@phnx-labs/agents-cli 1.20.78 → 1.20.83

package/dist/commands/set.js

@@ -0,0 +1,79 @@
+/**
+ * `agents set` — ergonomic top-level setter for per-agent/version run defaults.
+ *
+ * `agents set claude@2.1.220 --model opus-5` pins the default model (and/or
+ * mode) that `agents run` uses for that agent version. It reads and writes the
+ * same store as `agents defaults run set` (agents.yaml -> run.defaults), so the
+ * two stay consistent — `set` is just the short front door.
+ *
+ *   agents set                          # list every configured default
+ *   agents set claude@2.1.220           # show the default for one version
+ *   agents set claude@2.1.220 --model opus-5
+ *   agents set 'claude:*' --mode auto --model opus
+ */
+import chalk from 'chalk';
+import { setHelpSections } from '../lib/help.js';
+import { formatRunDefaultEntry, listRunDefaults, parseRunDefaultSelector, setRunDefault, } from '../lib/run-defaults.js';
+export function registerSetCommand(program) {
+    const set = program
+        .command('set [selector]')
+        .description('Set the default model/mode an agent version uses for `agents run`')
+        .option('--model <model>', 'Default model or model alias, forwarded via --model')
+        .option('--mode <mode>', "Default mode: plan, edit, auto, skip. 'full' accepted as alias for skip.")
+        .action((selector, options) => {
+        try {
+            const hasFlags = options.model !== undefined || options.mode !== undefined;
+            if (!selector) {
+                if (hasFlags) {
+                    throw new Error('Selector is required when passing --model/--mode. Example: agents set claude@2.1.220 --model opus-5');
+                }
+                const entries = listRunDefaults();
+                if (entries.length === 0) {
+                    console.log(chalk.gray('No agent defaults configured.'));
+                    console.log(chalk.gray('Set one with: agents set claude@2.1.220 --model opus-5'));
+                    return;
+                }
+                console.log(chalk.bold('Agent Defaults\n'));
+                for (const entry of entries) {
+                    console.log(`  ${formatRunDefaultEntry(entry)}`);
+                }
+                return;
+            }
+            if (!hasFlags) {
+                const parsed = parseRunDefaultSelector(selector);
+                const entry = listRunDefaults().find((e) => e.selector === parsed.selector);
+                if (!entry || (!entry.defaults.mode && !entry.defaults.model)) {
+                    console.log(chalk.gray(`No default set for ${parsed.selector}.`));
+                    console.log(chalk.gray(`Set one with: agents set ${selector} --model <model>`));
+                    return;
+                }
+                console.log(`  ${formatRunDefaultEntry(entry)}`);
+                return;
+            }
+            const entry = setRunDefault(selector, {
+                ...(options.mode !== undefined ? { mode: options.mode } : {}),
+                ...(options.model !== undefined ? { model: options.model } : {}),
+            });
+            console.log(chalk.green('Set default:'));
+            console.log(`  ${formatRunDefaultEntry(entry)}`);
+        }
+        catch (err) {
+            console.error(chalk.red(err.message));
+            process.exit(1);
+        }
+    });
+    setHelpSections(set, {
+        examples: `
+      agents set claude@2.1.220 --model opus-5
+      agents set 'claude:*' --mode auto --model opus
+      agents set claude@2.1.220
+      agents set
+    `,
+        notes: `
+      Selectors use <agent>@<version> or <agent>:<version>; * matches all versions.
+      Exact selectors override wildcard selectors field by field.
+      Writes the same store as 'agents defaults run set'. Explicit flags on
+      'agents run' always win over configured defaults.
+    `,
+    });
+}

package/dist/commands/setup-fleet.d.ts

@@ -0,0 +1,21 @@
+/**
+ * `agents setup fleet` — guided Tailscale device onboarding.
+ *
+ * This wizard is a front door over the existing fleet/device commands: sync
+ * Tailscale into the registry, choose auth, render SSH config, test devices, and
+ * optionally run the fleet updater without reimplementing those subcommands.
+ */
+import type { Command } from 'commander';
+interface SetupFleetOptions {
+    auth?: string;
+    bundle?: string;
+    bundleKey?: string;
+    yes?: boolean;
+    writeSshConfig?: boolean;
+    testConnectivity?: boolean;
+    fleetUpdate?: boolean;
+}
+export declare function runFleetSetupWizard(opts?: SetupFleetOptions): Promise<boolean>;
+/** Register `agents setup fleet` under the parent `setup` command. */
+export declare function registerSetupFleetCommand(setupCmd: Command): void;
+export {};

