@phnx-labs/agents-cli 1.20.89 → 1.20.90

package/dist/commands/setup-secrets.d.ts

@@ -5,6 +5,7 @@
  * `agents secrets import` command, keeping bundle storage as the source of truth.
  */
 import type { Command } from 'commander';
+import type { SecretsPolicy } from '../lib/secrets/bundles.js';
 interface SetupSecretsOptions {
     backend?: string;
     policy?: string;
@@ -14,6 +15,12 @@ interface SetupSecretsOptions {
     iUnderstand?: boolean;
     force?: boolean;
 }
+/** The wizard's `--policy` shares the canonical parser with `agents secrets
+ * policy`, so it accepts `hold` (and the `daily`/`session` aliases) rather than
+ * carrying its own copy that knows only the retired vocabulary. `parsePolicyOpt`
+ * defaults an absent value to `always`; the wizard's own default is `hold`, so
+ * it is supplied here rather than inherited. */
+export declare function parsePolicy(raw: string | undefined): SecretsPolicy;
 export declare function runSecretsSetupWizard(opts?: SetupSecretsOptions): Promise<boolean>;
 /** Register `agents setup secrets` under the parent `setup` command. */
 export declare function registerSetupSecretsCommand(setupCmd: Command): void;

package/dist/commands/setup-secrets.js

@@ -11,6 +11,7 @@ import { spawnSync } from 'node:child_process';
 import { getCliLaunch } from '../lib/cli-entry.js';
 import { getHistoryDir, updateMeta } from '../lib/state.js';
 import { isInteractiveTerminal, isPromptCancelled } from './utils.js';
+import { parsePolicyOpt } from './secrets.js';
 function defaultBackendForPlatform(platform = process.platform) {
     return platform === 'darwin' ? 'keychain' : 'file';
 }
@@ -23,11 +24,13 @@ function parseBackend(raw) {
         return value;
     throw new Error(`Invalid --backend '${raw}'. Use keychain, file, or vault.`);
 }
-function parsePolicy(raw) {
-    const value = (raw ?? 'daily').toLowerCase();
-    if (value === 'daily' || value === 'always' || value === 'never')
-        return value;
-    throw new Error(`Invalid --policy '${raw}'. Use daily, always, or never.`);
+/** The wizard's `--policy` shares the canonical parser with `agents secrets
+ * policy`, so it accepts `hold` (and the `daily`/`session` aliases) rather than
+ * carrying its own copy that knows only the retired vocabulary. `parsePolicyOpt`
+ * defaults an absent value to `always`; the wizard's own default is `hold`, so
+ * it is supplied here rather than inherited. */
+export function parsePolicy(raw) {
+    return parsePolicyOpt(raw ?? 'hold');
 }
 function parseImportSource(raw) {
     const value = (raw ?? 'none').toLowerCase();
@@ -140,9 +143,9 @@ async function resolveInteractiveChoices(opts) {
     });
     const policy = opts.policy ? parsePolicy(opts.policy) : await select({
         message: 'Default prompt policy',
-        default: 'daily',
+        default: 'hold',
         choices: [
-            { name: 'daily — ask once, then hold for the configured window', value: 'daily' },
+            { name: 'hold — ask once, then hold for the configured window (7 days by default)', value: 'hold' },
             { name: 'always — ask on every read', value: 'always' },
             { name: 'never — no biometry ACL; use only for automation-only bundles', value: 'never' },
         ],
@@ -171,7 +174,7 @@ function printOnboardingSummary(backend, policy, prefsFile) {
         console.log(chalk.gray(`policy: ${policy} — used by bundles that do not set their own policy.`));
     }
     console.log(chalk.bold('\nTry:'));
-    console.log(chalk.cyan(`  agents secrets create prod ${backendArgs(backend).join(' ')} --policy ${policy === 'never' ? 'daily' : policy}`));
+    console.log(chalk.cyan(`  agents secrets create prod ${backendArgs(backend).join(' ')} --policy ${policy === 'never' ? 'hold' : policy}`));
     console.log(chalk.cyan('  agents secrets add prod API_KEY'));
     console.log(chalk.cyan('  agents run claude "deploy" --secrets prod'));
 }
@@ -201,7 +204,7 @@ export function registerSetupSecretsCommand(setupCmd) {
         .command('secrets')
         .description('Configure `agents secrets` defaults and optionally import existing secrets.')
         .option('--backend <backend>', 'default backend: keychain, file, or vault')
-        .option('--policy <policy>', 'default prompt policy: daily, always, or never')
+        .option('--policy <policy>', "default prompt policy: hold, always, or never ('daily'/'session' are accepted aliases for 'hold')")
         .option('--import-from <source>', 'optional import source: none, env, 1password, or icloud')
         .option('--bundle <name>', 'bundle name for optional imports')
         .option('--vault <name-or-path>', '1Password vault name, or .env path with --import-from env')

