@phnx-labs/agents-cli 1.20.69 → 1.20.71

package/dist/commands/sessions.js

@@ -998,7 +998,7 @@ async function sessionsAction(query, options) {
     // When the user explicitly asks to render (via mode flag), resolve the
     // query globally so sessions outside the default cwd/30d window are found.
     if (wantsRender && searchQuery) {
-        await renderOneSession(searchQuery, mode, { agent: options.agent, project: options.project, filter: filterOpts, noRedact: options.noRedact });
+        await renderOneSession(searchQuery, mode, { agent: options.agent, project: options.project, filter: filterOpts, redact: options.redact });
         return;
     }
     // Interactive picker loads a deep pool but shows only recent sessions
@@ -1068,7 +1068,7 @@ async function sessionsAction(query, options) {
                 return;
             }
             if (idMatches.length === 0 && looksLikeSessionId(searchQuery)) {
-                await renderOneSession(searchQuery, mode, { agent: options.agent, project: options.project, filter: filterOpts, noRedact: options.noRedact });
+                await renderOneSession(searchQuery, mode, { agent: options.agent, project: options.project, filter: filterOpts, redact: options.redact });
                 return;
             }
         }
@@ -1475,7 +1475,7 @@ async function renderSession(session, mode, filters, options = {}) {
             chalk.gray(` ${formatRelativeTime(session.timestamp)}`) +
             (session.account ? chalk.gray(` (${session.account})`) : ''));
         console.log(chalk.gray('─'.repeat(60)));
-        process.stdout.write(renderMarkdown(renderConversationMarkdown(events, { redact: options.noRedact !== true })));
+        process.stdout.write(renderMarkdown(renderConversationMarkdown(events, { redact: options.redact !== false })));
         return;
     }
     // json — normalized events plus the durable session signals from the state
@@ -1486,7 +1486,7 @@ async function renderSession(session, mode, filters, options = {}) {
     // checklist reflects true session state regardless of any `--include` filter;
     // it lets the Factory panel read the CLI's checklist instead of re-parsing.
     const todos = inferSessionState(parsedEvents, { cwd: session.cwd }).todos;
-    process.stdout.write(renderJson(events, todos ? { ...session, todos } : session));
+    process.stdout.write(renderJson(events, todos ? { ...session, todos } : session, { redact: options.redact !== false }));
 }
 function renderTopicCell(label, topic, query, visibleWidth, paddedWidth) {
     const lbl = (label ?? '').trim();
@@ -2162,7 +2162,7 @@ async function renderOneSession(query, mode, scope) {
             throw new Error('Session resolution failed');
         }
         spinner.stop();
-        await renderSession(session, mode, scope.filter, { noRedact: scope.noRedact });
+        await renderSession(session, mode, scope.filter, { redact: scope.redact });
     }
     catch (err) {
         if (isPromptCancelled(err))
@@ -2195,7 +2195,7 @@ export function registerSessionsCommands(program) {
         .option('-n, --limit <n>', 'Maximum number of sessions to return', '50')
         .option('--sort <field>', 'Sort the list by: recent (default), cost, or duration')
         .option('--markdown', 'Render the session as markdown (user, assistant, thinking, tool calls)')
-        .option('--no-redact', 'Disable default secret redaction in markdown session output')
+        .option('--no-redact', 'Disable default secret redaction in rendered session output (--markdown and --json)')
         .option('--json', 'Output JSON (session list when browsing, event array when rendering one session)')
         .option('--include <roles>', 'Only include these roles (comma-separated): user, assistant, thinking, tools')
         .option('--exclude <roles>', 'Exclude these roles (comma-separated): user, assistant, thinking, tools')