package/dist/commands/setup-fleet.js

@@ -0,0 +1,201 @@
+/**
+ * `agents setup fleet` — guided Tailscale device onboarding.
+ *
+ * This wizard is a front door over the existing fleet/device commands: sync
+ * Tailscale into the registry, choose auth, render SSH config, test devices, and
+ * optionally run the fleet updater without reimplementing those subcommands.
+ */
+import chalk from 'chalk';
+import { spawnSync } from 'node:child_process';
+import { getCliLaunch } from '../lib/cli-entry.js';
+import { loadDevices } from '../lib/devices/registry.js';
+import { runDeviceSync } from '../lib/devices/sync.js';
+import { tailscaleStatusJson } from '../lib/devices/tailscale.js';
+import { isInteractiveTerminal, isPromptCancelled } from './utils.js';
+function parseAuth(raw) {
+    const value = (raw ?? 'key').toLowerCase();
+    if (value === 'key' || value === 'password')
+        return value;
+    throw new Error(`Invalid --auth '${raw}'. Use key or password.`);
+}
+function runAgentsSubcommand(args, opts = {}) {
+    const launch = getCliLaunch(args);
+    const res = spawnSync(launch.command, launch.args, { stdio: 'inherit', env: process.env });
+    if ((res.status ?? 1) === 0)
+        return true;
+    if (opts.optional)
+        return false;
+    throw new Error(`agents ${args.join(' ')} failed with exit ${res.status ?? 1}.`);
+}
+function commandExists(command) {
+    const res = spawnSync(command, ['version'], { stdio: 'ignore', windowsHide: true });
+    if (!res.error)
+        return true;
+    const fallback = spawnSync(command, ['--version'], { stdio: 'ignore', windowsHide: true });
+    return !fallback.error;
+}
+function tailscaleStatusOk() {
+    try {
+        tailscaleStatusJson();
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function printTailscaleInstallInstructions() {
+    console.error(chalk.red('Tailscale is not installed or not on PATH.'));
+    const platform = process.platform;
+    console.log(chalk.bold('\nInstall Tailscale, then re-run `agents setup fleet`:'));
+    if (platform === 'darwin') {
+        console.log(chalk.cyan('  brew install --cask tailscale'));
+        console.log(chalk.gray('  or install from https://tailscale.com/download/mac'));
+    }
+    else if (platform === 'linux') {
+        console.log(chalk.cyan('  curl -fsSL https://tailscale.com/install.sh | sh'));
+        console.log(chalk.gray('  then run: sudo tailscale up'));
+    }
+    else if (platform === 'win32') {
+        console.log(chalk.cyan('  winget install Tailscale.Tailscale'));
+        console.log(chalk.gray('  or install from https://tailscale.com/download/windows'));
+    }
+    else {
+        console.log(chalk.gray('  https://tailscale.com/download'));
+    }
+}
+async function resolveInteractiveChoices(opts) {
+    if (!isInteractiveTerminal()) {
+        return {
+            auth: parseAuth(opts.auth),
+            writeSshConfig: Boolean(opts.writeSshConfig),
+            testConnectivity: Boolean(opts.testConnectivity),
+            fleetUpdate: Boolean(opts.fleetUpdate),
+        };
+    }
+    const { confirm, select } = await import('@inquirer/prompts');
+    const auth = opts.auth ? parseAuth(opts.auth) : await select({
+        message: 'Default SSH auth for registered devices',
+        default: 'key',
+        choices: [
+            { name: 'key — use your SSH agent / on-disk public keys', value: 'key' },
+            { name: 'password — read the login password from an agents secrets bundle', value: 'password' },
+        ],
+    });
+    return {
+        auth,
+        writeSshConfig: opts.writeSshConfig ?? await confirm({
+            message: 'Write ~/.ssh/config.d/agents for plain ssh/scp/rsync?',
+            default: true,
+        }),
+        testConnectivity: opts.testConnectivity ?? await confirm({
+            message: 'Test connectivity with `agents ssh <device> uname`?',
+            default: true,
+        }),
+        fleetUpdate: opts.fleetUpdate ?? await confirm({
+            message: 'Run `agents fleet update` on online devices now?',
+            default: false,
+        }),
+    };
+}
+async function syncDevices(opts) {
+    if (isInteractiveTerminal() && !opts.yes) {
+        return runAgentsSubcommand(['devices', 'sync'], { optional: true });
+    }
+    const res = await runDeviceSync({ soft: true });
+    if (!res.ok) {
