@phnx-labs/agents-cli 1.22.38 → 1.22.40

package/dist/commands/permissions.js

@@ -8,8 +8,8 @@ import { confirm, checkbox } from '@inquirer/prompts';
 import { AGENTS, resolveAgentName, formatAgentError, agentLabel, } from '../lib/agents.js';
 import { cloneRepo } from '../lib/git.js';
 import { capableAgents, isCapable } from '../lib/capabilities.js';
-import { listInstalledPermissions, discoverPermissionsFromRepo, installPermissionSet, removePermissionSet, applyPermissionsToVersion, readAgentPermissions, exportPermissionsFromPath, getDefaultPermissionSet, computePermissionsDiff, mergePermissionSets, saveDefaultPermissionSet, containsBroadGrants, } from '../lib/permissions.js';
-import { listInstalledVersions, getGlobalDefault, getVersionHomePath, promptAgentVersionSelection, } from '../lib/versions.js';
+import { listInstalledPermissions, discoverPermissionsFromRepo, installPermissionSet, removePermissionSet, applyPermissionsToVersion, readAgentPermissions, exportPermissionsFromPath, detectPermissionAgentFromPath, getDefaultPermissionSet, computePermissionsDiff, mergePermissionSets, saveDefaultPermissionSet, containsBroadGrants, } from '../lib/permissions.js';
+import { listInstalledVersions, getGlobalDefault, getVersionHomePath, promptAgentVersionSelection, } from '../lib/installations/versions.js';
 import { recordVersionResources } from '../lib/state.js';
 import { isPromptCancelled, isInteractiveTerminal, parseCommaSeparatedList, printWithPager, requireInteractiveSelection, resolveAgentTargetsAutoInstalling, resolveListFilterOrExit, } from './utils.js';
 export function shouldRefuseBroadPermissions(permissions, allowBroadPermissions) {
@@ -51,17 +51,17 @@ When to use:
         .action(async (agentArg, options) => {
         const cwd = process.cwd();
         // Helper to render permissions for a specific version
-        const renderVersionPermissions = (agentId, version, isDefault, home, scope) => {
-            const agent = AGENTS[agentId];
-            const defaultLabel = isDefault ? ' default' : '';
-            const versionStr = chalk.gray(` (${version}${defaultLabel})`);
-            const perms = readAgentPermissions(agentId, scope, cwd, { home });
-            if (!perms) {
-                console.log(`  ${chalk.bold(agentLabel(agent.id))}${versionStr}: ${chalk.gray('none')}`);
-                console.log();
-                return;
-            }
-            console.log(`  ${chalk.bold(agentLabel(agent.id))}${versionStr}:`);
+        /**
+         * Print one harness's permission block.
+         *
+         * claude/opencode/codex keep their native renderings (Codex in particular
+         * has no rule list — showing its sandbox mode is more useful than the
+         * blanket grants that mode widens into). Every other allowlist-capable
+         * harness renders the canonical allow/deny that `PERMISSION_TARGETS` reads
+         * back, which is what makes `permissions list` answer for all 13 rather
+         * than three (RUSH-2676).