package/dist/commands/versions.js

@@ -31,7 +31,7 @@ function fixSessionFilePaths(agent, version, oldVersionDir) {
     const trashPath = path.join(trashAgentDir, stamps[0]);
     updateSessionFilePaths(oldVersionDir, trashPath);
 }
-function formatAccountHint(info, usage) {
+function formatAccountHint(info, usage, unverified = false) {
     const parts = [];
     if (info.email) {
         // Same-email accounts can live in different orgs (personal Max vs a Team
@@ -39,7 +39,7 @@ function formatAccountHint(info, usage) {
         const badge = accountOrgBadge(info);
         parts.push(badge ? `${info.email} (${badge})` : info.email);
     }
-    const usageSummary = formatUsageSummary(info.plan, usage);
+    const usageSummary = formatUsageSummary(info.plan, usage, 3, { unverified });
     if (usageSummary)
         parts.push(usageSummary);
     if (parts.length === 0)
@@ -535,7 +535,10 @@ export function registerVersionsCommands(program) {
                                     cliVersion: installedVersion,
                                     info,
                                 });
-                                const accountHint = formatAccountHint(info, usage.snapshot);
+                                // This hint sits in a "switch your default to this version?"
+                                // confirm — the one place a stale reading directly steers a
+                                // choice, so it must not present an unconfirmed bar as fact.
+                                const accountHint = formatAccountHint(info, usage.snapshot, !!usage.snapshot && !!usage.error);
                                 const message = `Switch default from ${agentLabel(agentConfig.id)}@${currentDefault} to ${agentLabel(agentConfig.id)}@${installedVersion}${accountHint}?`;
                                 const setAsDefault = await confirm({
                                     message,
@@ -702,7 +705,12 @@ export function registerVersionsCommands(program) {
                         const accountInfo = pickerAccountMap.get(v);
                         const email = accountInfo?.email || '';
                         const usageKey = getUsageLookupKey(accountInfo);
-                        const usageSummary = usageKey ? formatUsageSummary(null, usageByKey.get(usageKey)?.snapshot || null) : '';
+                        const versionUsage = usageKey ? usageByKey.get(usageKey) : undefined;
+                        const usageSummary = usageKey
+                            ? formatUsageSummary(null, versionUsage?.snapshot || null, 3, {
+                                unverified: !!versionUsage?.snapshot && !!versionUsage.error,
+                            })
+                            : '';
                         if (maxEmailLen > 0) {
                             label += '  ';
                             label += email ? chalk.cyan(email.padEnd(maxEmailLen)) : ' '.repeat(maxEmailLen);

package/dist/commands/view.d.ts

@@ -30,6 +30,17 @@ export interface ViewSectionFilter {
 /** Trim a description to a column-friendly snippet. Strips newlines, collapses whitespace. */
 export declare function summarizeDescription(desc: string | undefined, maxLen?: number): string;
 export declare function descriptionForPrefix(desc: string | undefined, prefix: string): string;
+/**
+ * Render custom harnesses as their own agent-type blocks — peers of the native
+ * Claude/Codex blocks, not indented rows under the host CLI that executes them.
+ * `agents run <name>` already treats a custom harness like a native agent id, so
+ * `agents view` lists it the same way: a bold name header, then one row carrying
+ * the model, the account/auth state, and the host it runs on.
+ *
+ * `installedHosts` is the set of agent ids with a usable install; a harness whose
+ * host is missing is flagged rather than silently listed as runnable.
+ */
+export declare function renderHarnessBlocks(harnesses: ProfileSummary[], installedHosts: Set<AgentId>, showPaths: boolean): void;
 /** Machine-readable entry for a single installed version. */
 export interface ViewJsonVersion {
     version: string;
@@ -47,6 +58,7 @@ export interface ViewJsonVersion {
     } | null;
     windows: Array<{
         key: 'session' | 'week' | 'sonnet_week' | 'month';
+        label?: string;
         usedPercent: number;
         resetsAt: string | null;
     }>;
@@ -64,7 +76,8 @@ export interface ViewJsonVersion {
 export interface ViewJsonAgent {
     agent: AgentId;
     versions: ViewJsonVersion[];
-    profiles: ProfileSummary[];
+    /** Custom harnesses that run on this agent as their host CLI. */
+    harnesses: ProfileSummary[];
 }
 /** Resource sections that --resources can include in --json output. */
 export type ResourceSection = 'commands' | 'skills' | 'mcp' | 'memory' | 'hooks' | 'workflows' | 'plugins';

