@phnx-labs/agents-cli 1.20.72 → 1.20.74

package/dist/commands/lease.d.ts

@@ -8,6 +8,25 @@
  * so a box a concurrent run just reused is never stopped.
  */
 import type { Command } from 'commander';
+import { type CrabboxBox } from '../lib/crabbox/cli.js';
+/** Compact human duration: "45s", "12m", "2h", "1h 5m". Clamps negatives to 0. */
+export declare function fmtDurationShort(secs: number): string;
+/** Idle time since the box was last touched, e.g. "idle 5m" / "idle ?". */
+export declare function fmtIdleShort(box: CrabboxBox, nowSecs: number): string;
+/** Time until the lease expires, e.g. "expires 42m" / "expires ?" / "expired". */
+export declare function fmtExpiresShort(box: CrabboxBox, nowSecs: number): string;
+/** Reachable address for a leased box: tailnet FQDN/IP first, else public IP. */
+export declare function boxAddress(box: CrabboxBox): string | undefined;
+/** Human status: "ready" when usable, else the raw bootstrap state/status. */
+export declare function boxStatus(box: CrabboxBox): string;
+/**
+ * Warm boxes eligible for reuse: `ready` and the lease has not expired.
+ * Sorted most-recently-touched first so `--reuse` / the auto-pick lands on the
+ * freshest box (an untouched `lastTouchedAt` sorts last).
+ */
+export declare function reusableBoxes(boxes: CrabboxBox[], nowSecs: number): CrabboxBox[];
+/** One aligned row for the reuse picker / `agents lease list`. */
+export declare function formatBoxRow(box: CrabboxBox, nowSecs: number): string;
 /** Validate a Hetzner token against the live API. Exported for unit tests (fetch injectable). */
 export declare function validateHetznerToken(token: string, fetchImpl?: typeof fetch): Promise<'valid' | 'invalid' | 'unreachable'>;
 /**

