@phnx-labs/agents-cli 1.20.72 → 1.20.74

package/dist/lib/config-transfer.js

@@ -0,0 +1,56 @@
+/**
+ * Primitives for moving an agent config directory across the agents-cli boundary.
+ *
+ * Both helpers were part of {@link ./uninstall.ts} and are unchanged — teardown was
+ * simply the first caller. `agents export` needs the same two operations (relocate a
+ * directory that may sit on another volume; copy one without dragging `~/.agents`
+ * symlinks along), so they live here rather than being duplicated or imported out of
+ * a module named for teardown.
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+/**
+ * Move `source` onto `dest` across possibly-different volumes. `renameSync` is
+ * atomic but throws EXDEV when `~/.agents` lives on a different filesystem than
+ * `$HOME`; fall back to copy-then-remove so the restore still completes. The
+ * source is removed only after the copy succeeds, so a mid-copy failure never
+ * destroys the sole surviving copy.
+ */
+export function moveDirCrossDevice(source, dest) {
+    try {
+        fs.renameSync(source, dest);
+    }
+    catch (err) {
+        if (err.code !== 'EXDEV')
+            throw err;
+        fs.cpSync(source, dest, { recursive: true });
+        fs.rmSync(source, { recursive: true, force: true });
+    }
+}
+/**
+ * Copy `source` to `dest`, dropping any symlink whose target resolves back into
+ * `~/.agents`. Managed resources (skills/commands) are synced into a version home
+ * as symlinks into `~/.agents`; copying them verbatim would leave the result full
+ * of links that dangle the moment `~/.agents` is disposed. Stripping them yields a
+ * clean, self-contained copy — which is the entire point of an export.
+ */
+export function copyDirStrippingAgentsSymlinks(source, dest, agentsDir) {
+    const inside = agentsDir + path.sep;
+    fs.cpSync(source, dest, {
+        recursive: true,
+        filter: (src) => {
+            try {
+                const st = fs.lstatSync(src);
+                if (st.isSymbolicLink()) {
+                    const tgt = path.resolve(path.dirname(src), fs.readlinkSync(src));
+                    if (tgt === agentsDir || tgt.startsWith(inside))
+                        return false;
+                }
+            }
+            catch {
+                /* unreadable entry — let cpSync surface it on the real copy */
+            }
+            return true;
+        },
+    });
+}

package/dist/lib/crabbox/cli.d.ts

@@ -26,6 +26,10 @@ export interface CrabboxBox {
     state: string;
     /** Public IPv4, when the provider exposes one. */
     ip?: string;
+    /** Tailnet IPv4 (100.x), when the box was leased with `--network tailscale`. */
+    tailscaleIPv4?: string;
+    /** Tailnet MagicDNS FQDN, when the box joined the tailnet. */
+    tailscaleFQDN?: string;
     profile?: string;
     class?: string;
     /** True when running + bootstrap-complete. */
@@ -49,6 +53,13 @@ export interface CrabboxOptions {
      * `crabbox login` credentials.
      */
     secretsBundle?: string;
+    /**
+     * Hard cap (ms) on a single crabbox invocation that hits the provider API
+     * (`list`). Prevents a slow/unreachable provider from hanging an ambient
+     * command like `agents devices`. Defaults to 8s; callers on a fast/interactive
+     * path (devices list, `agents ssh` fall-through) pass a shorter bound.
+     */
+    timeoutMs?: number;
 }
 /** Locate the crabbox binary, or throw an actionable error. */
 export declare function findCrabbox(): string;
@@ -61,6 +72,17 @@ export declare function findCrabbox(): string;
 export declare const LEASE_PROVIDER_TOKEN_KEYS: string[];
 /** The first bundle that declares a provider token key, or undefined. Pure over `bundles`. */
 export declare function pickLeaseBundleFromList(bundles: SecretsBundle[]): string | undefined;
+/**
+ * Env keys a bundle may use for a Tailscale auth key. crabbox reads
+ * `CRABBOX_TAILSCALE_AUTH_KEY` to join a leased box to the tailnet; we accept the
+ * common alternate names too and rename to that canonical key on injection.