package/dist/commands/ssh.js

@@ -18,6 +18,7 @@ import ora from 'ora';
 import { getCliVersion } from '../lib/version.js';
 import { readAndResolveBundleEnv, isHeadlessSecretsContext } from '../lib/secrets/bundles.js';
 import { machineId } from '../lib/session/sync/config.js';
+import { registerFleetCaptureCommand } from './fleet-capture.js';
 import { addIgnored, getDevice, loadDevices, loadIgnored, removeDevice, removeIgnored, upsertDevice, } from '../lib/devices/registry.js';
 import { addControlToken } from '../lib/serve/token.js';
 import { DEFAULT_SERVE_PORT } from '../lib/serve/server.js';
@@ -27,18 +28,19 @@ import { resolveDeviceTarget, splitUserHost } from '../lib/devices/resolve-targe
 import { clearPendingSentinel } from '../lib/devices/pending.js';
 import { isInteractiveTerminal, isPromptCancelled } from './utils.js';
 import { hostNameFor, renderSshConfig } from '../lib/devices/ssh-config.js';
-import { ASKPASS_BUNDLE_ENV, ASKPASS_KEY_ENV, buildSshInvocation, writeAskpassShim, } from '../lib/devices/connect.js';
+import { ASKPASS_BUNDLE_ENV, ASKPASS_KEY_ENV, buildSshInvocation, fleetDialTarget, writeAskpassShim, } from '../lib/devices/connect.js';
 import { ensureManagedKnownHostsDir, isHostPinned } from '../lib/devices/known-hosts.js';
 import { shouldSyncTerminfo, syncTerminfoToDevice, terminfoHostKey } from '../lib/devices/terminfo.js';
 import { fanOutDevices, planFleetTargets, remoteFleetTargets, runFleet, skipLabel, upgradeCommand, } from '../lib/devices/fleet.js';
-import { fleetCapacity, fmtBytes, headroom, probeLocalStats, probeFleetStats, } from '../lib/devices/health.js';
+import { fleetCapacity, fmtBytes, headroom, } from '../lib/devices/health.js';
 import { buildFleetHealthReport, renderFleetMatrix, renderFleetWarnings, } from '../lib/devices/health-report.js';
+import { loadFleetStats, readStatsCache } from '../lib/devices/stats-cache.js';
 import { checkSyncStatus, countOrphans } from '../lib/drift.js';
 import { checkAllClis } from '../lib/teams/agents.js';
 import { buildRemoteAgentsInvocation } from '../lib/hosts/remote-cmd.js';
 import { sshExecAsync } from '../lib/ssh-exec.js';
 import { ALL_AGENT_IDS } from '../lib/agents.js';
-import { formatCheckedAge, isDeadVerdict, probeLocalFleetAuth, summarizeVerdicts, verdictLabel, writeFleetAuthRows, } from '../lib/auth-health.js';
+import { formatCheckedAge, isDeadVerdict, probeLocalFleetAuth, readAuthHealthCache, summarizeHostAuth, summarizeVerdicts, verdictLabel, writeFleetAuthRows, } from '../lib/auth-health.js';
 /** One-line summary of a device for `list`. `isSelf` marks the machine this
  * command is running on so it stands out from the rest of the tailnet. */
 function deviceSummary(d, isSelf = false) {
@@ -243,10 +245,10 @@ async function probeRemoteHealth(target) {
     const isWin = /^win/i.test((target.platform ?? '').trim());
     const env = isWin ? undefined : { PATH: '$HOME/.agents/.cache/shims:$HOME/.local/bin:$PATH' };
     const versionCmd = buildRemoteAgentsInvocation(['--version'], undefined, isWin ? 'windows' : undefined, env);
-    const versionRes = await sshExecAsync(target.name, versionCmd, { timeoutMs: 15000, multiplex: true });
+    const versionRes = await sshExecAsync(target.dialTarget, versionCmd, { timeoutMs: 15000, multiplex: true });
     const version = versionRes.code === 0 ? versionRes.stdout.trim().split(/\s+/)[0] || null : null;
     const doctorCmd = buildRemoteAgentsInvocation(['doctor', '--json'], undefined, isWin ? 'windows' : undefined, env);
-    const doctorRes = await sshExecAsync(target.name, doctorCmd, { timeoutMs: 30000, multiplex: true });
+    const doctorRes = await sshExecAsync(target.dialTarget, doctorCmd, { timeoutMs: 30000, multiplex: true });
     if (doctorRes.code !== 0) {
         throw new Error(doctorRes.timedOut ? 'timed out' : (doctorRes.stderr.trim() || `exit ${doctorRes.code ?? 'unknown'}`));
     }
@@ -256,25 +258,43 @@ async function probeRemoteHealth(target) {
         clis: parsed.clis ?? {},
         sync: parsed.sync ?? [],
         orphans: parsed.orphans ?? [],
+        // The remote self-reports its own cached auth rollup (fresh via its daemon),
