@phnx-labs/agents-cli 1.22.116 → 1.22.118

package/dist/commands/setup-browser.js

@@ -1,124 +1,89 @@
 /**
- * `agents setup browser` — interactive wizard to get `agents browser` working on
- * a fresh machine: detect an installed Chromium-family browser, create the
- * `default` profile pinned to it, optionally make it this machine's default, and
- * point the user at the one manual step we can't automate (first-run + sign-in).
+ * `agents setup browser` — get `agents browser` working on a fresh machine:
+ * install the standalone `browser` CLI (@phnx-labs/browser-cli), let it detect
+ * installed browsers and create machine-local profiles (`browser profiles seed`),
+ * then pick this machine's default (`browser use`).
  *
- * Idempotent: re-running shows the current default profile and offers to change
- * the pinned browser or re-point the device default.
+ * The engine owns profile declarations and browser detection now (PHNX-4101), so
+ * this wizard DELEGATES to it rather than crafting profiles itself. What stays
+ * agents-cli's is the onboarding flow and the readiness check over the shared
+ * `browser.profile` config key both CLIs read/write.
+ *
+ * Idempotent: `profiles seed` leaves existing profiles untouched, and `use`
+ * re-points the device default.
  */
 import { openSetupTerminal } from './setup-terminal.js';
 import chalk from 'chalk';
-import { setConfigValue } from '../lib/device-config.js';
-import { listInstalledBrowsers } from '../lib/browser/chrome.js';
-import { DEFAULT_BROWSER_PROFILE_NAME, getAutoDetectedProfile, createProfile, findFreeProfilePort, getConfiguredDefaultProfileName, } from '../lib/browser/profiles.js';
-import { DEFAULT_VIEWPORT } from '../lib/browser/devices.js';
+import { getConfigValue } from '../lib/device-config.js';
 import { isInteractiveTerminal, isPromptCancelled } from './utils.js';
-import { defaultBrowserChoice } from './setup-preferences.js';
 import { installSetupTool } from '../lib/setup-tool-install.js';
 import { refreshToolSetup } from '../lib/setup-tool-status.js';
-const INSTALL_HINT = 'Install one of: Google Chrome, Brave, Microsoft Edge, Chromium, Comet, or Arc, then re-run `agents setup browser`.\n' +
-    '(This wizard picks a Chromium-family browser. An installed Firefox is not auto-picked here; its profiles are ' +
-    'discovered from profiles.ini and selected with `agents browser use firefox-<name>`. Safari is not supported.)';
+import { browserInstalled, runBrowser } from '../lib/browser-client.js';
+import { buildBrowserContext } from '../lib/browser/context.js';
+/** The device-local default profile, as both agents-cli and browser-cli see it. */
+function configuredDefaultProfile() {
+    return getConfigValue('browser.profile').value || undefined;
+}
+/** Run one standalone `browser` verb, inheriting the terminal, and return its exit code. */
+async function runBrowserVerb(argv) {
+    const { exitCode } = await runBrowser({ argv, context: await buildBrowserContext() });
+    return exitCode;
+}
 /**
- * Interactive browser setup. Returns true if a usable default profile exists
- * afterwards, false if none exists / the user backed out. Non-interactively it
- * only RECOGNIZES an existing profile — it never creates one (PHNX-3296), since
- * silently minting a logged-out `auto-chrome` on a headless box is the exact bug
- * that removed; a headless box gets its browser from the fleet hub. Never throws
- * on cancel — the `agents setup` hub relies on that.
+ * Interactive browser setup. Returns true if a default profile is configured
+ * afterwards, false if none is / the user backed out. Non-interactively it only
+ * RECOGNIZES an existing default — it never creates one (PHNX-3296), since
+ * silently minting a logged-out profile on a headless box is the exact bug that
+ * removed; a headless box gets its browser from the fleet hub. Never throws on
+ * cancel — the `agents setup` hub relies on that.
  */
 export async function runBrowserWizard() {
     if (!isInteractiveTerminal()) {
-        // Non-interactive / headless: recognize an existing default, but NEVER mint
-        // one. Silently auto-detecting an installed browser and creating an
-        // `auto-chrome` here is exactly the bug PHNX-3296 removed — a headless box
-        // gets its browser from the fleet hub (`browser.device`), or from an
-        // interactive pick later.
-        const existing = await getAutoDetectedProfile();
+        const existing = configuredDefaultProfile();
         if (existing) {
-            console.log(chalk.dim(`Browser profile "${existing.name}" already exists.`));
+            console.log(chalk.dim(`Default browser profile "${existing}" already configured on this machine.`));
             return true;
         }
         console.log(chalk.dim('No default browser profile on this machine. Re-run `agents setup browser` in an ' +
             'interactive terminal to pick one, or use the fleet hub: agents config set browser.device <host>.'));
         return false;
     }
-    const installed = listInstalledBrowsers();
-    if (installed.length === 0) {
-        console.error(chalk.red('No supported browser found on this machine.'));
-        console.log(chalk.dim(INSTALL_HINT));
