@phnx-labs/agents-cli 1.22.25 → 1.22.27

package/dist/commands/setup.js

@@ -26,6 +26,13 @@ import { registerSetupSecretsCommand } from './setup-secrets.js';
 import { registerSetupFleetCommand } from './setup-fleet.js';
 import { registerSetupWatchdogCommand, runWatchdogSetupWizard } from './setup-watchdog.js';
 import { runPreferencesStep } from './setup-preferences.js';
+import { getConfiguredDefaultProfileName, getProfile, isProfileLaunchableHere, DEFAULT_BROWSER_PROFILE_NAME } from '../lib/browser/profiles.js';
+import { listInstalledBrowsers } from '../lib/browser/chrome.js';
+import { probeComputerTrust } from './computer.js';
+import { readShareConfig } from '../lib/share/config.js';
+import { loadDevices } from '../lib/devices/registry.js';
+import { getConfigValue } from '../lib/device-config.js';
+import { setupSecretsPrefsPath } from './setup-secrets.js';
 const HOME = os.homedir();
 /**
  * Import an existing unmanaged agent installation into agents-cli.
@@ -70,9 +77,9 @@ export async function runSetup(program, options = {}) {
     const agentsDir = getAgentsDir();
     const alreadyConfigured = isGitRepo(agentsDir);
     if (alreadyConfigured && !options.force) {
-        console.log(chalk.gray('~/.agents/.system/ is already set up.'));
-        console.log(chalk.gray('\nTo sync updates:      agents repo pull system'));
-        console.log(chalk.gray('To re-run setup:      agents setup --force'));
+        if (options.suppressFooter)
+            return;
+        await (options.runHub ?? runSetupHub)();
         return;
     }
     // Detect existing installations BEFORE cloning (they won't exist after if we import)
@@ -193,11 +200,7 @@ export async function runSetup(program, options = {}) {
     // Fresh-machine hub: offer to set up the optional capabilities that need their
     // own guided flow. TTY-only and fully opt-in — a non-interactive `agents setup`
     // stops at the system-repo bootstrap above, unchanged.
-    await runSetupHub();
-    // Preferences step: the two questions that keep agents off the wrong machine —
-    // which box you sit at (interactive host) and which browser agents drive here.
-    // TTY-only, skippable, and writes the same keys as `agents devices …`.
-    await runPreferencesStep();
+    await (options.runHub ?? runSetupHub)();
     console.log(chalk.bold('\nSetup complete. Try:'));
     console.log(chalk.cyan('  agents view                 ') + chalk.gray(' # see what\'s installed'));
     console.log(chalk.cyan('  agents run <agent> "hello"  ') + chalk.gray(' # run an agent'));
@@ -229,42 +232,88 @@ export async function ensureInitialized(program) {
     }
     await runSetup(program, { suppressFooter: true });
 }
-/**
- * Interactive "what else do you want to set up?" menu shown after the bare
- * `agents setup` finishes on a TTY. Each pick runs that capability's guided
- * wizard. Never throws — a cancel or an optional wizard's error just skips the
- * rest and lets core setup complete.