+        // so the Auth column is current without a prior fleet-wide `fleet ping`.
+        // Older remotes that don't emit it fall back to this host's cache below.
+        auth: parsed.auth,
     };
 }
 async function runFleetStatus(opts) {
     const reg = await loadDevices();
     const self = machineId();
+    const forceRefresh = Boolean(opts.refresh || opts.live);
     const planned = planFleetTargets(reg);
     const probeable = planned.filter((t) => !t.skip).map((t) => t.device);
+    // Cache-first: serve remote stats from the daemon-warmed cache (instant),
+    // probe this machine locally, and only ssh out for missing/forced rows.
     const statsMap = opts.stats === false
         ? new Map()
-        : await probeFleetStats(probeable, { selfName: self });
-    if (opts.stats !== false && !statsMap.has(self)) {
-        statsMap.set(self, await probeLocalStats(self));
-    }
+        : (await loadFleetStats(probeable, { forceRefresh, selfName: self })).stats;
     const rows = [localHealthRow(self, statsMap.get(self))];
     const remoteTargets = remoteFleetTargets(planned, self)
         .map((t) => ({
         name: t.device.name,
         platform: t.device.platform,
         skip: t.skip,
+        dialTarget: fleetDialTarget(t.device),
+        // Fail fast: the stats probe already tried this box with the same
+        // (registry) address. If it came back unreachable, don't spend another
+        // 15s+30s on version+doctor — skip straight to an unreachable row so one
+        // genuinely-offline device can't stall the whole matrix.
+        //
+        // Only trust this on a FRESH probe (`--refresh`/`--live`). loadFleetStats
+        // is cache-first (daemon-warmed ~3min), so a box that came back online
+        // since the last warm would otherwise be skipped to "unreachable" without
+        // a live attempt — a false negative. On a default run we still do the live
+        // probe (fast now that it dials the registry address).
+        ...(forceRefresh && statsMap.get(t.device.name)?.reachable === false && !t.skip
+            ? { skip: 'unreachable' }
+            : {}),
     }));
     const remote = await fanOutDevices(remoteTargets, probeRemoteHealth);
     for (const result of remote) {
@@ -300,6 +320,15 @@ async function runFleetStatus(opts) {
             });
         }
     }
+    // Auth column: remote rows already carry the host's self-reported rollup from
+    // its `doctor --json`. Fill the rest (this machine; older remotes that don't
+    // emit it) from this host's local cache — written by `agents fleet ping` and
+    // the daemon's local refresh. A never-probed host rolls up to "—". No network.
+    const authCache = readAuthHealthCache();
+    for (const row of rows) {
+        if (!row.auth)
+            row.auth = summarizeHostAuth(authCache, row.name);
+    }
     const report = buildFleetHealthReport(rows);
     if (opts.json) {
         console.log(JSON.stringify(report, null, 2));
@@ -319,7 +348,7 @@ async function probeRemoteAuth(target) {
     const isWin = /^win/i.test((target.platform ?? '').trim());
     const env = isWin ? undefined : { PATH: '$HOME/.agents/.cache/shims:$HOME/.local/bin:$PATH' };
     const cmd = buildRemoteAgentsInvocation(['devices', 'ping', '--local', '--json'], undefined, isWin ? 'windows' : undefined, env);
-    const res = await sshExecAsync(target.name, cmd, { timeoutMs: 60000, multiplex: true });
+    const res = await sshExecAsync(target.dialTarget, cmd, { timeoutMs: 60000, multiplex: true });
     if (res.code !== 0) {
         throw new Error(res.timedOut ? 'timed out' : (res.stderr.trim() || `exit ${res.code ?? 'unknown'}`));
     }
@@ -356,6 +385,7 @@ async function runFleetPing(opts) {
         name: t.device.name,
         platform: t.device.platform,
         skip: t.skip,
+        dialTarget: fleetDialTarget(t.device),
     }));
     const probeable = remoteTargets.filter((t) => !t.skip).length;
     const spinner = isInteractiveTerminal() && !opts.json
@@ -497,6 +527,8 @@ Typical workflow:
             process.exit(1);
         }
     });
+    // `agents fleet capture` — snapshot live state into agents.yaml fleet:.
+    registerFleetCaptureCommand(devicesCmd);
     devicesCmd
