@phnx-labs/agents-cli 1.22.35 → 1.22.37

package/dist/commands/harness.js

@@ -16,6 +16,7 @@ import { isInteractiveTerminal } from './utils.js';
 import { listProfiles, readProfile, writeProfile, deleteProfile, profileExists, profileHostLabel, profileProviderLabel, profileModelLabel, profileAuthLabel, profileLabel, forkProfile, editProfile, renameProfile, profileFromHostModel, authEnvKeyForHost, modelEnvKeyForHost, baseUrlEnvKeyForHost, getProfilePath, validateProfileName, } from '../lib/profiles.js';
 import { listPresets, getPreset } from '../lib/profiles-presets.js';
 import { AGENTS, ALL_AGENT_IDS, resolveAgentName } from '../lib/agents.js';
+import { findAccount } from '../lib/account-registry.js';
 import { runWizardSteps, createSteps, editSteps, defaultWizardIO, } from './harness-wizard.js';
 /** Short capability summary for a native harness — its supported run modes. */
 function nativeModes(id) {
@@ -39,6 +40,8 @@ export function renderHarnessDetail(name) {
         console.log(`Fallback: ${p.fallback_model}`);
     console.log(`Provider: ${profileProviderLabel(p)}`);
     console.log(`Auth:     ${profileAuthLabel(p)}`);
+    if (p.account)
+        console.log(`Account:  ${findAccount(p.account)?.name ?? p.account}`);
     if (p.forkedFrom)
         console.log(`Forked:   from ${p.forkedFrom}`);
     console.log(chalk.gray(getProfilePath(p.name)));
@@ -54,14 +57,24 @@ export function renderHarnessDetail(name) {
  * copy a model from.
  */
 export function buildFork(source, name, opts) {
+    if (opts.authProvider || opts.fromSecrets)
+        throw new Error("Harnesses no longer own credentials. Add one with 'agents accounts add <name> --provider <provider> --auth <type>', then pass --account <name>.");
     if (profileExists(source)) {
-        return forkProfile(readProfile(source), name, {
+        const profile = forkProfile(readProfile(source), name, {
             model: opts.model,
             baseUrl: opts.baseUrl,
             provider: opts.authProvider,
             version: opts.version,
             description: opts.description,
         });
+        if (opts.account) {
+            const account = findAccount(opts.account);
+            if (!account)
+                throw new Error(`Unknown account '${opts.account}'.`);
+            profile.account = account.id;
+            profile.provider = account.provider;
+        }
+        return profile;
     }
     const host = resolveAgentName(source);
     if (!host) {
@@ -71,13 +84,21 @@ export function buildFork(source, name, opts) {
     if (!opts.model) {
         throw new Error(`--model <id> is required when forking the native '${host}' harness (there is no model to inherit).`);
     }
-    return profileFromHostModel(name, host, opts.model, {
+    const profile = profileFromHostModel(name, host, opts.model, {
         version: opts.version,
         baseUrl: opts.baseUrl,
         provider: opts.authProvider,
         authEnvVar: opts.authProvider ? authEnvKeyForHostOrThrow(host) : undefined,
         description: opts.description ?? `Forked from ${host}: ${opts.model}`,
     });
+    if (opts.account) {
+        const account = findAccount(opts.account);
+        if (!account)
+            throw new Error(`Unknown account '${opts.account}'.`);
+        profile.account = account.id;
+        profile.provider = account.provider;
+    }
+    return profile;
 }
 /** Auth env var for a host, as a hard error when the host declares none. */
 function authEnvKeyForHostOrThrow(host) {
@@ -111,6 +132,7 @@ export function hasEditFlags(opts) {
     return (opts.model !== undefined ||
         opts.baseUrl !== undefined ||
         opts.authProvider !== undefined ||
+        opts.account !== undefined ||
         opts.version !== undefined ||
         opts.description !== undefined ||
         opts.fallbackModel !== undefined ||
@@ -132,6 +154,15 @@ export function buildEdit(name, opts) {
     }
     const source = readProfile(name);
     const edited = editProfile(source, buildEditOverrides(opts));
+    if (opts.authProvider || opts.fromSecrets)
+        throw new Error("Harnesses no longer own credentials. Add one with 'agents accounts add <name> --provider <provider> --auth <type>', then pass --account <name>.");
+    if (opts.account !== undefined) {
+        const account = findAccount(opts.account);
+        if (!account)
+            throw new Error(`Unknown account '${opts.account}'.`);
+        edited.account = account.id;
+        edited.provider = account.provider;
+    }
     if (opts.version === '')
         delete edited.host.version;
     if (opts.fallbackModel !== undefined) {
@@ -210,8 +241,7 @@ async function runCreateWizard() {
         opts: {
             model: draft.model,
             baseUrl: draft.baseUrl,
-            authProvider: draft.authProvider,
-            fromSecrets: draft.fromSecrets,
+            account: draft.account,
         },
     };
 }
@@ -238,10 +268,8 @@ export function draftToEditOptions(draft, original) {
         opts.model = draft.model;
     if (draft.baseUrl && draft.baseUrl !== curBaseUrl)
         opts.baseUrl = draft.baseUrl;
-    if (draft.authProvider !== undefined)
-        opts.authProvider = draft.authProvider;
-    if (draft.fromSecrets !== undefined)
-        opts.fromSecrets = draft.fromSecrets;
+    if (draft.account !== undefined)
+        opts.account = draft.account;
     if (draft.version !== undefined && draft.version !== curVersion)
         opts.version = draft.version;
     if (draft.fallbackModel !== undefined && draft.fallbackModel !== curFallback)
@@ -300,7 +328,7 @@ Examples:
   agents run spark "refactor api/handlers/checkout.py"
 
