@phnx-labs/agents-cli 1.22.39 → 1.22.41

package/dist/commands/computer.js

@@ -13,7 +13,8 @@ import { makeVerbDispatcher } from '../lib/computer/dispatch.js';
 import { makeClaudeResponder, resolveApiKey, DEFAULT_CLAUDE_MODEL, DEFAULT_CLAUDE_BASE_URL } from '../lib/computer/model.js';
 import { TASK_PREVIEW_MAX_CHARS } from '../lib/computer/sessions-list.js';
 import { runComputerSessionsCommand } from './computer-sessions-picker.js';
-import { truncate } from '../lib/events.js';
+import { truncate } from '../lib/feed/events.js';
+import { namespacedServiceLabel, serviceManifestHomeEnv } from '../lib/service-manifest.js';
 // Help groups — mirror `agents browser` so the mental model carries over.
 const COMPUTER_HELP_GROUPS = [
     { title: 'Installation', names: ['setup'] },
@@ -23,16 +24,16 @@ const COMPUTER_HELP_GROUPS = [
     { title: 'Interact', names: ['launch', 'raise', 'click', 'right-click', 'type', 'type-text', 'key', 'drag', 'scroll', 'ax-action', 'focus', 'wait'] },
     { title: 'History and discovery', names: ['sessions'] },
 ];
-// Subcommands that manage the `--host` remote path themselves (provisioning /
+// Subcommands that manage the `--device` remote path themselves (provisioning /
 // tunnel lifecycle, or daemon-state reporting that must degrade gracefully
-// when no tunnel is recorded). Every other `--host`-bearing subcommand is a
+// when no tunnel is recorded). Every other `--device`-bearing subcommand is a
 // plain verb that just needs the TCP endpoint hydrated before it runs.
 const REMOTE_LIFECYCLE = new Set(['setup', 'start', 'stop', 'status', 'reload']);
 /**
  * Pure platform gate. The computer subsystem is macOS-only for LOCAL driving
  * (Accessibility / launchctl). It is NOT blocked off macOS when a remote daemon
  * is reachable — either a configured TCP endpoint (COMPUTER_HELPER_TCP, e.g. a
- * Windows daemon over a tunnel) or a `--host <device>` remote invocation. Kept
+ * Windows daemon over a tunnel) or a `--device <name>` remote invocation. Kept
  * pure so the gating rule is unit-testable without a live command tree.
  */
 export function shouldBlockOffPlatform(opts) {
@@ -40,7 +41,7 @@ export function shouldBlockOffPlatform(opts) {
         return false;
     if (opts.tcpConfigured)
         return false; // remote (Windows) daemon over a tunnel
-    if (opts.host)
+    if (opts.device)
         return false; // remote path resolves its own endpoint
     return true;
 }
@@ -83,21 +84,21 @@ export function reconcileScreenshotExt(outPath, buf) {
 export function registerComputerCommand(program) {
     const computer = program
         .command('computer')
-        .description('Drive macOS apps via Accessibility, or a remote Windows host with --host — list, screenshot, click, type')
+        .description('Drive macOS apps via Accessibility, or a remote Windows device with --device — list, screenshot, click, type')
         // The whole subsystem is macOS Accessibility / TCC for LOCAL driving. Off
         // macOS it still works against a remote daemon (COMPUTER_HELPER_TCP set, or
-        // a `--host <device>` invocation). Fail fast with a clear message only when
+        // a `--device <name>` invocation). Fail fast with a clear message only when
         // neither remote path is available, instead of a downstream launchctl error.
         .hook('preAction', async (_thisCommand, actionCommand) => {
-        const host = actionCommand.opts().host;
-        // Verbs with --host reconnect to the tunnel `start --host` recorded; this
-        // sets COMPUTER_HELPER_TCP so the shared client picks the TCP transport.
-        if (host && !REMOTE_LIFECYCLE.has(actionCommand.name())) {
-            hydrateRemoteEnvFromState(host);
+        const device = actionCommand.opts().device;
+        // Verbs with --device reconnect to the tunnel `start --device` recorded;
+        // this sets COMPUTER_HELPER_TCP so the shared client picks the TCP transport.
