@phnx-labs/agents-cli 1.22.114 → 1.22.116

package/dist/commands/setup.js

@@ -20,9 +20,9 @@ import { ensureShimCurrent, switchHomeFileSymlinks, isShimsInPath, addShimsToPat
 import { setHelpSections } from '../lib/help.js';
 import { registerSetupBrowserCommand, runBrowserWizard } from './setup-browser.js';
 import { registerSetupComputerCommand, runComputerWizard } from './setup-computer.js';
-import { runShareWizard } from './artifacts-setup.js';
 import { registerSetupMineCommand } from './setup-mine.js';
 import { registerSetupSecretsCommand } from './setup-secrets.js';
+import { registerSetupTermCommand, runTermWizard, isTermCliInstalled } from './setup-term.js';
 import { registerSetupFleetCommand } from './setup-fleet.js';
 import { registerSetupAccountsCommand, runAccountsSetupWizard } from './setup-accounts.js';
 import { registerSetupWatchdogCommand, runWatchdogSetupWizard } from './setup-watchdog.js';
@@ -34,10 +34,10 @@ import { runPreferencesStep } from './setup-preferences.js';
 import { getConfiguredDefaultProfileName, getProfile, getAutoDetectedProfile, isProfileLaunchableHere } from '../lib/browser/profiles.js';
 import { listInstalledBrowsers } from '../lib/browser/chrome.js';
 import { probeComputerTrust } from './computer.js';
-import { readShareConfig } from '../lib/share/config.js';
 import { loadDevices } from '../lib/devices/registry.js';
 import { getConfigValue } from '../lib/device-config.js';
 import { setupSecretsPrefsPath } from './setup-secrets.js';
+import { SETUP_TOOLS, getCachedToolSetup, refreshToolSetup } from '../lib/setup-tool-status.js';
 const HOME = os.homedir();
 /**
  * Import an existing unmanaged agent installation into agents-cli.
@@ -279,8 +279,8 @@ export async function getSetupStatus() {
     const devices = await loadDevices();
     const coreReady = isGitRepo(getAgentsDir());
     const secretsReady = fs.existsSync(setupSecretsPrefsPath());
+    const termReady = isTermCliInstalled();
     const minted = hasMintedSetupToken();
-    const shareConfig = readShareConfig();
     const watchdogEnabled = getConfigValue('watchdog.enabled').value === true;
     const interactiveHost = getConfigValue('interactive.host').value;
     const defaultBrowser = getConfigValue('browser.profile').value;
@@ -289,9 +289,9 @@ export async function getSetupStatus() {
         { phase: 'browser', state: browserReady ? 'ready' : 'missing', detail: browserReady ? `profile ${browserProfile.name}` : browserProfile ? `profile ${browserProfile.name} cannot launch here` : installedBrowsers.length ? 'no default profile' : 'no supported browser found' },
         { phase: 'computer', state: computerState, detail: computerState === 'ready' ? 'helper trusted' : computerState === 'n/a' ? 'macOS local setup only' : 'helper not running or not trusted' },
         { phase: 'secrets', state: secretsReady ? 'ready' : 'missing', detail: secretsReady ? 'defaults chosen' : 'defaults not chosen' },
+        { phase: 'term', state: termReady ? 'ready' : 'missing', detail: termReady ? 'installed' : 'not installed (fleet login / auth mint spawn it)' },
         { phase: 'accounts', state: minted.ready ? 'ready' : 'missing', detail: minted.detail },
         { phase: 'fleet', state: Object.keys(devices).length ? 'ready' : 'missing', detail: Object.keys(devices).length ? `${Object.keys(devices).length} device${Object.keys(devices).length === 1 ? '' : 's'} registered` : 'no devices registered' },
-        { phase: 'share', state: shareConfig ? 'ready' : 'missing', detail: shareConfig?.baseUrl ?? 'endpoint not configured' },
         { phase: 'watchdog', state: watchdogEnabled ? 'ready' : 'missing', detail: watchdogEnabled ? 'enabled on this device' : 'disabled on this device' },
         { phase: 'preferences', state: interactiveHost || defaultBrowser ? 'ready' : 'missing', detail: [interactiveHost && `host ${interactiveHost}`, defaultBrowser && `browser ${defaultBrowser}`].filter(Boolean).join(' · ') || 'interactive host and browser unset' },
     ];
@@ -309,10 +309,10 @@ async function runSetupPhase(phase) {
         await runBrowserWizard();
     else if (phase === 'computer')
         await runComputerWizard();
-    else if (phase === 'share')
-        await runShareWizard();
     else if (phase === 'secrets')
         await import('./setup-secrets.js').then((m) => m.runSecretsSetupWizard());
+    else if (phase === 'term')
+        await runTermWizard();
     else if (phase === 'accounts')
         await runAccountsSetupWizard();
     else if (phase === 'fleet')
@@ -371,11 +371,12 @@ export function registerSetupCommand(program) {
         .description('Set up agents-cli, or re-open the capability onboarding hub.')
