@phnx-labs/agents-cli 1.22.34 → 1.22.37

package/dist/commands/accounts.d.ts

@@ -1,13 +1,6 @@
 import type { Command } from 'commander';
-import type { AgentId } from '../lib/types.js';
-import { listInstalledVersions } from '../lib/versions.js';
-import { discoverAccounts } from '../lib/account-labels.js';
-export declare function fingerprintFromSource(raw: string, deps?: {
-    installedVersions?: typeof listInstalledVersions;
-    discover?: typeof discoverAccounts;
-}): Promise<{
-    agent: AgentId;
-    fingerprint: string;
-    versions: string[];
-}>;
+export declare function parseBundleKey(raw: string): {
+    bundle: string;
+    key: string;
+};
 export declare function registerAccountsCommand(program: Command): void;

package/dist/commands/accounts.js

@@ -1,32 +1,164 @@
 import chalk from 'chalk';
-import { select } from '@inquirer/prompts';
-import { resolveAgentName, formatAgentError } from '../lib/agents.js';
-import { listInstalledVersions } from '../lib/versions.js';
-import { discoverAccounts, nameAccount, removeAccountLabel, renameAccountLabel } from '../lib/account-labels.js';
+import { password } from '@inquirer/prompts';
 import { setHelpSections } from '../lib/help.js';
-function parseSource(raw) { const at = raw.lastIndexOf('@'); if (at < 1 || at === raw.length - 1)
-    throw new Error(`Expected <agent>@<version>, got '${raw}'.`); const name = raw.slice(0, at); const agent = resolveAgentName(name); if (!agent)
-    throw new Error(formatAgentError(name)); return { agent, version: raw.slice(at + 1) }; }
-export async function fingerprintFromSource(raw, deps = {}) {
-    const { agent, version } = parseSource(raw);
-    if (!(deps.installedVersions ?? listInstalledVersions)(agent).includes(version))
-        throw new Error(`${raw} is not installed.`);
-    const account = (await (deps.discover ?? discoverAccounts)([agent])).find(candidate => candidate.versions.includes(version));
-    if (!account)
-        throw new Error(`${raw} has no stable signed-in account. Run it and complete its normal login first.`);
-    return { agent, fingerprint: account.fingerprint, versions: account.versions };
+import { updateMeta } from '../lib/state.js';
+import { ALL_AGENT_IDS } from '../lib/agents.js';
+import { pushBundleToHost } from '../lib/secrets/push.js';
+import { resolveRemoteOsSync } from '../lib/hosts/remote-os.js';
+import { runDevicesAccounts } from './ssh.js';
+import { discoverNativeAccounts } from '../lib/account-catalog.js';
+import { readAndResolveBundleEnv } from '../lib/secrets/bundles.js';
+import { getAccountProvider, listAccountProviders } from '../lib/account-provider-registry.js';
+import { addAccount, findAccount, inspectAccount, readAccountRegistry, removeAccount, renameAccount, setAccountSecret } from '../lib/account-registry.js';
+export function parseBundleKey(raw) {
+    const colon = raw.indexOf(':');
+    if (colon < 1 || colon === raw.length - 1)
+        throw new Error(`Expected bundle:key, got '${raw}'.`);
+    return { bundle: raw.slice(0, colon), key: raw.slice(colon + 1) };
+}
+function secretFromBundle(raw) {
+    const { bundle, key } = parseBundleKey(raw);
+    return readAndResolveBundleEnv(bundle, { keys: [key], keyMode: 'storage', agentOnly: true, caller: 'accounts import' }).env[key];
+}
+function publicAccount(account) {
+    return { kind: 'provider', id: account.id, name: account.name, provider: account.provider, auth: account.auth, baseUrl: account.baseUrl, policy: account.policy, secretPresent: account.secretPresent };
+}
+async function printAccounts(json, fleet = false) {
+    if (fleet)
+        return runDevicesAccounts({ json });
+    const records = Object.values(readAccountRegistry().accounts).sort((a, b) => a.name.localeCompare(b.name));
+    const native = await discoverNativeAccounts();
+    if (json) {
+        console.log(JSON.stringify([...records.map(account => publicAccount(inspectAccount(account.name))), ...native], null, 2));
+        return;
+    }
+    console.log(chalk.bold('Provider account bundles\n'));
+    if (!records.length)
+        console.log(chalk.gray("  None. Add one with 'agents accounts add <name> --provider <provider> --auth <type>'."));
+    for (const account of records) {
+        const present = inspectAccount(account.name).secretPresent ? chalk.green('ready') : chalk.red('missing on this device');
+        console.log(`  ${chalk.cyan(account.name)}  ${account.provider}  ${account.auth}  ${present}`);
+    }
+    console.log(chalk.bold('\nNative harness logins\n'));
+    if (!native.length)
+        console.log(chalk.gray('  No signed-in native accounts found.'));
+    for (const account of native)
+        console.log(`  ${chalk.cyan(account.display)}  ${account.agent}  ${account.versions.join(', ')}`);
+}
+function parseAuth(raw) {
+    if (raw === 'api-key' || raw === 'setup-token' || raw === 'bearer-token')
+        return raw;
+    throw new Error(`Unsupported auth type '${raw}'. Use api-key, setup-token, or bearer-token.`);
 }
