@phnx-labs/agents-cli 1.22.39 → 1.22.41

package/dist/lib/browser/sessions-list.d.ts

@@ -1,3 +1,5 @@
+import { formatBytes } from '../format.js';
+export { formatBytes };
 import type { SessionMeta } from '../session/types.js';
 export type ArtifactKind = 'screenshot' | 'pdf' | 'recording' | 'download';
 export interface BrowserArtifact {
@@ -20,7 +22,6 @@ export declare function listProfileArtifacts(profile: string): BrowserArtifact[]
  * when empty); otherwise every profile dir on disk that has at least one capture.
  */
 export declare function listBrowserSessions(only?: string): ProfileArtifacts[];
-export declare function formatBytes(n: number): string;
 /** Per-kind counts over a flat artifact list — shared by the printed table and
  *  the interactive row labels. */
 export declare function countByKind(artifacts: BrowserArtifact[]): Record<ArtifactKind, number>;

package/dist/lib/browser/sessions-list.js

@@ -15,6 +15,9 @@
  * `feed-post.ts` `resolvePostIdentity`), never a second parser.
  */
 import * as fs from 'fs';
+import { formatBytes } from '../format.js';
+// Re-exported for the picker, which lists artifacts from this module's rows.
+export { formatBytes };
 import * as path from 'path';
 import { spawnSync } from 'child_process';
 import { getBrowserRuntimeDir, getProfileRuntimeDir } from './profiles.js';
@@ -22,7 +25,7 @@ import { formatRelativeTime } from '../session/relative-time.js';
 import { getSessionById, listBrowserSessionRecords, pruneToolSessions } from '../session/db.js';
 import { listPidSessionEntries } from '../session/pid-registry.js';
 import { loadHookSessionIndex } from '../session/hook-sessions.js';
-import { readRecentActivity } from '../activity.js';
+import { readRecentActivity } from '../feed/activity.js';
 const EXT_KIND = {
     '.png': 'screenshot',
     '.jpg': 'screenshot',
@@ -113,18 +116,6 @@ export function listBrowserSessions(only) {
         .map((p) => ({ profile: p, artifacts: listProfileArtifacts(p) }))
         .filter((r) => !!only || r.artifacts.length > 0);
 }
-export function formatBytes(n) {
-    if (n < 1024)
-        return `${n} B`;
-    const units = ['KB', 'MB', 'GB'];
-    let val = n / 1024;
-    let i = 0;
-    while (val >= 1024 && i < units.length - 1) {
-        val /= 1024;
-        i++;
-    }
-    return `${val < 10 ? val.toFixed(1) : Math.round(val)} ${units[i]}`;
-}
 /** Per-kind counts over a flat artifact list — shared by the printed table and
  *  the interactive row labels. */
 export function countByKind(artifacts) {

package/dist/lib/browser/types.d.ts

@@ -1,4 +1,4 @@
-export type BrowserType = 'chrome' | 'comet' | 'chromium' | 'brave' | 'edge' | 'custom';
+export type BrowserType = 'chrome' | 'comet' | 'chromium' | 'brave' | 'edge' | 'arc' | 'custom';
 /**
  * A single named endpoint preset within a profile. Lets one profile cover
  * the local + remote variants of the same app (e.g. an Electron app on this
@@ -72,7 +72,18 @@ export interface ChromeOptions {
 }
 export interface Task {
     id: string;
+    /**
+     * Unique addressable handle used as the tasks map key, capture-dir name, and
+     * the value agents export as `$AGENTS_BROWSER_TASK`. Prefer the short `id`
+     * for auto-generated tasks; an explicit `--task` name still wins.
+     */
     name: string;
+    /**
+     * Human-readable label for `browser status`. Derived once from `--title`,
+     * else the first navigated host, else `untitled`. Distinct from `name` so a
+     * short machine id can stay addressable while status stays readable.
+     */
+    label?: string;
     profile: string;
     tabs: Record<string, string>;
     currentTabId?: string;
@@ -142,6 +153,8 @@ export interface ProfileStatus {
 export interface TaskStatus {
     id: string;
     name: string;
+    /** Human label for status tables; falls back to name when absent. */
+    label?: string;
     tabCount: number;
     currentTabId?: string;
     createdAt: number;
@@ -232,6 +245,11 @@ export interface IPCRequest {
     until?: string;
     appLevel?: string;
     skipDomainSkill?: boolean;
+    /**
+     * Explicit human label for a new task (`agents browser start --title …`).
+     * When omitted, the label is derived from the first navigated host.
+     */
+    title?: string;
     /**
      * Browser start: always open a new tab. Without it, `start --url` reclaims a
      * tab that an ABANDONED task is still holding on this exact URL rather than