-        return false;
-    }
-    const { confirm, select } = await import('@inquirer/prompts');
-    // If a default profile already exists, this is a reconfigure.
-    const existing = await getAutoDetectedProfile();
-    if (existing) {
-        console.log(chalk.dim(`Browser profile "${existing.name}" already exists (${existing.browser}${existing.binary ? ` · ${existing.binary}` : ''}).`));
-        const change = await confirm({ message: 'Re-create it (e.g. to pin a different browser)?', default: false });
-        if (!change) {
-            await maybeSetDeviceDefault(existing.name, confirm);
-            printOnboardingNextStep(existing.name);
-            return true;
+    if (!browserInstalled()) {
+        console.log(chalk.dim('Installing the standalone Browser CLI (@phnx-labs/browser-cli)…'));
+        if (!(await installSetupTool('browser'))) {
+            console.error(chalk.red('Could not install @phnx-labs/browser-cli. Install it manually with `npm i -g @phnx-labs/browser-cli`, then re-run.'));
+            return false;
         }
-        // Re-create: drop the old one so createProfile doesn't collide.
-        const { deleteProfile } = await import('../lib/browser/profiles.js');
-        await deleteProfile(existing.name);
     }
-    // Pick which installed browser to pin (auto-select if only one). The picker
-    // highlights the same browser auto-detect would win — choosing is an
-    // override of the default, never a guess.
-    let chosen = installed[0];
-    if (installed.length > 1) {
-        const value = await select({
-            message: 'Which browser should the default profile use?',
-            default: defaultBrowserChoice(installed) ?? undefined,
-            choices: installed.map((b) => ({ name: `${b.browserType}  ${chalk.dim(b.binary)}`, value: b.browserType })),
-        });
-        chosen = installed.find((b) => b.browserType === value) ?? installed[0];
+    // Let the engine detect installed browsers and create a machine-local profile
+    // for each (idempotent), then open its own picker to set this machine's default.
+    const seedCode = await runBrowserVerb(['profiles', 'seed']);
+    if (seedCode !== 0) {
+        console.error(chalk.red('`browser profiles seed` failed — see the output above.'));
+        return false;
     }
-    const freePort = await findFreeProfilePort();
-    const profile = {
-        name: DEFAULT_BROWSER_PROFILE_NAME,
-        description: `${chosen.browserType} profile (agents setup browser)`,
-        browser: chosen.browserType,
-        binary: chosen.binary,
-        endpoints: [`cdp://127.0.0.1:${freePort}`],
-        viewport: { width: DEFAULT_VIEWPORT.width, height: DEFAULT_VIEWPORT.height },
-    };
-    await createProfile(profile);
-    console.log(chalk.green(`\nCreated browser profile "${profile.name}" → ${chosen.browserType} (CDP 127.0.0.1:${freePort}).`));
-    await maybeSetDeviceDefault(profile.name, confirm);
-    printOnboardingNextStep(profile.name);
-    return true;
-}
-/** Offer to make `name` this machine's default browser profile (device-local). */
-async function maybeSetDeviceDefault(name, confirm) {
-    const current = getConfiguredDefaultProfileName();
-    if (current === name)
-        return; // already the device default
-    const set = await confirm({
-        message: `Make "${name}" this machine's default browser profile?`,
-        default: true,
-    });
-    if (set) {
-        setConfigValue('browser.profile', name);
-        console.log(chalk.dim(`Bare \`agents browser start\` will now use "${name}" on this machine.`));
+    await runBrowserVerb(['use']);
+    const chosen = configuredDefaultProfile();
+    if (!chosen) {
+        console.log(chalk.dim('No default profile chosen. Run `agents browser use <name>` later to set one.'));
+        return false;
     }
+    printOnboardingNextStep(chosen);
+    return true;
 }
-/** The one step we can't automate: Chrome's first-run + your own sign-in. */
+/** The one step we can't automate: the browser's first-run + your own sign-in. */
 function printOnboardingNextStep(name) {
     console.log(chalk.bold('\nOne manual step left:'));
     console.log('  ' +
         chalk.cyan(`agents browser start --profile ${name}`) +
-        chalk.dim('   # finish Chrome first-run + sign in to any sites you want automated'));
+        chalk.dim('   # finish the browser first-run + sign in to any sites you want automated'));
     console.log(chalk.dim(`  Then check it's ready:  agents browser profiles doctor ${name}`));
 }
 /** Register `agents setup browser` under the parent `setup` command. */
 export function registerSetupBrowserCommand(setupCmd) {
     setupCmd
         .command('browser')
-        .description('Set up `agents browser` — detect an installed browser and create the default profile.')
+        .description('Set up `agents browser` — install the Browser CLI, seed profiles, and pick this machine\'s default.')
         .option('--install-only', 'Install the standalone Browser CLI without changing profiles or starting a browser')
         .option('--terminal [backend]', 'Open interactive setup in a detected or selected terminal')
         .action(async (options) => {

