@phnx-labs/agents-cli 1.22.117 → 1.22.119

package/dist/commands/repo.js

@@ -55,34 +55,13 @@ function syncMarketplacesForDefaults() {
         catch { /* best-effort */ }
     }
 }
-/** Write this device's account metadata before the user repo is committed. */
-async function publishUserRepoAccountState(provisionAuth) {
-    const { publishUsageSnapshotToSharedStore } = await import('../lib/accounting/usage-sync.js');
-    const usage = await publishUsageSnapshotToSharedStore();
-    if (usage.error)
-        console.error(chalk.yellow(`Usage snapshot: ${usage.error}`));
-    if (provisionAuth) {
-        const { syncReservedAuthBundle } = await import('../lib/secrets-policy.js');
-        const auth = await syncReservedAuthBundle();
-        if (auth.pushed.length > 0)
-            console.log(chalk.gray(`Auth bundle: pushed to ${auth.pushed.join(', ')}`));
-        for (const err of auth.errors)
-            console.error(chalk.yellow(`Auth bundle: ${err.device}: ${err.message}`));
-        return;
-    }
-    const { publishReservedAuthVerdict } = await import('../lib/secrets-policy.js');
-    const auth = await publishReservedAuthVerdict();
-    if (auth.error)
-        console.error(chalk.yellow(`Auth verdict: ${auth.device}: ${auth.error}`));
-}
-/** Consume freshly pulled usage/auth metadata from the local user-repo checkout. */
-async function consumeUserRepoAccountState() {
-    const { consumeUsageSnapshotsFromSharedStore } = await import('../lib/accounting/usage-sync.js');
-    const usage = consumeUsageSnapshotsFromSharedStore();
-    if (usage.merged > 0)
-        console.log(chalk.gray(`Usage snapshot: merged ${usage.merged} row(s) from ${usage.sources.join(', ')}`));
-    for (const err of usage.errors)
-        console.error(chalk.yellow(`Usage snapshot: ${err.device}: ${err.message}`));
+/**
+ * Push the reserved auth bundle to peers whose last-received verdict says
+ * `missing`. Daemon state (usage, verdicts, session digests) no longer rides the
+ * user repo — it moves over SSH on the usage-sync tick (PHNX-4116) — so a repo
+ * push/sync of human-authored resources only runs this credential half.
+ */
+async function syncUserRepoAuthBundle() {
     const { syncReservedAuthBundle } = await import('../lib/secrets-policy.js');
     const auth = await syncReservedAuthBundle();
     if (auth.pushed.length > 0)
@@ -1085,7 +1064,7 @@ export function registerRepoCommands(program) {
             ].filter(Boolean);
             if (parts.length > 0)
                 console.log(chalk.gray(`Device policy: ${parts.join(' · ')}`));
-            await consumeUserRepoAccountState();
+            await syncUserRepoAuthBundle();
         }
     });
     repoCmd
@@ -1121,10 +1100,8 @@ export function registerRepoCommands(program) {
             return;
         }
         for (const t of pushable) {
-            // Account snapshots must exist BEFORE commitAndPush or this push ships
-            // the previous tick's state and delays propagation by one repo cycle.
             if (t.alias === 'user')
-                await publishUserRepoAccountState(true);
+                await syncUserRepoAuthBundle();
             const spinner = interruptibleSpinner(`Pushing ${formatRepoTarget(t.alias, t.dir)}...`).start();
             const result = await commitAndPush(t.dir, options.message);
             if (result.success) {
@@ -1193,23 +1170,10 @@ Examples:
                 }
             }
             const push = t.alias !== 'system';
-            // syncRepoGit pulls then pushes. Seed our conflict-free owner file first
-            // so the same transaction carries it; consume peers after the pull.
-            if (t.alias === 'user')
-                await publishUserRepoAccountState(false);
+            // A plain pull/rebase (+ push) of human-authored resources for every
+            // alias, the user repo included: daemon state left git (PHNX-4116).
             const spinner = interruptibleSpinner(`Syncing ${formatRepoTarget(t.alias, t.dir)}...`).start();
-            const result = t.alias === 'user'
-                ? await (async () => {
-                    const { syncFleetSharedStateRepo } = await import('../lib/fleet-shared-repo-sync.js');
-                    const synced = await syncFleetSharedStateRepo({ userAgentsDir: t.dir });
-                    return {
-                        success: synced.success,
-                        commit: synced.commit ?? '',
-                        pushed: synced.pushed,
-                        error: synced.error ?? synced.skipped ?? undefined,
-                    };
-                })()
-                : await syncRepoGit(t.dir, { push });
+            const result = await syncRepoGit(t.dir, { push });
             if (result.success) {
                 const pushed = result.pushed ? ' (pushed)' : '';
                 spinner.succeed(`${formatRepoTarget(t.alias, t.dir)}: ${result.commit}${pushed}`);
@@ -1219,7 +1183,7 @@ Examples:
                         recordUserRepoRemote(t.dir, u);
                     const { reconcileDeviceDiscoveryPolicies } = await import('../lib/devices/discovery-policy.js');
                     await reconcileDeviceDiscoveryPolicies();
-                    await consumeUserRepoAccountState();
+                    await syncUserRepoAuthBundle();
                 }
             }
             else {