package/dist/lib/budget/config.js

@@ -8,7 +8,7 @@
  * `per_day`/`per_project`/`per_agent` rather than wiping them.
  *
  * This is the single resolver the pre-flight gate, the live watcher, and the
- * `agents budget` command all route through, so the effective cap set is
+ * `agents config budget` command all route through, so the effective cap set is
  * computed in exactly one place.
  */
 import * as fs from 'fs';

package/dist/lib/budget/ledger.js

@@ -3,7 +3,7 @@
  *
  * Every dispatched run that produces token usage records one JSONL line under
  * `<history>/spend/ledger.jsonl`. The ledger is the shared artifact #323's
- * `agents cost` can later read for $ rollups, so the entry shape stays clean
+ * `agents insights cost` can later read for $ rollups, so the entry shape stays clean
  * and stable: one record = one usage observation attributed to a run.
  *
  * `costUsd` is computed at write time via the canonical pricing module

package/dist/lib/byok-usage.js

@@ -8,7 +8,7 @@
  * API rather than the CLI's own usage tracking.
  */
 import { hasKeychainToken, getKeychainToken } from './secrets/profiles.js';
-import { renderBar, getUsageColor } from './usage.js';
+import { renderBar, getUsageColor } from './accounting/usage.js';
 import * as fs from 'node:fs';
 import * as path from 'node:path';
 import { createHash } from 'node:crypto';

package/dist/lib/capabilities.js

@@ -8,21 +8,9 @@
  * reason instead of silently corrupting an older binary's settings file.
  */
 import { AGENTS, MANAGED_AGENT_IDS } from './agents.js';
-/**
- * Compare semver-like versions ("0.116.0" vs "0.115.9"). Local copy to avoid
- * importing versions.ts (which imports agents.ts, which imports this file).
- */
-function compareVersions(a, b) {
-    const aParts = a.split('.').map((n) => parseInt(n, 10) || 0);
-    const bParts = b.split('.').map((n) => parseInt(n, 10) || 0);
-    for (let i = 0; i < Math.max(aParts.length, bParts.length); i++) {
-        const aVal = aParts[i] || 0;
-        const bVal = bParts[i] || 0;
-        if (aVal !== bVal)
-            return aVal - bVal;
-    }
-    return 0;
-}
+// agent-spec/primitives is a leaf module — importing it creates no cycle, and it
+// is the only compareVersions that honors OpenClaw's `-N` rebuild suffix.
+import { compareVersions } from './agent-spec/primitives.js';
 function getCapability(agent, cap) {
     // Guard against unknown agent ids (e.g. a caller passing "claude@2.1.168"
     // instead of "claude"). Without this, AGENTS[agent] is undefined and the

package/dist/lib/catchup.d.ts

@@ -34,7 +34,7 @@
  * human running `agents routines catchup` — which neither an in-process flag
  * nor `withFileLock` (synchronous; this pass awaits a spawn) can cover.
  */
-import { type JobConfig, type RunMeta } from './routines.js';
+import { type JobConfig, type RunMeta } from './scheduling/routines.js';
 import { type OverdueJob } from './overdue.js';
 /** What happened to one overdue routine on a catch-up pass. */
 export interface CatchupOutcome {

package/dist/lib/catchup.js

@@ -36,7 +36,7 @@
  */
 import * as fs from 'fs';
 import * as path from 'path';
-import { readJob, writeRunMeta, getRunDir, } from './routines.js';
+import { readJob, writeRunMeta, getRunDir, } from './scheduling/routines.js';
 import { detectOverdueJobs } from './overdue.js';
 import { executeJobDetached } from './runner.js';
 /**