package/dist/commands/setup-preferences.d.ts

@@ -21,14 +21,6 @@ export declare function macDeviceNames(reg: DeviceRegistry): string[];
  * first candidate. null when there are no candidates.
  */
 export declare function defaultInteractiveHostChoice(candidates: string[], self?: string): string | null;
-/**
- * The browser picker's highlighted default — the same browser auto-detect
- * would win, since `listInstalledBrowsers` returns platform priority order
- * (macOS: chrome first). null when nothing is installed.
- */
-export declare function defaultBrowserChoice<T extends {
-    browserType: string;
-}>(installed: T[]): T['browserType'] | null;
 /**
  * Offer to set the interactive host when none is configured and the registry
  * has more than one macOS device. Returns true when a host was set. Silent
@@ -53,15 +45,6 @@ export declare function maybePickInteractiveHost(): Promise<boolean>;
 export declare function maybePickBrowserProfile(deps?: {
     /** Force interactivity in a test; defaults to a real TTY probe. */
     interactive?: boolean;
-    /** Inject the prompt so the pick is testable without a TTY. */
-    select?: (config: {
-        message: string;
-        default?: string;
-        choices: Array<{
-            name: string;
-            value: string;
-        }>;
-    }) => Promise<string>;
 }): Promise<boolean>;
 /**
  * The bare-`agents setup` preferences step: interactive host, then browser.

package/dist/commands/setup-preferences.js

@@ -13,9 +13,8 @@
  * partial state.
  */
 import chalk from 'chalk';
-import { listInstalledBrowsers } from '../lib/browser/chrome.js';
-import { DEFAULT_BROWSER_PROFILE_NAME, getAutoDetectedProfile, createProfile, findFreeProfilePort, getConfiguredDefaultProfileName, } from '../lib/browser/profiles.js';
-import { DEFAULT_VIEWPORT } from '../lib/browser/devices.js';
+import { browserInstalled, runBrowser } from '../lib/browser-client.js';
+import { buildBrowserContext } from '../lib/browser/context.js';
 import { getConfigValue, setConfigValue } from '../lib/device-config.js';
 import { loadDevices } from '../lib/devices/registry.js';
 import { machineId } from '../lib/machine-id.js';
@@ -38,14 +37,6 @@ export function defaultInteractiveHostChoice(candidates, self = machineId()) {
         return null;
     return candidates.includes(self) ? self : candidates[0];
 }
-/**
- * The browser picker's highlighted default — the same browser auto-detect
- * would win, since `listInstalledBrowsers` returns platform priority order
- * (macOS: chrome first). null when nothing is installed.
- */
-export function defaultBrowserChoice(installed) {
-    return installed.length > 0 ? installed[0].browserType : null;
-}
 /**
  * Offer to set the interactive host when none is configured and the registry
  * has more than one macOS device. Returns true when a host was set. Silent
@@ -94,48 +85,26 @@ export async function maybePickBrowserProfile(deps = {}) {
     const interactive = deps.interactive ?? isInteractiveTerminal();
     if (!interactive)
         return false;
-    if (getConfiguredDefaultProfileName())
+    // Already chosen (by an earlier setup, `agents browser use`, or browser-cli
+    // directly) — never re-pin behind the user's back.
+    if (getConfigValue('browser.profile').value)
         return false;
-    if (await getAutoDetectedProfile())
+    // The engine owns detection and profile creation (PHNX-4101); it is optional,
+    // so skip the pick quietly when it is not installed rather than nagging.
+    if (!browserInstalled())
         return false;
-    const installed = listInstalledBrowsers();
-    if (installed.length === 0)
+    // Let the engine detect installed browsers and create a machine-local profile
+    // for each (idempotent), then open its own picker to set this machine's default.
+    const context = await buildBrowserContext();
+    const seed = await runBrowser({ argv: ['profiles', 'seed'], context });
+    if (seed.exitCode !== 0)
         return false;
-    const config = {
-        message: 'Which browser should agents drive on THIS machine?',
-        default: defaultBrowserChoice(installed) ?? SKIP,
-        choices: [
-            ...installed.map((b) => ({ name: `${b.browserType}  ${chalk.dim(b.binary)}`, value: b.browserType })),
-            { name: `None ${chalk.dim('— this box uses the fleet hub (agents config set browser.device <host>)')}`, value: SKIP },
-        ],
-    };
-    // The prompt is the only non-testable boundary here, so it is injectable —
-    // everything after (createProfile, setConfigValue) runs for real.
-    let picked;
-    if (deps.select) {
-        picked = await deps.select(config);
-    }
-    else {
-        const { select } = await import('@inquirer/prompts');
-        picked = await select(config);
-    }
-    if (picked === SKIP)
+    await runBrowser({ argv: ['use'], context });
+    const chosen = getConfigValue('browser.profile').value;
+    if (!chosen)
         return false;
-    const chosen = installed.find((b) => b.browserType === picked) ?? installed[0];
-    const freePort = await findFreeProfilePort();
-    const profile = {
-        name: DEFAULT_BROWSER_PROFILE_NAME,
-        description: `${chosen.browserType} profile (chosen during setup)`,
-        browser: chosen.browserType,
-        binary: chosen.binary,
-        endpoints: [`cdp://127.0.0.1:${freePort}`],
-        viewport: { width: DEFAULT_VIEWPORT.width, height: DEFAULT_VIEWPORT.height },
-    };
-    await createProfile(profile);
-    // The same key `agents browser use` writes (device-local).
-    setConfigValue('browser.profile', profile.name);
-    console.log(chalk.green(`Browser: '${chosen.browserType}'`) +
-        chalk.dim(` — profile "${profile.name}" is this machine's default (agents browser use to change).`));
+    console.log(chalk.green(`Browser: '${chosen}'`) +
+        chalk.dim(' — this machine\'s default (agents browser use to change).'));
     return true;
 }
 /**