   # Fork a native harness, or copy one of your own and swap the model
-  agents harness fork opencode deepseek --model deepseek/deepseek-v4-flash-0731 --auth-provider openrouter
+  agents harness fork opencode deepseek --model deepseek/deepseek-v4-flash-0731 --account openrouter-work
   agents harness fork deepseek deepseek-chat --model deepseek/deepseek-chat-v3
 
   # Per-run model override still wins
@@ -310,14 +338,14 @@ Examples:
   agents harness edit deepseek --fallback-model deepseek/deepseek-chat-v3
   agents harness rename deepseek deepseek-classic
 
-  # No args, in an interactive terminal: a wizard walks you through host, model, provider, key
+  # No args, in an interactive terminal: a wizard walks you through host, model, and account
   agents harness add
 
   # See custom harnesses, addable presets, and native harnesses
   agents harness list
 
-  # Private OpenAI/Anthropic-compatible endpoint (stores a keychain key)
-  agents harness add corp --host claude --model gpt-x --base-url https://gw.corp/v1 --auth-provider corp
+  # Private OpenAI/Anthropic-compatible endpoint using an existing account
+  agents harness add corp --host claude --model gpt-x --base-url https://gw.corp/v1 --account corp
 
   # Custom harnesses are just profiles — this also works via 'agents profiles'
 `);
@@ -327,14 +355,17 @@ Examples:
         .option('--host <agent>', 'Host CLI to run under (opencode, claude, codex, grok, antigravity, ...) — pair with --model')
         .option('--model <id>', 'Model id to pin on the host (e.g., meta/muse-spark-1.1) — pair with --host')
         .option('--base-url <url>', 'Custom endpoint base URL (claude/codex hosts)')
-        .option('--auth-provider <provider>', 'Attach a keychain-backed API key under this provider (for private endpoints)')
+        .option('--account <name>', 'Default durable credential account')
+        .option('--auth-provider <provider>', 'Removed: use agents accounts add, then --account')
         .option('--preset <preset>', 'Apply a built-in preset instead of --host/--model')
         .option('--version <version>', 'Pin the host CLI version (e.g., 1.16.0)')
-        .option('--from-secrets <bundle>[:<key>]', "Copy a value from an agents secrets bundle into this harness's own keychain item, once (not a live link)")
+        .option('--from-secrets <bundle>[:<key>]', 'Removed: import the value with agents accounts add, then use --account')
         .option('--key-stdin', 'Read API key from stdin instead of prompting (for scripts/CI)')
         .option('--force', 'Overwrite an existing harness with the same name')
         .action(async (name, opts) => {
         try {
+            if (opts.authProvider || opts.fromSecrets)
+                throw new Error("Harnesses no longer own credentials. Add one with 'agents accounts add <name> --provider <provider> --auth <type>', then pass --account <name>.");
             if (addNeedsWizard(name, opts)) {
                 if (!isInteractiveTerminal()) {
                     throw new Error("'agents harness add' needs --preset or --host + --model (or a name and an interactive terminal for the wizard).");
@@ -355,25 +386,26 @@ Examples:
         .description('Fork a native harness (claude, opencode, ...) or an existing custom one into a new named harness. Omit args in a terminal for the interactive wizard.')
         .option('--model <id>', 'Model to pin on the fork (required when forking a native harness)')
         .option('--base-url <url>', 'Custom endpoint base URL (claude/codex hosts)')
-        .option('--auth-provider <provider>', 'Attach a keychain-backed API key under this provider')
+        .option('--account <name>', 'Default durable credential account')
+        .option('--auth-provider <provider>', 'Removed: use agents accounts add, then --account')
         .option('--version <version>', 'Pin the host CLI version (e.g., 1.16.0)')
         .option('--description <text>', 'One-line description')
-        .option('--from-secrets <bundle>[:<key>]', "Copy a value from an agents secrets bundle into this harness's own keychain item, once (not a live link)")
+        .option('--from-secrets <bundle>[:<key>]', 'Removed: import the value with agents accounts add, then use --account')
         .option('--key-stdin', 'Read the API key from stdin instead of prompting (for scripts/CI)')
         .option('--force', 'Overwrite an existing harness with the same name')
         .addHelpText('after', `
 Examples:
   # Fork OpenCode into a harness pinned to a DeepSeek model on OpenRouter
-  agents harness fork opencode deepseek --model deepseek/deepseek-v4-flash-0731 --auth-provider openrouter
+  agents harness fork opencode deepseek --model deepseek/deepseek-v4-flash-0731 --account openrouter-work
 
