@phnx-labs/agents-cli 1.22.38 → 1.22.40

package/dist/commands/exec.js

@@ -18,8 +18,6 @@ import { recordDispatchedRun } from '../lib/audit/log.js';
 import { maybeShowStarNudge } from '../lib/star-nudge.js';
 import { warnUnpushedWork, shouldWarnUnpushed } from '../lib/warn-unpushed.js';
 import { warnOrphanedOpenPr } from '../lib/pr-land-detach.js';
-import { isHostPinned, pinHostKey, managedKnownHostsPath } from '../lib/devices/known-hosts.js';
-import { sshResolve } from '../lib/hosts/ssh-config.js';
 import * as fs from 'fs';
 import * as path from 'path';
 import * as os from 'os';
@@ -27,6 +25,7 @@ import { spawnSync } from 'child_process';
 import { randomUUID } from 'crypto';
 import { isSessionTrackedAgent } from '../lib/session/types.js';
 import { applyActiveRulesPresetAtRun } from '../lib/rules/run-sync.js';
+import { handleBroadcast } from './run-broadcast.js';
 /** Distinguish a terminal account-picker marker from an explicit @version pin. */
 export function parseRunAccountPickerRequest(agentSpec) {
     const requested = agentSpec.endsWith('@');
@@ -39,8 +38,8 @@ export function parseRunAccountPickerRequest(agentSpec) {
 }
 /** Return every option whose routing semantics conflict with a local account choice. */
 /**
- * The `--host` alias family — the flags that mean "dispatch this run to another
- * machine over SSH". `--host` is canonical; `--device`/`--on`/`--computer` are
+ * The `--device` alias family — the flags that mean "dispatch this run to another
+ * machine over SSH". `--device` is canonical; `--on`/`--computer` are hidden
  * aliases. Returns the values actually given (so callers can both test presence
  * and read the target). Kept in ONE place because a guard that listed only a
  * subset silently let `--terminal --device` open a local tab and drop the remote
@@ -62,7 +61,7 @@ export function runAccountPickerConflicts(options) {
     if (options.box)
         conflicts.push('--box');
     if (hostTargetGiven(options).length)
-        conflicts.push('--host/--device');
+        conflicts.push('--device');
     return conflicts;
 }
 /** Type guard that narrows a string to a known AgentId. */
@@ -186,46 +185,6 @@ export function writeAlwaysFreshRepos(repos) {
         /* best-effort — losing the preference just means the picker shows next time */
     }
 }
-/**
- * Decide whether `--copy-creds` may ship credentials (and the Claude OAuth
- * token) to `host` (RUSH-1767). Credentials ship only to a host whose SSH host
- * key is pinned in the managed known_hosts store, so the offload never rides an
- * accept-new (TOFU) connection a machine-in-the-middle could intercept.
- *
- * Resolution:
- *  - The checked target is the host's concrete `address`, else its ssh-config
- *    HostName (`ssh -G`), else its name — so an alias is pinned/verified against
- *    the SAME real host the strict dispatch later connects to.
- *  - An unpinned NON-device (a bare `~/.ssh/config` `Host` alias or literal,
- *    which `agents ssh <name>` can't reach — "Unknown device") is self-pinned in
- *    place via ssh-keyscan. A registered device is left unpinned here — it earns
- *    its pin through the normal `agents ssh <name>` accept-new connect, so the
- *    caller steers there instead.
- *
- * The network seams (`resolve`, `selfPin`) default to the real ssh -G /
- * ssh-keyscan implementations and are injectable so the ship/refuse decision is
- * unit-testable against real known_hosts fixtures with no network.
- */
-export function decideCopyCredsGate(host, deps = {}) {
-    const file = deps.file ?? managedKnownHostsPath();
-    const resolve = deps.resolve ?? sshResolve;
-    const selfPin = deps.selfPin ?? ((target, port, f) => pinHostKey(target, { file: f, ...(port ? { port } : {}) }).pinned);
-    // For an ssh-config host `host.address` is unset; ssh -G gives the real
-    // HostName (and Port) the strict dispatch will verify against.
-    const cfg = host.address ? undefined : resolve(host.name);
-    const pinTarget = host.address ?? cfg?.hostname ?? host.name;
-    // Not pinned yet? A registered device earns its pin through the normal
-    // accept-new connect (`agents ssh <name>` / the fleet sweep), so leave it and
-    // let the caller steer there. A bare ssh-config alias / literal is NOT a
-    // registered device — that flow can never pin it — so pin it right here.
-    let selfPinned = false;
-    if (!isHostPinned(pinTarget, file) && host.provider !== 'devices') {
-        const cfgPort = cfg?.port;
-        const port = cfgPort && cfgPort !== '22' ? Number(cfgPort) : undefined;
-        selfPinned = selfPin(pinTarget, port, file);
-    }
-    return { allowed: isHostPinned(pinTarget, file), pinTarget, selfPinned };
-}
 /**
  * Build the LoopConfig the driver consumes from CLI flags and/or a workflow's
  * `loop:` frontmatter block (issue #332). Returns undefined when neither source
@@ -445,8 +404,7 @@ async function resolveRunCwd(options, opts) {
  * a session started when none did.
