@phnx-labs/agents-cli 1.20.67 → 1.20.69

package/dist/commands/share.d.ts

@@ -1,2 +1,17 @@
 import type { Command } from 'commander';
 export declare function registerShareCommands(program: Command): void;
+/** Provision a fresh R2 bucket + Worker on the user's Cloudflare and persist the
+ * endpoint config + write token. Shared by `agents share setup` and the unified
+ * `agents setup share` wizard. */
+export declare function runShareProvision(opts: {
+    bundle: string;
+    worker: string;
+    bucket: string;
+    account?: string;
+    token?: string;
+    domain?: string;
+}): Promise<void>;
+/** Join an existing share endpoint (no provisioning): prompt for the endpoint
+ * details + write token and persist them. Shared by `agents share join` and the
+ * unified `agents setup share` wizard. */
+export declare function runShareJoin(baseUrl: string): Promise<void>;

package/dist/commands/share.js

@@ -52,7 +52,7 @@ export function registerShareCommands(program) {
         .option('--domain <host>', 'also map a custom domain (e.g. share.agents-cli.sh) if the token owns the zone')
         .action(async (opts) => {
         try {
-            await runSetup(opts);
+            await runShareProvision(opts);
         }
         catch (e) {
             console.error(chalk.red(e.message));
@@ -65,7 +65,7 @@ export function registerShareCommands(program) {
         .argument('<baseUrl>', 'base URL of the endpoint, e.g. https://share.agents-cli.sh')
         .action(async (baseUrl) => {
         try {
-            await runJoin(baseUrl);
+            await runShareJoin(baseUrl);
         }
         catch (e) {
             console.error(chalk.red(e.message));
@@ -85,7 +85,10 @@ export function registerShareCommands(program) {
         console.log(chalk.dim(`worker ${cfg.workerName} · bucket ${cfg.bucketName} · account ${cfg.accountId}`));
     });
 }
-async function runSetup(opts) {
+/** Provision a fresh R2 bucket + Worker on the user's Cloudflare and persist the
+ * endpoint config + write token. Shared by `agents share setup` and the unified
+ * `agents setup share` wizard. */
+export async function runShareProvision(opts) {
     const { default: ora } = await import('ora');
     const { input } = await import('@inquirer/prompts');
     const { apiToken, accountId: acctFromBundle } = readCloudflareCreds(opts.bundle, {
@@ -132,7 +135,10 @@ async function runSetup(opts) {
         throw e;
     }
 }
-async function runJoin(baseUrl) {
+/** Join an existing share endpoint (no provisioning): prompt for the endpoint
+ * details + write token and persist them. Shared by `agents share join` and the
+ * unified `agents setup share` wizard. */
+export async function runShareJoin(baseUrl) {
     const { password, input } = await import('@inquirer/prompts');
     const clean = baseUrl.replace(/\/+$/, '');
     const workerName = await input({ message: 'Worker name', default: DEFAULT_WORKER_NAME });

