@phnx-labs/agents-cli 1.20.51 → 1.20.53

package/dist/lib/cloud/types.js

@@ -5,6 +5,87 @@
  * Factory) implement, plus the shared task and event types that flow through
  * the dispatch pipeline.
  */
+/**
+ * Normalize a provider's raw wire status into the canonical `CloudTaskStatus`.
+ *
+ * Each cloud backend speaks its own status vocabulary and had its own copy of
+ * this mapping, which had drifted. This dispatches per provider while keeping
+ * provider-specific defaults explicit:
+ *   - `rush`        — switch over the Factory Floor's known strings; includes
+ *                     `allocating` and stopped/resumable `idle` states, has no
+ *                     `queued`, default `running`.
+ *   - `codex`       — substring match on the lowercased CLI status; default
+ *                     `running`.
+ *   - `antigravity` — substring match on the (possibly `undefined`) Interactions
+ *                     API status; default `completed` (its synchronous response
+ *                     is terminal), and `undefined`-safe.
+ *
+ * Factory's `mapResultStatus` is structurally different (it maps a droid *exit*
+ * result, not a lifecycle string) and deliberately stays in `factory.ts`.
+ */
+export function normalizeProviderStatus(provider, wireStatus) {
+    switch (provider) {
+        case 'rush':
+            return normalizeRushStatus(wireStatus ?? '');
+        case 'codex':
+            return normalizeCodexStatus(wireStatus ?? '');
+        case 'antigravity':
+            return normalizeAntigravityStatus(wireStatus);
+    }
+}
+/** Rush Factory Floor status → canonical enum. Default `running`; no `queued`. */
+function normalizeRushStatus(s) {
+    switch (s) {
+        case 'allocating': return 'allocating';
+        case 'running': return 'running';
+        case 'idle':
+        case 'paused':
+        case 'needs_review': return 'idle';
+        case 'input_required': return 'input_required';
+        case 'completed': return 'completed';
+        case 'failed': return 'failed';
+        case 'cancelled': return 'cancelled';
+        default: return 'running';
+    }
+}
+/** Codex Cloud CLI status → canonical enum. Substring match; default `running`. */
+function normalizeCodexStatus(s) {
+    const lower = s.toLowerCase();
+    if (lower.includes('queued') || lower.includes('pending'))
+        return 'queued';
+    if (lower.includes('running') || lower.includes('in_progress'))
+        return 'running';
+    if (lower.includes('idle') || lower.includes('paused') || lower.includes('needs_review'))
+        return 'idle';
+    if (lower.includes('completed') || lower.includes('succeeded') || lower.includes('success'))
+        return 'completed';
+    if (lower.includes('failed') || lower.includes('error'))
+        return 'failed';
+    if (lower.includes('cancelled') || lower.includes('canceled'))
+        return 'cancelled';
+    return 'running';
+}
+/**
+ * Antigravity Interactions API status → canonical enum. Substring match,
+ * `undefined`-safe; default `completed` because the synchronous response is
+ * already terminal.
+ */
+function normalizeAntigravityStatus(s) {
+    const lower = (s ?? '').toLowerCase();
+    if (lower.includes('queue') || lower.includes('pending'))
+        return 'queued';
+    if (lower.includes('run') || lower.includes('progress'))
+        return 'running';
+    if (lower.includes('idle') || lower.includes('paused') || lower.includes('needs_review'))
+        return 'idle';
+    if (lower.includes('complete') || lower.includes('success'))
+        return 'completed';
+    if (lower.includes('fail') || lower.includes('error'))
+        return 'failed';
+    if (lower.includes('cancel'))
+        return 'cancelled';
+    return 'completed';
+}
 /** Maximum images allowed per dispatch (matches Cursor Background Agents). */
 export const MAX_IMAGES_PER_DISPATCH = 5;
 /**

package/dist/lib/crabbox/cli.d.ts

@@ -62,7 +62,7 @@ export interface WarmupOptions extends CrabboxOptions {
  * created even if warmup's stdout format changes — the new lease id is the one
  * that wasn't present before.
  */
-export declare function crabboxWarmup(opts?: WarmupOptions): CrabboxBox;
+export declare function crabboxWarmup(opts?: WarmupOptions): Promise<CrabboxBox>;
 /**
  * Poll until the box reports ready, or throw after timeoutMs.
  * `sleep` is injectable so tests don't wall-clock wait.

