@phnx-labs/agents-cli 1.20.78 → 1.20.82

package/dist/lib/usage.js

@@ -1,5 +1,5 @@
 /**
- * Usage and rate-limit tracking for Claude, Codex, Kimi, and Droid agents.
+ * Usage and rate-limit tracking for Claude, Codex, Kimi, Droid, Grok, and Cursor agents.
  *
  * Fetches live usage data from each agent's usage API (Anthropic OAuth for
  * Claude, Kimi Code /usages, Factory billing limits for Droid) or parses
@@ -18,6 +18,7 @@ import chalk from 'chalk';
 import { decodeJwtPayload, decryptDroidAuthPayload } from './agents.js';
 import { walkForFiles } from './fs-walk.js';
 import { getKeychainToken, setKeychainToken, deleteKeychainToken, isKeychainBackendOverridden, } from './secrets/index.js';
+import { bundleExists, bundleBackend, readAndResolveBundleEnv } from './secrets/bundles.js';
 import { getCacheDir } from './state.js';
 const execFileAsync = promisify(execFile);
 const CLAUDE_USAGE_URL = 'https://api.anthropic.com/api/oauth/usage';
@@ -53,6 +54,7 @@ const getClaudeUsageCachePath = () => path.join(getCacheDir(), 'claude-usage.jso
 const CACHED_CLAUDE_USAGE_SOURCE_LABEL = 'last seen live account data';
 const KIMI_USAGES_URL = 'https://api.kimi.com/coding/v1/usages';
 const DROID_USAGE_URL = 'https://api.factory.ai/api/billing/limits';
+const CURSOR_USAGE_URL = 'https://cursor.com/api/usage';
 const COMPACT_BAR_LEN = 5;
 const USAGE_BAR_LEN = 10;
 const FULL = '\u2588';
@@ -68,6 +70,10 @@ export async function getUsageInfo(agentId, options) {
             return getKimiUsageInfo(options);
         case 'droid':
             return getDroidUsageInfo(options);
+        case 'grok':
+            return getGrokUsageInfo(options);
+        case 'cursor':
+            return getCursorUsageInfo(options);
         default:
             return { snapshot: null, error: null };
     }
@@ -104,14 +110,19 @@ export function buildCanonicalUsageContext(inputs) {
     return { canonicalByUsageKey, usageFetchInputs };
 }
 /**
- * Whether an agent exposes usage/limit data we can render — Claude/Kimi/Droid via
- * a live API, Codex via local session logs. Everything else has no usage concept,
- * so callers use this to decide whether a missing snapshot is worth flagging as
- * "usage unavailable" (a signed-in Claude account with no data) versus simply not
- * applicable (Antigravity, Grok, OpenCode).
+ * Whether an agent exposes usage/limit data we can render — Claude/Kimi/Droid/Cursor
+ * via a live API, Codex/Grok via local session logs. Everything else has no usage
+ * concept, so callers use this to decide whether a missing snapshot is worth
+ * flagging as "usage unavailable" (a signed-in Claude account with no data)
+ * versus simply not applicable (Antigravity, OpenCode).
  */
 export function agentReportsUsage(agentId) {
-    return agentId === 'claude' || agentId === 'codex' || agentId === 'kimi' || agentId === 'droid';
+    return (agentId === 'claude' ||
+        agentId === 'codex' ||
+        agentId === 'kimi' ||
+        agentId === 'droid' ||
+        agentId === 'grok' ||
+        agentId === 'cursor');
 }
 /** Fetch usage info for all unique accounts in parallel, keyed by usage key. */
 export async function getUsageInfoByIdentity(inputs, opts) {
@@ -604,7 +615,9 @@ export function formatKimiPlan(data) {
  * here would race a concurrently running droid session and can permanently
  * invalidate the user's login chain. Droid refreshes its own credential when
  * it runs; if the stored token is expired we skip the live fetch and let the
- * SWR cache serve the last-seen snapshot.
+ * SWR cache serve the last-seen snapshot. This same single-use-rotation property
+ * is why `agents apply` refuses to propagate droid credentials across machines
+ * (see `isCredentialSafeToPropagate` in `../fleet/auth-sync.ts`).
  */
 async function getDroidUsageInfo(options) {
     try {
@@ -986,6 +999,65 @@ function deleteCachedClaudeOauth(service) {
         /* best-effort — cache is an optimization */
     }
 }
+/**
+ * Reserved FILE-BASED secrets bundle holding long-lived, non-rotating Claude
+ * setup-tokens. Usage/probe reads authenticate with these instead of Claude
+ * Code's ACL-bound login item, so they never pop Touch ID. Keyed strictly
+ * per-account (`CLAUDE_CODE_OAUTH_TOKEN_<slug>` from the account email) — never a
+ * bare key, so one account's token can't be misapplied to another in a
+ * multi-account fleet.
+ */
+const AUTH_BUNDLE = 'auth';
+/** The per-account key an email maps to inside the `auth` bundle. */
+function claudeAccountTokenKey(account) {
+    const slug = account
+        .trim()
+        .toUpperCase()
+        .replace(/@/g, '_AT_')
+        .replace(/\./g, '_DOT_')
+        .replace(/[^A-Z0-9_]/g, '_');
+    return `CLAUDE_CODE_OAUTH_TOKEN_${slug}`;
+}
+/** Signed-in account email for a version home, from `.claude.json` (no keychain). */
+function readClaudeAccountEmail(home) {
+    const base = home ?? os.homedir();
+    for (const p of [path.join(base, '.claude', '.claude.json'), path.join(base, '.claude.json')]) {
+        try {
+            const email = JSON.parse(fs.readFileSync(p, 'utf-8')).oauthAccount?.emailAddress;
+            if (typeof email === 'string' && email.trim().length > 0)
+                return email.trim();
