@phnx-labs/agents-cli 1.20.68 → 1.20.70

package/dist/commands/ssh.js

@@ -29,13 +29,17 @@ import { isInteractiveTerminal, isPromptCancelled } from './utils.js';
 import { hostNameFor, renderSshConfig } from '../lib/devices/ssh-config.js';
 import { ASKPASS_BUNDLE_ENV, ASKPASS_KEY_ENV, buildSshInvocation, writeAskpassShim, } from '../lib/devices/connect.js';
 import { ensureManagedKnownHostsDir, isHostPinned } from '../lib/devices/known-hosts.js';
+import { shouldSyncTerminfo, syncTerminfoToDevice, terminfoHostKey } from '../lib/devices/terminfo.js';
 import { fanOutDevices, planFleetTargets, remoteFleetTargets, runFleet, skipLabel, upgradeCommand, } from '../lib/devices/fleet.js';
-import { fleetCapacity, fmtBytes, headroom, probeLocalStats, probeFleetStats, } from '../lib/devices/health.js';
+import { fleetCapacity, fmtBytes, headroom, } from '../lib/devices/health.js';
 import { buildFleetHealthReport, renderFleetMatrix, renderFleetWarnings, } from '../lib/devices/health-report.js';
+import { loadFleetStats, readStatsCache } from '../lib/devices/stats-cache.js';
 import { checkSyncStatus, countOrphans } from '../lib/drift.js';
 import { checkAllClis } from '../lib/teams/agents.js';
 import { buildRemoteAgentsInvocation } from '../lib/hosts/remote-cmd.js';
 import { sshExecAsync } from '../lib/ssh-exec.js';
+import { ALL_AGENT_IDS } from '../lib/agents.js';
+import { formatCheckedAge, isDeadVerdict, probeLocalFleetAuth, readAuthHealthCache, summarizeHostAuth, summarizeVerdicts, verdictLabel, writeFleetAuthRows, } from '../lib/auth-health.js';
 /** One-line summary of a device for `list`. `isSelf` marks the machine this
  * command is running on so it stands out from the rest of the tailnet. */
 function deviceSummary(d, isSelf = false) {
@@ -253,19 +257,23 @@ async function probeRemoteHealth(target) {
         clis: parsed.clis ?? {},
         sync: parsed.sync ?? [],
         orphans: parsed.orphans ?? [],
+        // The remote self-reports its own cached auth rollup (fresh via its daemon),
+        // so the Auth column is current without a prior fleet-wide `fleet ping`.
+        // Older remotes that don't emit it fall back to this host's cache below.
+        auth: parsed.auth,
     };
 }
 async function runFleetStatus(opts) {
     const reg = await loadDevices();
     const self = machineId();
+    const forceRefresh = Boolean(opts.refresh || opts.live);
     const planned = planFleetTargets(reg);
     const probeable = planned.filter((t) => !t.skip).map((t) => t.device);
+    // Cache-first: serve remote stats from the daemon-warmed cache (instant),
+    // probe this machine locally, and only ssh out for missing/forced rows.
     const statsMap = opts.stats === false
         ? new Map()
-        : await probeFleetStats(probeable, { selfName: self });
-    if (opts.stats !== false && !statsMap.has(self)) {
-        statsMap.set(self, await probeLocalStats(self));
-    }
+        : (await loadFleetStats(probeable, { forceRefresh, selfName: self })).stats;
     const rows = [localHealthRow(self, statsMap.get(self))];
     const remoteTargets = remoteFleetTargets(planned, self)
         .map((t) => ({
@@ -297,6 +305,15 @@ async function runFleetStatus(opts) {
             });
         }
     }
+    // Auth column: remote rows already carry the host's self-reported rollup from
+    // its `doctor --json`. Fill the rest (this machine; older remotes that don't
+    // emit it) from this host's local cache — written by `agents fleet ping` and
+    // the daemon's local refresh. A never-probed host rolls up to "—". No network.
