@phnx-labs/agents-cli 1.22.39 → 1.22.41

package/dist/commands/routines.js

@@ -10,11 +10,13 @@ import ora from 'ora';
 import * as fs from 'fs';
 import * as path from 'path';
 import * as yaml from 'yaml';
-import { isDaemonRunning, signalDaemonReload, startDaemon, stopDaemon, readDaemonLog, getDaemonStatus, getDaemonLogPath, } from '../lib/daemon.js';
+import { isDaemonRunning, signalDaemonReload, startDaemon, stopDaemon, readDaemonLog, getDaemonStatus, getDaemonLogPath, } from '../lib/daemon/daemon.js';
 import { assertSchedulerEnabled, assertDaemonEnabled, isDaemonEnabled } from '../lib/device-config.js';
-import { resolveAgentName, isAgentHardDeprecated, hardDeprecationError, ROUTINE_AGENT_IDS } from '../lib/agents.js';
-import { humanizeCron, humanizeNextRun, formatRepoLink, REPO_DISPLAY_MAX } from '../lib/routines-format.js';
-import { listJobs as listAllJobs, deleteJob, readJob, validateJob, writeJob, setJobEnabled, listRuns, routineStats, getLatestRun, getRunDir, getJobPath, isCanonicalRoutineSource, parseAtTime, hasCompletedOneShotRun, isOneShotLikeSchedule, isOneShotRoutine, isPastOneShotRoutine, jobRunsOnThisDevice, checkJobDeviceEligibility, normalizeTriggerEvent, parseHostStrategy, resolveHostStrategy, HOST_STRATEGIES, computeProjectGroup, computeProjectGroupKind, projectGroupKey, projectGroupTitle, projectGroupOrder, normalizeProjects, } from '../lib/routines.js';
+import { parseAgentVersionSpec, isAgentHardDeprecated, hardDeprecationError, ROUTINE_AGENT_IDS } from '../lib/agents.js';
+import { RUN_STRATEGIES, normalizeRunStrategy } from '../lib/accounting/rotate.js';
+import { formatRepoLink, REPO_DISPLAY_MAX } from '../lib/routines-format.js';
+import { listJobs as listAllJobs, deleteJob, readJob, validateJob, writeJob, setJobEnabled, listRuns, routineStats, getLatestRun, getRunDir, getJobPath, isCanonicalRoutineSource, parseAtTime, hasCompletedOneShotRun, isOneShotLikeSchedule, isOneShotRoutine, jobRunsOnThisDevice, checkJobDeviceEligibility, normalizeTriggerEvent, parseHostStrategy, resolveHostStrategy, HOST_STRATEGIES, computeProjectGroupKind, projectGroupKey, projectGroupTitle, projectGroupOrder, normalizeProjects, buildRoutineListJson, fireConditionLabel, nextRunForDisplay, nextRunLabel, localLatestRun, listJobsForDisplay, } from '../lib/scheduling/routines.js';
+export { buildRoutineListJson } from '../lib/scheduling/routines.js';
 import { listProjectDefs, isSafeProjectName } from '../lib/projects.js';
 import { evaluateActivationReadinessLive } from '../lib/routine-readiness.js';
 import { discoverProjectRoutines, findProjectRoutine, materialiseProjectRoutine, syncProjectRoutines, syncAllProjectRoutines, displayProjectPath, } from '../lib/routines-project.js';
@@ -61,31 +63,6 @@ export function formatRunDuration(startedAt, completedAt) {
  * Human label for what fires a job: its cron schedule, or its event trigger
  * for schedule-less (trigger-only) routines.
  */
-function fireConditionLabel(job) {
-    if (job.schedule)
-        return humanizeCron(job.schedule, job.timezone);
-    if (job.trigger) {
-        if (job.trigger.type === 'github_event') {
-            const scope = job.trigger.repo