package/dist/commands/setup-term.d.ts

@@ -2,9 +2,10 @@
  * `agents setup term` — install the standalone `term` CLI if missing (PHNX-4092).
  *
  * The PTY engine lives in `@phnx-labs/term-cli` (extracted PHNX-4091);
- * agents-cli never rebundles it. The OAuth device-code driver (`agents fleet
- * login`, `agents auth mint`) spawns `term` on demand and fails loud when it is
- * absent, so onboarding installs it here like every other standalone tool.
+ * agents-cli never rebundles it. The setup-token mint behind `agents accounts
+ * add` / `agents accounts login` (auth-mint.ts → term-driver.ts) spawns `term`
+ * on demand and fails loud when it is absent, so onboarding installs it here
+ * like every other standalone tool.
  *
  * Unlike browser/computer/secrets there is nothing to configure — no profile,
  * no OS permission, no migrate step. A missing binary is a routine install

package/dist/commands/setup-term.js

@@ -2,9 +2,10 @@
  * `agents setup term` — install the standalone `term` CLI if missing (PHNX-4092).
  *
  * The PTY engine lives in `@phnx-labs/term-cli` (extracted PHNX-4091);
- * agents-cli never rebundles it. The OAuth device-code driver (`agents fleet
- * login`, `agents auth mint`) spawns `term` on demand and fails loud when it is
- * absent, so onboarding installs it here like every other standalone tool.
+ * agents-cli never rebundles it. The setup-token mint behind `agents accounts
+ * add` / `agents accounts login` (auth-mint.ts → term-driver.ts) spawns `term`
+ * on demand and fails loud when it is absent, so onboarding installs it here
+ * like every other standalone tool.
  *
  * Unlike browser/computer/secrets there is nothing to configure — no profile,
  * no OS permission, no migrate step. A missing binary is a routine install
@@ -45,7 +46,7 @@ export async function runTermWizard() {
 export function registerSetupTermCommand(setupCmd) {
     setupCmd
         .command('term')
-        .description('Install the standalone `term` CLI (the PTY engine fleet login and auth mint spawn) if missing.')
+        .description('Install the standalone `term` CLI (the PTY engine `agents accounts add`/`login` spawn) if missing.')
         .option('--install-only', 'Install the standalone term CLI (identical to the wizard; term needs no further setup)')
         .option('--terminal [backend]', 'Open interactive setup in a detected or selected terminal')
         .action(async (options) => {

