@phnx-labs/agents-cli 1.22.39 → 1.22.41

package/dist/commands/accounts.js

@@ -1,15 +1,67 @@
 import chalk from 'chalk';
 import { password } from '@inquirer/prompts';
 import { setHelpSections } from '../lib/help.js';
-import { updateMeta } from '../lib/state.js';
-import { ALL_AGENT_IDS } from '../lib/agents.js';
+import { readMeta, updateMeta } from '../lib/state.js';
+import { ALL_AGENT_IDS, getAccountInfo, resolveAgentName } from '../lib/agents.js';
+import { getVersionHomePath, listInstalledVersions } from '../lib/installations/versions.js';
+import { nativeAccountCapability, nativeAccountNameable, nativeIdentityKey } from '../lib/account-capabilities.js';
+import { profileExists, readProfile } from '../lib/profiles.js';
 import { pushBundleToHost } from '../lib/secrets/push.js';
+import { assertCredentialTransportHostPinned, resolveHostSshTarget } from '../lib/secrets/remote.js';
 import { resolveRemoteOsSync } from '../lib/hosts/remote-os.js';
 import { runDevicesAccounts } from './ssh.js';
 import { discoverNativeAccounts } from '../lib/account-catalog.js';
 import { readAndResolveBundleEnv } from '../lib/secrets/bundles.js';
 import { getAccountProvider, listAccountProviders } from '../lib/account-provider-registry.js';
-import { addAccount, findAccount, inspectAccount, readAccountRegistry, removeAccount, renameAccount, setAccountSecret } from '../lib/account-registry.js';
+import { accountBindings, addAccount, addNativeAccount, bindAccount, findAccount, findUnifiedAccount, inspectAccount, listNativeAccounts, readAccountRegistry, removeAccount, renameAccount, setAccountSecret, unbindAccount } from '../lib/account-registry.js';
+function parseInstallation(raw) {
+    const at = raw.lastIndexOf('@');
+    if (at < 1 || at === raw.length - 1)
+        throw new Error(`Expected <agent>@<version>, got '${raw}'.`);
+    const agent = resolveAgentName(raw.slice(0, at));
+    if (!agent)
+        throw new Error(`Unknown agent '${raw.slice(0, at)}'.`);
+    return { agent, version: raw.slice(at + 1) };
+}
+async function nativeIdentityFromSource(raw) {
+    const parsed = parseInstallation(raw);
+    const capability = nativeAccountCapability(parsed.agent);
+    if (!nativeAccountNameable(parsed.agent)) {
+        throw new Error(`${parsed.agent} native accounts are ${capability.status}; agents-cli cannot safely name or attach this login.`);
+    }
+    if (!listInstalledVersions(parsed.agent).includes(parsed.version))
+        throw new Error(`${raw} is not installed.`);
+    const info = await getAccountInfo(parsed.agent, getVersionHomePath(parsed.agent, parsed.version));
+    const identityKey = nativeIdentityKey(info, capability);
+    if (!identityKey)
+        throw new Error(`${raw} has no stable signed-in identity. Run it and complete its normal login first.`);
+    return { agent: parsed.agent, version: parsed.version, identityKey, identityLabel: info.email ?? undefined, scope: capability.scope };
+}
+/**
+ * Classify + validate an attach target, rejecting a typo BEFORE any binding is
+ * written: it must be an existing custom-harness profile, an installed
+ * `agent@version`, or a known harness id.