- */
-async function runSetupHub() {
-    if (!isInteractiveTerminal())
+export async function getSetupStatus() {
+    const configuredBrowserProfile = getConfiguredDefaultProfileName();
+    const browserProfile = await getProfile(configuredBrowserProfile ?? DEFAULT_BROWSER_PROFILE_NAME);
+    const browserReady = browserProfile !== null && isProfileLaunchableHere(browserProfile);
+    const installedBrowsers = listInstalledBrowsers();
+    const computerState = process.platform === 'darwin' ? (await probeComputerTrust() ? 'ready' : 'missing') : 'n/a';
+    const devices = await loadDevices();
+    const coreReady = isGitRepo(getAgentsDir());
+    const secretsReady = fs.existsSync(setupSecretsPrefsPath());
+    const shareConfig = readShareConfig();
+    const watchdogEnabled = getConfigValue('watchdog.enabled').value === true;
+    const interactiveHost = getConfigValue('interactive.host').value;
+    const defaultBrowser = getConfigValue('browser.profile').value;
+    return [
+        { phase: 'core', state: coreReady ? 'ready' : 'missing', detail: coreReady ? 'system repo ready' : 'system repo missing' },
+        { phase: 'browser', state: browserReady ? 'ready' : 'missing', detail: browserReady ? `profile ${browserProfile.name}` : browserProfile ? `profile ${browserProfile.name} cannot launch here` : installedBrowsers.length ? 'no default profile' : 'no supported browser found' },
+        { phase: 'computer', state: computerState, detail: computerState === 'ready' ? 'helper trusted' : computerState === 'n/a' ? 'macOS local setup only' : 'helper not running or not trusted' },
+        { phase: 'secrets', state: secretsReady ? 'ready' : 'missing', detail: secretsReady ? 'defaults chosen' : 'defaults not chosen' },
+        { phase: 'fleet', state: Object.keys(devices).length ? 'ready' : 'missing', detail: Object.keys(devices).length ? `${Object.keys(devices).length} device${Object.keys(devices).length === 1 ? '' : 's'} registered` : 'no devices registered' },
+        { phase: 'share', state: shareConfig ? 'ready' : 'missing', detail: shareConfig?.baseUrl ?? 'endpoint not configured' },
+        { phase: 'watchdog', state: watchdogEnabled ? 'ready' : 'missing', detail: watchdogEnabled ? 'enabled on this device' : 'disabled on this device' },
+        { phase: 'preferences', state: interactiveHost || defaultBrowser ? 'ready' : 'missing', detail: [interactiveHost && `host ${interactiveHost}`, defaultBrowser && `browser ${defaultBrowser}`].filter(Boolean).join(' · ') || 'interactive host and browser unset' },
+    ];
+}
+export function renderSetupStatus(rows) {
+    console.log(chalk.bold('\nagents setup — onboarding\n'));
+    for (const row of rows) {
+        const marker = row.state === 'ready' ? chalk.green('[x]') : row.state === 'n/a' ? chalk.gray('[-]') : chalk.yellow('[ ]');
+        const label = row.phase[0].toUpperCase() + row.phase.slice(1);
+        console.log(`  ${marker} ${label.padEnd(12)} ${chalk.gray(row.detail)}`);
+    }
+}
+async function runSetupPhase(phase) {
+    if (phase === 'browser')
+        await runBrowserWizard();
+    else if (phase === 'computer')
+        await runComputerWizard();
+    else if (phase === 'share')
+        await runShareWizard();
+    else if (phase === 'secrets')
+        await import('./setup-secrets.js').then((m) => m.runSecretsSetupWizard());
+    else if (phase === 'fleet')
+        await import('./setup-fleet.js').then((m) => m.runFleetSetupWizard());
+    else if (phase === 'watchdog')
+        await runWatchdogSetupWizard();
+    else
+        await runPreferencesStep();
+}
+export async function runSetupHub(deps = {}) {
+    const interactive = deps.interactive ?? isInteractiveTerminal();
+    if (!interactive) {
+        const rows = await getSetupStatus();
+        renderSetupStatus(rows);
+        if (rows.some((row) => row.state === 'missing'))
+            process.exitCode = 1;
         return;
+    }
     try {
-        const { checkbox } = await import('@inquirer/prompts');
-        const picks = await checkbox({
-            message: 'Set up optional capabilities now? (space to select, enter to confirm)',
-            choices: [
-                { name: 'browser  — drive a real Chrome/Brave/Edge for web automation', value: 'browser' },
-                { name: 'computer — control native macOS apps (screenshot, click, type)', value: 'computer' },
-                { name: 'share    — publish shareable links (Cloudflare R2 + Worker)', value: 'share' },
-                { name: 'secrets  — choose storage defaults and import existing credentials', value: 'secrets' },
-                { name: 'fleet    — discover Tailscale devices and configure SSH access', value: 'fleet' },
-                { name: 'watchdog — resume stalled agent sessions on selected devices', value: 'watchdog' },
-            ],
-        });
-        for (const pick of picks) {
+        while (true) {
+            const rows = await getSetupStatus();
+            renderSetupStatus(rows);
+            let pick;
+            if (deps.selectPhase) {
+                pick = await deps.selectPhase(rows);
+            }
+            else {
+                const { select } = await import('@inquirer/prompts');
+                pick = await select({
+                    message: 'Choose a phase to configure',
+                    choices: [
+                        ...rows.filter((row) => row.phase !== 'core' && row.state !== 'n/a').map((row) => ({
+                            name: `${row.state === 'ready' ? '[x]' : '[ ]'} ${row.phase.padEnd(12)} ${row.detail}`,
+                            value: row.phase,
+                        })),
+                        { name: 'Exit setup', value: 'exit' },
+                    ],
+                });
+            }
+            if (pick === 'exit')
+                return;
             console.log();
-            if (pick === 'browser')
-                await runBrowserWizard();
-            else if (pick === 'computer')
-                await runComputerWizard();
-            else if (pick === 'share')
-                await runShareWizard();
-            else if (pick === 'secrets')
-                await import('./setup-secrets.js').then((m) => m.runSecretsSetupWizard());
-            else if (pick === 'fleet')
-                await import('./setup-fleet.js').then((m) => m.runFleetSetupWizard());
-            else if (pick === 'watchdog')
-                await runWatchdogSetupWizard();
+            await (deps.runPhase ?? runSetupPhase)(pick);
         }
     }
     catch (err) {
@@ -277,7 +326,7 @@ async function runSetupHub() {
 export function registerSetupCommand(program) {
     const setupCmd = program
         .command('setup')
-        .description('First-time setup. Clones a config repo and installs agent CLIs.')
