@phnx-labs/agents-cli 1.22.114 → 1.22.116

package/dist/commands/sync.js

@@ -514,7 +514,8 @@ async function runUmbrella(opts, quiet, outLog, errLog, json = false) {
     // into. Any explicit flag, --yes, or --json keeps the non-interactive path.
     // --json is a machine consumer (and the fleet fan-out injects it), so never
     // open a picker under it.
-    const anyExplicitFlag = !!(opts.repos || opts.secrets || opts.cloud || opts.local);
+    const kindSelection = parseKindSelection(opts);
+    const anyExplicitFlag = !!(opts.repos || opts.secrets || opts.cloud || opts.local || kindSelection);
     if (!quiet && !json && !opts.yes && !anyExplicitFlag && isInteractiveTerminal()) {
         await runInteractiveReconcile(opts, outLog, errLog);
         return;
@@ -524,7 +525,10 @@ async function runUmbrella(opts, quiet, outLog, errLog, json = false) {
         repos: opts.repos,
         secrets: opts.secrets,
         cloud: opts.cloud,
-        local: opts.local,
+        // A resource selector is a local reconcile unless the caller explicitly
+        // asks to fetch repos/secrets first. This keeps replacements such as
+        // `sync --mcp demo` scoped like the retired resource verb.
+        local: opts.local || (!!kindSelection && !opts.repos && !opts.secrets && !opts.cloud),
     };
     // Same chokepoint as `agents secrets push/pull` — prefers AGENTS_SYNC_PASSPHRASE,
     // falls back to the deprecated master-key name with a single warning.
@@ -541,6 +545,8 @@ async function runUmbrella(opts, quiet, outLog, errLog, json = false) {
             passphrase,
             // quiet under --json so refresh() cannot pollute the JSON stdout the fleet parses.
             quiet: quiet || json,
+            selection: kindSelection,
+            allowExecSurfaces: !!opts.allowExecSurfaces,
             log: (msg) => { if (!quiet && !json)
                 outLog(chalk.gray(`  ${msg}`)); },
         });
@@ -548,20 +554,22 @@ async function runUmbrella(opts, quiet, outLog, errLog, json = false) {
         // we act on central as converged by this sync rather than a stale pre-pull
         // copy that could re-claim a profile a peer already migrated. Skipped under
         // --cloud (fetch-only, no local reconcile).
-        if (!opts.cloud)
+        if (!opts.cloud && !kindSelection)
             evictCentralBrowserProfilesForSync(quiet, json, outLog, errLog);
         // Post-reconcile verification (PHNX-3186): re-read every version the reconcile
         // wrote into and confirm it now matches source. Without this the umbrella
         // printed `✓ sync: reconciled` unconditionally, the exact false-success the
         // ticket reports. Residual drift downgrades the line and sets a non-zero exit.
-        const residual = result.reconciled
+        const residual = result.reconciled && !kindSelection
             ? verifyReconciled(result.reconciledVersions.map((r) => ({ agent: r.agent, version: r.version })), cwd)
             : [];
         // Post-reconcile repair, machine-wide: no agent scope → heal every installed
         // agent, re-wire hooks the diff left behind, and repair managed hook runtime
         // shims. The stale-CLI purge runs ONLY with `--prune-clis` (never automatic).
         // Skipped under --cloud (fetch-only: nothing was reconciled to repair).
-        const repair = opts.cloud ? null : await repairAfterSync({ cwd, pruneClis: !!opts.pruneClis });
+        const repair = opts.cloud || kindSelection
+            ? null
+            : await repairAfterSync({ cwd, pruneClis: !!opts.pruneClis });
         // A repair that left something for a human (an unresolvable shim, a failed
         // rewire/purge) is a non-zero outcome, same as the deleted `doctor --fix`.
         const repairFailed = repair !== null && repairHadFailures(repair);
@@ -578,6 +586,7 @@ async function runUmbrella(opts, quiet, outLog, errLog, json = false) {
                 secrets: result.secrets,
                 devices: result.devices,
                 reconciled: result.reconciled,
+                selection: kindSelection ?? null,
                 declined: result.declined,
                 residualDrift: residual,
                 repair: repair ? repairAfterSyncJson(repair) : null,