package/dist/lib/cloud/dispatch.js

@@ -15,7 +15,7 @@ import { die } from '../format.js';
 import { insertTask, updateTaskStatus } from './store.js';
 import { renderStream } from './stream.js';
 import { MissingTargetError, MAX_IMAGES_PER_DISPATCH } from './types.js';
-import { emit } from '../events.js';
+import { emit } from '../feed/events.js';
 import { shareRuntimeEnv } from '../share/config.js';
 /** Map a supported image file extension to its wire mimeType. Rejects anything else. */
 function imageMimeFromPath(file) {

package/dist/lib/cloud/host.d.ts

@@ -2,8 +2,8 @@
  * Host cloud provider — your own machines as a task-execution backend.
  *
  * A thin adapter over the hosts subsystem (lib/hosts/*): `agents cloud run
- * --provider host --host <name>` dispatches through the SAME detached-SSH
- * launch as `agents run --host`, and the resulting task shows up in BOTH
+ * --provider host --device <name>` dispatches through the SAME detached-SSH
+ * launch as `agents run --device`, and the resulting task shows up in BOTH
  * `agents cloud ps` and `agents devices ps` — one store (the host-task sidecars
  * under ~/.agents/.cache/hosts/), two views. No new transport, no relay: SSH
  * is the only wire, exactly like the rest of the hosts design (docs/hosts.md).
@@ -43,7 +43,7 @@ export declare class HostCloudProvider implements CloudProvider {
      */
     private reconcileMemoized;
     /**
-     * Offset-tail the remote log (the same one-round-trip fetch the `run --host`
+     * Offset-tail the remote log (the same one-round-trip fetch the `run --device`
      * follow uses) and yield it as `text` events until the `.exit` file lands.
      */
     stream(taskId: string): AsyncIterable<CloudEvent>;

package/dist/lib/cloud/host.js

@@ -2,8 +2,8 @@
  * Host cloud provider — your own machines as a task-execution backend.
  *
  * A thin adapter over the hosts subsystem (lib/hosts/*): `agents cloud run
- * --provider host --host <name>` dispatches through the SAME detached-SSH
- * launch as `agents run --host`, and the resulting task shows up in BOTH
+ * --provider host --device <name>` dispatches through the SAME detached-SSH
+ * launch as `agents run --device`, and the resulting task shows up in BOTH
  * `agents cloud ps` and `agents devices ps` — one store (the host-task sidecars
  * under ~/.agents/.cache/hosts/), two views. No new transport, no relay: SSH
  * is the only wire, exactly like the rest of the hosts design (docs/hosts.md).
@@ -77,7 +77,7 @@ export class HostCloudProvider {
     async dispatch(options) {
         const hostName = options.providerOptions?.host;
         if (!hostName) {
-            throw new MissingTargetError('host', 'No host given. Pass --host <name> (a registered host, a device, a capability tag, or user@host).', 'List your machines: agents devices list  ·  register more: agents devices sync');
+            throw new MissingTargetError('host', 'No host given. Pass --device <name> (a registered host, a device, a capability tag, or user@host).', 'List your machines: agents devices list  ·  register more: agents devices sync');
         }
         if (resolveDispatchRepos(options).length > 0) {
             throw new Error('--repo has no meaning for --provider host — the run executes in a directory on the machine, not a cloned repo. ' +
@@ -131,7 +131,7 @@ export class HostCloudProvider {
         return updateTask(task.id, terminalPatch(st.code)) ?? task;
     }
     /**
-     * Offset-tail the remote log (the same one-round-trip fetch the `run --host`
+     * Offset-tail the remote log (the same one-round-trip fetch the `run --device`
      * follow uses) and yield it as `text` events until the `.exit` file lands.
      */
     async *stream(taskId) {
@@ -193,7 +193,7 @@ export class HostCloudProvider {
             throw new Error(`Unknown host task: ${taskId}`);
         if (!task.sessionId) {
             throw new Error(`Host task ${taskId} has no session id to resume (only Claude runs capture one). ` +
-                `Start a follow-up run instead: agents run ${task.agent} "<prompt>" --host ${task.host}`);
+                `Start a follow-up run instead: agents run ${task.agent} "<prompt>" --device ${task.host}`);
         }
         const host = await resolveHostRunTarget(task.host);
         await dispatchPromptToHost(host, {