+        .description('Set up agents-cli, or re-open the capability onboarding hub.')
         .option('-f, --force', 'Re-run setup even if ~/.agents/.system/ already exists (use with caution)')
         .option('--no-system-repo', 'Skip cloning the system repo (you must populate ~/.agents/.system/ yourself)');
     // Capability subcommands: `agents setup browser|computer|share|mine|secrets|fleet`.
@@ -288,6 +337,18 @@ export function registerSetupCommand(program) {
     registerSetupSecretsCommand(setupCmd);
     registerSetupFleetCommand(setupCmd);
     registerSetupWatchdogCommand(setupCmd);
+    setupCmd.command('status')
+        .description('Show setup readiness for core, browser, computer, secrets, fleet, share, watchdog, and preferences.')
+        .option('--json', 'print machine-readable JSON')
+        .action(async (options) => {
+        const rows = await getSetupStatus();
+        if (options.json)
+            console.log(JSON.stringify(rows, null, 2));
+        else
+            renderSetupStatus(rows);
+        if (rows.some((row) => row.state === 'missing'))
+            process.exitCode = 1;
+    });
     setHelpSections(setupCmd, {
         examples: `
       # First-time setup (clones the system repo into ~/.agents/.system/)
@@ -308,10 +369,8 @@ export function registerSetupCommand(program) {
       What it does:
         1. Clones the system repo into ~/.agents/.system/
         2. Imports any unmanaged agent installations it finds
-        3. On a TTY, offers to set up optional capabilities (browser/computer/share/secrets/fleet/watchdog)
-        4. On a TTY, asks preferences: which machine you sit at (interactive host)
-           and which browser agents drive here — both skippable, both the same
-           keys 'agents devices set-interactive' / 'browser profiles set-default' write
+        3. Opens a re-runnable capability menu with live ready/missing status
+        4. Delegates each selection to its existing setup wizard
 
       Capability setup can also be run any time on its own:
         agents setup browser    # detect a browser + create the default profile

package/dist/commands/ssh.js

@@ -31,7 +31,7 @@ import { resolveDeviceTarget, splitUserHost } from '../lib/devices/resolve-targe
 import { clearPendingSentinel } from '../lib/devices/pending.js';
 import { isInteractiveTerminal, isPromptCancelled } from './utils.js';
 import { hostNameFor, renderSshConfig } from '../lib/devices/ssh-config.js';
-import { ASKPASS_BUNDLE_ENV, ASKPASS_KEY_ENV, buildSshInvocation, fleetDialTarget, writeAskpassShim, } from '../lib/devices/connect.js';
+import { ASKPASS_BUNDLE_ENV, ASKPASS_KEY_ENV, buildSshInvocation, deviceIdentityArgs, fleetDialTarget, writeAskpassShim, } from '../lib/devices/connect.js';
 import { ensureManagedKnownHostsDir, isHostPinned } from '../lib/devices/known-hosts.js';
 import { shouldSyncTerminfo, syncTerminfoToDevice, terminfoHostKey } from '../lib/devices/terminfo.js';