package/dist/commands/ssh.js

@@ -15,6 +15,7 @@ import * as os from 'os';
 import * as path from 'path';
 import chalk from 'chalk';
 import ora from 'ora';
+import { getCliVersion } from '../lib/version.js';
 import { readAndResolveBundleEnv, isHeadlessSecretsContext } from '../lib/secrets/bundles.js';
 import { machineId } from '../lib/session/sync/config.js';
 import { addIgnored, getDevice, loadDevices, loadIgnored, removeDevice, removeIgnored, upsertDevice, } from '../lib/devices/registry.js';
@@ -28,8 +29,16 @@ import { isInteractiveTerminal, isPromptCancelled } from './utils.js';
 import { hostNameFor, renderSshConfig } from '../lib/devices/ssh-config.js';
 import { ASKPASS_BUNDLE_ENV, ASKPASS_KEY_ENV, buildSshInvocation, writeAskpassShim, } from '../lib/devices/connect.js';
 import { ensureManagedKnownHostsDir, isHostPinned } from '../lib/devices/known-hosts.js';
-import { planFleetTargets, runFleet, skipLabel, upgradeCommand, } from '../lib/devices/fleet.js';
-import { fleetCapacity, fmtBytes, headroom, probeFleetStats, } from '../lib/devices/health.js';
+import { shouldSyncTerminfo, syncTerminfoToDevice, terminfoHostKey } from '../lib/devices/terminfo.js';
+import { fanOutDevices, planFleetTargets, remoteFleetTargets, runFleet, skipLabel, upgradeCommand, } from '../lib/devices/fleet.js';
+import { fleetCapacity, fmtBytes, headroom, probeLocalStats, probeFleetStats, } from '../lib/devices/health.js';
+import { buildFleetHealthReport, renderFleetMatrix, renderFleetWarnings, } from '../lib/devices/health-report.js';
+import { checkSyncStatus, countOrphans } from '../lib/drift.js';
+import { checkAllClis } from '../lib/teams/agents.js';
+import { buildRemoteAgentsInvocation } from '../lib/hosts/remote-cmd.js';
+import { sshExecAsync } from '../lib/ssh-exec.js';
+import { ALL_AGENT_IDS } from '../lib/agents.js';
+import { formatCheckedAge, isDeadVerdict, probeLocalFleetAuth, summarizeVerdicts, verdictLabel, writeFleetAuthRows, } from '../lib/auth-health.js';
 /** One-line summary of a device for `list`. `isSelf` marks the machine this
  * command is running on so it stands out from the rest of the tailnet. */
 function deviceSummary(d, isSelf = false) {
@@ -219,6 +228,236 @@ function printFleetResults(results) {
     if (failed > 0)
         process.exitCode = 1;
 }
+function localHealthRow(self, stats) {
+    return {
+        name: self,
+        platform: process.platform === 'darwin' ? 'macos' : process.platform,
+        version: getCliVersion(),
+        stats,
+        clis: checkAllClis(),
+        sync: checkSyncStatus(process.cwd()),
+        orphans: countOrphans(),
+    };
+}
+async function probeRemoteHealth(target) {
+    const isWin = /^win/i.test((target.platform ?? '').trim());
+    const env = isWin ? undefined : { PATH: '$HOME/.agents/.cache/shims:$HOME/.local/bin:$PATH' };
+    const versionCmd = buildRemoteAgentsInvocation(['--version'], undefined, isWin ? 'windows' : undefined, env);
+    const versionRes = await sshExecAsync(target.name, versionCmd, { timeoutMs: 15000, multiplex: true });
+    const version = versionRes.code === 0 ? versionRes.stdout.trim().split(/\s+/)[0] || null : null;
+    const doctorCmd = buildRemoteAgentsInvocation(['doctor', '--json'], undefined, isWin ? 'windows' : undefined, env);
+    const doctorRes = await sshExecAsync(target.name, doctorCmd, { timeoutMs: 30000, multiplex: true });
+    if (doctorRes.code !== 0) {
+        throw new Error(doctorRes.timedOut ? 'timed out' : (doctorRes.stderr.trim() || `exit ${doctorRes.code ?? 'unknown'}`));
+    }
+    const parsed = JSON.parse(doctorRes.stdout);
+    return {
+        version,
+        clis: parsed.clis ?? {},
+        sync: parsed.sync ?? [],
+        orphans: parsed.orphans ?? [],
+    };
+}
+async function runFleetStatus(opts) {
+    const reg = await loadDevices();
+    const self = machineId();
+    const planned = planFleetTargets(reg);
+    const probeable = planned.filter((t) => !t.skip).map((t) => t.device);
+    const statsMap = opts.stats === false
+        ? new Map()
+        : await probeFleetStats(probeable, { selfName: self });
+    if (opts.stats !== false && !statsMap.has(self)) {
+        statsMap.set(self, await probeLocalStats(self));
+    }
+    const rows = [localHealthRow(self, statsMap.get(self))];
+    const remoteTargets = remoteFleetTargets(planned, self)
+        .map((t) => ({
+        name: t.device.name,
+        platform: t.device.platform,
+        skip: t.skip,
+    }));
+    const remote = await fanOutDevices(remoteTargets, probeRemoteHealth);
+    for (const result of remote) {
+        const profile = reg[result.name];
+        if (result.status === 'ok' && result.value) {
+            rows.push({
+                name: result.name,
+                platform: profile?.platform,
+                stats: statsMap.get(result.name),
+                ...result.value,
+            });
+        }
+        else {
+            rows.push({