+         */
+        const renderPermissionBody = (agentId, perms) => {
             if (agentId === 'claude') {
                 const claudePerms = perms;
                 if (claudePerms.permissions.allow.length > 0) {
@@ -106,8 +106,34 @@ When to use:
                     }
                 }
             }
+            else {
+                const set = perms;
+                if (set.allow?.length) {
+                    console.log(chalk.green('    Allow:'));
+                    for (const p of set.allow)
+                        console.log(`      ${chalk.cyan(p)}`);
+                }
+                if (set.deny?.length) {
+                    console.log(chalk.red('    Deny:'));
+                    for (const p of set.deny)
+                        console.log(`      ${chalk.yellow(p)}`);
+                }
+            }
             console.log();
         };
+        const renderVersionPermissions = (agentId, version, isDefault, home, scope) => {
+            const agent = AGENTS[agentId];
+            const defaultLabel = isDefault ? ' default' : '';
+            const versionStr = chalk.gray(` (${version}${defaultLabel})`);
+            const perms = readAgentPermissions(agentId, scope, cwd, { home });
+            if (!perms) {
+                console.log(`  ${chalk.bold(agentLabel(agent.id))}${versionStr}: ${chalk.gray('none')}`);
+                console.log();
+                return;
+            }
+            console.log(`  ${chalk.bold(agentLabel(agent.id))}${versionStr}:`);
+            renderPermissionBody(agentId, perms);
+        };
         if (agentArg) {
             // Parse agent@version syntax
             const parts = agentArg.split('@');
@@ -134,21 +160,7 @@ When to use:
                     return;
                 }
                 console.log(`  ${chalk.bold(agentLabel(agent.id))}:`);
-                if (agentId === 'claude') {
-                    const claudePerms = perms;
-                    if (claudePerms.permissions.allow.length > 0) {
-                        console.log(chalk.green('    Allow:'));
-                        for (const p of claudePerms.permissions.allow) {
-                            console.log(`      ${chalk.cyan(p)}`);
-                        }
-                    }
-                    if (claudePerms.permissions.deny.length > 0) {
-                        console.log(chalk.red('    Deny:'));
-                        for (const p of claudePerms.permissions.deny) {
-                            console.log(`      ${chalk.yellow(p)}`);
-                        }
-                    }
-                }
+                renderPermissionBody(agentId, perms);
                 return;
             }
             // Version-managed: determine which versions to show
@@ -361,10 +373,15 @@ Examples:
                 }
                 spinner.succeed('Using local path');
             }
-            // Check if this is an agent config file
-            const isAgentConfig = localPath.endsWith('.json') || localPath.endsWith('.jsonc') || localPath.endsWith('.toml');
-            const looksLikeAgentConfig = localPath.includes('.claude') || localPath.includes('.opencode') || localPath.includes('.codex');
-            if (isAgentConfig && looksLikeAgentConfig) {
+            // Is this a harness config agents-cli knows how to read?
+            //
+            // This used to hardcode `.json`/`.jsonc`/`.toml` plus a `.claude`/
+            // `.opencode`/`.codex` substring, which excluded the ten other harnesses
+            // the CLI writes -- and excluded kiro/hermes twice over, since
+            // their configs are YAML. The registry already answers this by matching
+            // each harness's own declared path, so ask it (RUSH-2676).
+            const isAgentConfig = detectPermissionAgentFromPath(localPath) !== null;
+            if (isAgentConfig) {
                 // Handle agent config file - convert, diff, merge into default set
                 const incoming = exportPermissionsFromPath(localPath);
                 if (!incoming || (incoming.allow.length === 0 && (!incoming.deny || incoming.deny.length === 0))) {

package/dist/commands/plugins.d.ts

@@ -6,7 +6,7 @@
  * stored in ~/.agents/plugins/.