package/dist/commands/lease.js

@@ -7,9 +7,9 @@
  * that have been untouched for a safety window are eligible (see `isReapSafe`),
  * so a box a concurrent run just reused is never stopped.
  */
-import { spawn } from 'child_process';
 import chalk from 'chalk';
-import { crabboxList, reapSafeOrphans, reapOrphans, setLeaseSecretsBundle } from '../lib/crabbox/cli.js';
+import { openUrl } from '../lib/open-url.js';
+import { crabboxList, crabboxStop, reapSafeOrphans, reapOrphans, setLeaseSecretsBundle } from '../lib/crabbox/cli.js';
 import { isInteractiveTerminal, isPromptCancelled } from './utils.js';
 import { bundleExists, readBundle, writeBundle, keychainRef, bundleItemStore } from '../lib/secrets/bundles.js';
 import { secretsKeychainItem } from '../lib/secrets/index.js';
@@ -19,21 +19,104 @@ function fmtIdle(box) {
     const iso = new Date(box.lastTouchedAt * 1000).toISOString().slice(0, 16).replace('T', ' ');
     return `idle since ${iso}Z`;
 }
+// ── Shared box helpers (consumed by exec.ts's reuse picker + ssh.ts's devices
+// section, so the reuse/format logic lives in exactly one place) ─────────────
+/** Compact human duration: "45s", "12m", "2h", "1h 5m". Clamps negatives to 0. */
+export function fmtDurationShort(secs) {
+    const s = Math.max(0, Math.round(secs));
+    if (s < 60)
+        return `${s}s`;
+    const m = Math.round(s / 60);
+    if (m < 60)
+        return `${m}m`;
+    const h = Math.floor(m / 60);
+    const rem = m % 60;
+    return rem ? `${h}h ${rem}m` : `${h}h`;
+}
+/** Idle time since the box was last touched, e.g. "idle 5m" / "idle ?". */
+export function fmtIdleShort(box, nowSecs) {
+    if (box.lastTouchedAt === null)
+        return 'idle ?';
+    return `idle ${fmtDurationShort(nowSecs - box.lastTouchedAt)}`;
+}
+/** Time until the lease expires, e.g. "expires 42m" / "expires ?" / "expired". */
+export function fmtExpiresShort(box, nowSecs) {
+    if (box.expiresAt === null)
+        return 'expires ?';
+    const left = box.expiresAt - nowSecs;
+    return left <= 0 ? 'expired' : `expires ${fmtDurationShort(left)}`;
+}
+/** Reachable address for a leased box: tailnet FQDN/IP first, else public IP. */
+export function boxAddress(box) {
+    return box.tailscaleFQDN || box.tailscaleIPv4 || box.ip || undefined;
+}
+/** Human status: "ready" when usable, else the raw bootstrap state/status. */
+export function boxStatus(box) {
+    return box.ready ? 'ready' : box.state || box.status || 'pending';
+}
+/**
+ * Warm boxes eligible for reuse: `ready` and the lease has not expired.
+ * Sorted most-recently-touched first so `--reuse` / the auto-pick lands on the
+ * freshest box (an untouched `lastTouchedAt` sorts last).
+ */
+export function reusableBoxes(boxes, nowSecs) {
+    return boxes
+        .filter((b) => b.ready && (b.expiresAt === null || b.expiresAt > nowSecs))
+        .sort((a, b) => (b.lastTouchedAt ?? 0) - (a.lastTouchedAt ?? 0));
+}
+/** One aligned row for the reuse picker / `agents lease list`. */
+export function formatBoxRow(box, nowSecs) {
+    const slug = box.slug.padEnd(16);
+    const cls = (box.class ?? '?').padEnd(10);
+    const addr = (boxAddress(box) ?? '—').padEnd(24);
+    const status = boxStatus(box).padEnd(8);
+    const idle = fmtIdleShort(box, nowSecs).padEnd(12);
+    return `${slug} ${cls} ${addr} ${status} ${idle} ${fmtExpiresShort(box, nowSecs)}`;
+}
 const HETZNER_BUNDLE = 'hetzner.com';
 const HCLOUD_KEY = 'HCLOUD_TOKEN';
 const HETZNER_CONSOLE_URL = 'https://console.hetzner.cloud/';
-/** Best-effort: open a URL in the user's default browser. Never throws. */
-function openUrl(url) {
-    const cmd = process.platform === 'darwin' ? 'open' : process.platform === 'win32' ? 'cmd' : 'xdg-open';
-    const args = process.platform === 'win32' ? ['/c', 'start', '', url] : [url];
+const TAILSCALE_BUNDLE = 'tailscale.com';
+const TAILSCALE_KEY = 'CRABBOX_TAILSCALE_AUTH_KEY';
+const TAILSCALE_KEYS_URL = 'https://login.tailscale.com/admin/settings/keys';
+/**
+ * Optional Tailscale setup for private-network leases (`--tailscale`). Collects
+ * an EPHEMERAL, pre-authorized, `tag:crabbox` auth key and stores it in the
+ * `tailscale.com` keychain bundle under `CRABBOX_TAILSCALE_AUTH_KEY` (the exact
+ * key `crabboxEnv` auto-injects). Blank input skips — public-IP leases still
+ * work with no Tailscale key. Never throws for cancel; mirrors the Hetzner
+ * capture above but does no live validation (Tailscale has no cheap probe).
+ */
+async function captureTailscaleAuthKey() {