+    const authCache = readAuthHealthCache();
+    for (const row of rows) {
+        if (!row.auth)
+            row.auth = summarizeHostAuth(authCache, row.name);
+    }
     const report = buildFleetHealthReport(rows);
     if (opts.json) {
         console.log(JSON.stringify(report, null, 2));
@@ -311,6 +328,150 @@ async function runFleetStatus(opts) {
     if (opts.strict && report.hasWarnings)
         process.exitCode = 1;
 }
+/** SSH into a host and run its local auth probe, returning its rows. */
+async function probeRemoteAuth(target) {
+    const isWin = /^win/i.test((target.platform ?? '').trim());
+    const env = isWin ? undefined : { PATH: '$HOME/.agents/.cache/shims:$HOME/.local/bin:$PATH' };
+    const cmd = buildRemoteAgentsInvocation(['devices', 'ping', '--local', '--json'], undefined, isWin ? 'windows' : undefined, env);
+    const res = await sshExecAsync(target.name, cmd, { timeoutMs: 60000, multiplex: true });
+    if (res.code !== 0) {
+        throw new Error(res.timedOut ? 'timed out' : (res.stderr.trim() || `exit ${res.code ?? 'unknown'}`));
+    }
+    const parsed = JSON.parse(res.stdout);
+    return parsed.rows ?? [];
+}
+async function runFleetPing(opts) {
+    const self = machineId();
+    const cliVersion = getCliVersion();
+    // --local: probe just this host. Used both directly and as the fan-out worker.
+    if (opts.local) {
+        const rows = await probeLocalFleetAuth({ cliVersion });
+        writeFleetAuthRows(self, rows);
+        if (opts.json) {
+            console.log(JSON.stringify({ host: self, rows }));
+        }
+        else {
+            for (const line of renderAuthMatrix([{ host: self, rows }], { verbose: opts.verbose }))
+                console.log(line);
+        }
+        if (opts.strict && rows.some((r) => isDeadVerdict(r.health.verdict))) {
+            process.exitCode = 1;
+        }
+        return;
+    }
+    // Origin: probe locally, then fan out to the rest of the fleet in parallel.
+    const reg = await loadDevices();
+    const planned = planFleetTargets(reg);
+    const results = [];
+    const localRows = await probeLocalFleetAuth({ cliVersion });
+    writeFleetAuthRows(self, localRows);
+    results.push({ host: self, rows: localRows });
+    const remoteTargets = remoteFleetTargets(planned, self).map((t) => ({
+        name: t.device.name,
+        platform: t.device.platform,
+        skip: t.skip,
+    }));
+    const probeable = remoteTargets.filter((t) => !t.skip).length;
+    const spinner = isInteractiveTerminal() && !opts.json
+        ? ora(`Pinging ${probeable} device${probeable === 1 ? '' : 's'}…`).start()
+        : undefined;
+    let remote;
+    try {
+        remote = await fanOutDevices(remoteTargets, probeRemoteAuth);
+    }
+    finally {
+        spinner?.stop();
+    }
+    for (const r of remote) {
+        if (r.status === 'ok' && r.value) {
+            results.push({ host: r.name, rows: r.value });
+            writeFleetAuthRows(r.name, r.value);
+        }
+        else {
+            results.push({
+                host: r.name,
+                rows: [],
+                error: r.error,
+                skipped: r.reason ? String(r.reason) : undefined,
+            });
+        }
+    }
+    if (opts.json) {
+        console.log(JSON.stringify(results, null, 2));
+    }
+    else {
+        for (const line of renderAuthMatrix(results, { verbose: opts.verbose }))
+            console.log(line);
+    }
+    const anyBad = results.some((r) => r.rows.some((row) => isDeadVerdict(row.health.verdict)));
+    if (opts.strict && anyBad)
+        process.exitCode = 1;
+}
+/** Color a per-host×agent cell: green all-live, red any revoked/expired, yellow degraded. */
+function authCell(summary, width) {
+    if (summary.total === 0)
+        return chalk.dim('·'.padEnd(width));
+    const text = `${summary.live}/${summary.total}`;
+    const padded = text.padEnd(width);
+    if (summary.bad > 0)
+        return chalk.red(padded);
+    if (summary.warn > 0)
+        return chalk.yellow(padded);
+    return chalk.green(padded);
+}
+/** Render the fleet auth matrix (device rows × agent columns) plus an optional per-account breakdown. */
+function renderAuthMatrix(results, opts) {
+    // Only show agent columns that appear somewhere in the results.
