@phnx-labs/agents-cli 1.22.114 → 1.22.115

package/dist/commands/ssh.js

@@ -1122,7 +1122,8 @@ function registerDevicesCommands(program) {
         agents devices config mac-mini notes "runs the releases"
         agents devices config win-mini ssh.auth password
         agents devices config worker ssh.identity-file ~/.ssh/worker_ed25519
-        agents devices config mac-mini auto-launch.enabled off
+        agents devices disable mac-mini                       # leave the auto-placement pool (auto-launch.enabled off)
+        agents devices enable mac-mini                        # rejoin it
         agents devices describe mark-1 "gpu box — cuda 12.4"  # one-line purpose, shown in the list
         agents devices config mac-mini interactive.host zion # where agents show YOU artifacts
         agents devices render --write  # write ~/.ssh/config.d/agents include
@@ -1286,11 +1287,9 @@ function registerDevicesCommands(program) {
     // ─── devices config (unified settings surface) ────────────────────────────
     //
     // ONE command for every per-device setting: `agents devices config <name>
-    // [key] [value] [--unset] [--json]`. The retired subcommands (configure,
-    // note, set-interactive, set, enable/disable/prefer/unprefer) are hidden
-    // tombstones below — each prints a deprecation notice on STDERR (so a --json
-    // consumer's stdout stays parseable) and delegates to this same engine,
-    // preserving its old output shape and exit codes.
+    // [key] [value] [--unset] [--json]`. configure, note, set-interactive, set,
+    // prefer, and unprefer are deleted (PHNX-4051) — use this command directly.
+    // enable/disable stay as first-class sugar over auto-launch.enabled.
     /** Parse a raw CLI string into a config key's typed value (bool/int pass validation, strings verbatim). */
     const parseConfigValueInput = (spec, raw) => {
         switch (spec.type) {
@@ -1685,8 +1684,10 @@ function registerDevicesCommands(program) {
       the device itself; --fleet still writes a fleet-wide default those boxes
       inherit until they override.
 