+    console.error(chalk.bold('\nOptional: private-network leases over Tailscale'));
+    console.error(chalk.dim('Mint an EPHEMERAL, pre-authorized auth key tagged `tag:crabbox` in the Tailscale admin,'));
+    console.error(chalk.dim('then paste it to reach leased boxes only over your tailnet (`--tailscale`). Leave blank to skip.\n'));
+    const { password } = await import('@inquirer/prompts');
+    let key;
     try {
-        const p = spawn(cmd, args, { stdio: 'ignore', detached: true });
-        p.on('error', () => { });
-        p.unref();
+        openUrl(TAILSCALE_KEYS_URL);
+        key = (await password({ message: 'Paste a Tailscale auth key (blank to skip):', mask: true })).trim();
     }
-    catch {
-        /* best-effort */
+    catch (e) {
+        if (isPromptCancelled(e)) {
+            console.error(chalk.yellow('Skipped Tailscale setup.'));
+            return;
+        }
+        throw e;
+    }
+    if (!key) {
+        console.error(chalk.dim('Skipped Tailscale setup — public-IP leases only.'));
+        return;
     }
+    const bundle = bundleExists(TAILSCALE_BUNDLE)
+        ? readBundle(TAILSCALE_BUNDLE)
+        : { name: TAILSCALE_BUNDLE, description: 'Tailscale ephemeral auth key for crabbox tailnet leases', vars: {} };
+    const store = bundleItemStore(bundle.backend);
+    store.set(secretsKeychainItem(TAILSCALE_BUNDLE, TAILSCALE_KEY), key);
+    bundle.vars[TAILSCALE_KEY] = keychainRef(TAILSCALE_KEY);
+    writeBundle(bundle);
+    console.error(chalk.green(`✔ Stored Tailscale auth key in keychain bundle '${TAILSCALE_BUNDLE}'.`));
+    console.error(chalk.dim('  Add --tailscale to a lease (reuse defaults to it) to reach the box over your tailnet.'));
 }
 /** Validate a Hetzner token against the live API. Exported for unit tests (fetch injectable). */
 export async function validateHetznerToken(token, fetchImpl = fetch) {
@@ -103,6 +186,8 @@ export async function runLeaseSetup(opts = {}) {
             setLeaseSecretsBundle(HETZNER_BUNDLE);
             console.error(chalk.green(`\n✔ Stored in keychain bundle '${HETZNER_BUNDLE}' and set as the default lease provider.`));
             console.error(chalk.dim('  Run `agents run <agent> "…" --lease` — no env var, no flag needed.'));
+            // Also offer to capture a Tailscale auth key for private-network leases.
+            await captureTailscaleAuthKey();
             return true;
         }
         console.error(chalk.yellow('lease setup: no valid token after 3 attempts — aborted.'));
@@ -128,6 +213,48 @@ export function registerLeaseCommand(program) {
         const ok = await runLeaseSetup({ provider: opts.provider });
         process.exit(ok ? 0 : 1);
     });
+    lease
+        .command('list')
+        .alias('ls')
+        .description('List warm crabbox boxes you can reuse with `agents run --box <slug>`.')
+        .option('--json', 'Output JSON', false)
+        .action((opts) => {
+        const boxOpts = { secretsBundle: process.env.AGENTS_LEASE_SECRETS_BUNDLE };
+        let boxes;
+        try {
+            boxes = crabboxList(boxOpts);
+        }
+        catch (e) {
+            console.error(chalk.red(`lease list: ${e.message}`));
+            process.exit(1);
+            return;
+        }
+        if (opts.json) {
+            console.log(JSON.stringify(boxes, null, 2));
+            return;
+        }
+        if (boxes.length === 0) {
+            console.error(chalk.gray('No crabbox boxes. `agents run <agent> "…" --lease` provisions one.'));
+            return;
+        }
+        const nowSecs = Math.floor(Date.now() / 1000);
+        console.log(chalk.bold(`Warm boxes (${boxes.length})`));
+        for (const b of boxes)
+            console.log('  ' + formatBoxRow(b, nowSecs));
+        console.log(chalk.gray('  Reuse: agents run <agent> "…" --box <slug>   ·   Stop: agents lease stop <slug>'));
+    });
+    lease
+        .command('stop <slug>')
+        .description('Stop (release) a leased crabbox box now.')
+        .action((slug) => {
+        const boxOpts = { secretsBundle: process.env.AGENTS_LEASE_SECRETS_BUNDLE };
+        const ok = crabboxStop(slug, boxOpts);
+        if (ok)
+            console.error(chalk.green(`Stopped box ${slug}.`));
+        else
+            console.error(chalk.red(`Could not stop box ${slug} (already gone, or crabbox is unavailable).`));
+        process.exit(ok ? 0 : 1);
+    });
     lease
         .command('gc')
         .description('Stop expired, idle lease boxes that are holding your provider quota. Safe: never stops a box in active use.')