package/dist/commands/setup.js

@@ -31,8 +31,7 @@ import { registerAliasCommand } from './alias.js';
 import { registerBetaCommands } from './beta.js';
 import { addUrlSchemeSubcommands } from './open.js';
 import { runPreferencesStep } from './setup-preferences.js';
-import { getConfiguredDefaultProfileName, getProfile, getAutoDetectedProfile, isProfileLaunchableHere } from '../lib/browser/profiles.js';
-import { listInstalledBrowsers } from '../lib/browser/chrome.js';
+import { browserInstalled } from '../lib/browser-client.js';
 import { probeComputerTrust } from './computer.js';
 import { loadDevices } from '../lib/devices/registry.js';
 import { getConfigValue } from '../lib/device-config.js';
@@ -269,12 +268,13 @@ export async function ensureInitialized(program) {
     await runSetup(program, { suppressFooter: true });
 }
 export async function getSetupStatus() {
-    const configuredBrowserProfile = getConfiguredDefaultProfileName();
-    const browserProfile = configuredBrowserProfile
-        ? await getProfile(configuredBrowserProfile)
-        : await getAutoDetectedProfile();
-    const browserReady = browserProfile !== null && isProfileLaunchableHere(browserProfile);
-    const installedBrowsers = listInstalledBrowsers();
+    // Browser readiness is now config + standalone presence (PHNX-4101): the engine
+    // (@phnx-labs/browser-cli) owns profile declarations and launchability, so
+    // agents-cli reads the shared default-profile key it and browser-cli both write
+    // rather than resolving a profile through a deleted in-repo engine.
+    const browserCliInstalled = browserInstalled();
+    const configuredBrowserProfile = getConfigValue('browser.profile').value;
+    const browserReady = browserCliInstalled && !!configuredBrowserProfile;
     const computerState = process.platform === 'darwin' ? (await probeComputerTrust() ? 'ready' : 'missing') : 'n/a';
     const devices = await loadDevices();
     const coreReady = isGitRepo(getAgentsDir());
@@ -286,10 +286,10 @@ export async function getSetupStatus() {
     const defaultBrowser = getConfigValue('browser.profile').value;
     return [
         { phase: 'core', state: coreReady ? 'ready' : 'missing', detail: coreReady ? 'system repo ready' : 'system repo missing' },
-        { phase: 'browser', state: browserReady ? 'ready' : 'missing', detail: browserReady ? `profile ${browserProfile.name}` : browserProfile ? `profile ${browserProfile.name} cannot launch here` : installedBrowsers.length ? 'no default profile' : 'no supported browser found' },
+        { phase: 'browser', state: browserReady ? 'ready' : 'missing', detail: browserReady ? `profile ${configuredBrowserProfile}` : !browserCliInstalled ? 'browser CLI not installed (npm i -g @phnx-labs/browser-cli)' : 'no default profile (agents setup browser)' },
         { phase: 'computer', state: computerState, detail: computerState === 'ready' ? 'helper trusted' : computerState === 'n/a' ? 'macOS local setup only' : 'helper not running or not trusted' },
         { phase: 'secrets', state: secretsReady ? 'ready' : 'missing', detail: secretsReady ? 'defaults chosen' : 'defaults not chosen' },
-        { phase: 'term', state: termReady ? 'ready' : 'missing', detail: termReady ? 'installed' : 'not installed (fleet login / auth mint spawn it)' },
+        { phase: 'term', state: termReady ? 'ready' : 'missing', detail: termReady ? 'installed' : 'not installed (accounts add/login spawn it)' },
         { phase: 'accounts', state: minted.ready ? 'ready' : 'missing', detail: minted.detail },
         { phase: 'fleet', state: Object.keys(devices).length ? 'ready' : 'missing', detail: Object.keys(devices).length ? `${Object.keys(devices).length} device${Object.keys(devices).length === 1 ? '' : 's'} registered` : 'no devices registered' },
         { phase: 'watchdog', state: watchdogEnabled ? 'ready' : 'missing', detail: watchdogEnabled ? 'enabled on this device' : 'disabled on this device' },
@@ -462,7 +462,7 @@ export function registerSetupCommand(program) {
         agents setup browser    # detect a browser + create the default profile
         agents setup computer    # install the signed macOS helper + grant permissions
         agents setup secrets     # choose secrets backend/policy defaults + import
-        agents setup term        # install the standalone term CLI (PTY engine for fleet login / auth mint)
+        agents setup term        # install the standalone term CLI (PTY engine agents accounts add/login spawn)
         agents setup accounts    # mint a Claude setup-token for unattended usage/probe
         agents setup fleet       # discover Tailscale devices + configure SSH access
         agents setup watchdog    # choose which devices run the daemon watchdog pass