-      The retired subcommands still work and forward here: configure, note,
-      set, set-interactive, enable, disable, prefer, unprefer.
+      configure, note, set, set-interactive, prefer, and unprefer are deleted;
+      use this command directly (auto-launch.preferred, interactive.host, or
+      any other key). enable/disable stay as first-class sugar over
+      auto-launch.enabled.
     `,
     });
     const roleCmd = devicesCmd
@@ -1765,182 +1766,6 @@ function registerDevicesCommands(program) {
       long-form scratch use 'agents devices config <name> notes "…"'.
     `,
     });
-    /** Deprecation notice for a retired subcommand — STDERR only, so a --json consumer's stdout stays parseable. */
-    const configTombstoneNotice = (retired, replacement) => {
-        console.error(chalk.yellow(`Deprecated: "agents devices ${retired}" is now "agents devices ${replacement}". Running that for you.\n`));
-    };
-    devicesCmd
-        .command('enable <name>', { hidden: true })
-        .action(async (name) => {
-        try {
-            configTombstoneNotice('enable <name>', 'config <name> auto-launch.enabled on');
-            await mustGetDevice(name);
-            // Back to the default (enabled) = remove the key.
-            await runDevicesConfig(name, 'auto-launch.enabled', [], { unset: true, quiet: true });
-            console.log(chalk.green(`Enabled '${name}'`) + chalk.gray(' for AGI EXT auto-launch.'));
-        }
-        catch (err) {
-            console.error(chalk.red(err.message));
-            process.exit(1);
-        }
-    });
-    devicesCmd
-        .command('disable <name>', { hidden: true })
-        .action(async (name) => {
-        try {
-            configTombstoneNotice('disable <name>', 'config <name> auto-launch.enabled off');
-            await mustGetDevice(name);
-            await runDevicesConfig(name, 'auto-launch.enabled', ['off'], { quiet: true });
-            console.log(chalk.green(`Disabled '${name}'`) + chalk.gray(' for AGI EXT auto-launch.'));
-        }
-        catch (err) {
-            console.error(chalk.red(err.message));
-            process.exit(1);
-        }
-    });
-    devicesCmd
-        .command('prefer <name>', { hidden: true })
-        .action(async (name) => {
-        try {
-            configTombstoneNotice('prefer <name>', 'config <name> auto-launch.preferred on');
-            await mustGetDevice(name);
-            await runDevicesConfig(name, 'auto-launch.preferred', ['on'], { quiet: true });
-            console.log(chalk.green(`Preferred '${name}'`) + chalk.gray(' for AGI EXT auto-launch.'));
-        }
-        catch (err) {
-            console.error(chalk.red(err.message));
-            process.exit(1);
-        }
-    });
-    devicesCmd
-        .command('unprefer <name>', { hidden: true })
-        .action(async (name) => {
-        try {
-            configTombstoneNotice('unprefer <name>', 'config <name> auto-launch.preferred off');
-            await mustGetDevice(name);
-            // Back to the default (not preferred) = remove the key.
-            await runDevicesConfig(name, 'auto-launch.preferred', [], { unset: true, quiet: true });
-            console.log(chalk.green(`No longer preferring '${name}'`) + chalk.gray(' for AGI EXT auto-launch.'));
-        }
-        catch (err) {
-            console.error(chalk.red(err.message));
-            process.exit(1);
-        }
-    });
-    devicesCmd
-        .command('set-interactive [name]', { hidden: true })
-        .option('--unset', 'clear the interactive host')
-        .option('--json', 'output machine-readable JSON')
-        .action(async (name, opts) => {
-        try {
-            configTombstoneNotice('set-interactive [name]', 'config <name> interactive.host <name>');
-            if (opts.unset) {
-                unsetConfigValue('interactive.host');
-                if (opts.json)
-                    writeJson({ interactiveHost: null });
-                else
-                    console.log(chalk.green('Cleared the interactive host.'));
-                return;
-            }
-            if (name) {
-                await mustGetDevice(name);
-                setConfigValue('interactive.host', name);
-                if (opts.json)
-                    writeJson({ interactiveHost: name });
-                else
-                    console.log(chalk.green(`Interactive host: '${name}'`) + chalk.gray(' — agents show you artifacts there. Clear with --unset.'));
-                return;
-            }
-            const current = getConfigValue('interactive.host').value;
-            if (opts.json) {
-                writeJson({ interactiveHost: current ?? null });
-            }
-            else if (current) {
-                console.log(`${chalk.bold('Interactive host:')} ${chalk.cyan(current)}`);
-            }
-            else {
-                console.log(chalk.gray("No interactive host set. Set one with 'agents devices config <name> interactive.host <name>'."));
-            }
-        }
-        catch (err) {
-            console.error(chalk.red(err.message));
-            process.exit(1);
-        }
-    });
-    devicesCmd
-        .command('configure <name>', { hidden: true })
-        .option('--max-agents <n>', 'cap concurrent agents')
-        .option('--scheduler <on|off>', 'allow the routines scheduler (daemon) to fire on this device')
-        .option('--json', 'output machine-readable JSON')
-        .action(async (name, opts) => {
-        try {
-            configTombstoneNotice('configure <name> [--max-agents N] [--scheduler on|off]', 'config <name> <key> <value>');
-            await mustGetDevice(name);
-            const writes = [];
-            if (opts.maxAgents !== undefined)
-                writes.push(['agents.max-concurrent', opts.maxAgents]);
-            if (opts.scheduler !== undefined) {
-                if (opts.scheduler !== 'on' && opts.scheduler !== 'off') {
-                    throw new Error(`--scheduler expects 'on' or 'off', got '${opts.scheduler}'.`);
-                }
-                writes.push(['scheduler.enabled', opts.scheduler]);
-            }
-            for (const [key, value] of writes) {
-                await runDevicesConfig(name, key, [value], { quiet: Boolean(opts.json) });
-            }
-            if (opts.json)
-                printDevicesConfig(name, true);
-            else if (writes.length === 0)
-                printDevicesConfig(name, false);
-        }
-        catch (err) {
-            console.error(chalk.red(err.message));
-            process.exit(1);
-        }
-    });
-    devicesCmd
-        .command('note <name> [text...]', { hidden: true })
-        .option('--clear', 'remove all notes from the device')
-        .option('--json', 'output machine-readable JSON')
-        .action(async (name, text, opts) => {
-        try {
-            configTombstoneNotice('note <name> [text...]', 'config <name> notes <text>');
-            await mustGetDevice(name);
-            if (opts.clear) {
-                await runDevicesConfig(name, 'notes', [], { unset: true, quiet: true });
-                if (opts.json)
-                    writeJson({ device: name, notes: [] });
-                else
-                    console.log(chalk.green(`Cleared notes on '${name}'.`));
-                return;
-            }
-            if (text.length > 0) {
-                await runDevicesConfig(name, 'notes', text, { quiet: true });
