@phnx-labs/agents-cli 1.20.72 → 1.20.73

package/dist/commands/ssh.js

@@ -19,6 +19,7 @@ import { getCliVersion } from '../lib/version.js';
 import { readAndResolveBundleEnv, isHeadlessSecretsContext } from '../lib/secrets/bundles.js';
 import { machineId } from '../lib/session/sync/config.js';
 import { registerFleetCaptureCommand } from './fleet-capture.js';
+import { registerFleetApplyAlias } from './apply.js';
 import { addIgnored, getDevice, loadDevices, loadIgnored, removeDevice, removeIgnored, upsertDevice, } from '../lib/devices/registry.js';
 import { addControlToken } from '../lib/serve/token.js';
 import { DEFAULT_SERVE_PORT } from '../lib/serve/server.js';
@@ -40,7 +41,10 @@ import { checkAllClis } from '../lib/teams/agents.js';
 import { buildRemoteAgentsInvocation } from '../lib/hosts/remote-cmd.js';
 import { sshExecAsync } from '../lib/ssh-exec.js';
 import { ALL_AGENT_IDS } from '../lib/agents.js';
-import { formatCheckedAge, isDeadVerdict, probeLocalFleetAuth, readAuthHealthCache, summarizeHostAuth, summarizeVerdicts, verdictLabel, writeFleetAuthRows, } from '../lib/auth-health.js';
+import { crabboxList, crabboxFind, crabboxSshArgv } from '../lib/crabbox/cli.js';
+import { boxAddress, boxStatus, fmtIdleShort, fmtExpiresShort } from './lease.js';
+import { authCellColor, formatCheckedAge, isDeadVerdict, probeLocalFleetAuth, readAuthHealthCache, summarizeHostAuth, summarizeVerdicts, verdictColor, verdictLabel, writeFleetAuthRows, } from '../lib/auth-health.js';
+import { runFleetLogin } from '../lib/fleet/remote-login.js';
 /** One-line summary of a device for `list`. `isSelf` marks the machine this
  * command is running on so it stands out from the rest of the tailnet. */
 function deviceSummary(d, isSelf = false) {
@@ -130,6 +134,74 @@ function renderDeviceTable(reg, names, self, statsMap, full = false) {
     }
     return lines;
 }
+/**
+ * Live "Leased boxes" section for `agents devices` (F4, RUSH-1923), computed
+ * from `crabboxList()` — these are ephemeral crabbox leases, NEVER written into
+ * the device registry. Returns [] when crabbox is unavailable / has no creds /
+ * reports no boxes, so the section is simply omitted. `nowSecs` is injected so
+ * the row formatting is deterministic in tests.
+ */
+export function renderLeasedBoxesSection(boxes, nowSecs) {
+    if (boxes.length === 0)
+        return [];
+    const lines = [];
+    lines.push('');
+    lines.push(chalk.bold('Leased boxes') + chalk.gray(' (ephemeral · via crabbox)'));
+    lines.push('  ' +
+        chalk.gray('box'.padEnd(16)) +
+        chalk.gray('class'.padEnd(10)) +
+        chalk.gray('address'.padEnd(24)) +
+        chalk.gray('status'.padEnd(9)) +
+        chalk.gray('idle'.padEnd(12)) +
+        chalk.gray('expires'));
+    for (const b of boxes) {
+        const addr = boxAddress(b) ?? '—';
+        lines.push('  ' +
+            chalk.cyan(b.slug.padEnd(16)) +
+            (b.class ?? '?').padEnd(10) +
+            addr.padEnd(24) +
+            boxStatus(b).padEnd(9) +
+            chalk.gray(fmtIdleShort(b, nowSecs).padEnd(12)) +
+            chalk.gray(fmtExpiresShort(b, nowSecs)));
+    }
+    lines.push(chalk.gray('  Reuse a box with `agents run --box <slug>` · stop with `agents lease stop <slug>`'));
+    return lines;
+}
+/** The leased-box rows for the devices list, or [] when crabbox can't be read. */
+function loadLeasedBoxesSection() {
+    try {
+        const boxes = crabboxList({ secretsBundle: process.env.AGENTS_LEASE_SECRETS_BUNDLE, timeoutMs: 5000 });
+        return renderLeasedBoxesSection(boxes, Math.floor(Date.now() / 1000));
+    }
+    catch {
+        return []; // crabbox not installed / no provider creds — omit the section
+    }
+}
+/**
+ * `agents ssh <slug>` targeting a leased crabbox box. crabbox provisions a
+ * per-lease identity key, so we ssh via crabbox's OWN emitted invocation
+ * (`crabboxSshArgv`) — a raw `ssh crabbox@ip` fails publickey. Returns false when
+ * `name` is not a known crabbox slug so the caller can fall through to the normal
+ * "Unknown device" error.