-async function printAccounts(json) { const accounts = await discoverAccounts(); if (json)
-    return console.log(JSON.stringify(accounts, null, 2)); if (!accounts.length)
-    return console.log(chalk.gray('No signed-in accounts found. Run an installed agent and complete its normal login first.')); console.log(chalk.bold('Signed-in accounts\n')); for (const account of accounts)
-    console.log(`  ${account.label ? chalk.cyan(account.label) : chalk.gray('(unnamed)')}  ${account.agent}  ${account.display}\n    ${account.versions.length} installed version${account.versions.length === 1 ? '' : 's'}: ${account.versions.join(', ')}`); }
-async function chooseAccount() { const accounts = await discoverAccounts(); if (!accounts.length)
-    throw new Error('No signed-in accounts found. Run an installed agent and complete its normal login first.'); return select({ message: 'Which signed-in account do you want to name?', choices: accounts.map(account => ({ name: `${account.agent}  ${account.display}  (${account.versions.length} version${account.versions.length === 1 ? '' : 's'})${account.label ? `  currently “${account.label}”` : ''}`, value: account })) }); }
 export function registerAccountsCommand(program) {
-    const accounts = program.command('accounts').description('Browse and name signed-in harness accounts').option('--json', 'Machine-readable discovered accounts').action(async (o) => printAccounts(!!o.json));
-    accounts.command('list').description('Alias for accounts').option('--json', 'Machine-readable discovered accounts').action((o) => printAccounts(!!o.json));
-    accounts.command('name <label>').description('Name one signed-in account; matching installed versions are found automatically').option('--from <agent@version>', 'Non-interactive identity source').action(async (label, o) => { const picked = o.from ? await fingerprintFromSource(o.from) : await chooseAccount(); nameAccount(label, picked.agent, picked.fingerprint); console.log(chalk.green(`Named the ${picked.agent} account '${label}'.`)); console.log(chalk.gray(`Found it in ${picked.versions.length} installed version${picked.versions.length === 1 ? '' : 's'}: ${picked.versions.join(', ')}`)); });
-    accounts.command('rename <old> <new>').description('Rename a saved account label').action((oldLabel, newLabel) => renameAccountLabel(oldLabel, newLabel));
-    accounts.command('remove <label>').description('Remove a saved account label').action((label) => removeAccountLabel(label));
-    setHelpSections(accounts, { examples: `agents accounts\nagents accounts name work\nagents accounts name work --from claude@2.1.220\nagents run claude --account work`, notes: 'First run the harness and complete its normal login. A label names one provider account; every matching installed version is discovered automatically. OAuth credentials are never copied or shared.' });
+    const accounts = program.command('accounts').description('Browse native logins and manage provider account bundles')
+        .option('--json', 'Machine-readable account metadata')
+        .option('--fleet', 'Show harness-native signed-in identities across reachable devices')
+        .action((o) => printAccounts(!!o.json, !!o.fleet));
+    accounts.command('list').description('List credential accounts').option('--json', 'Machine-readable account metadata').action((o, command) => printAccounts(!!(o.json || command.optsWithGlobals().json)));
+    accounts.command('add <name>')
+        .description('Add a durable API key, setup token, or bearer token')
+        .requiredOption('--provider <provider>', `Credential provider (${listAccountProviders().join(', ')})`)
+        .requiredOption('--auth <type>', 'Credential type: api-key | setup-token | bearer-token')
+        .option('--base-url <url>', 'Optional endpoint override stored with the account')
+        .option('--from-secrets <bundle:key>', 'Import from an existing agents secrets entry')
+        .action(async (name, o) => {
+        const auth = parseAuth(o.auth);
+        const provider = getAccountProvider(o.provider);
+        if (!provider.authKinds.includes(auth))
+            throw new Error(`Provider '${provider.provider}' does not support ${auth}. Supported: ${provider.authKinds.join(', ')}.`);
+        const secret = o.fromSecrets ? secretFromBundle(o.fromSecrets) : await password({ message: `Enter ${provider.provider} ${auth} for '${name}':` });
+        const account = addAccount(name, provider.provider, auth, secret, undefined, { baseUrl: o.baseUrl });
+        console.log(chalk.green(`Added ${account.provider} ${account.auth} account '${account.name}'.`));
+        console.log(chalk.gray(`Secret bundle '${account.name}' is the account and uses policy never, so agent launches never request Touch ID.`));
+    });
+    accounts.command('set-key <name>')
+        .description('Rotate an account credential without changing its identity')
+        .option('--from-secrets <bundle:key>', 'Import from an existing agents secrets entry')
+        .action(async (name, o) => {