package/dist/commands/teams.js

@@ -8,7 +8,7 @@ import { mailboxDir, enqueue } from '../lib/mailbox.js';
 import { resolveProvider } from '../lib/cloud/registry.js';
 import { emit } from '../lib/feed/events.js';
 import { maybeShowStarNudge } from '../lib/star-nudge.js';
-import { shareRuntimeEnv } from '../lib/share/config.js';
+import { shareRuntimeEnv } from '../lib/share-runtime.js';
 import { runSupervisor } from '../lib/teams/supervisor.js';
 import { debug } from '../lib/teams/debug.js';
 import { runPrWatch, DEFAULT_MAX_WAVES, } from '../lib/teams/pr-watch.js';

package/dist/commands/traces.js

@@ -3,7 +3,7 @@ import { setHelpSections } from '../lib/help.js';
 import { readSyncLedger, syncTraces } from '../lib/traces/sync.js';
 import { managedTracesBaseUrl, resolveTracesBackend } from '../lib/traces/backend.js';
 import { showUrl } from '../lib/open-url.js';
-import { DEFAULT_CF_BUNDLE, readCloudflareCreds } from '../lib/share/config.js';
+import { DEFAULT_CF_BUNDLE, readCloudflareCreds } from '../lib/cloudflare/creds.js';
 import { PHOENIX_ID_BASE } from '../lib/identity/client.js';
 import { DEFAULT_BUCKET_NAME, DEFAULT_WORKER_NAME } from '../lib/traces/config.js';
 import { DEFAULT_TRACES_DOMAIN } from '../lib/traces/backend.js';

package/dist/lib/accounting/rotate.d.ts

@@ -4,7 +4,7 @@
  * Detects which installed versions have expired credentials and rotates
  * authentication tokens so users maintain active sessions across version switches.
  */
-import type { AgentId, RunStrategy } from '../types.js';
+import { type AgentId, type RunStrategy } from '../types.js';
 import type { FallbackEntry } from '../exec.js';
 import { PROJECTION_HORIZON_MIN, capacityWeight } from './capacity.js';
 import { type AccountInfo, type CredentialPresence } from '../agents.js';
@@ -549,6 +549,68 @@ export declare const DEFAULT_ROTATION_FAILOVER_LIMIT = 3;
  * completely unchanged.
  */
 export declare function rotationFailoverChain(rotation: RotateResult | null, pickedVersion: string, limit?: number): FallbackEntry[];
+/**
+ * Whether a run SHAPE may take the preflight alternate-harness handoff
+ * ({@link preflightFallbackHandoff}) — the sibling of
+ * {@link shouldArmRotationFailover}, and load-bearing for the same reason.
+ *
+ * The handoff consumes the entry it uses from the `--fallback` spec, and the
+ * canonical `--fallback` validation runs LATER in the run command: it rejects a
+ * chain on an interactive, `--acp`, `--loop`, or `--resume-checkpoint` run, and
+ * requires a prompt. Handing off first on one of those shapes would empty the
+ * spec, leave that guard nothing to reject, and let the run proceed as the
+ * alternate harness — an interactive Codex launch from
+ * `agents run claude --interactive --fallback codex`, which the CLI refuses
+ * today. Gating the shape here keeps the original validation intact: an
+ * ineligible shape never switches, so the spec survives and still fails there
+ * with its own message.
+ *
+ * `resume` and `workflowScoped` are excluded for their own reasons: a resume is
+ * bound to the session's OWN harness, and a workflow's tool/MCP scoping is
+ * claude-only, so switching harness would silently drop the declared sandbox —
+ * the fail-open `runWithFallback` only warns about.
+ *
+ * Pure so the matrix is unit-testable without invoking the run command.
+ */
+export interface PreflightHandoffContext {
+    hasPrompt: boolean;
+    interactive: boolean;
+    acp: boolean;
+    loop: boolean;
+    resumeCheckpoint: boolean;
+    resume: boolean;
+    workflowScoped: boolean;
+}
+export declare function preflightHandoffEligible(ctx: PreflightHandoffContext): boolean;
+/**
+ * The permitted alternate harness to launch when EVERY account of the primary
+ * agent is already exhausted at PREFLIGHT (PHNX-3999 F19).
+ *
+ * `runWithFallback` only reaches a `--fallback` entry after the primary has
+ * actually RUN and hit a rate limit. When the primary's accounts are throttled
+ * before the run starts, version resolution reports `exhausted` and the run used
+ * to exit — so the alternate a user configured for exactly this case never fired.
+ * This resolves the first usable alternate from the same `--fallback` spec, and
+ * returns the remainder of the spec so the alternate becomes the primary and is
+ * not also listed as its own fallback.
+ *
+ * Deliberately NOT a second parser: an entry this cannot resolve exactly — a
+ * typo, an alias the canonical parse would fuzzy-match, the primary itself —
+ * makes the WHOLE spec yield `null`, so the run reaches the one canonical
+ * `--fallback` parse and fails (or corrects) there with the message it already
+ * has. `--fallback typoo,codex` must never silently launch codex while dropping
+ * `typoo`.
+ *
+ * Returns `null` when there is no spec, when any entry is not an exact agent id
+ * or names the primary, or when the primary is only sign-in-recoverable rather
+ * than throttled — a logged-out account is fixed by logging in, not by silently
+ * running a different harness.
+ */
+export declare function preflightFallbackHandoff(spec: string | undefined, primary: AgentId, exhausted: RotateCandidate[]): {
+    agent: AgentId;
+    version?: string;
+    remainingSpec?: string;
+} | null;
 /**
  * Whether a run is eligible to have a mid-run rate-limit failover chain armed
  * (issue #348). Failover injects synthesized `FallbackEntry`s into the same