         .option('-f, --force', 'Re-run setup even if ~/.agents/.system/ already exists (use with caution)')
         .option('--no-system-repo', 'Skip cloning the system repo (you must populate ~/.agents/.system/ yourself)');
-    // Capability subcommands: `agents setup browser|computer|mine|secrets|accounts|fleet|alias|beta`.
-    // Share/artifact publishing is set up by `agents artifacts setup` (RUSH-2580);
-    // the hub below still offers it as a phase via runShareWizard.
+    // Capability subcommands: `agents setup browser|computer|term|mine|secrets|accounts|fleet|alias|beta`.
+    // Artifact publishing is no longer set up here — it lives in the standalone
+    // `artifacts` CLI (`artifacts share setup`/`join`, PHNX-3992).
     registerSetupBrowserCommand(setupCmd);
     registerSetupComputerCommand(setupCmd);
+    registerSetupTermCommand(setupCmd);
     registerSetupMineCommand(setupCmd);
     registerSetupSecretsCommand(setupCmd);
     registerSetupAccountsCommand(setupCmd);
@@ -404,9 +405,25 @@ export function registerSetupCommand(program) {
     `,
     });
     setupCmd.command('status')
-        .description('Show setup readiness for core, browser, computer, secrets, accounts, fleet, share, watchdog, and preferences.')
+        .description('Show setup readiness for core, browser, computer, secrets, term, accounts, fleet, watchdog, and preferences.')
         .option('--json', 'print machine-readable JSON')
+        .option('--tool <name>', 'Read cached standalone tool status: browser, computer, secrets, term, or all')
+        .option('--refresh', 'Explicitly refresh only the selected standalone tool health checks')
         .action(async (options) => {
+        if (options.tool || options.refresh) {
+            const selected = options.tool ?? 'all';
+            if (selected !== 'all' && !SETUP_TOOLS.includes(selected))
+                throw new Error('Unknown tool. Choose browser, computer, secrets, term, or all.');
+            const rows = options.refresh
+                ? await refreshToolSetup(selected)
+                : getCachedToolSetup().filter((row) => selected === 'all' || row.tool === selected);
+            if (options.json)
+                console.log(JSON.stringify(rows));
+            else
+                for (const row of rows)
+                    console.log(`${row.tool}: ${row.installed === false ? 'not installed' : row.readiness} · ${row.detail}`);
+            return;
+        }
         const rows = await getSetupStatus();
         if (options.json)
             console.log(JSON.stringify(rows, null, 2));
@@ -427,6 +444,7 @@ export function registerSetupCommand(program) {
       agents setup browser
       agents setup computer
       agents setup secrets
+      agents setup term
       agents setup accounts
       agents setup fleet
       agents setup watchdog
@@ -443,8 +461,8 @@ export function registerSetupCommand(program) {
       Capability setup can also be run any time on its own:
         agents setup browser    # detect a browser + create the default profile
         agents setup computer    # install the signed macOS helper + grant permissions
-        agents artifacts setup   # provision or join a Cloudflare share endpoint
         agents setup secrets     # choose secrets backend/policy defaults + import
+        agents setup term        # install the standalone term CLI (PTY engine for fleet login / auth mint)
         agents setup accounts    # mint a Claude setup-token for unattended usage/probe
         agents setup fleet       # discover Tailscale devices + configure SSH access
         agents setup watchdog    # choose which devices run the daemon watchdog pass

package/dist/commands/skills.js

@@ -511,14 +511,6 @@ Examples:
         const output = lines.join('\n');
         printWithPager(output, lines.length);
     });
-    // Deprecated alias for 'view'
-    skillsCmd
-        .command('info [name]', { hidden: true })
-        .action(async (name) => {
-        console.log(chalk.yellow('Deprecated: Use "agents skills view" instead of "agents skills info"\n'));
-        // Re-execute view command logic
-        await skillsCmd.commands.find((c) => c.name() === 'view')?.parseAsync(['view', ...(name ? [name] : [])], { from: 'user' });
-    });
 }
 /**
  * Build the row data for `agents skills list`. Each row = one central skill

package/dist/commands/ssh.d.ts

@@ -83,5 +83,11 @@ export interface HarnessInventoryOpts {
  */
 export declare function collectFleetHarnesses(opts: HarnessInventoryOpts): Promise<HostHarnessResult[]>;
 export declare function runDevicesAccounts(opts: HarnessInventoryOpts): Promise<void>;
+/**
+ * Parse `--argv`'s JSON array, or report exactly what was wrong and return
+ * undefined. Fails loud rather than coercing: a caller that meant to pass argv
+ * and typo'd the JSON must not silently get shell-string semantics instead.