package/dist/commands/ssh.js

@@ -789,7 +789,16 @@ async function runFleetPing(opts) {
     if (opts.local) {
         const { authRows: rows } = await refreshLocalFleetAuthState({ force: true });
         if (opts.json) {
-            console.log(JSON.stringify({ host: self, rows }));
+            // Per-agent launchability from the SAME run-router path the local readiness
+            // check uses (`collectRunCandidates`/`isLaunchableSignedIn`), so a consumer
+            // can tell a box that simply could not probe — a worker's setup-token box,
+            // or a headed box that spent its usage-endpoint budget, both DROP their
+            // `no_evidence` row — from a box with no credential at all. From `rows`
+            // alone the two are indistinguishable, which broke `--host` routine
+            // readiness on every worker (PHNX-4116).
+            const { collectRunCandidates } = await import('../lib/accounting/rotate.js');
+            const launchable = (await Promise.all(ALL_AGENT_IDS.map(async (agent) => (await collectRunCandidates(agent)).some((candidate) => candidate.signedIn) ? agent : null))).filter((agent) => agent !== null);
+            console.log(JSON.stringify({ host: self, rows, launchable }));
         }
         else {
             for (const line of renderAuthMatrix([{ host: self, rows }], { verbose: opts.verbose }))

package/dist/commands/sync.js

@@ -35,8 +35,6 @@ import { Option } from 'commander';
 import chalk from 'chalk';
 import { resolveSyncPassphraseFromEnv } from '../lib/sync-passphrase.js';
 import { agentLabel, resolveAgentName, MANAGED_AGENT_IDS, isAgentHardDeprecated, hardDeprecationError } from '../lib/agents.js';
-import { autoEvictCentralBrowserProfiles } from '../lib/browser/registry.js';
-import { shouldAutoClaimCentralProfile } from '../lib/browser/profiles.js';
 import { isVersionInstalled, syncResourcesToVersion, parseAgentSpec, resolveVersion, resolveVersionAlias, listInstalledVersions, healDanglingVersionPointers, getAvailableResources, getActuallySyncedResources, getProjectOnlyResources, getNewResources, hasNewResources, promptResourceSelection, promptNewResourceSelection, buildSelection, mergeRepoScopedSelections, listRepoNames, getVersionHomePath, } from '../lib/installations/versions.js';
 import { capableAgents } from '../lib/capabilities.js';
 import { parseHookManifest, registerHooksToSettings } from '../lib/hooks/install.js';
@@ -397,12 +395,9 @@ async function runInteractiveReconcile(opts, outLog, errLog) {
         else
             outLog(chalk.yellow(`  ! ${repo}: ${(res.error ?? 'pull failed').split('\n')[0]}`));
     }
-    // Drain the legacy central `browser:` tombstone now that the repos are pulled.
-    // Running AFTER the pull is load-bearing: it acts on a view of central that
-    // already reflects peers' drains, so it never re-claims a profile another box
-    // already migrated (which would flip that profile's kind identity->fungible).
-    // The interactive path is always non-quiet, non-json.
-    evictCentralBrowserProfilesForSync(false, false, outLog, errLog);
+    // Central browser-profile claiming is the standalone `browser` CLI's now
+    // (PHNX-4101): `browser profiles claim` / `browser profiles prune` own it.
+    // agents-cli no longer evicts central `browser:` tombstones on sync.
     // 2. One selection spanning the chosen repos.
     const selection = mergeRepoScopedSelections(repos, cwd);
     const hasResources = selection.memory === 'all' || Object.entries(selection).some(([kind, v]) => kind !== 'memory' && Array.isArray(v) && v.length > 0);
@@ -443,36 +438,6 @@ async function runInteractiveReconcile(opts, outLog, errLog) {
     if (repairHadFailures(umbrellaRepair))
         process.exitCode = 1;
 }
-/**
- * Drain the legacy central `browser:` tombstone during `agents sync` (PHNX-3315).
- * New profiles write the per-device doc, but profiles created before the
- * device-scoped store lingered in the shared top-level `agents.yaml` and churned
- * every fleet pull until someone ran `agents browser profiles claim` by hand.
- * Fold the ones THIS box can host into its device doc — host-gated, and the
- * selection is computed under the meta lock (see autoEvictCentralBrowserProfiles)
- * so it never races itself. Callers MUST invoke this AFTER the repo pull: acting
- * on a pre-pull view of central risks re-claiming a profile a peer already
- * drained, which would flip its kind identity->fungible. Non-fatal so a hiccup
- * can never wedge the sync.
- */
-function evictCentralBrowserProfilesForSync(quiet, json, outLog, errLog) {
-    try {
-        // Auto-claim ONLY remote (ssh://) tombstones — they are fungible by design,
-        // so a concurrent cross-machine double-claim is harmless. Local/cdp profiles
-        // have no per-machine ownership signal and are left central for an explicit
-        // `agents browser profiles claim` (PHNX-3315 review). See
-        // shouldAutoClaimCentralProfile.
-        const result = autoEvictCentralBrowserProfiles(shouldAutoClaimCentralProfile);
-        if (!quiet && !json && result.claimed.length > 0) {
-            outLog(chalk.gray(`  Claimed ${result.claimed.length} central browser profile(s) into this device: ${result.claimed.join(', ')}`));
-        }
-    }
-    catch (err) {
-        if (!quiet && !json) {
-            errLog(chalk.yellow(`  ! browser profile eviction skipped: ${err.message}`));
-        }
-    }
-}
 /**
  * The umbrella verb: bare `agents sync` (no agent) makes this machine current.
  * Resolves the flags + a secrets passphrase (env-only for now; tokenized auth
@@ -550,12 +515,9 @@ async function runUmbrella(opts, quiet, outLog, errLog, json = false) {
             log: (msg) => { if (!quiet && !json)
                 outLog(chalk.gray(`  ${msg}`)); },
         });
-        // Drain the legacy central `browser:` tombstone AFTER the umbrella pull, so
-        // we act on central as converged by this sync rather than a stale pre-pull
-        // copy that could re-claim a profile a peer already migrated. Skipped under
-        // --cloud (fetch-only, no local reconcile).
-        if (!opts.cloud && !kindSelection)
-            evictCentralBrowserProfilesForSync(quiet, json, outLog, errLog);
+        // Central browser-profile claiming moved to the standalone `browser` CLI
+        // (PHNX-4101: `browser profiles claim` / `prune`), so `agents sync` no longer
+        // drains the central `browser:` tombstone.
         // Post-reconcile verification (PHNX-3186): re-read every version the reconcile
         // wrote into and confirm it now matches source. Without this the umbrella
         // printed `✓ sync: reconciled` unconditionally, the exact false-success the