package/dist/lib/accounting/rotate.js

@@ -6,6 +6,7 @@
  */
 import * as fs from 'fs';
 import * as path from 'path';
+import { isAgentId } from '../types.js';
 import { PROJECTION_HORIZON_MIN, capacityWeight } from './capacity.js';
 import { accountDisplayLabel, getAccountInfo, credentialPresence, ALL_AGENT_IDS, } from '../agents.js';
 import { readMeta, getHelpersDir } from '../state.js';
@@ -1206,6 +1207,61 @@ export function rotationFailoverChain(rotation, pickedVersion, limit = DEFAULT_R
     }
     return chain;
 }
+export function preflightHandoffEligible(ctx) {
+    return (ctx.hasPrompt &&
+        !ctx.interactive &&
+        !ctx.acp &&
+        !ctx.loop &&
+        !ctx.resumeCheckpoint &&
+        !ctx.resume &&
+        !ctx.workflowScoped);
+}
+/**
+ * The permitted alternate harness to launch when EVERY account of the primary
+ * agent is already exhausted at PREFLIGHT (PHNX-3999 F19).
+ *
+ * `runWithFallback` only reaches a `--fallback` entry after the primary has
+ * actually RUN and hit a rate limit. When the primary's accounts are throttled
+ * before the run starts, version resolution reports `exhausted` and the run used
+ * to exit — so the alternate a user configured for exactly this case never fired.
+ * This resolves the first usable alternate from the same `--fallback` spec, and
+ * returns the remainder of the spec so the alternate becomes the primary and is
+ * not also listed as its own fallback.
+ *
+ * Deliberately NOT a second parser: an entry this cannot resolve exactly — a
+ * typo, an alias the canonical parse would fuzzy-match, the primary itself —
+ * makes the WHOLE spec yield `null`, so the run reaches the one canonical
+ * `--fallback` parse and fails (or corrects) there with the message it already
+ * has. `--fallback typoo,codex` must never silently launch codex while dropping
+ * `typoo`.
+ *
+ * Returns `null` when there is no spec, when any entry is not an exact agent id
+ * or names the primary, or when the primary is only sign-in-recoverable rather
+ * than throttled — a logged-out account is fixed by logging in, not by silently
+ * running a different harness.
+ */
+export function preflightFallbackHandoff(spec, primary, exhausted) {
+    if (!spec)
+        return null;
+    if (exhausted.length === 0)
+        return null;
+    if (signInRecoverableCandidates(exhausted).length > 0)
+        return null;
+    const entries = spec.split(',').map((e) => e.trim()).filter(Boolean);
+    if (entries.length === 0)
+        return null;
+    const parsed = entries.map((entry) => entry.split('@'));
+    // Every entry has to be exactly resolvable, or this defers entirely.
+    if (parsed.some(([name]) => !isAgentId(name) || name === primary))
+        return null;
+    const [name, version] = parsed[0];
+    const remaining = entries.slice(1);
+    return {
+        agent: name,
+        version: version || undefined,
+        remainingSpec: remaining.length > 0 ? remaining.join(',') : undefined,
+    };
+}
 export function shouldArmRotationFailover(ctx) {
     return (ctx.hasRotation &&
         ctx.hasVersion &&