-                ? ` (${job.trigger.repo}${job.trigger.branch ? `@${job.trigger.branch}` : ''})`
-                : '';
-            const filters = [
-                job.trigger.action ? `action=${job.trigger.action}` : null,
-                job.trigger.label ? `label=${job.trigger.label}` : null,
-            ].filter(Boolean).join(', ');
-            return `on github:${job.trigger.event}${scope}${filters ? ` (${filters})` : ''}`;
-        }
-        const filters = [
-            job.trigger.action ? `action=${job.trigger.action}` : null,
-            job.trigger.teamKey ? `team=${job.trigger.teamKey}` : null,
-            job.trigger.label ? `label=${job.trigger.label}` : null,
-            job.trigger.stateTo ? `stateTo=${job.trigger.stateTo}` : null,
-            job.trigger.stateFrom ? `stateFrom=${job.trigger.stateFrom}` : null,
-        ].filter(Boolean).join(', ');
-        return `on linear:${job.trigger.event}${filters ? ` (${filters})` : ''}`;
-    }
-    return '-';
-}
 function scheduleLabel(job) {
     let label = fireConditionLabel(job);
     if (isOneShotRoutine(job))
@@ -99,16 +76,6 @@ function scheduleLabel(job) {
     }
     return label;
 }
-function nextRunForDisplay(job, scheduler) {
-    if (isPastOneShotRoutine(job))
-        return null;
-    return scheduler.getNextRun(job.name);
-}
-function nextRunLabel(job, scheduler, now) {
-    if (isPastOneShotRoutine(job))
-        return 'expired';
-    return humanizeNextRun(scheduler.getNextRun(job.name) ?? null, now, job.timezone);
-}
 function deviceStateLabel(name, registry) {
     const profile = registry[normalizeHost(name)] ?? registry[name];
     if (!profile)
@@ -147,21 +114,6 @@ function deviceLabel(job, width) {
         : raw;
     return { raw, display, dim: full.length === 0 || !jobRunsOnThisDevice(job) };
 }
-/**
- * The last run THIS device can speak for.
- *
- * A run record is written by whichever daemon fired the routine, into that
- * machine's own runs dir — records carry no device attribution, so a record
- * found here only ever describes this device's history. When a routine is
- * pinned away from this machine (`devices:` excludes it) any local record is a
- * leftover from before the pin, and reporting it as the routine's status paints
- * another device's healthy routine red. Report nothing instead; the local
- * history stays readable via `agents routines runs <name>`, and the owning
- * device's status via `agents routines list --device <name>`.
- */
-export function localLatestRun(job) {
-    return jobRunsOnThisDevice(job) ? getLatestRun(job.name) : null;
-}
 export function groupRoutineJobsByDevice(jobs, registry, self = machineId()) {
     const groups = new Map();
     const add = (key, title, job) => {
@@ -418,81 +370,6 @@ export function buildRunsJson(runs) {
  * enabled/disabled picture. Execution paths (`run`/`catchup`/`webhook`) keep
  * using `listAllJobs` so an un-materialised project routine can never fire.
  */
-function listJobsForDisplay(cwd) {
-    const jobs = listAllJobs(cwd);
-    const seen = new Set(jobs.map((j) => j.name));
-    for (const discovered of discoverProjectRoutines()) {
-        if (seen.has(discovered.name))
-            continue;
-        seen.add(discovered.name);