package/dist/lib/crabbox/cli.js

@@ -87,7 +87,7 @@ export function crabboxFind(slug, opts = {}) {
  * created even if warmup's stdout format changes — the new lease id is the one
  * that wasn't present before.
  */
-export function crabboxWarmup(opts = {}) {
+export async function crabboxWarmup(opts = {}) {
     findCrabbox();
     const env = crabboxEnv(opts);
     const before = new Set(crabboxList(opts).map((b) => b.lease));
@@ -100,7 +100,17 @@ export function crabboxWarmup(opts = {}) {
         args.push('--provider', opts.provider);
     if (opts.code)
         args.push('--code');
-    const r = spawnSync('crabbox', args, { encoding: 'utf-8', env, stdio: ['ignore', 'pipe', 'pipe'] });
+    // Async spawn (not spawnSync): provisioning takes 30-90s and a blocking call
+    // would freeze any caller's progress spinner. Output is captured, not streamed.
+    const r = await new Promise((resolve) => {
+        const proc = spawn('crabbox', args, { env, stdio: ['ignore', 'pipe', 'pipe'] });
+        let stdout = '';
+        let stderr = '';
+        proc.stdout.on('data', (c) => (stdout += c.toString('utf-8')));
+        proc.stderr.on('data', (c) => (stderr += c.toString('utf-8')));
+        proc.on('error', () => resolve({ status: null, stdout, stderr }));
+        proc.on('close', (code) => resolve({ status: code, stdout, stderr }));
+    });
     if (r.status !== 0) {
         const detail = (r.stderr || r.stdout || '').trim();
         throw new Error(`crabbox warmup failed: ${detail || 'unknown error'}. ` +

package/dist/lib/crabbox/lease.d.ts

@@ -9,6 +9,17 @@
 import type { AgentId } from '../types.js';
 import { type CrabboxBox } from './cli.js';
 import { type DetectedRuntime } from './runtimes.js';
+/** Phase signal for a lease run, so the command layer can drive a progress UI. */
+export type LeasePhase = {
+    kind: 'warmup';
+    backend?: string;
+} | {
+    kind: 'ready';
+    box: CrabboxBox;
+    elapsedMs: number;
+} | {
+    kind: 'teardown';
+};
 export interface LeaseRunOptions {
     agent: string;
     prompt: string;
@@ -24,8 +35,16 @@ export interface LeaseRunOptions {
     /** Secrets bundle providing crabbox's provider token. */
     secretsBundle?: string;
     onData?: (s: string) => void;
+    /** Progress phases (warmup → ready → teardown) for a command-layer spinner. */
+    onPhase?: (phase: LeasePhase) => void;
     /** Keep the box after the run instead of stopping it. */
     keep?: boolean;
+    /**
+     * Raw wrapped Claude OAuth payload (from `resolveClaudeCredentialsBlob`), written
+     * to `~/.claude/.credentials.json` on the box. The command layer resolves it
+     * (after consent) so this module stays free of Keychain I/O and unit-testable.
+     */
+    claudeCredentialsJson?: string | null;
 }
 export interface LeaseRunResult {
     box: CrabboxBox;