package/dist/lib/cloud/rush.d.ts

@@ -5,30 +5,26 @@
  * Requires the Rush GitHub App installed on the target repo.
  */
 import type { CloudProvider, CloudTask, CloudTaskStatus, CloudEvent, DispatchOptions, ProviderCapabilities, ImageAttachment, SkillRef } from './types.js';
-export declare const RUSH_CONSENT_PATH: string;
-export declare function hasRushUploadConsent(accountFingerprint: string, opts?: DispatchOptions, consentPath?: string): boolean;
 /** One version's entry in the account manifest sent on every dispatch. */
 export interface AccountManifestEntry {
     version: string;
     email: string;
-    cred_fp: string;
 }
 /**
- * Manifest of the user's local Claude accounts. Sent on every dispatch so the
- * server can detect "new account" or "token rotated" drift and ask the client
- * to upload the underlying credentials. The manifest itself contains no
- * secrets — only public-ish identifiers + a hash of each token.
+ * Manifest of the user's local Claude accounts (version + account email only).
+ * Sent on a non-balanced dispatch so the server knows which accounts exist and
+ * can route to one. It carries **no credential material** and does NOT read the
+ * native OAuth login (RUSH-2527 / SING-1b): agents-cli never reads a harness's
+ * interactive login to build this. When the server asks for the underlying token
+ * (a new account, or a rotation it can't otherwise resolve), the client does NOT
+ * upload it — there is no consented path to copy a native OAuth login to the
+ * cloud. Dispatch fails loud and steers to a portable provider account instead
+ * (see the 401 handler in `dispatch()`).
  */
 export interface AccountManifest {
     fp: string;
     versions: AccountManifestEntry[];
 }
-/** Token blob uploaded on retry when the server detects drift. */
-export interface AccountTokenEntry {
-    version: string;
-    /** Stringified OAuth credentials JSON (Mac: keychain blob; Linux: .credentials.json). */
-    credentials_json: string;
-}
 /**
  * Read the raw OAuth credentials for one Claude version. On Mac, prefer the
  * Keychain blob (canonical). On Linux/CI, fall back to `.claude/.credentials.json`
@@ -53,13 +49,6 @@ export declare function readClaudeCredentialsBlob(home: string): Promise<string
  * to the platform-wide key, current behavior).
  */
 export declare function buildAccountManifest(strategy?: string): Promise<AccountManifest | null>;
-/**
- * Re-load OAuth blobs for the given versions so they can be uploaded to the
- * server on a retry. Only the versions named in the manifest are loaded — we
- * never upload tokens for versions the server hasn't asked about.
- */
-export declare function buildAccountTokensPayload(versions: string[]): Promise<AccountTokenEntry[]>;
-export declare function accountTokensFingerprint(tokens: AccountTokenEntry[]): string;
 /**
  * Build the POST body for /api/v1/cloud-runs. Exported so tests can verify
  * the back-compat shape (singular fields + repos[]) without needing real
@@ -77,7 +66,6 @@ export declare function buildDispatchBody(input: {
         repo_name: string;
     }>;
     accountManifest?: AccountManifest | null;
-    accountTokens?: AccountTokenEntry[] | null;
     /**
      * Skill ride-alongs so the cloud pod isn't context-blind. Forwarded verbatim
      * as `skills` so the Factory Floor can mount them by id/version before the