package/dist/commands/login.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from 'commander';
+export declare function registerLoginCommands(program: Command): void;

package/dist/commands/login.js

@@ -0,0 +1,123 @@
+import chalk from 'chalk';
+import * as fs from 'fs';
+import { readStdinSync } from '../lib/format.js';
+import { clearVaultKey, createVault, getVaultSession, joinVault, unlock, vaultExists, vaultPath, } from '../lib/secrets/vault.js';
+import { isInteractiveTerminal, isPromptCancelled } from './utils.js';
+async function promptPassword(message) {
+    if (!isInteractiveTerminal()) {
+        throw new Error('A password is required. Run from a TTY or pass --password-stdin.');
+    }
+    const { password } = await import('@inquirer/prompts');
+    return password({ message, mask: true });
+}
+async function readPassword(opts, message) {
+    if (opts.passwordStdin) {
+        const value = readStdinSync();
+        if (!value)
+            throw new Error('No password received on stdin.');
+        return value.replace(/\r?\n$/, '');
+    }
+    return promptPassword(message);
+}
+async function chooseFreshLoginMode(opts) {
+    if (opts.create && opts.join)
+        throw new Error('--create and --join are mutually exclusive.');
+    if (opts.create)
+        return 'create';
+    if (opts.join)
+        return 'join';
+    if (!isInteractiveTerminal()) {
+        throw new Error('No synced secrets file exists. Pass --create or --join <vault.age> in a non-interactive shell.');
+    }
+    const { select } = await import('@inquirer/prompts');
+    return select({
+        message: 'No synced secrets login found. What do you want to do?',
+        choices: [
+            { name: 'Create a new login', value: 'create' },
+            { name: 'Join with an existing synced secrets file', value: 'join' },
+        ],
+    });
+}
+function formatRemaining(expiresAt) {
+    const ms = expiresAt - Date.now();
+    if (ms <= 0)
+        return 'expired';
+    const mins = Math.round(ms / 60000);
+    if (mins < 60)
+        return `${mins} minute${mins === 1 ? '' : 's'}`;
+    const hours = Math.round(mins / 60);
+    if (hours < 24)
+        return `${hours} hour${hours === 1 ? '' : 's'}`;
+    const days = Math.round(hours / 24);
+    return `${days} day${days === 1 ? '' : 's'}`;
+}
+export function registerLoginCommands(program) {
+    program
+        .command('login')
+        .description('Unlock synced secrets for this shell session')
+        .option('--create', 'Create a new encrypted synced-secrets file at ~/.agents/vault.age')
+        .option('--join <path>', 'Copy and unlock an existing vault.age file')
+        .option('--force', 'Replace an existing synced-secrets file when used with --create or --join')
+        .option('--password-stdin', 'Read the master password from stdin')
+        .action(async (opts) => {
+        try {
+            if (opts.force && !opts.create && !opts.join) {
+                throw new Error('--force can only be used with --create or --join.');
+            }
+            if (vaultExists() && !opts.create && !opts.join) {
+                const password = await readPassword(opts, 'Master password');
+                unlock(password);
+                const session = getVaultSession();
+                const ttl = session.loggedIn ? formatRemaining(session.expiresAt) : '8 hours';
+                console.log(chalk.green(`Logged in. Synced secrets unlocked for ${ttl}.`));
+                return;
+            }
+            const mode = await chooseFreshLoginMode(opts);
+            if (mode === 'join') {
+                let source = opts.join;
+                if (!source) {
+                    if (!isInteractiveTerminal())
+                        throw new Error('--join needs a vault.age path.');
+                    const { input } = await import('@inquirer/prompts');
+                    source = await input({
+                        message: 'Path to existing vault.age',
+                        validate: (value) => fs.existsSync(value) || 'File not found.',
+                    });
+                }
+                const password = await readPassword(opts, 'Master password');
+                joinVault(password, source, { overwrite: opts.force });
+                console.log(chalk.green(`Logged in. Copied synced secrets file to ${vaultPath()}.`));
+                return;
+            }
+            const password = await readPassword(opts, 'Choose a master password');
+            createVault(password, { overwrite: opts.force });
+            console.log(chalk.green(`Logged in. Created synced secrets file at ${vaultPath()}.`));
+        }
+        catch (err) {
+            if (isPromptCancelled(err))
+                return;
+            console.error(chalk.red(err.message));
+            process.exit(1);
+        }
+    });
+    program
+        .command('logout')
+        .description('Forget the cached synced-secrets key')
+        .action(() => {
+        clearVaultKey();
+        console.log(chalk.green('Logged out. Synced secrets are locked.'));
+    });
+    program
+        .command('whoami')
+        .description('Show synced-secrets login status')
+        .action(() => {
+        const session = getVaultSession();
+        if (!session.loggedIn) {
+            console.log(chalk.yellow('Not logged in.'));
+            console.log(chalk.gray(`File: ${vaultPath()}${vaultExists() ? '' : ' (not created)'}`));
+            return;
+        }
+        console.log(chalk.green(`Logged in (${formatRemaining(session.expiresAt)} remaining).`));
+        console.log(chalk.gray(`File: ${vaultPath()}`));
+    });
+}