package/dist/lib/crabbox/lease.js

@@ -7,7 +7,8 @@
  * `--script-stdin` body so the token contents never touch argv.
  */
 import { crabboxWarmup, crabboxWaitReady, crabboxRunScript, crabboxStop } from './cli.js';
-import { buildCredentialScript } from './runtimes.js';
+import { buildCredentialScript, CLAUDE_TOKEN_REMOTE } from './runtimes.js';
+import { LEASE_AGENT_MARKER } from './progress.js';
 /** POSIX single-quote for safe embedding in the generated bootstrap script. */
 function q(s) {
     return "'" + s.replace(/'/g, "'\\''") + "'";
@@ -46,26 +47,31 @@ const ENSURE_AGENTS_CLI = [
  * the credential files. Best-effort install steps never abort the run.
  */
 export function buildBootstrapScript(opts) {
-    const credScript = buildCredentialScript(opts.runtimes, opts.detected);
+    const credScript = buildCredentialScript(opts.runtimes, opts.detected, {
+        claudeCredentialsJson: opts.claudeCredentialsJson,
+    });
     const runParts = ['agents', 'run', q(opts.agent), q(opts.prompt), '--quiet'];
     if (opts.mode)
         runParts.push('--mode', q(opts.mode));
     if (opts.model)
         runParts.push('--model', q(opts.model));
     // Credential files to shred after the run (home-level paths written above).
-    const shred = opts.runtimes
-        .map((id) => {
-        const cred = { claude: '.claude.json', codex: '.codex/auth.json', gemini: '.gemini/google_accounts.json', grok: '.grok/auth.json' }[id];
-        return cred ? `rm -f "$HOME/${cred}" 2>/dev/null || true` : '';
-    })
-        .filter(Boolean)
-        .join('\n');
+    // Runs regardless of --keep-box (it's in the box body, not teardown), so a kept
+    // box still loses the token after the run — minimizing the credential window.
+    const shredPaths = opts.runtimes.flatMap((id) => {
+        const paths = { claude: ['.claude.json', CLAUDE_TOKEN_REMOTE], codex: ['.codex/auth.json'], gemini: ['.gemini/google_accounts.json'], grok: ['.grok/auth.json'] }[id];
+        return paths ?? [];
+    });
+    const shred = shredPaths.map((p) => `rm -f "$HOME/${p}" 2>/dev/null || true`).join('\n');
     const installRuntimes = opts.runtimes.map((id) => `agents add ${q(id)} >/dev/null 2>&1 || true`).join('\n');
     return [
         'set -uo pipefail',
         ENSURE_AGENTS_CLI,
         installRuntimes,
         credScript,
+        // Marker on its own line: the command layer shows everything before this as
+        // setup progress and everything after (the agent's output) verbatim.
+        `echo ${q(LEASE_AGENT_MARKER)}`,
         `${runParts.join(' ')}`,
         'rc=$?',
         shred,
@@ -75,13 +81,16 @@ export function buildBootstrapScript(opts) {
         .join('\n');
 }
 export async function leaseAndRun(opts) {
-    const box = crabboxWarmup({
+    const startedAt = Date.now();
+    opts.onPhase?.({ kind: 'warmup', backend: opts.backend });
+    const box = await crabboxWarmup({
         class: opts.boxClass,
         profile: opts.profile,
         provider: opts.backend,
         secretsBundle: opts.secretsBundle,
     });
     await crabboxWaitReady(box.slug, { secretsBundle: opts.secretsBundle });
+    opts.onPhase?.({ kind: 'ready', box, elapsedMs: Date.now() - startedAt });
     const script = buildBootstrapScript(opts);
     let exitCode = null;
     let toreDown = false;
@@ -94,8 +103,10 @@ export async function leaseAndRun(opts) {
     finally {
         // Always attempt teardown (bounds credential lifetime to the run) unless the
         // caller explicitly asked to keep the box.
-        if (!opts.keep)
+        if (!opts.keep) {
+            opts.onPhase?.({ kind: 'teardown' });
             toreDown = crabboxStop(box.slug, { secretsBundle: opts.secretsBundle });
+        }
     }
     return { box, exitCode, toreDown };
 }