-        jobs.push(discovered.config);
-    }
-    return jobs;
-}
-export function buildRoutineListJson() {
-    try {
-        monitorRunningJobs();
-    }
-    catch { /* best-effort orphan reap */ }
-    const jobs = listJobsForDisplay(process.cwd());
-    if (jobs.length === 0)
-        return [];
-    const scheduler = new JobScheduler(async () => { });
-    scheduler.loadAll();
-    try {
-        const overdueSet = new Set();
-        try {
-            for (const job of detectOverdueJobs())
-                overdueSet.add(job.name);
-        }
-        catch {
-            // Best-effort indicator; never block the list on detection errors.
-        }
-        const now = new Date();
-        const knownProjectNames = new Set(listProjectDefs().map((project) => project.name));
-        return jobs.map((job) => {
-            const latestRun = localLatestRun(job);
-            const enabledDevices = devicesWithRoutineEnabled(job.name);
-            return {
-                name: job.name,
-                agent: job.agent ?? null,
-                workflow: job.workflow ?? null,
-                command: job.command ?? null,
-                repo: job.repo ?? null,
-                schedule: job.schedule ?? null,
-                scheduleHuman: fireConditionLabel(job),
-                trigger: job.trigger ?? null,
-                timezone: job.timezone ?? null,
-                devices: enabledDevices,
-                enabledDevices,
-                host: job.host ?? null,
-                hostStrategy: resolveHostStrategy(job),
-                source: job.source ?? null,
-                sourceRepo: job.source?.repo ?? job.repo ?? null,
-                sourceBranch: job.source?.branch ?? null,
-                runOnce: Boolean(job.runOnce),
-                catchup: job.catchup !== false,
-                oneShot: isOneShotRoutine(job),
-                expired: isPastOneShotRoutine(job, now),
-                runsHere: jobRunsOnThisDevice(job),
-                enabled: job.enabled,
-                overdue: overdueSet.has(job.name),
-                nextRun: nextRunForDisplay(job, scheduler)?.toISOString() ?? null,
-                nextRunHuman: nextRunLabel(job, scheduler, now),
-                lastStatus: latestRun?.status ?? null,
-                exitCode: latestRun?.exitCode ?? null,
-                failureReason: latestRun?.errorMessage ?? null,
-                lastRunStartedAt: latestRun?.startedAt ?? null,
-                lastRunCompletedAt: latestRun?.completedAt ?? null,
-                projects: job.projects ?? [],
-                projectGroup: computeProjectGroup(job.projects, knownProjectNames),
-            };
-        });
-    }
-    finally {
-        scheduler.stopAll();
-    }
-}
 /** Detect Ctrl+C or premature stream close during an interactive prompt. */
 function isPromptCancelled(err) {
     return (err instanceof Error &&
@@ -926,6 +803,12 @@ export function registerRoutinesCommands(program) {
       agents routines add drain --schedule "0 3 * * *" --agent claude --placement fleet --prompt "Drain queue"
       agents routines add review --schedule "0 9 * * 1" --agent claude --placement cloud --prompt "Review open PRs"
 