+        }
+        catch {
+            // Missing/unreadable at this location — try the next.
+        }
+    }
+    return null;
+}
+/**
+ * Resolve a long-lived `claude setup-token` for the account signed into `home`
+ * from the reserved FILE-BASED `auth` bundle. Returns the token or null. Reads
+ * ONLY when the bundle is file-backed (never keychain), so this path itself can
+ * never trigger a Touch ID prompt — that is the entire point: usage/probe reads
+ * authenticate with the shareable setup-token, not the ACL-bound login item.
+ */
+function resolveClaudeSetupToken(home) {
+    try {
+        // Require a known account (email) up front: without it we cannot key a
+        // per-account token, and we must NOT fall back to a bare shared key that
+        // would misapply one account's setup-token to another.
+        const email = readClaudeAccountEmail(home);
+        if (!email)
+            return null;
+        if (!bundleExists(AUTH_BUNDLE) || bundleBackend(AUTH_BUNDLE) !== 'file')
+            return null;
+        const { env } = readAndResolveBundleEnv(AUTH_BUNDLE, { caller: 'usage', agentOnly: true });
+        const v = (env[claudeAccountTokenKey(email)] ?? '').trim();
+        return v.length > 0 ? v : null;
+    }
+    catch {
+        return null;
+    }
+}
 /**
  * Load a version home's Claude OAuth credential from the two stores Claude Code
  * uses, tried in order:
@@ -1012,6 +1084,23 @@ function deleteCachedClaudeOauth(service) {
  * access-token-only consumers (the usage fetch and the auth-health probe) opt in.
  */
 export async function loadClaudeOauth(home, opts) {
+    // Read-only usage/probe callers (accessTokenCache) authenticate with a
+    // file-based setup-token when one is provisioned: the usage endpoint accepts
+    // any sk-ant-oat01 bearer, and the token is read from the file-based `auth`
+    // bundle — never Claude Code's ACL-bound keychain item — so it never pops
+    // Touch ID. Transitional: an account with no provisioned setup-token still
+    // falls through to the keychain/file read below (that fallback is removed once
+    // the fleet is fully seeded, per docs/design/credential-management.md).
+    if (opts?.accessTokenCache === true) {
+        const setupToken = resolveClaudeSetupToken(home);
+        if (setupToken) {
+            // No expiresAt: a setup-token is long-lived and non-rotating, and a null
+            // expiry reads as "still fresh" (claudeAccessTokenNeedsRefresh) so the
+            // probe never reports it expired or tries to refresh it. The endpoint is
+            // the source of truth if it has actually been revoked.
+            return { accessToken: setupToken };
+        }
+    }
     // The OS keychain/keyring step is macOS/Linux-only. Windows skips straight
     // to the .credentials.json fallback — the Claude CLI has no keychain
     // integration there and stores its OAuth token in that file too. An injected
@@ -1448,3 +1537,177 @@ function safeStatSync(filePath) {
         return null;
     }
 }
+/** Parse the latest billing info from Grok's unified log. */
+async function getGrokUsageInfo(options) {
+    try {
+        const base = options?.home || os.homedir();
+        const logPath = path.join(base, '.grok', 'logs', 'unified.jsonl');
+        if (!fs.existsSync(logPath))
+            return { snapshot: null, error: null };
+        const match = await readLatestGrokBilling(logPath);
+        if (!match)
+            return { snapshot: null, error: null };
+        return {
+            snapshot: {
+                source: 'last_seen',
+                sourceLabel: 'last seen in Grok logs',
+                capturedAt: match.capturedAt,
+                windows: match.windows,
+                plan: match.subscriptionTier,
+            },
+            error: null,
+        };
+    }
+    catch {
+        return { snapshot: null, error: null };
+    }
+}
+async function readLatestGrokBilling(filePath) {
+    return new Promise((resolve) => {
+        let latest = null;
+        const stream = fs.createReadStream(filePath, { encoding: 'utf-8' });
+        const rl = readline.createInterface({ input: stream, crlfDelay: Infinity });
+        rl.on('line', (line) => {
+            if (!line.trim())
+                return;
+            try {
+                const parsed = JSON.parse(line);
+                if (parsed.msg === 'billing: fetched credits config' && parsed.ctx?.config) {
+                    const config = parsed.ctx.config;
+                    const windows = [];
+                    if (config.currentPeriod?.end) {
+                        // `creditUsagePercent` is Grok's weekly credit consumption (0-100);
+                        // the billing period's `end` is when that window resets.
+                        const rawPercent = typeof config.creditUsagePercent === 'number' ? config.creditUsagePercent : 0;
+                        windows.push({
+                            key: 'week',
+                            label: 'Current week',
+                            shortLabel: 'W',
+                            usedPercent: Math.max(0, Math.min(100, rawPercent)),
+                            resetsAt: parseDateValue(config.currentPeriod.end),