package/dist/lib/crabbox/progress.d.ts

@@ -0,0 +1,62 @@
+/**
+ * Progress routing for `agents run --lease`.
+ *
+ * The box-side bootstrap emits `LEASE_AGENT_MARKER` on its own line right before
+ * `agents run`. Everything the crabbox run streams BEFORE that marker is setup
+ * noise (sync bytes, node/agents install, `agents setup`) — shown as spinner
+ * text and captured for a failure dump. Everything AFTER is the agent's own
+ * output — printed through verbatim. The marker line itself is swallowed.
+ */
+/** Sentinel echoed on the box right before `agents run`. Distinctive + collision-proof. */
+export declare const LEASE_AGENT_MARKER = "___AGENTS_LEASE_AGENT_OUTPUT_b1f4c2___";
+export interface Spinner {
+    /** Begin animating a phase (renders `frame text` on one line, TTY only). */
+    start(text: string): void;
+    /** Change the text shown; rendered on the next throttled tick (no write itself). */
+    update(text: string): void;
+    /** Finalize the current line with a symbol (e.g. ✔) and a newline. */
+    stopAndPersist(symbol: string, text: string): void;
+    /** Clear the current animated line without persisting anything. */
+    stop(): void;
+    /** True while a phase is active. */
+    readonly active: boolean;
+}
+/**
+ * A deliberately minimal, self-throttled spinner. Unlike `ora`, it does NOT hook
+ * the stream's `write` to re-render on external output — it writes exactly one
+ * short line per fixed tick and nowhere else, so it is structurally incapable of
+ * a re-render feedback loop (the failure mode that made `ora` blow up when a
+ * lease streamed output past a live spinner). On a non-TTY it prints each phase
+ * label once and stays silent on `update`, so piped/CI output never floods.
+ *
+ * Only ever run ONE phase at a time, and never stream other output to the same
+ * stream while a phase is active — stop it first.
+ */
+export declare function createSpinner(opts?: {
+    stream?: {
+        write(s: string): unknown;
+        isTTY?: boolean;
+    };
+    enabled?: boolean;
+    intervalMs?: number;
+}): Spinner;
+export interface LeaseOutputRouter {
+    /** Feed a raw chunk of the crabbox run's combined stdout/stderr. */
+    push(chunk: string): void;
+    /** Flush any buffered partial line (call once the stream closes). */
+    end(): void;
+    /** True once the agent-output marker has been seen. */
+    sawAgent(): boolean;
+    /** The setup lines seen so far (for a failure dump). */
+    setupLines(): string[];
+}
+/**
+ * Split the crabbox run stream at `LEASE_AGENT_MARKER`. `onSetupLine` fires for
+ * each complete non-empty line before the marker; `onAgentChunk` fires with raw
+ * text after it (streamed promptly, not line-buffered, so agent output is live).
+ */
+export declare function createLeaseOutputRouter(cb: {
+    onSetupLine: (line: string) => void;
+    onAgentChunk: (chunk: string) => void;
+    marker?: string;
+}): LeaseOutputRouter;