+    const present = new Set();
+    for (const r of results)
+        for (const row of r.rows)
+            present.add(row.agent);
+    const agents = ALL_AGENT_IDS.filter((a) => present.has(a));
+    const cellW = 6; // 6 disambiguates opencode/openclaw (both 'openc' at 5)
+    const nameW = Math.max(6, ...results.map((r) => r.host.length));
+    const lines = [chalk.bold('Fleet auth')];
+    const header = `  ${'Device'.padEnd(nameW)}  ${agents.map((a) => a.slice(0, cellW).padEnd(cellW)).join(' ')}`;
+    lines.push(chalk.gray(header));
+    for (const r of results) {
+        const cells = agents.map((a) => {
+            const verdicts = r.rows.filter((row) => row.agent === a).map((row) => row.health.verdict);
+            return authCell(summarizeVerdicts(verdicts), cellW);
+        });
+        let note = '';
+        if (r.skipped)
+            note = chalk.dim(`  ${r.skipped}`);
+        else if (r.error)
+            note = chalk.red(`  ${r.error}`);
+        else {
+            const dead = r.rows.filter((row) => isDeadVerdict(row.health.verdict)).length;
+            if (dead > 0)
+                note = chalk.red(`  ${dead} revoked — re-login`);
+        }
+        lines.push(`  ${r.host.padEnd(nameW)}  ${cells.join(' ')}${note}`);
+    }
+    lines.push('');
+    lines.push(chalk.gray('  cell = live/total accounts · green all live · red revoked (re-login) · yellow expired/unverified/limited'));
+    if (opts?.verbose) {
+        lines.push('');
+        lines.push(chalk.bold('Accounts'));
+        for (const r of results) {
+            if (r.rows.length === 0)
+                continue;
+            for (const row of r.rows.slice().sort((x, y) => (x.agent + x.version).localeCompare(y.agent + y.version))) {
+                const v = row.health.verdict;
+                const label = v === 'live' ? chalk.green(verdictLabel(v))
+                    : (v === 'revoked' || v === 'expired') ? chalk.red(verdictLabel(v))
+                        : chalk.yellow(verdictLabel(v));
+                const acctRaw = row.account ?? '—';
+                const acct = row.account ? chalk.cyan(acctRaw.padEnd(28)) : chalk.dim(acctRaw.padEnd(28));
+                const detail = row.health.detail ? chalk.dim(` ${row.health.detail}`) : '';
+                const age = chalk.dim(` · ${formatCheckedAge(row.health.checkedAt)}`);
+                lines.push(`  ${r.host.padEnd(nameW)}  ${`${row.agent}@${row.version}`.padEnd(22)}  ${acct}  ${label}${detail}${age}`);
+            }
+        }
+    }
+    return lines;
+}
 /** Register the `agents devices` command tree (also aliased as `fleet`). */
 function registerDevicesCommands(program) {
     const devicesCmd = program
@@ -403,6 +564,8 @@ Typical workflow:
         .description('List registered devices with platform, address, reachability, and live resource headroom.')
         .option('--json', 'output the registry as a JSON array (for scripts and hooks)')
         .option('--no-stats', 'skip the live resource probe (instant; names/addresses only)')
+        .option('--refresh', 'force a live probe of every device, bypassing the cache')
+        .option('--live', 'alias of --refresh (shorter to type)')
         .option('-f, --full', 'full mode: add per-device core count and free/total memory')
         .action(async (opts) => {
         const reg = await loadDevices();
@@ -417,18 +580,26 @@ Typical workflow:
             return;
         }
         const self = machineId();
+        const forceRefresh = Boolean(opts.refresh || opts.live);
         let statsMap;
+        let freshness;
         if (opts.stats !== false) {
-            // Probe only reachable devices, in parallel, bounded by the per-probe
-            // timeout — a slow box degrades to "—", it never hangs the table.