+ */
+export declare const TAILSCALE_AUTH_KEY_NAMES: string[];
+/** The first bundle + key that declares a Tailscale auth key, or undefined. Pure over `bundles`. */
+export declare function pickTailscaleBundleFromList(bundles: SecretsBundle[]): {
+    name: string;
+    key: string;
+} | undefined;
 /** A resolved lease bundle: its name, plus (auto-detect only) the exact keys to inject. */
 export interface ResolvedLeaseBundle {
     name: string;
@@ -97,6 +119,13 @@ export interface WarmupOptions extends CrabboxOptions {
     code?: boolean;
     /** Cloud backend override (crabbox provider id, e.g. hetzner/aws/do). */
     provider?: string;
+    /**
+     * Network mode for the leased box. `'public'` (default) leases with a public
+     * IP; `'tailscale'` joins the box to the tailnet (`--network tailscale`,
+     * tagged `tag:crabbox`) so it is reachable only over Tailscale. The caller
+     * (command layer) decides WHEN to enable this — F5 here is plumbing only.
+     */
+    netMode?: 'public' | 'tailscale';
 }
 /**
  * Lease a box and block until it is ready. Returns the leased box.
@@ -137,6 +166,21 @@ export declare function crabboxRun(slug: string, remoteCmd: string, opts?: Crabb
  * Streams combined output; resolves with the remote exit code (null on dispatch failure).
  */
 export declare function crabboxRunScript(slug: string, script: string, opts?: CrabboxRunOptions): Promise<number | null>;
+/**
+ * Parse crabbox's shell-quoted `ssh` command (`'ssh' '-i' '<key>' … 'crabbox@ip'`)
+ * into an argv array. Exported for testing.
+ */
+export declare function parseCrabboxSshArgv(stdout: string): string[] | null;
+/**
+ * The concrete `ssh` argv crabbox uses to reach box `slug` — including the
+ * per-lease identity key and known_hosts crabbox provisions under its own config
+ * dir. A raw `ssh crabbox@ip` fails `publickey`; this is the only auth that works.
+ * `crabbox ssh --id` PRINTS the command (it doesn't connect — that's `crabbox
+ * connect`), and `--reclaim` makes it resolve regardless of which repo holds the
+ * lease claim (matching `crabboxRunScript`). Returns null when crabbox can't
+ * resolve the box (caller treats setup-copy / `agents ssh` as best-effort).
+ */
+export declare function crabboxSshArgv(slug: string, opts?: CrabboxOptions): string[] | null;
 /** Release the lease / delete the box. Best-effort; never throws. */
 export declare function crabboxStop(slug: string, opts?: CrabboxOptions): boolean;
 /** Never reap a box touched within this many seconds, regardless of idle-timeout. */

package/dist/lib/crabbox/cli.js

@@ -37,6 +37,36 @@ export function pickLeaseBundleFromList(bundles) {
     }
     return undefined;
 }
+/**
+ * Env keys a bundle may use for a Tailscale auth key. crabbox reads
+ * `CRABBOX_TAILSCALE_AUTH_KEY` to join a leased box to the tailnet; we accept the
+ * common alternate names too and rename to that canonical key on injection.
+ */
+export const TAILSCALE_AUTH_KEY_NAMES = ['CRABBOX_TAILSCALE_AUTH_KEY', 'TAILSCALE_AUTH_KEY', 'TS_AUTHKEY'];
+/** The first bundle + key that declares a Tailscale auth key, or undefined. Pure over `bundles`. */
+export function pickTailscaleBundleFromList(bundles) {
+    for (const b of bundles) {
+        const key = Object.keys(b.vars ?? {}).find((k) => TAILSCALE_AUTH_KEY_NAMES.includes(k));
+        if (key)
+            return { name: b.name, key };
+    }
+    return undefined;
+}
+/** Process-lifetime memo so the tailscale bundle `listBundles()` scan runs at most once. */
+let tailscaleBundleMemo;
+function resolveTailscaleBundleMemo() {
+    if (!tailscaleBundleMemo) {
+        let value;
+        try {
+            value = pickTailscaleBundleFromList(listBundles());
+        }
+        catch {
+            /* secrets unreadable — no auto-detect */
+        }
+        tailscaleBundleMemo = { value };
+    }
+    return tailscaleBundleMemo.value;
+}
 /**
  * The secrets bundle to feed crabbox, resolved in priority order:
  *   1. `AGENTS_LEASE_SECRETS_BUNDLE` env var          — explicit, no keychain
@@ -92,30 +122,55 @@ export function setLeaseSecretsBundle(name) {
 }
 /** Build the child env for crabbox, injecting a secrets bundle when configured. */
 export function crabboxEnv(opts) {
+    const out = { ...process.env };
     const resolved = opts.secretsBundle
         ? { name: opts.secretsBundle }
         : resolveLeaseBundleMemo();
-    if (!resolved)
-        return process.env;
-    try {
-        // Auto-detected bundle → inject ONLY the provider token key(s) (least
-        // privilege; an unrelated bundle can't leak its other secrets into crabbox).