  */
 import type { Command } from 'commander';
-import { type PluginCapabilities } from '../lib/plugins.js';
+import { type PluginCapabilities } from '../lib/plugins/plugins.js';
 export declare function shouldRefusePluginInstall(capabilities: PluginCapabilities, allowExecSurfaces: boolean): boolean;
 /** Register the `agents plugins` command tree. */
 export declare function registerPluginsCommands(program: Command): void;

package/dist/commands/plugins.js

@@ -12,14 +12,14 @@ import { homeDir } from '../lib/platform/index.js';
 import { input } from '@inquirer/prompts';
 import { agentLabel } from '../lib/agents.js';
 import { capableAgents, isCapable } from '../lib/capabilities.js';
-import { discoverPlugins, getPlugin, pluginSupportsAgent, removePluginFromVersion, isPluginSynced, installPlugin, updatePlugin, loadUserConfig, saveUserConfig, checkPluginDependencies, hasPluginExecSurfaces, inspectPluginCapabilities, pluginCapabilityLabels, parseInstallSpec, syncPluginToVersion, pluginResourceGroups, } from '../lib/plugins.js';
-import { listInstalledVersions, syncResourcesToVersion, getGlobalDefault, getVersionHomePath, } from '../lib/versions.js';
+import { discoverPlugins, getPlugin, pluginSupportsAgent, removePluginFromVersion, isPluginSynced, installPlugin, updatePlugin, loadUserConfig, saveUserConfig, checkPluginDependencies, hasPluginExecSurfaces, inspectPluginCapabilities, pluginCapabilityLabels, parseInstallSpec, syncPluginToVersion, pluginResourceGroups, } from '../lib/plugins/plugins.js';
+import { listInstalledVersions, syncResourcesToVersion, getGlobalDefault, getVersionHomePath, } from '../lib/installations/versions.js';
 import { isPromptCancelled, isInteractiveTerminal, requireDestructiveArg, requireInteractiveSelection, promptRemovalTargets, } from './utils.js';
 import { itemPicker } from '../lib/picker.js';
 import { showResourceList, buildTargetsSection, } from './resource-view.js';
 import { getPluginsDir } from '../lib/state.js';
 import { safeJoin } from '../lib/paths.js';
-import { discoverMarketplaces } from '../lib/plugin-marketplace.js';
+import { discoverMarketplaces } from '../lib/plugins/plugin-marketplace.js';
 /** Replace the home directory prefix with ~ for display. */
 function formatPath(p) {
     const home = homeDir();

package/dist/commands/profiles.d.ts

@@ -1,12 +1,11 @@
 /**
- * Profile management commands.
+ * Custom-harness profile helpers (shared by `agents harness`).
  *
- * Registers the `agents profiles` command tree for creating, viewing,
- * and removing named bundles of (host CLI, endpoint, model, keychain auth).
- * Profiles let users run non-default providers (Kimi, DeepSeek, Qwen, etc.)
- * through a standard agent CLI with no local proxy.
+ * Named bundles of (host CLI, endpoint, model, keychain auth) live under
+ * ~/.agents/profiles/*.yml. The user-facing surface is `agents harness`
+ * (add/fork/edit/list/view/remove). This module keeps the shared write helpers
+ * (`addProfile`, `ensureProviderToken`, …) that harness and the run path use.
  */
-import type { Command } from 'commander';
 import { type Profile } from '../lib/profiles.js';
 import { type Preset } from '../lib/profiles-presets.js';
 /**
@@ -18,7 +17,7 @@ export declare function buildProfileFromCollection(name: string, preset: Preset,
 /** Read all available data from stdin synchronously, trimmed. */
 /** Ensure a provider API key exists in keychain, prompting or reading stdin if missing. */
 export declare function ensureProviderToken(provider: string, signupUrl?: string, fromStdin?: boolean): Promise<void>;
-/** Options accepted by {@link addProfile} — shared by `agents profiles add` and `agents harness add`. */
+/** Options accepted by {@link addProfile} — shared by `agents harness add` and `agents harness add`. */
 export interface AddProfileOptions {
     preset?: string;
     host?: string;
@@ -81,5 +80,3 @@ export declare function applyFromSecrets(profile: Profile, spec: string, explici
  * `label` only tunes the success wording (Profile vs Harness). Throws on error.
  */
 export declare function addProfile(name: string, opts: AddProfileOptions, label?: 'Profile' | 'Harness'): Promise<void>;
-/** Register the `agents profiles` command tree. */
-export declare function registerProfilesCommands(program: Command): void;

package/dist/commands/profiles.js

@@ -1,21 +1,19 @@
 /**
- * Profile management commands.
+ * Custom-harness profile helpers (shared by `agents harness`).
  *
- * Registers the `agents profiles` command tree for creating, viewing,
- * and removing named bundles of (host CLI, endpoint, model, keychain auth).
- * Profiles let users run non-default providers (Kimi, DeepSeek, Qwen, etc.)
- * through a standard agent CLI with no local proxy.