+                name: result.name,
+                platform: profile?.platform,
+                stats: statsMap.get(result.name),
+                skipped: result.reason ? String(result.reason) : undefined,
+                error: result.error,
+                clis: {},
+                sync: [],
+                orphans: [],
+            });
+        }
+    }
+    const report = buildFleetHealthReport(rows);
+    if (opts.json) {
+        console.log(JSON.stringify(report, null, 2));
+    }
+    else {
+        for (const line of renderFleetWarnings(report))
+            console.log(line);
+        console.log();
+        for (const line of renderFleetMatrix(report))
+            console.log(line);
+    }
+    if (opts.strict && report.hasWarnings)
+        process.exitCode = 1;
+}
+/** SSH into a host and run its local auth probe, returning its rows. */
+async function probeRemoteAuth(target) {
+    const isWin = /^win/i.test((target.platform ?? '').trim());
+    const env = isWin ? undefined : { PATH: '$HOME/.agents/.cache/shims:$HOME/.local/bin:$PATH' };
+    const cmd = buildRemoteAgentsInvocation(['devices', 'ping', '--local', '--json'], undefined, isWin ? 'windows' : undefined, env);
+    const res = await sshExecAsync(target.name, cmd, { timeoutMs: 60000, multiplex: true });
+    if (res.code !== 0) {
+        throw new Error(res.timedOut ? 'timed out' : (res.stderr.trim() || `exit ${res.code ?? 'unknown'}`));
+    }
+    const parsed = JSON.parse(res.stdout);
+    return parsed.rows ?? [];
+}
+async function runFleetPing(opts) {
+    const self = machineId();
+    const cliVersion = getCliVersion();
+    // --local: probe just this host. Used both directly and as the fan-out worker.
+    if (opts.local) {
+        const rows = await probeLocalFleetAuth({ cliVersion });
+        writeFleetAuthRows(self, rows);
+        if (opts.json) {
+            console.log(JSON.stringify({ host: self, rows }));
+        }
+        else {
+            for (const line of renderAuthMatrix([{ host: self, rows }], { verbose: opts.verbose }))
+                console.log(line);
+        }
+        if (opts.strict && rows.some((r) => isDeadVerdict(r.health.verdict))) {
+            process.exitCode = 1;
+        }
+        return;
+    }
+    // Origin: probe locally, then fan out to the rest of the fleet in parallel.
+    const reg = await loadDevices();
+    const planned = planFleetTargets(reg);
+    const results = [];
+    const localRows = await probeLocalFleetAuth({ cliVersion });
+    writeFleetAuthRows(self, localRows);
+    results.push({ host: self, rows: localRows });
+    const remoteTargets = remoteFleetTargets(planned, self).map((t) => ({
+        name: t.device.name,
+        platform: t.device.platform,
+        skip: t.skip,
+    }));
+    const probeable = remoteTargets.filter((t) => !t.skip).length;
+    const spinner = isInteractiveTerminal() && !opts.json
+        ? ora(`Pinging ${probeable} device${probeable === 1 ? '' : 's'}…`).start()
+        : undefined;
+    let remote;
+    try {
+        remote = await fanOutDevices(remoteTargets, probeRemoteAuth);
+    }
+    finally {
+        spinner?.stop();
+    }
+    for (const r of remote) {
+        if (r.status === 'ok' && r.value) {
+            results.push({ host: r.name, rows: r.value });
+            writeFleetAuthRows(r.name, r.value);
+        }
+        else {
+            results.push({
+                host: r.name,
+                rows: [],
+                error: r.error,
+                skipped: r.reason ? String(r.reason) : undefined,
+            });
+        }
+    }
+    if (opts.json) {
+        console.log(JSON.stringify(results, null, 2));
+    }
+    else {
+        for (const line of renderAuthMatrix(results, { verbose: opts.verbose }))
+            console.log(line);
+    }
+    const anyBad = results.some((r) => r.rows.some((row) => isDeadVerdict(row.health.verdict)));
+    if (opts.strict && anyBad)
+        process.exitCode = 1;
+}
+/** Color a per-host×agent cell: green all-live, red any revoked/expired, yellow degraded. */
+function authCell(summary, width) {
+    if (summary.total === 0)
+        return chalk.dim('·'.padEnd(width));
+    const text = `${summary.live}/${summary.total}`;
+    const padded = text.padEnd(width);
+    if (summary.bad > 0)
+        return chalk.red(padded);
+    if (summary.warn > 0)
+        return chalk.yellow(padded);
+    return chalk.green(padded);
+}
+/** Render the fleet auth matrix (device rows × agent columns) plus an optional per-account breakdown. */
+function renderAuthMatrix(results, opts) {
+    // Only show agent columns that appear somewhere in the results.
+    const present = new Set();
+    for (const r of results)
+        for (const row of r.rows)
+            present.add(row.agent);
+    const agents = ALL_AGENT_IDS.filter((a) => present.has(a));
+    const cellW = 6; // 6 disambiguates opencode/openclaw (both 'openc' at 5)