+            // Cache-first: serve remote devices from the daemon-warmed cache
+            // (instant), probe this machine locally, and only ssh out for missing or
+            // forced (--refresh/--live) rows — so a warm read never hangs on a box.
             const probeable = planFleetTargets(reg)
                 .filter((t) => !t.skip)
                 .map((t) => t.device);
-            const spinner = isInteractiveTerminal()
+            // Only spin when we'll actually ssh (forced, or a cold/partial cache).
+            const cache = readStatsCache();
+            const willSsh = forceRefresh || probeable.some((d) => d.name !== self && !cache[d.name]);
+            const spinner = willSsh && isInteractiveTerminal()
                 ? ora(`Probing ${probeable.length} device${probeable.length === 1 ? '' : 's'}…`).start()
                 : undefined;
             try {
-                statsMap = await probeFleetStats(probeable, { selfName: self });
+                const res = await loadFleetStats(probeable, { forceRefresh, selfName: self });
+                statsMap = res.stats;
+                freshness = res;
             }
             finally {
                 spinner?.stop();
@@ -437,6 +608,9 @@ Typical workflow:
         console.log(chalk.bold(`Devices (${names.length})`));
         for (const line of renderDeviceTable(reg, names, self, statsMap, opts.full))
             console.log(line);
+        if (freshness?.servedFromCache && freshness.oldestFetchedAt != null) {
+            console.log(chalk.gray(`  updated ${formatCheckedAge(freshness.oldestFetchedAt)} — pass --refresh (--live) for a live probe`));
+        }
     });
     devicesCmd
         .command('status')
@@ -444,9 +618,21 @@ Typical workflow:
         .option('--json', 'output machine-readable JSON')
         .option('--strict', 'exit non-zero when any device has drift or is unreachable')
         .option('--no-stats', 'skip the live resource probe')
+        .option('--refresh', 'force a live probe of every device, bypassing the cache')
+        .option('--live', 'alias of --refresh (shorter to type)')
         .action(async (opts) => {
         await runFleetStatus(opts);
     });
+    devicesCmd
+        .command('ping')
+        .description('Live auth health: complete a real request for every agent account across the fleet (unlike the cached "signed in" flag). Writes the shared auth-health cache read by `agents view` and `fleet status`.')
+        .option('--json', 'output machine-readable JSON')
+        .option('--local', 'probe only this host (used internally for fan-out)')
+        .option('--verbose', 'show a per-account breakdown, not just the per-host rollup')
+        .option('--strict', 'exit non-zero when any account is revoked (expired is soft — it self-refreshes)')
+        .action(async (opts) => {
+        await runFleetPing(opts);
+    });
     devicesCmd
         .command('show <name>')
         .description('Show the full profile for one device.')
@@ -668,6 +854,13 @@ secrets bundle via an askpass shim — the password never touches argv.
             const addr = hostNameFor(device);
             const pinned = addr ? isHostPinned(addr) : false;
             const { args, env } = buildSshInvocation(device, cmd, shim, { pinned });
+            // Interactive login: make the local terminal's terminfo (e.g.
+            // xterm-ghostty) available on the remote so backspace/colors/clear work.
+            // Best-effort + cached per host — never blocks the login (see terminfo.ts).
+            if (cmd.length === 0 && shouldSyncTerminfo({ term: process.env.TERM, shell: device.shell, interactive: process.stdout.isTTY ?? false })) {
+                const { args: tinfoArgs, env: tinfoEnv } = buildSshInvocation(device, ['tic', '-x', '-'], shim, { pinned });
+                syncTerminfoToDevice({ device, host: terminfoHostKey(device, addr), term: process.env.TERM, sshArgs: tinfoArgs, sshEnv: tinfoEnv });
+            }
             const res = spawnSync('ssh', args, {
                 stdio: 'inherit',
                 env: { ...process.env, ...env },

package/dist/commands/view.d.ts

@@ -7,23 +7,12 @@
  * rules, hooks, and promptcuts synced to that version.
