@phnx-labs/agents-cli 1.20.78 → 1.20.83

package/README.md

@@ -94,7 +94,7 @@ agents:
   codex: "0.116.0"
 ```
 
-Think `requirements.txt` for CLI coding agents, on steroids. A shim reads `agents.yaml` from the project root and routes `claude` / `codex` / `gemini` / `grok` (and others) to the right version automatically. Each version gets its own isolated home -- switching backs up config and re-syncs resources.
+Think `requirements.txt` for CLI coding agents, on steroids. A shim reads `agents.yaml` from the project root and routes `claude` / `codex` / `antigravity` / `grok` (and others) to the right version automatically. Each version gets its own isolated home -- switching backs up config and re-syncs resources.
 
 ```bash
 agents add claude@2.0.65     # Install a specific version
@@ -111,7 +111,7 @@ agents view                   # See everything installed
 # Set up the Notion MCP server once.
 agents install mcp:com.notion/mcp
 
-# It's now registered with Claude Code, Codex, Gemini CLI, and Cursor.
+# It's now registered with Claude Code, Codex, Antigravity, and Cursor.
 agents mcp list
 ```
 
@@ -120,25 +120,25 @@ Skills, slash commands, rules, hooks, and permissions work the same way -- insta
 ```bash
 agents skills add gh:yourteam/python-expert     # Knowledge pack -> all agents
 agents commands add gh:yourteam/commands         # Slash commands -> all agents
-agents rules add gh:team/rules                   # AGENTS.md -> CLAUDE.md, GEMINI.md, .cursorrules
+agents rules add gh:team/rules                   # AGENTS.md -> per-agent instruction files
 agents permissions add ./perms                   # Permissions -> auto-converted per agent
 ```
 
-Write one `AGENTS.md`. It becomes `CLAUDE.md` for Claude Code, `GEMINI.md` for Gemini CLI, `.cursorrules` for Cursor.
+Write one `AGENTS.md`. It becomes `CLAUDE.md` for Claude Code, `AGENTS.md` for Antigravity, and `.cursorrules` for Cursor.
 
 ---
 
 ## Run any agent
 
 <p align="center">
-  <img src="assets/run-agent.svg" alt="agents run: one command runs any harness (claude/codex/gemini) against the project-pinned version, with an automatic rate-limit fallback chain." width="100%" />
+  <img src="assets/run-agent.svg" alt="agents run: one command runs any harness (claude/codex/antigravity) against the project-pinned version, with an automatic rate-limit fallback chain." width="100%" />
 </p>
 
 
 ```bash
 agents run claude "Find all auth vulnerabilities in src/"
 agents run codex "Fix the issues Claude found"
-agents run gemini "Write tests for the fixed code"
+agents run antigravity "Write tests for the fixed code"
 ```
 
 Each resolves to the project-pinned version with skills, MCP servers, and permissions already synced. Single-typo names auto-correct across every command — `agents view cladue` resolves to `claude`, `agents add codx@latest` to `codex`.
@@ -147,7 +147,7 @@ Each resolves to the project-pinned version with skills, MCP servers, and permis
 
 ```bash
 # Claude Code hits a rate limit -> Codex picks up automatically. Same project, same config.
-agents run claude "refactor auth module" --mode edit --fallback codex,gemini
+agents run claude "refactor auth module" --mode edit --fallback codex,antigravity
 ```
 
 ### Multiple accounts? Spread the load.
@@ -165,7 +165,7 @@ agents run codex@ "review this branch"
 
 A trailing `@` opens an account picker before either an interactive or prompt-based run. Each installed version shows its account identity, exact version, login state, plan, and every available session, weekly, or monthly limit. Logged-out, rate-limited, and out-of-credit accounts remain visible with the reason they cannot be selected; signed-in accounts whose provider does not expose quota data stay selectable and say `limits unavailable`. The choice pins only that run and does not change your default version.
 
-Account selection is available for Claude, Codex, Gemini, Grok, Antigravity, Kimi, Droid, and OpenCode. It requires a terminal and cannot be combined with `--resume`, `--strategy`/`--balanced`, `--lease`, or `--host`/`--device`; profiles and workflows must use their concrete host agent instead.
+Account selection is available for Claude, Codex, Antigravity, Grok, Kimi, Droid, and OpenCode. It requires a terminal and cannot be combined with `--resume`, `--strategy`/`--balanced`, `--lease`, or `--host`/`--device`; profiles and workflows must use their concrete host agent instead.
 
 ### Chain agents
 
@@ -218,21 +218,21 @@ agents run claude "review this diff" --acp --json
 
 `--acp` routes through the [Agent Client Protocol](https://github.com/zed-industries/agent-client-protocol) so you get a unified event stream -- `agent_message_chunk`, `tool_call`, `plan_update`, `stop_reason` -- instead of writing a parser per CLI. File writes and shell commands flow through agents-cli, which means `--mode plan` becomes a real sandbox: the write RPC is denied, not just unused.
 
-ACP adapters are documented for claude, codex, gemini, cursor, opencode, openclaw, and grok. Other harnesses keep running on the direct-exec path.
+ACP adapters are documented for claude, codex, cursor, opencode, openclaw, and grok. Other harnesses keep running on the direct-exec path.
 
 ---
 
 ## Sessions across agents
 
 <p align="center">
-  <img src="assets/sessions.svg" alt="agents sessions: search transcripts across Claude, Codex, Gemini, and OpenCode at once, plus a live --active panel showing each running session's state (working / waiting / idle)." width="100%" />
+  <img src="assets/sessions.svg" alt="agents sessions: search transcripts across Claude, Codex, legacy Gemini, and OpenCode at once, plus a live --active panel showing each running session's state (working / waiting / idle)." width="100%" />
 </p>
 
 
 When you run multiple agents, conversations scatter across tools. Session search brings them together.
 