-                const notes = getConfigValue('notes', { device: name }).value ?? [];
-                if (opts.json)
-                    writeJson({ device: name, notes });
-                else
-                    console.log(chalk.green(`Noted on '${name}':`) + ` ${text.join(' ')}`);
-                return;
-            }
-            const notes = getConfigValue('notes', { device: name }).value ?? [];
-            if (opts.json) {
-                writeJson({ device: name, notes });
-            }
-            else if (notes.length > 0) {
-                console.log(chalk.bold(`Notes for '${name}'`));
-                for (const n of notes)
-                    console.log(`  ${chalk.gray('•')} ${n}`);
-            }
-            else {
-                console.log(chalk.gray(`No notes on '${name}'. Add one with 'agents devices config ${name} notes "..."'.`));
-            }
-        }
-        catch (err) {
-            console.error(chalk.red(err.message));
-            process.exit(1);
-        }
-    });
     const runList = async (opts = {}) => {
         const reg = await loadDevices();
         const names = Object.keys(reg).sort();
@@ -2027,6 +1852,34 @@ function registerDevicesCommands(program) {
         }
     };
     devicesCmd.action(runList);
+    devicesCmd
+        .command('enable <name>')
+        .description('Put a device back in the automatic-placement pool (clears auto-launch.enabled)')
+        .action(async (name) => {
+        try {
+            await mustGetDevice(name);
+            await runDevicesConfig(name, 'auto-launch.enabled', [], { unset: true, quiet: true });
+            console.log(chalk.green(`Enabled '${name}'`) + chalk.gray(' for automatic placement.'));
+        }
+        catch (err) {
+            console.error(chalk.red(err.message));
+            process.exit(1);
+        }
+    });
+    devicesCmd
+        .command('disable <name>')
+        .description('Drop a device from every automatic-placement path (sets auto-launch.enabled off)')
+        .action(async (name) => {
+        try {
+            await mustGetDevice(name);
+            await runDevicesConfig(name, 'auto-launch.enabled', ['off'], { quiet: true });
+            console.log(chalk.green(`Disabled '${name}'`) + chalk.gray(' for automatic placement.'));
+        }
+        catch (err) {
+            console.error(chalk.red(err.message));
+            process.exit(1);
+        }
+    });
     devicesCmd
         .command('list')
         .alias('ls')
@@ -2214,53 +2067,6 @@ email) into a single row. Use \`agents devices harnesses\` for the per-install v
             process.exit(1);
         }
     });
-    devicesCmd
-        .command('set <name>', { hidden: true })
-        .option('--platform <platform>', 'windows | linux | macos')
-        .option('--user <user>', 'login user')
-        .option('--auth <method>', 'key | password')
-        .option('--bundle <bundle>', 'secrets bundle holding the password (for --auth password)')
-        .option('--bundle-key <key>', "key within the bundle (default 'password')")
-        .option('--identity-file <path>', 'private-key path for --auth key')
-        .option('--clear-identity-file', 'return key auth to ssh-agent/default-key discovery')
-        .action(async (name, opts) => {
-        try {
-            configTombstoneNotice('set <name> [--platform|--user|--auth|--bundle|--bundle-key|--identity-file …]', 'config <name> <ssh.*|platform> <value>');
-            const existing = await mustGetDevice(name);
-            const nextMethod = opts.auth ?? resolveDeviceProfile(existing).auth.method;
-            if (opts.identityFile && nextMethod !== 'key') {
-                throw new Error('--identity-file requires key auth; pass --auth key in the same command.');
-            }
-            const writes = [];
-            if (opts.platform)
-                writes.push({ key: 'platform', value: opts.platform });
-            if (opts.user)
-                writes.push({ key: 'ssh.user', value: opts.user });
-            if (opts.auth)
-                writes.push({ key: 'ssh.auth', value: opts.auth });
-            if (opts.bundle)
-                writes.push({ key: 'ssh.bundle', value: opts.bundle });
-            if (opts.bundleKey)
-                writes.push({ key: 'ssh.bundle-key', value: opts.bundleKey });
-            if (opts.identityFile)
-                writes.push({ key: 'ssh.identity-file', value: opts.identityFile });
-            if (opts.clearIdentityFile)
-                writes.push({ key: 'ssh.identity-file' }); // unset
-            if (writes.length === 0) {
-                printDevicesConfig(name, false);
-                return;
-            }
-            for (const w of writes) {
-                await runDevicesConfig(name, w.key, w.value !== undefined ? [w.value] : [], { unset: w.value === undefined, quiet: true });
-            }
-            const d = resolveDeviceProfile((await mustGetDevice(name)));
-            console.log(chalk.green(`Updated device '${name}'`) + chalk.gray(` (auth: ${d.auth.method}${d.auth.bundle ? ` via ${d.auth.bundle}` : ''})`));
-        }
-        catch (err) {
-            console.error(chalk.red(err.message));
-            process.exit(1);
-        }
-    });
     devicesCmd
         .command('remove <name>')
         .alias('rm')
@@ -2633,12 +2439,40 @@ async function doDeviceTaskStop(ref) {
         process.exitCode = 1;
     }
 }
+/**
+ * Parse `--argv`'s JSON array, or report exactly what was wrong and return
+ * undefined. Fails loud rather than coercing: a caller that meant to pass argv
+ * and typo'd the JSON must not silently get shell-string semantics instead.
+ */
+export function parseArgvJson(raw, log = (line) => console.error(line)) {
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (error) {
+        log(`--argv is not valid JSON: ${error.message}`);
+        log(`Expected a JSON array of strings, e.g. --argv '["uptime","-p"]'`);
+        return undefined;
+    }
+    if (!Array.isArray(parsed)) {
+        log('--argv must be a JSON ARRAY of strings.');
+        return undefined;
+    }
+    const bad = parsed.findIndex((token) => typeof token !== 'string');
+    if (bad >= 0) {
+        log(`--argv element ${bad} is ${typeof parsed[bad]}, not a string.`);
+        log('Every element is one argv token; numbers and objects have no argv meaning.');
+        return undefined;
+    }
+    return parsed;
+}
 /** Register the `agents ssh` smart wrapper. */
 function registerSshWrapper(program) {
     const sshCmd = program
         .command('ssh <name> [cmd...]')
         .description('Connect to a registered device. Preflights reachability, picks the right shell, and authenticates (key or password-from-bundle).')
         .allowUnknownOption()
+        .option('--argv <json>', 'run a JSON array of argv tokens with exact per-token fidelity (no shell splitting)')
         .addHelpText('after', `
 Examples:
   agents ssh yosemite-s0                     # interactive login (mirrors your project dir)
@@ -2646,6 +2480,8 @@ Examples:
   agents ssh win-mini hostname               # run a command (PowerShell on Windows)
   agents ssh yosemite-s0 uptime              # run a command (POSIX)
   agents ssh auto                            # affinity-pick a device (same engine as 'agents run --device auto')
+  agents ssh box --argv '["agents","feed","post","--title","two words","a & b"]'
+                                             # exact tokens: spaces and metacharacters survive
 