+        console.error(chalk.red(`Tailscale discovery failed: ${res.reason ?? 'unknown error'}`));
+        return false;
+    }
+    const extra = res.pending.length ? chalk.gray(` (${res.pending.length} new)`) : '';
+    console.log(chalk.green(`Synced ${res.synced} device${res.synced === 1 ? '' : 's'} from Tailscale${extra}.`));
+    return true;
+}
+async function applyAuth(auth, opts) {
+    const reg = await loadDevices();
+    const names = Object.keys(reg).sort();
+    if (names.length === 0) {
+        console.log(chalk.gray("No devices registered yet. Run 'agents setup fleet --yes' after joining Tailscale."));
+        return [];
+    }
+    if (auth === 'password' && !opts.bundle) {
+        throw new Error('--bundle is required with --auth password.');
+    }
+    for (const name of names) {
+        const args = ['devices', 'set', name, '--auth', auth];
+        if (opts.bundle)
+            args.push('--bundle', opts.bundle);
+        if (opts.bundleKey)
+            args.push('--bundle-key', opts.bundleKey);
+        runAgentsSubcommand(args);
+    }
+    return names;
+}
+function testConnectivity(names) {
+    if (names.length === 0)
+        return;
+    console.log(chalk.bold('\nTesting connectivity:'));
+    for (const name of names) {
+        const ok = runAgentsSubcommand(['ssh', name, 'uname'], { optional: true });
+        console.log(ok ? chalk.green(`  ${name}: ok`) : chalk.yellow(`  ${name}: failed`));
+    }
+}
+function printOnboardingSummary(names, auth) {
+    console.log(chalk.bold('\nFleet setup summary.'));
+    console.log(chalk.gray(`devices: ${names.length ? names.join(', ') : 'none registered'}`));
+    console.log(chalk.gray(`auth: ${auth}${auth === 'password' ? ' via secrets bundle' : ''}`));
+    console.log(chalk.bold('\nTry:'));
+    console.log(chalk.cyan('  agents devices list'));
+    console.log(chalk.cyan('  agents ssh <device> uname'));
+    console.log(chalk.cyan('  agents fleet run hostname'));
+    console.log(chalk.cyan('  agents fleet update'));
+}
+export async function runFleetSetupWizard(opts = {}) {
+    if (!commandExists('tailscale')) {
+        printTailscaleInstallInstructions();
+        return false;
+    }
+    if (!tailscaleStatusOk()) {
+        console.error(chalk.red('Tailscale is installed but not logged in or the daemon is unavailable.'));
+        console.log(chalk.gray('Run `tailscale login` (or `sudo tailscale up` on Linux), then re-run `agents setup fleet`.'));
+        return false;
+    }
+    const choices = await resolveInteractiveChoices(opts);
+    const synced = await syncDevices(opts);
+    if (!synced)
+        return false;
+    const names = await applyAuth(choices.auth, opts);
+    if (choices.writeSshConfig)
+        runAgentsSubcommand(['devices', 'render', '--write']);
+    if (choices.testConnectivity)
+        testConnectivity(names);
+    if (choices.fleetUpdate)
+        runAgentsSubcommand(['fleet', 'update']);
+    printOnboardingSummary(names, choices.auth);
+    return true;
+}
+/** Register `agents setup fleet` under the parent `setup` command. */
+export function registerSetupFleetCommand(setupCmd) {
+    setupCmd
+        .command('fleet')
+        .description('Set up `agents fleet` — discover Tailscale devices, choose auth, render SSH config, and test connectivity.')
+        .option('--auth <method>', 'device auth method: key or password', 'key')
+        .option('--bundle <name>', 'secrets bundle holding the login password when --auth password is used')
+        .option('--bundle-key <key>', "key within the secrets bundle (default 'password')")
+        .option('--yes', 'non-interactive: register every discovered, non-ignored Tailscale node')
+        .option('--write-ssh-config', 'write ~/.ssh/config.d/agents after syncing')
+        .option('--test-connectivity', 'run `agents ssh <device> uname` for each registered device')
+        .option('--fleet-update', 'run `agents fleet update` after setup')
+        .action(async (options) => {
+        try {
+            await runFleetSetupWizard(options);
+        }
+        catch (err) {
+            if (isPromptCancelled(err)) {
+                console.log(chalk.yellow('\nCancelled'));
+                return;
+            }
+            console.error(chalk.red(err.message));
+            process.exitCode = 1;
+        }
+    });
+}