 ```bash
-# Where was that auth conversation? Search Claude Code, Codex, Gemini CLI, OpenCode at once.
+# Where was that auth conversation? Search Claude Code, Codex, legacy Gemini, OpenCode at once.
 agents sessions "auth middleware"
 
 # Filter by agent, project, or time window
@@ -306,7 +306,7 @@ agents sessions detach a1b2c3d4     # go headless in the background, keep workin
 agents sessions attach a1b2c3d4     # resume it interactively, right here
 ```
 
-Both are agent-agnostic -- they route through the same `agents run --resume` path (native resume for Claude/Codex, `/continue` replay for the rest). `agents sessions --active` marks each session's `presence` -- `attached` (you're watching it), `background` (running headless), or `parked` (its background run finished) -- so the menu bar and Factory show where every agent is. In the Factory extension, **Agents: Detach** (`Cmd/Ctrl+K B`) and **Agents: Attach** (`Cmd/Ctrl+K A`) do the same over the focused terminal.
+Both are agent-agnostic -- they route through the same `agents run --resume` path (native resume for Claude/Codex, `/continue` replay for the rest). `agents sessions --active` shows each session's **owner** (the human who launched it, resolved from the tailnet identity, or `-` for an unresolved local run) and its `presence` -- `attached` (you're watching it), `background` (running headless), or `parked` (its background run finished) -- so the menu bar and Factory show who is running what, and where. In the Factory extension, **Agents: Detach** (`Cmd/Ctrl+K B`) and **Agents: Attach** (`Cmd/Ctrl+K A`) do the same over the focused terminal.
 
 ---
 
@@ -366,7 +366,7 @@ One machine is set up the way you like it. Make every other machine match -- sam
 fleet:
   devices: all              # every online registered device (minus this one)
   defaults:
-    agents: [claude@latest, codex@latest, gemini@latest]
+    agents: [claude@latest, codex@latest, antigravity@latest]
     sync: [user]            # config scopes to reconcile
     login: sync             # propagate logins where the token is portable
 ```
@@ -379,7 +379,7 @@ agents apply --only agents,config   # limit dimensions (agents, config, login)
 agents apply --no-login             # skip login propagation
 ```
 
-`agents apply` (`ag apply`) probes every target over the existing SSH transport, then reconciles it to the profile: installs missing agents, upgrades `agents-cli`, syncs the named config scopes, and **propagates logins** so a host signed in once seeds the fleet -- turning "6 hosts x 8 harnesses = 48 OAuth flows" into one. Portable credential files (claude, codex, gemini, grok, kimi, opencode, droid, antigravity) stream to each target over encrypted SSH stdin, never shell-interpolated, and land at `0600`. **Honest boundary:** macOS keychain-bound tokens (claude, antigravity on a Mac target) can't be extracted -- those surface as a one-time manual login, never faked. `--plan` / `--dry-run` shows the full matrix without touching anything.
+`agents apply` (`ag apply`) probes every target over the existing SSH transport, then reconciles it to the profile: installs missing agents, upgrades `agents-cli`, syncs the named config scopes, and **propagates logins** so a host signed in once seeds the fleet -- turning "6 hosts x 8 harnesses = 48 OAuth flows" into one. Portable credential files (claude, codex, grok, kimi, opencode, droid, antigravity) stream to each target over encrypted SSH stdin, never shell-interpolated, and land at `0600`. **Honest boundary:** macOS keychain-bound tokens (claude, antigravity on a Mac target) can't be extracted -- those surface as a one-time manual login, never faked. `--plan` / `--dry-run` shows the full matrix without touching anything.
 
 See [docs/fleet.md](apps/cli/docs/fleet.md) for the manifest schema and reconcile semantics.
 
@@ -445,6 +445,9 @@ agents run claude --host gpu-box                         # no prompt → interac
 agents run claude --host gpu-box --copy-creds "fix auth" # copy local runtime creds + Claude token, shred after
 agents run claude --device auto "…"                      # affinity-pick host from 14d usage (harness stays claude)
 agents run claude --host auto "…"                        # same — auto is a host value, not a harness name
+agents view kimi --device all                            # fan out across every registered device (grouped-by-OS roster)
+agents output --device all                               # per-device burn vs shipped output across the fleet
+agents view --device all --json                          # machine-readable fleet inventory
 agents hosts ps                         # list dispatched runs + terminal status
 agents hosts stop <id>                  # terminate a hung/detached run (alias: kill)
 agents logs --host gpu-box              # pick a dispatched run — concise summary by default
@@ -459,7 +462,7 @@ agents fleet status                     # online/offline rollup + NEEDS ATTENTIO
 agents fleet status --verbose           # full per-device auth/CLI/sync/version grid
 agents fleet status --live              # force a live resource probe (alias of --refresh)
 agents fleet status --json --strict     # scriptable fleet health gate
-agents check --devices                  # CI drift gate across every registered device
+agents doctor --check --devices         # CI drift gate across every registered device
 
 # Your Tailscale fleet, auto-discovered
 agents devices sync                     # ingest `tailscale status`
@@ -986,7 +989,7 @@ Two repos with the same shape, different roles:
 
 **Version pinning:** `agents.yaml` at project root pins which agent version to use (like `.nvmrc` for Node).
 
-**Resource resolution:** When syncing resources (commands, skills, rules, hooks, MCP, permissions), the order is **project > user > system**. A `.agents/` directory at project root wins, then `~/.agents/`, then `~/.agents-system/`. Same-named resources higher in the chain override lower ones; everything else unions in. Run `agents resources --merged` to see the effective skills, commands, MCP servers, hooks, rules, plugins, workflows, and subagents, with each row tagged by its winning layer.
+**Resource resolution:** When syncing resources (commands, skills, rules, hooks, MCP, permissions), the order is **project > user > system**. A `.agents/` directory at project root wins, then `~/.agents/`, then `~/.agents-system/`. Same-named resources higher in the chain override lower ones; everything else unions in. Run `agents view --merged` to see the effective skills, commands, MCP servers, hooks, rules, plugins, workflows, and subagents, with each row tagged by its winning layer.
 
 See [docs/00-concepts.md](apps/cli/docs/00-concepts.md) for the full mental model: DotAgents repos, resource kinds, and how resolution works end-to-end.
 
@@ -1069,7 +1072,7 @@ Every agent run, version install, browser launch, and secrets access is logged t
 
 ### Session search
 
-Conversations with Claude, Codex, Gemini, and other agents scatter across their native storage. Session search indexes them locally so you can find any conversation:
+Conversations with Claude, Codex, legacy Gemini, and other agents scatter across their native storage. Session search indexes them locally so you can find any conversation:
 