+ */
+export declare function parseArgvJson(raw: string, log?: (line: string) => void): string[] | undefined;
 /** Register both `agents ssh` and `agents devices`. */
 export declare function registerSshCommands(program: Command): void;

package/dist/commands/ssh.js

@@ -58,7 +58,6 @@ import { crabboxList, crabboxFind, crabboxSshArgv } from '../lib/crabbox/cli.js'
 import { boxAddress, boxStatus, fmtIdleShort, fmtExpiresShort, registerLeaseCommand } from './lease.js';
 import { registerSnapshotCommand } from './snapshot.js';
 import { authCellColor, formatCheckedAge, isDeadVerdict, readAuthHealthCache, summarizeHostAuth, summarizeVerdicts, verdictColor, verdictLabel, writeFleetAuthRows, } from '../lib/auth-health.js';
-import { runFleetLogin } from '../lib/fleet/remote-login.js';
 import { getConfigValue, listConfig, setConfigValue, unsetConfigValue, configKeySpec, autoPoolMode, configuredDeviceRole, listConfiguredDeviceRoles, setConfiguredDeviceRole, } from '../lib/device-config.js';
 import { filterAutoPool, listWorkerDevices } from '../lib/devices/pool.js';
 import { registerCommandGroups, setHelpSections } from '../lib/help.js';
@@ -1055,46 +1054,6 @@ function renderAuthMatrix(results, opts) {
     }
     return lines;
 }
-/** Render the final `fleet login` result summary in the house auth-matrix style. */
-function renderLoginMatrix(results) {
-    const lines = [chalk.bold('Fleet login')];
-    if (results.length === 0) {
-        lines.push(chalk.gray('  Nothing pending — every requested account is already logged in.'));
-        return lines;
-    }
-    const nameW = Math.max(6, ...results.map((r) => `${r.agent}@${r.device}`.length));
-    for (const r of results) {
-        const who = `${r.agent}@${r.device}`.padEnd(nameW);
-        let badge;
-        switch (r.state) {
-            case 'authorized':
-                badge = chalk.green('authorized');
-                break;
-            case 'ready':
-                badge = chalk.cyan('code ready');
-                break;
-            case 'driving':
-                badge = chalk.yellow('driving');
-                break;
-            case 'skipped':
-                badge = chalk.gray('not remotable');
-                break;
-            case 'error':
-                badge = chalk.red('error');
-                break;
-            default:
-                badge = chalk.gray(r.state);
-                break;
-        }
-        const note = r.detail ? chalk.dim(`  ${r.detail}`) : (r.reason && !r.remotable ? chalk.dim(`  ${r.reason}`) : '');
-        lines.push(`  ${who}  ${badge}${note}`);
-    }
-    const auth = results.filter((r) => r.state === 'authorized').length;
-    const remotable = results.filter((r) => r.remotable).length;
-    lines.push('');
-    lines.push(chalk.gray(`  ${auth}/${remotable} remotable logins authorized`));
-    return lines;
-}
 /** Register the `agents devices` command tree (also aliased as `fleet`). */
 function registerDevicesCommands(program) {
     const devicesCmd = program
@@ -1122,7 +1081,8 @@ function registerDevicesCommands(program) {
         agents devices config mac-mini notes "runs the releases"
         agents devices config win-mini ssh.auth password
         agents devices config worker ssh.identity-file ~/.ssh/worker_ed25519
-        agents devices config mac-mini auto-launch.enabled off
+        agents devices disable mac-mini                       # leave the auto-placement pool (auto-launch.enabled off)