+        if (device && !REMOTE_LIFECYCLE.has(actionCommand.name())) {
+            hydrateRemoteEnvFromState(device);
         }
-        if (shouldBlockOffPlatform({ platform: process.platform, tcpConfigured: resolveTcpEndpoint() != null, host })) {
+        if (shouldBlockOffPlatform({ platform: process.platform, tcpConfigured: resolveTcpEndpoint() != null, device })) {
             console.error('agents computer: macOS only for local driving — it uses the macOS Accessibility API.');
-            console.error('For a remote Windows host: register it with `agents devices`, then use --host (or set COMPUTER_HELPER_TCP).');
+            console.error('For a remote Windows device: register it with `agents devices`, then use --device (or set COMPUTER_HELPER_TCP).');
             process.exit(1);
         }
     });
@@ -119,11 +120,11 @@ export function registerComputerSubcommands(program) {
 function registerStatusCommand(program) {
     program
         .command('status')
-        .description('Report install state, daemon state, and Accessibility trust — or a remote Windows daemon with --host')
-        .option('--host <device>', 'Report the remote Windows daemon (tunnel + liveness) instead of the local helper')
+        .description('Report install state, daemon state, and Accessibility trust — or a remote Windows daemon with --device')
+        .option('--device <name>', 'Report the remote Windows daemon (tunnel + liveness) instead of the local helper')
         .action(async (opts) => {
-        if (opts.host) {
-            await reportRemoteStatus(opts.host);
+        if (opts.device) {
+            await reportRemoteStatus(opts.device);
             return;
         }
         const socketPath = resolveSocketPath();
@@ -172,21 +173,21 @@ function registerStatusCommand(program) {
         }
     });
 }
-// status --host: the local checks (app install, launchd socket, policy files)
+// status --device: the local checks (app install, launchd socket, policy files)
 // are macOS concepts — a remote Windows daemon is reported from what actually
 // exists for it: the recorded tunnel and a live trust_status probe through it.
-async function reportRemoteStatus(host) {
-    console.log(`host:      ${host}`);
-    const state = readRemoteState(host);
+async function reportRemoteStatus(device) {
+    console.log(`device:    ${device}`);
+    const state = readRemoteState(device);
     if (!state) {
         console.log('tunnel:    none');
         console.log('daemon:    unknown (no tunnel to probe through)');
         console.log('');
-        console.log(`Run:  agents computer start --host ${host}`);
+        console.log(`Run:  agents computer start --device ${device}`);
         process.exit(1);
     }
     console.log(`tunnel:    127.0.0.1:${state.localPort} -> ${state.target} (127.0.0.1:${state.remotePort})`);
-    hydrateRemoteEnvFromState(host);
+    hydrateRemoteEnvFromState(device);
     try {
         const client = openComputerClient();
         try {
@@ -210,7 +211,7 @@ async function reportRemoteStatus(host) {
         console.log('daemon:    unreachable');
         console.log(`           ${err.message}`);
         console.log('');
-        console.log(`Run:  agents computer start --host ${host}`);
+        console.log(`Run:  agents computer start --device ${device}`);
         process.exit(1);
     }
 }
@@ -227,12 +228,12 @@ export function buildRestartTaskScript(taskName, exeName) {
         `Write-Output 'restarted'`,
     ].join('; ');
 }
-// reload --host: the Windows daemon has no policy file to re-read (it
+// reload --device: the Windows daemon has no policy file to re-read (it
 // enforces no allow-list — see TrustStatus in native/computer-win/Rpc.cs), so
 // reload means bounce the daemon via its scheduled task — the way to pick up
 // a freshly pushed exe — then prove it answers through the recorded tunnel.