+      # Pin an exact installed version (same agent@version syntax as agents run)
+      agents routines add version-pin --schedule "*/5 * * * *" --agent claude@2.1.207 --cwd /path/to/repo --prompt "Reply OK"
+
+      # Per-routine selection strategy + health-aware fleet placement at each fire
+      agents routines add release-shepherd --schedule "*/5 * * * *" --agent claude --strategy balanced --run-on auto --cwd /path/to/repo --prompt "Own the release through verification"
+
       # Enable a routine (materialises a project routine on first enable)
       agents routines enable security-sweep
       agents routines disable security-sweep
@@ -934,7 +817,7 @@ export function registerRoutinesCommands(program) {
       agents routines list
 
       # List routines on a specific device
-      agents routines list --host yosemite-s0
+      agents routines list --device yosemite-s0
 
       # Create a routine restricted to specific devices
       agents routines add nightly --schedule "0 2 * * *" --agent claude --prompt "Summarize today's commits" --devices yosemite-s0,mac-mini
@@ -962,7 +845,15 @@ export function registerRoutinesCommands(program) {
       Version / credit failover (same semantics as 'agents run'):
         - Omit 'version:' to let the configured run strategy (default: balanced)
           pick a healthy install and skip accounts that are out of credits or
-          rate-limited. Pin with 'version: 2.1.x' when you want one install only.
+          rate-limited. Pin with '--agent claude@2.1.x' (or 'version:' in YAML)
+          when you want one install only; '--strategy pinned|available|balanced'
+          persists a per-routine selection policy that beats the firing box's
+          run.<agent>.strategy config.
+        - Three distinct device flags: '--devices a,b' is the scheduler FIRING
+          allowlist (which daemons may fire this routine); '--run-on <name|auto>'
+          is BODY placement (where the fired job executes — 'auto' re-picks a
+          healthy device at each fire); the parent '--device' manages the
+          routine DEFINITION on another machine.
         - Foreground 'agents routines run' re-dispatches to the next healthy
           same-agent account when a mid-run rate/usage limit is detected.
         - Detached/daemon fires use the pre-flight pick only (next tick re-selects).
@@ -1006,7 +897,9 @@ export function registerRoutinesCommands(program) {
         .command('add [nameOrPath]')
         .description('Create a new routine from a YAML file or inline flags. Starts the scheduler automatically if it is not already running.')
         .option('-s, --schedule <cron>', 'Cron schedule in standard format (5 fields: minute hour day month weekday)')
-        .option('-a, --agent <agent>', `Which agent runs this routine: ${ROUTINE_AGENT_IDS.join(', ')}`)
+        .option('-a, --agent <agent[@version]>', `Which agent runs this routine: ${ROUTINE_AGENT_IDS.join(', ')}. An @version pins that exact installed version (same syntax as agents run), persisted as separate agent + version fields.`)
+        .option('--strategy <strategy>', `Version/account selection strategy for this routine: ${RUN_STRATEGIES.join(' | ')}. Overrides run.<agent>.strategy from the firing device's config. Conflicts with an @version pin.`)
+        .option('--balanced', 'Shortcut for --strategy balanced.')
         .option('--workflow <name>', 'Run an installed workflow (~/.agents/workflows/<name>) via `agents run`. Mutually exclusive with --agent.')
         .option('--command <sh>', 'Run a plain shell command directly (no agent, no auth, no sandbox) — for deterministic housekeeping routines. Mutually exclusive with --agent and --workflow; --prompt is not used.')
         .option('-p, --prompt <prompt>', 'Task instruction for the agent')
@@ -1015,8 +908,8 @@ export function registerRoutinesCommands(program) {
         .option('-t, --timeout <timeout>', 'Kill the agent if it runs longer than this (e.g., 10m, 2h, 3d, 1w; max 1w)', '10m')
         .option('--timezone <tz>', 'Interpret schedule in this timezone (e.g., America/Los_Angeles)')
         .option('--devices <names>', 'Fleet allowlist (comma-separated): only listed devices schedule and fire this routine. Omit for unrestricted.')
-        .option('--run-on <name>', 'BODY placement: execute the job body on this machine over SSH (registered host, device, capability tag, or user@host). Sets hostStrategy=host. Same model as agents run --where device:<name> (docs/concepts.md#placement).')
-        .option('--placement <strategy>', `BODY placement strategy: ${HOST_STRATEGIES.join('|')} (default: local, or host when --run-on is set). Maps to the shared Placement model (local|device|fleet|cloud). Not the same as --host (which manages routines on a remote machine).`)
+        .option('--run-on <name|auto>', "BODY placement: execute the job body on this machine over SSH (registered host, device, capability tag, or user@host), or 'auto' to pick a healthy, signed-in, unloaded fleet device AT EACH FIRE — the same picker as agents run --device auto. Sets hostStrategy=host ('auto' sets fleet). Distinct from the parent --device (which manages this DEFINITION on another machine) and from --devices (the scheduler firing allowlist).")