 ```bash
 agents sessions "auth middleware"     # Full-text search across all agents
@@ -1104,13 +1107,12 @@ By default, secrets sync via iCloud Keychain to your other Macs. With `--no-iclo
 
 Which DotAgents resources each agent CLI can load. Source of truth: [src/lib/agents.ts](apps/cli/src/lib/agents.ts) (`capabilities`); gates use `supports(agent, cap, version)` from [src/lib/capabilities.ts](apps/cli/src/lib/capabilities.ts). Full matrix also in [docs/00-concepts.md](apps/cli/docs/00-concepts.md).
 
-> **† Gemini CLI is deprecated.** Google retired it for free, Pro, and Ultra tiers on **June 18, 2026** (announced at Google I/O 2026); the `gemini` command no longer serves requests on those tiers. agents-cli still manages existing installs, but warns on `agents add gemini` and `agents teams add … gemini`. New setups should use **Antigravity CLI** (`antigravity`), Google's official successor — see [the transition notice](https://developers.googleblog.com/an-important-update-transitioning-gemini-cli-to-antigravity-cli/).
+> **Gemini CLI is hard-deprecated.** Google retired it for free, Pro, and Ultra tiers on **June 18, 2026** (announced at Google I/O 2026); the `gemini` command no longer serves requests on those tiers. agents-cli keeps the legacy `gemini` id only so old sessions/config can still be read. `agents add gemini`, `agents import gemini`, and `agents sync gemini` fail and point to **Antigravity CLI** (`antigravity`), Google's official successor — see [the transition notice](https://developers.googleblog.com/an-important-update-transitioning-gemini-cli-to-antigravity-cli/).
 