package/dist/commands/setup-secrets.d.ts

@@ -0,0 +1,20 @@
+/**
+ * `agents setup secrets` — guided defaults for `agents secrets` onboarding.
+ *
+ * The wizard writes setup preferences and delegates imports to the existing
+ * `agents secrets import` command, keeping bundle storage as the source of truth.
+ */
+import type { Command } from 'commander';
+interface SetupSecretsOptions {
+    backend?: string;
+    policy?: string;
+    importFrom?: string;
+    bundle?: string;
+    vault?: string;
+    iUnderstand?: boolean;
+    force?: boolean;
+}
+export declare function runSecretsSetupWizard(opts?: SetupSecretsOptions): Promise<boolean>;
+/** Register `agents setup secrets` under the parent `setup` command. */
+export declare function registerSetupSecretsCommand(setupCmd: Command): void;
+export {};

package/dist/commands/setup-secrets.js

@@ -0,0 +1,223 @@
+/**
+ * `agents setup secrets` — guided defaults for `agents secrets` onboarding.
+ *
+ * The wizard writes setup preferences and delegates imports to the existing
+ * `agents secrets import` command, keeping bundle storage as the source of truth.
+ */
+import chalk from 'chalk';
+import * as fs from 'fs';
+import * as path from 'path';
+import { spawnSync } from 'node:child_process';
+import { getCliLaunch } from '../lib/cli-entry.js';
+import { getHistoryDir, updateMeta } from '../lib/state.js';
+import { isInteractiveTerminal, isPromptCancelled } from './utils.js';
+function defaultBackendForPlatform(platform = process.platform) {
+    return platform === 'darwin' ? 'keychain' : 'file';
+}
+function setupSecretsPrefsPath() {
+    return path.join(getHistoryDir(), 'setup', 'secrets.json');
+}
+function parseBackend(raw) {
+    const value = (raw ?? defaultBackendForPlatform()).toLowerCase();
+    if (value === 'keychain' || value === 'file' || value === 'vault')
+        return value;
+    throw new Error(`Invalid --backend '${raw}'. Use keychain, file, or vault.`);
+}
+function parsePolicy(raw) {
+    const value = (raw ?? 'daily').toLowerCase();
+    if (value === 'daily' || value === 'always' || value === 'never')
+        return value;
+    throw new Error(`Invalid --policy '${raw}'. Use daily, always, or never.`);
+}
+function parseImportSource(raw) {
+    const value = (raw ?? 'none').toLowerCase();
+    if (value === 'none' || value === 'env' || value === '1password' || value === 'icloud')
+        return value;
+    throw new Error(`Invalid --import-from '${raw}'. Use none, env, 1password, or icloud.`);
+}
+function hasCommand(command) {
+    const res = spawnSync(command, ['--version'], { stdio: 'ignore', windowsHide: true });
+    return !res.error;
+}
+function saveSetupSecretsPrefs(prefs) {
+    const file = setupSecretsPrefsPath();
+    fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
+    fs.writeFileSync(file, JSON.stringify(prefs, null, 2) + '\n', { mode: 0o600 });
+    return file;
+}
+function applySecretsDefaults(backend, policy) {
+    updateMeta((meta) => ({
+        ...meta,
+        secrets: {
+            ...meta.secrets,
+            backend,
+            ...(policy === 'never' ? {} : { policy }),
+        },
+    }));
+}
+function backendArgs(backend) {
+    return backend === 'vault' ? ['--synced'] : ['--backend', backend];
+}
+function printBackendNotes(backend) {
+    if (backend === 'keychain') {
+        console.log(chalk.gray('backend: keychain — macOS reads may ask for Touch ID or the device password.'));
+    }
+    else if (backend === 'file') {
+        console.log(chalk.gray('backend: file — set AGENTS_SECRETS_PASSPHRASE for headless encrypted-file reads.'));
+    }
+    else {
+        console.log(chalk.gray('backend: vault — synced ~/.agents/vault.age storage; unlock it with agents login.'));
+    }
+}
+function runAgentsSubcommand(args) {
+    const launch = getCliLaunch(args);
+    const res = spawnSync(launch.command, launch.args, { stdio: 'inherit', env: process.env });
+    if ((res.status ?? 1) !== 0) {
+        throw new Error(`agents ${args.join(' ')} failed with exit ${res.status ?? 1}.`);
+    }
+}
+async function maybeImportSecrets(source, opts) {
+    if (source === 'none')
+        return;
+    let bundle = opts.bundle;
+    if (!bundle) {
+        if (!isInteractiveTerminal()) {
+            throw new Error(`--bundle is required with --import-from ${source} in a non-interactive shell.`);
+        }
+        const { input } = await import('@inquirer/prompts');
+        bundle = await input({
+            message: 'Import into which bundle?',
+            default: 'default',
+            validate: (v) => (v.trim().length > 0 ? true : 'Enter a bundle name.'),
+        });
+    }
+    const args = ['secrets', 'import', bundle, ...backendArgs(opts.backend)];
+    if (opts.force)
+        args.push('--force');
+    if (source === 'env') {
+        let envPath = opts.vault;
+        if (!envPath) {
+            if (!isInteractiveTerminal()) {
+                throw new Error('--vault must name the .env path when --import-from env is used non-interactively.');
+            }
+            const { input } = await import('@inquirer/prompts');
+            envPath = await input({
+                message: '.env file path',
+                default: '.env',
+                validate: (v) => (v.trim().length > 0 ? true : 'Enter a .env path.'),