package/dist/lib/cloud/rush.js

@@ -9,53 +9,14 @@ import * as path from 'path';
 import * as os from 'os';
 import * as crypto from 'crypto';
 import * as yaml from 'yaml';
-import { getCloudDir } from '../state.js';
 import { resolveDispatchRepos, normalizeProviderStatus, MAX_IMAGES_PER_DISPATCH } from './types.js';
 import { parseSSE } from './stream.js';
-import { listInstalledVersions, getVersionHomePath } from '../versions.js';
+import { listInstalledVersions, getVersionHomePath } from '../installations/versions.js';
 import { getAccountInfo } from '../agents.js';
-import { loadClaudeOauth } from '../usage.js';
-import { selectBalancedVersion } from '../rotate.js';
+import { loadClaudeOauth } from '../accounting/usage.js';
+import { selectBalancedVersion } from '../accounting/rotate.js';
 const PROXY_BASE = process.env.RUSH_PROXY_BASE ?? 'https://api.prix.dev';
-const PROXY_HOST = new URL(PROXY_BASE).host;
 const USER_YAML = path.join(os.homedir(), '.rush', 'user.yaml');
-// Persistent consent record for uploading Claude OAuth blobs to Rush Cloud.
-// Created on first explicit consent (env var or flag); subsequent dispatches
-// see it and proceed without re-prompting.
-export const RUSH_CONSENT_PATH = path.join(getCloudDir(), 'rush-consent.json');
-const RUSH_CONSENT_ENV = 'AGENTS_RUSH_UPLOAD_TOKENS';
-export function hasRushUploadConsent(accountFingerprint, opts, consentPath = RUSH_CONSENT_PATH) {
-    if (process.env[RUSH_CONSENT_ENV] === '1')
-        return true;
-    const po = opts?.providerOptions;
-    if (po?.uploadAccountTokens === true)
-        return true;
-    try {
-        if (!fs.existsSync(consentPath))
-            return false;
-        const body = JSON.parse(fs.readFileSync(consentPath, 'utf-8'));
-        return body.host === PROXY_HOST && body.account_fingerprint === accountFingerprint;
-    }
-    catch {
-        return false;
-    }
-}
-function recordRushUploadConsent(grantedBy, accountFingerprint) {
-    try {
-        fs.mkdirSync(path.dirname(RUSH_CONSENT_PATH), { recursive: true });
-        const body = {
-            granted_at: new Date().toISOString(),
-            granted_by: grantedBy,
-            host: PROXY_HOST,
-            account_fingerprint: accountFingerprint,
-        };
-        fs.writeFileSync(RUSH_CONSENT_PATH, JSON.stringify(body, null, 2), { mode: 0o600 });
-    }
-    catch {
-        // Non-fatal: consent persistence is a UX optimization, not a security
-        // boundary. Worst case, the user is asked to consent again next dispatch.
-    }
-}
 /** Read the Rush session access token from ~/.rush/user.yaml. */
 function readToken() {
     if (!fs.existsSync(USER_YAML)) {
@@ -217,40 +178,24 @@ export async function buildAccountManifest(strategy) {
         }));
         candidateVersions = rows.filter((r) => r !== null);
     }
-    const entries = [];
-    for (const { version, email } of candidateVersions) {
-        const home = getVersionHomePath('claude', version);
-        const blob = await readClaudeCredentialsBlob(home);
-        if (!blob)
-            continue;
-        entries.push({ version, email, cred_fp: sha256(blob) });
-    }
+    // RUSH-2527 / SING-1b: do NOT read the native OAuth login to fingerprint it.
+    // The manifest carries version + account email only — enough for the server to
+    // route to an account. If the server needs the token itself, the client does NOT
+    // upload it (there is no consented path to copy a native OAuth login to the
+    // cloud); dispatch fails loud and steers to a portable provider account.
+    const entries = candidateVersions
+        .map(({ version, email }) => ({ version, email }))
+        .sort((a, b) => a.version.localeCompare(b.version));
     if (entries.length === 0)
         return null;
-    entries.sort((a, b) => a.version.localeCompare(b.version));
     const fp = sha256(JSON.stringify(entries));
     return { fp, versions: entries };
 }
-/**
- * Re-load OAuth blobs for the given versions so they can be uploaded to the
- * server on a retry. Only the versions named in the manifest are loaded — we
- * never upload tokens for versions the server hasn't asked about.
- */
-export async function buildAccountTokensPayload(versions) {
-    const out = [];
-    for (const version of versions) {
-        const home = getVersionHomePath('claude', version);
-        const blob = await readClaudeCredentialsBlob(home);
-        if (!blob)
-            continue;
-        out.push({ version, credentials_json: blob });
-    }
-    return out;
-}
-export function accountTokensFingerprint(tokens) {
-    const canonical = [...tokens].sort((a, b) => a.version.localeCompare(b.version));
-    return sha256(JSON.stringify(canonical));
-}
+// buildAccountTokensPayload / accountTokensFingerprint (which read every installed
+// Claude version's native OAuth token to upload it to the cloud) were REMOVED —
+// SING-1b forbids reading or transferring a native OAuth / session login, even
+// with consent. Cloud dispatch under a native login now fails loud and steers to a
+// portable provider account (see the 401 handler in dispatch()).
 /**
  * Build the POST body for /api/v1/cloud-runs. Exported so tests can verify
  * the back-compat shape (singular fields + repos[]) without needing real