 | Agent | Versions | Hooks | MCP | Permissions | Skills | Commands | Plugins | Subagents | Rules | Workflows |
 |-------|----------|-------|-----|-------------|--------|----------|---------|-----------|-------|-----------|
 | Claude Code | yes | yes | yes | yes | yes | yes | yes | yes | `CLAUDE.md` | yes |
 | Codex CLI | yes | >= 0.116.0 | yes | no | yes | < 0.117.0 · skills ($name, >= 0.117) | >= 0.128.0 | no | `AGENTS.md` | no |
-| Gemini CLI † | yes | >= 0.26.0 | yes | no | yes | yes (.toml) | no | no | `GEMINI.md` | no |
 | Antigravity | yes | yes | yes | yes | yes | yes | yes | no | `AGENTS.md` | no |
 | Grok Build | yes | yes | yes | yes | yes | skills ($name) | yes | no | `AGENTS.md` | no |
 | OpenClaw | yes | yes | yes | no | yes | gateway | yes | yes | `workspace/AGENTS.md` | no |
@@ -1133,7 +1135,6 @@ Which DotAgents resources each agent CLI can load. Source of truth: [src/lib/age
 |-------|----------|-------|---------------|
 | Claude Code | yes | yes | yes |
 | Codex CLI | yes | yes | yes |
-| Gemini CLI † | yes | yes | yes |
 | Cursor | -- | yes | -- |
 | OpenCode | -- | yes | -- |
 | Grok Build | -- | yes | yes |
@@ -1150,20 +1151,19 @@ Which DotAgents resources each agent CLI can load. Source of truth: [src/lib/age
 | Subagents | Kiro | >= 1.23.0 |
 | Skills | Droid | >= 0.26.0 |
 | Permissions | Droid | >= 0.57.5 |
-| Hooks | Gemini | >= 0.26.0 |
 | Permissions | Kiro | >= 2.8.0 |
 | File-based commands | Codex | < 0.117.0 (0.117+ uses command-as-skill) |
 | Plugins | Codex | >= 0.128.0 |
 
 Codex `0.117.0+` no longer reads `.codex/prompts/`; agents-cli converts slash commands into skills so they stay invocable as `$name`. OpenCode's plugin-based hook system is on the roadmap; hooks stay `no` until a writer ships.
 
-Slash commands can declare per-agent/version targeting in frontmatter (`agents:`, `since:`, `until:`). Gating applies when syncing from `~/.agents/commands/` (user/system) into version homes — project `.agents/commands/` files are read in place and are not filtered by `agents:`. This repo ships `.agents/commands/version.md` as `/version` for Claude, Codex, Gemini, Cursor, OpenCode, Copilot, and Grok; Antigravity excluded until verified.
+Slash commands can declare per-agent/version targeting in frontmatter (`agents:`, `since:`, `until:`). Gating applies when syncing from `~/.agents/commands/` (user/system) into version homes — project `.agents/commands/` files are read in place and are not filtered by `agents:`. This repo ships `.agents/commands/version.md` as `/version` for Claude, Codex, Cursor, OpenCode, Copilot, and Grok; Antigravity excluded until verified.
 
 ## FAQ
 
-### Why use `agents` instead of `claude` / `codex` / `gemini` directly?
+### Why use `agents` instead of `claude` / `codex` / `antigravity` directly?
 
-Claude Code, Codex CLI, Gemini CLI, Grok Build, and others each have their own config format, MCP setup, version management, and skill system. If you use more than one, you maintain N copies of everything. `agents` gives you one interface, one config source, and one place to pin versions -- plus features the individual CLIs don't ship: cross-agent pipelines, shared teams, unified session search, and project-pinned versions like `.nvmrc`.
+Claude Code, Codex CLI, Antigravity, Grok Build, and others each have their own config format, MCP setup, version management, and skill system. If you use more than one, you maintain N copies of everything. `agents` gives you one interface, one config source, and one place to pin versions -- plus features the individual CLIs don't ship: cross-agent pipelines, shared teams, unified session search, and project-pinned versions like `.nvmrc`.
 
 ### Is it free?
 
@@ -1181,9 +1181,9 @@ Same approach as nvm, pyenv, and rbenv — battle-tested by millions of develope
 
 Add a `.agents/` directory at your project root with your skills, hooks, rules, and commands. Resources merge automatically: project > user (`~/.agents/`) > system (`~/.agents-system/`). Commit it with your repo and teammates get the same agent environment.
 
-### Do I need to write separate rules for each agent (CLAUDE.md, GEMINI.md, etc.)?
+### Do I need to write separate rules for each agent (CLAUDE.md, .cursorrules, etc.)?
 
-No. Write one `AGENTS.md` — it's the canonical source. We automatically sync it to each agent's expected location (`CLAUDE.md` for Claude Code, `GEMINI.md` for Gemini CLI, `.cursorrules` for Cursor). Same content, zero duplication.
+No. Write one `AGENTS.md` — it's the canonical source. We automatically sync it to each agent's expected location (`CLAUDE.md` for Claude Code, `AGENTS.md` for Antigravity, `.cursorrules` for Cursor). Same content, zero duplication.
 
 ### Do agents use API keys or subscriptions?
 

package/dist/commands/activity.d.ts

@@ -7,6 +7,15 @@
  * hook time by 11-activity-log.py, so this reader never re-parses transcripts --
  * it tails the logs and collapses routine work to counts, surfacing milestones
  * individually and newest-first.
+ *
+ * Fleet-wide by opt-in: `--devices-all` (or `--host <box>`) fans the same
+ * `activity --json` payload out across the fleet the way `agents feed` does,
+ * merges every peer's stream host-tagged, and joins each item to live sessions
+ * (project / ticket / execution host) so `--group-by project` shows, per
+ * project, what each agent did, where, and for which ticket -- progress at a
+ * glance. Local-only stays the default.
  */
 import type { Command } from 'commander';
+/** Recursion guard: a peer answering a fan-out never re-fans-out itself. */
+export declare const ACTIVITY_NO_FANOUT_ENV = "AGENTS_ACTIVITY_LOCAL";
 export declare function registerActivityCommand(program: Command): void;