+        agents devices enable mac-mini                        # rejoin it
         agents devices describe mark-1 "gpu box — cuda 12.4"  # one-line purpose, shown in the list
         agents devices config mac-mini interactive.host zion # where agents show YOU artifacts
         agents devices render --write  # write ~/.ssh/config.d/agents include
@@ -1140,7 +1100,7 @@ function registerDevicesCommands(program) {
         { title: 'Inspect', names: ['list', 'show', 'status', 'ping', 'harnesses', 'accounts', 'snapshot'] },
         { title: 'Disposable devices', names: ['lease'] },
         { title: 'Configure a device', names: ['config', 'describe', 'render'] },
-        { title: 'Fleet operations', names: ['update', 'run', 'login', 'capture', 'apply', 'worktrees'] },
+        { title: 'Fleet operations', names: ['update', 'run', 'capture', 'apply', 'worktrees'] },
     ]);
     devicesCmd
         .command('sync')
@@ -1286,11 +1246,9 @@ function registerDevicesCommands(program) {
     // ─── devices config (unified settings surface) ────────────────────────────
     //
     // ONE command for every per-device setting: `agents devices config <name>
-    // [key] [value] [--unset] [--json]`. The retired subcommands (configure,
-    // note, set-interactive, set, enable/disable/prefer/unprefer) are hidden
-    // tombstones below — each prints a deprecation notice on STDERR (so a --json
-    // consumer's stdout stays parseable) and delegates to this same engine,
-    // preserving its old output shape and exit codes.
+    // [key] [value] [--unset] [--json]`. configure, note, set-interactive, set,
+    // prefer, and unprefer are deleted (PHNX-4051) — use this command directly.
+    // enable/disable stay as first-class sugar over auto-launch.enabled.
     /** Parse a raw CLI string into a config key's typed value (bool/int pass validation, strings verbatim). */
     const parseConfigValueInput = (spec, raw) => {
         switch (spec.type) {
@@ -1685,8 +1643,10 @@ function registerDevicesCommands(program) {
       the device itself; --fleet still writes a fleet-wide default those boxes
       inherit until they override.
 
-      The retired subcommands still work and forward here: configure, note,
-      set, set-interactive, enable, disable, prefer, unprefer.
+      configure, note, set, set-interactive, prefer, and unprefer are deleted;
+      use this command directly (auto-launch.preferred, interactive.host, or
+      any other key). enable/disable stay as first-class sugar over
+      auto-launch.enabled.
     `,
     });
     const roleCmd = devicesCmd
@@ -1765,182 +1725,6 @@ function registerDevicesCommands(program) {
       long-form scratch use 'agents devices config <name> notes "…"'.
     `,
     });
-    /** Deprecation notice for a retired subcommand — STDERR only, so a --json consumer's stdout stays parseable. */
-    const configTombstoneNotice = (retired, replacement) => {
-        console.error(chalk.yellow(`Deprecated: "agents devices ${retired}" is now "agents devices ${replacement}". Running that for you.\n`));
-    };
-    devicesCmd
-        .command('enable <name>', { hidden: true })
-        .action(async (name) => {
-        try {
-            configTombstoneNotice('enable <name>', 'config <name> auto-launch.enabled on');
-            await mustGetDevice(name);
-            // Back to the default (enabled) = remove the key.