+            });
+        }
+        args.push('--from', envPath);
+    }
+    else if (source === '1password') {
+        const vault = opts.vault;
+        if (!vault)
+            throw new Error('--vault <name> is required with --import-from 1password.');
+        args.push('--from', `1password:${vault}`);
+    }
+    else {
+        args.push('--from', 'icloud');
+    }
+    runAgentsSubcommand(args);
+}
+async function resolveInteractiveChoices(opts) {
+    if (!isInteractiveTerminal()) {
+        return {
+            backend: parseBackend(opts.backend),
+            policy: parsePolicy(opts.policy),
+            importSource: parseImportSource(opts.importFrom),
+        };
+    }
+    const { select } = await import('@inquirer/prompts');
+    const backend = opts.backend ? parseBackend(opts.backend) : await select({
+        message: 'Default secrets backend',
+        default: defaultBackendForPlatform(),
+        choices: [
+            { name: 'keychain — local OS keychain; reads may ask for Touch ID/device password', value: 'keychain' },
+            { name: 'file — passphrase-encrypted file store for headless machines', value: 'file' },
+            { name: 'vault — synced ~/.agents/vault.age file; requires agents login', value: 'vault' },
+        ],
+    });
+    const policy = opts.policy ? parsePolicy(opts.policy) : await select({
+        message: 'Default prompt policy',
+        default: 'daily',
+        choices: [
+            { name: 'daily — ask once, then hold for the configured window', value: 'daily' },
+            { name: 'always — ask on every read', value: 'always' },
+            { name: 'never — no biometry ACL; use only for automation-only bundles', value: 'never' },
+        ],
+    });
+    const importChoices = [
+        { name: 'skip import', value: 'none' },
+        { name: 'import from .env file', value: 'env' },
+        ...(hasCommand('op') ? [{ name: 'import from 1Password vault', value: '1password' }] : []),
+        { name: 'import legacy iCloud Keychain bundles', value: 'icloud' },
+    ];
+    const importSource = opts.importFrom ? parseImportSource(opts.importFrom) : await select({
+        message: 'Import existing secrets now?',
+        default: 'none',
+        choices: importChoices,
+    });
+    return { backend, policy, importSource };
+}
+function printOnboardingSummary(backend, policy, prefsFile) {
+    console.log(chalk.bold('\nSecrets setup saved.'));
+    console.log(chalk.gray(`preferences: ${prefsFile}`));
+    printBackendNotes(backend);
+    if (policy === 'never') {
+        console.log(chalk.yellow('policy: never is saved as a setup preference; create automation-only bundles with --policy never --i-understand.'));
+    }
+    else {
+        console.log(chalk.gray(`policy: ${policy} — used by bundles that do not set their own policy.`));
+    }
+    console.log(chalk.bold('\nTry:'));
+    console.log(chalk.cyan(`  agents secrets create prod ${backendArgs(backend).join(' ')} --policy ${policy === 'never' ? 'daily' : policy}`));
+    console.log(chalk.cyan('  agents secrets add prod API_KEY'));
+    console.log(chalk.cyan('  agents run claude "deploy" --secrets prod'));
+}
+export async function runSecretsSetupWizard(opts = {}) {
+    const { backend, policy, importSource } = await resolveInteractiveChoices(opts);
+    if (policy === 'never' && !opts.iUnderstand && !isInteractiveTerminal()) {
+        throw new Error("Refusing to save policy 'never' non-interactively without --i-understand.");
+    }
+    applySecretsDefaults(backend, policy);
+    const prefsFile = saveSetupSecretsPrefs({
+        defaultBackend: backend,
+        defaultPolicy: policy,
+        updatedAt: new Date().toISOString(),
+    });
+    await maybeImportSecrets(importSource, {
+        bundle: opts.bundle,
+        vault: opts.vault,
+        backend,
+        force: opts.force,
+    });
+    printOnboardingSummary(backend, policy, prefsFile);
+    return true;
+}
+/** Register `agents setup secrets` under the parent `setup` command. */
+export function registerSetupSecretsCommand(setupCmd) {
+    setupCmd
+        .command('secrets')
+        .description('Configure `agents secrets` defaults and optionally import existing secrets.')
+        .option('--backend <backend>', 'default backend: keychain, file, or vault')
+        .option('--policy <policy>', 'default prompt policy: daily, always, or never')
+        .option('--import-from <source>', 'optional import source: none, env, 1password, or icloud')
+        .option('--bundle <name>', 'bundle name for optional imports')
+        .option('--vault <name-or-path>', '1Password vault name, or .env path with --import-from env')
+        .option('--i-understand', 'allow saving the "never" policy preference without an interactive prompt')
+        .option('--force', 'pass --force through to optional imports')
+        .action(async (options) => {
+        try {
+            await runSecretsSetupWizard(options);
+        }
+        catch (err) {
+            if (isPromptCancelled(err)) {
+                console.log(chalk.yellow('\nCancelled'));
+                return;
+            }
+            console.error(chalk.red(err.message));
+            process.exitCode = 1;
+        }
+    });
+}