+ */
+export function classifyAttachTarget(target) {
+    if (profileExists(target))
+        return { kind: 'profile', profile: readProfile(target) };
+    if (target.includes('@')) {
+        const at = target.lastIndexOf('@');
+        const agent = resolveAgentName(target.slice(0, at));
+        const version = target.slice(at + 1);
+        if (!agent)
+            throw new Error(`Unknown harness '${target.slice(0, at)}' in target '${target}'.`);
+        if (!version)
+            throw new Error(`Target '${target}' is missing a version.`);
+        if (!listInstalledVersions(agent).includes(version))
+            throw new Error(`${agent}@${version} is not installed.`);
+        return { kind: 'installation', agent, version };
+    }
+    const agent = resolveAgentName(target);
+    if (agent)
+        return { kind: 'device-agent', agent };
+    throw new Error(`Unknown attach target '${target}'. Expected an installed <agent>@<version>, a harness id, or an existing custom harness profile.`);
+}
 export function parseBundleKey(raw) {
     const colon = raw.indexOf(':');
     if (colon < 1 || colon === raw.length - 1)
@@ -27,7 +79,12 @@ async function printAccounts(json, fleet = false) {
     if (fleet)
         return runDevicesAccounts({ json });
     const records = Object.values(readAccountRegistry().accounts).sort((a, b) => a.name.localeCompare(b.name));
-    const native = await discoverNativeAccounts();
+    const discovered = await discoverNativeAccounts();
+    const savedNative = listNativeAccounts(readMeta());
+    const native = discovered.map(row => {
+        const saved = savedNative.find(account => account.agent === row.agent && account.identityKey === row.id);
+        return { ...row, name: saved?.name, id: saved?.id ?? row.id };
+    });
     if (json) {
         console.log(JSON.stringify([...records.map(account => publicAccount(inspectAccount(account.name))), ...native], null, 2));
         return;
@@ -43,7 +100,7 @@ async function printAccounts(json, fleet = false) {
     if (!native.length)
         console.log(chalk.gray('  No signed-in native accounts found.'));
     for (const account of native)
-        console.log(`  ${chalk.cyan(account.display)}  ${account.agent}  ${account.versions.join(', ')}`);
+        console.log(`  ${account.name ? `${chalk.cyan(account.name)} · ` : ''}${account.display}  ${account.agent}  ${account.versions.join(', ')}`);
 }
 function parseAuth(raw) {
     if (raw === 'api-key' || raw === 'setup-token' || raw === 'bearer-token')
@@ -78,22 +135,87 @@ export function registerAccountsCommand(program) {
         .action(async (name, o) => {
         const account = findAccount(name);
         if (!account)
-            throw new Error(`Unknown account '${name}'.`);
+            throw new Error(`Unknown provider account '${name}'.`);
         const secret = o.fromSecrets ? secretFromBundle(o.fromSecrets) : await password({ message: `Enter new ${account.provider} ${account.auth} for '${name}':` });
         setAccountSecret(name, secret);
         console.log(chalk.green(`Updated credential for account '${name}'.`));
     });
-    accounts.command('inspect <name>').description('Show safe account metadata').option('--json', 'Machine-readable output').action((name, o, command) => {
-        const account = publicAccount(inspectAccount(name));
+    accounts.command('view <name>').alias('inspect').description('Show safe account metadata, custody, and attachments').option('--json', 'Machine-readable output').action((name, o, command) => {
+        const meta = readMeta();
+        const unified = findUnifiedAccount(name, meta);
+        if (!unified)
+            throw new Error(`Unknown account '${name}'.`);
+        const account = unified.kind === 'provider'
+            ? { ...publicAccount(inspectAccount(unified.name)), custody: 'agents secrets (policy never)', attached: accountBindings(unified.id, meta) }
+            : { ...unified, custody: `${unified.agent} (not stored by agents-cli)`, attached: accountBindings(unified.id, meta) };
         if (o.json || command.optsWithGlobals().json)
             return console.log(JSON.stringify(account, null, 2));
-        console.log(`${chalk.bold(account.name)}  ${account.provider}`);
-        console.log(`  auth: ${account.auth}`);
+        console.log(chalk.bold(account.name));
+        console.log(`  kind: ${account.kind}`);
         console.log(`  id: ${account.id}`);
-        console.log(`  policy: ${account.policy}`);
-        if (account.baseUrl)
-            console.log(`  base url: ${account.baseUrl}`);
-        console.log(`  credential: ${account.secretPresent ? 'present on this device' : 'missing on this device'}`);