-            await runDevicesConfig(name, 'auto-launch.enabled', [], { unset: true, quiet: true });
-            console.log(chalk.green(`Enabled '${name}'`) + chalk.gray(' for AGI EXT auto-launch.'));
-        }
-        catch (err) {
-            console.error(chalk.red(err.message));
-            process.exit(1);
-        }
-    });
-    devicesCmd
-        .command('disable <name>', { hidden: true })
-        .action(async (name) => {
-        try {
-            configTombstoneNotice('disable <name>', 'config <name> auto-launch.enabled off');
-            await mustGetDevice(name);
-            await runDevicesConfig(name, 'auto-launch.enabled', ['off'], { quiet: true });
-            console.log(chalk.green(`Disabled '${name}'`) + chalk.gray(' for AGI EXT auto-launch.'));
-        }
-        catch (err) {
-            console.error(chalk.red(err.message));
-            process.exit(1);
-        }
-    });
-    devicesCmd
-        .command('prefer <name>', { hidden: true })
-        .action(async (name) => {
-        try {
-            configTombstoneNotice('prefer <name>', 'config <name> auto-launch.preferred on');
-            await mustGetDevice(name);
-            await runDevicesConfig(name, 'auto-launch.preferred', ['on'], { quiet: true });
-            console.log(chalk.green(`Preferred '${name}'`) + chalk.gray(' for AGI EXT auto-launch.'));
-        }
-        catch (err) {
-            console.error(chalk.red(err.message));
-            process.exit(1);
-        }
-    });
-    devicesCmd
-        .command('unprefer <name>', { hidden: true })
-        .action(async (name) => {
-        try {
-            configTombstoneNotice('unprefer <name>', 'config <name> auto-launch.preferred off');
-            await mustGetDevice(name);
-            // Back to the default (not preferred) = remove the key.
-            await runDevicesConfig(name, 'auto-launch.preferred', [], { unset: true, quiet: true });
-            console.log(chalk.green(`No longer preferring '${name}'`) + chalk.gray(' for AGI EXT auto-launch.'));
-        }
-        catch (err) {
-            console.error(chalk.red(err.message));
-            process.exit(1);
-        }
-    });
-    devicesCmd
-        .command('set-interactive [name]', { hidden: true })
-        .option('--unset', 'clear the interactive host')
-        .option('--json', 'output machine-readable JSON')
-        .action(async (name, opts) => {
-        try {
-            configTombstoneNotice('set-interactive [name]', 'config <name> interactive.host <name>');
-            if (opts.unset) {
-                unsetConfigValue('interactive.host');
-                if (opts.json)
-                    writeJson({ interactiveHost: null });
-                else
-                    console.log(chalk.green('Cleared the interactive host.'));
-                return;
-            }
-            if (name) {
-                await mustGetDevice(name);
-                setConfigValue('interactive.host', name);
-                if (opts.json)
-                    writeJson({ interactiveHost: name });
-                else
-                    console.log(chalk.green(`Interactive host: '${name}'`) + chalk.gray(' — agents show you artifacts there. Clear with --unset.'));
-                return;
-            }
-            const current = getConfigValue('interactive.host').value;
-            if (opts.json) {
-                writeJson({ interactiveHost: current ?? null });
-            }
-            else if (current) {
-                console.log(`${chalk.bold('Interactive host:')} ${chalk.cyan(current)}`);
-            }
-            else {
-                console.log(chalk.gray("No interactive host set. Set one with 'agents devices config <name> interactive.host <name>'."));
-            }
-        }
-        catch (err) {
-            console.error(chalk.red(err.message));
-            process.exit(1);
-        }
-    });
-    devicesCmd
-        .command('configure <name>', { hidden: true })
-        .option('--max-agents <n>', 'cap concurrent agents')
-        .option('--scheduler <on|off>', 'allow the routines scheduler (daemon) to fire on this device')
-        .option('--json', 'output machine-readable JSON')
-        .action(async (name, opts) => {
-        try {
-            configTombstoneNotice('configure <name> [--max-agents N] [--scheduler on|off]', 'config <name> <key> <value>');
-            await mustGetDevice(name);
-            const writes = [];
-            if (opts.maxAgents !== undefined)
-                writes.push(['agents.max-concurrent', opts.maxAgents]);
-            if (opts.scheduler !== undefined) {
-                if (opts.scheduler !== 'on' && opts.scheduler !== 'off') {