+        const account = findAccount(name);
+        if (!account)
+            throw new Error(`Unknown account '${name}'.`);
+        const secret = o.fromSecrets ? secretFromBundle(o.fromSecrets) : await password({ message: `Enter new ${account.provider} ${account.auth} for '${name}':` });
+        setAccountSecret(name, secret);
+        console.log(chalk.green(`Updated credential for account '${name}'.`));
+    });
+    accounts.command('inspect <name>').description('Show safe account metadata').option('--json', 'Machine-readable output').action((name, o, command) => {
+        const account = publicAccount(inspectAccount(name));
+        if (o.json || command.optsWithGlobals().json)
+            return console.log(JSON.stringify(account, null, 2));
+        console.log(`${chalk.bold(account.name)}  ${account.provider}`);
+        console.log(`  auth: ${account.auth}`);
+        console.log(`  id: ${account.id}`);
+        console.log(`  policy: ${account.policy}`);
+        if (account.baseUrl)
+            console.log(`  base url: ${account.baseUrl}`);
+        console.log(`  credential: ${account.secretPresent ? 'present on this device' : 'missing on this device'}`);
+    });
+    accounts.command('rename <old> <new>').description('Rename an account without changing its stable id').action((oldName, newName) => renameAccount(oldName, newName));
+    accounts.command('remove <name>').description('Remove an account and its device-local credential').action((name) => removeAccount(name));
+    accounts.command('set-default <agent> <name>')
+        .description('Use a provider account for a harness when --account is omitted')
+        .action((agentRaw, name) => {
+        if (!ALL_AGENT_IDS.includes(agentRaw))
+            throw new Error(`Unknown agent '${agentRaw}'.`);
+        const agent = agentRaw;
+        const account = findAccount(name);
+        if (!account)
+            throw new Error(`Unknown provider account '${name}'.`);
+        getAccountProvider(account.provider).envFor(agent, account.auth);
+        // Defaults follow the stable account id, so renaming the bundle cannot
+        // strand bare runs on a deleted label. findAccount accepts ids and names.
+        updateMeta(meta => ({ ...meta, accounts: { ...meta.accounts, defaults: { ...meta.accounts?.defaults, [agent]: account.id } } }));
+        console.log(chalk.green(`${agent} now uses account '${account.name}' unless --account overrides it.`));
+    });
+    accounts.command('clear-default <agent>')
+        .description('Return a harness to native login or balanced account selection')
+        .action((agentRaw) => {
+        if (!ALL_AGENT_IDS.includes(agentRaw))
+            throw new Error(`Unknown agent '${agentRaw}'.`);
+        updateMeta(meta => {
+            const defaults = { ...meta.accounts?.defaults };
+            delete defaults[agentRaw];
+            return { ...meta, accounts: { ...meta.accounts, defaults } };
+        });
+        console.log(chalk.green(`Cleared the default account for ${agentRaw}.`));
+    });
+    accounts.command('sync <name>')
+        .description('Copy one provider account bundle to a worker device')
+        .requiredOption('--device <device>', 'Destination device or SSH host')
+        .option('--force', 'Replace matching keys on the destination')
+        .action((name, o) => {
+        const account = findAccount(name);
+        if (!account)
+            throw new Error(`Unknown provider account '${name}'.`);
+        const remoteBackend = resolveRemoteOsSync(o.device) === 'win32' ? 'keychain' : 'file';
+        const literalValues = {
+            ACCOUNT_ID: account.id,
+            PROVIDER: account.provider,
+            AUTH_TYPE: account.auth,
+            ...(account.baseUrl ? { BASE_URL: account.baseUrl } : {}),
+        };
+        const result = pushBundleToHost(account.name, o.device, {
+            remoteBackend,
+            force: o.force,
+            operation: 'accounts sync',
+            policyNever: true,
+            agentOnly: false,
+            literalValues,
+        });
+        if (!result.ok)
+            throw new Error(`${result.message}\nRetry: agents accounts sync ${account.name} --device ${o.device}${o.force ? ' --force' : ''}`);
+        console.log(chalk.green(`${account.name} synced to ${o.device} (${result.keyCount} keys, ${remoteBackend} backend, policy never).`));
+    });
+    setHelpSections(accounts, {
+        examples: `agents accounts add work --provider anthropic --auth setup-token
+agents accounts add openrouter-work --provider openrouter --auth api-key --from-secrets openrouter.ai:OPENROUTER_API_KEY
+agents accounts set-key work
+agents accounts inspect work --json
+agents accounts set-default claude work
+agents accounts sync work --device yosemite-s0
+agents run claude --account work`,
+        notes: 'Provider accounts are durable credentials independent of agent versions. Harness-native auth remains managed by each harness and is not copied or renamed by agents-cli.',
+    });
 }