+ * Named bundles of (host CLI, endpoint, model, keychain auth) live under
+ * ~/.agents/profiles/*.yml. The user-facing surface is `agents harness`
+ * (add/fork/edit/list/view/remove). This module keeps the shared write helpers
+ * (`addProfile`, `ensureProviderToken`, …) that harness and the run path use.
  */
 import chalk from 'chalk';
 import { readStdinSync } from '../lib/format.js';
-import { spawn } from 'child_process';
-import { listProfiles, readProfile, writeProfile, deleteProfile, profileExists, profileFromPreset, profileFromHostModel, baseUrlEnvKeyForHost, authEnvKeyForHost, validateProfileName, getPresetForProfile, } from '../lib/profiles.js';
-import { getPreset, listPresets, expandPreset } from '../lib/profiles-presets.js';
-import { hasKeychainToken, keychainItemName, setKeychainToken, deleteKeychainToken, getKeychainToken, } from '../lib/secrets/profiles.js';
+import { writeProfile, profileFromPreset, profileFromHostModel, baseUrlEnvKeyForHost, authEnvKeyForHost, validateProfileName, profileExists, } from '../lib/profiles.js';
+import { getPreset, listPresets } from '../lib/profiles-presets.js';
+import { hasKeychainToken, keychainItemName, setKeychainToken, getKeychainToken, } from '../lib/secrets/profiles.js';
 import { parseBundleValue, secretsKeychainItem } from '../lib/secrets/index.js';
 import { readBundle } from '../lib/secrets/bundles.js';
 import { isInteractiveTerminal } from './utils.js';
-import { getAgentsInvocation } from '../lib/daemon.js';
 import { ALL_AGENT_IDS } from '../lib/agents.js';
 import { findAccount } from '../lib/account-registry.js';
 /**
@@ -224,314 +222,3 @@ export async function addProfile(name, opts, label = 'Profile') {
     console.log(chalk.green(`${label} '${name}' added.`));
     console.log(chalk.gray(`Try: agents run ${name} "hello"`));
 }
-/** Format a single profile as a table row for the `profiles list` output. */
-function renderProfileRow(p) {
-    const host = p.host.version ? `${p.host.agent}@${p.host.version}` : p.host.agent;
-    const model = p.env.ANTHROPIC_MODEL || p.env.OPENAI_MODEL || p.env.GEMINI_MODEL || '-';
-    const provider = p.provider || (p.auth?.keychainItem?.split('.')[1]) || '-';
-    return `${chalk.cyan(p.name.padEnd(16))} ${host.padEnd(14)} ${provider.padEnd(12)} ${chalk.gray(model)}`;
-}
-/** Register the `agents profiles` command tree. */
-export function registerProfilesCommands(program) {
-    const cmd = program
-        .command('profiles')
-        .description('Named bundles of (host CLI, endpoint, model, auth) — run Kimi/DeepSeek/Qwen/etc through Claude Code without a proxy.')
-        .addHelpText('after', `
-A profile pins a host CLI (claude, codex, antigravity, ...) to a non-default endpoint
-and model, with a keychain-backed API key. Running 'agents run <profile>' spawns
-the host CLI with the right env vars — no plaintext tokens, no local proxy.
-
-Built-in presets (via OpenRouter, one shared key):
-  kimi       Kimi K2.5           (top HumanEval, reasoning — interactive only)
-  kimi-chat  Kimi K2 0905        (non-reasoning, print-safe)
-  minimax    MiniMax M2.5        (top SWE-bench, reasoning)
-  glm        GLM 5               (top Chatbot Arena among open-weight, reasoning)
-  qwen       Qwen3 Coder Next    (latest coding Qwen, print-safe)
-  deepseek   DeepSeek Chat V3    (latest non-reasoning chat, print-safe)
-
-Run 'agents profiles presets' for the full list with pricing and context sizes.