   # Fork Claude Code onto a private gateway
-  agents harness fork claude corp --model gpt-x --base-url https://gw.corp/v1 --auth-provider corp
+  agents harness fork claude corp --model gpt-x --base-url https://gw.corp/v1 --account corp
 
   # Copy an existing harness and swap only the model
   agents harness fork deepseek deepseek-chat --model deepseek/deepseek-chat-v3
 
-  # Copy a key out of an existing secrets bundle instead of typing it
-  agents harness fork claude corp --model gpt-x --auth-provider corp --from-secrets prod:OPENROUTER_KEY
+  # Attach an account whose credential came from agents secrets
+  agents harness fork claude corp --model gpt-x --account corp
 
   # No args, in an interactive terminal: walks through source, preset/model, name, key
   agents harness fork
@@ -400,19 +432,20 @@ Examples:
         .description('Edit an existing custom harness in place — model, endpoint, auth, version, description, fallback. Omit flags in a terminal for the interactive wizard.')
         .option('--model <id>', 'Swap the pinned model')
         .option('--base-url <url>', 'Swap the custom endpoint base URL')
-        .option('--auth-provider <provider>', 'Repoint auth at a different provider (keychain-backed)')
+        .option('--account <name>', 'Change the default durable credential account')
+        .option('--auth-provider <provider>', 'Removed: use agents accounts add, then --account')
         .option('--version <version>', 'Re-pin the host CLI version (pass an empty string to unpin)')
         .option('--description <text>', 'Update the one-line description')
         .option('--fallback-model <id>', 'Secondary model retried on the same host on a rate limit (pass an empty string to clear it)')
-        .option('--from-secrets <bundle>[:<key>]', "Copy a value from an agents secrets bundle into this harness's own keychain item, once (not a live link)")
+        .option('--from-secrets <bundle>[:<key>]', 'Removed: import the value with agents accounts add, then use --account')
         .option('--key-stdin', 'Read the API key from stdin instead of prompting (for scripts/CI)')
         .addHelpText('after', `
 Examples:
   # Swap the pinned model
   agents harness edit deepseek --model deepseek/deepseek-v3.2
 
-  # Repoint auth at a different provider and re-enter the key
-  agents harness edit corp --auth-provider corp2
+  # Repoint auth at a different durable account
+  agents harness edit corp --account corp2
 
   # Unpin the host CLI version
   agents harness edit spark --version ""
@@ -420,8 +453,8 @@ Examples:
   # Add a same-host fallback model for rate-limit retries
   agents harness edit deepseek --fallback-model deepseek/deepseek-chat-v3
 
-  # Copy a key out of an existing secrets bundle instead of typing it
-  agents harness edit corp --from-secrets prod:OPENROUTER_KEY
+  # Rotate the attached credential without editing the harness
+  agents accounts set-key corp2 --from-secrets prod:OPENROUTER_KEY
 