package/dist/commands/route.js

@@ -95,13 +95,13 @@ export function registerRouteCommands(program) {
     setHelpSections(routeCmd, {
         examples: `
       # Create a router scoped to two harnesses, capped at a tier
-      agents route add research --harness gemini,kimi --tier cheap,default
+      agents route add research --harness grok,kimi --tier cheap,default
 
       # Narrow one harness's model set
       agents route allow research kimi kimi-k2
 
       # Link accounts so routing under this router only ever picks them
-      agents route link-account research gemini personal
+      agents route link-account research grok personal
       agents route link-account research kimi work
 
       # Inspect, rename, remove it
@@ -126,7 +126,7 @@ export function registerRouteCommands(program) {
         .command('add <name>')
         .alias('create')
         .description('Create a named router with an initial harness + tier allowlist.')
-        .option('--harness <list>', 'Comma-separated harness ids to allow, e.g. gemini,kimi')
+        .option('--harness <list>', 'Comma-separated harness ids to allow, e.g. grok,kimi')
         .option('--tier <list>', 'Comma-separated tier tokens applied to every listed harness, e.g. cheap,default')
         .option('--task <type>', 'Free-text task type this router serves, e.g. research')
         .action((name, opts) => {
@@ -134,7 +134,7 @@ export function registerRouteCommands(program) {
             die(`Router '${name}' already exists. Use 'agents route allow ${name} <harness> <model|tier>...' to edit it.`);
         }
         if (!opts.harness) {
-            die("Missing --harness. Example: agents route add research --harness gemini,kimi --tier cheap,default");
+            die("Missing --harness. Example: agents route add research --harness grok,kimi --tier cheap,default");
         }
         const harnesses = opts.harness.split(',').map((h) => h.trim()).filter(Boolean);
         const tiers = (opts.tier ?? '').split(',').map((t) => t.trim()).filter(Boolean);
@@ -170,7 +170,7 @@ export function registerRouteCommands(program) {
         }
         if (routers.length === 0) {
             console.log(chalk.gray('No routers configured.'));
-            console.log(chalk.gray('Try: agents route add research --harness gemini,kimi --tier cheap,default'));
+            console.log(chalk.gray('Try: agents route add research --harness grok,kimi --tier cheap,default'));
             return;
         }
         for (const router of routers)