+                            windowMinutes: inferWindowMinutes('week'),
+                        });
+                    }
+                    latest = {
+                        capturedAt: parseDateValue(parsed.ts),
+                        subscriptionTier: parsed.ctx.subscriptionTier || null,
+                        windows,
+                    };
+                }
+            }
+            catch {
+                /* malformed session line */
+            }
+        });
+        rl.on('close', () => resolve(latest));
+        rl.on('error', () => resolve(latest));
+    });
+}
+/**
+ * Normalize Cursor's /api/usage payload into the common UsageWindow shape.
+ *
+ * Only free / legacy request-capped plans carry a `maxRequestUsage` on the
+ * premium ("gpt-4") bucket — that's the fast-request cap the plan meters, and it
+ * maps cleanly to a monthly window. Usage-based plans report `maxRequestUsage:
+ * null` (no request cap — spend is metered in dollars instead), so they have no
+ * bar to draw here and return no windows rather than a misleading empty gauge.
+ */
+export function normalizeCursorUsage(data) {
+    const premium = data['gpt-4'];
+    if (!premium || typeof premium !== 'object')
+        return [];
+    const max = premium.maxRequestUsage;
+    if (typeof max !== 'number' || !Number.isFinite(max) || max <= 0)
+        return [];
+    const used = typeof premium.numRequests === 'number' ? premium.numRequests : 0;
+    const startOfMonth = typeof data.startOfMonth === 'string' ? parseDateValue(data.startOfMonth) : null;
+    // The request quota resets one calendar month after the period start. Guard the
+    // month-end overflow: setMonth on a day the target month lacks (Jan 31 -> Feb 31)
+    // rolls forward into the month after (Mar 3), so clamp back to the intended
+    // month's last day.
+    let resetsAt = null;
+    if (startOfMonth) {
+        resetsAt = new Date(startOfMonth);
+        const intendedMonth = (resetsAt.getMonth() + 1) % 12;
+        resetsAt.setMonth(resetsAt.getMonth() + 1);
+        if (resetsAt.getMonth() !== intendedMonth)
+            resetsAt.setDate(0);
+    }
+    return [
+        {
+            key: 'month',
+            label: 'Current month',
+            shortLabel: 'M',
+            usedPercent: Math.max(0, Math.min(100, (used / max) * 100)),
+            resetsAt,
+            windowMinutes: inferWindowMinutes('month'),
+        },
+    ];
+}
+/** Read Cursor's OAuth subject + access token from the local CLI config/auth files. */
+function readCursorCredentials(base) {
+    try {
+        const cfgPath = path.join(base, '.cursor', 'cli-config.json');
+        const authPath = path.join(base, '.config', 'cursor', 'auth.json');
+        if (!fs.existsSync(cfgPath) || !fs.existsSync(authPath))
+            return null;
+        const cfg = JSON.parse(fs.readFileSync(cfgPath, 'utf-8'));
+        const sub = cfg?.authInfo?.authId;
+        const auth = JSON.parse(fs.readFileSync(authPath, 'utf-8'));
+        const accessToken = auth?.accessToken;
+        if (typeof sub !== 'string' || !sub)
+            return null;
+        if (typeof accessToken !== 'string' || !accessToken)
+            return null;
+        return { sub, accessToken };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Fetch Cursor usage from the dashboard usage endpoint. Cursor authenticates the
+ * request with a `WorkosCursorSessionToken` cookie of the form
+ * `<oauth-subject>::<access-token>` (the same pair the web dashboard sends), not a
+ * bearer header. Free/legacy plans return a monthly request bar; usage-based plans
+ * have no request cap, so they return a live-but-window-less snapshot (the account
+ * row still renders, without a misleading empty gauge).
+ */
+async function getCursorUsageInfo(options) {
+    try {
+        const base = options?.home || os.homedir();
+        const creds = readCursorCredentials(base);
+        if (!creds)
+            return { snapshot: null, error: null };
+        const exp = decodeJwtPayload(creds.accessToken)?.exp;
+        if (typeof exp === 'number' && Date.now() / 1000 >= exp) {
+            return { snapshot: null, error: null };
+        }
+        const url = `${CURSOR_USAGE_URL}?user=${encodeURIComponent(creds.sub)}`;
+        const response = await fetch(url, {
+            method: 'GET',
+            headers: {
+                Cookie: `WorkosCursorSessionToken=${creds.sub}%3A%3A${creds.accessToken}`,
+                Accept: 'application/json',
+            },
+            signal: AbortSignal.timeout(5000),
+        });
+        // 401/redirect => revoked/expired session; render nothing rather than a
+        // misleading empty bar.
+        if (!response.ok)
+            return { snapshot: null, error: null };
+        const data = (await response.json());
+        return {
+            snapshot: {
+                source: 'live',
+                sourceLabel: 'live account data',
+                capturedAt: new Date(),
+                windows: normalizeCursorUsage(data),
+            },
+            error: null,
+        };
+    }
+    catch {
+        return { snapshot: null, error: null };
+    }
+}