   # No flags, in an interactive terminal: a wizard walks each field pre-filled
   agents harness edit deepseek

package/dist/commands/hooks.js

@@ -517,17 +517,6 @@ Examples:
             console.log(chalk.gray('Central source unchanged. Hooks will re-sync on next agent launch.'));
         }
     });
-    // `hooks sync` is gone — sync runs automatically when the agent launches.
-    hooksCmd
-        .command('sync', { hidden: true })
-        .allowUnknownOption()
-        .allowExcessArguments()
-        .action(() => {
-        console.error(chalk.red('"agents hooks sync" is gone.'));
-        console.error(chalk.gray('Sync runs automatically when you launch the agent.'));
-        console.error(chalk.gray('To remove orphans, use:  agents prune cleanup hooks'));
-        process.exit(1);
-    });
     // `hooks prune` moved to the top-level `agents prune cleanup` command.
     hooksCmd
         .command('prune', { hidden: true })

package/dist/commands/inspect.d.ts

@@ -15,8 +15,9 @@ import { Command } from 'commander';
 import type { ManifestHook } from '../lib/types.js';
 import { type McpYamlConfig } from '../lib/mcp.js';
 import { type PluginResourceGroup } from '../lib/plugins.js';
+import { type JobConfig, type RunMeta } from '../lib/routines.js';
 /** Resource kinds the inspect command can drill into. */
-declare const DRILLABLE_KINDS: readonly ["commands", "skills", "hooks", "mcp", "rules", "plugins", "workflows", "subagents"];
+declare const DRILLABLE_KINDS: readonly ["commands", "skills", "hooks", "mcp", "rules", "plugins", "workflows", "subagents", "routines"];
 type DrillableKind = typeof DRILLABLE_KINDS[number];
 /** Wrap a separator-joined value list under `prefix`, preserving a hanging indent. */
 export declare function wrapJoined(prefix: string, items: string[], sep: string, width: number): string[];
@@ -33,6 +34,11 @@ interface ResourceItem {
     extra?: Array<[string, string]>;
     /** For plugins: the resource categories (skills, commands, …) the bundle packages. */
     groups?: PluginResourceGroup[];
+    /**
+     * Machine-shaped fields for `--json`, when the display strings in `extra` would
+     * lose information a script needs (a routine's raw cron, its device arrays).
+     */
+    json?: Record<string, unknown>;
 }
 export interface InspectOptions {
     brief?: boolean;
@@ -45,6 +51,7 @@ export interface InspectOptions {
     plugins?: boolean | string;
     workflows?: boolean | string;
     subagents?: boolean | string;
+    routines?: boolean | string;
     command?: string;
     skill?: string;
     hook?: string;
@@ -52,6 +59,7 @@ export interface InspectOptions {
     plugin?: string;
     workflow?: string;
     subagent?: string;
+    routine?: string;
 }
 export declare function registerInspectCommand(program: Command): void;
 export declare function inspectAction(target: string, options: InspectOptions): Promise<void>;
@@ -71,6 +79,55 @@ export declare function resolveRepoTarget(target: string, cwd?: string): RepoTar
 export declare function inspectRepo(repo: RepoTarget, options: InspectOptions): Promise<void>;
 /** List one resource kind from a single repo root — no layering, no overrides. */
 export declare function collectRepoKind(repo: RepoTarget, kind: DrillableKind): ResourceItem[];
+/** The live answers about one routine — what the YAML alone cannot say. */
+export interface RoutineLiveState {
+    /** Devices whose `routines:` allowlist names it. Empty means it fires nowhere. */
+    devices: string[];
+    /** False until some device has materialized an allowlist at all. */
+    materialized: boolean;
+    /** This machine's name, for reporting whether the routine is enabled here. */
+    thisDevice: string;
+    /**
+     * THIS machine's activation answer, from `routineEnabledOnThisDevice` — the
+     * same call `applyDeviceActivation` makes. `null` means this device has not
+     * materialized its own allowlist, so the file's `enabled:` still governs.
+     *
+     * Deliberately separate from `materialized`, which is fleet-wide: a box whose
+     * own device doc has no `routines:` key while a synced peer's does is the
+     * normal state of a freshly-joined machine, and conflating the two reported
+     * `enabled: no` for routines the daemon was actively firing.
+     */
+    enabledHere: boolean | null;
+    /** Last run's status, or null if it has never run on a device we can see. */
