@phnx-labs/agents-cli 1.20.77 → 1.20.82

package/dist/commands/repo.js

@@ -36,11 +36,13 @@ import { refresh } from '../lib/refresh.js';
 import { capableAgents } from '../lib/capabilities.js';
 import { getGlobalDefault, getVersionHomePath, listInstalledVersions } from '../lib/versions.js';
 import { syncAllMarketplaces } from '../lib/plugin-marketplace.js';
+import { gatherRemoteAgentsJson } from '../lib/remote-agents-json.js';
+import { machineId, normalizeHost } from '../lib/machine-id.js';
 /**
  * After a repo add/remove/enable/disable, reconcile each plugins-capable
  * agent's default version against the new marketplace set. Re-synthesizes
  * catalogs and known_marketplaces.json entries. Source-copy of plugins is
- * out of scope here — full sync still goes through `agents repo refresh`.
+ * out of scope here — full sync still goes through `agents sync`.
  */
 function syncMarketplacesForDefaults() {
     for (const agent of capableAgents('plugins')) {
@@ -432,13 +434,161 @@ function renderCards(rows, cols) {
         }
     }
 }
+/**
+ * Recursion guard for the fleet fan-out, passed as an env var (not a CLI flag)
+ * so an OLDER remote `agents` that predates this feature ignores it harmlessly
+ * instead of erroring on an unknown option. A peer new enough to fan out reads
+ * it and answers only for itself. Mirrors `NO_FANOUT_ENV` in remote-active.ts.
+ */
+export const NO_REPO_FANOUT_ENV = 'AGENTS_REPO_LOCAL';
+/**
+ * Parse one peer's `repo status --json` stdout (a RepoRow[]) into a single
+ * device entry tagged with `machine`. Defensive against version skew: non-JSON
+ * or a non-array yields no entry, and non-object rows are dropped rather than
+ * throwing. Exported for unit testing without a live tailnet.
+ */
+export function parseRemoteRepoRows(stdout, machine) {
+    let parsed;
+    try {
+        parsed = JSON.parse(stdout);
+    }
+    catch {
+        return [];
+    }
+    if (!Array.isArray(parsed))
+        return [];
+    const rows = parsed.filter((x) => !!x && typeof x === 'object' && !Array.isArray(x));
+    return [{ device: machine, reachable: true, rows }];
+}
+/**
+ * Query repo status on the fleet. With an explicit `hosts` list, fan out to
+ * exactly those; otherwise sweep every registered, online peer (excluding this
+ * machine). Each peer runs `repo status [alias] --json` locally — never its own
+ * fan-out — and unreachable peers are skipped with a gray note, never fatal.
+ */
+async function gatherRemoteRepoStatus(alias, hosts) {
+    const args = ['repo', 'status', ...(alias ? [alias] : []), '--json'];
+    const { items } = await gatherRemoteAgentsJson({
+        args,
+        noFanoutEnv: NO_REPO_FANOUT_ENV,
+        hosts,
+        parse: parseRemoteRepoRows,
+    });
+    return items;
+}
+/**
+ * Render the fleet repo-status table: one row per (device, repo), with the
+ * device name shown once per group. SYNC and CHANGES reuse the same compact
+ * cells as the local wide table (`↓N (…)  ↑N` / `clean` / `~N edits`), and an
+ * unreachable device collapses to a single `unreachable` marker row. Pure — no
+ * I/O — so the aggregation/formatting is unit-testable without live devices.
+ */
+export function renderDeviceStatusRows(results) {
+    const cells = [];
+    for (const r of results) {
+        if (!r.reachable || !r.rows) {
+            cells.push({ device: r.device, repo: chalk.gray('unreachable'), sync: '', changes: '' });
+            continue;
+        }
+        if (r.rows.length === 0) {
+            cells.push({ device: r.device, repo: chalk.gray('no repos'), sync: '', changes: '' });
+            continue;
+        }
+        let firstOfDevice = true;
+        for (const row of r.rows) {
+            const device = firstOfDevice ? r.device : '';
+            firstOfDevice = false;
+            if (row.raw) {
+                // missing / no-git-remote / error — the free-form trailer says it all.
+                cells.push({ device, repo: row.alias, sync: row.raw, changes: '' });
+            }
+            else {
+                cells.push({ device, repo: row.alias, sync: syncCompact(row), changes: changesCompact(row) });
+            }
+        }
+    }
+    if (cells.length === 0)
+        return [];
+    const headers = ['DEVICE', 'REPO', 'SYNC', 'CHANGES'];
+    const devW = Math.max(headers[0].length, ...cells.map((c) => visibleWidth(c.device)));
+    const repoW = Math.max(headers[1].length, ...cells.map((c) => visibleWidth(c.repo)));
+    const syncW = Math.max(headers[2].length, ...cells.map((c) => visibleWidth(c.sync)));
+    const lines = [];
+    lines.push(`  ${chalk.gray(headers[0].padEnd(devW))}  ${chalk.gray(headers[1].padEnd(repoW))}  ${chalk.gray(headers[2].padEnd(syncW))}  ${chalk.gray(headers[3])}`);