package/dist/lib/versions.js

@@ -29,7 +29,7 @@ import { activeRulesPreset, filterNamesForActiveResourceProfile } from './resour
 // (single source of truth). Re-exported below so existing importers of
 // `compareVersions` from './versions.js' keep working.
 import { VERSION_RE, compareVersions } from './agent-spec/primitives.js';
-import { AGENTS, agentConfigDirName, getAccountEmail, resolveAgentName, formatAgentError, findInPath, isSelfUpdatingAgent } from './agents.js';
+import { AGENTS, agentConfigDirName, getAccountEmail, resolveAgentName, formatAgentError, findInPath, isSelfUpdatingAgent, isAgentHardDeprecated, hardDeprecationError } from './agents.js';
 import { discoverPermissionGroups, getActivePermissionPresetName, readPermissionPresetRecipe, PERMISSION_PRESET_ENV_VAR } from './permissions.js';
 import { parseMcpServerConfig, isProjectMcpTrusted } from './mcp.js';
 import { createVersionedAlias, removeVersionedAlias, getConfigSymlinkVersion, ensureClaudeInsideSymlink, assertIsolationBoundary, } from './shims.js';
@@ -1337,6 +1337,9 @@ function relocateGrokBinaryToVersionHome(installedVersion) {
  */
 export async function installVersion(agent, version, onProgress, opts) {
     const agentConfig = AGENTS[agent];
+    if (isAgentHardDeprecated(agent)) {
+        return { success: false, installedVersion: version, error: hardDeprecationError(agent) };
+    }
     // Validate before deriving filesystem paths or npm package specs. The CLI
     // parser already enforces this for user input; this guard protects direct
     // callers and tests the critical install path at the source.
@@ -2416,6 +2419,9 @@ export function mergeRepoScopedSelections(repos, cwd = process.cwd()) {
  * For Gemini: commands are converted from markdown to TOML.
  */
 export function syncResourcesToVersion(agent, version, selection, options = {}) {
+    if (isAgentHardDeprecated(agent)) {
+        return { commands: false, skills: false, hooks: false, memory: [], permissions: false, mcp: [], subagents: [], plugins: [], workflows: [] };
+    }
     const agentConfig = AGENTS[agent];
     const versionHome = getVersionHomePath(agent, version);
     const agentDir = path.join(versionHome, agentConfigDirName(agent));