 import { fanOutDevices, fleetHealthSkip, planFleetTargets, remoteFleetTargets, runFleet, skipLabel, upgradeCommand, } from '../lib/devices/fleet.js';
@@ -44,6 +44,7 @@ import { checkAllClis } from '../lib/teams/agents.js';
 import { buildRemoteAgentsInvocation } from '../lib/hosts/remote-cmd.js';
 import { sshExecAsync } from '../lib/ssh-exec.js';
 import { ALL_AGENT_IDS } from '../lib/agents.js';
+import { collectLocalHarnessInventory, groupByAccount, renderAccountsMatrix, renderHarnessMatrix, } from '../lib/devices/harness-inventory.js';
 import { crabboxList, crabboxFind, crabboxSshArgv } from '../lib/crabbox/cli.js';
 import { boxAddress, boxStatus, fmtIdleShort, fmtExpiresShort } from './lease.js';
 import { authCellColor, formatCheckedAge, isDeadVerdict, probeLocalFleetAuth, readAuthHealthCache, summarizeHostAuth, summarizeVerdicts, verdictColor, verdictLabel, writeFleetAuthRows, } from '../lib/auth-health.js';
@@ -351,7 +352,7 @@ async function probeRemoteFleetStatus(target) {
     const isWin = /^win/i.test((target.platform ?? '').trim());
     const env = isWin ? undefined : { PATH: '$HOME/.agents/.cache/shims:$HOME/.local/bin:$PATH' };
     const cmd = buildRemoteAgentsInvocation(['devices', 'status', '--local', '--json'], undefined, isWin ? 'windows' : undefined, env);
-    const res = await sshExecAsync(target.dialTarget, cmd, { timeoutMs: 15000, multiplex: true });
+    const res = await sshExecAsync(target.dialTarget, cmd, { timeoutMs: 15000, multiplex: true, extraSshArgs: target.extraSshArgs });
     if (res.code !== 0) {
         throw new Error(res.timedOut ? 'timed out' : (res.stderr.trim() || `exit ${res.code ?? 'unknown'}`));
     }
@@ -361,10 +362,10 @@ async function probeRemoteHealth(target) {
     const isWin = /^win/i.test((target.platform ?? '').trim());
     const env = isWin ? undefined : { PATH: '$HOME/.agents/.cache/shims:$HOME/.local/bin:$PATH' };
     const versionCmd = buildRemoteAgentsInvocation(['--version'], undefined, isWin ? 'windows' : undefined, env);
-    const versionRes = await sshExecAsync(target.dialTarget, versionCmd, { timeoutMs: 15000, multiplex: true });
+    const versionRes = await sshExecAsync(target.dialTarget, versionCmd, { timeoutMs: 15000, multiplex: true, extraSshArgs: target.extraSshArgs });
     const version = versionRes.code === 0 ? versionRes.stdout.trim().split(/\s+/)[0] || null : null;
     const doctorCmd = buildRemoteAgentsInvocation(['doctor', '--json'], undefined, isWin ? 'windows' : undefined, env);
-    const doctorRes = await sshExecAsync(target.dialTarget, doctorCmd, { timeoutMs: 30000, multiplex: true });
+    const doctorRes = await sshExecAsync(target.dialTarget, doctorCmd, { timeoutMs: 30000, multiplex: true, extraSshArgs: target.extraSshArgs });
     if (doctorRes.code !== 0) {
         throw new Error(doctorRes.timedOut ? 'timed out' : (doctorRes.stderr.trim() || `exit ${doctorRes.code ?? 'unknown'}`));
     }
@@ -425,6 +426,7 @@ async function runFleetStatus(opts) {
         // this is trusted on the default path, not just under `--refresh`.