+    for (const c of cells) {
+        lines.push(`  ${chalk.cyan(padVisible(c.device, devW))}  ${padVisible(c.repo, repoW)}  ${padVisible(c.sync, syncW)}  ${c.changes}`);
+    }
+    return lines;
+}
+/**
+ * Read the device-scope flags into an intent, or null for the default local-only
+ * run. `--devices-all`/`--hosts-all` (and `--devices all`/`--hosts all`) sweep
+ * every reachable peer; `--devices box1,box2` targets an explicit list. A peer
+ * carrying {@link NO_REPO_FANOUT_ENV} never fans out again (recursion guard).
+ */
+export function resolveDeviceIntent(opts) {
+    if (process.env[NO_REPO_FANOUT_ENV] === '1')
+        return null;
+    if (opts.devicesAll || opts.hostsAll)
+        return { all: true };
+    const val = opts.devices ?? opts.hosts;
+    if (val === undefined)
+        return null;
+    const v = val.trim();
+    if (v === '' || v.toLowerCase() === 'all')
+        return { all: true };
+    const hosts = v.split(',').map((s) => s.trim()).filter(Boolean);
+    return hosts.length ? { hosts } : { all: true };
+}
+/**
+ * `repo status`/`list` across the fleet: read THIS machine's rows locally, fan
+ * out to peers, and render one aggregated table (device · repo · sync · changes).
+ * The local box is always shown first; unreachable peers were already noted by
+ * the fan-out and are simply absent from the table.
+ */
+async function listReposAcrossDevices(alias, opts, intent) {
+    const localTargets = collectRepoTargets(alias);
+    if (!localTargets) {
+        process.exitCode = 1;
+        return;
+    }
+    const localRows = await Promise.all(localTargets.map(renderRepoRow));
+    const self = machineId();
+    const hosts = 'hosts' in intent ? intent.hosts : undefined;
+    const remote = (await gatherRemoteRepoStatus(alias, hosts))
+        // An explicit host list may name this box; the local rows already cover it.
+        .filter((r) => normalizeHost(r.device) !== self);
+    const combined = [
+        { device: self, reachable: true, rows: localRows },
+        ...remote,
+    ];
+    if (opts.json) {
+        const clean = combined.map((r) => ({
+            device: r.device,
+            reachable: r.reachable,
+            rows: (r.rows ?? []).map((row) => row.raw !== undefined ? { ...row, raw: stripAnsi(row.raw) } : row),
+        }));
+        console.log(JSON.stringify(clean, null, 2));
+        return;
+    }
+    console.log('');
+    for (const line of renderDeviceStatusRows(combined))
+        console.log(line);
+    console.log('');
+}
 /**
  * Shared action body for `agents repo list` and the hidden `agents repo status`
  * alias. Responsive: a wide terminal gets an aligned table with compact SYNC /
  * CHANGES cells; a narrow one gets one card per repo with wrapping detail;
- * `--verbose` forces the full-detail table at any width.
+ * `--verbose` forces the full-detail table at any width. A device-scope flag
+ * (`--devices-all` / `--devices <list>`) instead fans out across the fleet.
  */
 async function listRepos(alias, opts = {}) {
+    const intent = resolveDeviceIntent(opts);
+    if (intent) {
+        await listReposAcrossDevices(alias, opts, intent);
+        return;
+    }
     const targets = collectRepoTargets(alias);
     if (!targets) {
         process.exitCode = 1;
@@ -487,6 +637,20 @@ function formatRepoTarget(alias, dir, branch) {
     const ref = branch ? `origin/${branch}` : 'origin';
     return `${alias} (${displayHomePath(dir)} → ${ref})`;
 }
+/**
+ * Register the fleet device-scope flags shared by `repo list` / `repo status`.
+ * `--devices-all` (alias `--hosts-all`) sweeps every reachable device;
+ * `--devices <who>` (alias `--hosts`) takes `all` or a comma-separated list.
+ * A single `--host`/`--device` is handled upstream by maybeRunOnHost, which
+ * streams that one box's `agents repo status` — these are the aggregating forms.
+ */
+function addDeviceStatusOptions(cmd) {
+    return cmd
+        .option('--devices-all', 'Report repo sync state across ALL reachable fleet devices (alias: --hosts-all).')
+        .option('--hosts-all', 'Alias of --devices-all.')
+        .option('--devices <who>', 'Fleet devices to report on: "all", or a comma-separated device list (alias: --hosts).')
+        .option('--hosts <who>', 'Alias of --devices.');
+}
 /** Register the `agents repos` command tree (`repo` is a convenience alias). */
 export function registerRepoCommands(program) {
     // addHostOption on the group so --help documents --host/--device; remote
@@ -512,6 +676,9 @@ export function registerRepoCommands(program) {
       # See what's registered
       agents repos list
 