@@ -277,9 +222,6 @@ export function buildDispatchBody(input) {
     if (input.accountManifest) {
         body.account_manifest = input.accountManifest;
     }
-    if (input.accountTokens && input.accountTokens.length > 0) {
-        body.account_tokens = input.accountTokens;
-    }
     if (input.skills && input.skills.length > 0) {
         body.skills = input.skills;
     }
@@ -364,56 +306,27 @@ export class RushCloudProvider {
             env: options.env,
         });
         let res = await api('POST', '/api/v1/cloud-runs', token, body);
-        // Server detects drift (new account or rotated token) by comparing the
-        // manifest's fp against what's stored. It returns 401 with a prompt_code
-        // telling the client to re-upload the actual token blobs and retry once.
+        // The server asks the client to upload the underlying Claude OAuth token when
+        // it detects a new account or a rotation (401 + prompt_code). agents-cli NEVER
+        // reads or transfers a native OAuth / session login off this machine — not
+        // even with consent (SING-1b): a rotating token copied to the cloud is
+        // invalidated on its next refresh and logs the fleet out. Fail loud and steer
+        // to a portable provider account instead of exfiltrating the login.
         if (res.status === 401 && accountManifest) {
             const errBody = await res.clone().text();
             const promptCode = parsePromptCode(errBody);
             if (promptCode === 'NEW_ACCOUNT' || promptCode === 'TOKEN_ROTATED') {
-                const accountTokens = await buildAccountTokensPayload(accountManifest.versions.map((v) => v.version));
-                const accountFingerprint = accountTokensFingerprint(accountTokens);
-                // Refuse to silently exfiltrate Claude OAuth credentials. The retry
-                // path below reads accessToken+refreshToken from every installed
-                // Claude version and POSTs them to api.prix.dev. That's an explicit
-                // data-flow decision the user has to opt into.
-                if (!hasRushUploadConsent(accountFingerprint, options)) {
-                    throw new Error([
-                        `Rush Cloud asked to sync your Claude credentials (reason: ${promptCode.toLowerCase()}).`,
-                        `This would upload accessToken + refreshToken from every installed Claude version`,
-                        `to ${PROXY_BASE} so Factory Floor pods can act as your Anthropic account.`,
-                        ``,
-                        `To consent, re-run with one of:`,
-                        `  AGENTS_RUSH_UPLOAD_TOKENS=1 agents cloud run ...`,
-                        `  agents cloud run --upload-account-tokens ...`,
-                        ``,
-                        `Consent will be recorded at ${RUSH_CONSENT_PATH} so you won't be asked again.`,
-                        `Remove that file to revoke.`,
-                    ].join('\n'));
-                }
-                // Always-on stderr notice (no isTTY gate). Scripts and CI need to see
-                // this in their captured stderr / logs.
-                const grantedBy = process.env[RUSH_CONSENT_ENV] === '1' ? 'env'
-                    : options.providerOptions?.uploadAccountTokens === true ? 'flag'
-                        : 'manual';
-                process.stderr.write(`[rush] uploading ${accountTokens.length} account token(s) to ${PROXY_HOST}\n`);
-                const retryBody = buildDispatchBody({
-                    agent: options.agent,
-                    prompt: options.prompt,
-                    mode: options.providerOptions?.mode,
-                    resolvedRepos,
-                    accountManifest,
-                    accountTokens,
-                    skills: options.skills,
-                    images: options.images,
-                    env: options.env,
-                });
-                res = await api('POST', '/api/v1/cloud-runs', token, retryBody);
-                // Persist consent on first successful upload so we don't re-prompt
-                // every time tokens rotate.
-                if (res.ok && grantedBy !== 'manual') {
-                    recordRushUploadConsent(grantedBy, accountFingerprint);
-                }
+                throw new Error([
+                    `Rush Cloud asked to sync your Claude login (reason: ${promptCode.toLowerCase()}), but`,
+                    `agents-cli never copies a native OAuth / session login off this machine (SING-1b) —`,
+                    `a rotating token uploaded to the cloud is invalidated on its next refresh.`,
+                    ``,
+                    `Portable provider accounts can run locally or on a pinned fleet device, but cloud`,
+                    `placement does not securely inject them yet. Create and sync one with:`,
+                    `    agents accounts add <name> --provider anthropic --auth api-key    # or: --auth setup-token`,
+                    `    agents accounts sync <name> <device>`,
+                    `then run locally or on that device with --account <name>. See docs/credential-management.md (SING-1b).`,
+                ].join('\n'));
             }
         }
         if (!res.ok) {