         skip: fleetHealthSkip(t.skip, statsMap.get(t.device.name)),
         dialTarget: fleetDialTarget(t.device),
+        extraSshArgs: deviceIdentityArgs(t.device),
     }));
     const remote = await fanOutDevices(remoteTargets, probeRemoteHealth);
     for (const result of remote) {
@@ -533,7 +535,7 @@ async function probeRemoteAuth(target) {
     const isWin = /^win/i.test((target.platform ?? '').trim());
     const env = isWin ? undefined : { PATH: '$HOME/.agents/.cache/shims:$HOME/.local/bin:$PATH' };
     const cmd = buildRemoteAgentsInvocation(['devices', 'ping', '--local', '--json'], undefined, isWin ? 'windows' : undefined, env);
-    const res = await sshExecAsync(target.dialTarget, cmd, { timeoutMs: 15000, multiplex: true });
+    const res = await sshExecAsync(target.dialTarget, cmd, { timeoutMs: 15000, multiplex: true, extraSshArgs: target.extraSshArgs });
     if (res.code !== 0) {
         throw new Error(res.timedOut ? 'timed out' : (res.stderr.trim() || `exit ${res.code ?? 'unknown'}`));
     }
@@ -601,6 +603,7 @@ async function runFleetPing(opts) {
         platform: t.device.platform,
         skip: t.skip,
         dialTarget: fleetDialTarget(t.device),
+        extraSshArgs: deviceIdentityArgs(t.device),
     }));
     const probeable = remoteTargets.filter((t) => !t.skip).length;
     const spinner = isInteractiveTerminal() && !opts.json
@@ -645,6 +648,118 @@ async function runFleetPing(opts) {
     if (opts.strict && anyBad)
         process.exitCode = 1;
 }
+/** SSH into a host and read its raw harness rows (the `--local --json` worker). */
+async function probeRemoteHarnesses(target, refresh) {
+    const isWin = /^win/i.test((target.platform ?? '').trim());
+    const env = isWin ? undefined : { PATH: '$HOME/.agents/.cache/shims:$HOME/.local/bin:$PATH' };
+    const args = ['devices', 'harnesses', '--local', '--json'];
+    if (refresh)
+        args.push('--refresh');
+    const cmd = buildRemoteAgentsInvocation(args, undefined, isWin ? 'windows' : undefined, env);
+    const res = await sshExecAsync(target.dialTarget, cmd, { timeoutMs: 15000, multiplex: true, extraSshArgs: target.extraSshArgs });
+    if (res.code !== 0) {
+        throw new Error(res.timedOut ? 'timed out' : (res.stderr.trim() || `exit ${res.code ?? 'unknown'}`));
+    }
+    const parsed = JSON.parse(res.stdout);
+    return parsed.rows ?? [];
+}
+/**
+ * Gather harness rows across the fleet: THIS host in process, every reachable
+ * peer over SSH. Shared by both `harnesses` and `accounts` (they differ only in
+ * how the rows are rendered). Honors an optional `--device` allowlist on both
+ * the local and remote rows. Bounded by the same per-device + overall deadlines
+ * as `fleet ping`, so one unreachable box can never stall the glance.
+ */
+async function collectFleetHarnesses(opts) {
+    const self = machineId();
+    const want = opts.devices?.length ? new Set(opts.devices) : null;
+    const results = [];
+    if (!want || want.has(self)) {
+        const localRows = await collectLocalHarnessInventory({ agents: opts.agents, refresh: opts.refresh });
+        results.push({ host: self, rows: localRows });
+    }
+    const reg = await loadDevices();
+    const planned = planFleetTargets(reg);
+    let remoteTargets = remoteFleetTargets(planned, self).map((t) => ({
+        name: t.device.name,
+        platform: t.device.platform,
+        skip: t.skip,
+        dialTarget: fleetDialTarget(t.device),
+        extraSshArgs: deviceIdentityArgs(t.device),
+    }));
+    if (want)
+        remoteTargets = remoteTargets.filter((t) => want.has(t.name));
+    if (remoteTargets.length > 0) {
+        const probeable = remoteTargets.filter((t) => !t.skip).length;
+        const spinner = isInteractiveTerminal() && !opts.json
+            ? ora(`Probing ${probeable} device${probeable === 1 ? '' : 's'}…`).start()
+            : undefined;
+        let remote;
+        try {
+            const fanOut = fanOutDevices(remoteTargets, (t) => probeRemoteHarnesses(t, !!opts.refresh), { perDeviceTimeoutMs: 15_000 });
+            remote = await raceFleetPingDeadline(fanOut, remoteTargets, 30_000);
+        }
+        finally {
+            spinner?.stop();
+        }
+        for (const r of remote) {
+            if (r.status === 'ok' && r.value) {
+                results.push({ host: r.name, rows: r.value });
+            }
+            else {
+                results.push({
+                    host: r.name,
+                    rows: [],
+                    error: r.error,
+                    skipped: r.reason ? String(r.reason) : undefined,