+      # Report repo sync state across the whole fleet (one box: --device <name>)
+      agents repos status --devices-all
+
       # View one repo's contents (git state + resource counts); omit the name for a picker
       agents repos view system
 
@@ -714,13 +881,13 @@ export function registerRepoCommands(program) {
         console.log(chalk.gray(`\nRegistered as "${alias}". Skills and commands from this repo will be`));
         console.log(chalk.gray(`picked up automatically the next time you launch any agent.`));
     });
-    repoCmd
+    const listCmd = repoCmd
         .command('list [alias]')
         .alias('ls')
         .description('Show all repos with resource-level sync (skills/commands/plugins to pull or push) and local changes.')
         .option('-v, --verbose', 'Full per-resource detail in a table, regardless of terminal width')
-        .option('--json', 'machine-readable JSON output')
-        .action(async (alias, options) => {
+        .option('--json', 'machine-readable JSON output');
+    addDeviceStatusOptions(listCmd).action(async (alias, options) => {
         await listRepos(alias, options);
     });
     repoCmd
@@ -856,6 +1023,10 @@ export function registerRepoCommands(program) {
             }
             else {
                 spinner.fail(`${formatRepoTarget(t.alias, t.dir)}: ${result.error}`);
+                // A failed repo must fail the command. Without this, `agents fleet run
+                // "agents repo pull user"` reported 11 ok across a fleet that pulled
+                // nothing — the silence that hid RUSH-2056. Matches commands/sync.ts.
+                process.exitCode = 1;
             }
         }
         // RUSH-1980: a pull rewrites the routine YAML on disk, but the daemon's
@@ -911,15 +1082,28 @@ export function registerRepoCommands(program) {
             }
             else {
                 spinner.fail(`${formatRepoTarget(t.alias, t.dir)}: ${result.error}`);
+                // A failed repo must fail the command. Without this, `agents fleet run
+                // "agents repo push user"` reported ok across a fleet that pushed
+                // nothing — the silence that hid RUSH-2056. Matches commands/sync.ts.
+                process.exitCode = 1;
             }
         }
     });
+    // Deprecated: superseded by `agents sync`. `agents sync --local` runs the same
+    // reconcile stage (sync-umbrella.ts calls this exact `refresh()`), and `agents
+    // sync <agent>` targets one agent — with the added reach `refresh` lacks
+    // (all installed versions, no silent skip when there is no global default).
+    // Hidden from help; kept as a warned, functional alias so old muscle-memory and
+    // scripts don't break. Migrate callers to `agents sync`.
     repoCmd
-        .command('refresh [agent]')
-        .description('Re-materialize resources into installed agent version homes. No git, no network.')
+        .command('refresh [agent]', { hidden: true })
+        .description('Deprecated — use `agents sync` instead.')
         .option('-y, --yes', 'Auto-sync everything without prompting')
         .option('--skip-clis', 'Skip CLI version install/upgrade from agents.yaml')
         .action(async (arg, options) => {
+        console.warn(chalk.yellow('`agents repo refresh` is deprecated — use `agents sync` instead:'));
+        console.warn(chalk.gray('  all agents:  agents sync --local'));
+        console.warn(chalk.gray('  one agent:   agents sync <agent>'));
         let agentFilter;
         if (arg) {
             if (!isAgentName(arg)) {
@@ -947,12 +1131,12 @@ export function registerRepoCommands(program) {
             process.exit(1);
         }
     });
-    repoCmd
+    const statusCmd = repoCmd
         .command('status [alias]', { hidden: true })
-        .description('Alias of `list` (kept for muscle memory).')
+        .description('Alias of `list` (kept for muscle memory). Add --devices-all to report across the fleet.')
         .option('-v, --verbose', 'Full per-resource detail in a table, regardless of terminal width')
-        .option('--json', 'machine-readable JSON output')
-        .action(async (alias, options) => {
+        .option('--json', 'machine-readable JSON output');
+    addDeviceStatusOptions(statusCmd).action(async (alias, options) => {
         await listRepos(alias, options);
     });
 }