+    const nameW = Math.max(6, ...results.map((r) => r.host.length));
+    const lines = [chalk.bold('Fleet auth')];
+    const header = `  ${'Device'.padEnd(nameW)}  ${agents.map((a) => a.slice(0, cellW).padEnd(cellW)).join(' ')}`;
+    lines.push(chalk.gray(header));
+    for (const r of results) {
+        const cells = agents.map((a) => {
+            const verdicts = r.rows.filter((row) => row.agent === a).map((row) => row.health.verdict);
+            return authCell(summarizeVerdicts(verdicts), cellW);
+        });
+        let note = '';
+        if (r.skipped)
+            note = chalk.dim(`  ${r.skipped}`);
+        else if (r.error)
+            note = chalk.red(`  ${r.error}`);
+        else {
+            const dead = r.rows.filter((row) => isDeadVerdict(row.health.verdict)).length;
+            if (dead > 0)
+                note = chalk.red(`  ${dead} revoked — re-login`);
+        }
+        lines.push(`  ${r.host.padEnd(nameW)}  ${cells.join(' ')}${note}`);
+    }
+    lines.push('');
+    lines.push(chalk.gray('  cell = live/total accounts · green all live · red revoked (re-login) · yellow expired/unverified/limited'));
+    if (opts?.verbose) {
+        lines.push('');
+        lines.push(chalk.bold('Accounts'));
+        for (const r of results) {
+            if (r.rows.length === 0)
+                continue;
+            for (const row of r.rows.slice().sort((x, y) => (x.agent + x.version).localeCompare(y.agent + y.version))) {
+                const v = row.health.verdict;
+                const label = v === 'live' ? chalk.green(verdictLabel(v))
+                    : (v === 'revoked' || v === 'expired') ? chalk.red(verdictLabel(v))
+                        : chalk.yellow(verdictLabel(v));
+                const acctRaw = row.account ?? '—';
+                const acct = row.account ? chalk.cyan(acctRaw.padEnd(28)) : chalk.dim(acctRaw.padEnd(28));
+                const detail = row.health.detail ? chalk.dim(` ${row.health.detail}`) : '';
+                const age = chalk.dim(` · ${formatCheckedAge(row.health.checkedAt)}`);
+                lines.push(`  ${r.host.padEnd(nameW)}  ${`${row.agent}@${row.version}`.padEnd(22)}  ${acct}  ${label}${detail}${age}`);
+            }
+        }
+    }
+    return lines;
+}
 /** Register the `agents devices` command tree (also aliased as `fleet`). */
 function registerDevicesCommands(program) {
     const devicesCmd = program
@@ -346,6 +585,25 @@ Typical workflow:
         for (const line of renderDeviceTable(reg, names, self, statsMap, opts.full))
             console.log(line);
     });
+    devicesCmd
+        .command('status')
+        .description('Show fleet health: warnings rollup, per-device sync drift, CLI readiness, version skew, and resource headroom.')
+        .option('--json', 'output machine-readable JSON')
+        .option('--strict', 'exit non-zero when any device has drift or is unreachable')
+        .option('--no-stats', 'skip the live resource probe')
+        .action(async (opts) => {
+        await runFleetStatus(opts);
+    });
+    devicesCmd
+        .command('ping')
+        .description('Live auth health: complete a real request for every agent account across the fleet (unlike the cached "signed in" flag). Writes the shared auth-health cache read by `agents view` and `fleet status`.')
+        .option('--json', 'output machine-readable JSON')
+        .option('--local', 'probe only this host (used internally for fan-out)')
+        .option('--verbose', 'show a per-account breakdown, not just the per-host rollup')
+        .option('--strict', 'exit non-zero when any account is revoked (expired is soft — it self-refreshes)')
+        .action(async (opts) => {
+        await runFleetPing(opts);
+    });
     devicesCmd
         .command('show <name>')
         .description('Show the full profile for one device.')
@@ -567,6 +825,13 @@ secrets bundle via an askpass shim — the password never touches argv.
             const addr = hostNameFor(device);
             const pinned = addr ? isHostPinned(addr) : false;
             const { args, env } = buildSshInvocation(device, cmd, shim, { pinned });
+            // Interactive login: make the local terminal's terminfo (e.g.
+            // xterm-ghostty) available on the remote so backspace/colors/clear work.
+            // Best-effort + cached per host — never blocks the login (see terminfo.ts).
+            if (cmd.length === 0 && shouldSyncTerminfo({ term: process.env.TERM, shell: device.shell, interactive: process.stdout.isTTY ?? false })) {
+                const { args: tinfoArgs, env: tinfoEnv } = buildSshInvocation(device, ['tic', '-x', '-'], shim, { pinned });
+                syncTerminfoToDevice({ device, host: terminfoHostKey(device, addr), term: process.env.TERM, sshArgs: tinfoArgs, sshEnv: tinfoEnv });
+            }
             const res = spawnSync('ssh', args, {
                 stdio: 'inherit',
                 env: { ...process.env, ...env },