package/dist/lib/cloud/types.d.ts

@@ -5,7 +5,7 @@
  * Factory) implement, plus the shared task and event types that flow through
  * the dispatch pipeline.
  */
-import type { JobTrigger } from '../routines.js';
+import type { JobTrigger } from '../scheduling/routines.js';
 /**
  * Identifier for a supported cloud dispatch backend.
  *
@@ -19,7 +19,7 @@ import type { JobTrigger } from '../routines.js';
  *
  * Agents route to their native cloud automatically (see `cloudProvider` in the
  * agent registry); `--provider` overrides. Nothing auto-routes to `host` — it
- * is always an explicit `--provider host` (or `--host <name>`) choice.
+ * is always an explicit `--provider host` (or `--device <name>`) choice.
  */
 export type CloudProviderId = 'rush' | 'codex' | 'factory' | 'antigravity' | 'cursor' | 'host';
 /**

package/dist/lib/commands.js

@@ -7,6 +7,7 @@
  * agent version homes.
  */
 import * as fs from 'fs';
+import { compareVersions } from './agent-spec/primitives.js';
 import * as path from 'path';
 import * as yaml from 'yaml';
 import { AGENTS, ensureCommandsDir, agentConfigDirName, resolveAgentName } from './agents.js';
@@ -15,21 +16,10 @@ import { isDirectoryDoc } from './resources.js';
 import { normalizeAliases } from './resource-aliases.js';
 import { markdownToToml } from './convert.js';
 import { getCommandsDir, getUserCommandsDir, getEnabledExtraRepos, getProjectAgentsDir, getSkillsDir, getTrashCommandsDir } from './state.js';
-import { getEffectiveHome, getVersionHomePath, listInstalledVersions, resolveVersion } from './versions.js';
-import { discoverPlugins } from './plugins.js';
+import { getEffectiveHome, getVersionHomePath, listInstalledVersions, resolveVersion } from './installations/versions.js';
+import { discoverPlugins } from './plugins/plugins.js';
 import { commandSkillMatches, installCommandSkillToVersion, listCommandSkillsInVersion, removeCommandSkillFromVersion, shouldAlsoInstallCommandAsSkill, shouldInstallCommandAsSkill, } from './command-skills.js';
 import { installGooseCommandToVersion, listGooseCommandsInVersion, gooseCommandMatches, removeGooseCommandFromVersion, } from './goose-commands.js';
-function compareVersions(a, b) {
-    const aParts = a.split('.').map((n) => parseInt(n, 10) || 0);
-    const bParts = b.split('.').map((n) => parseInt(n, 10) || 0);
-    for (let i = 0; i < Math.max(aParts.length, bParts.length); i++) {
-        const aVal = aParts[i] || 0;
-        const bVal = bParts[i] || 0;
-        if (aVal !== bVal)
-            return aVal - bVal;
-    }
-    return 0;
-}
 function parseAgentsField(raw) {
     if (raw == null)
         return undefined;

package/dist/lib/computer/actions.d.ts

@@ -0,0 +1,36 @@
+import type { ComputerClient } from '../computer-rpc.js';
+export interface AppInfo {
+    pid: number;
+    name: string;
+    bundle_id: string;
+    active: boolean;
+}
+export declare function pickTarget(list: AppInfo[], opts: {
+    pid?: number;
+    bundle?: string;
+}): {
+    ok: true;
+    app: AppInfo;
+} | {
+    ok: false;
+    error: string;
+};
+export declare function resolveTargetPidDecision(client: ComputerClient, opts: {
+    pid?: number;
+    bundle?: string;
+}, gate?: {
+    verb?: string;
+    env?: NodeJS.ProcessEnv;
+    nowMs?: number;
+}): Promise<{
+    ok: true;
+    pid: number;
+    source: 'pid' | 'list_apps' | 'session_admission';
+} | {
+    ok: false;
+    error: string;
+}>;
+export declare function emitComputerAction(verb: string, targetPid: number | undefined, opts: {
+    bundle?: string;
+    device?: string;
+}, extra?: Record<string, unknown>): void;