+ */
+function trySshLeasedBox(name, cmd) {
+    let box;
+    try {
+        box = crabboxFind(name, { secretsBundle: process.env.AGENTS_LEASE_SECRETS_BUNDLE, timeoutMs: 5000 });
+    }
+    catch {
+        return false; // crabbox unavailable — not a leased-box target
+    }
+    if (!box)
+        return false;
+    const sshArgv = crabboxSshArgv(name, { secretsBundle: process.env.AGENTS_LEASE_SECRETS_BUNDLE, timeoutMs: 8000 });
+    if (!sshArgv) {
+        console.error(chalk.red(`Leased box '${name}' is not reachable yet (status: ${boxStatus(box)}).`));
+        process.exit(1);
+    }
+    const res = spawnSync(sshArgv[0], [...sshArgv.slice(1), ...cmd], { stdio: 'inherit' });
+    process.exit(res.status ?? 1);
+}
 /** Resolve a device or exit with a clear error. */
 async function mustGetDevice(name) {
     const d = await getDevice(name);
@@ -423,17 +495,28 @@ async function runFleetPing(opts) {
     if (opts.strict && anyBad)
         process.exitCode = 1;
 }
-/** Color a per-host×agent cell: green all-live, red any revoked/expired, yellow degraded. */
+/** Resolve an {@link AuthCellColor} to a chalk painter. Single map for cells + labels. */
+const CELL_PAINT = {
+    green: chalk.green,
+    yellow: chalk.yellow,
+    red: chalk.red,
+    gray: chalk.gray,
+    dim: chalk.dim,
+};
+/**
+ * Color a per-host×agent cell. The numerator counts accounts that are usable
+ * right now — live-verified PLUS signed-in-but-unverifiable (codex/grok) — over
+ * the total, so a logged-in codex fleet reads "1/1", not a scary "0/1". Color is
+ * the shared {@link authCellColor}: red only for revoked (re-login), yellow for
+ * soft/expired (self-refreshes), gray for present-but-unverifiable, green when
+ * all live.
+ */
 function authCell(summary, width) {
     if (summary.total === 0)
         return chalk.dim('·'.padEnd(width));
-    const text = `${summary.live}/${summary.total}`;
-    const padded = text.padEnd(width);
-    if (summary.bad > 0)
-        return chalk.red(padded);
-    if (summary.warn > 0)
-        return chalk.yellow(padded);
-    return chalk.green(padded);
+    const ok = summary.live + summary.present;
+    const padded = `${ok}/${summary.total}`.padEnd(width);
+    return CELL_PAINT[authCellColor(summary)](padded);
 }
 /** Render the fleet auth matrix (device rows × agent columns) plus an optional per-account breakdown. */
 function renderAuthMatrix(results, opts) {
@@ -466,7 +549,7 @@ function renderAuthMatrix(results, opts) {
         lines.push(`  ${r.host.padEnd(nameW)}  ${cells.join(' ')}${note}`);
     }
     lines.push('');
-    lines.push(chalk.gray('  cell = live/total accounts · green all live · red revoked (re-login) · yellow expired/unverified/limited'));
+    lines.push(chalk.gray('  cell = signed-in/total accounts · green live · gray signed-in (unverifiable: codex/grok) · yellow expired (self-refreshes) · red revoked (re-login)'));
     if (opts?.verbose) {
         lines.push('');
         lines.push(chalk.bold('Accounts'));
@@ -475,9 +558,7 @@ function renderAuthMatrix(results, opts) {
                 continue;
             for (const row of r.rows.slice().sort((x, y) => (x.agent + x.version).localeCompare(y.agent + y.version))) {
                 const v = row.health.verdict;
-                const label = v === 'live' ? chalk.green(verdictLabel(v))
-                    : (v === 'revoked' || v === 'expired') ? chalk.red(verdictLabel(v))
-                        : chalk.yellow(verdictLabel(v));
+                const label = CELL_PAINT[verdictColor(v)](verdictLabel(v));
                 const acctRaw = row.account ?? '—';
                 const acct = row.account ? chalk.cyan(acctRaw.padEnd(28)) : chalk.dim(acctRaw.padEnd(28));
                 const detail = row.health.detail ? chalk.dim(` ${row.health.detail}`) : '';
@@ -488,6 +569,46 @@ function renderAuthMatrix(results, opts) {
     }
     return lines;
 }
+/** Render the final `fleet login` result summary in the house auth-matrix style. */
+function renderLoginMatrix(results) {
+    const lines = [chalk.bold('Fleet login')];
+    if (results.length === 0) {