  */
 async function handleTerminalHandoff(agentSpec, options, prompt) {
-    const { parseTerminalFlag, openRunInTerminal, toHostSamples } = await import('../lib/terminal/run-surface.js');
-    const { currentContext } = await import('../lib/terminal/index.js');
+    const { parseTerminalFlag, openRunInTerminal, toHostSamples, currentContext } = await import('../lib/terminal/index.js');
     const parsed = parseTerminalFlag(options.terminal);
     if (parsed.error) {
         console.error(chalk.red(parsed.error));
@@ -478,10 +436,10 @@ async function handleTerminalHandoff(agentSpec, options, prompt) {
             process.exit(1);
         }
     }
-    // --host and its aliases (--device/--on/--computer) all mean "dispatch this
+    // --device and its aliases (--on/--computer) all mean "dispatch this
     // run to another machine over SSH", which is incompatible with opening a
     // terminal tab on THIS machine — so reject the whole alias family, not just
-    // the canonical flag. The rule and its wording live once, in the --host
+    // the canonical flag. The rule and its wording live once, in the --device
     // forwarding table, so the classification a reviewer reads and the error a
     // user sees can't drift.
     if (hostTargetGiven(options).length) {
@@ -490,7 +448,7 @@ async function handleTerminalHandoff(agentSpec, options, prompt) {
         process.exit(1);
     }
     // Machine-readable output would land in the tab, where the caller that asked
-    // for it can never read it. Same class of failure as --host: refuse, don't
+    // for it can never read it. Same class of failure as --device: refuse, don't
     // hand back a stream that goes nowhere.
     const streamFlag = options.json ? '--json' : options.emitSessionId ? '--emit-session-id' : undefined;
     if (streamFlag) {
@@ -500,7 +458,7 @@ async function handleTerminalHandoff(agentSpec, options, prompt) {
     // `--project` owns the working directory, but the main action resolves it far
     // below this handoff — so without this the tab would open in THIS process's
     // cwd (launchd's `/` for a menu-bar click) while the run inside it moved to
-    // the project. `forRemote: false` because --terminal is always local (--host
+    // the project. `forRemote: false` because --terminal is always local (--device
     // is rejected above).
     const cwd = await resolveRunCwd(options, { forRemote: false });
     const { getActiveSessions } = await import('../lib/session/active.js');
@@ -532,8 +490,8 @@ async function handleTerminalHandoff(agentSpec, options, prompt) {
 /** Register the `agents run <agent> [prompt]` command. */
 export function registerRunCommand(program) {
     const runCmd = program
-        .command('run <agent> [prompt]')
-        .description('Execute an agent. Pass a prompt for headless runs; omit it to launch the agent interactively.')
+        .command('run [agent] [prompt]')
+        .description('Execute an agent. Pass a prompt for headless runs; omit it to launch the agent interactively. With --broadcast, run the same prompt/task across an agent × model matrix.')
         .option('-m, --mode <mode>', 'How much the agent can do: plan (read-only), edit (can write files), auto (smart classifier auto-approves safe ops, prompts for risky), skip (bypass all permission prompts). Omitted Codex mode defaults to safe writable edit; other harnesses default to plan. \'full\' accepted as alias for skip.', 'plan')
         .option('-e, --effort <effort>', 'Reasoning effort: low | medium | high | xhigh | max | auto (claude and codex only)', 'auto')
         .option('--model <model>', 'Cost tier (cheap|default|best|ultra) or a concrete model id; tiers resolve per harness+version to a supported model')
@@ -542,22 +500,27 @@ export function registerRunCommand(program) {
         .option('--no-auto-secrets', 'Skip auto-injection of secrets declared by a workflow\'s frontmatter `secrets:` field. Has no effect on bare-agent runs.')
         .option('--secrets-keys <keys>', 'Inject only this comma-separated subset of keys from --secrets bundles (e.g. KEY1,KEY2). Missing keys are an error. Applies to all --secrets bundles on this run.')
         .option('--allow-expired', 'Inject secrets even if their expiry date has passed (overrides the pre-run expiry abort).')
-        .option('--cwd <dir>', 'Working directory for the agent (defaults to current directory). With --host, the directory ON the host.')
-        .option('-P, --project <ref>', 'Project shorthand <slug>[@worktree], resolved against your projects root (auto-inferred, cached). Sets the cwd locally or on --host.')
+        .option('--cwd <dir>', 'Working directory for the agent (defaults to current directory). With --device, the directory ON the device.')
+        .option('-P, --project <ref>', 'Project shorthand <slug>[@worktree], resolved against your projects root (auto-inferred, cached). Sets the cwd locally or on --device.')
         .option('--add-dir <dir>', 'Grant access to an additional directory outside the project (Claude, Codex, Cursor, Kimi, Grok; repeatable)', (val, prev) => [...prev, val], [])
         .option('--json', 'Stream events as JSON lines (for parsing by other tools)')
         .option('--quiet', 'Suppress preamble (rotation banner, "Running:" line). Useful when piping JSON events to a parser.', false)
         .option('--headless', 'Force headless mode. Auto-enabled when a prompt is provided; pass explicitly to stay headless with no prompt (reads the prompt from stdin).', false)
         .option('--no-auth-check', 'Skip the pre-launch "looks logged out" warning on an interactive run (advisory; never blocks anyway). Also silenced by AGENTS_NO_AUTH_CHECK=1.')
         .option('-i, --interactive', 'Force interactive mode even when a prompt is provided. Mutually exclusive with --headless.')
+        .option('--broadcast', 'Run the same prompt or --task across multiple agents (comma-separated [agent]) × --model cells. Replaces the former `agents bench` group.')
+        .option('--task <id>', 'With --broadcast: house benchmark task id under apps/cli/bench/tasks/')
+        .option('--list-tasks', 'With --broadcast: list available broadcast task ids')
+        .option('--results [run-id]', 'With --broadcast: show one saved matrix run, or list saved runs newest first')
+        .option('--concurrency <n>', 'With --broadcast: maximum cells running at once', '3')
         .option('--resume [id]', 'Recover a previous conversation on its origin device. The exact healthy origin uses native resume; otherwise a healthy version of the same harness replays via /continue. Pair with a prompt to continue headlessly.')
         .option('--session-id <id>', 'Force a NEW conversation to use this exact session UUID (Claude only). This CREATES a session — to resume an existing one, use --resume.')
-        .option('--name <slug>', 'Name the run — seeds the session label so it shows up as `<name>` in `agents sessions` and resolves by it (and `agents logs <name>` for --host runs) instead of an opaque id. An agent-generated title later refines the label; your name shows until then. Optional.')