+        console.log(`  custody: ${account.custody}`);
+        if (account.kind === 'provider') {
+            console.log(`  provider: ${account.provider}`);
+            console.log(`  auth: ${account.auth}`);
+            console.log(`  credential: ${account.secretPresent ? 'present on this device' : 'missing on this device'}`);
+        }
+        else {
+            console.log(`  identity: ${account.identityLabel ?? account.identityKey}`);
+            console.log(`  scope: ${account.scope}`);
+        }
+        console.log(`  attached: ${account.attached.length ? account.attached.join(', ') : 'none'}`);
+    });
+    accounts.command('name <source> <name>')
+        .description('Name a signed-in native installation without copying its OAuth credentials')
+        .action(async (source, name) => {
+        const identity = await nativeIdentityFromSource(source);
+        const account = addNativeAccount(name, identity.agent, identity.identityKey, identity.identityLabel, identity.scope);
+        console.log(chalk.green(`Named ${source} as ${account.name}.`));
+        if (account.scope === 'device')
+            console.log(chalk.gray(`${identity.agent} authentication is device-scoped; attach '${account.name}' to '${identity.agent}', not an individual version.`));
+    });
+    accounts.command('attach <account> <target>')
+        .description('Attach a named account to a native installation or custom harness')
+        .action(async (name, target) => {
+        const meta = readMeta();
+        const account = findUnifiedAccount(name, meta);
+        if (!account)
+            throw new Error(`Unknown account '${name}'.`);
+        // Validate the target exists before mutating any binding.
+        const t = classifyAttachTarget(target);
+        const targetAgent = t.kind === 'profile' ? t.profile.host.agent : t.agent;
+        if (account.kind === 'native') {
+            // A provider-backed profile injects provider env at spawn, which would run
+            // under a different credential than the native identity claims — refuse it.
+            if (t.kind === 'profile' && t.profile.provider) {
+                throw new Error(`Custom harness '${target}' is provider-backed (${t.profile.provider}); it cannot host the native login account '${account.name}'. Attach a matching provider account instead.`);
+            }
+            if (targetAgent !== account.agent)
+                throw new Error(`Account '${account.name}' is a ${account.agent} login; '${target}' runs ${targetAgent}.`);
+            if (account.scope === 'device') {
+                if (t.kind !== 'device-agent')
+                    throw new Error(`${account.agent} authentication is device-scoped. Attach it with 'agents accounts attach ${account.name} ${account.agent}'.`);
+            }
+            else {
+                if (t.kind !== 'installation')
+                    throw new Error(`${account.agent} authentication is per-version. Attach '${account.name}' to a specific ${account.agent}@<version>.`);
+                const identity = await nativeIdentityFromSource(target);
+                if (identity.identityKey !== account.identityKey)
+                    throw new Error(`'${target}' is signed in to a different identity than account '${account.name}'.`);
+            }
+        }
+        else {
+            // Provider account: it must be able to authenticate the target's harness.
+            getAccountProvider(account.provider).envFor(targetAgent, account.auth);
+        }
+        bindAccount(name, target);
+        console.log(chalk.green(`Attached ${account.name} to ${target}.`));
+    });
+    accounts.command('detach <account> <target>')
+        .description('Remove one account attachment')
+        .action((name, target) => {
+        unbindAccount(name, target);
+        console.log(chalk.green(`Detached ${name} from ${target}.`));
     });
     accounts.command('rename <old> <new>').description('Rename an account without changing its stable id').action((oldName, newName) => renameAccount(oldName, newName));
     accounts.command('remove <name>').description('Remove an account and its device-local credential').action((name) => removeAccount(name));
@@ -124,22 +246,58 @@ export function registerAccountsCommand(program) {
         });
         console.log(chalk.green(`Cleared the default account for ${agentRaw}.`));
     });
-    accounts.command('sync <name>')
+    accounts.command('logout <target>')
+        .description('Sign out a harness-native OAuth login. API-key / setup-token / bearer accounts use `accounts remove` instead.')