-                    throw new Error(`--scheduler expects 'on' or 'off', got '${opts.scheduler}'.`);
-                }
-                writes.push(['scheduler.enabled', opts.scheduler]);
-            }
-            for (const [key, value] of writes) {
-                await runDevicesConfig(name, key, [value], { quiet: Boolean(opts.json) });
-            }
-            if (opts.json)
-                printDevicesConfig(name, true);
-            else if (writes.length === 0)
-                printDevicesConfig(name, false);
-        }
-        catch (err) {
-            console.error(chalk.red(err.message));
-            process.exit(1);
-        }
-    });
-    devicesCmd
-        .command('note <name> [text...]', { hidden: true })
-        .option('--clear', 'remove all notes from the device')
-        .option('--json', 'output machine-readable JSON')
-        .action(async (name, text, opts) => {
-        try {
-            configTombstoneNotice('note <name> [text...]', 'config <name> notes <text>');
-            await mustGetDevice(name);
-            if (opts.clear) {
-                await runDevicesConfig(name, 'notes', [], { unset: true, quiet: true });
-                if (opts.json)
-                    writeJson({ device: name, notes: [] });
-                else
-                    console.log(chalk.green(`Cleared notes on '${name}'.`));
-                return;
-            }
-            if (text.length > 0) {
-                await runDevicesConfig(name, 'notes', text, { quiet: true });
-                const notes = getConfigValue('notes', { device: name }).value ?? [];
-                if (opts.json)
-                    writeJson({ device: name, notes });
-                else
-                    console.log(chalk.green(`Noted on '${name}':`) + ` ${text.join(' ')}`);
-                return;
-            }
-            const notes = getConfigValue('notes', { device: name }).value ?? [];
-            if (opts.json) {
-                writeJson({ device: name, notes });
-            }
-            else if (notes.length > 0) {
-                console.log(chalk.bold(`Notes for '${name}'`));
-                for (const n of notes)
-                    console.log(`  ${chalk.gray('•')} ${n}`);
-            }
-            else {
-                console.log(chalk.gray(`No notes on '${name}'. Add one with 'agents devices config ${name} notes "..."'.`));
-            }
-        }
-        catch (err) {
-            console.error(chalk.red(err.message));
-            process.exit(1);
-        }
-    });
     const runList = async (opts = {}) => {
         const reg = await loadDevices();
         const names = Object.keys(reg).sort();
@@ -2027,6 +1811,34 @@ function registerDevicesCommands(program) {
         }
     };
     devicesCmd.action(runList);
+    devicesCmd
+        .command('enable <name>')
+        .description('Put a device back in the automatic-placement pool (clears auto-launch.enabled)')
+        .action(async (name) => {
+        try {
+            await mustGetDevice(name);
+            await runDevicesConfig(name, 'auto-launch.enabled', [], { unset: true, quiet: true });
+            console.log(chalk.green(`Enabled '${name}'`) + chalk.gray(' for automatic placement.'));
+        }
+        catch (err) {
+            console.error(chalk.red(err.message));
+            process.exit(1);
+        }
+    });
+    devicesCmd
+        .command('disable <name>')
+        .description('Drop a device from every automatic-placement path (sets auto-launch.enabled off)')
+        .action(async (name) => {
+        try {
+            await mustGetDevice(name);
+            await runDevicesConfig(name, 'auto-launch.enabled', ['off'], { quiet: true });
+            console.log(chalk.green(`Disabled '${name}'`) + chalk.gray(' for automatic placement.'));
+        }
+        catch (err) {
+            console.error(chalk.red(err.message));
+            process.exit(1);
+        }
+    });
     devicesCmd
         .command('list')
         .alias('ls')
@@ -2155,33 +1967,6 @@ agents devices accounts --json           # machine-readable, per-host account gr
 Collapses the installs that share one account (e.g. five claude versions on one
 email) into a single row. Use \`agents devices harnesses\` for the per-install view.`,
     });
-    devicesCmd
-        .command('login')
-        .description('Log agent CLIs into fleet boxes over SSH: drive each box\'s device-code OAuth, scrape the URL + code, and surface every pending login in one local browser page. Default drives all codes at once; --interactive walks one box at a time (codes requested just-in-time so they don\'t expire).')