+        .option('--placement <strategy>', `BODY placement strategy: ${HOST_STRATEGIES.join('|')} (default: local, or host when --run-on is set). Maps to the shared Placement model (local|device|fleet|cloud). Not the same as --device (which manages routines on a remote machine).`)
         .option('--run-cwd <dir>', 'Working directory on the --run-on host (--remote-cwd is taken by the remote-management passthrough)')
         .option('--at <time>', 'One-shot mode: run once at this time (e.g., "14:30" or "2026-02-24 09:00"), then disable')
         .option('--on <source:event>', 'Webhook trigger instead of/in addition to a schedule: github:pull_request or linear:Issue')
@@ -1084,12 +977,53 @@ export function registerRoutinesCommands(program) {
                 console.error(chalk.red('An agent, workflow, or command is required (use --agent, --workflow, or --command)'));
                 process.exit(1);
             }
-            // Hard-deprecated harnesses cannot be scheduled — refuse at create time so
-            // no new recurring job silently fails against a retired backend.
+            // Normalize `--agent <agent[@version]>` into separate bare agent +
+            // version fields, the same split `agents run` performs. Storing the raw
+            // compound string is the RUSH-2719 bug: validateJob compared
+            // 'claude@2.1.207' against bare AgentIds, and the deprecation gate below
+            // silently missed a hard-deprecated harness pinned with @version.
+            let parsedAgent;
             if (options.agent) {
-                const routineAgentId = resolveAgentName(options.agent);
-                if (routineAgentId && isAgentHardDeprecated(routineAgentId)) {
-                    console.error(chalk.red(hardDeprecationError(routineAgentId)));
+                const parsed = parseAgentVersionSpec(options.agent);
+                if ('error' in parsed) {
+                    console.error(chalk.red(parsed.error));
+                    process.exit(1);
+                }
+                parsedAgent = parsed;
+                // Hard-deprecated harnesses cannot be scheduled — refuse at create time
+                // so no new recurring job silently fails against a retired backend.
+                if (isAgentHardDeprecated(parsed.agent)) {
+                    console.error(chalk.red(hardDeprecationError(parsed.agent)));
+                    process.exit(1);
+                }
+            }
+            // --strategy / --balanced: per-routine selection policy, same vocabulary
+            // as agents run. Rejected (not warned) against an @version pin: a warning
+            // printed once at add time is easy to miss and the routine then silently
+            // runs pinned forever.
+            let strategy;
+            if (options.strategy !== undefined || options.balanced) {
+                if (options.strategy !== undefined && options.balanced) {
+                    console.error(chalk.red('--balanced conflicts with --strategy. Use one strategy override.'));
+                    process.exit(1);
+                }
+                if (!options.agent) {
+                    console.error(chalk.red('--strategy only applies to agent routines (set --agent)'));
+                    process.exit(1);
+                }
+                if (options.strategy !== undefined) {
+                    const normalized = normalizeRunStrategy(options.strategy);
+                    if (!normalized) {
+                        console.error(chalk.red(`Invalid strategy: ${options.strategy}. Use ${RUN_STRATEGIES.join(', ')}.`));
+                        process.exit(1);
+                    }
+                    strategy = normalized;
+                }
+                else {
+                    strategy = 'balanced';
+                }
+                if (parsedAgent?.version) {
+                    console.error(chalk.red(`--strategy ${strategy} conflicts with the @${parsedAgent.version} pin — an exact pin leaves nothing to select; drop --strategy or the @version pin`));
                     process.exit(1);
                 }
             }
@@ -1139,18 +1073,31 @@ export function registerRoutinesCommands(program) {
                 console.error(chalk.red(err.message));
                 process.exit(1);
             }
-            // --run-on implies host strategy when the user didn't pick one.
+            // --run-on implies host strategy when the user didn't pick one;
+            // 'auto' means fleet placement re-picked at each fire, never a literal
+            // SSH target named "auto".
             if (options.runOn && !hostStrategy)
-                hostStrategy = 'host';
+                hostStrategy = options.runOn === 'auto' ? 'fleet' : 'host';
+            if (options.runOn === 'auto' && hostStrategy !== 'fleet') {
+                console.error(chalk.red("--run-on auto is fleet placement — drop --placement, or use --placement fleet with it"));
+                process.exit(1);
+            }
             if (hostStrategy === 'host' && !options.runOn) {
                 console.error(chalk.red('--placement host requires --run-on <name>'));
                 process.exit(1);
             }
+            // No devices auto-pin is needed for off-box placement: under the