package/dist/commands/logs.js

@@ -62,7 +62,7 @@ async function showSession(session, follow, full, json = false) {
             console.error(chalk.red(`Tailing is supported for claude and codex sessions only (got ${session.agent}).`));
             process.exit(2);
         }
-        await streamSessionTail(session, {});
+        await streamSessionTail(session, { raw: full });
         return;
     }
     await renderSessionLog(session, full ? 'markdown' : 'summary');

package/dist/commands/mine.d.ts

@@ -0,0 +1,27 @@
+/**
+ * `agents mine` — white-label the CLI under your own name.
+ *
+ * `agents mine init <name>` mints a personally-named binary (e.g. `jack`) that
+ * IS agents-cli: a pure pass-through shim on PATH that runs every `agents` verb
+ * under the brand's name, with the brand's disabled commands and curated
+ * resource profile applied. `list` / `toggle` / `remove` manage brands.
+ *
+ * The discoverable entry point is the `agents setup mine` wizard
+ * (see setup-mine.ts), which delegates to `initBrand` here.
+ *
+ * Storage: brand config in `meta.brands` (agents.yaml); the curated resource set
+ * reuses the resource-profile engine — each brand owns a preset named
+ * `mine-<name>` in `meta.profiles.presets`. See lib/brand.ts.
+ */
+import type { Command } from 'commander';
+/**
+ * Create (or re-mint) a brand. Shared by `mine init` and the `setup mine`
+ * wizard. Writes the shim, the brand config, and an empty resource preset.
+ */
+export declare function initBrand(name: string, opts?: {
+    disabledCommands?: string[];
+    force?: boolean;
+}): {
+    pathWarning: boolean;
+};
+export declare function registerMineCommand(program: Command): void;