package/dist/commands/view.js

@@ -25,7 +25,8 @@ import { composeRulesFromState } from '../lib/rules/compose.js';
 import { getConfiguredRunStrategy } from '../lib/rotate.js';
 import { resolveRunDefaults } from '../lib/run-defaults.js';
 import { resolveConfiguredModel } from '../lib/models.js';
-import { listProfiles, profileSummary } from '../lib/profiles.js';
+import { listProfiles, profileExists, profileSummary, readProfile } from '../lib/profiles.js';
+import { renderHarnessDetail } from './harness.js';
 import { loadManifest, isStale } from '../lib/staleness/index.js';
 import { confirm } from '@inquirer/prompts';
 import { formatPath, isInteractiveTerminal, isPromptCancelled } from './utils.js';
@@ -33,28 +34,19 @@ import { terminalWidth, truncateToWidth, stringWidth } from '../lib/session/widt
 /** Shared account identity formatter, re-exported for the view-specific tests. */
 export const accountColumnLabel = accountDisplayLabel;
 /**
- * Group profile summaries by their host harness, optionally filtered to a
- * single agent. Profile YAMLs that fail validation are silently skipped by
- * `listProfiles` so this never throws on a malformed file.
+ * Custom harnesses (the `~/.agents/profiles/*.yml` bundles), sorted by name and
+ * optionally narrowed to the ones that run on one host agent. YAMLs that fail
+ * validation are silently skipped by `listProfiles`, so this never throws on a
+ * malformed file.
  */
-function getProfilesByAgent(filterAgentId) {
-    const byAgent = new Map();
-    for (const profile of listProfiles()) {
-        if (filterAgentId && profile.host.agent !== filterAgentId)
-            continue;
-        const summary = profileSummary(profile);
-        const existing = byAgent.get(profile.host.agent);
-        if (existing)
-            existing.push(summary);
-        else
-            byAgent.set(profile.host.agent, [summary]);
-    }
-    return byAgent;
+function getHarnesses(filterAgentId) {
+    return listProfiles()
+        .filter((profile) => !filterAgentId || profile.host.agent === filterAgentId)
+        .map(profileSummary);
 }
-/** Build the usage-column equivalent for a profile row: "profile  <model>". */
-function profileKindAndModel(model, planWidth) {
-    const kind = 'profile'.padEnd(Math.max(planWidth, 'profile'.length));
-    return `${kind}  ${model}`;
+/** "via <host> <version>" — which native harness actually executes this one. */
+function harnessHostTag(harness) {
+    return harness.hostVersion ? `via ${harness.agent} ${harness.hostVersion}` : `via ${harness.agent}`;
 }
 /**
  * Resolve a resource path to something the IDE can open inline. When `p` is a
@@ -147,31 +139,38 @@ export function descriptionForPrefix(desc, prefix) {
     const budget = Math.max(1, terminalWidth() - stringWidth(visiblePrefix));
     return summarizeDescription(desc, budget);
 }
-function getProfileSummaries(filterAgentId) {
-    return listProfiles()
-        .filter((profile) => !filterAgentId || profile.host.agent === filterAgentId)
-        .map(profileSummary);
-}
-function renderProfilesSection(profiles) {
-    if (profiles.length === 0)
+/**
+ * Render custom harnesses as their own agent-type blocks — peers of the native
+ * Claude/Codex blocks, not indented rows under the host CLI that executes them.
+ * `agents run <name>` already treats a custom harness like a native agent id, so
+ * `agents view` lists it the same way: a bold name header, then one row carrying
+ * the model, the account/auth state, and the host it runs on.
+ *
+ * `installedHosts` is the set of agent ids with a usable install; a harness whose
+ * host is missing is flagged rather than silently listed as runnable.
+ */
+export function renderHarnessBlocks(harnesses, installedHosts, showPaths) {
+    if (harnesses.length === 0)
         return;
-    const nameWidth = Math.max(4, ...profiles.map((p) => p.name.length));
-    const hostWidth = Math.max(4, ...profiles.map((p) => p.host.length));
-    const providerWidth = Math.max(8, ...profiles.map((p) => p.provider.length));
-    console.log(chalk.bold('Profiles\n'));
-    console.log(`  ${chalk.gray('NAME'.padEnd(nameWidth))}  ` +
-        `${chalk.gray('HOST'.padEnd(hostWidth))}  ` +
-        `${chalk.gray('PROVIDER'.padEnd(providerWidth))}  ` +