-        // An explicitly-named bundle (env/config or `opts.secretsBundle`) injects
-        // whole — the user chose it. Same resolver `agents secrets exec` uses.
-        const { env } = readAndResolveBundleEnv(resolved.name, {
-            caller: 'agents run --lease (crabbox)',
-            keys: resolved.keys,
-            // --lease is headless by contract and crabboxEnv is called several times
-            // per run (list/wait/spawn/stop) — resolve broker-only so a keychain bundle
-            // can't pop repeated unwatched Touch ID sheets mid-lease.
-            agentOnly: isHeadlessSecretsContext(),
-        });
-        return { ...process.env, ...env };
+    if (resolved) {
+        try {
+            // Auto-detected bundle → inject ONLY the provider token key(s) (least
+            // privilege; an unrelated bundle can't leak its other secrets into crabbox).
+            // An explicitly-named bundle (env/config or `opts.secretsBundle`) injects
+            // whole — the user chose it. Same resolver `agents secrets exec` uses.
+            const { env } = readAndResolveBundleEnv(resolved.name, {
+                caller: 'agents run --lease (crabbox)',
+                keys: resolved.keys,
+                // --lease is headless by contract and crabboxEnv is called several times
+                // per run (list/wait/spawn/stop) — resolve broker-only so a keychain bundle
+                // can't pop repeated unwatched Touch ID sheets mid-lease.
+                agentOnly: isHeadlessSecretsContext(),
+            });
+            Object.assign(out, env);
+        }
+        catch (e) {
+            throw new Error(`Could not load secrets bundle "${resolved.name}" for crabbox: ${e.message}. ` +
+                `Fix the bundle (agents secrets view ${resolved.name}) or unset lease.secretsBundle to use crabbox's own login.`);
+        }
     }
-    catch (e) {
-        throw new Error(`Could not load secrets bundle "${resolved.name}" for crabbox: ${e.message}. ` +
-            `Fix the bundle (agents secrets view ${resolved.name}) or unset lease.secretsBundle to use crabbox's own login.`);
+    // Tailscale plumbing (F5): inject CRABBOX_TAILSCALE_AUTH_KEY from a bundle that
+    // declares a tailscale auth key, when the ambient env doesn't already set one.
+    // Best-effort and opt-in — a missing/unreadable tailscale bundle never fails a
+    // public-network lease; `crabboxWarmup({ netMode: 'tailscale' })` is what decides
+    // whether the key is actually used.
+    if (!out.CRABBOX_TAILSCALE_AUTH_KEY) {
+        const ts = resolveTailscaleBundleMemo();
+        if (ts) {
+            try {
+                const { env } = readAndResolveBundleEnv(ts.name, {
+                    caller: 'agents run --lease (crabbox tailscale)',
+                    keys: [ts.key],
+                    agentOnly: isHeadlessSecretsContext(),
+                });
+                const value = env[ts.key];
+                if (value)
+                    out.CRABBOX_TAILSCALE_AUTH_KEY = value;
+            }
+            catch {
+                /* best-effort — tailscale is opt-in plumbing, never blocks a public lease */
+            }
+        }
     }
+    return out;
 }
 function normalizeBox(raw) {
     const labels = (raw.labels ?? {});
@@ -138,6 +193,8 @@ function normalizeBox(raw) {
         lease: labels.lease ?? '',
         state,
         ip: publicNet.ipv4?.ip || undefined,
+        tailscaleIPv4: labels.tailscale_ipv4 || undefined,
+        tailscaleFQDN: labels.tailscale_fqdn || undefined,
         profile: labels.profile,
         class: labels.class,
         ready: status === 'running' && state === 'ready',
@@ -151,7 +208,11 @@ function normalizeBox(raw) {
 /** All crabbox machines the broker knows about. */
 export function crabboxList(opts = {}) {
     findCrabbox();
-    const r = spawnSync('crabbox', ['list', '--json'], { encoding: 'utf-8', env: crabboxEnv(opts) });
+    const timeoutMs = opts.timeoutMs ?? 8000;
+    const r = spawnSync('crabbox', ['list', '--json'], { encoding: 'utf-8', env: crabboxEnv(opts), timeout: timeoutMs });
+    if (r.error && r.error.code === 'ETIMEDOUT') {
+        throw new Error(`crabbox list timed out after ${Math.round(timeoutMs / 1000)}s (provider slow or unreachable)`);
+    }
     if (r.status !== 0) {
         throw new Error(`crabbox list failed: ${(r.stderr || r.stdout || '').trim() || 'unknown error'}`);
     }
@@ -190,6 +251,10 @@ export async function crabboxWarmup(opts = {}) {
         args.push('--provider', opts.provider);
     if (opts.code)
         args.push('--code');
+    // Tailscale plumbing (F5): join the box to the tailnet, tagged tag:crabbox.