package/dist/commands/mine.js

@@ -0,0 +1,207 @@
+import chalk from 'chalk';
+import { validateBrandName, listBrands, getBrandConfig, upsertBrand, removeBrand, brandPresetName, } from '../lib/brand.js';
+import { createBrandShim, removeBrandShim, isShimsInPath } from '../lib/shims.js';
+import { updateMeta } from '../lib/state.js';
+import { COMMAND_LOADERS } from '../lib/startup/command-registry.js';
+/** Built-in top-level command names, for validating `--disable <cmd>`. */
+function knownCommandNames() {
+    const names = new Set(Object.keys(COMMAND_LOADERS));
+    // Inline aliases registered outside COMMAND_LOADERS (see src/index.ts).
+    for (const n of ['perms', 'exec', 'jobs', 'cron', 'upgrade'])
+        names.add(n);
+    return names;
+}
+/**
+ * Add/remove a `!name` exclusion on a preset's pattern list for one kind,
+ * keeping `*` so everything not explicitly disabled stays enabled. Deletes the
+ * key entirely once nothing but `*` remains, so a clean brand has an empty preset.
+ */
+function applyResourceToggle(preset, kind, name, enable) {
+    // Cast to a plain string-bag: writing through the union-keyed `preset[kind]`
+    // collapses to `never` under strict TS, so index the bag instead.
+    const bag = preset;
+    const arr = [...(bag[kind] ?? [])];
+    if (arr.length === 0)
+        arr.push('*');
+    const excl = `!${name}`;
+    const idx = arr.indexOf(excl);
+    if (enable) {
+        if (idx !== -1)
+            arr.splice(idx, 1);
+    }
+    else if (idx === -1) {
+        arr.push(excl);
+    }
+    const onlyStar = arr.length === 1 && arr[0] === '*';
+    if (onlyStar)
+        delete bag[kind];
+    else
+        bag[kind] = arr;
+}
+/** Ensure the brand's preset exists in meta.profiles.presets and return a mutable copy path. */
+function ensurePresetExists(name) {
+    const presetName = brandPresetName(name);
+    updateMeta((meta) => {
+        const profiles = meta.profiles ?? {};
+        const presets = { ...(profiles.presets ?? {}) };
+        if (!presets[presetName]) {
+            presets[presetName] = { description: `Resource set for the "${name}" brand` };
+        }
+        return { ...meta, profiles: { ...profiles, presets } };
+    });
+}
+/** Mutate the brand's resource preset under lock. */
+function editPreset(name, fn) {
+    const presetName = brandPresetName(name);
+    updateMeta((meta) => {
+        const profiles = meta.profiles ?? {};
+        const presets = { ...(profiles.presets ?? {}) };
+        const preset = { ...(presets[presetName] ?? {}) };
+        fn(preset);
+        presets[presetName] = preset;
+        return { ...meta, profiles: { ...profiles, presets } };
+    });
+}
+/**
+ * Create (or re-mint) a brand. Shared by `mine init` and the `setup mine`
+ * wizard. Writes the shim, the brand config, and an empty resource preset.
+ */
+export function initBrand(name, opts = {}) {
+    const err = validateBrandName(name);
+    if (err) {
+        console.error(chalk.red(err));
+        process.exit(1);
+    }
+    if (getBrandConfig(name) && !opts.force) {
+        console.error(chalk.red(`Brand "${name}" already exists. Use --force to re-mint, or 'agents mine toggle ${name}'.`));
+        process.exit(1);
+    }
+    ensurePresetExists(name);
+    const disabled = (opts.disabledCommands ?? []).filter((c) => c.length > 0);
+    const known = knownCommandNames();
+    for (const c of disabled) {
+        if (!known.has(c))
+            console.error(chalk.yellow(`  note: "${c}" is not a known command — kept anyway.`));
+    }
+    const cfg = {
+        name,
+        enabled: true,
+        profile: brandPresetName(name),
+        ...(disabled.length > 0 ? { disabledCommands: disabled } : {}),
+    };
+    upsertBrand(cfg);
+    createBrandShim(name);
+    const pathWarning = !isShimsInPath();
+    return { pathWarning };
+}
+function printMinted(name, pathWarning) {
+    console.log(`${chalk.green('Minted')} ${chalk.bold(name)} — your own agents CLI.`);
+    console.log(chalk.dim(`  try:  ${name} --help    ${name} run claude "hello"`));
+    if (pathWarning) {
+        console.log(chalk.yellow(`  note: the shims dir isn't on your PATH yet — run 'agents setup' or open a new shell.`));
+    }
+}
+export function registerMineCommand(program) {
+    const cmd = program
+        .command('mine')
+        .description('White-label the CLI: your own personally-named binary (e.g. `jack`)');
+    cmd
+        .command('init <name>')
+        .description('Mint your own branded CLI that runs every agents verb under <name>')