  */
 import type { Command } from 'commander';
+import { accountDisplayLabel } from '../lib/agents.js';
 import type { AccountInfo } from '../lib/agents.js';
 import type { AgentId } from '../lib/types.js';
 import { type ProfileSummary } from '../lib/profiles.js';
-/**
- * Text for the account (email) column. Prefers the real email; otherwise, for a
- * signed-in agent whose credential carries no email but does carry an opaque
- * account id (Kimi's user_id), show `id:<user_id>` so distinct accounts read
- * distinctly instead of a generic "signed in". Falls back to "signed in" when we
- * have neither (Antigravity), and empty when signed out.
- *
- * When the account carries a Claude organizationType, the org badge is appended
- * — "email (Turing Labs · Team)" — so two installs signed into the same email
- * under different orgs (personal Max vs a Team seat) read distinctly. The
- * suffix is plain text inside the label so the existing column-width pass
- * measures and pads it for free.
- */
-export declare function accountColumnLabel(info?: Pick<AccountInfo, 'email' | 'accountId' | 'signedIn' | 'organizationType' | 'organizationName'> | null): string;
+/** Shared account identity formatter, re-exported for the view-specific tests. */
+export declare const accountColumnLabel: typeof accountDisplayLabel;
 type SyncState = 'synced' | 'new' | 'modified' | 'deleted';
 /** Per-section filter flags. When any are true, only those sections render. */
 export interface ViewSectionFilter {
@@ -134,6 +123,7 @@ export declare function viewAction(agentArg?: string, options?: {
     resources?: string | boolean;
     detailed?: boolean;
     refresh?: boolean;
+    live?: boolean;
 } & ViewSectionFilter): Promise<void>;
 /** Register the `agents view` command. */
 export declare function registerViewCommand(program: Command): void;

package/dist/commands/view.js

@@ -4,8 +4,10 @@ import { visibleWidth, termLink } from '../lib/format.js';
 import ora from 'ora';
 import * as fs from 'fs';
 import * as path from 'path';
-import { AGENTS, ALL_AGENT_IDS, accountOrgBadge, getAllCliStates, getAccountInfo, resolveAgentName, formatAgentError, agentLabel, colorAgent, } from '../lib/agents.js';
+import { AGENTS, ALL_AGENT_IDS, accountDisplayLabel, getAllCliStates, getAccountInfo, resolveAgentName, formatAgentError, agentLabel, colorAgent, } from '../lib/agents.js';
 import { loginHint } from '../lib/signin-badge.js';
+import { machineId } from '../lib/machine-id.js';
+import { authCacheKey, formatCheckedAge, readAuthHealthCache } from '../lib/auth-health.js';
 import { agentReportsUsage, deriveUsageStatusFromSnapshot, formatUsageSection, formatUsageSummary, formatUsageStatusBadge, getUsageInfoForIdentity, getUsageInfoByIdentity, getUsageLookupKey, } from '../lib/usage.js';
 import { readManifest } from '../lib/manifest.js';
 import { listInstalledVersions, listInstalledVersionDirs, getGlobalDefault, getVersionHomePath, getVersionDir, getAvailableResources, getActuallySyncedResources, getNewResources, getProjectOnlyResources, hasNewResources, promptNewResourceSelection, syncResourcesToVersion, removeVersion, printTrashFooter, reconcileStaleLatestForAgent, isGlobalBinaryAgent, getLiveVersion, } from '../lib/versions.js';
@@ -26,33 +28,8 @@ import { loadManifest, isStale } from '../lib/staleness/index.js';
 import { confirm } from '@inquirer/prompts';
 import { formatPath, isInteractiveTerminal, isPromptCancelled } from './utils.js';
 import { terminalWidth, truncateToWidth, stringWidth } from '../lib/session/width.js';
-// Shown in the email column for agents that are signed in but expose no email
-// address locally (Antigravity stores an opaque OAuth grant with no identity).