package/dist/commands/activity.js

@@ -1,5 +1,12 @@
 import chalk from 'chalk';
-import { collapseActivity, ensureActivityLogHook, formatActivityLine, readRecentActivity, styleForEvent, tierForEvent, } from '../lib/activity.js';
+import { collapseActivity, enrichActivityEvents, ensureActivityLogHook, filterActivityEvents, formatActivityGroupHeader, formatEnrichedActivityLine, formatProgressUpdate, groupActivity, mergeActivityEvents, parseActivityPayload, projectFromCwd, readRecentActivity, styleForEvent, tierForEvent, } from '../lib/activity.js';
+import { gatherRemoteAgentsJson } from '../lib/remote-agents-json.js';
+import { machineId, normalizeHost } from '../lib/machine-id.js';
+import { shouldIncludeLocalFeed, remoteFeedHostsToDial } from './feed.js';
+import { getActiveSessions } from '../lib/session/active.js';
+/** Recursion guard: a peer answering a fan-out never re-fans-out itself. */
+export const ACTIVITY_NO_FANOUT_ENV = 'AGENTS_ACTIVITY_LOCAL';
+const GROUP_BY_VALUES = ['project', 'device', 'agent'];
 /** Wire the activity-log hooks into each hooks-capable version's settings. */
 async function installActivityHooks() {
     const warnings = [];
@@ -20,49 +27,171 @@ async function installActivityHooks() {
     }
     return warnings;
 }
+/** Session facts (project / ticket / execution host) keyed for the read-time join. */
+function activityHintsFromSessions(sessions) {
+    return sessions.map((s) => ({
+        sessionId: s.sessionId,
+        ticket: s.ticket?.id,
+        // Where the process actually lives — the SSH-resolved provenance host, else
+        // the cross-machine `machine` id. Normalized to match the event `host` form.
+        executionHost: s.provenance?.host ? normalizeHost(s.provenance.host) : s.machine,
+        project: projectFromCwd(s.cwd),
+    }));
+}
+/**
+ * Render one enriched event. Deliberate progress posts (`status.posted`) use the
+ * rich multi-line {@link formatProgressUpdate} (joining the ticket the event's
+ * session carries); every other milestone keeps the compact enriched line.
+ */
+function renderEnrichedEntry(ev, opts = {}) {
+    if (ev.event === 'status.posted') {
+        const body = formatProgressUpdate(ev, { joined: { ticketId: ev.ticket } });
+        return opts.indent ? body.split('\n').map((l) => `${opts.indent}${l}`).join('\n') : body;
+    }
+    return formatEnrichedActivityLine(ev, opts);
+}
+/** Print one flat, newest-first stream (the default view). */
+function renderFlat(events, opts) {
+    const { milestones, counts, subagentCount } = collapseActivity(events);
+    process.stdout.write(chalk.bold('\n  recent activity\n'));
+    const shown = opts.all ? events : milestones;
+    for (const ev of shown) {
+        process.stdout.write(`${renderEnrichedEntry(ev, { showHost: true, showProject: true })}\n`);
+    }
+    if (!opts.all) {
+        const parts = Object.entries(counts)
+            .sort((a, b) => b[1] - a[1])
+            .map(([event, n]) => `${styleForEvent(event).label} ×${n}`);
+        if (parts.length > 0)
+            process.stdout.write(chalk.gray(`\n  · ${parts.join('  ')}\n`));
+    }
+    if (subagentCount > 0) {
+        process.stdout.write(chalk.magenta(`\n  ⑂ ${subagentCount} sub-agent${subagentCount === 1 ? '' : 's'} spawned\n`));
+    }
+    process.stdout.write('\n');
+}
+/** Print the bucketed view (`--group-by project|device|agent`). */
+function renderGrouped(events, by, opts) {
+    const groups = groupActivity(events, by);
+    // The grouping dimension is redundant on each line -- drop it from the tags.
+    const showHost = by !== 'device';
+    const showProject = by !== 'project';
+    process.stdout.write(chalk.bold(`\n  activity by ${by}\n`));
+    for (const group of groups) {
+        process.stdout.write(`\n  ${chalk.bold(formatActivityGroupHeader(group))}\n`);
+        const { milestones, counts, subagentCount } = collapseActivity(group.events);
+        const shown = opts.all ? group.events : milestones;
+        for (const ev of shown) {
+            process.stdout.write(`${renderEnrichedEntry(ev, { showHost, showProject, indent: '  ' })}\n`);
+        }
+        if (!opts.all) {
+            const parts = Object.entries(counts)
+                .sort((a, b) => b[1] - a[1])
+                .map(([event, n]) => `${styleForEvent(event).label} ×${n}`);
+            if (parts.length > 0)
+                process.stdout.write(chalk.gray(`    · ${parts.join('  ')}\n`));
+        }
+        if (subagentCount > 0) {
+            process.stdout.write(chalk.magenta(`    ⑂ ${subagentCount} sub-agent${subagentCount === 1 ? '' : 's'} spawned\n`));
+        }
+    }
+    process.stdout.write('\n');
+}
 export function registerActivityCommand(program) {
     program
         .command('activity')
         .description('Recent agent activity -- plans, PRs, worktrees, sub-agents (newest first)')
-        .option('--json', 'Emit the raw event list as JSON')
+        .option('--json', 'Emit the (enriched) event list as JSON')
         .option('--all', 'Include routine activity (file edits) inline, not collapsed')
         .option('--milestones', 'Only milestone events (plans, PRs, worktrees, sub-agents)')
         .option('-n, --limit <n>', 'Cap the number of events shown', (v) => parseInt(v, 10), 40)
         .option('--since <minutes>', 'Only events within the last N minutes', (v) => parseInt(v, 10))
+        .option('--local', 'Only this machine -- skip the cross-machine SSH fan-out')
+        .option('-H, --host <target...>', 'Scope to remote machine(s) over SSH; repeatable')
+        .option('--device <target...>', 'Alias for --host; repeatable')
+        .option('--devices-all', 'Fan out to every reachable device on the fleet')
+        .option('--hosts-all', 'Alias for --devices-all')