package/dist/commands/teams.d.ts

@@ -32,5 +32,16 @@ export declare function decideTeamMessageRoute(status: AgentStatus, hasMessage:
  * the teammate itself so we don't need the original --cloud CLI args.
  */
 export declare function wireCloudDispatcher(mgr: AgentManager): void;
+/**
+ * `teams add --remote-cwd` is a no-op trap. `--remote-cwd` comes from the shared
+ * `--host` option family (option.ts) and is meaningful for commands that *route*
+ * to a host, but `teams add` special-cases `--host`/`--device` as PLACEMENT, so
+ * the flag is never read — a teammate's directory is the team's repo plus its
+ * `--worktree`, not a path passed here. Silently ignoring it misleads you into
+ * thinking it set the teammate's repo path (the exact wrong model that turns one
+ * team into a teardown-and-rebuild). Reject with guidance instead. Exported for
+ * the unit test that pins the message.
+ */
+export declare function remoteCwdOnAddError(team: string): string;
 /** Register the `agents teams` command tree (list, create, add, status, start, remove, disband, logs, doctor). */
 export declare function registerTeamsCommands(program: Command): void;

package/dist/commands/teams.js

@@ -809,6 +809,23 @@ async function pickTeamOr(mgr, command) {
         throw err;
     }
 }
+/**
+ * `teams add --remote-cwd` is a no-op trap. `--remote-cwd` comes from the shared
+ * `--host` option family (option.ts) and is meaningful for commands that *route*
+ * to a host, but `teams add` special-cases `--host`/`--device` as PLACEMENT, so
+ * the flag is never read — a teammate's directory is the team's repo plus its
+ * `--worktree`, not a path passed here. Silently ignoring it misleads you into
+ * thinking it set the teammate's repo path (the exact wrong model that turns one
+ * team into a teardown-and-rebuild). Reject with guidance instead. Exported for
+ * the unit test that pins the message.
+ */
+export function remoteCwdOnAddError(team) {
+    return (`--remote-cwd has no effect on 'teams add' — it does not set a teammate's repo or directory.\n` +
+        `  A teammate works in the team's repo plus its own --worktree:\n` +
+        `    • Set the repo once, on the team:  agents teams create ${team} --repo <url|path>\n` +
+        `    • Place the teammate on a machine: agents teams add ${team} <agent> "<task>" --device <host> --worktree <name>\n` +
+        `  (Remote worktrees fork from the host's freshly-fetched origin/<default> automatically.)`);
+}
 /** Register the `agents teams` command tree (list, create, add, status, start, remove, disband, logs, doctor). */
 export function registerTeamsCommands(program) {
     const teams = program
@@ -853,6 +870,20 @@ export function registerTeamsCommands(program) {
         '<profile>'        a profile from 'agents view' — runs through 'agents
                            run <profile>' with the profile's host harness
 