-const SIGNED_IN_LABEL = 'signed in';
-/**
- * Text for the account (email) column. Prefers the real email; otherwise, for a
- * signed-in agent whose credential carries no email but does carry an opaque
- * account id (Kimi's user_id), show `id:<user_id>` so distinct accounts read
- * distinctly instead of a generic "signed in". Falls back to "signed in" when we
- * have neither (Antigravity), and empty when signed out.
- *
- * When the account carries a Claude organizationType, the org badge is appended
- * — "email (Turing Labs · Team)" — so two installs signed into the same email
- * under different orgs (personal Max vs a Team seat) read distinctly. The
- * suffix is plain text inside the label so the existing column-width pass
- * measures and pads it for free.
- */
-export function accountColumnLabel(info) {
-    if (!info)
-        return '';
-    if (info.email) {
-        const badge = accountOrgBadge(info);
-        return badge ? `${info.email} (${badge})` : info.email;
-    }
-    if (info.signedIn)
-        return info.accountId ? `id:${info.accountId}` : SIGNED_IN_LABEL;
-    return '';
-}
+/** Shared account identity formatter, re-exported for the view-specific tests. */
+export const accountColumnLabel = accountDisplayLabel;
 /**
  * Group profile summaries by their host harness, optionally filtered to a
  * single agent. Profile YAMLs that fail validation are silently skipped by
@@ -245,6 +222,22 @@ function renderHostClisSection(cwd) {
         console.log(`  ${chalk.red('error')}      ${chalk.gray(err.file)}: ${chalk.gray(err.reason)}`);
     }
 }
+/**
+ * A compact live-auth chip for a version row, read from the fleet auth-health
+ * cache (written by `agents fleet ping` / the daemon). Empty when the install
+ * hasn't been probed — this is the local "signed in" flag's ground-truth
+ * companion: ● live, ○ revoked (re-login), ◐ unverified/limited, plus its age.
+ */
+function liveAuthChip(cache, host, agentId, version) {
+    const h = cache[authCacheKey(host, agentId, version)];
+    if (!h)
+        return '';
+    const glyph = h.verdict === 'live' ? chalk.green('●')
+        : h.verdict === 'revoked' ? chalk.red('○')
+            : h.verdict === 'expired' ? chalk.yellow('○')
+                : chalk.yellow('◐');
+    return `${glyph} ${chalk.gray(formatCheckedAge(h.checkedAt))}`;
+}
 async function showInstalledVersions(filterAgentId, viewOpts) {
     const spinnerText = filterAgentId
         ? `Checking ${agentLabel(filterAgentId)} agents...`
@@ -276,6 +269,9 @@ async function showInstalledVersions(filterAgentId, viewOpts) {
     }
     // Shim healing is silent — users don't need to know about internal repairs
     console.log(chalk.bold('Installed Agent CLIs\n'));
+    const selfHost = machineId();
+    // Read the auth-health cache once (not per version row — see the batching note above).
+    const authCache = readAuthHealthCache();
     // Pre-fetch account info for all versions in parallel
     const infoFetches = [];
     const globalInfoFetches = [];
@@ -500,6 +496,9 @@ async function showInstalledVersions(filterAgentId, viewOpts) {
                 if (runDefaultBits.length > 0) {
                     parts.push(chalk.gray(`run ${runDefaultBits.join(' ')}`));
                 }
+                const authChip = liveAuthChip(authCache, selfHost, agentId, version);
+                if (authChip)
+                    parts.push(authChip);
                 console.log(parts.join('  '));
                 if (showPaths) {
                     const versionDir = getVersionDir(agentId, version);
@@ -1401,6 +1400,8 @@ export async function pruneDuplicates(filterAgentId, yes, dryRun) {
  * Exported for use by deprecated aliases.