package/dist/commands/routines.js

@@ -246,7 +246,7 @@ function renderRoutineRows({ jobs, scheduler, overdueSet, link, now, local = tru
                     : lastStatus === 'missed' ? chalk.magenta
                         : chalk.gray;
         const overdueTag = overdueSet.has(job.name) ? chalk.yellow(' (overdue)') : '';
-        // Append the concrete reason a routine did not complete (auth_failed, wedged,
+        // Append the concrete reason a routine did not complete (auth_failed,
         // blocked, missed) right in the Last Status cell, so the list answers "why"
         // without a drill-in. Only for non-completed local runs; peer rows stay blank.
         const reason = latestRun ? runFailureReason(latestRun) : null;
@@ -650,12 +650,29 @@ function routineMatchesQuery(job, q) {
         .toLowerCase()
         .includes(q);
 }
-/** Friendly one-liners for the claim a `skipped` run lost. */
+/**
+ * Friendly one-liners for the claim a `skipped` run lost — the reasons whose
+ * message is static. `active_run` is dynamic (it names the live run that owns
+ * the slot and when it started), built in {@link runFailureReason}: since
+ * PHNX-4116 there is no "wedged" daemon state, so an overlapping routine reads
+ * as `blocked` on the live run, not "wedged".
+ */
 const SKIP_REASON_LABEL = {
-    active_run: 'wedged: a prior run is still active',
     duplicate_slot: 'duplicate slot (already fired)',
     wrong_owner: 'pinned to another device',
 };
+/**
+ * A run id is an ISO timestamp with `:`/`.` replaced by `-` (`slotRunId` /
+ * `generateRunId`), so it reverses losslessly to the run's start time. Returns
+ * the ISO string, or null when the id is not that shape (a hand-set id).
+ */
+function runIdToStartIso(runId) {
+    const m = /^(\d{4}-\d{2}-\d{2})T(\d{2})-(\d{2})-(\d{2})-(\d{3})Z$/.exec(runId);
+    if (!m)
+        return null;
+    const iso = `${m[1]}T${m[2]}:${m[3]}:${m[4]}.${m[5]}Z`;
+    return Number.isFinite(Date.parse(iso)) ? iso : null;
+}
 /**
  * The short, human reason a run did not simply complete — for inline display in
  * the list/detail so "why did it fail" needs no dig into the run dir. Prefers the
@@ -670,6 +687,21 @@ export function runFailureReason(run) {
         const one = s.replace(/\s+/g, ' ').trim();
         return one.length > 80 ? one.slice(0, 79) + '…' : one;
     };
+    // An overlap skip names the live run it lost to (PHNX-4116): `blocked: run
+    // <id> active since <t>`, not the removed "wedged" wording. The structured
+    // `activeRunId` is preferred; a legacy record without it falls back to the
+    // errorMessage (which embeds the same id) so nothing regresses to vaguer text.
+    if (run.skipReason === 'active_run') {
+        if (run.activeRunId) {
+            const since = runIdToStartIso(run.activeRunId);
+            return since
+                ? `blocked: run ${run.activeRunId} active since ${since}`
+                : `blocked: run ${run.activeRunId} still active`;
+        }
+        if (run.errorMessage)
+            return compact(run.errorMessage);
+        return 'blocked: a prior run is still active';
+    }
     if (run.errorMessage)
         return compact(run.errorMessage);
     if (run.status === 'blocked' && run.readiness) {
@@ -751,8 +783,8 @@ function buildRoutineDetail(job, scheduler, now) {
                     : chalk.yellow(run.status);
             const dur = run.completedAt ? ` ${formatRunDuration(run.startedAt, run.completedAt)}` : '';
             // Surface WHY a run did not complete, inline, so "looking at status" does not
-            // require digging into the run dir. auth_failed / OAuth-revoked, a wedged
-            // active-run skip, or a readiness block all live on the RunMeta already.
+            // require digging into the run dir. auth_failed / OAuth-revoked, an
+            // active-run overlap skip, or a readiness block all live on the RunMeta already.
             const reason = runFailureReason(run);
             const why = reason ? chalk.gray(` — ${reason}`) : '';
             lines.push(`  ${run.startedAt}  ${status}${dur}${why}`);
@@ -1941,7 +1973,7 @@ export function registerRoutinesCommands(program) {
             chalk.gray(`  ${run.startedAt}`) +
             chalk.gray(formatRunDuration(run.startedAt, run.completedAt)) +
             (run.exitCode !== null && run.exitCode !== undefined ? chalk.gray(`  exit ${run.exitCode}`) : ''));
-        // The structured reason (auth_failed, blocked readiness, wedged skip) — the
+        // The structured reason (auth_failed, blocked readiness, overlap skip) — the
         // report/stdout tail below often buries or omits it, so name it up front.
         const logsReason = runFailureReason(run);
         if (logsReason)
@@ -2300,9 +2332,7 @@ export function registerRoutinesCommands(program) {
         console.log(chalk.bold('Scheduler\n'));
         const stateLabel = schedulerState === 'running'
             ? chalk.green('running')
-            : schedulerState === 'wedged'
-                ? chalk.red('wedged')
-                : chalk.gray('stopped');
+            : chalk.gray('stopped');
         console.log(`  Status:    ${stateLabel}`);
         console.log(`  Daemon:    ${status.running ? chalk.green('running') : chalk.gray('stopped')}`);
         if (status.pid)
@@ -2316,9 +2346,6 @@ export function registerRoutinesCommands(program) {
         const jobs = listAllJobs();
         const enabled = jobs.filter((j) => j.enabled);
         console.log(`  Routines:  ${enabled.length} enabled / ${jobs.length} total`);
-        if (status.state === 'wedged') {
-            console.log(chalk.red('\n  The shared daemon is wedged (heartbeat stale). Restart deliberately with: agents daemon restart'));
-        }
         if (schedulerState === 'running' && enabled.length > 0) {
             const scheduler = new JobScheduler(async () => { });
             scheduler.loadAll();