-        chalk.gray('MODEL'));
-    for (const profile of profiles) {
-        console.log(`  ${chalk.cyan(profile.name.padEnd(nameWidth))}  ` +
-            `${profile.host.padEnd(hostWidth)}  ` +
-            `${profile.provider.padEnd(providerWidth)}  ` +
-            chalk.gray(profile.model));
-    }
-    console.log(chalk.gray('\n  Run: agents run <profile> [prompt]'));
-    console.log(chalk.gray('       agents profiles view <profile>'));
-    console.log();
+    const modelWidth = Math.max(...harnesses.map((h) => h.model.length));
+    const authWidth = Math.max(...harnesses.map((h) => h.auth.length));
+    for (const harness of harnesses) {
+        // The `via <host>` tag on the row already names a native fork parent, so
+        // only a fork of another custom harness adds lineage worth printing.
+        const origin = harness.forkedFrom && harness.forkedFrom !== harness.agent
+            ? `custom · forked from ${harness.forkedFrom}`
+            : 'custom';
+        const missingHost = installedHosts.has(harness.agent)
+            ? ''
+            : chalk.yellow(` (host ${harness.agent} not installed)`);
+        console.log(`  ${chalk.bold(harness.label)}${chalk.gray(` (${origin})`)}${missingHost}`);
+        console.log(`    ${chalk.yellow(harness.model.padEnd(modelWidth))}  ` +
+            `${chalk.cyan(harness.auth.padEnd(authWidth))}  ` +
+            chalk.gray(harnessHostTag(harness)));
+        if (showPaths)
+            console.log(chalk.gray(`      ${harness.path}`));
+        console.log();
+    }
 }
 /**
  * Show installed versions for one or all agents.
@@ -267,8 +266,7 @@ async function showInstalledVersions(filterAgentId, viewOpts) {
         .map(async (agentId) => [agentId, await getUnmanagedCliState(agentId)])));
     spinner.stop();
     const showPaths = !!filterAgentId;
-    const profilesByAgent = getProfilesByAgent(filterAgentId);
-    const profileSummaries = [...profilesByAgent.values()].flat();
+    const harnesses = getHarnesses(filterAgentId);
     // Auto-heal stale versioned aliases. Pre-v2 aliases (e.g. pre-CLAUDE_CONFIG_DIR
     // claude shims) silently route login through the default version's symlinked
     // home, so `agents view` would never reflect the right account. Regenerate on
@@ -367,11 +365,9 @@ async function showInstalledVersions(filterAgentId, viewOpts) {
     // Separate version-managed from globally-installed agents
     const versionManaged = [];
     const globallyInstalled = [];
-    const profileOnly = [];
     for (const agentId of agentsToShow) {
         const versions = listInstalledVersions(agentId);
         const cliState = cliStates[agentId];
-        const hasProfiles = (profilesByAgent.get(agentId)?.length ?? 0) > 0;
         if (versions.length > 0) {
             versionManaged.push(agentId);
         }
@@ -380,10 +376,10 @@ async function showInstalledVersions(filterAgentId, viewOpts) {
             if (!hasNonIsolatedVersion(agentId))
                 globallyInstalled.push(agentId);
         }
-        else if (versions.length === 0 && hasProfiles) {
-            profileOnly.push(agentId);
-        }
     }
+    // A custom harness runs through its host CLI, so it is only launchable when
+    // that host has an install of some kind.
+    const installedHosts = new Set([...versionManaged, ...globallyInstalled]);
     // For self-updating global-binary agents (droid) the on-disk version-dir name
     // is a stale label — the real version is whatever `<cli> --version` reports.
     // Resolve it once so every row/width pass shows the live version, while the
@@ -443,12 +439,6 @@ async function showInstalledVersions(filterAgentId, viewOpts) {
                     maxModelWidth = Math.max(maxModelWidth, model.length);
                 }
             }
-            // Profile rows share these columns with version rows so they line up.
-            for (const profile of profilesByAgent.get(agentId) ?? []) {
-                maxVerLabel = Math.max(maxVerLabel, profile.name.length);
-                maxEmail = Math.max(maxEmail, profile.auth.length);
-                maxPlanWidth = Math.max(maxPlanWidth, 'profile'.length);
-            }
         }
         // Second pass: compute max visible usage + status widths (now that maxPlanWidth is settled)