package/dist/commands/setup.js

@@ -22,6 +22,8 @@ import { registerSetupBrowserCommand, runBrowserWizard } from './setup-browser.j
 import { registerSetupComputerCommand, runComputerWizard } from './setup-computer.js';
 import { registerSetupShareCommand, runShareWizard } from './setup-share.js';
 import { registerSetupMineCommand } from './setup-mine.js';
+import { registerSetupSecretsCommand } from './setup-secrets.js';
+import { registerSetupFleetCommand } from './setup-fleet.js';
 const HOME = os.homedir();
 /**
  * Import an existing unmanaged agent installation into agents-cli.
@@ -247,6 +249,8 @@ async function runSetupHub() {
                 { name: 'browser  — drive a real Chrome/Brave/Edge for web automation', value: 'browser' },
                 { name: 'computer — control native macOS apps (screenshot, click, type)', value: 'computer' },
                 { name: 'share    — publish shareable links (Cloudflare R2 + Worker)', value: 'share' },
+                { name: 'secrets  — choose storage defaults and import existing credentials', value: 'secrets' },
+                { name: 'fleet    — discover Tailscale devices and configure SSH access', value: 'fleet' },
             ],
         });
         for (const pick of picks) {
@@ -257,6 +261,10 @@ async function runSetupHub() {
                 await runComputerWizard();
             else if (pick === 'share')
                 await runShareWizard();
+            else if (pick === 'secrets')
+                await import('./setup-secrets.js').then((m) => m.runSecretsSetupWizard());
+            else if (pick === 'fleet')
+                await import('./setup-fleet.js').then((m) => m.runFleetSetupWizard());
         }
     }
     catch (err) {
@@ -272,11 +280,13 @@ export function registerSetupCommand(program) {
         .description('First-time setup. Clones a config repo and installs agent CLIs.')
         .option('-f, --force', 'Re-run setup even if ~/.agents/.system/ already exists (use with caution)')
         .option('--no-system-repo', 'Skip cloning the system repo (you must populate ~/.agents/.system/ yourself)');
-    // Capability subcommands: `agents setup browser|computer|share|mine`.
+    // Capability subcommands: `agents setup browser|computer|share|mine|secrets|fleet`.
     registerSetupBrowserCommand(setupCmd);
     registerSetupComputerCommand(setupCmd);
     registerSetupShareCommand(setupCmd);
     registerSetupMineCommand(setupCmd);
+    registerSetupSecretsCommand(setupCmd);
+    registerSetupFleetCommand(setupCmd);
     setHelpSections(setupCmd, {
         examples: `
       # First-time setup (clones the system repo into ~/.agents/.system/)
@@ -289,20 +299,24 @@ export function registerSetupCommand(program) {
       agents setup browser
       agents setup computer
       agents setup share
+      agents setup secrets
+      agents setup fleet
     `,
         notes: `
       What it does:
         1. Clones the system repo into ~/.agents/.system/
         2. Imports any unmanaged agent installations it finds
-        3. On a TTY, offers to set up optional capabilities (browser/computer/share)
+        3. On a TTY, offers to set up optional capabilities (browser/computer/share/secrets/fleet)
 