package/dist/commands/routines.js

@@ -11,6 +11,7 @@ import * as fs from 'fs';
 import * as path from 'path';
 import * as yaml from 'yaml';
 import { isDaemonRunning, signalDaemonReload, startDaemon, stopDaemon, readDaemonLog, getDaemonStatus, } from '../lib/daemon.js';
+import { resolveAgentName, isAgentHardDeprecated, hardDeprecationError } from '../lib/agents.js';
 import { humanizeCron, humanizeNextRun, formatRepoLink, REPO_DISPLAY_MAX } from '../lib/routines-format.js';
 import { listJobs as listAllJobs, deleteJob, readJob, validateJob, writeJob, setJobEnabled, listRuns, getLatestRun, getRunDir, getJobPath, parseAtTime, jobRunsOnThisDevice, checkJobDeviceEligibility, normalizeTriggerEvent, parseHostStrategy, resolveHostStrategy, placementRequiresFiringPin, HOST_STRATEGIES, } from '../lib/routines.js';
 import { discoverProjectRoutinesAt, enableProjectRoutines, disableProjectRoutines, syncProjectRoutines, syncAllProjectRoutines, listEnabledProjectRoots, resolveProjectRoot, displayProjectPath, listProjectRoutineFiles, } from '../lib/routines-project.js';
@@ -280,7 +281,7 @@ export function registerRoutinesCommands(program) {
     `,
         notes: `
       A routine is a YAML file that schedules an agent invocation. It specifies:
-        - which agent to run (claude, codex, gemini, ...)
+        - which agent to run (claude, codex, antigravity, ...)
         - when to run (cron schedule or one-shot time)
         - what task to give the agent (the prompt)
         - execution constraints (mode, effort, timeout)
@@ -297,8 +298,10 @@ export function registerRoutinesCommands(program) {
         - Detached/daemon fires use the pre-flight pick only (next tick re-selects).
         - Diagnostic lines log which account was picked, which were skipped, and
           each failover hop: look for "[agents] routine <name>:" in the run log.
-        - Headless Claude auth: store CLAUDE_CODE_OAUTH_TOKEN in the 'claude'
-          secrets bundle so the daemon can inject it into routine spawns.
+        - Claude auth: a routine authenticates through the pinned account's own
+          on-disk login (the same one 'agents run claude' uses on this device).
+          The daemon injects no token; if that account's login has expired the
+          run is skipped up front with a re-login hint.
     `,
     });
     routinesCmd
@@ -458,7 +461,7 @@ export function registerRoutinesCommands(program) {
         .command('add [nameOrPath]')
         .description('Create a new routine from a YAML file or inline flags. Starts the scheduler automatically if it is not already running.')
         .option('-s, --schedule <cron>', 'Cron schedule in standard format (5 fields: minute hour day month weekday)')
-        .option('-a, --agent <agent>', 'Which agent runs this routine: claude, codex, gemini, cursor, or opencode')
+        .option('-a, --agent <agent>', 'Which agent runs this routine: claude, codex, antigravity, cursor, or opencode')
         .option('--workflow <name>', 'Run an installed workflow (~/.agents/workflows/<name>) via `agents run`. Mutually exclusive with --agent.')
         .option('--command <sh>', 'Run a plain shell command directly (no agent, no auth, no sandbox) — for deterministic housekeeping routines. Mutually exclusive with --agent and --workflow; --prompt is not used.')
         .option('-p, --prompt <prompt>', 'Task instruction for the agent')
@@ -525,6 +528,15 @@ export function registerRoutinesCommands(program) {
                 console.error(chalk.red('An agent, workflow, or command is required (use --agent, --workflow, or --command)'));
                 process.exit(1);
             }
+            // Hard-deprecated harnesses cannot be scheduled — refuse at create time so
+            // no new recurring job silently fails against a retired backend.
+            if (options.agent) {
+                const routineAgentId = resolveAgentName(options.agent);
+                if (routineAgentId && isAgentHardDeprecated(routineAgentId)) {
+                    console.error(chalk.red(hardDeprecationError(routineAgentId)));
+                    process.exit(1);
+                }
+            }
             // Command routines run a plain shell and take no prompt; agent/workflow routines require one.
             if (!options.command && !options.prompt) {
                 console.error(chalk.red('Prompt is required (use --prompt)'));