package/dist/lib/accounts/add.d.ts

@@ -131,8 +131,3 @@ export declare function runAdd(agent: AgentId, name: string | undefined, opts: A
  * that IS how such a box logs in.
  */
 export declare function runLogin(agent: AgentId, name: string, opts: AddOptions, runners?: AddRunners): Promise<AddResult>;
-/** Back-compat alias for the retired `connect` module surface (one release). */
-export declare const runConnect: typeof runAdd;
-export declare const connectSupported: typeof addSupported;
-export declare const connectRefusal: typeof addRefusal;
-export declare const connectWorkerRefusal: typeof addWorkerRefusal;

package/dist/lib/accounts/add.js

@@ -15,8 +15,7 @@ import { ensureSlot, readSlots, recordSlot, slotDir } from './slots.js';
 export { LOGIN_INVOCATIONS };
 /**
  * `agents accounts add <harness> [name]` / `agents accounts login <harness>#<name>`
- * — the account onboarding front door (PHNX-3940, track T4; successor of the
- * `connect` module, kept as the `runConnect` alias for one release).
+ * — the account onboarding front door (PHNX-3940, track T4).
  *
  * An account is a credential SLOT, not an installation: the harness has ONE
  * managed installation (`ensureHarnessInstallation`, label `main`); every
@@ -90,11 +89,11 @@ export function workerProvisioningHint(agent) {
             parts.push(env === 'provider' ? 'a provider API key collected by add (--api-key)' : `the ${env} collected by add (--api-key)`);
         }
         else if (kind.startsWith('per-device')) {
-            parts.push(`per-device login on each worker (--per-device / agents fleet login ${agent})`);
+            parts.push(`per-device login on each worker (--per-device; run \`agents run ${agent} --device <box>\` there and complete its native login)`);
         }
     }
     if (parts.length === 0)
-        return `${agent} has no portable credential — it logs in per box (agents fleet login ${agent})`;
+        return `${agent} has no portable credential — it logs in per box (run \`agents run ${agent} --device <box>\` on the worker and complete its native login)`;
     return parts.join(', or ');
 }
 /**
@@ -542,11 +541,6 @@ async function _runLoginLocked(agent, name, opts, lock, runners) {
         warnings,
     };
 }
-/** Back-compat alias for the retired `connect` module surface (one release). */
-export const runConnect = runAdd;
-export const connectSupported = addSupported;
-export const connectRefusal = addRefusal;
-export const connectWorkerRefusal = addWorkerRefusal;
 /** Real runners: the install engine, an inherited-stdio login spawn, identity read, and the mint drive. */
 async function defaultAddRunners() {
     const [store, agentsMod, execMod] = await Promise.all([