-        .option('--agents <csv>', 'only these agents (comma-separated); default: every agent with a device-code flow')
-        .option('--devices <csv>', 'only these devices (comma-separated); default: every online box')
-        .option('--all', 'target every device-code pair regardless of cached login state (cold cache / forced re-login)')
-        .option('--interactive', 'guided one-box-at-a-time wizard (codes requested just-in-time)')
-        .option('--json', 'output the final result matrix as JSON')
-        .action(async (opts) => {
-        const csv = (s) => (s ? s.split(',').map((x) => x.trim()).filter(Boolean) : undefined);
-        const results = await runFleetLogin({
-            agents: csv(opts.agents),
-            devices: csv(opts.devices),
-            all: opts.all,
-            interactive: opts.interactive,
-            json: opts.json,
-        });
-        if (opts.json) {
-            console.log(JSON.stringify(results, null, 2));
-        }
-        else {
-            for (const line of renderLoginMatrix(results))
-                console.log(line);
-        }
-        if (results.some((r) => r.remotable && r.state !== 'authorized'))
-            process.exitCode = 1;
-    });
     devicesCmd
         .command('show <name>')
         .description('Show the full profile for one device.')
@@ -2214,53 +1999,6 @@ email) into a single row. Use \`agents devices harnesses\` for the per-install v
             process.exit(1);
         }
     });
-    devicesCmd
-        .command('set <name>', { hidden: true })
-        .option('--platform <platform>', 'windows | linux | macos')
-        .option('--user <user>', 'login user')
-        .option('--auth <method>', 'key | password')
-        .option('--bundle <bundle>', 'secrets bundle holding the password (for --auth password)')
-        .option('--bundle-key <key>', "key within the bundle (default 'password')")
-        .option('--identity-file <path>', 'private-key path for --auth key')
-        .option('--clear-identity-file', 'return key auth to ssh-agent/default-key discovery')
-        .action(async (name, opts) => {
-        try {
-            configTombstoneNotice('set <name> [--platform|--user|--auth|--bundle|--bundle-key|--identity-file …]', 'config <name> <ssh.*|platform> <value>');
-            const existing = await mustGetDevice(name);
-            const nextMethod = opts.auth ?? resolveDeviceProfile(existing).auth.method;
-            if (opts.identityFile && nextMethod !== 'key') {
-                throw new Error('--identity-file requires key auth; pass --auth key in the same command.');
-            }
-            const writes = [];
-            if (opts.platform)
-                writes.push({ key: 'platform', value: opts.platform });
-            if (opts.user)
-                writes.push({ key: 'ssh.user', value: opts.user });
-            if (opts.auth)
-                writes.push({ key: 'ssh.auth', value: opts.auth });
-            if (opts.bundle)
-                writes.push({ key: 'ssh.bundle', value: opts.bundle });
-            if (opts.bundleKey)
-                writes.push({ key: 'ssh.bundle-key', value: opts.bundleKey });
-            if (opts.identityFile)
-                writes.push({ key: 'ssh.identity-file', value: opts.identityFile });
-            if (opts.clearIdentityFile)
-                writes.push({ key: 'ssh.identity-file' }); // unset
-            if (writes.length === 0) {
-                printDevicesConfig(name, false);
-                return;
-            }
-            for (const w of writes) {
-                await runDevicesConfig(name, w.key, w.value !== undefined ? [w.value] : [], { unset: w.value === undefined, quiet: true });
-            }
-            const d = resolveDeviceProfile((await mustGetDevice(name)));
-            console.log(chalk.green(`Updated device '${name}'`) + chalk.gray(` (auth: ${d.auth.method}${d.auth.bundle ? ` via ${d.auth.bundle}` : ''})`));
-        }
-        catch (err) {
-            console.error(chalk.red(err.message));
-            process.exit(1);
-        }
-    });
     devicesCmd
         .command('remove <name>')
         .alias('rm')
@@ -2633,12 +2371,40 @@ async function doDeviceTaskStop(ref) {
         process.exitCode = 1;
     }
 }
+/**
+ * Parse `--argv`'s JSON array, or report exactly what was wrong and return
+ * undefined. Fails loud rather than coercing: a caller that meant to pass argv
+ * and typo'd the JSON must not silently get shell-string semantics instead.