package/dist/lib/watchdog/watchdog.d.ts

@@ -33,7 +33,7 @@ export interface ClassifyInput {
     dormantMs: number;
 }
 export declare function classifyTerminal(input: ClassifyInput): StallStatus;
-export declare const WATCHDOG_SYSTEM_PROMPT = "You are the watchdog for AI coding agents running in terminals. These agents are\nexpected to DRIVE TO COMPLETION end-to-end. They too often stop to ask a needless\nquestion or pause with the task unfinished. For each stalled terminal below, decide\nNUDGE (send a message that unsticks it and pushes it to finish) or SKIP (it genuinely\nneeds the human).\n\nNUDGE when the agent could have continued on its own:\n- It asked permission for an obvious or already-authorized next step\n  (\"should I proceed?\", \"want me to continue?\", \"shall I run the tests?\").\n- It asked a question it could answer itself from the available context or a\n  reasonable default.\n- It announced an action (\"I'll run X\", \"let me write Y\") but no tool call followed.\n- It paused with the task incomplete and no real blocker.\nThe nudge text MUST: restate the goal, tell it to use best judgment and finish\nend-to-end WITHOUT asking again, and give ONE concrete hint \u2014 the specific next\nstep, a tool it forgot, or the sensible default to take. Imperative, 1-2 sentences,\nno emojis, under 200 characters.\n\nSKIP when the agent genuinely needs the human:\n- Credentials, auth, login, 2FA, or biometric.\n- An irreversible or outward-facing action that needs sign-off (force-push, delete\n  prod data, publish/release, spend money, send an external message).\n- A real product or intent decision with genuine ambiguity (not a trivial default).\n- The task is actually complete.\n- You cannot tell what the agent is doing.\n\nRespond with ONLY a JSON array (no prose, no code fence):\n[{\"terminalId\":\"<id>\",\"action\":\"nudge\"|\"skip\",\"text\":\"<message or empty>\",\"reason\":\"<brief>\"}]";
+export declare const WATCHDOG_SYSTEM_PROMPT = "You are the watchdog for AI coding agents running in terminals. Your one job is to get\nIDLE agents moving to completion: each agent has a goal and is expected to DRIVE TO\nCOMPLETION end-to-end, but the terminals below have gone idle. Read each one's goal and\nWHY it stopped, then decide NUDGE (send a message that unsticks it and drives it to\nfinish) or SKIP (it genuinely needs the human).\n\nRead the transcript before judging \u2014 an agent that already reached a decision needs \"do\nit,\" not \"decide.\"\n\nNUDGE when the agent went idle and could keep going on its own:\n- It asked permission for an obvious or already-authorized next step\n  (\"should I proceed?\", \"want me to continue?\", \"shall I run the tests?\").\n- It asked a question it could answer itself from the available context or a\n  reasonable default, or by using a tool it already has.\n- It announced an action (\"I'll run X\", \"let me write Y\") but no tool call followed.\n- It already decided what to do, then stalled without doing it.\n- It paused with the task incomplete and no real blocker.\n\nThe nudge text MUST carry context, not shove:\n- Restate the goal and reference the conclusion the agent ALREADY reached.\n- Give ONE concrete next step \u2014 the specific action, the sensible default, or a TOOL it\n  forgot it has (e.g. \"agents computer\" to drive the Mac, \"agents browser\" for the web,\n  \"agents ssh <mac> \\\"agents computer \u2026\\\"\" to drive a Mac from another box).\n- Split the ask: drive the reversible, goal-advancing part now; flag only a genuinely\n  disruptive sub-step for the human.\n- Tell it to use best judgment and finish end-to-end WITHOUT asking again.\n- Imperative, 1-2 sentences, no emojis, under 240 characters.\n\nSKIP when the agent genuinely needs the human (these belong in the user's feed, not a\nnudge):\n- Credentials, auth, login, 2FA, or biometric.\n- An irreversible or outward-facing action that needs sign-off (force-push, delete\n  prod data, publish/release, spend money, send an external message) \u2014 UNLESS the House\n  Rules below authorize it.\n- A real product or intent decision with genuine ambiguity (not a trivial default).\n- The task is actually complete.\n- You cannot tell what the agent is doing.\n\nRespond with ONLY a JSON array (no prose, no code fence):\n[{\"terminalId\":\"<id>\",\"action\":\"nudge\"|\"skip\",\"text\":\"<message or empty>\",\"reason\":\"<brief>\"}]";
 export declare function composePromptWithPlaybook(basePrompt: string, playbook: string): string;
 export declare function renderWatchdogPrompt(candidates: WatchdogCandidate[], playbook?: string): string;
 export declare function parseWatchdogResponse(stdout: string): Decision[];