+        lines.push(chalk.gray('  Nothing pending — every requested account is already logged in.'));
+        return lines;
+    }
+    const nameW = Math.max(6, ...results.map((r) => `${r.agent}@${r.device}`.length));
+    for (const r of results) {
+        const who = `${r.agent}@${r.device}`.padEnd(nameW);
+        let badge;
+        switch (r.state) {
+            case 'authorized':
+                badge = chalk.green('authorized');
+                break;
+            case 'ready':
+                badge = chalk.cyan('code ready');
+                break;
+            case 'driving':
+                badge = chalk.yellow('driving');
+                break;
+            case 'skipped':
+                badge = chalk.gray('not remotable');
+                break;
+            case 'error':
+                badge = chalk.red('error');
+                break;
+            default:
+                badge = chalk.gray(r.state);
+                break;
+        }
+        const note = r.detail ? chalk.dim(`  ${r.detail}`) : (r.reason && !r.remotable ? chalk.dim(`  ${r.reason}`) : '');
+        lines.push(`  ${who}  ${badge}${note}`);
+    }
+    const auth = results.filter((r) => r.state === 'authorized').length;
+    const remotable = results.filter((r) => r.remotable).length;
+    lines.push('');
+    lines.push(chalk.gray(`  ${auth}/${remotable} remotable logins authorized`));
+    return lines;
+}
 /** Register the `agents devices` command tree (also aliased as `fleet`). */
 function registerDevicesCommands(program) {
     const devicesCmd = program
@@ -529,6 +650,9 @@ Typical workflow:
     });
     // `agents fleet capture` — snapshot live state into agents.yaml fleet:.
     registerFleetCaptureCommand(devicesCmd);
+    // `agents fleet apply` — same reconcile engine as the top-level `agents apply`,
+    // surfaced under the fleet tree for discoverability.
+    registerFleetApplyAlias(devicesCmd);
     devicesCmd
         .command('register <name>')
         .description('Register a discovered (pending) node by name — used by the menu-bar "NEW DEVICES → Register" action.')
@@ -576,16 +700,7 @@ Typical workflow:
         }
         console.log(chalk.green(`No longer ignoring '${name}'`) + chalk.gray(' — run `agents devices sync` to register it.'));
     });
-    devicesCmd
-        .command('list')
-        .alias('ls')
-        .description('List registered devices with platform, address, reachability, and live resource headroom.')
-        .option('--json', 'output the registry as a JSON array (for scripts and hooks)')
-        .option('--no-stats', 'skip the live resource probe (instant; names/addresses only)')
-        .option('--refresh', 'force a live probe of every device, bypassing the cache')
-        .option('--live', 'alias of --refresh (shorter to type)')
-        .option('-f, --full', 'full mode: add per-device core count and free/total memory')
-        .action(async (opts) => {
+    const runList = async (opts = {}) => {
         const reg = await loadDevices();
         const names = Object.keys(reg).sort();
         if (opts.json) {
@@ -629,7 +744,26 @@ Typical workflow:
         if (freshness?.servedFromCache && freshness.oldestFetchedAt != null) {
             console.log(chalk.gray(`  updated ${formatCheckedAge(freshness.oldestFetchedAt)} — pass --refresh (--live) for a live probe`));
         }
-    });
+        // Ephemeral crabbox leases live alongside the registered fleet but are never
+        // written into the registry — surface them as their own live section. This is
+        // a live provider call, so honor --no-stats (the explicit "instant, no probes"
+        // opt-out) and bound it so a slow provider can't hang `agents devices`.
+        if (opts.stats !== false) {
+            for (const line of loadLeasedBoxesSection())
+                console.log(line);
+        }
+    };
+    devicesCmd.action(runList);
+    devicesCmd
+        .command('list')
+        .alias('ls')
+        .description('List registered devices with platform, address, reachability, and live resource headroom.')