package/dist/commands/sessions-render.d.ts

@@ -1,6 +1,6 @@
 import type { Command } from 'commander';
 import type { SessionMeta } from '../lib/session/types.js';
-export declare const MARKDOWN_RENDER_AGENTS: readonly ["claude", "codex", "gemini", "antigravity", "opencode", "grok", "rush", "hermes", "kimi", "droid", "cursor"];
+export declare const MARKDOWN_RENDER_AGENTS: readonly ["claude", "codex", "antigravity", "opencode", "grok", "rush", "hermes", "kimi", "droid", "cursor"];
 export type ReasoningMode = 'omit' | 'fold' | 'include';
 /** Build one shareable Markdown document from the canonical preview and event model. */
 export declare function renderSessionMarkdownDocument(session: SessionMeta, options?: {

package/dist/commands/sessions-render.js

@@ -14,7 +14,6 @@ import { selectSessions } from './sessions-export.js';
 export const MARKDOWN_RENDER_AGENTS = [
     'claude',
     'codex',
-    'gemini',
     'antigravity',
     'opencode',
     'grok',

package/dist/commands/sessions.test-fixture.d.ts

@@ -15,7 +15,6 @@ export declare const tsxLoaderUrl: string;
 export declare function writeUpdateCache(tempHome: string): void;
 export declare function writeClaudeSession(tempHome: string, projectKey: string, sessionId: string, cwd: string, content: string, timestamp: string): void;
 export declare function writeCodexSession(tempHome: string, sessionId: string, cwd: string, prompt: string, timestamp: string): void;
-export declare function writeGeminiSession(tempHome: string, sessionId: string, cwd: string, prompt: string, timestamp: string, version?: string): void;
 export declare function writeOpenClawSetup(tempHome: string, version?: string): string;
 export declare function runAgents(args: string[], cwd: string, home: string, envOverrides?: Record<string, string>): import("node:child_process").SpawnSyncReturns<string>;
 export declare function outputOf(result: {