package/dist/lib/accounts/slots.js

@@ -13,7 +13,8 @@
  */
 import * as fs from 'node:fs';
 import * as path from 'node:path';
-import { agentConfigDirName } from '../agents.js';
+import { AGENTS, agentConfigDirName } from '../agents.js';
+import { createLink } from '../platform/links.js';
 import { harnessAuth, harnessWorkerIsPerDevice } from '../harness-auth-capabilities.js';
 import { installSessionTrackerHookSync } from '../hooks/install.js';
 import { getGlobalDefault, getVersionHomePath, listInstalledVersions } from '../installations/store.js';
@@ -64,7 +65,36 @@ function projectResources(harness, version, destHome, fromHome) {
         if (!writer)
             continue;
         if (kind === 'rules') {
-            writer.write({ version, versionHome: destHome, selection: { preset: 'default' }, cwd });
+            // Symlink to the version home's rules instead of composing a duplicate.
+            // Harnesses whose shim pins a separate config dir (e.g. CLAUDE_CONFIG_DIR
+            // → account slot) cause the harness to load rules from both the version
+            // home (~/.claude/) and the slot, doubling ~5 K tokens per session.
+            // A symlink gives both paths the same inode so the harness can dedup.
+            const cap = AGENTS[harness].capabilities.rules;
+            if (typeof cap !== 'object')
+                continue;
+            const srcFile = path.join(fromHome, agentConfigDirName(harness), cap.file);
+            if (!fs.existsSync(srcFile)) {
+                writer.write({ version, versionHome: destHome, selection: { preset: 'default' }, cwd });
+                continue;
+            }
+            const destFile = path.join(destHome, agentConfigDirName(harness), cap.file);
+            fs.mkdirSync(path.dirname(destFile), { recursive: true });
+            try {
+                const st = fs.lstatSync(destFile);
+                if (st.isSymbolicLink() || st.isFile())
+                    fs.unlinkSync(destFile);
+            }
+            catch { /* did not exist */ }
+            try {
+                createLink(srcFile, destFile);
+            }
+            catch (err) {
+                if (err.code === 'EEXIST') {
+                    continue;
+                }
+                throw err;
+            }
             continue;
         }
         const names = getDetector(kind, harness)?.list({ version, versionHome: fromHome, cwd }) ?? [];

package/dist/lib/answer-router.d.ts

@@ -10,7 +10,7 @@
  * This module picks the delivery mechanism from (open feed block × session
  * liveness × runtime rail). Pure — unit-testable without a live terminal.
  */
-import type { OpenBlock, BlockOption } from './feed/feed.js';
+import { type OpenBlock, type BlockOption } from './feed/feed.js';
 import type { ActiveSession } from './session/active.js';
 import type { InjectTarget } from './terminal/index.js';
 export type AnswerRouteKind = 'mailbox' | 'tmux' | 'iterm' | 'resume' | 'refuse';
@@ -67,7 +67,16 @@ export declare function keystrokesForAnswer(answer: string, options?: Array<Pick
 };
 /** True when the session is waiting on user input (parked on a question/plan). */
 export declare function isParkedOnInput(session: ActiveSession | null | undefined): boolean;
-/** True when an open feed block still needs an answer. */
+/**
+ * True when an open feed block still needs an answer.
+ *
+ * Openness comes from {@link deriveBlockState}, not from `block.answer` being
+ * truthy: a PENDING claim records the answer while deliberately leaving the
+ * block `open` (feed.ts `recordAnswer`'s two-phase mode), so reading the field
+ * directly would call a claimed-but-undelivered block "closed" — and a retry of
+ * a stranded claim would then re-route a parked headless agent to the mailbox it
+ * will never drain (PHNX-3999).
+ */
 export declare function isOpenQuestionBlock(block: OpenBlock | null | undefined): boolean;
 /**
  * Pick the delivery mechanism for one answer.

package/dist/lib/answer-router.js

@@ -1,3 +1,16 @@
+/**
+ * Parked-agent answer router (RUSH-1474).
+ *
+ * `agents message` historically only enqueued into the mailbox (delivered at the
+ * next PreToolUse). That steers a *running* agent between tool calls but never
+ * unblocks a *parked* agent:
+ *   - interactive TUI open on AskUserQuestion (needs keystrokes, not context)
+ *   - headless run waiting on input (no next tool call; needs resume)
+ *
+ * This module picks the delivery mechanism from (open feed block × session
+ * liveness × runtime rail). Pure — unit-testable without a live terminal.
+ */
+import { deriveBlockState } from './feed/feed.js';
 import { addressabilityRecoveryHint } from './terminal/resolve.js';
 import { injectTargetFromReplyRail } from './session/inject.js';
 /** The Escape keystroke as its raw control byte — what a tmux/iterm rail reads as a real Escape. */
@@ -64,11 +77,22 @@ export function isParkedOnInput(session) {
     }
     return false;
 }
-/** True when an open feed block still needs an answer. */
+/**
+ * True when an open feed block still needs an answer.
+ *
+ * Openness comes from {@link deriveBlockState}, not from `block.answer` being
+ * truthy: a PENDING claim records the answer while deliberately leaving the
+ * block `open` (feed.ts `recordAnswer`'s two-phase mode), so reading the field
+ * directly would call a claimed-but-undelivered block "closed" — and a retry of
+ * a stranded claim would then re-route a parked headless agent to the mailbox it
+ * will never drain (PHNX-3999).
+ */
 export function isOpenQuestionBlock(block) {
     if (!block)
         return false;
-    if (block.answer || block.parkedAt || block.continuedAt || block.defaultedAt)
+    if (block.parkedAt || block.continuedAt || block.defaultedAt)
+        return false;
+    if (deriveBlockState(block) !== 'open')
         return false;
     return (block.questions?.length ?? 0) > 0;
 }