+        .option('--name <slug>', 'Name the run — seeds the session label so it shows up as `<name>` in `agents sessions` and resolves by it (and `agents hosts logs <name>` for --device runs) instead of an opaque id. An agent-generated title later refines the label; your name shows until then. Optional.')
         .option('--notify', 'Post a desktop notification when a headless run finishes. Fired by this process on exit, so it survives whatever launched the run (the menu bar dispatching it, a terminal you closed).')
         .option('--terminal [backend]', "Open this run in a real terminal tab instead of here. Without a value the terminal is detected from your live sessions (`agents sessions --active` host), so it lands where you already work — Ghostty for a Ghostty user, iTerm for an iTerm user. Name one to force it: iterm | ghostty | terminal | tmux | vscodium-agent. This is how the menu bar's New Session opens.")
         .option('--verbose', 'Show detailed execution logs')
         .option('--raw', 'Interactive runs on macOS/Linux launch inside a shared tmux session (for %pane addressing + re-attach). Pass --raw to spawn the agent directly instead. Also disabled by AGENTS_NO_TMUX=1.')
-        .option('--no-tmux', 'Spawn the agent directly instead of wrapping it in the shared tmux session. Same effect as --raw / AGENTS_NO_TMUX=1. Use this to see the agent\'s full startup output when a launch is failing.')
+        .option('--no-tmux', 'Spawn the agent directly instead of wrapping it in the shared tmux session. Same effect as --raw / AGENTS_NO_TMUX=1. Use this to see the agent\'s full startup output when a launch is failing; to turn the wrap off for every run on this machine, set `agents config set devices.<name>.tmux off`.')
         .option('--disable-tmux', 'Alias for --no-tmux.')
         .option('--timeout <duration>', 'Kill the agent after this duration (e.g., 30m, 1h, 2h30m)')
         .option('--fallback <agents>', 'Comma-separated agents to try on rate-limit failure. Each entry accepts an optional @version pin (e.g., codex@0.116.0,antigravity). The primary runs first; if it exits with a rate-limit error, the next agent picks up via /continue handoff.')
@@ -572,14 +535,13 @@ export function registerRunCommand(program) {
         .option('--budget <tokens>', 'Loop token hard-cap: stop once cumulative tokens reach this (stoppedBy: budget), enforced outside the agent. Loop only.')
         .option('--until <signal>', 'Loop stop condition. `signal` reads <runDir>/loop-signal.json {continue,reason} each iteration; absent or continue:false stops (fail-closed). Loop only.')
         .option('--interval <dur>', 'Loop delay between iterations ("0" back-to-back, "30m" paces). Loop only.')
-        .option('--where <spec>', 'Where this run\'s body executes (one placement door): local | device:<name> | auto | lease[:backend] | cloud[:provider]. Expands to --host/--lease/--cloud. Do not combine with those flags. See docs/concepts.md#placement.')
-        .option('--host <name>', 'Offload this run onto another machine over SSH — a device name, registered host, or user@host. Pass "auto" to pick the least-loaded reachable device with an eligible account; an unavailable or capped pool fails loud. Same as --where device:<name>. See `agents devices`.')
-        .option('--device <name>', 'Alias of --host. Pass "auto" for live health/account-aware device placement.')
-        .option('--remote-cwd <dir>', "Explicit host working directory for --host runs, used VERBATIM (overrides --cwd; usually --cwd suffices — it re-roots a local-home path onto the remote home). Pass a single-quoted '$HOME/…' or a valid remote absolute path; a local ~ expands here and won't exist there (/Users/you vs /home/you).")
-        .option('--no-follow', 'With --host, dispatch detached and return immediately (track via `agents devices ps` and `agents logs`).')
-        .option('--any', 'With --host <cap> (a capability tag), pick any matching host instead of erroring when several match.')
-        .option('--copy-creds', 'With --host, copy the picked runtime credentials (and Claude OAuth token) to the host, then shred them after the run. Opt-in per run.')
-        .option('--lease [backend]', "Run on a cloud box (via crabbox) and tear it down after — reuses a warm box from the repo's profile pool when one is ready (--fresh forces a new box). Optional backend selects the cloud (hetzner/aws/do). Same as --where lease[:backend]. Unlike --host, no machine is registered.")
+        .option('--where <spec>', 'Where this run\'s body executes (one placement door): local | device:<name> | auto | lease[:backend] | cloud[:provider]. Expands to --device/--lease/--cloud. Do not combine with those flags. See docs/00-concepts.md#placement.')
+        .option('-D, --device <name>', 'Offload this run onto another machine over SSH — a registered device, or user@host. Pass "auto" to pick the least-loaded reachable device where the requested agent is installed and signed in, keeping the run local when no remote is better. Same as --where device:<name>. See `agents devices`.')
+        .option('--remote-cwd <dir>', "Explicit device working directory for --device runs, used VERBATIM (overrides --cwd; usually --cwd suffices — it re-roots a local-home path onto the remote home). Pass a single-quoted '$HOME/…' or a valid remote absolute path; a local ~ expands here and won't exist there (/Users/you vs /home/you).")
+        .option('--no-follow', 'With --device, dispatch detached and return immediately (track via `agents hosts ps/logs`).')
+        .option('--any', 'With --device <cap> (a capability tag), pick any matching device instead of erroring when several match.')
+        .option('--copy-creds', 'Deprecated refusal: native OAuth/session credentials cannot be copied between devices. Use `agents accounts sync <account> --device <device>` for a portable provider credential.')
+        .option('--lease [backend]', "Run on a cloud box (via crabbox) and tear it down after — reuses a warm box from the repo's profile pool when one is ready (--fresh forces a new box). Optional backend selects the cloud (hetzner/aws/do). Same as --where lease[:backend]. Unlike --device, no machine is registered.")
         .option('--box <slug>', 'Reuse an existing warm crabbox box for this run instead of provisioning a disposable --lease box.')
         .option('--keep-box', 'With --lease, keep the box after the run instead of stopping it.')
         .option('--fresh', "With --lease, always provision a brand-new box (skip the warm profile-pool reuse) and tear it down after the run.")