 Devices come from 'agents devices'. Password auth pulls the secret from a
 secrets bundle via an askpass shim — the password never touches argv.
@@ -2660,8 +2496,31 @@ the target when it exists, else the remote home. Same portable-cwd rule as
 An 'agents browser …', 'ag browser …', or standalone 'browser …' command is
 stamped AGENTS_FLEET_REMOTE so the target's browser.remote-control consent
 gate applies, same as 'agents browser <verb> --device <name>'.
+
+--argv takes a JSON array of strings and delivers each element as exactly ONE
+token on the peer, so a token containing a space, '&', '|', '$' or a quote
+arrives intact. The positional form keeps its existing semantics — the remote
+shell parses it — so the two are mutually exclusive rather than interchangeable.
 `)
-        .action(async (name, cmd) => {
+        .action(async (name, cmd, opts) => {
+        // `--argv` is a DIFFERENT delivery contract, not a spelling of the
+        // positional form, so accepting both would have to silently pick one.
+        if (opts.argv !== undefined && cmd.length > 0) {
+            console.error(chalk.red('Pass either --argv <json> or a positional command, not both.'));
+            console.error(chalk.gray('--argv delivers exact tokens; the positional form is parsed by the remote shell.'));
+            process.exit(1);
+        }
+        let argvTokens;
+        if (opts.argv !== undefined) {
+            argvTokens = parseArgvJson(opts.argv);
+            if (!argvTokens)
+                process.exit(1);
+            if (argvTokens.length === 0) {
+                console.error(chalk.red('--argv needs at least one token (the program to run).'));
+                process.exit(1);
+            }
+            cmd = argvTokens;
+        }
         // Hidden askpass bridge: ssh execs the shim, which re-invokes us here.
         if (name === '__askpass') {
             await runAskpass();
@@ -2734,7 +2593,7 @@ gate applies, same as 'agents browser <verb> --device <name>'.
             // `agents run --device` (deriveMirroredCwd). Best-effort — a missing dir
             // falls back to the remote home. An explicit `cmd` keeps its cwd (RUSH-2412).
             const mirrorCwd = cmd.length === 0 ? deriveMirroredCwd(process.cwd()) : undefined;
-            const { args, env } = buildSshInvocation(device, cmd, shim, { pinned }, { interactiveCwd: mirrorCwd });
+            const { args, env } = buildSshInvocation(device, cmd, shim, { pinned }, { interactiveCwd: mirrorCwd, ...(argvTokens ? { argv: true } : {}) });
             // Interactive login: make the local terminal's terminfo (e.g.
             // xterm-ghostty) available on the remote so backspace/colors/clear work.
             // Best-effort + cached per host — never blocks the login (see terminfo.ts).