+        .option('--json', 'output the registry as a JSON array (for scripts and hooks)')
+        .option('--no-stats', 'skip the live resource probe (instant; names/addresses only)')
+        .option('--refresh', 'force a live probe of every device, bypassing the cache')
+        .option('--live', 'alias of --refresh (shorter to type)')
+        .option('-f, --full', 'full mode: add per-device core count and free/total memory')
+        .action(runList);
     devicesCmd
         .command('status')
         .description('Show fleet health: warnings rollup, per-device sync drift, CLI readiness, version skew, and resource headroom.')
@@ -648,8 +782,41 @@ Typical workflow:
         .option('--local', 'probe only this host (used internally for fan-out)')
         .option('--verbose', 'show a per-account breakdown, not just the per-host rollup')
         .option('--strict', 'exit non-zero when any account is revoked (expired is soft — it self-refreshes)')
+        .action(async (opts, cmd) => {
+        // The root program also defines a global `--verbose` (startup self-heal
+        // detail), and commander binds a shared long flag to the program, not the
+        // leaf — so `fleet ping --verbose` never set opts.verbose and the
+        // per-account breakdown was silently unreachable. Read the effective value
+        // from the merged globals so the flag works at either level.
+        const verbose = opts.verbose ?? Boolean(cmd.optsWithGlobals().verbose);
+        await runFleetPing({ ...opts, verbose });
+    });
+    devicesCmd
+        .command('login')
+        .description('Log agent CLIs into fleet boxes over SSH: drive each box\'s device-code OAuth, scrape the URL + code, and surface every pending login in one local browser page. Default drives all codes at once; --interactive walks one box at a time (codes requested just-in-time so they don\'t expire).')
+        .option('--agents <csv>', 'only these agents (comma-separated); default: every agent with a device-code flow')
+        .option('--devices <csv>', 'only these devices (comma-separated); default: every online box')
+        .option('--all', 'target every device-code pair regardless of cached login state (cold cache / forced re-login)')
+        .option('--interactive', 'guided one-box-at-a-time wizard (codes requested just-in-time)')
+        .option('--json', 'output the final result matrix as JSON')
         .action(async (opts) => {
-        await runFleetPing(opts);
+        const csv = (s) => (s ? s.split(',').map((x) => x.trim()).filter(Boolean) : undefined);
+        const results = await runFleetLogin({
+            agents: csv(opts.agents),
+            devices: csv(opts.devices),
+            all: opts.all,
+            interactive: opts.interactive,
+            json: opts.json,
+        });
+        if (opts.json) {
+            console.log(JSON.stringify(results, null, 2));
+        }
+        else {
+            for (const line of renderLoginMatrix(results))
+                console.log(line);
+        }
+        if (results.some((r) => r.remotable && r.state !== 'authorized'))
+            process.exitCode = 1;
     });
     devicesCmd
         .command('show <name>')
@@ -849,6 +1016,9 @@ secrets bundle via an askpass shim — the password never touches argv.
         // A bare unregistered alias still errors as "Unknown device".
         const device = resolveDeviceTarget(name, await loadDevices());
         if (!device) {
+            // Not a registered device — it may be a leased crabbox box slug. ssh into
+            // it directly (crabbox@<tailnet|ip>:2222) before giving up.