@@ -587,21 +549,21 @@ export function registerRunCommand(program) {
         .option('--bare', 'With --lease, skip copying your local ~/.agents setup (skills/hooks/commands/MCP) onto the box.')
         .option('--tailscale', 'Lease the box onto your tailnet (reachable only over Tailscale) rather than a public IP.')
         .option('--no-tailscale', 'Force a public-IP lease even when a reuse context would default to Tailscale.')
-        .option('--cloud', 'Vendor cloud placement: dispatch to the agent\'s native cloud (claude→rush, codex→codex, cursor→cursor, droid→factory, antigravity→antigravity) and stream the result. Same dispatch as `agents cloud run --agent <agent>`; tracked by `agents cloud list/status/logs`. Same as --where cloud. Mutually exclusive with --host/--lease and local-run flags.')
+        .option('--cloud', 'Vendor cloud placement: dispatch to the agent\'s native cloud (claude→rush, codex→codex, cursor→cursor, droid→factory, antigravity→antigravity) and stream the result. Same dispatch as `agents cloud run --agent <agent>`; tracked by `agents cloud list/status/logs`. Same as --where cloud. Mutually exclusive with --device/--lease and local-run flags.')
         .option('--provider <id>', 'With --cloud: override the agent\'s native cloud provider (rush | codex | cursor | factory | antigravity | host).')
         .option('--repo <owner/repo>', 'With --cloud: GitHub repository. Repeatable for multi-repo dispatch (Rush Cloud only).', (val, prev) => [...prev, val], [])
         .option('--branch <name>', 'With --cloud: target git branch.')
         .option('--cloud-env <id>', 'With --cloud: Codex Cloud environment ID (run\'s --env is the KEY=VAL passthrough, so the cloud env id gets its own flag).');
-    // `--on` and `--computer` are hidden aliases of `--host` — same behavior.
-    runCmd.addOption(new Option('--on <name>', 'Alias of --host.').hideHelp());
-    runCmd.addOption(new Option('--computer <name>', 'Alias of --host.').hideHelp());
+    // `--on` and `--computer` are hidden aliases of `--device` — same behavior.
+    runCmd.addOption(new Option('--on <name>', 'Alias of --device.').hideHelp());
+    runCmd.addOption(new Option('--computer <name>', 'Alias of --device.').hideHelp());
     // Deprecated one-release alias: `agents run … --smart` → treat as `--device auto`.
     runCmd.addOption(new Option('--smart', 'Deprecated: use --device auto (affinity host pick).').hideHelp());
-    // Internal: the `--host` dispatch forwards this so the REMOTE run prints its
+    // Internal: the `--device` dispatch forwards this so the REMOTE run prints its
     // resolved session id as a one-line stdout sentinel (hosts/session-marker.ts),
     // letting the launcher relate the remote-created session back to itself for
     // every agent — not just Claude, whose id it forces up front.
-    runCmd.addOption(new Option('--emit-session-id', 'internal: print the resolved session id for a --host launcher to capture').hideHelp());
+    runCmd.addOption(new Option('--emit-session-id', 'internal: print the resolved session id for a --device launcher to capture').hideHelp());
     // Required for the documented `agents run <agent> [prompt] -- <native flags>`
     // passthrough: commander >=13 rejects excess operands by default, so any
     // post-`--` token died with "too many arguments" before the action ran. The
@@ -625,11 +587,11 @@ export function registerRunCommand(program) {
       # Full-auto: affinity-pick the host, then the harness with the most
       # account headroom, then a balanced account on it
       agents run auto "fix the flaky test" --mode edit
-      agents run auto --host yosemite-s0 "fix the flaky test"   # pin the host
+agents run auto --device yosemite-s0 "fix the flaky test"   # pin the device
       agents run auto --interactive --device auto --strategy balanced --mode auto
 
       # Placement (one door — where the body runs). Old flags still work.
-      agents run claude "…" --where device:yosemite-s0   # = --host yosemite-s0
+      agents run claude "…" --where device:yosemite-s0   # = --device yosemite-s0
       agents run claude "…" --where auto                 # = --device auto
       agents run claude "fix CI" --where lease --mode edit
 
@@ -662,6 +624,12 @@ export function registerRunCommand(program) {
       agents run claude "fix the failing tests" --lease --fresh
       agents run claude "fix the failing tests" --box warm-one
 
+      # Broadcast one prompt (or --task) across agents × models
+      agents run --broadcast claude,codex "say hello" --model cheap,default
+      agents run --broadcast --task hello-repo --model cheap
+      agents run --broadcast --list-tasks
+      agents run --broadcast --results --json
+
       # Pass arbitrary native flags to the underlying CLI via -- separator
       agents run kimi -- --plan --some-kimi-option value
       agents run claude "fix the bug" -- --custom-flag
@@ -692,7 +660,7 @@ export function registerRunCommand(program) {
         excluded account and the earliest window reset — use --strategy pinned to force.
 
       'auto' harness (agents run auto): picks the host (14d usage affinity,
-      unless --host is given), the harness (installed CLIs weighted by
+      unless --device is given), the harness (installed CLIs weighted by
       best-account headroom), and the account (the strategy above). Zero
       healthy accounts on any harness exits nonzero with the earliest reset.
 
@@ -708,10 +676,10 @@ export function registerRunCommand(program) {
         cloud list/status/logs/cancel/message. --provider overrides the routing;
         --repo/--branch/--cloud-env refine the task. Agents without a native
         cloud (kimi, grok, cursor, opencode, …) fail loud unless --provider is
-        given. --cloud is mutually exclusive with --host/--lease and with
+        given. --cloud is mutually exclusive with --device/--lease and with
         local-run flags (--loop, --resume, --secrets, --terminal, …).
 
-      Resume: --resume <id> resolves full IDs locally first, then fleet-wide, and recovers on the source device with its cwd/mode. The exact healthy origin version uses native resume; otherwise a healthy version of the same harness replays via /continue. agents resume <id> infers the harness too.