+        .action(async (target) => {
+        const provider = findAccount(target);
+        if (provider) {
+            throw new Error(`Account '${provider.name}' uses ${provider.auth}, not OAuth. Remove it with: agents accounts remove ${provider.name}`);
+        }
+        const agentRaw = target.split('@')[0];
+        if (!ALL_AGENT_IDS.includes(agentRaw)) {
+            throw new Error(`Unknown target '${target}'. Pass a native harness (claude, codex, …) or a provider account name. Provider API-key accounts use \`agents accounts remove\`.`);
+        }
+        const agent = agentRaw;
+        const { spawnSync } = await import('child_process');
+        const { getBinaryPath, getGlobalDefault, getVersionHomePath, listInstalledVersions } = await import('../lib/installations/versions.js');
+        const installed = listInstalledVersions(agent);
+        const version = getGlobalDefault(agent) ?? installed[installed.length - 1];
+        if (!version)
+            throw new Error(`No installed version of ${agent}. Install one with: agents add ${agent}`);
+        const bin = getBinaryPath(agent, version);
+        const home = getVersionHomePath(agent, version);
+        const result = spawnSync(bin, ['logout'], {
+            env: { ...process.env, HOME: home },
+            stdio: 'inherit',
+        });
+        if (result.error)
+            throw result.error;
+        if ((result.status ?? 1) !== 0) {
+            throw new Error(`${agent} logout exited ${result.status ?? 'null'}. If this harness has no logout verb, sign out from its own UI.`);
+        }
+        console.log(chalk.green(`Signed out native ${agent} login (${version}).`));
+    });
+    accounts.command('sync <name> [device]')
         .description('Copy one provider account bundle to a worker device')
-        .requiredOption('--device <device>', 'Destination device or SSH host')
+        .option('--device <device>', 'Deprecated destination form; use the positional device')
         .option('--force', 'Replace matching keys on the destination')
-        .action((name, o) => {
+        .action(async (name, deviceArg, o) => {
+        const device = deviceArg ?? o.device;
+        if (!device)
+            throw new Error('Missing destination device. Usage: agents accounts sync <account> <device>.');
         const account = findAccount(name);
         if (!account)
             throw new Error(`Unknown provider account '${name}'.`);
-        const remoteBackend = resolveRemoteOsSync(o.device) === 'win32' ? 'keychain' : 'file';
+        const sshTarget = await resolveHostSshTarget(device);
+        assertCredentialTransportHostPinned(sshTarget);
+        const remoteBackend = resolveRemoteOsSync(device) === 'win32' ? 'keychain' : 'file';
         const literalValues = {
             ACCOUNT_ID: account.id,
             PROVIDER: account.provider,
             AUTH_TYPE: account.auth,
             ...(account.baseUrl ? { BASE_URL: account.baseUrl } : {}),
         };
-        const result = pushBundleToHost(account.name, o.device, {
+        const result = pushBundleToHost(account.name, device, {
             remoteBackend,
             force: o.force,
             operation: 'accounts sync',
@@ -148,17 +306,20 @@ export function registerAccountsCommand(program) {
             literalValues,
         });
         if (!result.ok)
-            throw new Error(`${result.message}\nRetry: agents accounts sync ${account.name} --device ${o.device}${o.force ? ' --force' : ''}`);
-        console.log(chalk.green(`${account.name} synced to ${o.device} (${result.keyCount} keys, ${remoteBackend} backend, policy never).`));
+            throw new Error(`${result.message}\nRetry: agents accounts sync ${account.name} ${device}${o.force ? ' --force' : ''}`);
+        console.log(chalk.green(`${account.name} synced to ${device} (${result.keyCount} keys, ${remoteBackend} backend, policy never).`));