+            trySshLeasedBox(name, cmd); // exits the process on a match
             console.error(chalk.red(`Unknown device '${name}'. See 'agents devices list'.`));
             process.exit(1);
         }
@@ -907,7 +1077,7 @@ async function runAskpass() {
         process.exit(1);
     }
     try {
-        const { env } = readAndResolveBundleEnv(bundle, { caller: 'agents ssh', agentOnly: isHeadlessSecretsContext() });
+        const { env } = readAndResolveBundleEnv(bundle, { caller: 'agents ssh', keys: [key], keyMode: 'storage', agentOnly: isHeadlessSecretsContext() });
         const value = env[key];
         if (value === undefined) {
             console.error(`askpass: key '${key}' not found in bundle '${bundle}'`);

package/dist/commands/sync.js

@@ -544,7 +544,7 @@ function runLaunchMode(agent, version, cwd, quiet) {
     if (result.rulesCompiled)
         bits.push('rules');
     if (result.workspaceLinks > 0)
-        bits.push(`${result.workspaceLinks} workspace link(s)`);
+        bits.push(`${result.workspaceLinks} project resource(s)`);
     const mpCount = Object.keys(result.marketplaces).length;
     if (mpCount > 0) {
         const pluginCount = Object.values(result.marketplaces).reduce((acc, names) => acc + names.length, 0);

package/dist/commands/teams.js

@@ -7,6 +7,8 @@ import { AgentManager, AgentStatus, checkCliSignedIn, collectTeamsDoctorData, ge
 import { mailboxDir, enqueue } from '../lib/mailbox.js';
 import { resolveProvider } from '../lib/cloud/registry.js';
 import { emit } from '../lib/events.js';
+import { maybeShowStarNudge } from '../lib/star-nudge.js';
+import { shareRuntimeEnv } from '../lib/share/config.js';
 import { runSupervisor } from '../lib/teams/supervisor.js';
 import { debug } from '../lib/teams/debug.js';
 import { runPrWatch, DEFAULT_MAX_WAVES, } from '../lib/teams/pr-watch.js';
@@ -49,8 +51,6 @@ const VALID_AGENTS = Object.keys(AGENT_NAMES);
 const VALID_MODES = ['plan', 'edit', 'auto', 'skip', 'full'];
 const VALID_EFFORTS = ['low', 'medium', 'high', 'xhigh', 'max', 'auto'];
 const VALID_CLOUD_PROVIDERS = ['rush', 'codex', 'factory'];
-// Auto-enable JSON mode when piped / not a TTY so AI agent consumers get
-// parseable output by default.
 function statusColor(status) {
     switch (status) {
         case 'pending': return chalk.blue;
@@ -1352,6 +1352,7 @@ export function registerTeamsCommands(program) {
                     repo: opts.repo,
                     branch: opts.branch,
                     model: a.model ?? undefined,
+                    env: shareRuntimeEnv({ agentOnly: true }),
                 };
                 const cloudTask = await prov.dispatch(dispatchOpts);
                 return { cloudSessionId: cloudTask.id };
@@ -1369,6 +1370,7 @@ export function registerTeamsCommands(program) {
                 repo: opts.repo,
                 branch: opts.branch,
                 model: opts.model,
+                env: shareRuntimeEnv({ agentOnly: true }),
             };
             try {
                 const cloudTask = await prov.dispatch(dispatchOpts);
@@ -1594,6 +1596,13 @@ export function registerTeamsCommands(program) {
         emit('teams.complete', { module: 'teams', team, stoppedBy: result.stoppedBy, waves: result.waves, durationMs: result.elapsed_ms });
         if (result.stoppedBy === 'drained') {
             console.log(chalk.green(`Factory drained in ${elapsed}s (${result.waves} waves).`));
+            // First-successful-team star nudge (one-time, non-nagging). "drained"
+            // only means nothing is pending/running — teammates may have failed — so
+            // gate on a clean drain (failed === 0). A team where every teammate
+            // failed is not the success this nudge celebrates.
+            if ((result.failed ?? 0) === 0) {
+                maybeShowStarNudge({ quiet: opts.json });
+            }
         }
         else if (result.stoppedBy === 'max-waves') {
             console.error(chalk.yellow(`Hit --max-waves=${maxWaves}; stopping. Re-run to continue.`));

package/dist/index.js

@@ -26,6 +26,11 @@ const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const packageJsonPath = path.join(__dirname, '..', 'package.json');
 const packageJson = JSON.parse(fs.readFileSync(packageJsonPath, 'utf-8'));
 const VERSION = packageJson.version;
+if (process.argv[2] === '__vault-age-helper') {
+    const { runVaultAgeHelperCli } = await import('./lib/secrets/vault-age-helper.js');
+    await runVaultAgeHelperCli();
+    process.exit(process.exitCode ?? 0);
+}
 import { NPM_PACKAGE_NAME, deriveGlobalPrefix, detectPackageManager, installPackageIntoPrefix, installPackageWithBun, verifyInstalledVersion, refreshAliasShims, downloadVerifiedTarball, } from './lib/self-update.js';
 // Detect dev/working-tree builds and default the noisy startup steps off.
 // Three cases trip this:
@@ -50,7 +55,7 @@ if (IS_DEV_BUILD) {
 // module on each invocation (which loaded the whole ~50-module tree before the
 // first byte of output), the registry maps a command name to a thunk that
 // imports only what that command needs. See src/lib/startup/command-registry.ts.