package/dist/lib/watchdog/watchdog.js

@@ -64,28 +64,40 @@ export function classifyTerminal(input) {
     }
     return { kind: 'stalled', stalledForMs: age };
 }
-export const WATCHDOG_SYSTEM_PROMPT = `You are the watchdog for AI coding agents running in terminals. These agents are
-expected to DRIVE TO COMPLETION end-to-end. They too often stop to ask a needless
-question or pause with the task unfinished. For each stalled terminal below, decide
-NUDGE (send a message that unsticks it and pushes it to finish) or SKIP (it genuinely
-needs the human).
+export const WATCHDOG_SYSTEM_PROMPT = `You are the watchdog for AI coding agents running in terminals. Your one job is to get
+IDLE agents moving to completion: each agent has a goal and is expected to DRIVE TO
+COMPLETION end-to-end, but the terminals below have gone idle. Read each one's goal and
+WHY it stopped, then decide NUDGE (send a message that unsticks it and drives it to
+finish) or SKIP (it genuinely needs the human).
 
-NUDGE when the agent could have continued on its own:
+Read the transcript before judging — an agent that already reached a decision needs "do
+it," not "decide."
+
+NUDGE when the agent went idle and could keep going on its own:
 - It asked permission for an obvious or already-authorized next step
   ("should I proceed?", "want me to continue?", "shall I run the tests?").
 - It asked a question it could answer itself from the available context or a
-  reasonable default.
+  reasonable default, or by using a tool it already has.
 - It announced an action ("I'll run X", "let me write Y") but no tool call followed.
+- It already decided what to do, then stalled without doing it.
 - It paused with the task incomplete and no real blocker.
-The nudge text MUST: restate the goal, tell it to use best judgment and finish
-end-to-end WITHOUT asking again, and give ONE concrete hint — the specific next
-step, a tool it forgot, or the sensible default to take. Imperative, 1-2 sentences,
-no emojis, under 200 characters.
 
-SKIP when the agent genuinely needs the human:
+The nudge text MUST carry context, not shove:
+- Restate the goal and reference the conclusion the agent ALREADY reached.
+- Give ONE concrete next step — the specific action, the sensible default, or a TOOL it
+  forgot it has (e.g. "agents computer" to drive the Mac, "agents browser" for the web,
+  "agents ssh <mac> \\"agents computer …\\"" to drive a Mac from another box).
+- Split the ask: drive the reversible, goal-advancing part now; flag only a genuinely
+  disruptive sub-step for the human.
+- Tell it to use best judgment and finish end-to-end WITHOUT asking again.
+- Imperative, 1-2 sentences, no emojis, under 240 characters.
+
+SKIP when the agent genuinely needs the human (these belong in the user's feed, not a
+nudge):
 - Credentials, auth, login, 2FA, or biometric.
 - An irreversible or outward-facing action that needs sign-off (force-push, delete
-  prod data, publish/release, spend money, send an external message).
+  prod data, publish/release, spend money, send an external message) — UNLESS the House
+  Rules below authorize it.
 - A real product or intent decision with genuine ambiguity (not a trivial default).
 - The task is actually complete.
 - You cannot tell what the agent is doing.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@phnx-labs/agents-cli",
-  "version": "1.20.78",
+  "version": "1.20.82",
   "description": "One CLI for all your AI coding agents - versions, config, cloud dispatch, sessions, and teams (now with first-class Grok Build CLI support)",
   "type": "module",
   "main": "dist/index.js",
@@ -63,7 +63,6 @@
     "dotfiles",
     "claude",
     "codex",
-    "gemini",
     "cursor",
     "opencode",
     "grok",