package/dist/commands/sync.js

@@ -514,7 +514,8 @@ async function runUmbrella(opts, quiet, outLog, errLog, json = false) {
     // into. Any explicit flag, --yes, or --json keeps the non-interactive path.
     // --json is a machine consumer (and the fleet fan-out injects it), so never
     // open a picker under it.
-    const anyExplicitFlag = !!(opts.repos || opts.secrets || opts.cloud || opts.local);
+    const kindSelection = parseKindSelection(opts);
+    const anyExplicitFlag = !!(opts.repos || opts.secrets || opts.cloud || opts.local || kindSelection);
     if (!quiet && !json && !opts.yes && !anyExplicitFlag && isInteractiveTerminal()) {
         await runInteractiveReconcile(opts, outLog, errLog);
         return;
@@ -524,7 +525,10 @@ async function runUmbrella(opts, quiet, outLog, errLog, json = false) {
         repos: opts.repos,
         secrets: opts.secrets,
         cloud: opts.cloud,
-        local: opts.local,
+        // A resource selector is a local reconcile unless the caller explicitly
+        // asks to fetch repos/secrets first. This keeps replacements such as
+        // `sync --mcp demo` scoped like the retired resource verb.
+        local: opts.local || (!!kindSelection && !opts.repos && !opts.secrets && !opts.cloud),
     };
     // Same chokepoint as `agents secrets push/pull` — prefers AGENTS_SYNC_PASSPHRASE,
     // falls back to the deprecated master-key name with a single warning.
@@ -541,6 +545,8 @@ async function runUmbrella(opts, quiet, outLog, errLog, json = false) {
             passphrase,
             // quiet under --json so refresh() cannot pollute the JSON stdout the fleet parses.
             quiet: quiet || json,
+            selection: kindSelection,
+            allowExecSurfaces: !!opts.allowExecSurfaces,
             log: (msg) => { if (!quiet && !json)
                 outLog(chalk.gray(`  ${msg}`)); },
         });
@@ -548,20 +554,22 @@ async function runUmbrella(opts, quiet, outLog, errLog, json = false) {
         // we act on central as converged by this sync rather than a stale pre-pull
         // copy that could re-claim a profile a peer already migrated. Skipped under
         // --cloud (fetch-only, no local reconcile).
-        if (!opts.cloud)
+        if (!opts.cloud && !kindSelection)
             evictCentralBrowserProfilesForSync(quiet, json, outLog, errLog);
         // Post-reconcile verification (PHNX-3186): re-read every version the reconcile
         // wrote into and confirm it now matches source. Without this the umbrella
         // printed `✓ sync: reconciled` unconditionally, the exact false-success the
         // ticket reports. Residual drift downgrades the line and sets a non-zero exit.
-        const residual = result.reconciled
+        const residual = result.reconciled && !kindSelection
             ? verifyReconciled(result.reconciledVersions.map((r) => ({ agent: r.agent, version: r.version })), cwd)
             : [];
         // Post-reconcile repair, machine-wide: no agent scope → heal every installed
         // agent, re-wire hooks the diff left behind, and repair managed hook runtime
         // shims. The stale-CLI purge runs ONLY with `--prune-clis` (never automatic).
         // Skipped under --cloud (fetch-only: nothing was reconciled to repair).
-        const repair = opts.cloud ? null : await repairAfterSync({ cwd, pruneClis: !!opts.pruneClis });
+        const repair = opts.cloud || kindSelection
+            ? null
+            : await repairAfterSync({ cwd, pruneClis: !!opts.pruneClis });
         // A repair that left something for a human (an unresolvable shim, a failed
         // rewire/purge) is a non-zero outcome, same as the deleted `doctor --fix`.
         const repairFailed = repair !== null && repairHadFailures(repair);
@@ -578,6 +586,7 @@ async function runUmbrella(opts, quiet, outLog, errLog, json = false) {
                 secrets: result.secrets,
                 devices: result.devices,
                 reconciled: result.reconciled,
+                selection: kindSelection ?? null,
                 declined: result.declined,
                 residualDrift: residual,
                 repair: repair ? repairAfterSyncJson(repair) : null,