package/dist/lib/artifacts-client.d.ts

@@ -0,0 +1,20 @@
+export declare const ARTIFACTS_INSTALL_HINT = "npm i -g @phnx-labs/artifacts-cli";
+export declare class ArtifactsClientError extends Error {
+    readonly code: 'ARTIFACTS_BIN_MISSING';
+    constructor(code: 'ARTIFACTS_BIN_MISSING', message: string);
+}
+/**
+ * Resolve the standalone `artifacts` executable. `ARTIFACTS_BIN` wins so a dev
+ * build can be driven without touching PATH.
+ *
+ * Resolution uses `findInPath`, which skips `~/.agents/.cache/shims` — the same
+ * load-bearing skip the secrets/computer clients rely on, so a leftover alias
+ * shim that execs back into this CLI can never be picked as the engine.
+ */
+export declare function resolveArtifactsBin(): string;
+/** How to invoke the resolved binary: a `.js` entrypoint runs through this
+ * runtime, a real executable is spawned directly. */
+export declare function invocation(bin: string): {
+    command: string;
+    prefix: string[];
+};

package/dist/lib/artifacts-client.js

@@ -0,0 +1,46 @@
+// Thin client for the standalone `artifacts` CLI (`@phnx-labs/artifacts-cli`).
+//
+// The artifact render + share ENGINE lives in artifacts-cli, not this repo
+// (PHNX-3992, mirroring the secrets/computer extractions). agents-cli calls it
+// only where a `sessions` convenience wants to publish (`agents sessions share`).
+// A missing executable fails loud with install guidance — there is no fallback
+// to a retired in-repo engine.
+import { findInPath } from './agent-spec/agents.js';
+export const ARTIFACTS_INSTALL_HINT = 'npm i -g @phnx-labs/artifacts-cli';
+export class ArtifactsClientError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = 'ArtifactsClientError';
+    }
+}
+let cachedBin = null;
+/**
+ * Resolve the standalone `artifacts` executable. `ARTIFACTS_BIN` wins so a dev
+ * build can be driven without touching PATH.
+ *
+ * Resolution uses `findInPath`, which skips `~/.agents/.cache/shims` — the same
+ * load-bearing skip the secrets/computer clients rely on, so a leftover alias
+ * shim that execs back into this CLI can never be picked as the engine.
+ */
+export function resolveArtifactsBin() {
+    if (cachedBin)
+        return cachedBin;
+    const explicit = process.env.ARTIFACTS_BIN?.trim();
+    const resolved = explicit && explicit.length > 0 ? explicit : findInPath('artifacts');
+    if (!resolved) {
+        throw new ArtifactsClientError('ARTIFACTS_BIN_MISSING', 'The standalone `artifacts` CLI was not found. Install it with:\n' +
+            `  ${ARTIFACTS_INSTALL_HINT}\n` +
+            'or point $ARTIFACTS_BIN at its executable.');
+    }
+    cachedBin = resolved;
+    return resolved;
+}
+/** How to invoke the resolved binary: a `.js` entrypoint runs through this
+ * runtime, a real executable is spawned directly. */
+export function invocation(bin) {
+    if (/\.[mc]?js$/.test(bin))
+        return { command: process.execPath, prefix: [bin] };
+    return { command: bin, prefix: [] };
+}