  */
 export async function viewAction(agentArg, options) {
+    // --live is a shorter-to-type alias of --refresh; both force a live probe.
+    const forceRefresh = options?.refresh === true || options?.live === true;
     // --resources / --detailed imply --json (they only shape structured output).
     const explicitResources = options?.detailed === true || options?.resources !== undefined;
     const json = options?.json === true || explicitResources;
@@ -1441,7 +1442,7 @@ export async function viewAction(agentArg, options) {
             return;
         }
         // No argument: show all installed versions
-        await showInstalledVersions(undefined, { forceRefresh: options?.refresh === true });
+        await showInstalledVersions(undefined, { forceRefresh });
         return;
     }
     // Parse agent@version syntax
@@ -1502,7 +1503,7 @@ export async function viewAction(agentArg, options) {
     }
     else {
         // Just agent name: show versions for that agent
-        await showInstalledVersions(agentId, { forceRefresh: options?.refresh === true });
+        await showInstalledVersions(agentId, { forceRefresh });
     }
 }
 /** Register the `agents view` command. */
@@ -1513,6 +1514,7 @@ export function registerViewCommand(program) {
         .option('--resources [sections]', 'In --json mode, include each version\'s resources: "all" (default) or a comma list (skills,plugins,mcp,commands,workflows,memory,hooks). Implies --json.')
         .option('--detailed', 'Include all resources in --json output (alias for --resources all). Implies --json.')
         .option('-r, --refresh', 'Force a live usage refresh, bypassing the cache (slower). Repopulates the S:/W: limit bars for every account whose token is reachable.')
+        .option('--live', 'Alias of --refresh (shorter to type).')
         .option('--prune', 'Remove older installed versions that share an account with a newer installed version. Skips the global default.')
         .option('--dry-run', 'With --prune, show duplicate versions without deleting')
         .option('-y, --yes', 'Skip the prune confirmation prompt.')

package/dist/index.js

@@ -50,7 +50,7 @@ if (IS_DEV_BUILD) {
 // module on each invocation (which loaded the whole ~50-module tree before the
 // first byte of output), the registry maps a command name to a thunk that
 // imports only what that command needs. See src/lib/startup/command-registry.ts.
-import { COMMAND_LOADERS, LAZY_COMMAND_NAMES, loadView, loadInspect, loadFeedback, loadCommands, loadHooks, loadSkills, loadRules, loadMemory, loadPermissions, loadMcp, loadCli, loadSubagents, loadPlugins, loadWorkflows, loadWorktree, loadVersions, loadImport, loadPackages, loadDaemon, loadRoutines, loadMonitors, loadRun, loadDefaults, loadModels, loadPrune, loadTrash, loadRestore, loadDoctor, loadApply, loadCheck, loadStatus, loadProfiles, loadSecrets, loadWallet, loadHelper, loadMenubar, loadBeta, loadSync, loadLock, loadRefreshRules, loadDrive, loadFactory, loadUsage, loadCost, loadOutput, loadBudget, loadAlias, loadPty, loadTmux, loadWatchdog, loadBrowser, loadComputer, loadHosts, loadLogs, loadEvents, loadAudit, loadWebhook, loadFunnel, loadSsh, loadPull, loadPush, loadRepo, loadSetup, loadShare, loadFeed, loadMailboxes, } from './lib/startup/command-registry.js';