+    // The auth key rides the child env as CRABBOX_TAILSCALE_AUTH_KEY (see crabboxEnv).
+    if (opts.netMode === 'tailscale')
+        args.push('--network', 'tailscale', '-tailscale-tags', 'tag:crabbox');
     // Async spawn (not spawnSync): provisioning takes 30-90s and a blocking call
     // would freeze any caller's progress spinner. Output is captured, not streamed.
     const r = await new Promise((resolve) => {
@@ -324,6 +389,41 @@ export function crabboxRunScript(slug, script, opts = {}) {
         proc.stdin.end();
     });
 }
+/**
+ * Parse crabbox's shell-quoted `ssh` command (`'ssh' '-i' '<key>' … 'crabbox@ip'`)
+ * into an argv array. Exported for testing.
+ */
+export function parseCrabboxSshArgv(stdout) {
+    for (const raw of stdout.split('\n')) {
+        const line = raw.trim();
+        if (!line.startsWith("'ssh'") && !line.startsWith('ssh '))
+            continue;
+        const toks = [...line.matchAll(/'([^']*)'|(\S+)/g)].map((m) => m[1] ?? m[2]);
+        if (toks[0] === 'ssh' && toks.length >= 3)
+            return toks;
+    }
+    return null;
+}
+/**
+ * The concrete `ssh` argv crabbox uses to reach box `slug` — including the
+ * per-lease identity key and known_hosts crabbox provisions under its own config
+ * dir. A raw `ssh crabbox@ip` fails `publickey`; this is the only auth that works.
+ * `crabbox ssh --id` PRINTS the command (it doesn't connect — that's `crabbox
+ * connect`), and `--reclaim` makes it resolve regardless of which repo holds the
+ * lease claim (matching `crabboxRunScript`). Returns null when crabbox can't
+ * resolve the box (caller treats setup-copy / `agents ssh` as best-effort).
+ */
+export function crabboxSshArgv(slug, opts = {}) {
+    findCrabbox();
+    const r = spawnSync('crabbox', ['ssh', '--id', slug, '--reclaim'], {
+        encoding: 'utf-8',
+        env: crabboxEnv(opts),
+        timeout: opts.timeoutMs ?? 15000,
+    });
+    if (r.status !== 0 || !r.stdout)
+        return null;
+    return parseCrabboxSshArgv(r.stdout);
+}
 /** Release the lease / delete the box. Best-effort; never throws. */
 export function crabboxStop(slug, opts = {}) {
     try {

package/dist/lib/crabbox/lease.d.ts

@@ -5,6 +5,24 @@
  * credentials → run the agent on the box (via `crabbox run`, which owns the
  * SSH) → tear the box down. The whole box-side sequence rides a single
  * `--script-stdin` body so the token contents never touch argv.
+ *
+ * ── Command-layer contract (RUSH-1920/1921/1924) ─────────────────────────────
+ * Exports the commands layer (exec.ts / lease.ts / ssh.ts) consumes:
+ *   • `buildBootstrapScript(opts)` — `opts.copySetup` (default TRUE; clear for
+ *     --bare) gates the `copy-setup` progress sentinel; `opts.netMode`
+ *     ('public' | 'tailscale', default 'public') adds the `joined-tailnet` step.