package/dist/lib/crabbox/progress.js

@@ -0,0 +1,129 @@
+/**
+ * Progress routing for `agents run --lease`.
+ *
+ * The box-side bootstrap emits `LEASE_AGENT_MARKER` on its own line right before
+ * `agents run`. Everything the crabbox run streams BEFORE that marker is setup
+ * noise (sync bytes, node/agents install, `agents setup`) — shown as spinner
+ * text and captured for a failure dump. Everything AFTER is the agent's own
+ * output — printed through verbatim. The marker line itself is swallowed.
+ */
+/** Sentinel echoed on the box right before `agents run`. Distinctive + collision-proof. */
+export const LEASE_AGENT_MARKER = '___AGENTS_LEASE_AGENT_OUTPUT_b1f4c2___';
+const SPINNER_FRAMES = ['⠋', '⠙', '⠹', '⠸', '⠼', '⠴', '⠦', '⠧', '⠇', '⠏'];
+/**
+ * A deliberately minimal, self-throttled spinner. Unlike `ora`, it does NOT hook
+ * the stream's `write` to re-render on external output — it writes exactly one
+ * short line per fixed tick and nowhere else, so it is structurally incapable of
+ * a re-render feedback loop (the failure mode that made `ora` blow up when a
+ * lease streamed output past a live spinner). On a non-TTY it prints each phase
+ * label once and stays silent on `update`, so piped/CI output never floods.
+ *
+ * Only ever run ONE phase at a time, and never stream other output to the same
+ * stream while a phase is active — stop it first.
+ */
+export function createSpinner(opts = {}) {
+    const stream = opts.stream ?? process.stderr;
+    const enabled = opts.enabled ?? !!stream.isTTY;
+    const intervalMs = opts.intervalMs ?? 120;
+    const CLEAR = '\r\u001b[2K';
+    let text = '';
+    let frame = 0;
+    let timer;
+    let running = false;
+    const write = (s) => stream.write(s);
+    return {
+        start(t) {
+            text = t;
+            running = true;
+            if (!enabled) {
+                write(`${t}\n`);
+                return;
+            }
+            if (timer)
+                return;
+            frame = 0;
+            write(`${CLEAR}${SPINNER_FRAMES[0]} ${text}`);
+            timer = setInterval(() => {
+                frame = (frame + 1) % SPINNER_FRAMES.length;
+                write(`${CLEAR}${SPINNER_FRAMES[frame]} ${text}`);
+            }, intervalMs);
+        },
+        update(t) {
+            text = t; // next tick renders it; on a non-TTY we stay silent (no flood)
+        },
+        stopAndPersist(symbol, t) {
+            if (timer) {
+                clearInterval(timer);
+                timer = undefined;
+            }
+            running = false;
+            write(enabled ? `${CLEAR}${symbol} ${t}\n` : `${symbol} ${t}\n`);
+        },
+        stop() {
+            if (timer) {
+                clearInterval(timer);
+                timer = undefined;
+                if (enabled)
+                    write(CLEAR);
+            }
+            running = false;
+        },
+        get active() {
+            return running;
+        },
+    };
+}
+/**
+ * Split the crabbox run stream at `LEASE_AGENT_MARKER`. `onSetupLine` fires for
+ * each complete non-empty line before the marker; `onAgentChunk` fires with raw
+ * text after it (streamed promptly, not line-buffered, so agent output is live).
+ */
+export function createLeaseOutputRouter(cb) {
+    const marker = cb.marker ?? LEASE_AGENT_MARKER;
+    let seen = false;
+    let buf = '';
+    const setup = [];
+    const emitLine = (line) => {
+        const t = line.replace(/\r$/, '');
+        if (t.trim()) {
+            setup.push(t);
+            cb.onSetupLine(t);
+        }
+    };
+    return {
+        push(chunk) {
+            if (seen) {
+                cb.onAgentChunk(chunk);
+                return;
+            }
+            buf += chunk;
+            let idx;
+            while ((idx = buf.indexOf('\n')) !== -1) {
+                const line = buf.slice(0, idx);
+                buf = buf.slice(idx + 1);
+                if (line.includes(marker)) {
+                    seen = true;
+                    // Anything already buffered past the marker is agent output.
+                    if (buf) {
+                        cb.onAgentChunk(buf);
+                        buf = '';
+                    }
+                    return;
+                }
+                emitLine(line);
+            }
+            // A trailing partial line stays in `buf` — it may be the marker forming.
+        },
+        end() {
+            if (!seen && buf)
+                emitLine(buf);
+            buf = '';
+        },
+        sawAgent() {
+            return seen;
+        },
+        setupLines() {
+            return setup;
+        },
+    };
+}