-import { COMMAND_LOADERS, LAZY_COMMAND_NAMES, loadView, loadInspect, loadFeedback, loadCommands, loadHooks, loadSkills, loadRules, loadMemory, loadPermissions, loadMcp, loadCli, loadSubagents, loadPlugins, loadWorkflows, loadWorktree, loadVersions, loadImport, loadPackages, loadDaemon, loadRoutines, loadMonitors, loadRun, loadFork, loadDefaults, loadModels, loadPrune, loadTrash, loadRestore, loadDoctor, loadApply, loadCheck, loadStatus, loadProfiles, loadSecrets, loadWallet, loadHelper, loadMenubar, loadBeta, loadSync, loadLock, loadRefreshRules, loadDrive, loadFactory, loadUsage, loadCost, loadOutput, loadBudget, loadAlias, loadPty, loadTmux, loadWatchdog, loadBrowser, loadComputer, loadHosts, loadLogs, loadEvents, loadAudit, loadWebhook, loadFunnel, loadSsh, loadPull, loadPush, loadRepo, loadSetup, loadUninstall, loadShare, loadFeed, loadMailboxes, } from './lib/startup/command-registry.js';
+import { COMMAND_LOADERS, LAZY_COMMAND_NAMES, loadView, loadInspect, loadResources, loadFeedback, loadCommands, loadHooks, loadSkills, loadRules, loadMemory, loadPermissions, loadMcp, loadCli, loadSubagents, loadPlugins, loadWorkflows, loadWorktree, loadVersions, loadImport, loadPackages, loadRoutines, loadMonitors, loadRun, loadFork, loadDefaults, loadModels, loadPrune, loadTrash, loadRestore, loadDoctor, loadApply, loadCheck, loadStatus, loadProfiles, loadSecrets, loadLogin, loadWallet, loadHelper, loadMenubar, loadBeta, loadSync, loadLock, loadRefreshRules, loadDrive, loadFactory, loadUsage, loadCost, loadOutput, loadBudget, loadAlias, loadMine, loadPty, loadTmux, loadWatchdog, loadBrowser, loadComputer, loadHosts, loadLogs, loadEvents, loadAudit, loadWebhook, loadFunnel, loadSsh, loadPull, loadPush, loadRepo, loadSetup, loadUninstall, loadShare, loadSend, loadHq, loadFeed, loadActivity, loadMailboxes, } from './lib/startup/command-registry.js';
 import { applyGlobalHelpConventions } from './lib/help.js';
 import { renderWhatsNew } from './lib/whats-new.js';
 import { emit, redactArgs } from './lib/events.js';
@@ -68,9 +73,18 @@ if (process.argv[2] === '__shim') {
     const code = await execShimPassthrough(agent, rawArgs, process.cwd(), pinned || undefined);
     process.exit(code);
 }
+if (process.argv[2] === '__daemon-run') {
+    const { runDaemon } = await import('./lib/daemon.js');
+    await runDaemon();
+    process.exit(process.exitCode ?? 0);
+}
+// White-label: the shim for a brand (e.g. `jack`) exports AGENTS_BRAND, so the
+// CLI presents its own name/help/errors as the brand. Unbranded (AGENTS_BRAND
+// unset) resolves to 'agents' and everything below is byte-identical to before.
+const BRAND = resolveBrandName();
 const program = new Command();
 program
-    .name('agents')
+    .name(BRAND)
     .description('Environment manager for AI agents')
     .version(VERSION)
     .option('--verbose', 'Show startup self-heal details on stderr')
@@ -86,7 +100,7 @@ program
 function auditCommandPath(cmd) {
     const parts = [];
     let c = cmd;
-    while (c && c.name() && c.name() !== 'agents') {
+    while (c && c.name() && c.name() !== BRAND) {
         parts.unshift(c.name());
         c = c.parent;
     }
@@ -129,11 +143,36 @@ program.hook('postAction', (_thisCommand, actionCommand) => {
         // Best-effort completion record; the start line is the durable audit fact.
     }
 });
+/**
+ * Skin the static root help for a brand: rewrite the visible `agents` command
+ * examples to the brand name and drop lines for commands this brand disabled.
+ * A no-op for the unbranded `agents` CLI with nothing disabled.