-
-Typical flow:
-  agents profiles create               # interactive wizard for any provider
-  agents profiles add kimi             # one-line preset (existing)
-  agents run kimi "refactor this"      # Claude Code UI, Kimi model responses
-  agents profiles add deepseek         # reuses OpenRouter key, no re-prompt
-
-Managing keys:
-  agents profiles login openrouter     # rotate the key (shared across openrouter profiles)
-  agents profiles logout openrouter    # remove from Keychain
-
-Custom endpoints — drop a YAML file at ~/.agents/profiles/<name>.yml:
-  name: local-llama
-  host: { agent: claude }
-  env:
-    ANTHROPIC_BASE_URL: http://localhost:11434
-    ANTHROPIC_MODEL: llama-3.3-70b
-  auth:
-    envVar: ANTHROPIC_AUTH_TOKEN
-    keychainItem: agents-cli.ollama.token
-
-Profiles store no secrets — safe to 'agents push' to a shared repo.
-
-Examples:
-  # One-time: store the OpenRouter key (every preset reuses it)
-  agents profiles login openrouter
-
-  # Add Kimi (top HumanEval) and run it through the Claude Code UI
-  agents profiles add kimi
-  agents run kimi "refactor api/handlers/checkout.py to use async sqlalchemy"
-
-  # Add MiniMax for SWE-bench style fixes; reuses the same OpenRouter key
-  agents profiles add minimax
-  agents run minimax "investigate PROJ-456 and patch the off-by-one in pagination"
-
-  # Add DeepSeek for cheap, fast non-reasoning work
-  agents profiles add deepseek
-  agents run deepseek "rename UserSession -> AuthSession across the codebase"
-
-  # See every profile and which provider it talks to
-  agents profiles list
-
-  # Browse the catalog (pricing, context sizes, reasoning vs print-safe)
-  agents profiles presets
-
-  # Rotate the OpenRouter key (every openrouter profile picks it up)
-  agents profiles login openrouter
-
-  # Drop a profile, keep the key in Keychain for the next one
-  agents profiles remove kimi
-
-  # Fully remove the OpenRouter key from Keychain
-  agents profiles logout openrouter
-`);
-    cmd
-        .command('list')
-        .alias('ls')
-        .description('List configured profiles')
-        .action(() => {
-        const profiles = listProfiles();
-        if (profiles.length === 0) {
-            console.log(chalk.gray('No profiles configured.'));
-            console.log(chalk.gray('Try: agents profiles add kimi'));
-            console.log(chalk.gray('     agents profiles presets'));
-            return;
-        }
-        console.log(chalk.bold(`${'NAME'.padEnd(16)} ${'HOST'.padEnd(14)} ${'PROVIDER'.padEnd(12)} MODEL`));
-        for (const p of profiles) {
-            console.log(renderProfileRow(p));
-        }
-    });
-    cmd
-        .command('presets')
-        .description('List built-in presets (OpenRouter + direct providers)')
-        .action(() => {
-        const presets = listPresets();
-        console.log(chalk.bold(`${'NAME'.padEnd(14)} ${'PROVIDER'.padEnd(12)} DESCRIPTION`));
-        for (const p of presets) {
-            console.log(`${chalk.cyan(p.name.padEnd(14))} ${p.provider.padEnd(12)} ${chalk.gray(p.description)}`);
-        }
-    });
-    cmd
-        .command('view <name>')
-        .alias('show')
-        .description('Show a profile (env, host, auth source, preset link)')
-        .action((name) => {
-        try {
-            const p = readProfile(name);
-            console.log(chalk.bold(p.name));
-            if (p.description)
-                console.log(chalk.gray(p.description));
-            console.log();
-            console.log(chalk.bold('Host:'), p.host.agent + (p.host.version ? `@${p.host.version}` : ''));
-            if (p.provider)
-                console.log(chalk.bold('Provider:'), p.provider);
-            if (p.preset)
-                console.log(chalk.bold('Preset:'), p.preset);
-            console.log();
-            console.log(chalk.bold('Env:'));
-            for (const [k, v] of Object.entries(p.env)) {
-                console.log(`  ${k}=${v}`);
-            }
-            if (p.auth) {
-                console.log();
-                console.log(chalk.bold('Auth:'));
-                const tokenStatus = hasKeychainToken(p.auth.keychainItem) ? chalk.green('stored') : chalk.red('missing');
-                console.log(`  ${p.auth.envVar} <- keychain:${p.auth.keychainItem} (${tokenStatus})`);
-            }
-            const preset = getPresetForProfile(p);
-            if (preset?.signupUrl) {
-                console.log();
-                console.log(chalk.gray(`Sign up: ${preset.signupUrl}`));
-            }
-        }
-        catch (err) {
-            console.error(chalk.red(err.message));
-            process.exit(1);
-        }
-    });
-    cmd
-        .command('create')
-        .description('Interactive profile creation wizard (any provider, with prompts for endpoints + keys).')