package/dist/commands/attach.js

@@ -4,19 +4,32 @@ import { sessionRecoveryPeer } from '../lib/session/recovery.js';
 import { resolveSessionMetadataValue, resumeSessionInPlace } from './sessions.js';
 import { readDetachRecord, clearDetachRecord, isHeadlessAlive } from '../lib/session/detached.js';
 export function registerAttachCommand(program) {
+    // Deprecated: superseded by `agents sessions resume`, which detects the state
+    // (live pane / headless / ended) instead of making the caller pick a verb.
+    // Hidden from help; kept as a warned, functional alias for one release so old
+    // muscle-memory and scripts don't break.
     program
-        .command('attach')
+        .command('attach', { hidden: true })
         .argument('<id>', 'Short or full id of the backgrounded/parked session to resume interactively')
-        .description('Bring a backgrounded agent to the foreground — resume it interactively here')
+        .description('Deprecated — use `agents sessions resume <id>` instead.')
         .action(async (id) => {
+        console.warn(chalk.yellow('`agents sessions attach` is deprecated — use `agents sessions resume` instead:'));
+        console.warn(chalk.gray(`  agents sessions resume ${id}`));
         await attachAction(id);
     });
 }
 export async function attachAction(id) {
     const outcome = await resolveSessionMetadataValue(id);
     if (outcome.kind === 'partial') {
-        console.error(chalk.red(`Could not resolve session while these devices were unavailable: ${outcome.failedPeers.join(', ')}`));
-        process.exitCode = 2;
+        // RUSH-2492: an unreachable peer is a warning, not a hard failure. The
+        // resolver already resolves an id found on the reachable fleet (SES-9a), so
+        // reaching here means the session was not found on any device we COULD reach
+        // — it may live on one of the unreachable peers, which we could not check.
+        const offline = outcome.failedPeers;
+        console.error(chalk.yellow(`Warning: ${offline.length} device(s) unreachable, not checked: ${offline.join(', ')}`));
+        console.error(chalk.red(`No session matching "${id}" on any reachable device (${offline.length} unreachable, not checked).`));
+        console.error(chalk.gray('  If it lives on an offline box, wake it (agents devices) or run there: agents ssh <device>'));
+        process.exitCode = 1;
         return;
     }
     if (outcome.kind === 'not-found') {

package/dist/commands/audit.d.ts

@@ -1,14 +1,14 @@
 /**
- * `agents audit` — inspect the tamper-evident audit log of dispatched runs.
+ * `agents audit` — thin alias of `agents events --include runs`.
  *
- * Every run that reaches the exec dispatch chokepoint appends one hash-chained
- * record (see src/lib/audit/log.ts). This command walks that chain:
+ * New run-dispatch outcomes land in the unified event stream as `run.dispatched`
+ * (see lib/audit/log.ts::recordDispatchedRun). This command does not own a
+ * separate store or query path — it only sets the default family filter.
  *
- *   agents audit verify   Confirm the chain is intact; report the first break.
- *   agents audit list     Print recent records (newest last).
- *
- * `verify` exits non-zero when the chain is broken so it can gate CI / governance
- * checks.
+ *   agents audit              ≡ agents events --include runs
+ *   agents audit list         ≡ same
+ *   agents audit verify       walks the legacy hash-chain file if present
+ *                             (pre-unification history only)
  */
 import type { Command } from 'commander';
 export declare function registerAuditCommands(program: Command): void;