         .command('register <name>')
         .description('Register a discovered (pending) node by name — used by the menu-bar "NEW DEVICES → Register" action.')
@@ -550,6 +582,8 @@ Typical workflow:
         .description('List registered devices with platform, address, reachability, and live resource headroom.')
         .option('--json', 'output the registry as a JSON array (for scripts and hooks)')
         .option('--no-stats', 'skip the live resource probe (instant; names/addresses only)')
+        .option('--refresh', 'force a live probe of every device, bypassing the cache')
+        .option('--live', 'alias of --refresh (shorter to type)')
         .option('-f, --full', 'full mode: add per-device core count and free/total memory')
         .action(async (opts) => {
         const reg = await loadDevices();
@@ -564,18 +598,26 @@ Typical workflow:
             return;
         }
         const self = machineId();
+        const forceRefresh = Boolean(opts.refresh || opts.live);
         let statsMap;
+        let freshness;
         if (opts.stats !== false) {
-            // Probe only reachable devices, in parallel, bounded by the per-probe
-            // timeout — a slow box degrades to "—", it never hangs the table.
+            // Cache-first: serve remote devices from the daemon-warmed cache
+            // (instant), probe this machine locally, and only ssh out for missing or
+            // forced (--refresh/--live) rows — so a warm read never hangs on a box.
             const probeable = planFleetTargets(reg)
                 .filter((t) => !t.skip)
                 .map((t) => t.device);
-            const spinner = isInteractiveTerminal()
+            // Only spin when we'll actually ssh (forced, or a cold/partial cache).
+            const cache = readStatsCache();
+            const willSsh = forceRefresh || probeable.some((d) => d.name !== self && !cache[d.name]);
+            const spinner = willSsh && isInteractiveTerminal()
                 ? ora(`Probing ${probeable.length} device${probeable.length === 1 ? '' : 's'}…`).start()
                 : undefined;
             try {
-                statsMap = await probeFleetStats(probeable, { selfName: self });
+                const res = await loadFleetStats(probeable, { forceRefresh, selfName: self });
+                statsMap = res.stats;
+                freshness = res;
             }
             finally {
                 spinner?.stop();
@@ -584,6 +626,9 @@ Typical workflow:
         console.log(chalk.bold(`Devices (${names.length})`));
         for (const line of renderDeviceTable(reg, names, self, statsMap, opts.full))
             console.log(line);
+        if (freshness?.servedFromCache && freshness.oldestFetchedAt != null) {
+            console.log(chalk.gray(`  updated ${formatCheckedAge(freshness.oldestFetchedAt)} — pass --refresh (--live) for a live probe`));
+        }
     });
     devicesCmd
         .command('status')
@@ -591,6 +636,8 @@ Typical workflow:
         .option('--json', 'output machine-readable JSON')
         .option('--strict', 'exit non-zero when any device has drift or is unreachable')
         .option('--no-stats', 'skip the live resource probe')
+        .option('--refresh', 'force a live probe of every device, bypassing the cache')
+        .option('--live', 'alias of --refresh (shorter to type)')
         .action(async (opts) => {
         await runFleetStatus(opts);
     });
@@ -752,7 +799,7 @@ Typical workflow:
             return;
         }
         console.log(chalk.gray(`Running \`${cmd.join(' ')}\` on ${targets.filter((t) => !t.skip).length} online device(s)…`));
-        const results = runFleet(targets, cmd);
+        const results = runFleet(targets, cmd, { self: machineId() });
         printFleetResults(results);
     });
     devicesCmd
@@ -771,7 +818,7 @@ Typical workflow:
             return;
         }
         console.log(chalk.gray(`Running \`${cmd.join(' ')}\` on ${targets.filter((t) => !t.skip).length} online device(s)…`));
-        const results = runFleet(targets, cmd);
+        const results = runFleet(targets, cmd, { self: machineId() });
         printFleetResults(results);
     });
 }