+ *   • `LeaseRunOptions.copySetup` / `LeaseRunOptions.netMode` — forwarded by
+ *     `leaseAndRun` (netMode → `crabboxWarmup`).
+ *   • `crabboxWarmup(opts.netMode)` — 'tailscale' leases onto the tailnet
+ *     (`--network tailscale -tailscale-tags tag:crabbox`); auth key rides the
+ *     child env as `CRABBOX_TAILSCALE_AUTH_KEY` (crabboxEnv, cli.ts).
+ *   • `CrabboxBox.tailscaleIPv4` / `CrabboxBox.tailscaleFQDN` — populated from
+ *     the box labels by `normalizeBox` (cli.ts).
+ *   • Step stream (progress.ts): `type LeaseStep`, the `onStep` router option,
+ *     and the self-contained `renderStepLine(step)` helper (the lib never prints).
+ *   • Setup-copy (setup-copy.ts): `copySetupToBox({ host, user?, port?,
+ *     secretsBundle?, userAgentsDir?, onData? }): Promise<CopySetupResult>` — the
+ *     push-from-local the command layer runs before the box run.
  */
 import type { AgentId } from '../types.js';
 import { type CrabboxBox } from './cli.js';
@@ -13,6 +31,9 @@ import { type DetectedRuntime } from './runtimes.js';
 export type LeasePhase = {
     kind: 'warmup';
     backend?: string;
+} | {
+    kind: 'reuse';
+    slug: string;
 } | {
     kind: 'ready';
     box: CrabboxBox;
@@ -29,16 +50,36 @@ export interface LeaseRunOptions {
     backend?: string;
     boxClass?: string;
     profile?: string;
-    /** Runtimes to install + authenticate on the box (from the picker). */
+    /** Runtimes to install on the box. */
     runtimes: AgentId[];
+    /** Runtime credentials to copy; defaults to `runtimes`. */
+    credentialRuntimes?: AgentId[];
     detected: DetectedRuntime[];
+    /** Profile-dispatch config to materialize on the leased box before the run. */
+    dispatchProfile?: LeaseDispatchProfile;
     /** Secrets bundle providing crabbox's provider token. */
     secretsBundle?: string;
+    /**
+     * Push the git-tracked subset of the local `~/.agents` onto the box before the
+     * run (default TRUE). The command layer sets `false` for `--bare`. When true,
+     * `buildBootstrapScript` emits the `copy-setup` progress sentinel; the actual
+     * push-from-local is `copySetupToBox` (setup-copy.ts), which the command layer
+     * runs before the box run.
+     */
+    copySetup?: boolean;
+    /**
+     * Network mode threaded to `crabboxWarmup` (default `'public'`). `'tailscale'`
+     * leases the box onto the tailnet and adds a `joined-tailnet` progress step.
+     * The command layer decides WHEN to enable it — this is plumbing only.
+     */
+    netMode?: 'public' | 'tailscale';
     onData?: (s: string) => void;
     /** Progress phases (warmup → ready → teardown) for a command-layer spinner. */
     onPhase?: (phase: LeasePhase) => void;
     /** Keep the box after the run instead of stopping it. */
     keep?: boolean;
+    /** Existing warm crabbox slug to reuse instead of provisioning a new lease. */
+    reuseBox?: string;
     /**
      * Raw wrapped Claude OAuth payload (from `resolveClaudeCredentialsBlob`), written
      * to `~/.claude/.credentials.json` on the box. The command layer resolves it
@@ -46,6 +87,16 @@ export interface LeaseRunOptions {
      */
     claudeCredentialsJson?: string | null;
 }
+export interface LeaseDispatchProfile {
+    name: string;
+    agent: AgentId;
+    version?: string;
+    env: Record<string, string>;
+    description?: string;
+    preset?: string;
+    provider?: string;
+    fallbackModel?: string;
+}
 export interface LeaseRunResult {
     box: CrabboxBox;
     exitCode: number | null;

package/dist/lib/crabbox/lease.js

@@ -5,14 +5,58 @@
  * credentials → run the agent on the box (via `crabbox run`, which owns the
  * SSH) → tear the box down. The whole box-side sequence rides a single
  * `--script-stdin` body so the token contents never touch argv.