package/dist/commands/audit.js

@@ -1,68 +1,78 @@
 /**
- * `agents audit` — inspect the tamper-evident audit log of dispatched runs.
+ * `agents audit` — thin alias of `agents events --include runs`.
  *
- * Every run that reaches the exec dispatch chokepoint appends one hash-chained
- * record (see src/lib/audit/log.ts). This command walks that chain:
+ * New run-dispatch outcomes land in the unified event stream as `run.dispatched`
+ * (see lib/audit/log.ts::recordDispatchedRun). This command does not own a
+ * separate store or query path — it only sets the default family filter.
  *
- *   agents audit verify   Confirm the chain is intact; report the first break.
- *   agents audit list     Print recent records (newest last).
- *
- * `verify` exits non-zero when the chain is broken so it can gate CI / governance
- * checks.
+ *   agents audit              ≡ agents events --include runs
+ *   agents audit list         ≡ same
+ *   agents audit verify       walks the legacy hash-chain file if present
+ *                             (pre-unification history only)
  */
 import chalk from 'chalk';
 import { verifyAuditChain, readAuditLog, getAuditLogPath, } from '../lib/audit/log.js';
-function renderRow(r, i) {
-    const idx = chalk.gray(String(i).padStart(4));
-    const time = chalk.gray(r.ts.slice(0, 19).replace('T', ' '));
-    const who = `${r.agent}@${r.version}`.padEnd(20);
-    const outcome = r.outcome === 'ok' ? chalk.green('ok  ') : chalk.red('fail');
-    const mode = chalk.cyan(r.mode.padEnd(6));
-    return `${idx}  ${time}  ${who} ${mode} ${outcome} exit=${r.exit}  ${r.repo}`;
-}
+import { addEventsReadOptions, runEventsCommand } from './events.js';
 export function registerAuditCommands(program) {
-    const audit = program
+    const audit = addEventsReadOptions(program
         .command('audit')
-        .description('Inspect the tamper-evident audit log of dispatched runs');
+        .description('Alias of `agents events --include runs` — dispatched-run outcomes'), false)
+        .addHelpText('after', `
+Examples:
+  agents audit                         Same as: agents events --include runs
+  agents audit --since 7d --json
+  agents audit list                    Muscle-memory alias of bare audit
+  agents audit verify                  Legacy hash-chain file only (if present)
+`)
+        .action((_options, command) => {
+        const opts = command.optsWithGlobals();
+        // Bare audit defaults to --include runs unless the user already set families.
+        if (!opts.include && !opts.exclude)
+            opts.include = 'runs';
+        return runEventsCommand(opts);
+    });
+    audit
+        .command('list')
+        .description('Alias of `agents audit` / `agents events --include runs`')
+        .action((_options, command) => {
+        const parent = command.parent;
+        const opts = {
+            ...(parent?.optsWithGlobals?.() ?? {}),
+            ...(command.optsWithGlobals?.() ?? {}),
+            include: 'runs',
+        };
+        return runEventsCommand(opts);
+    });
     audit
         .command('verify')
-        .description('Walk the hash chain and report OK or the first broken index')
+        .description('Walk the legacy hash-chain file (pre-unification history only)')
         .option('--json', 'Output the result as JSON')
         .action((options) => {
-        const result = verifyAuditChain();
+        const logPath = getAuditLogPath();
+        const records = readAuditLog(logPath);
+        if (records.length === 0) {
+            if (options.json) {
+                console.log(JSON.stringify({ ok: true, legacy: true, records: 0, note: 'no legacy audit chain; new runs use events --include runs' }));
+                process.exit(0);
+            }
+            console.log(chalk.green('✓ no legacy audit chain present'));
+            console.log(chalk.gray('  New run outcomes: agents events --include runs'));
+            console.log(chalk.gray(`  (looked for ${logPath})`));
+            process.exit(0);
+        }
+        const result = verifyAuditChain(logPath);
         if (options.json) {
-            console.log(JSON.stringify(result));
+            console.log(JSON.stringify({ ...result, legacy: true, records: records.length }));
             process.exit(result.ok ? 0 : 1);
         }
         if (result.ok) {
-            const n = readAuditLog().length;
-            console.log(chalk.green(`✓ audit chain intact — ${n} record(s) verified`));
-            console.log(chalk.gray(`  ${getAuditLogPath()}`));
+            console.log(chalk.green(`✓ legacy audit chain intact — ${records.length} record(s) verified`));
+            console.log(chalk.gray(`  ${logPath}`));
+            console.log(chalk.gray('  New runs use the events stream: agents events --include runs'));
             process.exit(0);
         }
-        console.error(chalk.red(`✗ audit chain BROKEN at record #${result.brokenAt}`));
-        console.error(chalk.gray(`  ${getAuditLogPath()}`));
+        console.error(chalk.red(`✗ legacy audit chain BROKEN at record #${result.brokenAt}`));
+        console.error(chalk.gray(`  ${logPath}`));
         process.exit(1);
     });
-    audit
-        .command('list')
-        .description('Print recent audit records (oldest-first)')
-        .option('--limit <n>', 'Max records to show (default 50)', '50')
-        .option('--json', 'Output raw records as JSON')
-        .action((options) => {
-        const all = readAuditLog();
-        if (options.json) {
-            console.log(JSON.stringify(all, null, 2));
-            return;
-        }
-        if (all.length === 0) {
-            console.log(chalk.gray('No audit records yet.'));
-            return;
-        }
-        const limit = Math.max(1, parseInt(options.limit ?? '50', 10) || 50);
-        const start = Math.max(0, all.length - limit);
-        for (let i = start; i < all.length; i++)
-            console.log(renderRow(all[i], i));
-        console.log(chalk.gray(`\n${all.length} record(s). Log: ${getAuditLogPath()}`));
-    });
 }