+            // per-device activation model (§8), a new routine is activated only on
+            // the creating machine's device manifest (setJobEnabled below), so
+            // exactly one daemon fires it unless it is deliberately enabled
+            // elsewhere — the double-fire guard is structural now.
             const config = {
                 name: nameOrPath,
                 ...(schedule ? { schedule } : {}),
                 ...(trigger ? { trigger } : {}),
-                ...(options.agent ? { agent: options.agent } : {}),
+                ...(parsedAgent ? { agent: parsedAgent.agent } : {}),
+                ...(parsedAgent?.version ? { version: parsedAgent.version } : {}),
+                ...(strategy ? { strategy } : {}),
                 ...(options.workflow ? { workflow: options.workflow } : {}),
                 ...(options.command ? { command: options.command } : {}),
                 mode: options.mode,
@@ -1405,6 +1352,8 @@ export function registerRoutinesCommands(program) {
         .option('--state-from <name>', 'Update the Linear previous-state filter before opening the editor')
         .option('--cwd <path>', 'Set the execution directory and save, without opening an editor')
         .option('--project-anchor <name>', 'Set the execution project anchor and save, without opening an editor')
+        .option('--agent <agent[@version]>', 'Set the agent (and optional exact version pin) and save, without opening an editor — same syntax as agents run')
+        .option('--strategy <strategy>', `Set the per-routine version/account selection strategy (${RUN_STRATEGIES.join(' | ')}) and save. Conflicts with an @version pin.`)
         .action(async (name, options) => {
         if (!name) {
             name = await pickJob('Select job to edit', undefined, ['agents routines edit <name>']) ?? undefined;
@@ -1418,7 +1367,7 @@ export function registerRoutinesCommands(program) {
         // and the only edit surface opened $EDITOR — so an agent could never
         // follow its own repair hint (RUSH-2517). Applying and saving directly is
         // what makes that hint true.
-        if (options.cwd !== undefined || options.projectAnchor !== undefined) {
+        if (options.cwd !== undefined || options.projectAnchor !== undefined || options.agent !== undefined || options.strategy !== undefined) {
             if (!existing) {
                 console.error(chalk.red(`Routine '${name}' not found. Create it first: agents routines add ${name} --schedule "..." --agent claude --prompt "..."`));
                 process.exit(1);
@@ -1427,6 +1376,32 @@ export function registerRoutinesCommands(program) {
                 existing.cwd = options.cwd;
             if (options.projectAnchor !== undefined)
                 existing.project = options.projectAnchor;
+            if (options.agent !== undefined) {
+                const parsed = parseAgentVersionSpec(options.agent);
+                if ('error' in parsed) {
+                    console.error(chalk.red(parsed.error));
+                    process.exit(1);
+                }
+                if (isAgentHardDeprecated(parsed.agent)) {
+                    console.error(chalk.red(hardDeprecationError(parsed.agent)));
+                    process.exit(1);
+                }
+                existing.agent = parsed.agent;
+                // An @version pin replaces any previous pin; a bare agent clears it so
+                // the routine returns to strategy/balanced selection.
+                if (parsed.version)
+                    existing.version = parsed.version;
+                else
+                    delete existing.version;
+            }
+            if (options.strategy !== undefined) {
+                const normalized = normalizeRunStrategy(options.strategy);
+                if (!normalized) {
+                    console.error(chalk.red(`Invalid strategy: ${options.strategy}. Use ${RUN_STRATEGIES.join(', ')}.`));
+                    process.exit(1);
+                }
+                existing.strategy = normalized;
+            }
             const errors = validateJob(existing);
             if (errors.length > 0) {
                 console.error(chalk.red('Validation errors:'));
@@ -2042,7 +2017,7 @@ export function registerRoutinesCommands(program) {
                         signalDaemonReload();
                     continue;
                 }
-                const launch = getCliLaunch(['routines', action, name, '--host', device]);
+                const launch = getCliLaunch(['routines', action, name, '--device', device]);
                 const result = spawnSync(launch.command, launch.args, { stdio: 'inherit', env: process.env });
                 if ((result.status ?? 1) !== 0) {
                     if (isTarget) {
@@ -2261,7 +2236,7 @@ export function registerRoutinesCommands(program) {
             console.log(chalk.gray('No scheduler logs'));
         }
     });
-    // Every direct routines subcommand accepts the shared --host family so remote
+    // Every direct routines subcommand accepts the shared --device family so remote
     // fall-through works and each subcommand's --help documents the flags.
     for (const sub of routinesCmd.commands) {
         addHostOption(sub);