+ *
+ * ── Command-layer contract (RUSH-1920/1921/1924) ─────────────────────────────
+ * Exports the commands layer (exec.ts / lease.ts / ssh.ts) consumes:
+ *   • `buildBootstrapScript(opts)` — `opts.copySetup` (default TRUE; clear for
+ *     --bare) gates the `copy-setup` progress sentinel; `opts.netMode`
+ *     ('public' | 'tailscale', default 'public') adds the `joined-tailnet` step.
+ *   • `LeaseRunOptions.copySetup` / `LeaseRunOptions.netMode` — forwarded by
+ *     `leaseAndRun` (netMode → `crabboxWarmup`).
+ *   • `crabboxWarmup(opts.netMode)` — 'tailscale' leases onto the tailnet
+ *     (`--network tailscale -tailscale-tags tag:crabbox`); auth key rides the
+ *     child env as `CRABBOX_TAILSCALE_AUTH_KEY` (crabboxEnv, cli.ts).
+ *   • `CrabboxBox.tailscaleIPv4` / `CrabboxBox.tailscaleFQDN` — populated from
+ *     the box labels by `normalizeBox` (cli.ts).
+ *   • Step stream (progress.ts): `type LeaseStep`, the `onStep` router option,
+ *     and the self-contained `renderStepLine(step)` helper (the lib never prints).
+ *   • Setup-copy (setup-copy.ts): `copySetupToBox({ host, user?, port?,
+ *     secretsBundle?, userAgentsDir?, onData? }): Promise<CopySetupResult>` — the
+ *     push-from-local the command layer runs before the box run.
  */
-import { crabboxWarmup, crabboxWaitReady, crabboxRunScript, crabboxStop } from './cli.js';
-import { buildCredentialScript, CLAUDE_TOKEN_REMOTE } from './runtimes.js';
-import { LEASE_AGENT_MARKER } from './progress.js';
+import { crabboxFind, crabboxWarmup, crabboxWaitReady, crabboxRunScript, crabboxStop } from './cli.js';
+import * as yaml from 'yaml';
+import { buildCredentialScript, buildHomeFileWriteScript, CLAUDE_TOKEN_REMOTE } from './runtimes.js';
+import { LEASE_AGENT_MARKER, leasePhaseSentinel } from './progress.js';
+import { copySetupToBox } from './setup-copy.js';
 /** POSIX single-quote for safe embedding in the generated bootstrap script. */
 function q(s) {
     return "'" + s.replace(/'/g, "'\\''") + "'";
 }
+function profileRemotePath(name) {
+    return `.agents/profiles/${name}.yml`;
+}
+function buildProfileScript(profile) {
+    const body = yaml.stringify({
+        name: profile.name,
+        ...(profile.description ? { description: profile.description } : {}),
+        host: {
+            agent: profile.agent,
+            ...(profile.version ? { version: profile.version } : {}),
+        },
+        env: profile.env,
+        ...(profile.fallbackModel ? { fallback_model: profile.fallbackModel } : {}),
+        ...(profile.preset ? { preset: profile.preset } : {}),
+        ...(profile.provider ? { provider: profile.provider } : {}),
+    });
+    return buildHomeFileWriteScript(profileRemotePath(profile.name), body);
+}
+function runtimeInstallSpec(id, dispatchProfile) {
+    if (dispatchProfile?.agent === id && dispatchProfile.version) {
+        return `${id}@${dispatchProfile.version}`;
+    }
+    return id;
+}
 /**
  * Bash snippet that guarantees `agents` is runnable on the box. Fresh crabbox
  * images ship without node, and the box user may not own the global npm prefix,
@@ -47,9 +91,11 @@ const ENSURE_AGENTS_CLI = [
  * the credential files. Best-effort install steps never abort the run.
  */
 export function buildBootstrapScript(opts) {
-    const credScript = buildCredentialScript(opts.runtimes, opts.detected, {
+    const credentialRuntimes = opts.credentialRuntimes ?? opts.runtimes;
+    const credScript = buildCredentialScript(credentialRuntimes, opts.detected, {
         claudeCredentialsJson: opts.claudeCredentialsJson,
     });
+    const profileScript = opts.dispatchProfile ? buildProfileScript(opts.dispatchProfile) : '';
     const runParts = ['agents', 'run', q(opts.agent), q(opts.prompt), '--quiet'];
     if (opts.mode)
         runParts.push('--mode', q(opts.mode));
@@ -58,17 +104,40 @@ export function buildBootstrapScript(opts) {
     // Credential files to shred after the run (home-level paths written above).