-        .option('--name <name>', 'Profile name (skips the name prompt)')
-        .option('--provider <provider>', 'Provider preset name (skips the provider prompt)')
-        .option('--no-smoke-test', 'Skip the post-create smoke test prompt')
-        .action(async (opts) => {
-        if (!isInteractiveTerminal()) {
-            console.error(chalk.red('agents profiles create requires an interactive terminal. Use `agents profiles add <preset>` for scriptable creation.'));
-            process.exit(1);
-        }
-        const { input, select, confirm } = await import('@inquirer/prompts');
-        const name = opts.name
-            ? opts.name
-            : await input({
-                message: 'Profile name',
-                validate: (v) => /^[a-z0-9][a-z0-9-_]{0,48}$/i.test(v) || 'lowercase alphanumeric + -_ only, max 48 chars',
-            });
-        validateProfileName(name);
-        if (profileExists(name)) {
-            const overwrite = await confirm({
-                message: `Profile '${name}' already exists. Overwrite?`,
-                default: false,
-            });
-            if (!overwrite) {
-                console.log(chalk.gray('Cancelled.'));
-                return;
-            }
-        }
-        const presets = listPresets();
-        const providerName = opts.provider
-            ? opts.provider
-            : await select({
-                message: 'Provider',
-                choices: presets.map((p) => ({
-                    name: `${p.name.padEnd(18)} ${chalk.gray(p.description.slice(0, 70))}`,
-                    value: p.name,
-                })),
-            });
-        const preset = getPreset(providerName);
-        if (!preset) {
-            console.error(chalk.red(`Unknown provider '${providerName}'. Run 'agents profiles presets' for the list.`));
-            process.exit(1);
-        }
-        const expanded = expandPreset(preset);
-        const collected = {};
-        for (const v of expanded.prompts) {
-            if (v.secret) {
-                collected[v.envVar] = await promptForSecret(v.prompt);
-            }
-            else {
-                const value = await input({
-                    message: v.hint ? `${v.prompt}  ${chalk.gray('(' + v.hint + ')')}` : v.prompt,
-                    default: v.default,
-                    validate: v.pattern
-                        ? (val) => new RegExp(v.pattern).test(val) || `must match ${v.pattern}`
-                        : undefined,
-                });
-                collected[v.envVar] = value;
-            }
-        }
-        if (!preset.authOptional) {
-            await ensureProviderToken(preset.provider, preset.signupUrl);
-        }
-        const profile = buildProfileFromCollection(name, preset, collected);
-        writeProfile(profile);
-        console.log(chalk.green(`Profile '${name}' created.`));
-        if (preset.docPath) {
-            console.log(chalk.gray(`See docs/profiles/${preset.docPath}.md for provider-specific caveats.`));
-        }
-        if (opts.smokeTest !== false) {
-            const run = await confirm({ message: 'Run smoke test now?', default: true });
-            if (run) {
-                console.log(chalk.gray(`Spawning: agents run ${name} "say alive in one word" (60s timeout)`));
-                const inv = getAgentsInvocation([
-                    'run',
-                    name,
-                    'say alive in one word',
-                    '--headless',
-                    '--timeout',
-                    '60s',
-                ]);
-                const child = spawn(inv.command, inv.args, { stdio: 'inherit' });
-                child.on('exit', (code) => process.exit(code ?? 0));
-            }
-            else {
-                console.log(chalk.gray(`Try later: agents run ${name} "hello"`));
-            }
-        }
-    });
-    cmd
-        .command('add <name>')
-        .description('Add a profile. If <name> matches a built-in preset, the preset is applied. Prompts for API key (once per provider).')