package/dist/commands/rules.js

@@ -8,7 +8,7 @@ import { AGENTS, agentConfigDirName, MANAGED_AGENT_IDS, resolveAgentName, format
 import { capableAgents } from '../lib/capabilities.js';
 import { cloneRepo } from '../lib/git.js';
 import { discoverInstructionsFromRepo, discoverRuleFilesFromRepo, installInstructionsCentrally, uninstallInstructions, listInstalledInstructionsWithScope, instructionsExists, getInstructionsContent, listCentralRules, } from '../lib/rules/rules.js';
-import { listInstalledVersions, getGlobalDefault, resolveVersionAlias, syncResourcesToVersion, promptAgentVersionSelection, getVersionHomePath, } from '../lib/versions.js';
+import { listInstalledVersions, getGlobalDefault, resolveVersionAlias, syncResourcesToVersion, promptAgentVersionSelection, getVersionHomePath, } from '../lib/installations/versions.js';
 import { recordVersionResources, getActiveRulesPreset, setActiveRulesPreset } from '../lib/state.js';
 import { discoverRulesLayers } from '../lib/rules/compose.js';
 import * as yaml from 'yaml';

package/dist/commands/run-account-picker.d.ts

@@ -1,5 +1,5 @@
 import type { AgentId } from '../lib/types.js';
-import { type RotateCandidate } from '../lib/rotate.js';
+import { type RotateCandidate } from '../lib/accounting/rotate.js';
 export interface RunAccountChoice {
     name: string;
     value: string;

package/dist/commands/run-account-picker.js

@@ -2,8 +2,8 @@ import { select } from '@inquirer/prompts';
 import chalk from 'chalk';
 import { agentLabel } from '../lib/agents.js';
 import { loginHint } from '../lib/signin-badge.js';
-import { collectRunCandidates, readinessFromCandidate, isSignInRecoverable, } from '../lib/rotate.js';
-import { compareVersions, getGlobalDefault } from '../lib/versions.js';
+import { collectRunCandidates, readinessFromCandidate, isSignInRecoverable, } from '../lib/accounting/rotate.js';
+import { compareVersions, getGlobalDefault } from '../lib/installations/versions.js';
 import { isInteractiveTerminal, isPromptCancelled, requireInteractiveSelection } from './utils.js';
 const CANCEL_SELECTION = '__agents_cancel_account_selection__';
 const WINDOW_ORDER = ['session', 'week', 'sonnet_week', 'month'];

package/dist/commands/run-broadcast.d.ts

@@ -0,0 +1,21 @@
+/**
+ * `agents run --broadcast` — run the same task/prompt across an agent × model
+ * matrix (formerly `agents bench`).
+ *
+ * Task definitions live under apps/cli/bench/tasks/<id>/task.json.
+ */
+export interface BroadcastOpts {
+    listTasks?: boolean;
+    results?: string | true;
+    task?: string;
+    model?: string;
+    concurrency?: string;
+    json?: boolean;
+    /** Comma-separated agents from the run [agent] positional when broadcasting. */
+    agentsCsv?: string;
+    prompt?: string;
+    /** When true, run the matrix (not just list/results). */
+    requireRun?: boolean;
+}
+/** Handle --broadcast / --list-tasks / --results on `agents run`. Always completes the path. */
+export declare function handleBroadcast(opts: BroadcastOpts): Promise<void>;