     // Runs regardless of --keep-box (it's in the box body, not teardown), so a kept
     // box still loses the token after the run — minimizing the credential window.
-    const shredPaths = opts.runtimes.flatMap((id) => {
+    const shredPaths = credentialRuntimes.flatMap((id) => {
         const paths = { claude: ['.claude.json', CLAUDE_TOKEN_REMOTE], codex: ['.codex/auth.json'], gemini: ['.gemini/google_accounts.json'], grok: ['.grok/auth.json'] }[id];
         return paths ?? [];
     });
+    if (opts.dispatchProfile)
+        shredPaths.push(profileRemotePath(opts.dispatchProfile.name));
     const shred = shredPaths.map((p) => `rm -f "$HOME/${p}" 2>/dev/null || true`).join('\n');
-    const installRuntimes = opts.runtimes.map((id) => `agents add ${q(id)} >/dev/null 2>&1 || true`).join('\n');
+    const installRuntimes = opts.runtimes
+        .map((id) => `agents add ${q(runtimeInstallSpec(id, opts.dispatchProfile))} >/dev/null 2>&1 || true`)
+        .join('\n');
+    // `echo`-ed phase sentinels (progress.ts) let the command layer drive a
+    // step-by-step UI. `createLeaseOutputRouter` swallows these lines and surfaces
+    // them as a structured step stream — they never appear as setup noise.
+    const step = (name) => `echo ${q(leasePhaseSentinel(name))}`;
+    const copySetup = opts.copySetup !== false; // default TRUE
     return [
         'set -uo pipefail',
+        // crabbox has finished its workspace resync by the time this script runs;
+        // the sync sentinel marks the transition out of that (crabbox-driven) phase.
+        step('sync'),
+        // Only meaningful on a tailnet lease — the box already joined during warmup.
+        opts.netMode === 'tailscale' ? step('joined-tailnet') : '',
+        step('install'),
         ENSURE_AGENTS_CLI,
+        step('runtime'),
         installRuntimes,
+        step('creds'),
         credScript,
+        profileScript,
+        // copy-setup: the host already rsync'd the git-tracked ~/.agents onto the box
+        // (leaseAndRun, before this script). Here — after ENSURE_AGENTS_CLI installed
+        // the CLI — we materialize that config into the runtime home. Gated by
+        // copySetup (cleared for --bare). Best-effort; a refresh failure never aborts.
+        copySetup ? [step('copy-setup'), 'agents repo refresh >/dev/null 2>&1 || true'].join('\n') : '',
         // Marker on its own line: the command layer shows everything before this as
         // setup progress and everything after (the agent's output) verbatim.
         `echo ${q(LEASE_AGENT_MARKER)}`,
@@ -82,15 +151,47 @@ export function buildBootstrapScript(opts) {
 }
 export async function leaseAndRun(opts) {
     const startedAt = Date.now();
-    opts.onPhase?.({ kind: 'warmup', backend: opts.backend });
-    const box = await crabboxWarmup({
-        class: opts.boxClass,
-        profile: opts.profile,
-        provider: opts.backend,
-        secretsBundle: opts.secretsBundle,
-    });
-    await crabboxWaitReady(box.slug, { secretsBundle: opts.secretsBundle });
+    let box;
+    if (opts.reuseBox) {
+        opts.onPhase?.({ kind: 'reuse', slug: opts.reuseBox });
+        const found = crabboxFind(opts.reuseBox, { secretsBundle: opts.secretsBundle });
+        if (!found)
+            throw new Error(`crabbox box "${opts.reuseBox}" was not found. Check \`crabbox list\` or pass a different --box slug.`);
+        box = found.ready
+            ? found
+            : await crabboxWaitReady(opts.reuseBox, { secretsBundle: opts.secretsBundle });
+    }
+    else {
+        opts.onPhase?.({ kind: 'warmup', backend: opts.backend });
+        box = await crabboxWarmup({
+            class: opts.boxClass,
+            profile: opts.profile,
+            provider: opts.backend,
+            secretsBundle: opts.secretsBundle,
+            netMode: opts.netMode,
+        });
+        await crabboxWaitReady(box.slug, { secretsBundle: opts.secretsBundle });
+    }
     opts.onPhase?.({ kind: 'ready', box, elapsedMs: Date.now() - startedAt });
+    // Setup-copy (F1, RUSH-1920): push the git-tracked ~/.agents config onto the
+    // box from the host, over crabbox's own per-lease ssh (a raw ssh fails
+    // publickey). rsync only here — the box has no agents-cli yet, so the matching
+    // `agents repo refresh` runs inside the bootstrap script, after the install
+    // step. Best-effort: a copy failure never aborts the run (the agent just runs
+    // without the config).