+      Placement & repos (the part people get wrong):
+        --remote-cwd does NOT place a teammate or set its repo — it is ignored on
+        'teams add' (and rejected, so you find out immediately). A teammate's
+        directory is the team's repo plus its --worktree:
+          --device <host>     run THIS teammate on <host>
+          create --repo <r>   ONE repo for the whole team (defaults to this
+                              checkout's origin). Work spanning repos → one team
+                              per repo — don't build a cross-repo team then rebuild.
+        With --enable-worktrees each teammate gets its own worktree + branch:
+          local teammate      forks from your CURRENT local HEAD — no fetch, so
+                              pull/sync the checkout first or it forks stale
+          remote (--device)   forks from the freshly-fetched origin/<default> on
+                              the host (no manual sync needed)
+
       Short aliases:
         teams c  = create    teams a  = add       teams s  = status
         teams rm = remove    teams d  = disband   teams ls = list
@@ -978,7 +1009,7 @@ export function registerTeamsCommands(program) {
         .option('--use-worktree <path>', 'All teammates share this existing worktree path (mutually exclusive with --enable-worktrees)')
         .option('--devices <list>', 'Pool of machines this team may run teammates on (comma-separated). Enables distributed auto-scheduling.')
         .option('--hosts <list>', 'Alias for --devices.')
-        .option('--repo <urlOrPath>', 'How each device gets the code (git URL to clone, or a path). Defaults to the local checkout origin.')
+        .option('--repo <urlOrPath>', 'How each remote (--device) teammate gets the code — ONE git URL/path for the whole team (existing checkout reused, else cloned). A team is single-repo; for work across repos, make one team per repo. Defaults to this checkout origin.')
         .option('--json', 'Output machine-readable JSON')
         .action(async (team, opts) => {
         try {
@@ -1073,6 +1104,13 @@ export function registerTeamsCommands(program) {
         .option('--force', "Skip the advisory 'may not be signed in' / 'account throttled' warnings")
         .option('--json', 'Output machine-readable JSON')
         .action(async (team, teammate, task, opts) => {
+        // `--remote-cwd` rides the shared --host option family but is never read by
+        // `teams add` (placement, not routing). Fail loud with guidance rather than
+        // silently ignoring it — see remoteCwdOnAddError. `!== undefined` so even an
+        // explicit empty value (`--remote-cwd ""`) is rejected, not silently dropped.
+        if (opts.remoteCwd !== undefined) {
+            die(remoteCwdOnAddError(team));
+        }
         if (!VALID_MODES.includes(opts.mode)) {
             die(`Invalid mode '${opts.mode}'. Use one of: ${VALID_MODES.join(', ')}`);
         }

package/dist/commands/view.d.ts

@@ -7,23 +7,12 @@
  * rules, hooks, and promptcuts synced to that version.
  */
 import type { Command } from 'commander';
+import { accountDisplayLabel } from '../lib/agents.js';
 import type { AccountInfo } from '../lib/agents.js';
 import type { AgentId } from '../lib/types.js';
 import { type ProfileSummary } from '../lib/profiles.js';
-/**
- * Text for the account (email) column. Prefers the real email; otherwise, for a
- * signed-in agent whose credential carries no email but does carry an opaque
- * account id (Kimi's user_id), show `id:<user_id>` so distinct accounts read
- * distinctly instead of a generic "signed in". Falls back to "signed in" when we
- * have neither (Antigravity), and empty when signed out.
- *
- * When the account carries a Claude organizationType, the org badge is appended
- * — "email (Turing Labs · Team)" — so two installs signed into the same email
- * under different orgs (personal Max vs a Team seat) read distinctly. The
- * suffix is plain text inside the label so the existing column-width pass
- * measures and pads it for free.
- */
-export declare function accountColumnLabel(info?: Pick<AccountInfo, 'email' | 'accountId' | 'signedIn' | 'organizationType' | 'organizationName'> | null): string;
+/** Shared account identity formatter, re-exported for the view-specific tests. */
+export declare const accountColumnLabel: typeof accountDisplayLabel;
 type SyncState = 'synced' | 'new' | 'modified' | 'deleted';
 /** Per-section filter flags. When any are true, only those sections render. */
 export interface ViewSectionFilter {
@@ -133,6 +122,7 @@ export declare function viewAction(agentArg?: string, options?: {
     dryRun?: boolean;
     resources?: string | boolean;
     detailed?: boolean;
+    refresh?: boolean;
 } & ViewSectionFilter): Promise<void>;
 /** Register the `agents view` command. */
 export declare function registerViewCommand(program: Command): void;