-async function reloadRemoteHelper(host) {
-    const { target } = await resolveRemoteDevice(host);
+async function reloadRemoteHelper(device) {
+    const { target } = await resolveRemoteDevice(device);
     const script = buildRestartTaskScript(REMOTE_TASK_NAME, WIN_HELPER_EXE);
     const res = sshExec(target, `powershell -NoProfile -NonInteractive -EncodedCommand ${encodePowershell(script)}`, { timeoutMs: 60_000 });
     if (res.code !== 0) {
@@ -241,12 +242,12 @@ async function reloadRemoteHelper(host) {
         process.exit(1);
     }
     console.log(`task:   restarted "${REMOTE_TASK_NAME}" on ${target}`);
-    const state = readRemoteState(host);
+    const state = readRemoteState(device);
     if (!state) {
-        console.log(`(no tunnel recorded — run \`agents computer start --host ${host}\` to drive it)`);
+        console.log(`(no tunnel recorded — run \`agents computer start --device ${device}\` to drive it)`);
         return;
     }
-    hydrateRemoteEnvFromState(host);
+    hydrateRemoteEnvFromState(device);
     // The relaunched daemon needs a beat to rebind its port; poll through the
     // tunnel until it answers.
     const deadline = Date.now() + 15_000;
@@ -290,7 +291,7 @@ function registerRunCommand(program) {
         .option('--model <id>', `Model id (default: ${DEFAULT_CLAUDE_MODEL})`)
         .option('--max-steps <n>', 'Max model turns before giving up', (v) => parseInt(v, 10), 12)
         .option('--max-tokens <n>', 'Max tokens per model turn', (v) => parseInt(v, 10), 1024)
-        .option('--host <device>', 'Drive a remote Windows device (requires `agents computer start --host <device>` first)')
+        .option('--device <name>', 'Drive a remote Windows device (requires `agents computer start --device <name>` first)')
         .option('--json', 'Emit the final loop result as JSON')
         .action(async (opts) => {
         const apiKey = resolveApiKey({ apiKey: undefined, baseUrl: opts.baseUrl });
@@ -305,9 +306,9 @@ function registerRunCommand(program) {
             model: opts.model,
             maxTokens: opts.maxTokens,
         });
-        emitComputerRunTaskMarker({ task: opts.task, bundle: opts.bundle, host: opts.host });
+        emitComputerRunTaskMarker({ task: opts.task, bundle: opts.bundle, device: opts.device });
         await withClient(async (client) => {
-            const dispatch = makeVerbDispatcher(client, { host: opts.host });
+            const dispatch = makeVerbDispatcher(client, { device: opts.device });
             const targetInput = opts.bundle ? { bundle: opts.bundle } : {};
             const result = await runComputerLoop({
                 task: opts.task,
@@ -337,7 +338,7 @@ function registerSessionsCommand(program) {
     program
         .command('sessions')
         .description('Browse computer-driving history, grouped by run — one row per `agents computer` invocation')
-        .option('--machine <name>', 'Only rows invoked from/driving this machine (hostname, machineId, or --host device)')
+        .option('--machine <name>', 'Only rows invoked from/driving this machine (hostname, machineId, or --device name)')
         .option('--limit <n>', 'Cap the flat/--no-interactive table at this many rows (default 50; --json is unbounded)', (v) => parseInt(v, 10))
         .option('--json', 'Emit machine-readable JSON')
         .option('--no-interactive', 'Print the flat listing instead of opening the interactive run browser')
@@ -357,7 +358,7 @@ function registerSessionsCommand(program) {
  * `emitComputerAction`.