package/dist/commands/usage.d.ts

@@ -10,4 +10,17 @@
  *     don't publish per-account usage today)
  */
 import type { Command } from 'commander';
+import type { AgentId } from '../lib/types.js';
+import { getUsageInfoForIdentity } from '../lib/usage.js';
+/** One agent's usage snapshot — the unit the text and --json renderers share. */
+export interface AgentUsageRecord {
+    agent: AgentId;
+    /** Plain agent name (no ANSI) — safe to emit in --json; the text table colorizes it. */
+    label: string;
+    status: 'unsupported' | 'no-version' | 'not-signed-in' | 'ok';
+    email?: string;
+    usage?: Awaited<ReturnType<typeof getUsageInfoForIdentity>>;
+}
 export declare function registerUsageCommand(program: Command): void;
+/** Render one usage record as the human table section. */
+export declare function formatAgentUsage(rec: AgentUsageRecord): string;

package/dist/commands/usage.js

@@ -13,13 +13,15 @@ const USAGE_SUPPORTED = new Set(['claude', 'codex', 'kimi', 'droid']);
 export function registerUsageCommand(program) {
     addHostOption(program.command('usage [agent]'))
         .description('Show rate-limit / quota usage per agent')
+        .option('--json', 'Emit machine-readable JSON (per-agent usage snapshot) instead of the table')
         .addHelpText('after', `
 Examples:
   agents usage              Show usage for all installed agents
   agents usage claude       Show usage for Claude only
   agents usage codex        Show usage for Codex only
+  agents usage --json       Machine-readable snapshot for scripts
 `)
-        .action(async (agentFilter) => {
+        .action(async (agentFilter, options) => {
         let filter;
         if (agentFilter) {
             const resolved = resolveAgentName(agentFilter);
@@ -33,47 +35,67 @@ Examples:
             ? [filter]
             : ALL_AGENT_IDS.filter((id) => listInstalledVersions(id).length > 0);
         if (targets.length === 0) {
+            if (options.json) {
+                console.log('[]');
+                return;
+            }
             console.log(chalk.gray('No agents installed. Run `agents add <agent>` first.'));
             return;
         }
-        const sections = await Promise.all(targets.map(async (agentId) => renderAgentUsage(agentId)));
-        console.log(sections.filter(Boolean).join('\n\n'));
+        const records = await Promise.all(targets.map((agentId) => collectAgentUsage(agentId)));
+        if (options.json) {
+            console.log(JSON.stringify(records, null, 2));
+            return;
+        }
+        console.log(records.map(formatAgentUsage).filter(Boolean).join('\n\n'));
     });
 }
-async function renderAgentUsage(agentId) {
-    const cfg = AGENTS[agentId];
-    const heading = agentLabel(agentId);
+/** Gather one agent's usage snapshot as structured data (shared by both renderers). */
+async function collectAgentUsage(agentId) {
+    // Plain name — color is applied only at text-render time (formatAgentUsage), so
+    // `--json` never emits ANSI escapes in `label` (e.g. under FORCE_COLOR=1).
+    const label = AGENTS[agentId].name;
     if (!USAGE_SUPPORTED.has(agentId)) {
-        return [
-            `${heading}`,
-            `  ${chalk.dim(`${cfg.name} CLI does not publish usage data.`)}`,
-        ].join('\n');
+        return { agent: agentId, label, status: 'unsupported' };
     }
     const versions = listInstalledVersions(agentId);
     const version = getGlobalDefault(agentId) || versions[0];
     if (!version) {
-        return [`${heading}`, `  ${chalk.dim('No version installed.')}`].join('\n');
+        return { agent: agentId, label, status: 'no-version' };
     }
     const home = getVersionHomePath(agentId, version);
     const info = await getAccountInfo(agentId, home);
     if (!info.usageKey && !info.accountKey) {
-        return [`${heading}`, `  ${chalk.dim('Not signed in.')}`].join('\n');
-    }
-    const usage = await getUsageInfoForIdentity({
-        agentId,
-        home,
-        info,
-        cliVersion: null,
-    });
-    const lines = [heading];
-    if (info.email)
-        lines.push(`  ${chalk.dim(info.email)}`);
-    const section = formatUsageSection(usage);
-    if (section.length === 0) {
-        lines.push(`  ${chalk.dim('No usage data available right now.')}`);
+        return { agent: agentId, label, status: 'not-signed-in' };
     }
-    else {
-        lines.push(...section);
+    const usage = await getUsageInfoForIdentity({ agentId, home, info, cliVersion: null });
+    return { agent: agentId, label, status: 'ok', email: info.email ?? undefined, usage };
+}
+/** Render one usage record as the human table section. */
+export function formatAgentUsage(rec) {
+    const cfg = AGENTS[rec.agent];
+    // Colorize the heading here (not in the record) so the plain `label` stays
+    // clean for --json while the text table keeps its per-agent color.
+    const heading = agentLabel(rec.agent);
+    switch (rec.status) {
+        case 'unsupported':
+            return [heading, `  ${chalk.dim(`${cfg.name} CLI does not publish usage data.`)}`].join('\n');
+        case 'no-version':
+            return [heading, `  ${chalk.dim('No version installed.')}`].join('\n');
+        case 'not-signed-in':
+            return [heading, `  ${chalk.dim('Not signed in.')}`].join('\n');
+        case 'ok': {
+            const lines = [heading];
+            if (rec.email)
+                lines.push(`  ${chalk.dim(rec.email)}`);
+            const section = formatUsageSection(rec.usage);
+            if (section.length === 0) {
+                lines.push(`  ${chalk.dim('No usage data available right now.')}`);
+            }
+            else {
+                lines.push(...section);
+            }
+            return lines.join('\n');
+        }
     }
-    return lines.join('\n');
 }