package/dist/lib/auth-mint.d.ts

@@ -1,8 +1,8 @@
 /**
  * First-class setup-token mint + seed (PHNX-2364).
  *
- * Closes the mint-auth manual recipe: drive `claude setup-token` through the
- * same injectable term driver `agents fleet login` uses, capture a well-formed
+ * Closes the mint-auth manual recipe: drive `claude setup-token` through an
+ * injectable term driver (`lib/term-driver.ts`), capture a well-formed
  * `sk-ant-oat01-…` token (the #1767 ANSI-banner guard), and seed BOTH:
  *
  *   1. a named provider account (`agents accounts add` shape, policy never)
@@ -16,7 +16,7 @@
 import type { AgentId, Meta } from './types.js';
 import { type CredentialAccount } from './account-registry.js';
 import { type StorableCredentialKind } from './secrets-policy.js';
-import { type DriveOptions, type TermDriver } from './fleet/remote-login.js';
+import { type DriveOptions, type TermDriver } from './term-driver.js';
 /** Well-formed Claude setup-token as it appears inside a TTY blob. */
 export declare const CLAUDE_SETUP_TOKEN_CAPTURE_RE: RegExp;
 export interface MintFlow {
@@ -37,7 +37,8 @@ export interface MintFlow {
  * key, COLLECTED via `--api-key` or a prompt by `accounts add` (never derived
  * from OAuth). The api-key entries describe collection only — they have no
  * mint argv, and `mintAndSeed` refuses them with the `accounts add` pointer.
- * Native device-code login (kimi/antigravity) stays on `agents fleet login`.
+ * A token-less harness (kimi/antigravity) has no portable credential and logs
+ * in per box (run it there and complete its native login).
  * The apiKeyEnv values are pinned to HARNESS_AUTH's `api-key:<ENV>` worker
  * kinds by auth-mint.test.ts — keep them in lockstep.
  */

package/dist/lib/auth-mint.js

@@ -5,7 +5,7 @@ import { bundleBackendSync, isSecretsClientError, bundleExists, bundleExistsSync
 import { assertStorableCredentialKind, reservedStoreName, } from './secrets-policy.js';
 import { getBinaryPath, getGlobalDefault, getVersionHomePath, listInstalledVersions } from './installations/versions.js';
 import { shellQuote } from './ssh-exec.js';
-import { defaultTermDriver, } from './fleet/remote-login.js';
+import { defaultTermDriver, } from './term-driver.js';
 import { showUrl } from './open-url.js';
 import { loadDevices } from './devices/registry.js';
 import { isSelfHost } from './devices/self-host.js';
@@ -21,7 +21,8 @@ const EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
  * key, COLLECTED via `--api-key` or a prompt by `accounts add` (never derived
  * from OAuth). The api-key entries describe collection only — they have no
  * mint argv, and `mintAndSeed` refuses them with the `accounts add` pointer.
- * Native device-code login (kimi/antigravity) stays on `agents fleet login`.
+ * A token-less harness (kimi/antigravity) has no portable credential and logs
+ * in per box (run it there and complete its native login).
  * The apiKeyEnv values are pinned to HARNESS_AUTH's `api-key:<ENV>` worker
  * kinds by auth-mint.test.ts — keep them in lockstep.
  */
@@ -63,7 +64,7 @@ export function unmintableMessage(harness) {
     return [
         `Cannot mint a setup-token for '${harness}'.`,
         `Interactive setup-token mint is implemented for: ${listMintableHarnesses().join(', ')}.`,
-        `Device-code native login is \`agents fleet login --agent ${harness}\`.`,
+        `A token-less harness like '${harness}' logs in per box — run it on that device and complete its native login.`,
         `API-key / pasted-token accounts use \`agents accounts add <name> --provider <provider> --auth api-key\`.`,
     ].join(' ');
 }
@@ -534,7 +535,7 @@ async function syncMintedBundles(accountName, device) {
         const accountPush = await pushBundleToHost(accountName, device, {
             remoteBackend,
             force: true,
-            operation: 'accounts mint --fleet',
+            operation: 'accounts login --fleet',
             policyNever: true,
             agentOnly: false,
             literalValues: {
@@ -550,7 +551,7 @@ async function syncMintedBundles(accountName, device) {
             const authPush = await pushBundleToHost(AUTH_BUNDLE, device, {
                 remoteBackend: 'file',
                 force: true,
-                operation: 'accounts mint --fleet',
+                operation: 'accounts login --fleet',
                 policyNever: true,
                 agentOnly: true,
             });

package/dist/lib/browser/drivers/arc.d.ts

@@ -7,7 +7,7 @@ interface ArcNativeTab extends ArcNativeTabRef {
     url: string;
     title: string;
 }
-interface ArcEnumeratedSpace {
+export interface ArcEnumeratedSpace {
     windowId: string;
     spaceId: string;
     spaceTitle: string;