  */
 export function emitComputerRunTaskMarker(opts) {
-    emitComputerAction('run', undefined, { bundle: opts.bundle, host: opts.host }, {
+    emitComputerAction('run', undefined, { bundle: opts.bundle, device: opts.device }, {
         task: truncate(opts.task, TASK_PREVIEW_MAX_CHARS),
     });
 }
@@ -388,11 +389,11 @@ function registerScreenshotCommand(program) {
         .description('Capture a window (default: largest), enumerate windows (--list), or the whole display (--display)')
         .option('--bundle <id>', 'Bundle id to capture (default: frontmost allow-listed app)')
         .option('--pid <n>', 'Target pid directly (overrides --bundle)', (v) => parseInt(v, 10))
-        .option('--host <device>', 'Drive a remote Windows device (requires `agents computer start --host <device>` first)')
+        .option('--device <name>', 'Drive a remote Windows device (requires `agents computer start --device <name>` first)')
         .option('--list', 'List the app\'s windows (id/title/layer/bounds) instead of capturing — reveals modals/popups')
         .option('--window-id <n>', 'Capture a specific window by id (from --list)', (v) => parseInt(v, 10))
         .option('--display', 'Capture the whole display the app is on (composites stacked modals)')
-        .option('--out <path>', 'Output image path — extension auto-corrected to the encoded format (JPEG on macOS, PNG on a Windows --host)', './computer-screenshot.jpg')
+        .option('--out <path>', 'Output image path — extension auto-corrected to the encoded format (JPEG on macOS, PNG on a Windows --device)', './computer-screenshot.jpg')
         .option('--quality <n>', 'JPEG quality 1-100 (macOS capture only; the Windows helper encodes lossless PNG and ignores this)', (v) => parseInt(v, 10), 85)
         .option('--json', 'Emit JSON (metadata for captures; window list for --list)')
         .action(async (opts) => {
@@ -479,7 +480,16 @@ function registerScreenshotCommand(program) {
 const HELPER_BUNDLE_ID = 'com.phnx-labs.computer-helper';
 const HELPER_APP_NAME = 'Computer Helper.app';
 const HELPER_APP_DEST = `/Applications/${HELPER_APP_NAME}`;
-const HELPER_LABEL = HELPER_BUNDLE_ID;
+/**
+ * launchd Label for this process's helper — the production identifier for a real
+ * invocation, namespaced under a redirected HOME (RUSH-2639). launchd routes
+ * bootout/bootstrap/kickstart/print by identifier alone, never by the plist's
+ * path, so without this a process running under a sandbox HOME tears down the
+ * operator's live helper.
+ */
+export function helperLabel() {
+    return namespacedServiceLabel(HELPER_BUNDLE_ID);
+}
 /**
  * Install the macOS helper locally: resolve (or download + verify) the signed,
  * notarized .app, copy it to /Applications, verify the destination signature,
@@ -499,7 +509,7 @@ export async function installComputerHelperMacLocal() {
     }
     const socketPath = resolveSocketPath();
     const logPath = resolveLogPath();
-    const plistPath = path.join(os.homedir(), 'Library', 'LaunchAgents', `${HELPER_LABEL}.plist`);
+    const plistPath = path.join(os.homedir(), 'Library', 'LaunchAgents', `${helperLabel()}.plist`);
     console.log(`source:  ${srcApp}`);
     console.log(`dest:    ${HELPER_APP_DEST}`);
     // 1. Copy to /Applications/ via ditto (preserves xattrs + codesign metadata).
@@ -531,7 +541,7 @@ export async function installComputerHelperMacLocal() {
     fs.mkdirSync(path.dirname(logPath), { recursive: true });
     // 4. Write the LaunchAgent plist but DO NOT bootstrap it (opt-in via `start`).
     const execInsideApp = path.join(HELPER_APP_DEST, 'Contents', 'MacOS', 'ComputerHelper');
-    const plistContent = renderLaunchAgentPlist({ label: HELPER_LABEL, exec: execInsideApp, socketPath, logPath });
+    const plistContent = renderLaunchAgentPlist({ label: helperLabel(), exec: execInsideApp, socketPath, logPath });
     fs.mkdirSync(path.dirname(plistPath), { recursive: true });
     fs.writeFileSync(plistPath, plistContent);
     console.log(`wrote plist: ${plistPath} (NOT activated)`);
@@ -544,7 +554,7 @@ export async function installComputerHelperMacLocal() {
  * Shared by `agents computer start` and the `agents setup computer` wizard.
  */
 export async function activateComputerHelperMacLocal() {
-    const plistPath = path.join(os.homedir(), 'Library', 'LaunchAgents', `${HELPER_LABEL}.plist`);
+    const plistPath = path.join(os.homedir(), 'Library', 'LaunchAgents', `${helperLabel()}.plist`);
     const socketPath = resolveSocketPath();
     const logPath = resolveLogPath();
     if (!fs.existsSync(plistPath))
@@ -591,7 +601,7 @@ export async function activateComputerHelperMacLocal() {
     }
     // Force restart so we pick up the latest binary.