package/dist/commands/view.d.ts

@@ -123,6 +123,7 @@ export declare function viewAction(agentArg?: string, options?: {
     resources?: string | boolean;
     detailed?: boolean;
     refresh?: boolean;
+    live?: boolean;
 } & ViewSectionFilter): Promise<void>;
 /** Register the `agents view` command. */
 export declare function registerViewCommand(program: Command): void;

package/dist/commands/view.js

@@ -1400,6 +1400,8 @@ export async function pruneDuplicates(filterAgentId, yes, dryRun) {
  * Exported for use by deprecated aliases.
  */
 export async function viewAction(agentArg, options) {
+    // --live is a shorter-to-type alias of --refresh; both force a live probe.
+    const forceRefresh = options?.refresh === true || options?.live === true;
     // --resources / --detailed imply --json (they only shape structured output).
     const explicitResources = options?.detailed === true || options?.resources !== undefined;
     const json = options?.json === true || explicitResources;
@@ -1440,7 +1442,7 @@ export async function viewAction(agentArg, options) {
             return;
         }
         // No argument: show all installed versions
-        await showInstalledVersions(undefined, { forceRefresh: options?.refresh === true });
+        await showInstalledVersions(undefined, { forceRefresh });
         return;
     }
     // Parse agent@version syntax
@@ -1501,7 +1503,7 @@ export async function viewAction(agentArg, options) {
     }
     else {
         // Just agent name: show versions for that agent
-        await showInstalledVersions(agentId, { forceRefresh: options?.refresh === true });
+        await showInstalledVersions(agentId, { forceRefresh });
     }
 }
 /** Register the `agents view` command. */
@@ -1512,6 +1514,7 @@ export function registerViewCommand(program) {
         .option('--resources [sections]', 'In --json mode, include each version\'s resources: "all" (default) or a comma list (skills,plugins,mcp,commands,workflows,memory,hooks). Implies --json.')
         .option('--detailed', 'Include all resources in --json output (alias for --resources all). Implies --json.')
         .option('-r, --refresh', 'Force a live usage refresh, bypassing the cache (slower). Repopulates the S:/W: limit bars for every account whose token is reachable.')
+        .option('--live', 'Alias of --refresh (shorter to type).')
         .option('--prune', 'Remove older installed versions that share an account with a newer installed version. Skips the global default.')
         .option('--dry-run', 'With --prune, show duplicate versions without deleting')
         .option('-y, --yes', 'Skip the prune confirmation prompt.')

package/dist/lib/auth-health.d.ts

@@ -49,6 +49,44 @@ export interface VerdictSummary {
 export declare function summarizeVerdicts(verdicts: AuthVerdict[]): VerdictSummary;
 /** Verdicts that mean "this token was rejected by the server — re-login required". */
 export declare function isDeadVerdict(verdict: AuthVerdict): boolean;
+/**
+ * A host's rolled-up auth state for the `fleet status` Auth column.
+ *
+ * The four display buckets are deliberately finer-grained than
+ * {@link VerdictSummary}'s live/bad/warn: they separate "present but this agent
+ * has no live probe" (`unverified`) and "soft, self-healing expiry"
+ * (`expired`/`rate_limited`) from a genuine server rejection (`revoked`). The
+ * old three-bucket rollup lumped all of those into `warn` and the column painted
+ * them one alarming yellow — so a fleet of perfectly logged-in accounts on
+ * codex/grok/etc (which can NEVER be probed live) read as half-degraded. These
+ * buckets let the renderer show `unverified` as neutral and reserve red for the
+ * only verdict that actually means "re-login now" ({@link isDeadVerdict}).
+ */
+export interface HostAuthSummary {
+    /** Live-verified accounts (a real 2xx). */
+    live: number;
+    /** Signed in but this agent has no live-probe endpoint — benign, neutral. */
+    present: number;
+    /** Soft/degraded: expired (self-healing) / rate_limited / error. Mild warning. */
+    degraded: number;
+    /** Server rejected the token — genuinely needs re-login. */
+    revoked: number;
+    /** Total cached rows for this host (0 → the renderer shows "—"). */
+    total: number;
+    /** Oldest `checkedAt` (epoch ms) among this host's cached rows, or null when none. */
+    oldestCheckedAt: number | null;
+}
+/**
+ * Roll every cached (agent, version) row for one host into a {@link HostAuthSummary}
+ * plus the age of its stalest entry. Pure — reads the map the caller already
+ * loaded via {@link readAuthHealthCache}, so `fleet status` renders the Auth
+ * column without any network probe. A host with no cached rows yields an empty
+ * summary (total 0), which the renderer shows as "—".
+ *
+ * Keys are `host:agent:version` ({@link authCacheKey}); we match on the `host:`
+ * prefix so agent/version segments can never be mistaken for a host.
+ */
+export declare function summarizeHostAuth(cache: Record<string, AuthHealth>, host: string): HostAuthSummary;
 /** Human "3m ago" style age for a checkedAt timestamp. */
 export declare function formatCheckedAge(checkedAt: number, now?: number): string;
 /**