package/dist/lib/browser/runtime-state.d.ts

@@ -144,10 +144,59 @@ export declare function listAllProfileSnapshots(): ProfileSnapshot[];
  * alone — we'd rather leak than wrongly kill a user-owned process that
  * happens to share metadata.
  */
+/**
+ * Clean up what a DEAD daemon genuinely left behind — which is not the browser.
+ *
+ * A live local browser outliving its daemon is the NORMAL case, not an orphan.
+ * `BrowserService.shutdown` deliberately closes only CDP and leaves the browser
+ * running, and on macOS the spawn is detached so the daemon's own positive-pid
+ * `killTree` reaches the daemon alone. This reaper used to read "the recorded
+ * `daemonPid` has exited" as "everything it recorded is garbage" and SIGTERM the
+ * browser — so replacing the daemon (a menubar activation, an upgrade, a crash
+ * restart) killed a browser the user was looking at, and `clearProfileRuntime`
+ * then removed the `port`/meta that {@link readProfileRuntime} needs, so even a
+ * survivor could not be re-attached and a second browser would launch beside it.
+ *
+ * The three cases are now decided independently:
+ *
+ * - **A live local browser/electron is preserved untouched** — not signalled, not
+ *   cleared, and its `daemonPid` deliberately NOT rewritten. Ownership is adopted
+ *   only after an identity-checked attach succeeds (`adoptProfileRuntimeOwner`,
+ *   called from the reuse branch in `BrowserService.connectProfile`), so nothing
+ *   claims a browser it has not proven it can talk to. Re-running this is a no-op.
+ * - **A dead browser record is cleared**, with no signal sent: there is nothing
+ *   alive to signal, and the stale pid/port would otherwise mislead the next
+ *   attach.
+ * - **A stale tunnel IS reaped.** A local `ssh -L` cannot outlive its purpose, so
+ *   a dead owner does make it an orphan. This is the one thing the old code was
+ *   right about; it just shared a code path with the browser.
+ *
+ * The accepted trade: a genuinely leaked browser from a long-dead daemon is no
+ * longer force-killed here. Idle/abandoned cleanup has its own owner in
+ * `browser/hygiene.ts` (session-dead + idle), which the daemon's periodic tick and
+ * `agents browser prune` both call — that is the right place for it, because it can
+ * tell "idle and abandoned" from "in use right now" and this function cannot.
+ */
 export declare function reapOrphanedProcesses(): {
     reaped: number;
     details: string[];
 };
+/**
+ * Take ownership of a runtime record after an identity-checked attach succeeded.
+ *
+ * Called from the reuse branch in `BrowserService.connectProfile`, which has just
+ * probed `/json/version` and run `verifyBrowserIdentity` against the profile's
+ * expected browser family — so by this point the process on the recorded port is
+ * proven to be ours. Only then may a new service claim it.
+ *
+ * Rewrites `daemonPid` ALONE. Every other field — `pid`, `port`, `command`,
+ * `userDataDir`, `spawnedAt`, `kind`, `tunnelPid` — is the original launch's
+ * metadata and stays exactly as recorded: this is an ownership handover, not a
+ * re-registration, and rewriting the rest would lose the provenance the reaper and
+ * the hygiene pass both read. A record that has since disappeared is left alone
+ * rather than recreated from a partial view.
+ */
+export declare function adoptProfileRuntimeOwner(profileName: string, daemonPid?: number): boolean;
 /**
  * True when ANY cache dir belonging to this profile still has a live browser or
  * SSH tunnel, or an open task. The composite naming (`<name>@<endpoint>`) means
@@ -233,4 +282,10 @@ export declare function buildProfilePrunePlan(): Promise<PrunePlan>;
  * went, matching what `--dry-run` printed.
  */
 export declare function pruneProfiles(plan: PrunePlan): Promise<PrunePlan>;
+/**
+ * The executable/image name the live `pid` is running, or null if it can't be
+ * determined. The process-listing API differs per OS: Windows has no `ps`, so
+ * we query `tasklist` (CSV image name in column 1); POSIX uses `ps -o comm=`.
+ */
+export declare function liveProcessCommand(pid: number): string | null;
 export {};