         for (const agentId of versionManaged) {
@@ -459,15 +449,12 @@ async function showInstalledVersions(filterAgentId, viewOpts) {
                 const usageKey = getUsageLookupKey(info);
                 const usageInfo = usageKey ? usageByKey.get(usageKey) : undefined;
                 const usageUnavailable = agentReportsUsage(agentId) && !!info?.signedIn && !usageInfo?.snapshot;
-                const usageStr = formatUsageSummary(info?.plan || null, usageInfo?.snapshot || null, maxPlanWidth, { unavailable: usageUnavailable });
+                const usageUnverified = !!usageInfo?.snapshot && !!usageInfo.error;
+                const usageStr = formatUsageSummary(info?.plan || null, usageInfo?.snapshot || null, maxPlanWidth, { unavailable: usageUnavailable, unverified: usageUnverified });
                 maxUsageWidth = Math.max(maxUsageWidth, visibleWidth(usageStr));
                 const statusStr = formatUsageStatusBadge(info?.usageStatus);
                 maxStatusWidth = Math.max(maxStatusWidth, visibleWidth(statusStr));
             }
-            for (const profile of profilesByAgent.get(agentId) ?? []) {
-                const usageEquivalent = profileKindAndModel(profile.model, maxPlanWidth);
-                maxUsageWidth = Math.max(maxUsageWidth, visibleWidth(usageEquivalent));
-            }
         }
         for (const agentId of versionManaged) {
             const agent = AGENTS[agentId];
@@ -518,7 +505,8 @@ async function showInstalledVersions(filterAgentId, viewOpts) {
                 const hasEmail = !!vInfo?.email;
                 const signedIn = !!vInfo?.signedIn;
                 const usageUnavailable = agentReportsUsage(agentId) && signedIn && !usageInfo?.snapshot;
-                const usageStr = formatUsageSummary(vInfo?.plan || null, usageInfo?.snapshot || null, maxPlanWidth, { unavailable: usageUnavailable });
+                const usageUnverified = !!usageInfo?.snapshot && !!usageInfo.error;
+                const usageStr = formatUsageSummary(vInfo?.plan || null, usageInfo?.snapshot || null, maxPlanWidth, { unavailable: usageUnavailable, unverified: usageUnverified });
                 const hasUsage = usageStr.length > 0;
                 // Only show lastActive for versions with an actual logged-in account.
                 // Otherwise it reflects install time (misleading "just now" for fresh installs).
@@ -577,20 +565,6 @@ async function showInstalledVersions(filterAgentId, viewOpts) {
                     console.log(chalk.gray(`      ${versionDir}`));
                 }
             }
-            // Profile rows share the same columns as versions: name | auth | "profile"+model.
-            // No status badge, no last-active — profiles don't accumulate usage state.
-            for (const profile of profilesByAgent.get(agentId) ?? []) {
-                const nameCol = chalk.cyan(profile.name.padEnd(maxVerLabel));
-                // Pad the model column so profile rows line up with version rows.
-                const modelPad = maxModelWidth > 0 ? `${' '.repeat(maxModelWidth)}  ` : '';
-                const authCol = chalk.gray(profile.auth.padEnd(maxEmail));
-                const usageEquivalent = profileKindAndModel(profile.model, maxPlanWidth);
-                const usagePad = ' '.repeat(Math.max(0, maxUsageWidth - visibleWidth(usageEquivalent)));
-                console.log(`    ${nameCol}  ${modelPad}${authCol}  ${chalk.gray(usageEquivalent + usagePad)}`);
-                if (showPaths) {
-                    console.log(chalk.gray(`      ${profile.path}`));
-                }
-            }
             // Check for project override
             const projectVersion = getProjectVersionFromCwd(agentId);
             if (projectVersion && projectVersion !== globalDefault) {
@@ -599,6 +573,10 @@ async function showInstalledVersions(filterAgentId, viewOpts) {
             console.log();
         }
     }
+    // Custom harnesses sit in the same list as the native ones — they are run the
+    // same way (`agents run <name>`), so they read as their own agent type rather
+    // than as an indented row under whichever host CLI executes them.
+    renderHarnessBlocks(harnesses, installedHosts, showPaths);
     // Show globally installed (not managed) agents