package/dist/commands/sessions.test-fixture.js

@@ -1,7 +1,6 @@
 import { describe } from 'vitest';
 import * as fs from 'fs';
 import * as path from 'path';
-import * as crypto from 'crypto';
 import { spawnSync } from 'child_process';
 import { createRequire } from 'node:module';
 import { pathToFileURL } from 'node:url';
@@ -121,42 +120,6 @@ export function writeCodexSession(tempHome, sessionId, cwd, prompt, timestamp) {
     ];
     fs.writeFileSync(filePath, lines.join('\n') + '\n', 'utf-8');
 }
-export function writeGeminiSession(tempHome, sessionId, cwd, prompt, timestamp, version = '0.29.5') {
-    const versionHome = path.join(tempHome, '.agents', '.history', 'versions', 'gemini', version, 'home');
-    const geminiHome = path.join(versionHome, '.gemini');
-    const projectHash = crypto.createHash('sha256').update(cwd).digest('hex');
-    const chatsDir = path.join(geminiHome, 'tmp', projectHash, 'chats');
-    fs.mkdirSync(cwd, { recursive: true });
-    fs.mkdirSync(chatsDir, { recursive: true });
-    fs.mkdirSync(path.dirname(path.join(tempHome, '.gemini')), { recursive: true });
-    const activeGeminiHome = path.join(tempHome, '.gemini');
-    if (!fs.existsSync(activeGeminiHome)) {
-        fs.symlinkSync(geminiHome, activeGeminiHome);
-    }
-    fs.writeFileSync(path.join(geminiHome, 'projects.json'), JSON.stringify({ projects: [cwd] }), 'utf-8');
-    fs.writeFileSync(path.join(chatsDir, `session-${timestamp.replace(/[:.]/g, '-')}-${sessionId.slice(0, 8)}.json`), JSON.stringify({
-        sessionId,
-        projectHash,
-        startTime: timestamp,
-        lastUpdated: timestamp,
-        messages: [
-            {
-                id: `${sessionId}-user`,
-                timestamp,
-                type: 'user',
-                content: [{ text: prompt }],
-            },
-            {
-                id: `${sessionId}-assistant`,
-                timestamp,
-                type: 'gemini',
-                content: 'Investigating now.',
-                model: 'gemini-3-flash-preview',
-                tokens: { total: 1234 },
-            },
-        ],
-    }, null, 2), 'utf-8');
-}
 export function writeOpenClawSetup(tempHome, version = '2026.3.8') {
     const managedHome = path.join(tempHome, '.agents', '.history', 'versions', 'openclaw', version, 'home', '.openclaw');
     fs.mkdirSync(managedHome, { recursive: true });

package/dist/commands/setup-browser.d.ts

@@ -1,20 +1,25 @@
 /**
- * `agents setup browser` — interactive wizard to get `agents browser` working on
- * a fresh machine: detect an installed Chromium-family browser, create the
- * `default` profile pinned to it, optionally make it this machine's default, and
- * point the user at the one manual step we can't automate (first-run + sign-in).
+ * `agents setup browser` — get `agents browser` working on a fresh machine:
+ * install the standalone `browser` CLI (@phnx-labs/browser-cli), let it detect
+ * installed browsers and create machine-local profiles (`browser profiles seed`),
+ * then pick this machine's default (`browser use`).
  *
- * Idempotent: re-running shows the current default profile and offers to change
- * the pinned browser or re-point the device default.
+ * The engine owns profile declarations and browser detection now (PHNX-4101), so
+ * this wizard DELEGATES to it rather than crafting profiles itself. What stays
+ * agents-cli's is the onboarding flow and the readiness check over the shared
+ * `browser.profile` config key both CLIs read/write.
+ *
+ * Idempotent: `profiles seed` leaves existing profiles untouched, and `use`
+ * re-points the device default.
  */
 import type { Command } from 'commander';
 /**
- * Interactive browser setup. Returns true if a usable default profile exists
- * afterwards, false if none exists / the user backed out. Non-interactively it
- * only RECOGNIZES an existing profile — it never creates one (PHNX-3296), since
- * silently minting a logged-out `auto-chrome` on a headless box is the exact bug
- * that removed; a headless box gets its browser from the fleet hub. Never throws
- * on cancel — the `agents setup` hub relies on that.
+ * Interactive browser setup. Returns true if a default profile is configured
+ * afterwards, false if none is / the user backed out. Non-interactively it only
+ * RECOGNIZES an existing default — it never creates one (PHNX-3296), since
+ * silently minting a logged-out profile on a headless box is the exact bug that
+ * removed; a headless box gets its browser from the fleet hub. Never throws on
+ * cancel — the `agents setup` hub relies on that.
  */
 export declare function runBrowserWizard(): Promise<boolean>;
 /** Register `agents setup browser` under the parent `setup` command. */