package/dist/commands/run-broadcast.js

@@ -0,0 +1,89 @@
+/**
+ * `agents run --broadcast` — run the same task/prompt across an agent × model
+ * matrix (formerly `agents bench`).
+ *
+ * Task definitions live under apps/cli/bench/tasks/<id>/task.json.
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+import { fileURLToPath } from 'url';
+import { detectSignedInRuntimes } from '../lib/crabbox/runtimes.js';
+import { listRuns, loadRun, loadTask, runCells, saveRun, } from '../lib/bench/index.js';
+const TASKS_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../../bench/tasks');
+function csv(value) {
+    return (value
+        ?.split(',')
+        .map((item) => item.trim())
+        .filter(Boolean) ?? []);
+}
+function taskIds(root = TASKS_ROOT) {
+    if (!fs.existsSync(root))
+        return [];
+    return fs
+        .readdirSync(root, { withFileTypes: true })
+        .filter((entry) => entry.isDirectory() &&
+        fs.existsSync(path.join(root, entry.name, 'task.json')))
+        .map((entry) => entry.name)
+        .sort();
+}
+function renderResult(result) {
+    console.log(`Run ${result.run_id}${result.task_id ? ` · ${result.task_id}` : ''}`);
+    for (const cell of result.cells)
+        console.log(`${cell.status === 'passed' ? 'PASS' : 'FAIL'}  ${cell.agent}${cell.model ? `/${cell.model}` : ''}  ${cell.wall_ms} ms  exit ${cell.exit ?? 'spawn-error'}`);
+}
+/** Handle --broadcast / --list-tasks / --results on `agents run`. Always completes the path. */
+export async function handleBroadcast(opts) {
+    if (opts.listTasks) {
+        const tasks = taskIds();
+        if (opts.json)
+            console.log(JSON.stringify(tasks, null, 2));
+        else if (tasks.length === 0)
+            console.log('No broadcast tasks installed.');
+        else
+            tasks.forEach((id) => console.log(id));
+        return;
+    }
+    if (opts.results !== undefined) {
+        const runId = opts.results === true ? undefined : opts.results;
+        const value = runId ? loadRun(runId) : listRuns();
+        if (opts.json)
+            console.log(JSON.stringify(value, null, 2));
+        else if (Array.isArray(value)) {
+            if (value.length === 0)
+                console.log('No broadcast results yet.');
+            else
+                value.forEach(renderResult);
+        }
+        else
+            renderResult(value);
+        return;
+    }
+    if (!opts.requireRun) {
+        throw new Error('Pass --broadcast with a prompt or --task <id>, or use --list-tasks / --results.');
+    }
+    if (!!opts.task === !!opts.prompt) {
+        throw new Error('Pass exactly one of --task <id> or a prompt with --broadcast.');
+    }
+    const task = opts.task ? loadTask(opts.task, TASKS_ROOT) : undefined;
+    const prompt = opts.prompt ?? task.prompt;
+    let agents = csv(opts.agentsCsv);
+    if (agents.length === 0) {
+        agents = (await detectSignedInRuntimes())
+            .filter((runtime) => runtime.signedIn)
+            .map((runtime) => runtime.id);
+    }
+    if (agents.length === 0) {
+        throw new Error('No signed-in native agents found. Pass comma-separated agents: agents run --broadcast claude,codex "…"');
+    }
+    const models = csv(opts.model);
+    const cells = agents.flatMap((agent) => models.length > 0 ? models.map((model) => ({ agent, model })) : [{ agent }]);
+    const concurrency = Number(opts.concurrency ?? '3');
+    const result = await runCells({ task, prompt, cells, concurrency });
+    saveRun(result);
+    if (opts.json)
+        console.log(JSON.stringify(result, null, 2));
+    else
+        renderResult(result);
+    if (result.cells.some((cell) => cell.status === 'failed'))
+        process.exitCode = 1;
+}

package/dist/commands/run-cloud.js

@@ -1,7 +1,7 @@
 /**
  * `agents run <agent> [prompt] --cloud` — the vendor-cloud placement for a run.
  *
- * One of three run placements: local (default), machine (--host/--device,
+ * One of three run placements: local (default), machine (--device,
  * --lease), cloud (--cloud). Routing goes through the cloud provider registry
  * exactly like `agents cloud run --agent <agent>`: the agent's native
  * `cloudProvider` wins, `--provider` overrides. The dispatch itself is the

package/dist/commands/secrets-vault.d.ts

@@ -0,0 +1,10 @@
+/**
+ * `agents secrets vault` — unlock/lock the age-encrypted synced-secrets file
+ * at ~/.agents/vault.age (distinct from `agents secrets unlock|lock`, which
+ * holds keychain bundles in the secrets-agent).
+ *
+ * Formerly top-level `agents login` / `agents logout`.
+ */
+import type { Command } from 'commander';
+/** Register `agents secrets vault unlock|lock` under the secrets parent. */
+export declare function registerSecretsVaultCommands(secretsCmd: Command): void;