+      Resume: --resume <id> resolves full IDs locally first, then fleet-wide, and recovers on the source device with its cwd/mode. The exact healthy origin version uses native resume; otherwise a healthy version of the same harness replays via /continue. agents sessions resume <id> infers the harness too.
 
       Passthrough: everything after -- is forwarded verbatim to the underlying agent CLI.
         agents run kimi -- --plan --some-native-flag value
@@ -737,6 +705,37 @@ export function registerRunCommand(program) {
             // a native flag, not a prompt. Run interactively.
             prompt = undefined;
         }
+        // Broadcast matrix (formerly `agents bench`): list/results/run cells, then exit.
+        // --broadcast is local-only fan-out — it is mutually exclusive with --host/--device.
+        if (options.broadcast || options.listTasks || options.results !== undefined) {
+            const whereIsRemote = typeof options.where === 'string' && options.where.trim().toLowerCase() !== 'local';
+            if (hostTargetGiven(options).length > 0 || whereIsRemote) {
+                console.error(chalk.red('--broadcast is local-only and cannot be combined with --host/--device/--where.'));
+                process.exit(1);
+            }
+            try {
+                await handleBroadcast({
+                    listTasks: options.listTasks === true,
+                    results: options.results,
+                    task: options.task,
+                    model: options.model,
+                    concurrency: options.concurrency,
+                    json: options.json,
+                    agentsCsv: agentSpec,
+                    prompt,
+                    requireRun: options.broadcast === true && !options.listTasks && options.results === undefined,
+                });
+            }
+            catch (err) {
+                console.error(chalk.red(err.message));
+                process.exit(1);
+            }
+            return;
+        }
+        if (!agentSpec) {
+            console.error(chalk.red("Missing required argument 'agent'. Example: agents run claude \"hello\"."));
+            process.exit(1);
+        }
         // --cloud: vendor cloud placement. Validate BEFORE the terminal handoff
         // and every local dispatch path — flags like --terminal/--loop/--resume
         // belong to the local runner and must error, never ride along silently.
@@ -757,7 +756,7 @@ export function registerRunCommand(program) {
             await handleTerminalHandoff(agentSpec, options, prompt);
             return;
         }
-        // Placement: --where expands into --host / --lease / --cloud before any
+        // Placement: --where expands into --device / --lease / --cloud before any
         // dispatch. One door for "where does the body run?" — old flags remain
         // aliases. See lib/placement.ts and docs/concepts.md#placement.
         {
@@ -808,7 +807,7 @@ export function registerRunCommand(program) {
             return;
         }
         // --notify: post a desktop notification when this run finishes. Armed on
-        // process exit so it covers EVERY dispatch path below (local, --host,
+        // process exit so it covers EVERY dispatch path below (local, --device,
         // --lease, the error path) instead of one branch. Only for headless runs
         // — an interactive run ends in front of the person who started it.
         if (options.notify && prompt !== undefined) {
@@ -902,7 +901,7 @@ export function registerRunCommand(program) {
             const [requestedAgent, requestedVersion] = normalizedAgentSpec.split('@');
             if (!autoHarnessRequested && requestedAgent !== resolvedResumeSource.agent) {
                 console.error(chalk.red(`Session ${resolvedResumeSource.shortId} belongs to ${resolvedResumeSource.agent}, not ${requestedAgent}. ` +
-                    `Use: agents resume ${resolvedResumeSource.id}`));
+                    `Use: agents sessions resume ${resolvedResumeSource.id}`));
                 process.exit(1);
             }
             if (!autoHarnessRequested && requestedVersion && requestedVersion !== resolvedResumeSource.version) {
@@ -970,13 +969,13 @@ export function registerRunCommand(program) {
                 console.error(chalk.red(`agents run auto picks the harness and account itself — the trailing-@ account picker needs a concrete harness (agents run <harness>@).`));
                 process.exit(1);
             }
-            // Host layer: with no explicit --host/--device, default to the
-            // affinity pick. Skipped on a host-dispatched run — its dispatcher
+            // Host layer: with no explicit --device, default to the
+            // affinity pick. Skipped on a device-dispatched run — its dispatcher
             // already resolved this layer (see runAutoDefaultsToAffinity).
             if (!resolvedResumeSource && runAutoDefaultsToAffinity(options))
                 options.device = 'auto';
         }
-        // --device auto / --host auto (and deprecated --smart): live fleet pick.
+        // --device auto (and deprecated --smart): live fleet pick.
         // Harness is always the agent the user typed — never auto-picked.
         // Placement failure propagates; an automatic request never becomes local.
         {
@@ -1134,10 +1133,10 @@ export function registerRunCommand(program) {
                     netMode = 'public';
                 }
             }
-            const { detectSignedInRuntimes, resolveClaudeCredentialsBlob, inferLeaseRuntime, profileNeedsBaseRuntimeCredentials } = await import('../lib/crabbox/runtimes.js');
+            const { assertNoNativeOAuthTransfer, detectSignedInRuntimes, inferLeaseRuntime, profileNeedsBaseRuntimeCredentials } = await import('../lib/crabbox/runtimes.js');
             const { leaseAndRun, leaseWorkspaceId } = await import('../lib/crabbox/lease.js');
             const { boxAddress } = await import('./lease.js');
-            const { getConfiguredRunStrategy, resolveRunVersion } = await import('../lib/rotate.js');
+            const { getConfiguredRunStrategy, resolveRunVersion } = await import('../lib/accounting/rotate.js');
             const { profileExists, readProfile, resolveProfileEnv } = await import('../lib/profiles.js');
             const detected = await detectSignedInRuntimes();
             const [agentName, rawLeaseVersion] = normalizedAgentSpec.split('@');
@@ -1185,40 +1184,17 @@ export function registerRunCommand(program) {
                 console.error(chalk.yellow(`Profile '${agentName}' needs ${runtime} credentials, but ${runtime} is not signed in locally. Sign in locally, then retry.`));
                 process.exit(1);
             }
-            // Copy the account the run's OWN strategy would pick (default `balanced`:
-            // a healthy, non-rate-limited account weighted by remaining headroom) —
-            // never the raw default signed-in one, which could be throttled or out of
-            // credits and would boot the box straight into a wall.