package/dist/commands/teams.js

@@ -42,7 +42,6 @@ import { isPromptCancelled, isInteractiveTerminal, requireDestructiveArg, requir
 const AGENT_NAMES = {
     claude: 'Claude',
     codex: 'Codex',
-    gemini: 'Gemini',
     cursor: 'Cursor',
     opencode: 'OpenCode',
     grok: 'Grok',

package/dist/commands/update.d.ts

@@ -1,5 +1,24 @@
 import type { Command } from 'commander';
 import type { AgentId } from '../lib/types.js';
+/**
+ * Split `<agent>[@<selector>]`. The selector names an INSTALLATION — its frozen
+ * label, or the release it currently carries — never a release to install; that
+ * is `--to`. Keeping them separate is what lets `agents update claude@2.0.65
+ * --to 2.0.71` read unambiguously.
+ */
+/**
+ * `<agent>[@<installed-version>][#<account>]`. The `#<account>` form is the
+ * same selector `agents run claude#work` takes: accounts run on the harness's
+ * one managed installation (PHNX-3940), so it names WHICH login the user means
+ * and resolves to that installation. Refusing it as "Unknown agent
+ * 'claude#work'" sent operators hunting for a per-account install that does
+ * not exist.
+ */
+export declare function parseTarget(raw: string): {
+    agent: AgentId;
+    selector?: string;
+    account?: string;
+};
 /**
  * One line naming the installations a bare `agents update <agent>` did NOT
  * touch — isolated (`--isolated`) copies and legacy pre-v2 per-version homes —