package/dist/commands/browser.js

@@ -1,7 +1,7 @@
+import chalk from 'chalk';
 import * as fs from 'fs';
 import * as path from 'path';
 import { listProfiles, getProfile, createProfile, deleteProfile, ensureDefaultBrowserProfile, getConfiguredDefaultProfileName, DEFAULT_BROWSER_PROFILE_NAME, getProfileRuntimeDir, extractConfiguredPort, findFreeProfilePort, getEndpointPresets, } from '../lib/browser/profiles.js';
-import { updateMeta } from '../lib/state.js';
 import { resolveActor } from '../lib/actor.js';
 import { loginsForProfile, profilesLoggedInto, serviceForUrl, loginsWithAccountsForProfile, accountsForProfile, credKeysForService, AUTH_SIGNATURES, } from '../lib/browser/login-detection.js';
 import { parseSecretRef } from '../lib/browser/secret-ref.js';
@@ -15,7 +15,7 @@ import { parseTargetFilter } from '../lib/browser/service.js';
 import { BrowserDaemonNotRunningError, formatBrowserDaemonNotRunningError, sendIPCRequest, } from '../lib/browser/ipc.js';
 import { browserTaskPicker } from './browser-picker.js';
 import { assertRemoteControlAllowed } from '../lib/browser/remote-control.js';
-import { getConfigValue, setConfigValue } from '../lib/device-config.js';
+import { getConfigValue, setConfigValue, unsetConfigValue } from '../lib/device-config.js';
 import { isInteractiveTerminal } from './utils.js';
 import { registerCommandGroups, setHelpSections } from '../lib/help.js';
 import { buildHar } from '../lib/browser/har.js';
@@ -188,17 +188,15 @@ function registerProfilesCommands(browser) {
             console.log(`Default profile (this machine): ${configuredDefault}`);
         }
     });
+    const browserProfileDeprecation = chalk.yellow('Deprecation: `agents browser profiles set-default` is replaced by `agents config set browser.profile <name>`.');
     profiles
         .command('set-default [name]')
         .description('Set the profile `agents browser start` uses when no --profile is passed (also re-points an explicit `--profile default`). Device-local — each machine has its own. No name prints the current value.')
         .option('--unset', 'Clear the configured default (revert to auto-detecting an installed browser)')
         .action(async (name, opts) => {
+        console.warn(browserProfileDeprecation);
         if (opts.unset) {
-            updateMeta((m) => {
-                const { defaultBrowserProfile, ...rest } = m;
-                void defaultBrowserProfile;
-                return rest;
-            });
+            unsetConfigValue('browser.profile');
             console.log('Default browser profile cleared. `agents browser start` will auto-detect an installed Chromium-family browser.');
             return;
         }
@@ -209,7 +207,7 @@ function registerProfilesCommands(browser) {
             }
             else {
                 console.log('No default browser profile set. `agents browser start` auto-detects an installed Chromium-family browser.');
-                console.log('Set one with: agents browser profiles set-default <name>');
+                console.log('Set one with: agents config set browser.profile <name>');
             }
             return;
         }
@@ -221,7 +219,7 @@ function registerProfilesCommands(browser) {
                 console.error(`Available profiles: ${all.map((p) => p.name).join(', ')}`);
             process.exit(1);
         }
-        updateMeta((m) => ({ ...m, defaultBrowserProfile: name }));
+        setConfigValue('browser.profile', name);
         const eps = getEndpointPresets(target);
         const epStr = Object.values(eps)[0]?.target ?? '';
         console.log(`Default browser profile (this machine) is now "${name}" (${target.browser}${epStr ? `, ${epStr}` : ''}).`);