-            //
-            // Only claude's token is account-switched: resolveClaudeCredentialsBlob
-            // honors preferEmail across version-homes. The other runtimes'
-            // buildCredentialScript copies the single currently-active credential file
-            // with no switching, so run the balanced picker only for claude — otherwise
-            // the notice below would name a balanced-picked account that is NOT the one
-            // actually shipped. Best-effort: fall back to the default account on error.
-            let leaseEmail = detected.find((d) => d.id === runtime)?.email ?? null;
-            if (credentialRuntimes.includes('claude')) {
-                try {
-                    const strategy = getConfiguredRunStrategy(runtime, leaseCwd);
-                    const { rotation } = await resolveRunVersion(runtime, strategy, leaseCwd);
-                    if (rotation?.picked.email)
-                        leaseEmail = rotation.picked.email;
-                }
-                catch {
-                    /* strategy resolution is best-effort; keep the default signed-in account */
-                }
-            }
+            // Refuse before account selection, OAuth reads, box lookup, or lease
+            // provisioning. A provider-backed profile has no credentialRuntimes and
+            // proceeds with its portable provider environment instead.
+            assertNoNativeOAuthTransfer(credentialRuntimes, detected);
             // Headless-by-contract: don't prompt, but print exactly what ships and
             // where — copying an auth token to a cloud box is a credential transfer.
             // The box is destroyed after the run, so the credential's lifetime is
             // bounded by the run.
-            const whatShips = credentialRuntimes.includes('claude')
-                ? `${dispatchProfile ? `profile '${dispatchProfile.name}', ` : ''}${runtime} credentials + Claude OAuth token`
-                : credentialRuntimes.length > 0
-                    ? `${dispatchProfile ? `profile '${dispatchProfile.name}', ` : ''}${runtime} credentials`
-                    : dispatchProfile
-                        ? `profile '${dispatchProfile.name}'`
-                        : `${runtime} credentials`;
+            const whatShips = dispatchProfile
+                ? `profile '${dispatchProfile.name}'`
+                : `${runtime} runtime setup`;
             const boxLifecycle = reuseSlug
                 ? `Reusing crabbox box ${reuseSlug}`
                 : options.fresh
@@ -1231,18 +1207,8 @@ export function registerRunCommand(program) {
                     : options.fresh
                         ? 'the box is destroyed after the run'
                         : 'the shared-pool box is kept after the run';
-            console.error(chalk.gray(`${boxLifecycle} · shipping ${whatShips}${credentialRuntimes.length > 0 && leaseEmail ? ` (${leaseEmail})` : ''}; ${boxAfterRun}.`));
-            // Read the Claude OAuth token from the local Keychain (silent) so it can be
-            // written to ~/.claude/.credentials.json on the box — otherwise Claude boots
-            // "Not logged in". `preferEmail` targets the strategy-picked account so the
-            // token matches the account this run resolved to.
-            let claudeCredentialsJson = null;
-            if (credentialRuntimes.includes('claude')) {
-                claudeCredentialsJson = await resolveClaudeCredentialsBlob({ preferEmail: leaseEmail });
-                if (!claudeCredentialsJson) {
-                    console.error(chalk.yellow('Warning: could not read the local Claude OAuth token — the box may come up "Not logged in".'));
-                }
-            }
+            console.error(chalk.gray(`${boxLifecycle} · shipping ${whatShips}; ${boxAfterRun}.`));
+            const claudeCredentialsJson = null;
             // Progress UI (F2, RUSH-1921). A self-throttled spinner (NOT ora — see
             // progress.ts) covers provisioning; the box-side bootstrap then streams a
             // structured step stream (sync → install → runtime → creds → …) via the
@@ -1368,7 +1334,7 @@ export function registerRunCommand(program) {
                 process.exit(1);
             }
         }
-        // --host/--on/--computer: offload this run onto a registered agent host
+        // --device/--on/--computer: offload this run onto a registered agent host
         // over SSH instead of running locally. The three flags are aliases.
         const hostGiven = hostTargetGiven(options);
         // --project <slug>[@worktree]: resolve the projects-root shorthand into a
@@ -1380,7 +1346,7 @@ export function registerRunCommand(program) {
         }
         if (hostGiven.length > 0) {
             if (new Set(hostGiven).size > 1) {
-                console.error(chalk.red('Conflicting --host/--device values — pass just one.'));
+                console.error(chalk.red('Conflicting --device values values — pass just one.'));
                 process.exit(1);
             }
             const hostName = hostGiven[0];
@@ -1392,7 +1358,7 @@ export function registerRunCommand(program) {
             const { runInteractiveOnHost } = await import('../lib/hosts/dispatch.js');
             const { registerInteractiveHostSession } = await import('../lib/hosts/session-index.js');
             const { RUN_OPTION_REJECT_MESSAGES } = await import('../lib/hosts/remote-cmd.js');
-            const { normalizeRunStrategy, RUN_STRATEGIES } = await import('../lib/rotate.js');
+            const { normalizeRunStrategy, RUN_STRATEGIES } = await import('../lib/accounting/rotate.js');
             // The forwarding contract (RUN_OPTION_FORWARDING): options that cannot
             // cross the SSH boundary fail loud BEFORE dispatch — never a silent
             // drop. Value-aware: only reject what was actually passed.