package/dist/commands/teams.js

@@ -8,7 +8,7 @@ import { mailboxDir, enqueue } from '../lib/mailbox.js';
 import { resolveProvider } from '../lib/cloud/registry.js';
 import { emit } from '../lib/feed/events.js';
 import { maybeShowStarNudge } from '../lib/star-nudge.js';
-import { shareRuntimeEnv } from '../lib/share/config.js';
+import { shareRuntimeEnv } from '../lib/share-runtime.js';
 import { runSupervisor } from '../lib/teams/supervisor.js';
 import { debug } from '../lib/teams/debug.js';
 import { runPrWatch, DEFAULT_MAX_WAVES, } from '../lib/teams/pr-watch.js';

package/dist/commands/traces.js

@@ -3,7 +3,7 @@ import { setHelpSections } from '../lib/help.js';
 import { readSyncLedger, syncTraces } from '../lib/traces/sync.js';
 import { managedTracesBaseUrl, resolveTracesBackend } from '../lib/traces/backend.js';
 import { showUrl } from '../lib/open-url.js';
-import { DEFAULT_CF_BUNDLE, readCloudflareCreds } from '../lib/share/config.js';
+import { DEFAULT_CF_BUNDLE, readCloudflareCreds } from '../lib/cloudflare/creds.js';
 import { PHOENIX_ID_BASE } from '../lib/identity/client.js';
 import { DEFAULT_BUCKET_NAME, DEFAULT_WORKER_NAME } from '../lib/traces/config.js';
 import { DEFAULT_TRACES_DOMAIN } from '../lib/traces/backend.js';

package/dist/lib/accounts/add.d.ts

@@ -131,8 +131,3 @@ export declare function runAdd(agent: AgentId, name: string | undefined, opts: A
  * that IS how such a box logs in.
  */
 export declare function runLogin(agent: AgentId, name: string, opts: AddOptions, runners?: AddRunners): Promise<AddResult>;
-/** Back-compat alias for the retired `connect` module surface (one release). */
-export declare const runConnect: typeof runAdd;
-export declare const connectSupported: typeof addSupported;
-export declare const connectRefusal: typeof addRefusal;
-export declare const connectWorkerRefusal: typeof addWorkerRefusal;

package/dist/lib/accounts/add.js

@@ -15,8 +15,7 @@ import { ensureSlot, readSlots, recordSlot, slotDir } from './slots.js';
 export { LOGIN_INVOCATIONS };
 /**
  * `agents accounts add <harness> [name]` / `agents accounts login <harness>#<name>`
- * — the account onboarding front door (PHNX-3940, track T4; successor of the
- * `connect` module, kept as the `runConnect` alias for one release).
+ * — the account onboarding front door (PHNX-3940, track T4).
  *
  * An account is a credential SLOT, not an installation: the harness has ONE
  * managed installation (`ensureHarnessInstallation`, label `main`); every
@@ -542,11 +541,6 @@ async function _runLoginLocked(agent, name, opts, lock, runners) {
         warnings,
     };
 }
-/** Back-compat alias for the retired `connect` module surface (one release). */
-export const runConnect = runAdd;
-export const connectSupported = addSupported;
-export const connectRefusal = addRefusal;
-export const connectWorkerRefusal = addWorkerRefusal;
 /** Real runners: the install engine, an inherited-stdio login spawn, identity read, and the mint drive. */
 async function defaultAddRunners() {
     const [store, agentsMod, execMod] = await Promise.all([