package/dist/commands/setup-browser.js

@@ -1,124 +1,89 @@
 /**
- * `agents setup browser` — interactive wizard to get `agents browser` working on
- * a fresh machine: detect an installed Chromium-family browser, create the
- * `default` profile pinned to it, optionally make it this machine's default, and
- * point the user at the one manual step we can't automate (first-run + sign-in).
+ * `agents setup browser` — get `agents browser` working on a fresh machine:
+ * install the standalone `browser` CLI (@phnx-labs/browser-cli), let it detect
+ * installed browsers and create machine-local profiles (`browser profiles seed`),
+ * then pick this machine's default (`browser use`).
  *
- * Idempotent: re-running shows the current default profile and offers to change
- * the pinned browser or re-point the device default.
+ * The engine owns profile declarations and browser detection now (PHNX-4101), so
+ * this wizard DELEGATES to it rather than crafting profiles itself. What stays
+ * agents-cli's is the onboarding flow and the readiness check over the shared
+ * `browser.profile` config key both CLIs read/write.
+ *
+ * Idempotent: `profiles seed` leaves existing profiles untouched, and `use`
+ * re-points the device default.
  */
 import { openSetupTerminal } from './setup-terminal.js';
 import chalk from 'chalk';
-import { setConfigValue } from '../lib/device-config.js';
-import { listInstalledBrowsers } from '../lib/browser/chrome.js';
-import { DEFAULT_BROWSER_PROFILE_NAME, getAutoDetectedProfile, createProfile, findFreeProfilePort, getConfiguredDefaultProfileName, } from '../lib/browser/profiles.js';
-import { DEFAULT_VIEWPORT } from '../lib/browser/devices.js';
+import { getConfigValue } from '../lib/device-config.js';
 import { isInteractiveTerminal, isPromptCancelled } from './utils.js';
-import { defaultBrowserChoice } from './setup-preferences.js';
 import { installSetupTool } from '../lib/setup-tool-install.js';
 import { refreshToolSetup } from '../lib/setup-tool-status.js';
-const INSTALL_HINT = 'Install one of: Google Chrome, Brave, Microsoft Edge, Chromium, Comet, or Arc, then re-run `agents setup browser`.\n' +
-    '(This wizard picks a Chromium-family browser. An installed Firefox is not auto-picked here; its profiles are ' +
-    'discovered from profiles.ini and selected with `agents browser use firefox-<name>`. Safari is not supported.)';
+import { browserInstalled, runBrowser } from '../lib/browser-client.js';
+import { buildBrowserContext } from '../lib/browser/context.js';
+/** The device-local default profile, as both agents-cli and browser-cli see it. */
+function configuredDefaultProfile() {
+    return getConfigValue('browser.profile').value || undefined;
+}
+/** Run one standalone `browser` verb, inheriting the terminal, and return its exit code. */
+async function runBrowserVerb(argv) {
+    const { exitCode } = await runBrowser({ argv, context: await buildBrowserContext() });
+    return exitCode;
+}
 /**
- * Interactive browser setup. Returns true if a usable default profile exists
- * afterwards, false if none exists / the user backed out. Non-interactively it
- * only RECOGNIZES an existing profile — it never creates one (PHNX-3296), since
- * silently minting a logged-out `auto-chrome` on a headless box is the exact bug
- * that removed; a headless box gets its browser from the fleet hub. Never throws
- * on cancel — the `agents setup` hub relies on that.
+ * Interactive browser setup. Returns true if a default profile is configured
+ * afterwards, false if none is / the user backed out. Non-interactively it only
+ * RECOGNIZES an existing default — it never creates one (PHNX-3296), since
+ * silently minting a logged-out profile on a headless box is the exact bug that
+ * removed; a headless box gets its browser from the fleet hub. Never throws on
+ * cancel — the `agents setup` hub relies on that.
  */
 export async function runBrowserWizard() {
     if (!isInteractiveTerminal()) {
-        // Non-interactive / headless: recognize an existing default, but NEVER mint
-        // one. Silently auto-detecting an installed browser and creating an
-        // `auto-chrome` here is exactly the bug PHNX-3296 removed — a headless box
-        // gets its browser from the fleet hub (`browser.device`), or from an
-        // interactive pick later.
-        const existing = await getAutoDetectedProfile();
+        const existing = configuredDefaultProfile();
         if (existing) {
-            console.log(chalk.dim(`Browser profile "${existing.name}" already exists.`));
+            console.log(chalk.dim(`Default browser profile "${existing}" already configured on this machine.`));
             return true;
         }
         console.log(chalk.dim('No default browser profile on this machine. Re-run `agents setup browser` in an ' +
             'interactive terminal to pick one, or use the fleet hub: agents config set browser.device <host>.'));
         return false;
     }
-    const installed = listInstalledBrowsers();
-    if (installed.length === 0) {
-        console.error(chalk.red('No supported browser found on this machine.'));
-        console.log(chalk.dim(INSTALL_HINT));
-        return false;