     try {
-        execFileSync('/bin/launchctl', ['kickstart', '-k', `${domain}/${HELPER_LABEL}`], { stdio: 'pipe' });
+        execFileSync('/bin/launchctl', ['kickstart', '-k', `${domain}/${helperLabel()}`], { stdio: 'pipe' });
     }
     catch (err) {
         throw new Error(`launchctl kickstart failed: ${err.message}`);
@@ -650,16 +660,16 @@ function registerSetupCommand(program) {
     program
         .command('setup')
         .alias('install-helper')
-        .description('Install the helper — locally to /Applications/ (macOS), or to a remote Windows host with --host')
-        .option('--host <device>', 'Provision a remote Windows device (push the exe + register a LOGON task) instead of installing locally')
+        .description('Install the helper — locally to /Applications/ (macOS), or to a remote Windows device with --device')
+        .option('--device <name>', 'Provision a remote Windows device (push the exe + register a LOGON task) instead of installing locally')
         .action(async (opts) => {
-        if (opts.host) {
+        if (opts.device) {
             try {
-                const { target, taskName } = await setupRemoteHelper(opts.host);
+                const { target, taskName } = await setupRemoteHelper(opts.device);
                 console.log(`pushed computer-helper-win.exe to ${target}`);
                 console.log(`registered LOGON scheduled task "${taskName}" (interactive session, started now)`);
                 console.log('');
-                console.log(`Next:  agents computer start --host ${opts.host}`);
+                console.log(`Next:  agents computer start --device ${opts.device}`);
             }
             catch (err) {
                 console.error(`error: ${err.message}`);
@@ -698,17 +708,17 @@ function registerSetupCommand(program) {
 function registerStartCommand(program) {
     program
         .command('start')
-        .description('Activate the helper daemon — local launchd (macOS) or a remote Windows tunnel with --host')
-        .option('--host <device>', 'Open a tunnel to the remote Windows daemon and record it for --host verbs')
+        .description('Activate the helper daemon — local launchd (macOS) or a remote Windows tunnel with --device')
+        .option('--device <name>', 'Open a tunnel to the remote Windows daemon and record it for --device verbs')
         .action(async (opts) => {
-        if (opts.host) {
+        if (opts.device) {
             try {
-                const state = await startRemoteTunnel(opts.host);
+                const state = await startRemoteTunnel(opts.device);
                 console.log(`tunnel: 127.0.0.1:${state.localPort} -> ${state.target} (127.0.0.1:${state.remotePort})`);
                 console.log(`daemon: answering (ssh pid ${state.tunnelPid})`);
                 console.log('');
-                console.log(`Drive it:  agents computer apps --host ${opts.host}`);
-                console.log(`Stop:      agents computer stop --host ${opts.host}`);
+                console.log(`Drive it:  agents computer apps --device ${opts.device}`);
+                console.log(`Stop:      agents computer stop --device ${opts.device}`);
             }
             catch (err) {
                 console.error(`error: ${err.message}`);
@@ -733,12 +743,12 @@ function registerStartCommand(program) {
 function registerReloadCommand(program) {
     program
         .command('reload')
-        .description('Reload the allow-list policy (SIGHUP the local daemon) — or restart a remote Windows daemon with --host')
-        .option('--host <device>', 'Restart the remote Windows daemon (its scheduled task) instead of SIGHUPing the local one')
+        .description('Reload the allow-list policy (SIGHUP the local daemon) — or restart a remote Windows daemon with --device')
+        .option('--device <name>', 'Restart the remote Windows daemon (its scheduled task) instead of SIGHUPing the local one')
         .action(async (opts) => {
-        if (opts.host) {
+        if (opts.device) {
             try {
-                await reloadRemoteHelper(opts.host);
+                await reloadRemoteHelper(opts.device);
             }
             catch (err) {
                 console.error(`error: ${err.message}`);
@@ -771,7 +781,7 @@ function registerReloadCommand(program) {
         const domain = `gui/${uid}`;
         let pid = null;
         try {
-            const out = execFileSync('/bin/launchctl', ['print', `${domain}/${HELPER_LABEL}`], { encoding: 'utf-8' });
+            const out = execFileSync('/bin/launchctl', ['print', `${domain}/${helperLabel()}`], { encoding: 'utf-8' });
             const m = out.match(/\bpid\s*=\s*(\d+)/);