+        .option('--group-by <field>', 'Bucket the stream by project | device | agent')
+        .option('--filter <text>', 'Narrow to items matching a project / device / agent / event / ticket')
+        .addHelpText('after', `
+Examples:
+  agents activity                              # this machine, newest first
+  agents activity --devices-all --group-by project   # per project across the fleet
+  agents activity --host yosemite-s1           # one box over SSH
+  agents activity --devices-all --filter RUSH-2100   # one ticket, fleet-wide
+  agents activity --milestones                 # only plans / PRs / worktrees / sub-agents
+
+Each item is enriched by JOINING to live sessions (project, execution host,
+Linear ticket) -- never by re-parsing transcripts. --devices-all runs the same
+'activity --json' on each peer and merges the streams host-tagged.
+`)
         .action(async (opts) => {
-        const warnings = await installActivityHooks();
+        if (opts.device?.length)
+            opts.host = [...(opts.host ?? []), ...opts.device];
+        const groupBy = opts.groupBy;
+        if (groupBy && !GROUP_BY_VALUES.includes(groupBy)) {
+            process.stderr.write(chalk.red(`--group-by must be one of: ${GROUP_BY_VALUES.join(', ')}\n`));
+            process.exitCode = 1;
+            return;
+        }
+        const self = machineId();
+        const forceLocal = opts.local === true || process.env[ACTIVITY_NO_FANOUT_ENV] === '1';
+        const explicitHosts = opts.host;
+        const wantAll = Boolean(opts.devicesAll || opts.hostsAll);
+        const wantRemote = !forceLocal && (wantAll || (explicitHosts != null && explicitHosts.length > 0));
+        // Local events are included unless an explicit --host list excludes this box.
+        let includeLocal = true;
+        if (wantRemote && explicitHosts && explicitHosts.length > 0) {
+            includeLocal = shouldIncludeLocalFeed(explicitHosts, self);
+        }
+        const warnings = includeLocal ? await installActivityHooks() : [];
         const sinceMs = typeof opts.since === 'number' && opts.since > 0
             ? Date.now() - opts.since * 60_000
             : undefined;
-        let events = readRecentActivity({ sinceMs, limit: opts.limit });
+        let events = includeLocal
+            ? readRecentActivity({ sinceMs, limit: opts.limit })
+            : [];
+        if (wantRemote) {
+            // Explicit hosts drop self (it's the local read); --devices-all dials
+            // every online peer (hosts undefined).
+            const remoteHosts = explicitHosts?.length ? remoteFeedHostsToDial(explicitHosts, self) : undefined;
+            if (!explicitHosts?.length || (remoteHosts && remoteHosts.length > 0)) {
+                const remoteArgs = ['activity', '--json', '-n', String(opts.limit)];
+                if (typeof opts.since === 'number' && opts.since > 0)
+                    remoteArgs.push('--since', String(opts.since));
+                const remote = await gatherRemoteAgentsJson({
+                    args: remoteArgs,
+                    noFanoutEnv: ACTIVITY_NO_FANOUT_ENV,
+                    hosts: remoteHosts,
+                    parse: parseActivityPayload,
+                });
+                events = mergeActivityEvents(events, remote.items);
+            }
+        }
+        // Enrich by joining to live LOCAL sessions (ticket/project/execution host).
+        // Remote events arrive already enriched by their own peer, so the join only
+        // fills local ones; the pure fallbacks (cwd->project, host->device) cover
+        // everything either way. Skip the ps/lsof scan when there's nothing to show.
+        const sessions = includeLocal && events.length > 0 ? await getActiveSessions() : [];
+        let enriched = enrichActivityEvents(events, activityHintsFromSessions(sessions));
         if (opts.milestones)
-            events = events.filter((e) => tierForEvent(e.event) === 'milestone');
+            enriched = enriched.filter((e) => tierForEvent(e.event) === 'milestone');
+        if (opts.filter)
+            enriched = filterActivityEvents(enriched, opts.filter);
+        enriched = enriched.slice(0, opts.limit);
         if (opts.json) {
-            process.stdout.write(`${JSON.stringify(events, null, 2)}\n`);
+            process.stdout.write(`${JSON.stringify(enriched, null, 2)}\n`);
             return;
         }
         for (const w of warnings)
             process.stderr.write(chalk.yellow(`  ! ${w}\n`));
-        if (events.length === 0) {
+        if (enriched.length === 0) {
             process.stdout.write(chalk.gray('No recent agent activity. Events appear here as agents create plans, open PRs, and spawn sub-agents.\n'));
             return;
         }
-        const { milestones, counts, subagentCount } = collapseActivity(events);
-        process.stdout.write(chalk.bold('\n  recent activity\n'));
-        const shown = opts.all ? events : milestones;
-        for (const ev of shown)
-            process.stdout.write(`${formatActivityLine(ev, { showHost: true })}\n`);
-        if (!opts.all) {
-            const parts = Object.entries(counts)
-                .sort((a, b) => b[1] - a[1])
-                .map(([event, n]) => `${styleForEvent(event).label} ×${n}`);
-            if (parts.length > 0) {
-                process.stdout.write(chalk.gray(`\n  · ${parts.join('  ')}\n`));
-            }
-        }
-        if (subagentCount > 0) {
-            process.stdout.write(chalk.magenta(`\n  ⑂ ${subagentCount} sub-agent${subagentCount === 1 ? '' : 's'} spawned\n`));
-        }
-        process.stdout.write('\n');
+        if (groupBy)
+            renderGrouped(enriched, groupBy, opts);
+        else
+            renderFlat(enriched, opts);
     });
 }