package/dist/commands/rules.js

@@ -4,7 +4,8 @@ import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
 import { select, checkbox } from '@inquirer/prompts';
-import { AGENTS, agentConfigDirName, ALL_AGENT_IDS, resolveAgentName, formatAgentError, agentLabel, } from '../lib/agents.js';
+import { AGENTS, agentConfigDirName, MANAGED_AGENT_IDS, resolveAgentName, formatAgentError, agentLabel, } from '../lib/agents.js';
+import { capableAgents } from '../lib/capabilities.js';
 import { cloneRepo } from '../lib/git.js';
 import { discoverInstructionsFromRepo, discoverRuleFilesFromRepo, installInstructionsCentrally, uninstallInstructions, listInstalledInstructionsWithScope, instructionsExists, getInstructionsContent, listCentralRules, } from '../lib/rules/rules.js';
 import { listInstalledVersions, getGlobalDefault, resolveVersionAlias, syncResourcesToVersion, promptAgentVersionSelection, getVersionHomePath, } from '../lib/versions.js';
@@ -28,7 +29,7 @@ Examples:
   agents rules list claude@2.1.112
 
   # Install rules from your .agents repo to multiple agents
-  agents rules add --agents claude,codex,gemini
+  agents rules add --agents claude,codex,cursor
 
   # Install a shared rule file from GitHub
   agents rules add gh:anthropics/agent-rules --agents codex@0.116.0
@@ -44,13 +45,13 @@ When to use:
 
 Project rules & @-imports:
   Project rules live in <repo>/.agents/rules/. On every agent launch, the shim compiles
-  them into <repo>/AGENTS.md (with CLAUDE.md, GEMINI.md, .cursorrules symlinked to it).
+  them into <repo>/AGENTS.md (with CLAUDE.md and .cursorrules symlinked to it).
   A hand-authored AGENTS.md is preserved — the compile pipeline only overwrites files
   it owns (those starting with the auto-compile header). Delete the file to migrate.
 
   @path imports inside AGENTS.md/CLAUDE.md are resolved at session start by the agent
   itself, not by agents-cli. Support is per-agent:
-    Inlined natively:  claude, gemini
+    Inlined natively:  claude
     Literal text:      codex, cursor, opencode, copilot, amp, kiro, goose
 