package/dist/lib/crabbox/runtimes.d.ts

@@ -47,11 +47,48 @@ export declare function pickRuntimes(detected: DetectedRuntime[], prompt?: (choi
     checked: boolean;
     disabled: boolean | string;
 }[]) => Promise<AgentId[]>): Promise<AgentId[]>;
+/**
+ * Where Claude Code reads its OAuth token on the box. `.claude.json` (the file
+ * LEASE_RUNTIMES copies) is config/account-metadata ONLY — the actual token
+ * lives here, so without it the box boots "Not logged in".
+ */
+export declare const CLAUDE_TOKEN_REMOTE = ".claude/.credentials.json";
+/**
+ * The RAW wrapped Claude credential payload (`{"claudeAiOauth":{…}}`) to write to
+ * the box's `~/.claude/.credentials.json`, or null if no signed-in token is found.
+ *
+ * On macOS the token is in the login Keychain, read SILENTLY via
+ * `getKeychainToken` (the `/usr/bin/security … -w` path — Claude's item trusts it,
+ * no Touch ID). A default native install uses the bare `Claude Code-credentials`
+ * service; an agents-cli managed install (where `~/.claude` symlinks into a
+ * versioned home) uses a hash-suffixed service, so we try the bare service first,
+ * then enumerate installed version homes (preferring the account whose email
+ * matches `preferEmail`, so the token matches the `.claude.json` config we copy).
+ * Off macOS the local Claude CLI stores the token in `.credentials.json` already —
+ * reuse the rush.ts Linux branch verbatim.
+ *
+ * The reader/service/version helpers are injected so unit tests never touch the
+ * real Keychain.
+ */
+export declare function resolveClaudeCredentialsBlob(opts?: {
+    preferEmail?: string | null;
+    readItem?: (service: string) => string;
+    service?: (home?: string) => string;
+    listVersions?: () => string[];
+    versionHome?: (version: string) => string;
+    accountEmail?: (home: string) => Promise<string | null>;
+}): Promise<string | null>;
 /**
  * Build a bash snippet that writes each picked runtime's token file to the box's
  * home-level config path (0600), from the token contents read locally. Returns
  * `''` when no runtimes were selected. The snippet is meant to be embedded in
  * the `--script-stdin` body (never argv).
+ *
+ * `extras.claudeCredentialsJson` (the raw wrapped payload from
+ * `resolveClaudeCredentialsBlob`) is written to `~/.claude/.credentials.json` in
+ * ADDITION to claude's `.claude.json` config — without it the box is "Not logged in".
  */
-export declare function buildCredentialScript(picked: AgentId[], detected: DetectedRuntime[]): string;
+export declare function buildCredentialScript(picked: AgentId[], detected: DetectedRuntime[], extras?: {
+    claudeCredentialsJson?: string | null;
+}): string;
 export {};