+ */
+function brandRootHelp(raw) {
+    let text = raw;
+    if (BRAND !== 'agents') {
+        text = text
+            .replace(/Usage: agents /g, `Usage: ${BRAND} `)
+            .replace(/^ {2}agents /gm, `  ${BRAND} `)
+            .replace(/Run 'agents /g, `Run '${BRAND} `);
+    }
+    const disabled = disabledCommandsForActiveBrand();
+    if (disabled.size > 0) {
+        text = text
+            .split('\n')
+            .filter((line) => {
+            const m = line.match(/^ {2}([a-z][\w-]*)/);
+            return !(m && disabled.has(m[1]));
+        })
+            .join('\n');
+    }
+    return text;
+}
 // Custom help for the main program only
 const originalHelpInformation = program.helpInformation.bind(program);
 program.helpInformation = function () {
-    if (this.name() === 'agents' && !this.parent) {
-        return `Usage: agents [command] [options]
+    if (this.name() === BRAND && !this.parent) {
+        return brandRootHelp(`Usage: agents [command] [options]
 
 Install, configure, run, and dispatch AI coding agents from one place.
 Works with Claude, Codex, Gemini, Cursor, OpenCode, OpenClaw, and Droid.
@@ -154,6 +193,7 @@ Agent versions:
   trash                           Inspect and restore soft-deleted version directories
   view [agent[@version]]          List versions, or inspect one in detail
   inspect <target>                Deep details for one agent+version, or a DotAgents repo (user|system|project|alias|path)
+  resources                       Show merged DotAgents resources with their winning layer
 
 Agent configuration (synced across versions):
   rules                           Instructions given to agents (CLAUDE.md, etc.)
@@ -173,6 +213,7 @@ Run and dispatch:
   run <agent|profile> [prompt]    Run an agent. Omit prompt for interactive mode.
   defaults                        Configure run defaults by agent/version selector
   teams                           Coordinate multiple agents on shared work
+  hq                              JSON bridge for the interactive Agents HQ floor
   routines                        Run agents on a cron schedule (scheduler auto-starts)
   webhook                         Receive signed GitHub/Linear webhooks for trigger routines
   funnel                          Expose a webhook receiver through Tailscale Funnel
@@ -182,6 +223,7 @@ Run and dispatch:
   pty                             Drive interactive terminal programs (REPLs, TUIs) via a persistent PTY session
 
 Credentials and profiles:
+  profile                         Activate resource profiles across skills, MCP, permissions, and secrets
   profiles                        Bundles of (host CLI, endpoint, model, auth)
   secrets                         Keychain-backed env bundles; use 'secrets exec <bundle> -- <cmd>' to inject into a subprocess
 
@@ -213,7 +255,7 @@ Options:
   --verbose                       Show startup self-heal details on stderr
 
 System config lives in ~/.agents/.system/. Run 'agents <command> --help' for details.
-`;
+`);
     }
     return originalHelpInformation();
 };
@@ -251,6 +293,7 @@ async function showWhatsNew(fromVersion, toVersion) {
 }
 const UPDATE_CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000; // 24 hours
 import { getUpdateCheckPath, getMigratedSentinelPath, getUserAgentsDir, getRuntimeStateDir } from './lib/state.js';
+import { resolveBrandName, disabledCommandsForActiveBrand } from './lib/brand.js';
 import { readUpdateCache, saveUpdateCheck, dismissUpdateVersion, shouldPromptUpgrade, findAgentsCliInstalls, } from './lib/self-update.js';
 const UPDATE_CHECK_FILE = getUpdateCheckPath();
 /**
@@ -668,7 +711,9 @@ async function registerEagerForRequest(name) {
 async function registerAllEagerCommands() {
     await reg(loadView);
     await reg(loadShare);
+    await reg(loadSend);
     await reg(loadInspect);
+    await reg(loadResources);
     await reg(loadFeedback);
     await reg(loadCommands);
     await reg(loadHooks);
@@ -686,7 +731,6 @@ async function registerAllEagerCommands() {
     await reg(loadVersions);
     await reg(loadImport);
     await reg(loadPackages);
-    await reg(loadDaemon);
     await reg(loadRoutines);
     await reg(loadMonitors);
     await reg(loadRun);
@@ -703,6 +747,7 @@ async function registerAllEagerCommands() {
     registerExecAliasCommand(program);
     await reg(loadProfiles);
     await reg(loadSecrets);
+    await reg(loadLogin);
     await reg(loadWallet);
     await reg(loadHelper);
     await reg(loadMenubar);
@@ -717,6 +762,7 @@ async function registerAllEagerCommands() {
     await reg(loadOutput);
     await reg(loadBudget);
     await reg(loadAlias);
+    await reg(loadMine);
     await reg(loadPty);
     await reg(loadTmux);
     await reg(loadWatchdog);
@@ -728,7 +774,9 @@ async function registerAllEagerCommands() {
     await reg(loadAudit);
     await reg(loadWebhook);
     await reg(loadFunnel);
+    await reg(loadHq);
     await reg(loadFeed);
+    await reg(loadActivity);
     await reg(loadMailboxes);
     await reg(loadSsh);
     registerJobsCronAliasCommand(program, 'jobs');
@@ -795,13 +843,19 @@ const verboseStartup = passedArgs.includes('--verbose');
 // Help and version output are pure documentation — they must never gate on
 // setup, otherwise `agents <cmd> --help` becomes useless on a fresh box.