+import { COMMAND_LOADERS, LAZY_COMMAND_NAMES, loadView, loadInspect, loadFeedback, loadCommands, loadHooks, loadSkills, loadRules, loadMemory, loadPermissions, loadMcp, loadCli, loadSubagents, loadPlugins, loadWorkflows, loadWorktree, loadVersions, loadImport, loadPackages, loadDaemon, loadRoutines, loadMonitors, loadRun, loadFork, loadDefaults, loadModels, loadPrune, loadTrash, loadRestore, loadDoctor, loadApply, loadCheck, loadStatus, loadProfiles, loadSecrets, loadWallet, loadHelper, loadMenubar, loadBeta, loadSync, loadLock, loadRefreshRules, loadDrive, loadFactory, loadUsage, loadCost, loadOutput, loadBudget, loadAlias, loadPty, loadTmux, loadWatchdog, loadBrowser, loadComputer, loadHosts, loadLogs, loadEvents, loadAudit, loadWebhook, loadFunnel, loadSsh, loadPull, loadPush, loadRepo, loadSetup, loadShare, loadFeed, loadMailboxes, } from './lib/startup/command-registry.js';
 import { applyGlobalHelpConventions } from './lib/help.js';
 import { renderWhatsNew } from './lib/whats-new.js';
 import { emit, redactArgs } from './lib/events.js';
@@ -690,6 +690,7 @@ async function registerAllEagerCommands() {
     await reg(loadRoutines);
     await reg(loadMonitors);
     await reg(loadRun);
+    await reg(loadFork);
     await reg(loadDefaults);
     await reg(loadModels);
     await reg(loadPrune);

package/dist/lib/agents.d.ts

@@ -148,6 +148,16 @@ export declare function formatClaudeOrgLabel(orgType: string | null | undefined)
  * organizationType (signed out, non-Claude agents, configs predating the field).
  */
 export declare function accountOrgBadge(info?: Pick<AccountInfo, 'organizationType' | 'organizationName'> | null): string | null;
+/** Agents whose local credential formats expose enough state for account selection. */
+export declare const ACCOUNT_INSPECTION_AGENT_IDS: readonly ["claude", "codex", "gemini", "grok", "antigravity", "kimi", "droid", "opencode"];
+/** Whether agents-cli can determine this agent's per-version sign-in state. */
+export declare function supportsAccountInspection(agentId: AgentId): boolean;
+/**
+ * Human-readable account identity shared by every account-aware surface.
+ * Prefer email, append a multi-seat Claude organization name when present,
+ * then fall back to a non-secret account id or a generic signed-in label.
+ */
+export declare function accountDisplayLabel(info?: Pick<AccountInfo, 'email' | 'accountId' | 'signedIn' | 'organizationType' | 'organizationName'> | null): string;
 /** Return the email address associated with the agent's auth config, or null. */
 export declare function getAccountEmail(agentId: AgentId, home?: string): Promise<string | null>;
 /** Decrypted contents of Droid's auth.v2.file (subset we consume). */

package/dist/lib/agents.js

@@ -992,6 +992,38 @@ export function accountOrgBadge(info) {
         return info.organizationName;
     return null;
 }
+/** Agents whose local credential formats expose enough state for account selection. */
+export const ACCOUNT_INSPECTION_AGENT_IDS = [
+    'claude',
+    'codex',
+    'gemini',
+    'grok',
+    'antigravity',
+    'kimi',
+    'droid',
+    'opencode',
+];
+const ACCOUNT_INSPECTION_AGENTS = new Set(ACCOUNT_INSPECTION_AGENT_IDS);
+/** Whether agents-cli can determine this agent's per-version sign-in state. */
+export function supportsAccountInspection(agentId) {
+    return ACCOUNT_INSPECTION_AGENTS.has(agentId);
+}
+/**
+ * Human-readable account identity shared by every account-aware surface.
+ * Prefer email, append a multi-seat Claude organization name when present,
+ * then fall back to a non-secret account id or a generic signed-in label.
+ */
+export function accountDisplayLabel(info) {
+    if (!info)
+        return '';
+    if (info.email) {
+        const badge = accountOrgBadge(info);
+        return badge ? `${info.email} (${badge})` : info.email;
+    }
+    if (info.signedIn)
+        return info.accountId ? `id:${info.accountId}` : 'signed in';
+    return '';
+}
 /** Return the email address associated with the agent's auth config, or null. */
 export async function getAccountEmail(agentId, home) {
     const info = await getAccountInfo(agentId, home);