             if (m)
                 pid = parseInt(m[1], 10);
@@ -809,12 +819,12 @@ function registerReloadCommand(program) {
 function registerStopCommand(program) {
     program
         .command('stop')
-        .description('Deactivate the helper daemon — local launchd (macOS) or a remote Windows tunnel with --host')
-        .option('--host <device>', 'Tear down the remote tunnel and unregister the scheduled task')
+        .description('Deactivate the helper daemon — local launchd (macOS) or a remote Windows tunnel with --device')
+        .option('--device <name>', 'Tear down the remote tunnel and unregister the scheduled task')
         .action(async (opts) => {
-        if (opts.host) {
+        if (opts.device) {
             try {
-                const { tunnelKilled, taskRemoved } = await stopRemoteHelper(opts.host);
+                const { tunnelKilled, taskRemoved } = await stopRemoteHelper(opts.device);
                 console.log(`tunnel: ${tunnelKilled ? 'closed' : 'not running'}`);
                 console.log(`task:   ${taskRemoved ? 'unregistered' : 'not removed (device offline?)'}`);
             }
@@ -825,7 +835,7 @@ function registerStopCommand(program) {
             return;
         }
         const home = os.homedir();
-        const plistPath = path.join(home, 'Library', 'LaunchAgents', `${HELPER_LABEL}.plist`);
+        const plistPath = path.join(home, 'Library', 'LaunchAgents', `${helperLabel()}.plist`);
         const socketPath = resolveSocketPath();
         const uid = process.getuid?.();
         if (typeof uid !== 'number') {
@@ -851,7 +861,21 @@ function registerStopCommand(program) {
         }
     });
 }
-function renderLaunchAgentPlist(opts) {
+/**
+ * The helper's launchd plist.
+ *
+ * The `EnvironmentVariables` dict carries HOME (RUSH-2639, see
+ * `lib/service-manifest.ts`): launchd applies this dict on top of the LOGIN
+ * SESSION's environment, never the environment of whoever called `launchctl
+ * bootstrap`, so a manifest that omits HOME hands the helper the account home no
+ * matter which home the caller resolved. That is a silent escape from any
+ * redirected HOME — the hermetic test harness's, and an agent's isolated version
+ * home alike.
+ */
+export function renderLaunchAgentPlist(opts) {
+    const envXml = Object.entries(serviceManifestHomeEnv())
+        .map(([k, v]) => `        <key>${escapeXml(k)}</key>\n        <string>${escapeXml(v)}</string>`)
+        .join('\n');
     return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
@@ -864,6 +888,10 @@ function renderLaunchAgentPlist(opts) {
         <string>--socket</string>
         <string>${escapeXml(opts.socketPath)}</string>
     </array>
+    <key>EnvironmentVariables</key>
+    <dict>
+${envXml}
+    </dict>
     <key>RunAtLoad</key>
     <true/>
     <key>KeepAlive</key>

package/dist/commands/config.js

@@ -16,6 +16,7 @@
 import chalk from 'chalk';
 import { setHelpSections } from '../lib/help.js';
 import { parseConfigKey, formatAgentVersion, devicePropertyToConfigName, configKeyStorageHint, } from '../lib/config-keys.js';
+import { registerBudgetCommand } from './budget.js';
 import { resolveRunDefaults, setRunDefaultModel, setRunDefaultMode, setRunDefaultEffort, unsetRunDefault, } from '../lib/run-defaults.js';
 import { resolveTierOverride, setTierOverride, clearTierOverride } from '../lib/model-tier-overrides.js';
 import { getConfigValue, setConfigValue, unsetConfigValue, listConfig, } from '../lib/device-config.js';
@@ -63,6 +64,11 @@ function parseValue(key, parsed, raw) {
                 case 'tmux':
                 case 'browser.remote-control':
                     return parseBool(raw, key);
+                case 'browser.task-idle-minutes':
+                    if (!/^\d+$/.test(raw.trim())) {
+                        throw new Error(`Config key '${key}' expects a non-negative integer, got '${raw}'.`);
+                    }
+                    return Number.parseInt(raw.trim(), 10);
                 case 'notes':
                     return raw.trim();
                 case 'browser.profile':
@@ -111,8 +117,8 @@ function setConfig(parsed, value) {
             return;
         }
         case 'browser': {
-            // Device-local default lives in the central fleet.devices.<name>.config
-            // block (same store `agents devices config` / getConfigValue use). Bare
+            // Device-local default lives in the per-device doc's config: block
+            // (same store `agents devices config` / getConfigValue use). Bare
             // browser.profile targets this machine; devices.<name>.browser.profile
             // targets a peer.