package/dist/commands/check.d.ts

@@ -1,15 +0,0 @@
-/**
- * `agents check` — scriptable drift gate for CI.
- *
- * Runs the SAME drift/divergence diagnostic `agents doctor` computes (via the
- * shared `computeDrift` in `../lib/drift.js`) and turns it into an exit code:
- * non-zero when any installed version is stale or never-synced, zero when the
- * whole install is fresh. `agents doctor` is the human report; `agents check`
- * is the machine gate — same engine, different output.
- *
- * Orphans are surfaced informationally but never fail the check: they are a
- * `prune` concern, not sync drift (mirrors the sync-status engine, where an
- * orphan alone never flags needsSync).
- */
-import type { Command } from 'commander';
-export declare function registerCheckCommand(program: Command): void;

package/dist/commands/check.js

@@ -1,180 +0,0 @@
-import chalk from 'chalk';
-import { AGENTS, ALL_AGENT_IDS } from '../lib/agents.js';
-import { setHelpSections } from '../lib/help.js';
-import { computeDrift } from '../lib/drift.js';
-import { loadDevices } from '../lib/devices/registry.js';
-import { fanOutDevices, planFleetTargets, remoteFleetTargets } from '../lib/devices/fleet.js';
-import { fleetDialTarget } from '../lib/devices/connect.js';
-import { machineId } from '../lib/session/sync/config.js';
-import { buildRemoteAgentsInvocation } from '../lib/hosts/remote-cmd.js';
-import { sshExecAsync } from '../lib/ssh-exec.js';
-const AGENT_NAMES = Object.fromEntries(ALL_AGENT_IDS.map((id) => [id, AGENTS[id].name]));
-function label(row) {
-    return `${AGENT_NAMES[row.agent] || row.agent}@${row.version}`;
-}
-export function registerCheckCommand(program) {
-    const checkCmd = program
-        .command('check')
-        .description('CI drift gate: exit non-zero when any installed version is out of sync (stale or never-synced), zero when clean.')
-        .option('--json', 'Output machine-readable JSON')
-        .option('-q, --quiet', 'Suppress per-version lines; print only the one-line verdict')
-        .option('--cwd <path>', 'Resolution cwd for project layer detection (default: process.cwd())')
-        .option('--devices', 'Run the drift gate across every registered online device');
-    setHelpSections(checkCmd, {
-        examples: `
-      # Fail the build if anything drifted (exit 1), pass if clean (exit 0)
-      agents check
-
-      # Just the verdict line, nothing per-version
-      agents check --quiet
-
-      # Machine-readable, for scripting
-      agents check --json
-
-      # Gate every registered device
-      agents check --devices
-
-      # Gate in a CI step
-      agents check || { echo "resources drifted — run 'agents doctor --fix'"; exit 1; }
-    `,
-    });
-    checkCmd.action(async (opts) => {
-        const cwd = opts.cwd ? opts.cwd : process.cwd();
-        if (opts.devices) {
-            await runDevicesCheck(opts, cwd);
-            return;
-        }
-        const drift = computeDrift(cwd);
-        if (opts.json) {
-            console.log(JSON.stringify({
-                hasDrift: drift.hasDrift,
-                stale: drift.staleCount,
-                neverSynced: drift.neverSyncedCount,
-                orphanVersions: drift.orphanVersionCount,
-                versions: drift.syncRows.map((r) => ({
-                    agent: r.agent,
-                    version: r.version,
-                    status: r.status,
-                    isDefault: r.isDefault,
-                    divergence: r.divergence ?? [],
-                })),
-            }, null, 2));
-            process.exit(drift.hasDrift ? 1 : 0);
-        }
-        if (drift.syncRows.length === 0) {
-            // Nothing installed is a clean state, not a failure — CI on a fresh
-            // checkout with no versions should pass, not error.
-            console.log(chalk.gray('check: no installed versions — nothing to verify'));
-            process.exit(0);
-        }
-        if (!drift.hasDrift) {
-            const orphanNote = drift.orphanVersionCount > 0
-                ? chalk.gray(` (${drift.orphanVersionCount} version(s) carry orphans — run \`agents prune cleanup\`)`)
-                : '';
-            console.log(`${chalk.green('ok')}  ${drift.syncRows.length} version(s) in sync${orphanNote}`);
-            process.exit(0);
-        }
-        // Drift: one-line verdict always, per-version detail unless --quiet.
-        const parts = [];
-        if (drift.staleCount > 0)