     });
     setHelpSections(accounts, {
         examples: `agents accounts add work --provider anthropic --auth setup-token
 agents accounts add openrouter-work --provider openrouter --auth api-key --from-secrets openrouter.ai:OPENROUTER_API_KEY
 agents accounts set-key work
-agents accounts inspect work --json
+agents accounts name claude@2.1.220 work
+agents accounts attach work claude@2.1.225
+agents accounts view work --json
 agents accounts set-default claude work
-agents accounts sync work --device yosemite-s0
-agents run claude --account work`,
-        notes: 'Provider accounts are durable credentials independent of agent versions. Harness-native auth remains managed by each harness and is not copied or renamed by agents-cli.',
+agents accounts sync openrouter-work yosemite-s0
+agents run claude --account work
+agents accounts logout claude`,
+        notes: 'Native account records contain metadata only; harness-owned OAuth credentials are never copied. Provider accounts are explicit portable bundles with policy never. Harness-native OAuth sign-out is `agents accounts logout <harness>` (API-key accounts use `accounts remove`). Synced vault unlock is `agents secrets vault unlock`.',
     });
 }

package/dist/commands/apply.d.ts

@@ -1,8 +1,8 @@
 /**
  * `agents apply` (alias `ag apply`) — reconcile the whole fleet to a declared
- * profile in one command: install agents-cli + agents, sync config, and
- * propagate login so a machine that's signed in once seeds every device. Kills
- * the "6 hosts x ~8 harnesses = ~48 OAuth flows" slog.
+ * profile in one command: install agents-cli + agents and sync config. Native
+ * harness logins remain device-local; portable provider credentials move only
+ * through explicit `agents accounts sync`.
  *
  * The manifest is the `fleet:` block of any `-f` file (default `agents.yaml`).
  */

package/dist/commands/apply.js

@@ -1,16 +1,14 @@
 /**
  * `agents apply` (alias `ag apply`) — reconcile the whole fleet to a declared
- * profile in one command: install agents-cli + agents, sync config, and
- * propagate login so a machine that's signed in once seeds every device. Kills
- * the "6 hosts x ~8 harnesses = ~48 OAuth flows" slog.
+ * profile in one command: install agents-cli + agents and sync config. Native
+ * harness logins remain device-local; portable provider credentials move only
+ * through explicit `agents accounts sync`.
  *
  * The manifest is the `fleet:` block of any `-f` file (default `agents.yaml`).
  */
 import * as fs from 'fs';
-import * as os from 'os';
 import * as path from 'path';
 import { fileURLToPath } from 'url';
-import { Option } from 'commander';
 import chalk from 'chalk';
 import { setHelpSections } from '../lib/help.js';
 import { machineId } from '../lib/session/sync/config.js';
@@ -18,9 +16,9 @@ import { loadDevices, isControlDevice } from '../lib/devices/registry.js';
 import { isHostPinned, managedKnownHostsPath } from '../lib/devices/known-hosts.js';
 import { ensureDevicesRegistered } from '../lib/devices/sync.js';
 import { readFleetFile, resolveDesired } from '../lib/fleet/manifest.js';
-import { snapshotAuth, materializeAuth, parseAuthBundle, KEYCHAIN_BOUND_ON_MAC, isCredentialSafeToPropagate } from '../lib/fleet/auth-sync.js';
+import { snapshotAuth } from '../lib/fleet/auth-sync.js';
 import { agentIdOf, diffFleet, probeDevice, runFleetApply, pool, sourceHome, expandAllSpecs, rosterNeedsVersions, } from '../lib/fleet/apply.js';
-import { listInstalledVersions } from '../lib/versions.js';
+import { listInstalledVersions } from '../lib/installations/versions.js';
 /** Version of the running agents-cli — the fleet target version. */
 function localCliVersion() {
     try {
@@ -32,23 +30,6 @@ function localCliVersion() {
         return '';
     }
 }
-async function readStdin() {
-    const chunks = [];
-    for await (const c of process.stdin)
-        chunks.push(c);