+                });
+            }
+        }
+    }
+    return results;
+}
+async function runDevicesHarnesses(opts) {
+    if (opts.local) {
+        const rows = await collectLocalHarnessInventory({ agents: opts.agents, refresh: opts.refresh });
+        if (opts.json)
+            console.log(JSON.stringify({ host: machineId(), rows }));
+        else
+            for (const line of renderHarnessMatrix([{ host: machineId(), rows }]))
+                console.log(line);
+        return;
+    }
+    const results = await collectFleetHarnesses(opts);
+    if (opts.json)
+        console.log(JSON.stringify(results, null, 2));
+    else
+        for (const line of renderHarnessMatrix(results))
+            console.log(line);
+}
+async function runDevicesAccounts(opts) {
+    if (opts.local) {
+        const rows = await collectLocalHarnessInventory({ agents: opts.agents, refresh: opts.refresh });
+        if (opts.json)
+            console.log(JSON.stringify({ host: machineId(), accounts: groupByAccount(rows) }));
+        else
+            for (const line of renderAccountsMatrix([{ host: machineId(), rows }]))
+                console.log(line);
+        return;
+    }
+    const results = await collectFleetHarnesses(opts);
+    if (opts.json) {
+        const grouped = results.map((r) => ({
+            host: r.host,
+            error: r.error,
+            skipped: r.skipped,
+            accounts: groupByAccount(r.rows),
+        }));
+        console.log(JSON.stringify(grouped, null, 2));
+    }
+    else {
+        for (const line of renderAccountsMatrix(results))
+            console.log(line);
+    }
+}
 /** Resolve an {@link AuthCellColor} to a chalk painter. Single map for cells + labels. */
 const CELL_PAINT = {
     green: chalk.green,
@@ -777,6 +892,7 @@ Typical workflow:
   agents devices configure mac-mini --max-agents 4 --scheduler off
   agents devices note mac-mini "runs the releases — don't reboot"
   agents devices set win-mini --auth password --bundle muqsit
+  agents devices set worker --auth key --identity-file ~/.ssh/worker_ed25519
   agents devices render --write  # write ~/.ssh/config.d/agents include
   agents fleet update            # roll out latest agents-cli to every online device
   agents fleet run uname -a      # run a command on every online device
@@ -1219,6 +1335,59 @@ Typical workflow:
         const verbose = opts.verbose ?? Boolean(cmd.optsWithGlobals().verbose);
         await runFleetPing({ ...opts, verbose });
     });
+    const csvList = (s) => s ? s.split(',').map((x) => x.trim()).filter(Boolean) : undefined;
+    const harnessInvOpts = (opts) => ({
+        agents: csvList(opts.agents),
+        devices: csvList(opts.device ?? opts.devices),
+        refresh: opts.refresh || opts.live,
+        json: opts.json,
+        local: opts.local,
+    });
+    const harnessesCmd = devicesCmd
+        .command('harnesses')
+        .description('Per device, one row per installed agent@version: account, signed-in, quota, and a single ready verdict. SSH-probes each online box.')
+        .option('--json', 'output machine-readable JSON (per-host rows)')
+        .option('--agents <csv>', 'only these agents (comma-separated)')
+        .option('--device <csv>', 'only these devices (comma-separated); default: every online box')
+        .option('--refresh', 'fetch live quota instead of the cached snapshot (slower)')
+        .option('--live', 'alias of --refresh')
+        .option('--local', "this host only: emit THIS box's rows (the per-host worker the fan-out reads over ssh)")
+        .action(async (opts) => {
+        await runDevicesHarnesses(harnessInvOpts(opts));
+    });
+    setHelpSections(harnessesCmd, {
+        examples: `
+agents devices harnesses                 # every box: agent@version · account · signed · quota · ready
+agents devices harnesses --agents claude,codex   # just these harnesses
+agents devices harnesses --device zion   # one box
+agents devices harnesses --refresh       # live quota (bypass the cached snapshot)
+agents devices harnesses --json          # machine-readable, per-host rows`,
+        notes: `
+"ready" = signed in AND not rate-limited — usable for a run right now.
+Quota is the cached usage snapshot (the daemon warms it); --refresh fetches live.
+Use \`agents devices accounts\` for the same data grouped by account.`,
+    });
+    const accountsCmd = devicesCmd
+        .command('accounts')
+        .description('Per device, one row per account: which harnesses share it, signed-in, quota, and ready. The identity lens on `agents devices harnesses`.')