       Capability setup can also be run any time on its own:
         agents setup browser    # detect a browser + create the default profile
         agents setup computer    # install the signed macOS helper + grant permissions
         agents setup share       # provision or join a Cloudflare share endpoint
+        agents setup secrets     # choose secrets backend/policy defaults + import
+        agents setup fleet       # discover Tailscale devices + configure SSH access
 
       To install CLIs from agents.yaml and sync resources into version homes:
-        agents repo refresh -y
+        agents sync --local -y
     `,
     });
     setupCmd.action(async (options) => {

package/dist/commands/skills.js

@@ -81,7 +81,7 @@ When to use:
     skillsCmd
         .command('add [source]')
         .description('Install skills from a source (GitHub, local) or pick from central storage')
-        .option('-a, --agents <list>', 'Targets: claude, codex@0.116.0, or gemini@default')
+        .option('-a, --agents <list>', 'Targets: claude, codex@0.116.0, or antigravity@default')
         .option('--names <list>', 'Skill names from ~/.agents/skills/ (comma-separated)')
         .option('-y, --yes', 'Skip all prompts')
         .addHelpText('after', `

package/dist/commands/sync.js

@@ -31,7 +31,7 @@
  */
 import * as path from 'path';
 import chalk from 'chalk';
-import { agentLabel, resolveAgentName, ALL_AGENT_IDS } from '../lib/agents.js';
+import { agentLabel, resolveAgentName, MANAGED_AGENT_IDS, isAgentHardDeprecated, hardDeprecationError } from '../lib/agents.js';
 import { isVersionInstalled, syncResourcesToVersion, parseAgentSpec, resolveVersion, resolveVersionAlias, listInstalledVersions, getAvailableResources, getActuallySyncedResources, getProjectOnlyResources, getNewResources, hasNewResources, promptResourceSelection, promptNewResourceSelection, buildRepoScopedSelection, mergeRepoScopedSelections, listRepoNames, getVersionHomePath, } from '../lib/versions.js';
 import { capableAgents } from '../lib/capabilities.js';
 import { parseHookManifest, registerHooksToSettings } from '../lib/hooks.js';
@@ -128,7 +128,7 @@ function repoChoiceLabel(repo) {
 async function runInteractiveReconcile(opts, outLog, errLog) {
     const { checkbox } = await import('@inquirer/prompts');
     const cwd = opts.cwd || process.cwd();
-    const installedAgents = ALL_AGENT_IDS.filter((a) => listInstalledVersions(a).length > 0);
+    const installedAgents = MANAGED_AGENT_IDS.filter((a) => listInstalledVersions(a).length > 0);
     if (installedAgents.length === 0) {
         errLog(chalk.red('No agents installed. Install one: agents add claude@latest'));
         process.exitCode = 1;
@@ -311,6 +311,11 @@ async function runSync(agentSpec, repoArg, opts) {
         }
         agentId = resolved;
     }
+    if (agentId && isAgentHardDeprecated(agentId)) {
+        errLog(chalk.red(hardDeprecationError(agentId)));
+        process.exitCode = 1;
+        return;
+    }
     if (opts.agentVersion) {
         // Legacy flag and the launch-shim hot path (`--agent-version <concrete>`):
         // pass through verbatim. Selector aliases are a positional-spec feature.

package/dist/commands/teams-picker.js

@@ -12,7 +12,6 @@ import { itemPicker } from '../lib/picker.js';
 const AGENT_LABEL = {
     claude: 'Claude',
     codex: 'Codex',
-    gemini: 'Gemini',
     cursor: 'Cursor',
     opencode: 'OpenCode',
 };