package/dist/commands/apply.js

@@ -17,7 +17,7 @@ import { machineId } from '../lib/session/sync/config.js';
 import { loadDevices, isControlDevice } from '../lib/devices/registry.js';
 import { ensureDevicesRegistered } from '../lib/devices/sync.js';
 import { readFleetFile, resolveDesired } from '../lib/fleet/manifest.js';
-import { snapshotAuth, materializeAuth, parseAuthBundle, KEYCHAIN_BOUND_ON_MAC } from '../lib/fleet/auth-sync.js';
+import { snapshotAuth, materializeAuth, parseAuthBundle, KEYCHAIN_BOUND_ON_MAC, isCredentialSafeToPropagate } from '../lib/fleet/auth-sync.js';
 import { agentIdOf, diffFleet, probeDevice, runFleetApply, pool, sourceHome, expandAllSpecs, rosterNeedsVersions, } from '../lib/fleet/apply.js';
 import { listInstalledVersions } from '../lib/versions.js';
 /** Version of the running agents-cli — the fleet target version. */
@@ -104,19 +104,26 @@ function renderPlan(plan) {
     }
     console.log();
     console.log(chalk.gray(`  ${plan.actions.length} action(s) across ${rows.filter((r) => r.probe.reachable).length} reachable device(s)`));
-    // Distinguish *why* a login can't be propagated: a macOS keychain-bound token
-    // vs. the source simply not being signed in to that agent (no portable file).
+    // Distinguish *why* a login can't be propagated: macOS keychain-bound,
+    // single-use rotating refresh token (never copied), or the source simply not
+    // being signed in to that agent (no portable file).
     const bound = [];
+    const rotating = [];
     const noToken = [];
     for (const r of rows) {
         for (const a of r.loginBlocked) {
             const tag = `${a}@${r.device}`;
-            if (r.probe.platform === 'macos' && KEYCHAIN_BOUND_ON_MAC.has(a))
+            if (!isCredentialSafeToPropagate(a))
+                rotating.push(tag);
+            else if (r.probe.platform === 'macos' && KEYCHAIN_BOUND_ON_MAC.has(a))
                 bound.push(tag);
             else
                 noToken.push(tag);
         }
     }
+    if (rotating.length > 0) {
+        console.log(chalk.yellow(`  manual login needed (single-use rotating refresh token): ${rotating.join(', ')}`));
+    }
     if (bound.length > 0) {
         console.log(chalk.yellow(`  manual login needed (macOS keychain-bound): ${bound.join(', ')}`));
     }

package/dist/commands/cli.js

@@ -52,7 +52,7 @@ Examples:
   agents cli check
 
 When to use:
-  - After 'agents repo refresh' on a new machine, to materialize host binaries
+  - After 'agents sync' on a new machine, to materialize host binaries
   - In a team setup: commit cli/ entries so teammates get the same toolchain
 `);
     cliCmd

package/dist/commands/commands.d.ts

@@ -4,7 +4,7 @@
  * Implements `agents commands` -- list, add, remove, sync, prune, and view
  * markdown files that agents invoke mid-session as slash commands. Central
  * storage lives in ~/.agents/commands/ and commands are synced to individual
- * version homes (with TOML conversion for Gemini).
+ * version homes.
  */
 import type { Command } from 'commander';
 /** Register the `agents commands` command tree (list, add, remove, sync, prune, view). */