-    }
-    const { confirm, select } = await import('@inquirer/prompts');
-    // If a default profile already exists, this is a reconfigure.
-    const existing = await getAutoDetectedProfile();
-    if (existing) {
-        console.log(chalk.dim(`Browser profile "${existing.name}" already exists (${existing.browser}${existing.binary ? ` · ${existing.binary}` : ''}).`));
-        const change = await confirm({ message: 'Re-create it (e.g. to pin a different browser)?', default: false });
-        if (!change) {
-            await maybeSetDeviceDefault(existing.name, confirm);
-            printOnboardingNextStep(existing.name);
-            return true;
+    if (!browserInstalled()) {
+        console.log(chalk.dim('Installing the standalone Browser CLI (@phnx-labs/browser-cli)…'));
+        if (!(await installSetupTool('browser'))) {
+            console.error(chalk.red('Could not install @phnx-labs/browser-cli. Install it manually with `npm i -g @phnx-labs/browser-cli`, then re-run.'));
+            return false;
         }
-        // Re-create: drop the old one so createProfile doesn't collide.
-        const { deleteProfile } = await import('../lib/browser/profiles.js');
-        await deleteProfile(existing.name);
     }
-    // Pick which installed browser to pin (auto-select if only one). The picker
-    // highlights the same browser auto-detect would win — choosing is an
-    // override of the default, never a guess.
-    let chosen = installed[0];
-    if (installed.length > 1) {
-        const value = await select({
-            message: 'Which browser should the default profile use?',
-            default: defaultBrowserChoice(installed) ?? undefined,
-            choices: installed.map((b) => ({ name: `${b.browserType}  ${chalk.dim(b.binary)}`, value: b.browserType })),
-        });
-        chosen = installed.find((b) => b.browserType === value) ?? installed[0];
+    // Let the engine detect installed browsers and create a machine-local profile
+    // for each (idempotent), then open its own picker to set this machine's default.
+    const seedCode = await runBrowserVerb(['profiles', 'seed']);
+    if (seedCode !== 0) {
+        console.error(chalk.red('`browser profiles seed` failed — see the output above.'));
+        return false;
     }
-    const freePort = await findFreeProfilePort();
-    const profile = {
-        name: DEFAULT_BROWSER_PROFILE_NAME,
-        description: `${chosen.browserType} profile (agents setup browser)`,
-        browser: chosen.browserType,
-        binary: chosen.binary,
-        endpoints: [`cdp://127.0.0.1:${freePort}`],
-        viewport: { width: DEFAULT_VIEWPORT.width, height: DEFAULT_VIEWPORT.height },
-    };
-    await createProfile(profile);
-    console.log(chalk.green(`\nCreated browser profile "${profile.name}" → ${chosen.browserType} (CDP 127.0.0.1:${freePort}).`));
-    await maybeSetDeviceDefault(profile.name, confirm);
-    printOnboardingNextStep(profile.name);
-    return true;
-}
-/** Offer to make `name` this machine's default browser profile (device-local). */
-async function maybeSetDeviceDefault(name, confirm) {
-    const current = getConfiguredDefaultProfileName();
-    if (current === name)
-        return; // already the device default
-    const set = await confirm({
-        message: `Make "${name}" this machine's default browser profile?`,
-        default: true,
-    });
-    if (set) {
-        setConfigValue('browser.profile', name);
-        console.log(chalk.dim(`Bare \`agents browser start\` will now use "${name}" on this machine.`));
+    await runBrowserVerb(['use']);
+    const chosen = configuredDefaultProfile();
+    if (!chosen) {
+        console.log(chalk.dim('No default profile chosen. Run `agents browser use <name>` later to set one.'));
+        return false;
     }
+    printOnboardingNextStep(chosen);
+    return true;
 }
-/** The one step we can't automate: Chrome's first-run + your own sign-in. */
+/** The one step we can't automate: the browser's first-run + your own sign-in. */
 function printOnboardingNextStep(name) {
     console.log(chalk.bold('\nOne manual step left:'));
     console.log('  ' +
         chalk.cyan(`agents browser start --profile ${name}`) +
-        chalk.dim('   # finish Chrome first-run + sign in to any sites you want automated'));
+        chalk.dim('   # finish the browser first-run + sign in to any sites you want automated'));
     console.log(chalk.dim(`  Then check it's ready:  agents browser profiles doctor ${name}`));
 }
 /** Register `agents setup browser` under the parent `setup` command. */
 export function registerSetupBrowserCommand(setupCmd) {
     setupCmd
         .command('browser')
-        .description('Set up `agents browser` — detect an installed browser and create the default profile.')
+        .description('Set up `agents browser` — install the Browser CLI, seed profiles, and pick this machine\'s default.')
         .option('--install-only', 'Install the standalone Browser CLI without changing profiles or starting a browser')
         .option('--terminal [backend]', 'Open interactive setup in a detected or selected terminal')
         .action(async (options) => {