-        .option('--preset <preset>', 'Use a named preset (defaults to <name> if a preset by that name exists)')
-        .option('--version <version>', 'Pin the host CLI version (e.g., 2.1.113)')
-        .option('--account <name>', 'Attach an existing durable credential account')
-        .option('--key-stdin', 'Read API key from stdin instead of prompting (for scripts/CI)')
-        .option('--force', 'Overwrite an existing profile with the same name')
-        .addHelpText('after', '\nTo build a custom harness from a host CLI + model in one shot, use `agents harness add`.\n')
-        .action(async (name, opts) => {
-        // Preset-only surface here — `--host` on `profiles` is reserved for remote
-        // device routing (see lib/hosts/passthrough.ts). The host+model one-shot
-        // lives on `agents harness add`, which owns its own `--host`.
-        try {
-            await addProfile(name, { preset: opts.preset, version: opts.version, account: opts.account, keyStdin: opts.keyStdin, force: opts.force }, 'Profile');
-        }
-        catch (err) {
-            console.error(chalk.red(err.message));
-            process.exit(1);
-        }
-    });
-    cmd
-        .command('remove <name>')
-        .alias('rm')
-        .description('Delete a profile (keychain token is kept — use `profiles logout <provider>` to remove)')
-        .action((name) => {
-        const existed = deleteProfile(name);
-        if (!existed) {
-            console.error(chalk.red(`Profile '${name}' not found.`));
-            process.exit(1);
-        }
-        console.log(chalk.green(`Profile '${name}' removed.`));
-    });
-    cmd
-        .command('login <provider>')
-        .description('Store or rotate the API key for a provider (e.g., openrouter). Shared across profiles using that provider.')
-        .option('--key-stdin', 'Read API key from stdin')
-        .action(async (provider, opts) => {
-        try {
-            const item = keychainItemName(provider);
-            let token;
-            if (opts.keyStdin) {
-                token = readStdinSync();
-                if (!token)
-                    throw new Error('No key received on stdin.');
-            }
-            else {
-                token = await promptForSecret(`Enter API key for ${provider}`);
-            }
-            setKeychainToken(item, token);
-            console.log(chalk.green(`Stored in keychain: ${item}`));
-        }
-        catch (err) {
-            console.error(chalk.red(err.message));
-            process.exit(1);
-        }
-    });
-    cmd
-        .command('logout <provider>')
-        .description('Remove a stored provider key from keychain')
-        .action((provider) => {
-        try {
-            const item = keychainItemName(provider);
-            const existed = deleteKeychainToken(item);
-            if (!existed) {
-                console.error(chalk.yellow(`No keychain item '${item}' to remove.`));
-                process.exit(1);
-            }
-            console.log(chalk.green(`Removed keychain item: ${item}`));
-        }
-        catch (err) {
-            console.error(chalk.red(err.message));
-            process.exit(1);
-        }
-    });
-}

package/dist/commands/projects.d.ts

@@ -28,6 +28,15 @@ export declare function formatForCwdOutput(name: string | undefined, json: boole
  * string when everything answered.
  */
 export declare function formatFleetSkippedNote(skipped: string[]): string;
+/**
+ * One compact trailing note for peers that DID answer a fan-out but whose
+ * payload failed verification — a wrong machine id, a fingerprint that doesn't
+ * match the targets we sent, or a malformed row. Deliberately separate from
+ * {@link formatFleetSkippedNote}: silence means a peer never ran, while this
+ * means it ran and we cannot trust what it reports, which is the worse state.
+ * Empty string when every answer verified.
+ */
+export declare function formatFleetUnverifiedNote(unverified: string[]): string;
 /**
  * Best-effort `owner/repo` from a repo's origin remote.
  *