package/dist/commands/view.js

@@ -4,8 +4,11 @@ import { visibleWidth, termLink } from '../lib/format.js';
 import ora from 'ora';
 import * as fs from 'fs';
 import * as path from 'path';
-import { AGENTS, ALL_AGENT_IDS, accountOrgBadge, getAllCliStates, getAccountInfo, resolveAgentName, formatAgentError, agentLabel, colorAgent, } from '../lib/agents.js';
-import { deriveUsageStatusFromSnapshot, formatUsageSection, formatUsageSummary, formatUsageStatusBadge, getUsageInfoForIdentity, getUsageInfoByIdentity, getUsageLookupKey, } from '../lib/usage.js';
+import { AGENTS, ALL_AGENT_IDS, accountDisplayLabel, getAllCliStates, getAccountInfo, resolveAgentName, formatAgentError, agentLabel, colorAgent, } from '../lib/agents.js';
+import { loginHint } from '../lib/signin-badge.js';
+import { machineId } from '../lib/machine-id.js';
+import { authCacheKey, formatCheckedAge, readAuthHealthCache } from '../lib/auth-health.js';
+import { agentReportsUsage, deriveUsageStatusFromSnapshot, formatUsageSection, formatUsageSummary, formatUsageStatusBadge, getUsageInfoForIdentity, getUsageInfoByIdentity, getUsageLookupKey, } from '../lib/usage.js';
 import { readManifest } from '../lib/manifest.js';
 import { listInstalledVersions, listInstalledVersionDirs, getGlobalDefault, getVersionHomePath, getVersionDir, getAvailableResources, getActuallySyncedResources, getNewResources, getProjectOnlyResources, hasNewResources, promptNewResourceSelection, syncResourcesToVersion, removeVersion, printTrashFooter, reconcileStaleLatestForAgent, isGlobalBinaryAgent, getLiveVersion, } from '../lib/versions.js';
 import { ensureVersionedAliasCurrent, removeShim, } from '../lib/shims.js';
@@ -25,33 +28,8 @@ import { loadManifest, isStale } from '../lib/staleness/index.js';
 import { confirm } from '@inquirer/prompts';
 import { formatPath, isInteractiveTerminal, isPromptCancelled } from './utils.js';
 import { terminalWidth, truncateToWidth, stringWidth } from '../lib/session/width.js';
-// Shown in the email column for agents that are signed in but expose no email
-// address locally (Antigravity stores an opaque OAuth grant with no identity).
-const SIGNED_IN_LABEL = 'signed in';
-/**
- * Text for the account (email) column. Prefers the real email; otherwise, for a
- * signed-in agent whose credential carries no email but does carry an opaque
- * account id (Kimi's user_id), show `id:<user_id>` so distinct accounts read
- * distinctly instead of a generic "signed in". Falls back to "signed in" when we
- * have neither (Antigravity), and empty when signed out.
- *
- * When the account carries a Claude organizationType, the org badge is appended
- * — "email (Turing Labs · Team)" — so two installs signed into the same email
- * under different orgs (personal Max vs a Team seat) read distinctly. The
- * suffix is plain text inside the label so the existing column-width pass
- * measures and pads it for free.
- */
-export function accountColumnLabel(info) {
-    if (!info)
-        return '';
-    if (info.email) {
-        const badge = accountOrgBadge(info);
-        return badge ? `${info.email} (${badge})` : info.email;
-    }
-    if (info.signedIn)
-        return info.accountId ? `id:${info.accountId}` : SIGNED_IN_LABEL;
-    return '';
-}
+/** Shared account identity formatter, re-exported for the view-specific tests. */
+export const accountColumnLabel = accountDisplayLabel;
 /**
  * Group profile summaries by their host harness, optionally filtered to a
  * single agent. Profile YAMLs that fail validation are silently skipped by
@@ -244,7 +222,23 @@ function renderHostClisSection(cwd) {
         console.log(`  ${chalk.red('error')}      ${chalk.gray(err.file)}: ${chalk.gray(err.reason)}`);
     }
 }
-async function showInstalledVersions(filterAgentId) {
+/**
+ * A compact live-auth chip for a version row, read from the fleet auth-health
+ * cache (written by `agents fleet ping` / the daemon). Empty when the install
+ * hasn't been probed — this is the local "signed in" flag's ground-truth
+ * companion: ● live, ○ revoked (re-login), ◐ unverified/limited, plus its age.
+ */
+function liveAuthChip(cache, host, agentId, version) {
+    const h = cache[authCacheKey(host, agentId, version)];
+    if (!h)
+        return '';
+    const glyph = h.verdict === 'live' ? chalk.green('●')
+        : h.verdict === 'revoked' ? chalk.red('○')
+            : h.verdict === 'expired' ? chalk.yellow('○')
+                : chalk.yellow('◐');
+    return `${glyph} ${chalk.gray(formatCheckedAge(h.checkedAt))}`;
+}
+async function showInstalledVersions(filterAgentId, viewOpts) {
     const spinnerText = filterAgentId
         ? `Checking ${agentLabel(filterAgentId)} agents...`
         : 'Checking installed agents...';
@@ -275,6 +269,9 @@ async function showInstalledVersions(filterAgentId) {
     }
     // Shim healing is silent — users don't need to know about internal repairs
     console.log(chalk.bold('Installed Agent CLIs\n'));
+    const selfHost = machineId();
+    // Read the auth-health cache once (not per version row — see the batching note above).