package/dist/lib/crabbox/runtimes.js

@@ -16,6 +16,10 @@ import * as os from 'os';
 import * as path from 'path';
 import * as fs from 'fs';
 import { getAccountInfo } from '../agents.js';
+import { getKeychainToken } from '../secrets/index.js';
+import { getClaudeKeychainService } from '../usage.js';
+import { listInstalledVersions, getVersionHomePath } from '../versions.js';
+import { readClaudeCredentialsBlob } from '../cloud/rush.js';
 export const LEASE_RUNTIMES = [
     { id: 'claude', label: 'Claude Code', localCandidates: ['.claude/.claude.json', '.claude.json'], remote: '.claude.json' },
     { id: 'codex', label: 'Codex CLI', localCandidates: ['.codex/auth.json'], remote: '.codex/auth.json' },
@@ -79,15 +83,102 @@ export async function pickRuntimes(detected, prompt) {
 // token's contents effectively impossible, so the quoted heredoc can never be
 // closed early by the credential body.
 const CRED_EOF = 'AGENTS_LEASE_CRED_EOF_9f3c1a7b5e2d4068';
+/**
+ * Where Claude Code reads its OAuth token on the box. `.claude.json` (the file
+ * LEASE_RUNTIMES copies) is config/account-metadata ONLY — the actual token
+ * lives here, so without it the box boots "Not logged in".
+ */
+export const CLAUDE_TOKEN_REMOTE = '.claude/.credentials.json';
+/** True when `s` parses to a Claude keychain payload with an OAuth access token. */
+function isClaudeCredentialsBlob(s) {
+    try {
+        const p = JSON.parse(s);
+        return typeof p?.claudeAiOauth?.accessToken === 'string';
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * The RAW wrapped Claude credential payload (`{"claudeAiOauth":{…}}`) to write to
+ * the box's `~/.claude/.credentials.json`, or null if no signed-in token is found.
+ *
+ * On macOS the token is in the login Keychain, read SILENTLY via
+ * `getKeychainToken` (the `/usr/bin/security … -w` path — Claude's item trusts it,
+ * no Touch ID). A default native install uses the bare `Claude Code-credentials`
+ * service; an agents-cli managed install (where `~/.claude` symlinks into a
+ * versioned home) uses a hash-suffixed service, so we try the bare service first,
+ * then enumerate installed version homes (preferring the account whose email
+ * matches `preferEmail`, so the token matches the `.claude.json` config we copy).
+ * Off macOS the local Claude CLI stores the token in `.credentials.json` already —
+ * reuse the rush.ts Linux branch verbatim.
+ *
+ * The reader/service/version helpers are injected so unit tests never touch the
+ * real Keychain.
+ */
+export async function resolveClaudeCredentialsBlob(opts) {
+    const readItem = opts?.readItem ?? getKeychainToken;
+    const service = opts?.service ?? getClaudeKeychainService;
+    const listVersions = opts?.listVersions ?? (() => listInstalledVersions('claude'));
+    const versionHome = opts?.versionHome ?? ((v) => getVersionHomePath('claude', v));
+    const accountEmail = opts?.accountEmail ?? (async (home) => (await getAccountInfo('claude', home)).email);
+    const tryRead = (svc) => {
+        try {
+            const raw = readItem(svc).trim();
+            return isClaudeCredentialsBlob(raw) ? raw : null;
+        }
+        catch {
+            return null;
+        }
+    };
+    if (process.platform === 'darwin') {
+        // 1) Bare service — the default native (non-managed) install.
+        const bare = tryRead(service(undefined));
+        if (bare)
+            return bare;
+        // 2) Managed installs — hash-suffixed service keyed to each version home.
+        //    Prefer the version whose account email matches the copied config.
+        let homes;
+        try {
+            homes = listVersions().map(versionHome);
+        }
+        catch {
+            homes = [];
+        }
+        if (opts?.preferEmail) {
+            const scored = await Promise.all(homes.map(async (home) => ({ home, match: (await accountEmail(home).catch(() => null)) === opts.preferEmail })));
+            homes = [...scored.filter((s) => s.match), ...scored.filter((s) => !s.match)].map((s) => s.home);
+        }
+        for (const home of homes) {
+            const hit = tryRead(service(home));
+            if (hit)
+                return hit;
+        }
+        return null;
+    }
+    // Off darwin: the local Claude CLI already stores the wrapped blob on disk.
+    const home = process.env.AGENTS_REAL_HOME || os.homedir();
+    return readClaudeCredentialsBlob(home);
+}
 /**
  * Build a bash snippet that writes each picked runtime's token file to the box's
  * home-level config path (0600), from the token contents read locally. Returns
  * `''` when no runtimes were selected. The snippet is meant to be embedded in
  * the `--script-stdin` body (never argv).
+ *
+ * `extras.claudeCredentialsJson` (the raw wrapped payload from
+ * `resolveClaudeCredentialsBlob`) is written to `~/.claude/.credentials.json` in
+ * ADDITION to claude's `.claude.json` config — without it the box is "Not logged in".
  */
-export function buildCredentialScript(picked, detected) {
+export function buildCredentialScript(picked, detected, extras) {
     const byId = new Map(detected.map((d) => [d.id, d]));
     const parts = [];
+    const writeFile = (remote, contents) => {
+        const dir = path.posix.dirname(remote);
+        const mkdir = dir && dir !== '.' ? `mkdir -p "$HOME/${dir}"\n` : '';
+        return (`${mkdir}cat > "$HOME/${remote}" <<'${CRED_EOF}'\n${contents}${contents.endsWith('\n') ? '' : '\n'}${CRED_EOF}\n` +
+            `chmod 600 "$HOME/${remote}"`);
+    };
     for (const id of picked) {
         const d = byId.get(id);
         const cred = LEASE_RUNTIMES.find((c) => c.id === id);
@@ -100,10 +191,12 @@ export function buildCredentialScript(picked, detected) {
         catch {
             continue;
         }
-        const dir = path.posix.dirname(cred.remote);
-        const mkdir = dir && dir !== '.' ? `mkdir -p "$HOME/${dir}"\n` : '';
-        parts.push(`${mkdir}cat > "$HOME/${cred.remote}" <<'${CRED_EOF}'\n${contents}${contents.endsWith('\n') ? '' : '\n'}${CRED_EOF}\n` +
-            `chmod 600 "$HOME/${cred.remote}"`);
+        parts.push(writeFile(cred.remote, contents));
+        // For claude the file above is config/state only; the OAuth token is a
+        // second artifact — without it the box comes up "Not logged in".
+        if (id === 'claude' && extras?.claudeCredentialsJson) {
+            parts.push(writeFile(CLAUDE_TOKEN_REMOTE, extras.claudeCredentialsJson));
+        }
     }
     return parts.join('\n');
 }