@@ -1412,6 +1378,12 @@ export function registerRunCommand(program) {
                     console.error(chalk.red(msg));
                 process.exit(1);
             }
+            if (options.copyCreds) {
+                console.error(chalk.red('Refusing --copy-creds: native OAuth/session credentials are device-local and cannot be copied. ' +
+                    'Create a portable provider account and run `agents accounts sync <account> --device <device>` instead.'));
+                process.exit(1);
+                return;
+            }
             // Shared resolution (name → capability tag → error). A password-auth
             // device throws DeviceOffloadUnsupportedError inside the helper and
             // propagates untouched — it's printed cleanly by the top-level catch in
@@ -1468,78 +1440,7 @@ export function registerRunCommand(program) {
                 // which can't run over a detached remote dispatch — only forward a
                 // concrete id.
                 const resumeId = typeof options.resume === 'string' ? options.resume : undefined;
-                // --copy-creds: provision runtime credentials (and the Claude OAuth token)
-                // on the remote host before the run, then shred them after. Unlike
-                // --lease, a host is persistent, so this is strictly opt-in per run.
                 let hostCopyCreds;
-                if (options.copyCreds) {
-                    // Refuse to copy credentials (and the Claude OAuth token) to a host
-                    // whose SSH host key isn't pinned in the managed known_hosts store:
-                    // the offload transport would otherwise ride an accept-new (TOFU)
-                    // connection, so a machine-in-the-middle on an unverified first
-                    // connect could capture the tokens. The dispatch itself then verifies
-                    // strictly against that pin (see lib/hosts/dispatch.ts) (RUSH-1767).
-                    // The ship/refuse decision — pinTarget resolution, the non-device
-                    // self-pin, and the final pinned check — lives in decideCopyCredsGate
-                    // (unit-tested against real known_hosts fixtures).
-                    const gate = decideCopyCredsGate(host);
-                    if (gate.selfPinned) {
-                        console.error(chalk.gray(`Pinned "${host.name}" (${gate.pinTarget}) into the managed known_hosts store.`));
-                    }
-                    if (!gate.allowed) {
-                        console.error(chalk.red(`Refusing --copy-creds to "${host.name}": its SSH host key isn't pinned, so the ` +
-                            `credentials could be exposed to a machine-in-the-middle on an unverified first connect.`));
-                        console.error(chalk.gray(host.provider === 'devices'
-                            ? `Pin the key first by connecting once so agents records and verifies it:  agents ssh ${host.name}\n` +
-                                `Then re-run with --copy-creds.`
-                            : `Couldn't reach "${gate.pinTarget}" to pin its key (ssh-keyscan returned nothing). ` +
-                                `Make sure the host is reachable over SSH, then re-run with --copy-creds.`));
-                        process.exit(1);
-                    }
-                    // --copy-creds ships live credentials to a host, so it deliberately
-                    // requires an interactive terminal to pick which signed-in runtimes to
-                    // send and to confirm the transfer. Fail clean in a non-TTY/headless
-                    // shell instead of hanging on the picker/confirm below — auto-shipping
-                    // every signed-in token without consent would defeat the gate's purpose.
-                    if (!isInteractiveTerminal()) {
-                        // No non-interactive form: --copy-creds must pick which signed-in
-                        // runtimes to ship and confirm the transfer, so pass no alternatives
-                        // (an empty list prints just the "needs an interactive terminal" line).
-                        requireInteractiveSelection('--copy-creds (it selects which credentials to ship and confirms the transfer)', []);
-                    }
-                    const { detectSignedInRuntimes, pickRuntimes, resolveClaudeCredentialsBlob } = await import('../lib/crabbox/runtimes.js');
-                    const { confirm } = await import('@inquirer/prompts');
-                    const detected = await detectSignedInRuntimes();
-                    const runtimes = await pickRuntimes(detected);
-                    if (runtimes.length === 0) {
-                        console.error(chalk.yellow('No runtimes selected. Sign into one locally then retry, or omit --copy-creds.'));
-                        process.exit(1);
-                    }
-                    const names = runtimes
-                        .map((id) => {
-                        const d = detected.find((x) => x.id === id);
-                        return `${d?.label ?? id}${d?.email ? ` (${d.email})` : ''}`;
-                    })
-                        .join(', ');
-                    const whatShips = runtimes.includes('claude') ? 'credentials + Claude OAuth token' : 'credentials';
-                    const ok = await confirm({
-                        message: `Copy ${whatShips} for ${names} to host "${host.name}", run there, then shred them after?`,
-                        default: false,
-                    });
-                    if (!ok) {
-                        console.error(chalk.yellow('Aborted — no credentials pushed, no run dispatched.'));
-                        process.exit(1);
-                    }
-                    let claudeCredentialsJson = null;
-                    if (runtimes.includes('claude')) {
-                        const claudeEmail = detected.find((d) => d.id === 'claude')?.email ?? null;
-                        claudeCredentialsJson = await resolveClaudeCredentialsBlob({ preferEmail: claudeEmail });
-                        if (!claudeCredentialsJson) {
-                            console.error(chalk.yellow('Warning: could not read the local Claude OAuth token — the host may boot Claude "Not logged in".'));
-                        }
-                    }
-                    hostCopyCreds = { runtimes, detected, claudeCredentialsJson };
-                }
                 // Decide whether this host run is interactive. No prompt always means
                 // interactive (matching local resolveInteractive); --interactive forces
                 // interactive even when a prompt is provided; --headless forces headless
@@ -1673,7 +1574,7 @@ export function registerRunCommand(program) {
                 // Headless host run: launch detached, tail the remote log, and follow
                 // until the remote process exits.
                 if (prompt === undefined) {
-                    console.error(chalk.red('A prompt is required for headless host runs: agents run <agent> "<task>" --host <name>'));
+                    console.error(chalk.red('A prompt is required for headless host runs: agents run <agent> "<task>" --device <name>'));
                     process.exit(1);
                 }
                 // Session-id mint, detached dispatch, and local session-index
@@ -1839,9 +1740,9 @@ export function registerRunCommand(program) {
             import('../lib/profiles.js'),
             import('../lib/secrets/bundles.js'),
             import('../lib/secrets/remote.js'),
-            import('../lib/rotate.js'),
-            import('../lib/versions.js'),
-            import('../lib/plugins.js'),
+            import('../lib/accounting/rotate.js'),
+            import('../lib/installations/versions.js'),
+            import('../lib/plugins/plugins.js'),
             import('../lib/workflows.js'),
             import('../lib/run-defaults.js'),
             import('../lib/mcp.js'),
@@ -2189,20 +2090,64 @@ export function registerRunCommand(program) {
             }
         }
         version = resolveVersionAlias(agent, version);
-        const { resolveAccountSelection } = await import('../lib/account-registry.js');
-        const configuredAccount = resolveAccountSelection(options.account, agent, readMeta(), { useDefault: !fromProfile });
-        if (configuredAccount) {
+        // Account selection follows the binding order: explicit --account → exact
+        // `agent@version` binding → device-scoped `agent` binding → per-harness
+        // default. The exact-installation binding needs the concrete launch
+        // version, so resolve it (default when the run named no version).