   For rules that need to work across all agents, inline the content rather than using
@@ -161,7 +162,7 @@ Project rules & @-imports:
             return;
         }
         console.log(chalk.bold('Installed Rules\n'));
-        for (const aid of ALL_AGENT_IDS) {
+        for (const aid of MANAGED_AGENT_IDS) {
             const agent = AGENTS[aid];
             const installedVersions = listInstalledVersions(aid);
             const defaultVer = getGlobalDefault(aid);
@@ -200,7 +201,7 @@ Project rules & @-imports:
     rulesCmd
         .command('add [source]')
         .description('Install rule files from a source (GitHub, local path) or pick from central storage')
-        .option('-a, --agents <list>', 'Targets: claude, codex@0.116.0, or gemini@default')
+        .option('-a, --agents <list>', 'Targets: claude, codex@0.116.0, or cursor@default')
         .option('--names <list>', 'Rule file names from ~/.agents/rules/ (comma-separated)')
         .option('-y, --yes', 'Skip all prompts and use defaults')
         .addHelpText('after', `
@@ -212,7 +213,7 @@ Examples:
   agents rules add --names AGENTS.md --agents codex@0.116.0
 
   # Install all rules from a GitHub repo to multiple agents
-  agents rules add gh:team/agent-rules --agents claude,gemini
+  agents rules add gh:team/agent-rules --agents claude,codex
 
   # Sync a local rules directory to your active agents
   agents rules add ~/projects/my-rules --agents claude@default
@@ -317,7 +318,7 @@ Examples:
             let selectedAgents;
             let versionSelections;
             if (options.agents) {
-                const result = await resolveAgentTargetsAutoInstalling(options.agents, ALL_AGENT_IDS, { yes: options.yes });
+                const result = await resolveAgentTargetsAutoInstalling(options.agents, capableAgents('rules'), { yes: options.yes });
                 if (!result) {
                     console.log(chalk.gray('Cancelled.'));
                     return;
@@ -326,7 +327,7 @@ Examples:
                 versionSelections = result.versionSelections;
             }
             else {
-                const result = await promptAgentVersionSelection(ALL_AGENT_IDS, {
+                const result = await promptAgentVersionSelection(capableAgents('rules'), {
                     skipPrompts: options.yes,
                 });
                 selectedAgents = result.selectedAgents;
@@ -376,7 +377,7 @@ Examples:
   agents rules view codex --scope project
 
   # View rules for a specific installed version
-  agents rules view gemini@1.5.0
+  agents rules view codex@0.116.0
 `)
         .action(async (agentArg, options) => {
         const cwd = process.cwd();
@@ -393,7 +394,7 @@ Examples:
             requestedVersion = resolveVersionAlias(agentId, parts[1]) ?? null;
         }
         else {
-            const choices = ALL_AGENT_IDS.filter((id) => instructionsExists(id, 'user', cwd) || instructionsExists(id, 'project', cwd));
+            const choices = MANAGED_AGENT_IDS.filter((id) => instructionsExists(id, 'user', cwd) || instructionsExists(id, 'project', cwd));
             if (choices.length === 0) {
                 console.log(chalk.yellow('No rule files found.'));
                 return;
@@ -460,7 +461,7 @@ Examples:
         if (!agentArg) {
             // Only list agents that actually have a rules file installed — avoids
             // suggesting agents the user hasn't touched.
-            const candidates = ALL_AGENT_IDS.filter((id) => instructionsExists(id));
+            const candidates = MANAGED_AGENT_IDS.filter((id) => instructionsExists(id));
             requireDestructiveArg({
                 argName: 'agent',
                 command: 'agents rules remove',

package/dist/commands/secrets.d.ts

@@ -8,7 +8,7 @@
 import { type Command } from 'commander';
 import { SSH_TARGET_RE, assertValidSshTarget } from '../lib/ssh-exec.js';
 import { quoteWin32ExecArg } from '../lib/platform/index.js';
-import { type SecretsBundle, type SecretsPolicy } from '../lib/secrets/bundles.js';
+import { type SecretsBackend, type SecretsBundle, type SecretsPolicy } from '../lib/secrets/bundles.js';
 /** Read all available data from stdin synchronously, trimmed. */
 /**
  * Read the raw `.env` text for `import --from <path|->`. A `-` reads the .env
@@ -109,4 +109,6 @@ export declare function assertNeverPolicyAcknowledged(policy: SecretsPolicy | un
     iUnderstand?: boolean;
     interactive: boolean;
 }): 'ok' | 'prompt';
+/** Validate a --backend value, exiting with a clear message on a bad one. */
+export declare function secretsDefaultBackend(): SecretsBackend;
 export { quoteWin32ExecArg };