-    return Buffer.concat(chunks).toString('utf-8');
-}
-/** Hidden path: receive an auth bundle on stdin and materialize it locally. */
-async function runRecvAuth() {
-    const raw = await readStdin();
-    const bundle = parseAuthBundle(raw);
-    const res = materializeAuth(bundle, { home: os.homedir() });
-    if (res.errors.length > 0) {
-        console.error(`recv-auth: ${res.errors.length} error(s): ${res.errors.join('; ')}`);
-        process.exit(1);
-    }
-    console.log(`recv-auth: wrote login for ${res.written.join(', ') || '(nothing)'}`);
-}
 function confirm(question) {
     return new Promise((resolve) => {
         process.stdout.write(question);
@@ -64,7 +45,7 @@ function confirm(question) {
 const ONLY_KINDS = {
     agents: new Set(['install-cli', 'upgrade-cli', 'add-agent']),
     config: new Set(['sync-config']),
-    login: new Set(['push-login', 'needs-login']),
+    login: new Set(['needs-login']),
 };
 /** Render the device x dimension matrix (cribbed from `doctor --devices`). */
 function renderPlan(plan) {
@@ -77,9 +58,8 @@ function renderPlan(plan) {
         if (acts.length === 0)
             return chalk.green(`ok ${okLabel}`);
         if (acts.some((a) => a.kind === 'needs-login')) {
-            const push = acts.filter((a) => a.kind === 'push-login').length;
             const need = acts.filter((a) => a.kind === 'needs-login').length;
-            return chalk.yellow(`${push} push · ${need} manual`);
+            return chalk.yellow(`${need} manual`);
         }
         return chalk.cyan('↑ ' + acts.map((a) => a.agent ?? a.kind.replace('-cli', '')).join(','));
     };
@@ -103,7 +83,7 @@ function renderPlan(plan) {
         const configCell = row.probe.reachable
             ? (row.actions.some((a) => a.kind === 'sync-config') ? chalk.cyan('↑ sync') : chalk.green('ok'))
             : chalk.gray('-');
-        const loginCell = cell(row, ['push-login', 'needs-login'], `${row.desired.agents.length}/${row.desired.agents.length}`);
+        const loginCell = cell(row, ['needs-login'], `${row.desired.agents.length}/${row.desired.agents.length}`);
         const secretsCell = (() => {
             if (!anySecrets)
                 return '';
@@ -131,31 +111,14 @@ function renderPlan(plan) {
     if (anySecrets && !rows.some((r) => r.actions.some((a) => a.kind === 'push-secret'))) {
         console.log(chalk.gray('  secrets: not pushed. `--provision-secrets` pushes declared bundles to devices whose host key is pinned.'));
     }
-    // Distinguish *why* a login can't be propagated: macOS keychain-bound,
-    // single-use rotating refresh token (never copied), or the source simply not
-    // being signed in to that agent (no portable file).
-    const bound = [];
-    const rotating = [];
-    const noToken = [];
-    for (const r of rows) {
-        for (const a of r.loginBlocked) {
-            const tag = `${a}@${r.device}`;
-            if (!isCredentialSafeToPropagate(a))
-                rotating.push(tag);
-            else if (r.probe.platform === 'macos' && KEYCHAIN_BOUND_ON_MAC.has(a))
-                bound.push(tag);
-            else
-                noToken.push(tag);
-        }
-    }
-    if (rotating.length > 0) {
-        console.log(chalk.yellow(`  manual login needed (single-use rotating refresh token): ${rotating.join(', ')}`));
-    }
-    if (bound.length > 0) {
-        console.log(chalk.yellow(`  manual login needed (macOS keychain-bound): ${bound.join(', ')}`));
-    }
-    if (noToken.length > 0) {
-        console.log(chalk.yellow(`  manual login needed (no portable token on source): ${noToken.join(', ')}`));
+    // `apply` no longer propagates ANY login (SING-1b: a native OAuth / session
+    // login is never copied between devices). Every login:sync agent that has a
+    // login to establish is surfaced here with the one honest reason + the portable
+    // alternative — never a silent skip.