+        const { resolveSpawnAccount } = await import('../lib/account-registry.js');
+        // Binding key: a custom harness keys on its own profile name; a native /
+        // global run keys on the exact `agent@version` (default when unpinned).
+        const bindingTarget = fromProfile ? rawAgent : (version ? `${agent}@${version}` : `${agent}@${getGlobalDefault(agent) ?? ''}`);
+        let spawnAccount = null;
+        try {
+            spawnAccount = resolveSpawnAccount(options.account, agent, version, readMeta(), { useDefault: !fromProfile, provider: profileProvider, target: bindingTarget });
+        }
+        catch (err) {
+            console.error(chalk.red(err.message));
+            process.exit(1);
+        }
+        // Downstream rotation gating asks only "was an account selected?".
+        const configuredAccount = spawnAccount?.name;
+        if (spawnAccount) {
             if (options.cloud || options.provider || options.lease) {
                 console.error(chalk.red('--account selects a device-local credential and cannot be combined with cloud or lease placement.'));
                 process.exit(1);
             }
-            const { resolveCredentialAccount } = await import('../lib/account-registry.js');
-            try {
-                accountEnv = resolveCredentialAccount(configuredAccount, agent, profileProvider).env;
+            if (spawnAccount.kind === 'native') {
+                // A native login is owned by the harness and read from its own home —
+                // it cannot be forwarded to another machine, and no secret/env is
+                // injected. Fail closed for a remote target.
+                const remoteTarget = options.host || options.device;
+                if (remoteTarget) {
+                    console.error(chalk.red(`Account '${spawnAccount.name}' is a device-local ${spawnAccount.agent} login and cannot be forwarded to '${remoteTarget}'. Sign in on that device and name the login there.`));
+                    process.exit(1);
+                }
+                if (version) {
+                    // A pinned version must actually be signed in as the named identity.
+                    const { getAccountInfo } = await import('../lib/agents.js');
+                    const info = await getAccountInfo(agent, getVersionHomePath(agent, version));
+                    const liveKey = info.accountKey ?? info.email?.toLowerCase() ?? null;
+                    if (!info.signedIn || liveKey !== spawnAccount.identityKey) {
+                        console.error(chalk.red(`Account '${spawnAccount.name}' names a specific ${spawnAccount.agent} identity, but ${agent}@${version} ${info.signedIn ? 'is signed in as a different identity' : 'is not signed in'}. Sign in as that identity, or re-name the account.`));
+                        process.exit(1);
+                    }
+                }
+                else {
+                    // No version pinned: locate the installed version currently signed in
+                    // as this identity and pin the run to it — do NOT assume the global
+                    // default holds it (the account may live on another installed copy).
+                    const { resolveAccountVersion } = await import('../lib/accounting/rotate.js');
+                    const matched = await resolveAccountVersion(agent, spawnAccount.identityKey);
+                    if (!matched) {
+                        console.error(chalk.red(`No installed ${spawnAccount.agent} version is signed in as the identity named by account '${spawnAccount.name}'. Sign in as that identity, or attach a different account.`));
+                        process.exit(1);
+                    }
+                    version = matched;
+                }
+                // Native identity confirmed live; the harness reads it from its home.
             }
-            catch (err) {
-                console.error(chalk.red(err.message));
-                process.exit(1);
+            else {
+                accountEnv = spawnAccount.env;
             }
         }
         // --resume: resolve a prior conversation and rewrite the run target to
@@ -2470,7 +2415,7 @@ export function registerRunCommand(program) {
                     // An isolated copy is never repaired by adopting another version, so
                     // `add <agent>@latest` would build an unrelated NORMAL install rather
                     // than fix what the user asked to run. Point at the isolated re-add.
-                    const { isVersionIsolated } = await import('../lib/versions.js');
+                    const { isVersionIsolated } = await import('../lib/installations/versions.js');
                     const hint = isVersionIsolated(agent, launchTarget)
                         ? `agents add ${agent}@${launchTarget} --isolated`
                         : `agents add ${agent}@latest`;
@@ -2537,7 +2482,7 @@ export function registerRunCommand(program) {
         // home would false-negative. It can still false-negative for opaque
         // credentials, so this NEVER blocks — it warns and launches anyway. Skipped
         // for --json/--quiet, when a rotation already picked a signed-in account,
-        // and via --no-auth-check / AGENTS_NO_AUTH_CHECK=1. (--host/--lease return
+        // and via --no-auth-check / AGENTS_NO_AUTH_CHECK=1. (--device/--lease return
         // earlier.)
         {
             const { shouldCheckLoginBeforeLaunch, loginHint } = await import('../lib/signin-badge.js');
@@ -2745,7 +2690,7 @@ export function registerRunCommand(program) {
             toolsRestrict: workflowToolsRestrict,
             mcpConfigPath: workflowMcpConfigPath,
             passthroughArgs,
-            // Set only on the REMOTE side of a `--host` dispatch (the launcher
+            // Set only on the REMOTE side of a `--device` dispatch (the launcher
             // forwards `--emit-session-id`): print the resolved session id as a
             // stdout sentinel so the launcher captures the id this run coined.
             emitSessionId: options.emitSessionId === true,