+    const authCache = readAuthHealthCache();
     // Pre-fetch account info for all versions in parallel
     const infoFetches = [];
     const globalInfoFetches = [];
@@ -326,7 +323,7 @@ async function showInstalledVersions(filterAgentId) {
             cliVersion,
             info,
         })),
-    ]);
+    ], { forceRefresh: viewOpts?.forceRefresh });
     const mergeCanonical = (info) => {
         const key = getUsageLookupKey(info);
         if (!key)
@@ -417,7 +414,8 @@ async function showInstalledVersions(filterAgentId) {
                 const info = rawInfo ? mergeCanonical(rawInfo) : undefined;
                 const usageKey = getUsageLookupKey(info);
                 const usageInfo = usageKey ? usageByKey.get(usageKey) : undefined;
-                const usageStr = formatUsageSummary(info?.plan || null, usageInfo?.snapshot || null, maxPlanWidth);
+                const usageUnavailable = agentReportsUsage(agentId) && !!info?.signedIn && !usageInfo?.snapshot;
+                const usageStr = formatUsageSummary(info?.plan || null, usageInfo?.snapshot || null, maxPlanWidth, { unavailable: usageUnavailable });
                 maxUsageWidth = Math.max(maxUsageWidth, visibleWidth(usageStr));
                 const statusStr = formatUsageStatusBadge(info?.usageStatus);
                 maxStatusWidth = Math.max(maxStatusWidth, visibleWidth(statusStr));
@@ -457,7 +455,8 @@ async function showInstalledVersions(filterAgentId) {
                 const parts = [`    ${label}`];
                 const hasEmail = !!vInfo?.email;
                 const signedIn = !!vInfo?.signedIn;
-                const usageStr = formatUsageSummary(vInfo?.plan || null, usageInfo?.snapshot || null, maxPlanWidth);
+                const usageUnavailable = agentReportsUsage(agentId) && signedIn && !usageInfo?.snapshot;
+                const usageStr = formatUsageSummary(vInfo?.plan || null, usageInfo?.snapshot || null, maxPlanWidth, { unavailable: usageUnavailable });
                 const hasUsage = usageStr.length > 0;
                 // Only show lastActive for versions with an actual logged-in account.
                 // Otherwise it reflects install time (misleading "just now" for fresh installs).
@@ -471,7 +470,7 @@ async function showInstalledVersions(filterAgentId) {
                     runDefaultBits.push(`model:${runDefaults.model}`);
                 if (!hasEmail && !hasUsage && !signedIn) {
                     // Installed but never signed in
-                    parts.push(chalk.gray('(not signed in — run ' + agent.cliCommand + ' to log in)'));
+                    parts.push(chalk.gray('(logged out — log in with: ' + loginHint(agentId) + ')'));
                 }
                 else {
                     if (hasEmail || hasUsage || hasActive || signedIn) {
@@ -497,6 +496,9 @@ async function showInstalledVersions(filterAgentId) {
                 if (runDefaultBits.length > 0) {
                     parts.push(chalk.gray(`run ${runDefaultBits.join(' ')}`));
                 }
+                const authChip = liveAuthChip(authCache, selfHost, agentId, version);
+                if (authChip)
+                    parts.push(authChip);
                 console.log(parts.join('  '));
                 if (showPaths) {
                     const versionDir = getVersionDir(agentId, version);
@@ -1438,7 +1440,7 @@ export async function viewAction(agentArg, options) {
             return;
         }
         // No argument: show all installed versions
-        await showInstalledVersions();
+        await showInstalledVersions(undefined, { forceRefresh: options?.refresh === true });
         return;
     }
     // Parse agent@version syntax
@@ -1499,7 +1501,7 @@ export async function viewAction(agentArg, options) {
     }
     else {
         // Just agent name: show versions for that agent
-        await showInstalledVersions(agentId);
+        await showInstalledVersions(agentId, { forceRefresh: options?.refresh === true });
     }
 }
 /** Register the `agents view` command. */
@@ -1509,6 +1511,7 @@ export function registerViewCommand(program) {
         .option('--json', 'Emit machine-readable JSON (version list, usage, signed-in status).')
         .option('--resources [sections]', 'In --json mode, include each version\'s resources: "all" (default) or a comma list (skills,plugins,mcp,commands,workflows,memory,hooks). Implies --json.')
         .option('--detailed', 'Include all resources in --json output (alias for --resources all). Implies --json.')
+        .option('-r, --refresh', 'Force a live usage refresh, bypassing the cache (slower). Repopulates the S:/W: limit bars for every account whose token is reachable.')
         .option('--prune', 'Remove older installed versions that share an account with a newer installed version. Skips the global default.')
         .option('--dry-run', 'With --prune, show duplicate versions without deleting')
         .option('-y, --yes', 'Skip the prune confirmation prompt.')