+    const needsLogin = [...new Set(rows.flatMap((r) => r.loginBlocked.map((a) => `${a}@${r.device}`)))];
+    if (needsLogin.length > 0) {
+        console.log(chalk.yellow(`  manual login needed — a native OAuth login is never copied between devices (SING-1b); ` +
+            `log in on the box itself, or sync a portable provider account (\`agents accounts sync\`): ${needsLogin.join(', ')}`));
     }
     // Secrets bundles are declared once for the fleet; surface the distinct set the
     // gate did NOT push, so a refusal is never silent. "never pushed" used to be
@@ -260,8 +223,7 @@ async function runApply(opts) {
         secretsBundles: manifest.secrets?.bundles,
         provisionSecrets: opts.provisionSecrets === true,
         forceSecrets: opts.force === true,
-        // Same bar as `exec --copy-creds` (EXEC-34): credential values only ever go
-        // to a host whose key we already pinned.
+        // Portable secret values only ever go to a host whose key is already pinned.
         isHostPinned: (device) => isHostPinned(device, managedKnownHostsPath()),
     });
     // --only filter.
@@ -334,7 +296,7 @@ function reportResults(results) {
  */
 export function configureApplyCommand(cmd) {
     return cmd
-        .description('Reconcile the fleet to a declared profile: install agents, sync config, propagate login.')
+        .description('Reconcile the fleet to a declared profile: install agents and sync config.')
         .option('-f, --file <path>', 'Manifest file carrying a fleet: block (default: agents.yaml)')
         .option('--plan', 'Show the reconcile plan and exit (no changes)')
         .option('--dry-run', 'Alias for --plan')
@@ -342,16 +304,11 @@ export function configureApplyCommand(cmd) {
         .option('--device <name>', 'Scope the apply to a single device')
         .option('--agent <specs...>', 'Override the roster for targeted device(s): install these specs instead of the manifest\'s. Use `claude@all` to replicate every version installed on this machine.')
         .option('--only <dims>', 'Limit to dimensions: comma list of agents,config,login')
-        .option('--no-login', 'Do not propagate logins')
+        .option('--no-login', 'Deprecated no-op: native logins are always device-local')
         .option('--provision-secrets', "Push the manifest's declared secrets bundles to each device (OFF by default; moves credential values over SSH, and only to a device whose host key is already pinned)")
         .option('--force', 'With --provision-secrets: re-push a bundle the device already has')
-        .addOption(new Option('--recv-auth', 'internal: receive an auth bundle on stdin').hideHelp())
         .action(async (opts) => {
         try {
-            if (opts.recvAuth) {
-                await runRecvAuth();
-                return;
-            }
             await runApply(opts);
         }
         catch (e) {
@@ -367,7 +324,7 @@ export function registerApplyCommand(program) {
       # Preview what would change across the fleet
       agents apply --plan -f agents.yaml
 
-      # Bring every device to the profile (installs, syncs, propagates login)
+      # Bring every device to the profile (installs + config sync; native login stays local)
       ag apply -f agents.yaml
 
       # One device only

package/dist/commands/browser.d.ts

@@ -1,3 +1,18 @@
 import { Command } from 'commander';
+import { type BrowserProfile } from '../lib/browser/profiles.js';
+import { listInstalledBrowsers } from '../lib/browser/chrome.js';
 export declare function registerBrowserCommand(program: Command): void;
 export declare function registerBrowserSubcommands(program: Command): void;
+interface BrowserUseOptions {
+    unset?: boolean;
+}
+interface BrowserUseChoice {
+    name: string;
+    value: {
+        name: string;
+        installed?: ReturnType<typeof listInstalledBrowsers>[number];
+    };
+}
+export declare function buildBrowserUseChoices(profiles: BrowserProfile[], installed: ReturnType<typeof listInstalledBrowsers>, current?: string): BrowserUseChoice[];
+export declare function runBrowserUse(name: string | undefined, opts: BrowserUseOptions, interactive?: boolean): Promise<boolean>;
+export {};