package/dist/lib/artifacts-client.d.ts

@@ -0,0 +1,20 @@
+export declare const ARTIFACTS_INSTALL_HINT = "npm i -g @phnx-labs/artifacts-cli";
+export declare class ArtifactsClientError extends Error {
+    readonly code: 'ARTIFACTS_BIN_MISSING';
+    constructor(code: 'ARTIFACTS_BIN_MISSING', message: string);
+}
+/**
+ * Resolve the standalone `artifacts` executable. `ARTIFACTS_BIN` wins so a dev
+ * build can be driven without touching PATH.
+ *
+ * Resolution uses `findInPath`, which skips `~/.agents/.cache/shims` — the same
+ * load-bearing skip the secrets/computer clients rely on, so a leftover alias
+ * shim that execs back into this CLI can never be picked as the engine.
+ */
+export declare function resolveArtifactsBin(): string;
+/** How to invoke the resolved binary: a `.js` entrypoint runs through this
+ * runtime, a real executable is spawned directly. */
+export declare function invocation(bin: string): {
+    command: string;
+    prefix: string[];
+};

package/dist/lib/artifacts-client.js

@@ -0,0 +1,46 @@
+// Thin client for the standalone `artifacts` CLI (`@phnx-labs/artifacts-cli`).
+//
+// The artifact render + share ENGINE lives in artifacts-cli, not this repo
+// (PHNX-3992, mirroring the secrets/computer extractions). agents-cli calls it
+// only where a `sessions` convenience wants to publish (`agents sessions share`).
+// A missing executable fails loud with install guidance — there is no fallback
+// to a retired in-repo engine.
+import { findInPath } from './agent-spec/agents.js';
+export const ARTIFACTS_INSTALL_HINT = 'npm i -g @phnx-labs/artifacts-cli';
+export class ArtifactsClientError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = 'ArtifactsClientError';
+    }
+}
+let cachedBin = null;
+/**
+ * Resolve the standalone `artifacts` executable. `ARTIFACTS_BIN` wins so a dev
+ * build can be driven without touching PATH.
+ *
+ * Resolution uses `findInPath`, which skips `~/.agents/.cache/shims` — the same
+ * load-bearing skip the secrets/computer clients rely on, so a leftover alias
+ * shim that execs back into this CLI can never be picked as the engine.
+ */
+export function resolveArtifactsBin() {
+    if (cachedBin)
+        return cachedBin;
+    const explicit = process.env.ARTIFACTS_BIN?.trim();
+    const resolved = explicit && explicit.length > 0 ? explicit : findInPath('artifacts');
+    if (!resolved) {
+        throw new ArtifactsClientError('ARTIFACTS_BIN_MISSING', 'The standalone `artifacts` CLI was not found. Install it with:\n' +
+            `  ${ARTIFACTS_INSTALL_HINT}\n` +
+            'or point $ARTIFACTS_BIN at its executable.');
+    }
+    cachedBin = resolved;
+    return resolved;
+}
+/** How to invoke the resolved binary: a `.js` entrypoint runs through this
+ * runtime, a real executable is spawned directly. */
+export function invocation(bin) {
+    if (/\.[mc]?js$/.test(bin))
+        return { command: process.execPath, prefix: [bin] };
+    return { command: bin, prefix: [] };
+}

package/dist/lib/auth-mint.js

@@ -534,7 +534,7 @@ async function syncMintedBundles(accountName, device) {
         const accountPush = await pushBundleToHost(accountName, device, {
             remoteBackend,
             force: true,
-            operation: 'accounts mint --fleet',
+            operation: 'accounts login --fleet',
             policyNever: true,
             agentOnly: false,
             literalValues: {
@@ -550,7 +550,7 @@ async function syncMintedBundles(accountName, device) {
             const authPush = await pushBundleToHost(AUTH_BUNDLE, device, {
                 remoteBackend: 'file',
                 force: true,
-                operation: 'accounts mint --fleet',
+                operation: 'accounts login --fleet',
                 policyNever: true,
                 agentOnly: true,
             });