@@ -454,7 +452,7 @@ function registerProfilesCommands(browser) {
             (removed > 0 ? ` (and ${removed} cache dir${removed === 1 ? '' : 's'})` : ''));
         if (getConfiguredDefaultProfileName() === name) {
             console.error(`warning: "${name}" was this machine's default browser profile; ` +
-                `\`agents browser start\` will auto-detect until you run: agents browser profiles set-default <name>`);
+                `\`agents browser start\` will auto-detect until you run: agents config set browser.profile <name>`);
         }
     });
     profiles
@@ -674,6 +672,7 @@ function registerTaskCommands(browser) {
             task: opts.task ?? process.env.AGENTS_BROWSER_TASK,
             actor: resolveActor().id,
             launchId: process.env.AGENT_LAUNCH_ID,
+            sessionId: process.env.AGENT_SESSION_ID || process.env.AGENTS_SESSION_ID,
         });
     });
     setHelpSections(stream, {
@@ -695,7 +694,7 @@ function registerTaskCommands(browser) {
     });
     browser
         .command('start')
-        .description('Start a browser task. Pass --profile <name>; omit to use your configured default (`agents browser profiles set-default`), else auto-pick an installed Chromium-family browser.')
+        .description('Start a browser task. Pass --profile <name>; omit to use your configured default (`agents config set browser.profile <name>`), else auto-pick an installed Chromium-family browser.')
         .option('-p, --profile <name>', 'Browser profile to use (omit to use the configured default, else auto-pick an installed Chromium-family browser)')
         .option(TASK_OPTION_FLAG, 'Task name (auto-generated if omitted)')
         .option('-e, --endpoint <name>', 'Endpoint preset (defaults to the profile\'s default)')
@@ -798,6 +797,11 @@ function registerTaskCommands(browser) {
             // per-run id exec.ts injects for every harness.
             actor: resolveActor().id,
             launchId: process.env.AGENT_LAUNCH_ID,
+            // The agent session that drove this task — what makes the capture
+            // traceable back to a conversation (RUSH-2549). Sent alongside, not
+            // instead of, launchId: a launch id is absent on most agent processes,
+            // a session id is not.
+            sessionId: process.env.AGENT_SESSION_ID || process.env.AGENTS_SESSION_ID,
         });
         if (!response.ok) {
             console.error(response.error);

package/dist/commands/cloud.js

@@ -127,7 +127,7 @@ Examples:
   # Codex Cloud
   agents cloud run "add auth tests" --provider codex --env env_abc123
 
-  # One of your own machines (agents hosts / agents devices), over SSH
+  # One of your own machines (agents devices), over SSH
   agents cloud run "run the nightly benchmark" --host gpu-box --agent claude
   agents cloud run "rebuild the index" --host gpu --any --remote-cwd ~/proj
 

package/dist/commands/commands.js

@@ -395,17 +395,6 @@ Examples:
             console.log(chalk.gray('Central source unchanged. Commands will re-sync on next agent launch.'));
         }
     });
-    // `commands sync` is gone — sync runs automatically when the agent launches.
-    commandsCmd
-        .command('sync', { hidden: true })
-        .allowUnknownOption()
-        .allowExcessArguments()
-        .action(() => {
-        console.error(chalk.red('"agents commands sync" is gone.'));
-        console.error(chalk.gray('Sync runs automatically when you launch the agent.'));
-        console.error(chalk.gray('To remove orphans, use:  agents prune cleanup commands'));
-        process.exit(1);
-    });
     // `commands prune` moved to the top-level `agents prune cleanup` command.
     commandsCmd
         .command('prune', { hidden: true })