+        .option('--json', 'output machine-readable JSON (per-host account groups)')
+        .option('--agents <csv>', 'only these agents (comma-separated)')
+        .option('--device <csv>', 'only these devices (comma-separated); default: every online box')
+        .option('--refresh', 'fetch live quota instead of the cached snapshot (slower)')
+        .option('--live', 'alias of --refresh')
+        .option('--local', "this host only: emit THIS box's account groups")
+        .action(async (opts) => {
+        await runDevicesAccounts(harnessInvOpts(opts));
+    });
+    setHelpSections(accountsCmd, {
+        examples: `
+agents devices accounts                  # every box: account · agents · signed · quota · ready
+agents devices accounts --device mac-mini
+agents devices accounts --json           # machine-readable, per-host account groups`,
+        notes: `
+Collapses the installs that share one account (e.g. five claude versions on one
+email) into a single row. Use \`agents devices harnesses\` for the per-install view.`,
+    });
     devicesCmd
         .command('login')
         .description('Log agent CLIs into fleet boxes over SSH: drive each box\'s device-code OAuth, scrape the URL + code, and surface every pending login in one local browser page. Default drives all codes at once; --interactive walks one box at a time (codes requested just-in-time so they don\'t expire).')
@@ -1281,15 +1450,19 @@ Typical workflow:
         .option('--auth <method>', 'key | password')
         .option('--bundle <bundle>', 'secrets bundle holding the password (for --auth password)')
         .option('--bundle-key <key>', "key within the bundle (default 'password')")
+        .option('--identity-file <path>', 'private-key path for --auth key')
+        .option('--clear-identity-file', 'return key auth to ssh-agent/default-key discovery')
         .action(async (name, opts) => {
         try {
             const existing = await mustGetDevice(name);
-            const auth = opts.auth || opts.bundle || opts.bundleKey
-                ? {
-                    method: opts.auth ?? existing.auth.method,
-                    bundle: opts.bundle ?? existing.auth.bundle,
-                    bundleKey: opts.bundleKey ?? existing.auth.bundleKey,
-                }
+            const nextMethod = opts.auth ?? existing.auth.method;
+            if (opts.identityFile && nextMethod !== 'key') {
+                throw new Error('--identity-file requires key auth; pass --auth key in the same command.');
+            }
+            const auth = opts.auth || opts.bundle || opts.bundleKey || opts.identityFile || opts.clearIdentityFile
+                ? nextMethod === 'key'
+                    ? { method: nextMethod, identityFile: opts.clearIdentityFile ? undefined : (opts.identityFile ?? existing.auth.identityFile) }
+                    : { method: nextMethod, bundle: opts.bundle ?? existing.auth.bundle, bundleKey: opts.bundleKey ?? existing.auth.bundleKey }
                 : undefined;
             const d = await upsertDevice(name, {
                 platform: opts.platform ?? undefined,

package/dist/commands/teams.d.ts

@@ -34,6 +34,12 @@ export interface TeamListAgentSnapshot {
     cloud_provider: string | null;
     pr_url: string | null;
 }
+/**
+ * One-line operator nudge after `teams start`: teammates are briefed to post
+ * IMPORTANT milestones to the feed (RUSH-2250), and this is how to watch them.
+ * Print-only — no engine behavior.
+ */
+export declare function printFeedHint(team: string): void;
 /** Where `teams message`/`teams resume` routes a follow-up, by teammate status. */
 export type TeamMessageRoute = {
     kind: 'steer';

package/dist/commands/teams.js

@@ -17,7 +17,7 @@ import { createTeam, ensureTeam, getTeam, loadTeams, removeTeam, teamExists, } f
 import { setHelpSections } from '../lib/help.js';
 import { createWorktree, isGitRepo, hasUncommittedChanges, removeWorktree, } from '../lib/teams/worktree.js';
 import { resolveHost } from '../lib/hosts/registry.js';
-import { isDeviceAuto, resolveDeviceAffinity } from '../lib/smart-launch.js';
+import { isDeviceAuto, resolveDeviceAuto } from '../lib/smart-launch.js';
 import { sshTargetFor } from '../lib/hosts/types.js';
 import { ensureHostReady } from '../lib/hosts/ready.js';
 import { remoteShellFor } from '../lib/hosts/remote-cmd.js';
@@ -153,6 +153,18 @@ function fullName(type, version) {
     const name = AGENT_NAMES[type];
     return version ? `${name} ${version}` : name;
 }
+/**
+ * One-line operator nudge after `teams start`: teammates are briefed to post
+ * IMPORTANT milestones to the feed (RUSH-2250), and this is how to watch them.