package/dist/lib/auth-health.js

@@ -5,9 +5,12 @@
  * The rest of the CLI reports "signed in" from a local heuristic — a credential
  * file is present and its email decodes — which cannot distinguish a good token
  * from a revoked-but-unexpired one. This module completes a real request per
- * (agent, account) and records the verdict in a small cache that `agents view`,
- * `agents fleet status`, and the run rotation all read. The daemon and
- * `agents fleet ping` are the writers; everyone else reads.
+ * (agent, account) and records the verdict in a small cache that `agents view`
+ * (per-version chip), `agents fleet status` (the per-host Auth column, via
+ * {@link summarizeHostAuth}), and the run rotation all read. The writers are
+ * the daemon (a periodic local refresh) and `agents fleet ping` (which also
+ * fans out to write remote hosts' rows into the local cache); everyone else
+ * reads.
  *
  * The network probes themselves live in lib/usage.ts (where the per-provider
  * token loaders + endpoints already are); this module classifies their result,
@@ -95,6 +98,48 @@ export function summarizeVerdicts(verdicts) {
 export function isDeadVerdict(verdict) {
     return verdict === 'revoked';
 }
+/**
+ * Roll every cached (agent, version) row for one host into a {@link HostAuthSummary}
+ * plus the age of its stalest entry. Pure — reads the map the caller already
+ * loaded via {@link readAuthHealthCache}, so `fleet status` renders the Auth
+ * column without any network probe. A host with no cached rows yields an empty
+ * summary (total 0), which the renderer shows as "—".
+ *
+ * Keys are `host:agent:version` ({@link authCacheKey}); we match on the `host:`
+ * prefix so agent/version segments can never be mistaken for a host.
+ */
+export function summarizeHostAuth(cache, host) {
+    const prefix = `${host}:`;
+    let live = 0, present = 0, degraded = 0, revoked = 0, total = 0;
+    let oldest = null;
+    for (const [key, health] of Object.entries(cache)) {
+        if (!key.startsWith(prefix))
+            continue;
+        // `unconfigured` = no credential at all — not a probed account. Writers
+        // already drop these before they reach the cache; skip here too so a stray
+        // one never counts toward total or the freshness age (belt-and-suspenders).
+        if (health.verdict === 'unconfigured')
+            continue;
+        total++;
+        switch (health.verdict) {
+            case 'live':
+                live++;
+                break;
+            case 'unverified':
+                present++;
+                break; // signed in, no probe — benign
+            case 'revoked':
+                revoked++;
+                break; // server said no — re-login
+            default:
+                degraded++;
+                break; // expired / rate_limited / error — soft
+        }
+        if (oldest === null || health.checkedAt < oldest)
+            oldest = health.checkedAt;
+    }
+    return { live, present, degraded, revoked, total, oldestCheckedAt: oldest };
+}
 /** Human "3m ago" style age for a checkedAt timestamp. */
 export function formatCheckedAge(checkedAt, now = Date.now()) {
     const secs = Math.max(0, Math.round((now - checkedAt) / 1000));

package/dist/lib/commands.d.ts

@@ -89,6 +89,16 @@ export interface VersionCommandDiff {
 /**
  * Compare a version home's commands against central. Returns the reconciliation diff.
  */
+/**
+ * Flattened names of plugin-bundled commands (`<plugin>-<command>`), matching
+ * exactly how `syncPluginToVersion` installs a plugin's `commands/<cmd>.md` as a
+ * command-skill (plugins.ts → `installCommandSkillToVersion(agentDir,
+ * `${plugin.name}-${cmd}`, …)`). These are source-managed by their plugin, so
+ * the orphan detector must NOT flag them — else `prune cleanup` proposes
+ * deleting live plugin commands (swarm-plan, code-review, …). Scans user +
+ * system + extra marketplaces (no project layer), matching the trusted sources.
+ */
+export declare function listPluginCommandNames(): Set<string>;
 export declare function diffVersionCommands(agent: AgentId, version: string): VersionCommandDiff;
 /**
  * Install a single command from central into a specific version home.