package/dist/lib/daemon.d.ts

@@ -54,13 +54,15 @@ export declare function runDaemon(): Promise<void>;
 /**
  * Read the long-lived Claude OAuth token (from `claude setup-token`) that the
  * user stored under the `claude` secrets bundle. Resolves the bundle the same
- * way `agents run --secrets` does, so the token is found whether it was stored
- * keychain-backed or as a literal. Returns null when the bundle/key isn't
- * configured, the Keychain read is cancelled, or the platform has no keychain —
- * the daemon then behaves exactly as before (relying on the interactive OAuth
- * session). Never throws: a misconfigured token must not block daemon startup.
+ * way `agents run --secrets` does. Interactive starts may prompt Keychain;
+ * headless auto-starts are broker-only and return null unless the user already
+ * unlocked the bundle in the secrets agent. That keeps a background browser
+ * command from hanging on an unseen biometric prompt. Never throws: an absent
+ * token leaves the daemon on its existing interactive OAuth session.
  */
-export declare function readDaemonClaudeOAuthToken(): string | null;
+export declare function readDaemonClaudeOAuthToken(opts?: {
+    allowPrompt?: boolean;
+}): string | null;
 /**
  * Write a launchd plist or systemd unit with owner-only permissions atomically.
  *
@@ -72,9 +74,10 @@ export declare function readDaemonClaudeOAuthToken(): string | null;
  */
 export declare function writeOwnerOnlyServiceManifest(filePath: string, content: string): void;
 /** Generate a macOS launchd plist for auto-starting the daemon. */
-export declare function generateLaunchdPlist(): string;
+export declare function generateLaunchdPlist(oauthToken?: string | null): string;
 /** Generate a Linux systemd user unit for auto-starting the daemon. */
-export declare function generateSystemdUnit(): string;
+export declare function generateSystemdUnit(oauthToken?: string | null): string;
+export declare function getAgentsBinPath(): string;
 /** Start the daemon via launchd, systemd, or as a detached process. */
 export declare function startDaemon(): {
     pid: number | null;
@@ -102,7 +105,7 @@ export declare function ensureDaemonStarted(): {
  * the daemon then passes it to every routine run it spawns. An already-set
  * value (e.g. inherited from launchd) is left untouched.
  */
-export declare function buildDetachedDaemonEnv(baseEnv?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+export declare function buildDetachedDaemonEnv(baseEnv?: NodeJS.ProcessEnv, oauthToken?: string | null): NodeJS.ProcessEnv;
 /**
  * Resolve how to launch the daemon: `node <entry> daemon _run`, matching the
  * exact form that works under a direct `daemon _run`.