     if (globallyInstalled.length > 0) {
         console.log(chalk.bold('Not Managed by Agents CLI\n'));
@@ -632,7 +610,9 @@ async function showInstalledVersions(filterAgentId, viewOpts) {
             const parts = [`    ${verLabel}${padding}`];
             const gUsageKey = getUsageLookupKey(gInfo);
             const gUsage = gUsageKey ? usageByKey.get(gUsageKey) : undefined;
-            const gUsageStr = formatUsageSummary(gInfo?.plan || null, gUsage?.snapshot || null);
+            const gUsageStr = formatUsageSummary(gInfo?.plan || null, gUsage?.snapshot || null, 3, {
+                unverified: !!gUsage?.snapshot && !!gUsage.error,
+            });
             const gActiveStr = gInfo ? formatLastActive(gInfo.lastActive) : '';
             if (gInfo?.email || gUsageStr || gActiveStr || gInfo?.signedIn) {
                 const gDisplay = accountColumnLabel(gInfo);
@@ -651,25 +631,6 @@ async function showInstalledVersions(filterAgentId, viewOpts) {
             if (showPaths && cliState?.path) {
                 console.log(chalk.gray(`      ${cliState.path}`));
             }
-            // Profile rows under a globally-installed harness. Use a simpler
-            // alignment here since this section doesn't share column state with
-            // the version-managed block.
-            // An isolated-only agent now appears in BOTH blocks; its profiles already
-            // rendered under the version-managed one, so don't print them twice.
-            const profilesHere = versionManaged.includes(agentId) ? [] : (profilesByAgent.get(agentId) ?? []);
-            if (profilesHere.length > 0) {
-                const nameWidth = Math.max(globalMaxVerLabel, ...profilesHere.map((p) => p.name.length));
-                const authWidth = Math.max(...profilesHere.map((p) => p.auth.length));
-                for (const profile of profilesHere) {
-                    console.log(`    ${chalk.cyan(profile.name.padEnd(nameWidth))}  ` +
-                        `${chalk.gray(profile.auth.padEnd(authWidth))}  ` +
-                        `${chalk.gray('profile')}  ` +
-                        chalk.gray(profile.model));
-                    if (showPaths) {
-                        console.log(chalk.gray(`      ${profile.path}`));
-                    }
-                }
-            }
             if (agent.npmPackage && cliState?.version) {
                 console.log(chalk.gray(`    Manage: agents add ${agentId}@${cliState.version} -y`));
             }
@@ -681,47 +642,44 @@ async function showInstalledVersions(filterAgentId, viewOpts) {
             console.log();
         }
     }
-    // Agents with no install but with profiles defined — render under the same
-    // harness header so users find them where they look.
-    if (profileOnly.length > 0) {
-        if (versionManaged.length === 0 && globallyInstalled.length === 0) {
-            console.log(chalk.bold('Profile-only Agents\n'));
-        }
-        for (const agentId of profileOnly) {
-            const profilesHere = profilesByAgent.get(agentId) ?? [];
-            console.log(`  ${chalk.bold(agentLabel(agentId))}${chalk.yellow(' (profile only)')}`);
-            const nameWidth = Math.max(...profilesHere.map((p) => p.name.length));
-            const authWidth = Math.max(...profilesHere.map((p) => p.auth.length));
-            for (const profile of profilesHere) {
-                console.log(`    ${chalk.cyan(profile.name.padEnd(nameWidth))}  ` +
-                    `${chalk.gray(profile.auth.padEnd(authWidth))}  ` +
-                    `${chalk.gray('profile')}  ` +
-                    chalk.gray(profile.model));
-                if (showPaths) {
-                    console.log(chalk.gray(`      ${profile.path}`));
-                }
-            }
-            console.log();
-        }
-    }
     // If filtering to a specific agent and not found
     if (filterAgentId &&
         versionManaged.length === 0 &&
         globallyInstalled.length === 0 &&
-        profileOnly.length === 0) {
+        harnesses.length === 0) {
         console.log(`  ${chalk.bold(agentLabel(filterAgentId))}: ${chalk.gray('not installed')}`);
         console.log();
     }
     // No agents installed at all
     if (versionManaged.length === 0 &&