             setConfigValue('browser.profile', value, parsed.device ? { device: parsed.device } : undefined);
@@ -295,6 +301,9 @@ function* listDeviceConfigEntries(device) {
             case 'browser.remote-control':
                 key = `${prefix}browser.remote-control`;
                 break;
+            case 'browser.task-idle-minutes':
+                key = `${prefix}browser.task-idle-minutes`;
+                break;
             case 'notes':
                 key = `${prefix}notes`;
                 break;
@@ -314,7 +323,7 @@ function* listDeviceConfigEntries(device) {
 export function registerConfigCommand(program) {
     const config = program
         .command('config')
-        .description('Get, set, list, and unset run defaults, tier overrides, the projects root, and device options.');
+        .description('Get, set, list, and unset run defaults, tier overrides, the projects root, device options, and spend caps.');
     setHelpSections(config, {
         examples: `
       agents config set run.claude@*.model best
@@ -331,11 +340,14 @@ export function registerConfigCommand(program) {
       agents config unset run.claude@*.tier.best
       agents config unset usage.primary-host
       agents config list
+      agents config budget
+      agents config budget set per_day 50
     `,
         notes: `
       Every agent/harness reference uses agent@version. Use * for all versions.
       Tier overrides are part of the run namespace: run.<agent@version>.tier.<tier>.
       Project root is auto-inferred from the current Git repository when unset.
+      Spend caps live under \`agents config budget\` (not a top-level command).
     `,
     });
     config
@@ -428,4 +440,5 @@ export function registerConfigCommand(program) {
             process.exit(1);
         }
     });
+    registerBudgetCommand(config);
 }

package/dist/commands/cost.d.ts

@@ -9,4 +9,5 @@
  * quota status per agent and is left untouched.
  */
 import type { Command } from 'commander';
-export declare function registerCostCommand(program: Command): void;
+/** Register `agents insights cost` under the insights parent. */
+export declare function registerCostCommand(insightsCmd: Command): void;

package/dist/commands/cost.js

@@ -5,18 +5,19 @@ import { queryUsageRollup, topSessionsByCost, } from '../lib/session/db.js';
 import { formatUsd, PRICING_VERSION } from '../lib/pricing/index.js';
 import { formatDuration } from '../lib/session/render.js';
 import { terminalWidth, truncateToWidth, stringWidth, padToWidth } from '../lib/session/width.js';
-export function registerCostCommand(program) {
-    addHostOption(program.command('cost'))
+/** Register `agents insights cost` under the insights parent. */
+export function registerCostCommand(insightsCmd) {
+    addHostOption(insightsCmd.command('cost'))
         .description('Roll up $ cost and duration across local agent sessions')
         .option('--json', 'Output the rollup as JSON')
         .option('--since <time>', 'Only sessions newer than this (e.g., 7d, 4w, or ISO date)')
         .option('--by <dimension>', 'Group the breakdown by: agent (default), project, day, or account (the Claude org that produced each session)')
         .addHelpText('after', `
 Examples:
-  agents cost                   Daily histogram + top sessions + per-agent breakdown
-  agents cost --since 30d       Last 30 days only
-  agents cost --by project      Break down by project instead of agent
-  agents cost --by day --json   Machine-readable daily rollup
+  agents insights cost                   Daily histogram + top sessions + per-agent breakdown
+  agents insights cost --since 30d       Last 30 days only
+  agents insights cost --by project      Break down by project instead of agent
+  agents insights cost --by day --json   Machine-readable daily rollup
 
 Cost is computed offline from a versioned per-model price table (${PRICING_VERSION}).
 `)