+        .option('--disable <commands...>', 'Built-in commands to hide from this brand (e.g. teams cloud)')
+        .option('--force', 'Re-mint even if the brand already exists')
+        .action((name, options) => {
+        const { pathWarning } = initBrand(name, {
+            disabledCommands: options.disable,
+            force: options.force,
+        });
+        printMinted(name, pathWarning);
+    });
+    cmd
+        .command('list')
+        .alias('ls')
+        .description('Show your brands and what each has turned off')
+        .action(() => {
+        const brands = listBrands();
+        const entries = Object.entries(brands);
+        if (entries.length === 0) {
+            console.log(chalk.gray("No brands yet. Try: agents setup mine   (or: agents mine init jack)"));
+            return;
+        }
+        const width = entries.reduce((m, [n]) => Math.max(m, n.length), 0);
+        for (const [name, cfg] of entries) {
+            const off = cfg.disabledCommands?.length ? `disabled: ${cfg.disabledCommands.join(', ')}` : 'all commands on';
+            const state = cfg.enabled === false ? chalk.yellow('(disabled) ') : '';
+            console.log(`  ${chalk.bold(name.padEnd(width))}  ${state}${chalk.dim(off)}`);
+        }
+    });
+    cmd
+        .command('toggle <name>')
+        .description('Enable/disable features for a brand')
+        .option('--disable <commands...>', 'Hide these built-in commands')
+        .option('--enable <commands...>', 'Un-hide these built-in commands')
+        .option('--disable-plugin <names...>', 'Disable these plugins for the brand')
+        .option('--enable-plugin <names...>', 'Re-enable these plugins')
+        .option('--disable-skill <names...>', 'Disable these skills for the brand')
+        .option('--enable-skill <names...>', 'Re-enable these skills')
+        .action((name, options) => {
+        const cfg = getBrandConfig(name);
+        if (!cfg) {
+            console.error(chalk.red(`No brand named "${name}". Create it with 'agents mine init ${name}'.`));
+            process.exit(1);
+        }
+        // Built-in command toggles → brand.disabledCommands.
+        const disabledSet = new Set(cfg.disabledCommands ?? []);
+        const known = knownCommandNames();
+        for (const c of options.disable ?? []) {
+            if (!known.has(c))
+                console.error(chalk.yellow(`  note: "${c}" is not a known command — kept anyway.`));
+            disabledSet.add(c);
+        }
+        for (const c of options.enable ?? [])
+            disabledSet.delete(c);
+        const nextDisabled = [...disabledSet];
+        const nextCfg = { ...cfg };
+        if (nextDisabled.length > 0)
+            nextCfg.disabledCommands = nextDisabled;
+        else
+            delete nextCfg.disabledCommands;
+        upsertBrand(nextCfg);
+        // Resource toggles → the brand's profile preset.
+        const resourceOps = [];
+        for (const p of options.disablePlugin ?? [])
+            resourceOps.push(['plugins', p, false]);
+        for (const p of options.enablePlugin ?? [])
+            resourceOps.push(['plugins', p, true]);
+        for (const s of options.disableSkill ?? [])
+            resourceOps.push(['skills', s, false]);
+        for (const s of options.enableSkill ?? [])
+            resourceOps.push(['skills', s, true]);
+        if (resourceOps.length > 0) {
+            ensurePresetExists(name);
+            editPreset(name, (preset) => {
+                for (const [kind, n, enable] of resourceOps)
+                    applyResourceToggle(preset, kind, n, enable);
+            });
+        }
+        console.log(`${chalk.green('Updated')} ${chalk.bold(name)}.`);
+        const finalCfg = getBrandConfig(name);
+        const off = finalCfg.disabledCommands?.length ? finalCfg.disabledCommands.join(', ') : '(none)';
+        console.log(chalk.dim(`  disabled commands: ${off}`));
+    });
+    cmd
+        .command('remove <name>')
+        .alias('rm')
+        .description('Remove a brand (its shim + config)')
+        .option('--purge', "Also delete the brand's resource profile preset")
+        .action((name, options) => {
+        const existed = getBrandConfig(name) !== undefined;
+        const shimRemoved = removeBrandShim(name);
+        if (!existed && !shimRemoved) {
+            console.error(chalk.red(`No brand named "${name}".`));
+            process.exit(1);
+        }
+        removeBrand(name, options.purge === true);
+        console.log(`${chalk.yellow('Removed')} brand ${chalk.bold(name)}`);
+    });
+}