basename(dir);
+            const meta = readProfileRuntimeMeta(dirName);
+            if (meta?.pid && meta.pid !== 0 && isProcessAlive(meta.pid, meta.command)) {
+                killChrome(meta.pid);
+            }
+            clearProfileRuntime(dirName);
         }
     }
     async navigate(taskId, url, profileName) {

package/dist/lib/cloud/rush.d.ts

@@ -29,6 +29,21 @@ export interface AccountTokenEntry {
     /** Stringified OAuth credentials JSON (Mac: keychain blob; Linux: .credentials.json). */
     credentials_json: string;
 }
+/**
+ * Read the raw OAuth credentials for one Claude version. On Mac, prefer the
+ * Keychain blob (canonical). On Linux/CI, fall back to `.claude/.credentials.json`
+ * inside the version home (where the Linux Claude CLI stores its OAuth).
+ *
+ * Returns null when no credentials are findable — caller treats as "version
+ * is installed but not signed in" and skips it from the manifest.
+ *
+ * NOTE: the darwin branch returns the UNWRAPPED oauth sub-object (what the Rush
+ * server re-wraps). It is NOT the shape Claude Code reads back from
+ * `.credentials.json`. The lease exporter (crabbox/runtimes.ts) therefore only
+ * reuses the Linux `.credentials.json` branch here and reads the wrapped raw
+ * Keychain payload itself on darwin.
+ */
+export declare function readClaudeCredentialsBlob(home: string): Promise<string | null>;
 /**
  * Build a manifest of the user's local Claude installations to send on every
  * cloud dispatch. The manifest is the contract the server uses to detect when

package/dist/lib/cloud/rush.js

@@ -170,8 +170,14 @@ function parsePromptCode(body) {
  *
  * Returns null when no credentials are findable — caller treats as "version
  * is installed but not signed in" and skips it from the manifest.
+ *
+ * NOTE: the darwin branch returns the UNWRAPPED oauth sub-object (what the Rush
+ * server re-wraps). It is NOT the shape Claude Code reads back from
+ * `.credentials.json`. The lease exporter (crabbox/runtimes.ts) therefore only
+ * reuses the Linux `.credentials.json` branch here and reads the wrapped raw
+ * Keychain payload itself on darwin.
  */
-async function readClaudeCredentialsBlob(home) {
+export async function readClaudeCredentialsBlob(home) {
     if (process.platform === 'darwin') {
         const oauth = await loadClaudeOauth(home);
         if (oauth && oauth.accessToken) {

package/dist/lib/crabbox/lease.d.ts

@@ -26,6 +26,12 @@ export interface LeaseRunOptions {
     onData?: (s: string) => void;
     /** Keep the box after the run instead of stopping it. */
     keep?: boolean;
+    /**
+     * Raw wrapped Claude OAuth payload (from `resolveClaudeCredentialsBlob`), written
+     * to `~/.claude/.credentials.json` on the box. The command layer resolves it
+     * (after consent) so this module stays free of Keychain I/O and unit-testable.
+     */
+    claudeCredentialsJson?: string | null;
 }
 export interface LeaseRunResult {
     box: CrabboxBox;