+    lastStatus: RunMeta['status'] | null;
+    /** ISO timestamp of that run's start. */
+    lastAt: string | null;
+}
+/** `2h` / `3d` / `just now` — compact enough for a 10-column cell. */
+export declare function compactAge(iso: string | null, now?: Date): string;
+/** What makes this routine fire: a humanized cron, an event trigger, or nothing. */
+export declare function routineFireLabel(job: JobConfig, now?: Date): string;
+/** What the routine actually executes. Exactly one of agent/workflow/command is set. */
+export declare function routineTargetLabel(job: JobConfig): string;
+/**
+ * A routine's one-line intent.
+ *
+ * Routine YAML has no `description:` key, so the generic first-prose-line reader
+ * returns `name: growth-metrics` for one file and a real sentence for the next.
+ * Prefer the prompt's first sentence, then the file's leading comment block, then
+ * the first meaningful line of a shell command.
+ */
+export declare function routineDescription(job: JobConfig | null, raw: string): string;
+/**
+ * Read every routine one DotAgents repo declares.
+ *
+ * Reads exactly `<root>/routines/`, never the layered `listJobs` — `collectRepoKind`
+ * is a single-root view, and returning `~/.agents` routines while inspecting a
+ * project repo would be a lie. `live` is injectable because `getUserAgentsDir()`
+ * and `getRunsDir()` have no env override, so tests cannot otherwise keep this
+ * off the developer's real fleet state.
+ */
+export declare function collectRepoRoutines(repo: RepoTarget, live?: (name: string) => RoutineLiveState, now?: Date): ResourceItem[];
 /** Recursive size + file count of a path; symlinks are not followed. */
 export declare function pathSize(p: string): {
     bytes: number;
@@ -106,6 +163,24 @@ export interface RepoGitInfo {
     behind: number | null;
 }
 export declare function repoGitInfo(root: string): RepoGitInfo | null;
+/**
+ * The scannable half of a description: everything before the trigger clause, and
+ * only the first sentence of that. 15 of 20 skills in .system lead with their
+ * purpose and then append "Triggers on: …" — in a one-line row that boilerplate
+ * is what survives truncation, so the row says nothing. The full text still
+ * renders in the preview pane.
+ */
+export declare function summaryLine(description: string): string;
+/**
+ * The preview pane for one row, refreshed as the selection moves.
+ *
+ * Adaptive on purpose — the sessions picker sets the precedent: a Cursor
+ * session shows Dirs/Repos/Artifacts, a Codex one shows a different set, and
+ * empty fields simply do not render. A hook's useful metadata (what fires it,
+ * whether it is wired) has nothing in common with a skill's (what invokes it,
+ * where it is synced), so each kind contributes its own rows and blanks drop out.
+ */
+export declare function previewFor(kind: DrillableKind, item: ResourceItem, hookManifest: Map<string, ManifestHook>): string;
 /**
  * Compact one-liner for a hook from its manifest entry: the firing events (with
  * the matcher/tool-name in parens), then a `·`-separated predicate summary, then
@@ -121,4 +196,22 @@ export declare function summarizeMcp(cfg: McpYamlConfig): string;
  * script basename, not the manifest key.
  */
 export declare function hookManifestByScript(manifest: Record<string, ManifestHook>): Map<string, ManifestHook>;
+/**
+ * Health tier for the section ordering. Lower sorts first.
+ *
+ * `printExpandedSection` shows only the first handful before a `…(+N)` tail, so
+ * for a repo with 24 routines the sort IS the section. Same reasoning as
+ * `hookRows` putting wired hooks first: a routine that fires nowhere is exactly
+ * what the reader opened this for, and must never hide behind the tail.
+ */
+export declare function routineHealthTier(item: ResourceItem): number;
+/**
+ * The one-line warning under the Routines section, or null when it would mislead.
+ *
+ * Silent until some device has materialized a `routines:` list — before that,
+ * every routine is legitimately unpinned and "will not fire" would be noise.
+ */
+export declare function routineDarkWarning(items: ResourceItem[]): string | null;
+/** Read a repo/agents.yaml `hooks:` section into a name→ManifestHook map (best-effort). */
+export declare function hookManifestFromFile(agentsYamlPath: string): Record<string, ManifestHook>;
 export {};