package/dist/lib/commands.js

@@ -14,6 +14,7 @@ import { capableAgents, isCapable, supports } from './capabilities.js';
 import { markdownToToml } from './convert.js';
 import { getCommandsDir, getUserCommandsDir, getEnabledExtraRepos, getProjectAgentsDir, getSkillsDir, getTrashCommandsDir } from './state.js';
 import { getEffectiveHome, getVersionHomePath, listInstalledVersions, resolveVersion } from './versions.js';
+import { discoverPlugins } from './plugins.js';
 import { commandSkillMatches, installCommandSkillToVersion, listCommandSkillsInVersion, removeCommandSkillFromVersion, shouldInstallCommandAsSkill, } from './command-skills.js';
 import { installGooseCommandToVersion, listGooseCommandsInVersion, gooseCommandMatches, removeGooseCommandFromVersion, } from './goose-commands.js';
 function compareVersions(a, b) {
@@ -311,8 +312,26 @@ function versionCommandMatches(agent, version, commandName) {
 /**
  * Compare a version home's commands against central. Returns the reconciliation diff.
  */
+/**
+ * Flattened names of plugin-bundled commands (`<plugin>-<command>`), matching
+ * exactly how `syncPluginToVersion` installs a plugin's `commands/<cmd>.md` as a
+ * command-skill (plugins.ts → `installCommandSkillToVersion(agentDir,
+ * `${plugin.name}-${cmd}`, …)`). These are source-managed by their plugin, so
+ * the orphan detector must NOT flag them — else `prune cleanup` proposes
+ * deleting live plugin commands (swarm-plan, code-review, …). Scans user +
+ * system + extra marketplaces (no project layer), matching the trusted sources.
+ */
+export function listPluginCommandNames() {
+    const names = new Set();
+    for (const plugin of discoverPlugins()) {
+        for (const cmd of plugin.commands)
+            names.add(`${plugin.name}-${cmd}`);
+    }
+    return names;
+}
 export function diffVersionCommands(agent, version) {
     const central = new Set(listCentralCommands());
+    const pluginCommands = listPluginCommandNames();
     const installed = new Set(listCommandsInVersionHome(agent, version));
     const toAdd = [];
     const toUpdate = [];
@@ -335,15 +354,20 @@ export function diffVersionCommands(agent, version) {
         }
     }
     for (const name of installed) {
-        if (!central.has(name)) {
-            orphans.push(name);
+        if (central.has(name)) {
+            const sourcePath = path.join(getCommandsDir(), `${name}.md`);
+            const metadata = parseCommandMetadata(sourcePath);
+            if (!commandAppliesTo(agent, version, metadata).ok) {
+                toRemove.push(name);
+            }
             continue;
         }
-        const sourcePath = path.join(getCommandsDir(), `${name}.md`);
-        const metadata = parseCommandMetadata(sourcePath);
-        if (!commandAppliesTo(agent, version, metadata).ok) {
-            toRemove.push(name);
-        }
+        // A plugin-bundled command (installed as `<plugin>-<cmd>`) is source-managed
+        // by its plugin — not an orphan. Only a name with no central AND no plugin
+        // source is genuinely unmanaged.
+        if (pluginCommands.has(name))
+            continue;
+        orphans.push(name);
     }
     return {
         agent,

package/dist/lib/computer/download.d.ts

@@ -29,6 +29,9 @@ export declare function macHelperAssetUrls(version: string): {
     zip: string;
     sha256: string;
 };
+/** Extract `TeamIdentifier=XXXX` from `codesign -dv --verbose=4` output (which is
+ * emitted on stderr). Returns null when absent (ad-hoc / unsigned). */
+export declare function parseTeamId(codesignInfo: string): string | null;
 /**
  * Verify a helper `.app` bundle is intact, signed by the expected Developer ID
  * Team, and notarized (Gatekeeper-accepted). Throws with an actionable message