-            parts.push(`${drift.staleCount} stale`);
-        if (drift.neverSyncedCount > 0)
-            parts.push(`${drift.neverSyncedCount} never-synced`);
-        console.error(`${chalk.red('drift')}  ${parts.join(', ')} of ${drift.syncRows.length} version(s)`);
-        if (!opts.quiet) {
-            for (const row of drift.syncRows) {
-                if (row.status === 'fresh')
-                    continue;
-                const tag = row.status === 'stale' ? chalk.yellow('stale') : chalk.gray('cold ');
-                console.error(`  ${tag}  ${label(row)}`);
-                for (const line of row.divergence ?? []) {
-                    console.error(chalk.gray(`           ${line}`));
-                }
-            }
-            console.error(chalk.gray('\nReconcile with `agents doctor --fix` (or `agents doctor <agent>@<version> --fix`).'));
-        }
-        process.exit(1);
-    });
-}
-function checkPayload(device, drift) {
-    return {
-        device,
-        hasDrift: drift.hasDrift,
-        stale: drift.staleCount,
-        neverSynced: drift.neverSyncedCount,
-        orphanVersions: drift.orphanVersionCount,
-    };
-}
-async function probeDeviceCheck(target) {
-    const isWin = /^win/i.test((target.platform ?? '').trim());
-    const remoteCmd = buildRemoteAgentsInvocation(['check', '--json'], undefined, isWin ? 'windows' : undefined, isWin ? undefined : { PATH: '$HOME/.agents/.cache/shims:$HOME/.local/bin:$PATH' });
-    const res = await sshExecAsync(target.dialTarget, remoteCmd, { timeoutMs: 30000, multiplex: true });
-    if (res.code !== 0 && !res.stdout.trim()) {
-        throw new Error(res.timedOut ? 'timed out' : (res.stderr.trim() || `exit ${res.code ?? 'unknown'}`));
-    }
-    try {
-        const parsed = JSON.parse(res.stdout);
-        return {
-            device: target.name,
-            hasDrift: Boolean(parsed.hasDrift),
-            stale: parsed.stale ?? 0,
-            neverSynced: parsed.neverSynced ?? 0,
-            orphanVersions: parsed.orphanVersions ?? 0,
-        };
-    }
-    catch (err) {
-        throw new Error(`invalid JSON (${err?.message ?? 'parse error'})`);
-    }
-}
-async function runDevicesCheck(opts, cwd) {
-    const registry = await loadDevices();
-    const self = machineId();
-    const planned = planFleetTargets(registry);
-    const local = checkPayload(self, computeDrift(cwd));
-    const remoteTargets = remoteFleetTargets(planned, self)
-        .map((t) => ({
-        name: t.device.name,
-        platform: t.device.platform,
-        skip: t.skip,
-        dialTarget: fleetDialTarget(t.device),
-    }));
-    const remote = await fanOutDevices(remoteTargets, probeDeviceCheck);
-    const devices = [local];
-    for (const result of remote) {
-        if (result.status === 'ok' && result.value) {
-            devices.push(result.value);
-        }
-        else {
-            devices.push({
-                device: result.name,
-                hasDrift: true,
-                stale: 0,
-                neverSynced: 0,
-                orphanVersions: 0,
-                error: result.error ?? String(result.reason ?? 'skipped'),
-            });
-        }
-    }
-    const hasDrift = devices.some((d) => d.hasDrift || d.error);
-    if (opts.json) {
-        console.log(JSON.stringify({ hasDrift, devices }, null, 2));
-        process.exit(hasDrift ? 1 : 0);
-    }
-    if (!hasDrift) {
-        console.log(chalk.green('ok') + chalk.gray(`  ${devices.length} device(s) in sync`));
-        process.exit(0);
-    }
-    console.error(chalk.red('drift') + chalk.gray(`  ${devices.filter((d) => d.hasDrift || d.error).length} of ${devices.length} device(s)`));
-    if (!opts.quiet) {
-        for (const d of devices) {
-            if (!d.hasDrift && !d.error)
-                continue;
-            const detail = d.error
-                ? d.error
-                : [`${d.stale} stale`, `${d.neverSynced} never-synced`].filter((p) => !p.startsWith('0 ')).join(', ');
-            console.error(`  ${chalk.yellow(d.device.padEnd(18))} ${detail || 'drift'}`);
-        }
-        console.error(chalk.gray('\nReconcile each device with `agents doctor --fix` or `agents repo pull user`.'));
-    }
-    process.exit(1);
-}

package/dist/commands/resources.d.ts

@@ -1,5 +0,0 @@
-/**
- * `agents resources` — show the merged DotAgents resource surface.
- */
-import type { Command } from 'commander';
-export declare function registerResourcesCommand(program: Command): void;