+ * Print-only — no engine behavior.
+ */
+export function printFeedHint(team) {
+    console.log(chalk.gray('Tip: teammates post IMPORTANT milestones to the feed (') +
+        chalk.cyan('agents feed timeline') +
+        chalk.gray('); watch team progress with ') +
+        chalk.cyan(`agents teams status ${team}`) +
+        chalk.gray('.'));
+}
 /**
  * Resolve a teammate spec to its execution target.
  *
@@ -365,6 +377,8 @@ async function runOneWave(mgr, team, json) {
             console.log(`  ${chalk.blue(h)}  ${chalk.gray('after')} ${a.after.join(', ')}`);
         }
     }
+    if (launched.length > 0)
+        printFeedHint(team);
 }
 /**
  * Path to the pr-watch dedupe-state file for a team. Persists the set of
@@ -1340,12 +1354,12 @@ export function registerTeamsCommands(program) {
             }
             return h ?? d ?? null;
         })();
-        // `auto` is the same affinity sentinel `agents run --device auto` resolves
+        // `auto` is the same live fleet sentinel `agents run --device auto` resolves
         // (RUSH-2185) — pick the concrete device name up front so the local-machine
         // check right below (and every dieFriction message further down) sees the
         // real target instead of the literal string "auto".
         if (explicitDevice && isDeviceAuto(explicitDevice)) {
-            const plan = resolveDeviceAffinity({});
+            const plan = await resolveDeviceAuto(parseTeammate(teammate).agent);
             const picked = plan.host ?? machineId();
             process.stderr.write(chalk.gray(`[teams] device=auto → ${picked === machineId() ? 'local' : picked}\n`));
             explicitDevice = picked;
@@ -1766,11 +1780,40 @@ export function registerTeamsCommands(program) {
             await warnUnsignedTeammates(mgr, team);
             await warnThrottledTeammates(mgr, team);
         }
+        // Health-/harness-aware pre-flight (RUSH-2002): if the team declares a
+        // device pool and no device in it can run a pending teammate's agent, fail
+        // loud here rather than launching a wave that strands teammates pending.
+        // --force downgrades it to a warning so the user can still try.
+        const placementError = await mgr.preflightPlacement(team);
+        if (placementError) {
+            if (isJsonMode(opts)) {
+                console.log(JSON.stringify({
+                    team,
+                    error: 'no-viable-device',
+                    message: placementError.message,
+                    excluded: placementError.excluded,
+                }));
+                if (!opts.force) {
+                    process.exitCode = 1;
+                    return;
+                }
+            }
+            else if (opts.force) {
+                console.error(chalk.yellow(`⚠ ${placementError.message}\n  Continuing anyway (--force).`));
+            }
+            else {
+                console.error(chalk.red(placementError.message));
+                process.exitCode = 1;
+                return;
+            }
+        }
         emit('teams.start', { module: 'teams', team, watch: Boolean(opts.watch) });
         if (!opts.watch) {
             await runOneWave(mgr, team, Boolean(opts.json));
             return;
         }
+        if (!isJsonMode(opts))
+            printFeedHint(team);
         const intervalMs = Math.max(1000, Number.parseInt(opts.interval, 10) * 1000 || 8000);
         const maxWaves = Math.max(1, Number.parseInt(opts.maxWaves, 10) || 1000);
         const json = isJsonMode(opts);

package/dist/commands/trends.d.ts

@@ -1,2 +1,10 @@
+/**
+ * Deprecated top-level spelling of the counter-mix tree.
+ *
+ * Implementation lives under `agents insights mix` (see
+ * `lib/analytics/mix-commands.ts`). This file only registers the thin alias so
+ * old scripts and agent briefs keep working while printing one deprecation line
+ * — no second recipe implementation.
+ */
 import type { Command } from 'commander';
 export declare function registerTrendsCommand(program: Command): void;