+ */
+export function parseArgvJson(raw, log = (line) => console.error(line)) {
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (error) {
+        log(`--argv is not valid JSON: ${error.message}`);
+        log(`Expected a JSON array of strings, e.g. --argv '["uptime","-p"]'`);
+        return undefined;
+    }
+    if (!Array.isArray(parsed)) {
+        log('--argv must be a JSON ARRAY of strings.');
+        return undefined;
+    }
+    const bad = parsed.findIndex((token) => typeof token !== 'string');
+    if (bad >= 0) {
+        log(`--argv element ${bad} is ${typeof parsed[bad]}, not a string.`);
+        log('Every element is one argv token; numbers and objects have no argv meaning.');
+        return undefined;
+    }
+    return parsed;
+}
 /** Register the `agents ssh` smart wrapper. */
 function registerSshWrapper(program) {
     const sshCmd = program
         .command('ssh <name> [cmd...]')
         .description('Connect to a registered device. Preflights reachability, picks the right shell, and authenticates (key or password-from-bundle).')
         .allowUnknownOption()
+        .option('--argv <json>', 'run a JSON array of argv tokens with exact per-token fidelity (no shell splitting)')
         .addHelpText('after', `
 Examples:
   agents ssh yosemite-s0                     # interactive login (mirrors your project dir)
@@ -2646,6 +2412,8 @@ Examples:
   agents ssh win-mini hostname               # run a command (PowerShell on Windows)
   agents ssh yosemite-s0 uptime              # run a command (POSIX)
   agents ssh auto                            # affinity-pick a device (same engine as 'agents run --device auto')
+  agents ssh box --argv '["agents","feed","post","--title","two words","a & b"]'
+                                             # exact tokens: spaces and metacharacters survive
 
 Devices come from 'agents devices'. Password auth pulls the secret from a
 secrets bundle via an askpass shim — the password never touches argv.
@@ -2660,8 +2428,31 @@ the target when it exists, else the remote home. Same portable-cwd rule as
 An 'agents browser …', 'ag browser …', or standalone 'browser …' command is
 stamped AGENTS_FLEET_REMOTE so the target's browser.remote-control consent
 gate applies, same as 'agents browser <verb> --device <name>'.
+
+--argv takes a JSON array of strings and delivers each element as exactly ONE
+token on the peer, so a token containing a space, '&', '|', '$' or a quote
+arrives intact. The positional form keeps its existing semantics — the remote
+shell parses it — so the two are mutually exclusive rather than interchangeable.
 `)
-        .action(async (name, cmd) => {
+        .action(async (name, cmd, opts) => {
+        // `--argv` is a DIFFERENT delivery contract, not a spelling of the
+        // positional form, so accepting both would have to silently pick one.
+        if (opts.argv !== undefined && cmd.length > 0) {
+            console.error(chalk.red('Pass either --argv <json> or a positional command, not both.'));
+            console.error(chalk.gray('--argv delivers exact tokens; the positional form is parsed by the remote shell.'));
+            process.exit(1);
+        }
+        let argvTokens;
+        if (opts.argv !== undefined) {
+            argvTokens = parseArgvJson(opts.argv);
+            if (!argvTokens)
+                process.exit(1);
+            if (argvTokens.length === 0) {
+                console.error(chalk.red('--argv needs at least one token (the program to run).'));
+                process.exit(1);
+            }
+            cmd = argvTokens;
+        }
         // Hidden askpass bridge: ssh execs the shim, which re-invokes us here.
         if (name === '__askpass') {
             await runAskpass();
@@ -2734,7 +2525,7 @@ gate applies, same as 'agents browser <verb> --device <name>'.
             // `agents run --device` (deriveMirroredCwd). Best-effort — a missing dir
             // falls back to the remote home. An explicit `cmd` keeps its cwd (RUSH-2412).
             const mirrorCwd = cmd.length === 0 ? deriveMirroredCwd(process.cwd()) : undefined;
-            const { args, env } = buildSshInvocation(device, cmd, shim, { pinned }, { interactiveCwd: mirrorCwd });
+            const { args, env } = buildSshInvocation(device, cmd, shim, { pinned }, { interactiveCwd: mirrorCwd, ...(argvTokens ? { argv: true } : {}) });
             // Interactive login: make the local terminal's terminfo (e.g.
             // xterm-ghostty) available on the remote so backspace/colors/clear work.
             // Best-effort + cached per host — never blocks the login (see terminfo.ts).