         globallyInstalled.length === 0 &&
-        profileOnly.length === 0 &&
-        profileSummaries.length === 0 &&
+        harnesses.length === 0 &&
         !filterAgentId) {
         console.log(chalk.gray('  No agent CLIs installed.'));
         console.log(chalk.gray('  Run: agents add claude@latest'));
         console.log();
     }
+    // `--refresh` used to print a table that looked fully refreshed no matter how
+    // many accounts it had failed to reach, so a box whose every Claude credential
+    // had expired rendered identically to a healthy one — the bars beside each row
+    // came from a cache that the run had not managed to update. Name the accounts
+    // it could not confirm, and why.
+    if (viewOpts?.forceRefresh) {
+        const unrefreshed = [];
+        for (const [key, usage] of usageByKey) {
+            if (!usage.error)
+                continue;
+            const label = canonicalByUsageKey.get(key)?.email ?? key;
+            unrefreshed.push(`    ${label.padEnd(24)} ${chalk.gray(usage.error)}`);
+        }
+        if (unrefreshed.length > 0) {
+            const noun = unrefreshed.length === 1 ? 'account' : 'accounts';
+            console.log(chalk.yellow(`  Could not refresh ${unrefreshed.length} ${noun} — bars above are the last cached reading:`));
+            for (const line of unrefreshed)
+                console.log(line);
+            console.log();
+        }
+    }
     // Host CLIs are host-global, not per-agent — show them once in the overview.
     if (!filterAgentId) {
         renderHostClisSection(process.cwd());
@@ -1246,6 +1204,7 @@ async function collectAgentsJson(filterAgentId, resourceSections) {
             windows: snapshot
                 ? snapshot.windows.map((w) => ({
                     key: w.key,
+                    label: w.label,
                     usedPercent: w.usedPercent,
                     resetsAt: w.resetsAt ? w.resetsAt.toISOString() : null,
                 }))
@@ -1263,7 +1222,7 @@ async function collectAgentsJson(filterAgentId, resourceSections) {
         else
             byAgent.set(agentId, [entry]);
     }
-    const profilesByAgent = getProfilesByAgent(filterAgentId);
+    const harnesses = getHarnesses(filterAgentId);
     const out = [];
     for (const agentId of agentsToShow) {
         const versions = byAgent.get(agentId) ?? [];
@@ -1272,7 +1231,7 @@ async function collectAgentsJson(filterAgentId, resourceSections) {
                 return a.isDefault ? -1 : 1;
             return compareVersions(b.version, a.version);
         });
-        out.push({ agent: agentId, versions, profiles: profilesByAgent.get(agentId) ?? [] });
+        out.push({ agent: agentId, versions, harnesses: harnesses.filter((h) => h.agent === agentId) });
     }
     return out;
 }
@@ -1536,6 +1495,17 @@ export async function viewAction(agentArg, options) {
     const agentName = parts[0];
     const agentId = resolveAgentName(agentName);
     if (!agentId) {
+        // A custom harness is an agent type here, not an unknown name: `agents run
+        // <name>` launches it, so `agents view <name>` describes it.
+        if (profileExists(agentName)) {
+            const harness = profileSummary(readProfile(agentName));
+            if (json) {
+                console.log(JSON.stringify(harness, null, 2));
+                return;
+            }
+            renderHarnessDetail(agentName);
+            return;
+        }
         if (json) {
             console.log(JSON.stringify({ error: formatAgentError(agentName) }));
             process.exit(1);
@@ -1575,7 +1545,7 @@ export async function viewAction(agentArg, options) {
         // --json ignores the @version suffix, but --resources/--detailed (or a
         // section flag) now attach each version's resource inventory + sync-state.
         const data = await collectAgentsJson(agentId, resourceSections);
-        console.log(JSON.stringify(data[0] ?? { agent: agentId, versions: [], profiles: [] }, null, 2));
+        console.log(JSON.stringify(data[0] ?? { agent: agentId, versions: [], harnesses: [] }, null, 2));
         return;
     }
     if (requestedVersion) {
@@ -1622,6 +1592,9 @@ Examples:
   # Show versions for one agent
   agents view claude
 