package/dist/commands/setup-preferences.d.ts

@@ -21,14 +21,6 @@ export declare function macDeviceNames(reg: DeviceRegistry): string[];
  * first candidate. null when there are no candidates.
  */
 export declare function defaultInteractiveHostChoice(candidates: string[], self?: string): string | null;
-/**
- * The browser picker's highlighted default — the same browser auto-detect
- * would win, since `listInstalledBrowsers` returns platform priority order
- * (macOS: chrome first). null when nothing is installed.
- */
-export declare function defaultBrowserChoice<T extends {
-    browserType: string;
-}>(installed: T[]): T['browserType'] | null;
 /**
  * Offer to set the interactive host when none is configured and the registry
  * has more than one macOS device. Returns true when a host was set. Silent
@@ -53,15 +45,6 @@ export declare function maybePickInteractiveHost(): Promise<boolean>;
 export declare function maybePickBrowserProfile(deps?: {
     /** Force interactivity in a test; defaults to a real TTY probe. */
     interactive?: boolean;
-    /** Inject the prompt so the pick is testable without a TTY. */
-    select?: (config: {
-        message: string;
-        default?: string;
-        choices: Array<{
-            name: string;
-            value: string;
-        }>;
-    }) => Promise<string>;
 }): Promise<boolean>;
 /**
  * The bare-`agents setup` preferences step: interactive host, then browser.