package/dist/commands/update.js

@@ -3,23 +3,48 @@ import { AGENTS, formatAgentError, resolveAgentName } from '../lib/agents.js';
 import { setHelpSections } from '../lib/help.js';
 import { describeInstallation, listInstallations, planAutoUpdates, resolveInstallation, runAutoUpdatePass, selectUpdateStrategy, supportsPinnedUpdate, updateInstallation, } from '../lib/installations/index.js';
 import { resolveManagedInstallation } from '../lib/installations/index.js';
+import { findUnifiedAccount } from '../lib/account-registry.js';
+import { readMeta } from '../lib/state.js';
 /**
  * Split `<agent>[@<selector>]`. The selector names an INSTALLATION — its frozen
  * label, or the release it currently carries — never a release to install; that
  * is `--to`. Keeping them separate is what lets `agents update claude@2.0.65
  * --to 2.0.71` read unambiguously.
  */
-function parseTarget(raw) {
-    const at = raw.indexOf('@');
-    const name = at === -1 ? raw : raw.slice(0, at);
-    const selector = at === -1 ? undefined : raw.slice(at + 1).trim();
+/**
+ * `<agent>[@<installed-version>][#<account>]`. The `#<account>` form is the
+ * same selector `agents run claude#work` takes: accounts run on the harness's
+ * one managed installation (PHNX-3940), so it names WHICH login the user means
+ * and resolves to that installation. Refusing it as "Unknown agent
+ * 'claude#work'" sent operators hunting for a per-account install that does
+ * not exist.
+ */
+export function parseTarget(raw) {
+    const hash = raw.indexOf('#');
+    const spec = hash === -1 ? raw : raw.slice(0, hash);
+    const account = hash === -1 ? undefined : raw.slice(hash + 1).trim();
+    if (hash !== -1 && !account) {
+        throw new Error(`Select an account after # in '${raw}', e.g. claude#work — or just <agent>.`);
+    }
+    if (account?.includes('@')) {
+        throw new Error(`Put the installation before the account: <agent>@<installed-version>#<account>, not '${raw}'.`);
+    }
+    const at = spec.indexOf('@');
+    const name = at === -1 ? spec : spec.slice(0, at);
+    const selector = at === -1 ? undefined : spec.slice(at + 1).trim();
     if (at !== -1 && !selector) {
         throw new Error(`Missing installation in '${raw}'. Use <agent>@<installed-version>, or just <agent>.`);
     }
     const agent = resolveAgentName(name);
     if (!agent)
         throw new Error(formatAgentError(name));
-    return { agent, selector };
+    if (account) {
+        const known = findUnifiedAccount(account, readMeta(), undefined, agent);
+        if (!known) {
+            throw new Error(`Unknown ${AGENTS[agent].name} account '${account}'. See: agents accounts list ${agent}`);
+        }
+    }
+    return { agent, selector, account };
 }
 /**
  * One line naming the installations a bare `agents update <agent>` did NOT
@@ -219,7 +244,10 @@ export function registerUpdateCommand(program) {
             if (!target) {
                 throw new Error('Which agent? Use: agents update <agent>[@<installed-version>], or agents update --auto.');
             }
-            const { agent, selector } = parseTarget(target);
+            const { agent, selector, account } = parseTarget(target);
+            if (account && !options.json) {
+                console.log(chalk.gray(`  account '${account}' runs on the managed ${AGENTS[agent].name} installation; updating that.`));
+            }
             if (options.check) {
                 const plan = (await planAutoUpdates({ agents: [agent] })).filter((entry) => !selector || entry.installation.label === selector || entry.installation.releaseVersion === selector);
                 if (selector && plan.length === 0) {

package/dist/commands/view.d.ts

@@ -4,7 +4,7 @@ import type { AccountInfo } from '../lib/agents.js';
 import type { AgentId } from '../lib/types.js';
 import { type ConfiguredDeviceRole } from '../lib/device-config.js';
 import { type NativeAccountCatalogRow } from '../lib/account-catalog.js';
-import type { ResourceSection, ViewJsonAgent } from '../lib/view-types.js';
+import type { ResourceSection, ViewJsonAgent, ViewJsonRunReady } from '../lib/view-types.js';
 export type { ResourceItemJson, ResourceSection, SyncState, VersionResourcesJson, ViewJsonAgent, ViewJsonVersion } from '../lib/view-types.js';
 import { type ProfileSummary } from '../lib/profiles.js';
 import { type ByokUsageResult } from '../lib/byok-usage.js';
@@ -76,6 +76,17 @@ export declare function parseResourceSections(options: {
     resources?: string | boolean;
     detailed?: boolean;
 } & ViewSectionFilter, jsonMode: boolean): Set<ResourceSection>;
+/**
+ * The one run-readiness gate for one agent on THIS box (PHNX-4116). Runs the
+ * SAME enumeration the local router picks from — `collectRunCandidates` (native
+ * slots + version homes) through `readinessFromCandidate` — so the answer
+ * `agents view --json` publishes is exactly what a `run` here would find, and a
+ * remote `--device auto` dispatcher can read it instead of re-deriving freshness
+ * on its own box (which drifted: view.ts lists version homes, the router lists
+ * slots). Returns undefined when the agent has no candidates at all (nothing
+ * installed), so the field is simply absent rather than a misleading verdict.
+ */
+export declare function computeAgentRunReady(agentId: AgentId): Promise<ViewJsonRunReady | undefined>;
 /**
  * Collect structured info for one or more agents without rendering to the
  * terminal. Used by `--json` output and any programmatic consumer (e.g. the