+  # Describe one custom harness (host, model, provider, auth, path)
+  agents view deepseek-flash
+
   # Detailed view: resources, commands, skills, MCP servers for a specific version
   agents view claude@2.1.112
   agents view claude@default
@@ -1655,8 +1628,10 @@ When to use:
   - Cleaning up stale versions left behind after upgrading (--prune)
 
 Output:
-  - Without arguments: table of all agents with versions, emails, usage stats
+  - Without arguments: table of all agents with versions, emails, usage stats,
+    then one block per custom harness (see 'agents harness')
   - With agent name: versions for that agent, showing which is the default
+  - With a custom harness name: that harness's host, model, provider, and auth
   - With agent@version: detailed breakdown of resources synced to that version
   - With --json: structured JSON with version, isDefault, signedIn, email, plan,
     usageStatus, per-window usedPercent, lastActive, and path

package/dist/lib/agents.d.ts

@@ -242,8 +242,10 @@ export declare function decryptDroidAuthFile(filePath: string, keyPath: string):
  *     -> email / org_id / sub.
  *   - kimi: credentials/kimi-code.json -> access-token JWT -> user_id / sub.
  *   - antigravity: antigravity-oauth-token -> token.refresh_token -> JWT sub
- *     when the token is a JWT, else the raw refresh-token value (opaque Google
- *     consumer tokens are stable per login).
+ *     when the token is a JWT, else a SHA-256 hash of the raw refresh-token
+ *     value (opaque Google consumer tokens are stable per login — hashed so
+ *     the identity key, which is persisted as a usage-cache key, never carries
+ *     a live credential).
  * Two directories for the SAME account compare equal; two DIFFERENT accounts
  * compare distinct. Used by carryForwardAuthFiles to refuse overwriting one
  * account's login with a credential that belongs to a DIFFERENT account

package/dist/lib/agents.js

@@ -1190,8 +1190,10 @@ export function decryptDroidAuthFile(filePath, keyPath) {
  *     -> email / org_id / sub.
  *   - kimi: credentials/kimi-code.json -> access-token JWT -> user_id / sub.
  *   - antigravity: antigravity-oauth-token -> token.refresh_token -> JWT sub
- *     when the token is a JWT, else the raw refresh-token value (opaque Google
- *     consumer tokens are stable per login).
+ *     when the token is a JWT, else a SHA-256 hash of the raw refresh-token
+ *     value (opaque Google consumer tokens are stable per login — hashed so
+ *     the identity key, which is persisted as a usage-cache key, never carries
+ *     a live credential).
  * Two directories for the SAME account compare equal; two DIFFERENT accounts
  * compare distinct. Used by carryForwardAuthFiles to refuse overwriting one
  * account's login with a credential that belongs to a DIFFERENT account
@@ -1226,7 +1228,11 @@ export function readAuthAccountIdentity(agent, configDir) {
                     return null;
                 const claims = decodeJwtPayload(refreshToken);
                 const sub = normalizeIdentityPart(claims?.sub ?? claims?.user_id);
-                return buildIdentityKey(agent, [['sub', sub ?? refreshToken]]);
+                // An opaque (non-JWT) Google refresh token IS the credential — hash it
+                // so the identity key stays stable per login without embedding a live
+                // secret (the key is persisted as a usage-cache filename key).
+                const fallback = crypto.createHash('sha256').update(refreshToken).digest('hex').slice(0, 16);
+                return buildIdentityKey(agent, [['sub', sub ?? fallback]]);
             }
             default:
                 return null;
@@ -1648,11 +1654,20 @@ export async function getAccountInfo(agentId, home) {
                 if (tokenPath) {
                     const data = JSON.parse(await fs.promises.readFile(tokenPath, 'utf-8'));
                     if (typeof data?.token?.refresh_token === 'string' && data.token.refresh_token) {
-                        return { ...empty, signedIn: true, lastActive };
+                        // A stable account/usage key (derived from the refresh token — see
+                        // readAuthAccountIdentity) lets `agents view` dedupe and cache the
+                        // per-model quota bars for this login.
+                        const identity = readAuthAccountIdentity('antigravity', path.dirname(tokenPath));
+                        return { ...empty, signedIn: true, lastActive, accountKey: identity, usageKey: identity };
                     }
                 }
-                if (await antigravityKeychainSignedIn())
-                    return { ...empty, signedIn: true, lastActive };
+                if (await antigravityKeychainSignedIn()) {
+                    // Keyring-only login (the macOS case): the OS keyring holds exactly
+                    // ONE antigravity credential, so a stable singleton key identifies it
+                    // for usage-cache dedup without reading the secret value here.
+                    const identity = buildIdentityKey('antigravity', [['sub', 'keychain']]);
+                    return { ...empty, signedIn: true, lastActive, accountKey: identity, usageKey: identity };
+                }
                 return { ...empty, lastActive };
             }
             case 'kimi': {