+    if (opts.copySetup !== false) {
+        try {
+            await copySetupToBox({
+                slug: box.slug,
+                secretsBundle: opts.secretsBundle,
+                onData: opts.onData,
+                refresh: false,
+            });
+        }
+        catch {
+            /* best-effort — never block the run on a config-copy failure */
+        }
+    }
     const script = buildBootstrapScript(opts);
     let exitCode = null;
     let toreDown = false;
@@ -102,8 +203,8 @@ export async function leaseAndRun(opts) {
     }
     finally {
         // Always attempt teardown (bounds credential lifetime to the run) unless the
-        // caller explicitly asked to keep the box.
-        if (!opts.keep) {
+        // caller explicitly asked to keep the box or targeted an existing warm box.
+        if (!opts.keep && !opts.reuseBox) {
             opts.onPhase?.({ kind: 'teardown' });
             toreDown = crabboxStop(box.slug, { secretsBundle: opts.secretsBundle });
         }

package/dist/lib/crabbox/progress.d.ts

@@ -9,6 +9,27 @@
  */
 /** Sentinel echoed on the box right before `agents run`. Distinctive + collision-proof. */
 export declare const LEASE_AGENT_MARKER = "___AGENTS_LEASE_AGENT_OUTPUT_b1f4c2___";
+/**
+ * A structured setup step, parsed from a `___PHASE_<name>___` sentinel line the
+ * bootstrap script echoes before each block (sync/install/runtime/creds/…). The
+ * command layer renders these to drive a step-by-step progress UI; the lib never
+ * prints (see `renderStepLine`).
+ */
+export type LeaseStep = {
+    name: string;
+    detail?: string;
+    elapsedMs?: number;
+};
+/**
+ * The sentinel line the bootstrap script echoes to announce phase `name`.
+ * Kept distinct from `LEASE_AGENT_MARKER` (which does NOT start with `___PHASE_`).
+ */
+export declare function leasePhaseSentinel(name: string): string;
+/**
+ * Render one lease step as a single human line the command layer can print
+ * (e.g. behind a spinner). Self-contained: the lib never writes to a stream.
+ */
+export declare function renderStepLine(step: LeaseStep): string;
 export interface Spinner {
     /** Begin animating a phase (renders `frame text` on one line, TTY only). */
     start(text: string): void;
@@ -49,14 +70,24 @@ export interface LeaseOutputRouter {
     sawAgent(): boolean;
     /** The setup lines seen so far (for a failure dump). */
     setupLines(): string[];
+    /** The structured steps parsed from phase sentinels so far. */
+    steps(): LeaseStep[];
 }
 /**
  * Split the crabbox run stream at `LEASE_AGENT_MARKER`. `onSetupLine` fires for
  * each complete non-empty line before the marker; `onAgentChunk` fires with raw
  * text after it (streamed promptly, not line-buffered, so agent output is live).
+ *
+ * Setup lines matching a `___PHASE_<name>___` sentinel are swallowed (never shown
+ * as setup noise) and surfaced through `onStep` instead — a structured step
+ * stream the command layer can render via `renderStepLine`. When `now` is
+ * provided, each step carries `elapsedMs` since the previous step (or router
+ * start for the first); omit `now` for deterministic, timing-free output.
  */
 export declare function createLeaseOutputRouter(cb: {
     onSetupLine: (line: string) => void;
     onAgentChunk: (chunk: string) => void;
+    onStep?: (step: LeaseStep) => void;
     marker?: string;
+    now?: () => number;
 }): LeaseOutputRouter;