package/dist/commands/commands.js

@@ -4,7 +4,8 @@ import * as fs from 'fs';
 import * as os from 'os';
 import * as path from 'path';
 import { checkbox } from '@inquirer/prompts';
-import { AGENTS, ALL_AGENT_IDS, resolveAgentName, formatAgentError, agentLabel, } from '../lib/agents.js';
+import { AGENTS, resolveAgentName, formatAgentError, agentLabel, } from '../lib/agents.js';
+import { capableAgents } from '../lib/capabilities.js';
 import { cloneRepo } from '../lib/git.js';
 import { discoverCommands, resolveCommandSource, installCommandCentrally, listCentralCommands, listInstalledCommandsWithScope, getCommandInfo, diffVersionCommands, iterCommandsCapableVersions, removeCommandFromVersion, } from '../lib/commands.js';
 import { getCommandsDir } from '../lib/state.js';
@@ -80,7 +81,7 @@ When to use:
     commandsCmd
         .command('add [source]')
         .description('Install commands from a source (GitHub, local) or pick from central storage')
-        .option('-a, --agents <list>', 'Targets: claude, codex@0.116.0, or gemini@default')
+        .option('-a, --agents <list>', 'Targets: claude, codex@0.116.0, or cursor@default')
         .option('--names <list>', 'Command names from ~/.agents/commands/ (comma-separated)')
         .option('-y, --yes', 'Skip all prompts')
         .addHelpText('after', `
@@ -92,7 +93,7 @@ Examples:
   agents commands add --names README,debug --agents codex@0.116.0
 
   # Pull commands from GitHub and sync to all installed agents
-  agents commands add gh:user/repo --agents claude,codex,gemini
+  agents commands add gh:user/repo --agents claude,codex,cursor
 
   # Add a local command directory
   agents commands add ~/my-commands --agents claude@default
@@ -216,7 +217,7 @@ Examples:
             let selectedAgents;
             let versionSelections;
             if (options.agents) {
-                const result = await resolveAgentTargetsAutoInstalling(options.agents, ALL_AGENT_IDS, { yes: options.yes });
+                const result = await resolveAgentTargetsAutoInstalling(options.agents, capableAgents('commands'), { yes: options.yes });
                 if (!result) {
                     console.log(chalk.gray('Cancelled.'));
                     return;
@@ -225,7 +226,7 @@ Examples:
                 versionSelections = result.versionSelections;
             }
             else {
-                const result = await promptAgentVersionSelection(ALL_AGENT_IDS, {
+                const result = await promptAgentVersionSelection(capableAgents('commands'), {
                     skipPrompts: options.yes,
                 });
                 selectedAgents = result.selectedAgents;
@@ -345,7 +346,7 @@ Examples:
             // agent@x.y.z, agent@all, literal all) works here too.
             let availableTargets = cmdInfo.targets;
             if (options?.agents) {
-                const requestedTargets = resolveInstalledAgentTargets(options.agents, ALL_AGENT_IDS);
+                const requestedTargets = resolveInstalledAgentTargets(options.agents, capableAgents('commands'));
                 const requested = new Set();
                 for (const aid of requestedTargets.directAgents) {
                     for (const ver of listInstalledVersions(aid)) {

package/dist/commands/defaults.js

@@ -5,16 +5,8 @@
  */
 import chalk from 'chalk';
 import { setHelpSections } from '../lib/help.js';
-import { listRunDefaults, setRunDefault, unsetRunDefault, } from '../lib/run-defaults.js';
+import { formatRunDefaultEntry, listRunDefaults, setRunDefault, unsetRunDefault, } from '../lib/run-defaults.js';
 import { getProjectRoot, setProjectRoot } from '../lib/project-root.js';
-function formatRunDefault(entry) {
-    const parts = [];
-    if (entry.defaults.mode)
-        parts.push(`mode ${chalk.white(entry.defaults.mode)}`);
-    if (entry.defaults.model)
-        parts.push(`model ${chalk.white(entry.defaults.model)}`);
-    return `${chalk.cyan(entry.selector.padEnd(22))} ${parts.join('  ')}`;
-}
 export function registerDefaultsCommands(program) {
     const defaults = program
         .command('defaults')
@@ -47,7 +39,7 @@ export function registerDefaultsCommands(program) {
         }
         console.log(chalk.bold('Run Defaults\n'));
         for (const entry of entries) {
-            console.log(`  ${formatRunDefault(entry)}`);
+            console.log(`  ${formatRunDefaultEntry(entry)}`);
         }
     });
     run
@@ -62,7 +54,7 @@ export function registerDefaultsCommands(program) {
                 ...(options.model !== undefined ? { model: options.model } : {}),
             });
             console.log(chalk.green('Set run default:'));
-            console.log(`  ${formatRunDefault(entry)}`);
+            console.log(`  ${formatRunDefaultEntry(entry)}`);
         }
         catch (err) {
             console.error(chalk.red(err.message));