package/dist/commands/computer-actions.js

@@ -9,9 +9,12 @@
 import { execFileSync } from 'child_process';
 import * as fs from 'fs';
 import * as path from 'path';
+import { randomUUID } from 'node:crypto';
 import { openComputerClient, describeTransport, resolvePolicyPath, } from '../lib/computer-rpc.js';
 import { COMPUTER_INPUT_GATED_VERBS, formatComputerPermissionGrantHint, } from '../lib/permissions.js';
 import { emit as emitEvent } from '../lib/events.js';
+import { recordComputerSession } from '../lib/session/db.js';
+import { resolveActor } from '../lib/actor.js';
 function isComputerInputVerb(verb) {
     return typeof verb === 'string' && COMPUTER_INPUT_GATED_VERBS.includes(verb);
 }
@@ -358,14 +361,44 @@ function emit(result, json, human) {
 // NOTE: the field is `targetPid`, never `pid` — `pid` is a reserved envelope
 // key (the emitting process's OWN pid, events.ts RESERVED_META_KEYS) that
 // sanitizePayload() silently strips from the payload before it can collide.
+const COMPUTER_INVOCATION_ID = randomUUID();
 export function emitComputerAction(verb, targetPid, opts, extra = {}) {
     emitEvent('computer.action', {
         command: verb,
+        invocationId: COMPUTER_INVOCATION_ID,
         targetPid,
         bundle: opts.bundle,
         host: opts.host,
         ...extra,
     });
+    // Mirror the invocation's IDENTITY into the durable store (RUSH-2549). The
+    // event above stays the audit record, but the event ledger is bounded and
+    // prunes at 7 days / 50 MiB (events.ts), so a run's history used to vanish on
+    // day 8. This row is metadata only -- no screenshots, no typed text -- and
+    // `action_count` accumulates across the many calls one invocation makes.
+    //
+    // Identity is read from this process's own env, exactly as stampProvenance()
+    // does for the event: `agents computer` runs IN the caller's process, so there
+    // is no shared daemon to mis-attribute it to (the browser problem).
+    //
+    // Guarded for the same reason `emit` above guards itself ("logging should
+    // never break the CLI", events.ts): this is a RECORD of the action, not the
+    // action. An unwritable or locked session DB must not stop `agents computer
+    // click` from clicking. The action still happened and its event still landed;
+    // only this row is missed, and the next call re-records the identity.
+    try {
+        recordComputerSession({
+            invocationId: COMPUTER_INVOCATION_ID,
+            sessionId: process.env.AGENT_SESSION_ID || process.env.AGENTS_SESSION_ID,
+            launchId: process.env.AGENT_LAUNCH_ID,
+            actor: resolveActor().id,
+            actionCount: 1,
+            taskPreview: typeof extra.task === 'string' ? extra.task : undefined,
+        });
+    }
+    catch {
+        // Recording is best-effort; the action and its event are already done.
+    }
 }
 // Add the shared --pid/--bundle/--host target options to a verb. `--host` routes
 // the verb at a remote Windows device: the `computer` preAction hook hydrates

package/dist/commands/computer-sessions-picker.d.ts

@@ -0,0 +1,21 @@
+import { type ComputerRunRow } from '../lib/computer/sessions-list.js';
+export interface ComputerSessionsCommandOpts {
+    machine?: string;
+    /** Row cap for the flat table only — the interactive picker is searchable
+     *  and shows every row regardless (see `runComputerSessions`). */
+    limit?: number;
+    json?: boolean;
+    /** Commander's `--no-interactive` convention: `false` opts out. */
+    interactive?: boolean;
+    /** Pre-collected fleet rows. Omitted for the local ledger path. */
+    rows?: ComputerRunRow[];
+}
+/** True when the interactive picker should open instead of the printed table:
+ *  a real TTY, no `--json`, and `--no-interactive` not set. */
+export declare function shouldOpenInteractiveComputerSessions(opts: ComputerSessionsCommandOpts, isTTY: boolean): boolean;
+/**
+ * Shared entry point for `agents computer sessions` and `agents sessions
+ * --computer`. Mirrors `runBrowserSessionsCommand`'s interactive-routing
+ * split so both call sites stay in lockstep.
+ */
+export declare function runComputerSessionsCommand(opts: ComputerSessionsCommandOpts): Promise<void>;