 const helpOrVersionRequested = passedArgs.some((arg) => arg === '--help' || arg === '-h' || arg === '--version' || arg === '-V');
+// White-label: a brand can hide built-in top-level commands. A hidden command
+// must behave as if it doesn't exist under this brand (unknown-command +
+// spellcheck), while `agents` itself is unaffected. `brandDisabled` is empty for
+// the unbranded CLI, so all of this is a no-op there.
+const brandDisabled = disabledCommandsForActiveBrand();
+const requestedIsDisabled = requestedCommand !== undefined && brandDisabled.has(requestedCommand);
 // `--host` passthrough: run this invocation on a remote machine over SSH instead
 // of locally. Handled before any local command registration / update check /
 // background sync — a remote run needs none of that. Only the allowlisted
 // read-only + config + teams commands route here; `run`/`sessions` are absent
 // from the table and fall through to their own richer `--host` handling below.
 // `--help`/`--version` stay local (docs must work without a reachable host).
-if (requestedCommand !== undefined && !helpOrVersionRequested) {
+if (requestedCommand !== undefined && !helpOrVersionRequested && !requestedIsDisabled) {
     const { maybeRunOnHost } = await import('./lib/hosts/passthrough.js');
     if (await maybeRunOnHost(requestedCommand, passedArgs)) {
         process.exit(process.exitCode ?? 0);
@@ -810,7 +864,13 @@ if (requestedCommand !== undefined && !helpOrVersionRequested) {
 // Register only the command(s) this invocation actually uses. Lazy commands
 // (sessions/teams/cloud) are handled after applyGlobalHelpConventions below.
 const isLazyRequest = requestedCommand !== undefined && LAZY_COMMAND_NAMES.has(requestedCommand);
-if (requestedCommand !== undefined && !isLazyRequest) {
+if (requestedIsDisabled) {
+    // The brand turned this command off: register the full tree so the "did you
+    // mean" picker still works, then strip the disabled commands below so the
+    // request resolves as unknown.
+    await registerAllEagerCommands();
+}
+else if (requestedCommand !== undefined && !isLazyRequest) {
     const known = await registerEagerForRequest(requestedCommand);
     if (!known) {
         // Unknown top-level command: register the full tree so the "did you mean"
@@ -828,10 +888,19 @@ if (requestedCommand !== undefined && !isLazyRequest) {
 applyGlobalHelpConventions(program);
 // Lazy commands pull in the SQLite-backed session/cloud stack; register them
 // only when explicitly requested, keeping lightweight commands off that path.
-if (isLazyRequest) {
+if (isLazyRequest && !requestedIsDisabled) {
     for (const loader of COMMAND_LOADERS[requestedCommand])
         await reg(loader);
 }
+// White-label: remove any commands this brand disabled so they resolve as
+// unknown (the command:* handler then reports "unknown command"). Unbranded or
+// nothing-disabled → no-op. Done after all registration paths above.
+if (brandDisabled.size > 0) {
+    const kept = program.commands.filter((c) => !brandDisabled.has(c.name()));
+    if (kept.length !== program.commands.length) {
+        program.commands = kept;
+    }
+}
 // Pure documentation paths (--version / --help / -h) return immediately: skip
 // the update check (PATH scan + cache read) and the detached background sync
 // (spawns a child process) that every other invocation runs.