@phnx-labs/agents-cli 1.22.4 → 1.22.6

package/dist/lib/model-tiers.js

@@ -1,11 +1,27 @@
 import { getModelCatalog } from './models.js';
 import { getModelPricing } from './pricing/index.js';
+import { resolveTierOverride } from './model-tier-overrides.js';
 /** The four cross-harness cost tiers, cheapest -> most capable. */
 export const MODEL_TIERS = ['cheap', 'default', 'best', 'ultra'];
 /** True if `s` is one of the four tier tokens (not a concrete model id). */
 export function isTierToken(s) {
     return !!s && MODEL_TIERS.includes(s);
 }
+/**
+ * Curated tier ladders for harnesses the auto-ranker can't order from names/price
+ * (subscription harnesses with no price signal). Each rung is `[tier, matcher]` in
+ * cheap -> best order; the newest catalog id matching each rung fills that tier,
+ * missing tiers clamp. Extend this table rather than adding per-harness branches.
+ */
+const CURATED_LADDERS = {
+    // Kimi: K2.7 Highspeed < K2.7 Coding < K3 (the 1M-context default; k3-256k folds
+    // into K3). No ultra. The name heuristic can't tell K3 > K2.7, so curate it.
+    kimi: [
+        { tier: 'cheap', match: /highspeed/i },
+        { tier: 'default', match: /for-coding(?!.*highspeed)/i },
+        { tier: 'best', match: /(^|[-/])k3\b/i }, // K3 family incl. k3-256k; the plain id represents it
+    ],
+};
 // --- single-model harnesses: the tier is reasoning effort, not a model ---------
 const TIER_EFFORT = {
     cheap: 'low',
@@ -169,29 +185,100 @@ function rankCatalog(agent, models) {
 function rungIndexFor(tierIndex, n) {
     return n >= 4 ? Math.round((tierIndex / 3) * (n - 1)) : Math.min(tierIndex, n - 1);
 }
+/** Bucket an ordered (cheap -> dear) rung list onto the four tiers, clamping when < 4. */
+function bucketRungs(rungs) {
+    const n = rungs.length;
+    const map = {};
+    if (n === 0) {
+        // Fail-safe: no catalog -> every tier null, caller drops the --model flag.
+        for (const t of MODEL_TIERS)
+            map[t] = { tier: t, model: null };
+        return map;
+    }
+    // A tier that shares the rung of the tier below has no distinct rung -> mark clamped.
+    for (let i = 0; i < MODEL_TIERS.length; i++) {
+        const t = MODEL_TIERS[i];
+        const idx = rungIndexFor(i, n);
+        const shared = i > 0 && rungIndexFor(i - 1, n) === idx;
+        map[t] = shared
+            ? { tier: t, model: rungs[idx].id, clampedFrom: MODEL_TIERS[i - 1], note: `no distinct ${t} rung; using ${MODEL_TIERS[i - 1]}`, source: 'auto' }
+            : { tier: t, model: rungs[idx].id, source: 'auto' };
+    }
+    return map;
+}
+/** Build a tier map from a curated ladder against a catalog (newest match per rung). */
+function tierizeFromLadder(ladder, models) {
+    const usable = models.filter((m) => !PSEUDO.test(m.id));
+    const rungs = [];
+    for (const rung of ladder) {
+        const matches = usable.filter((m) => rung.match.test(m.id));
+        if (matches.length === 0)
+            continue;
+        // Prefer a plain id over a context-size variant (k3 over k3-256k) -- the
+        // variant folds into the rung but the plain model represents it -- then newest.
+        const plain = matches.filter((m) => !/-\d+[km]\b/i.test(m.id));
+        const pool = plain.length ? plain : matches;
+        rungs.push({ id: pool.reduce((a, b) => (newer(b.id, a.id) > 0 ? b : a)).id });
+    }
+    const map = bucketRungs(rungs);
+    for (const t of MODEL_TIERS)
+        if (map[t].model)
+            map[t].source = 'curated';
+    return map;
+}
 /**
- * Resolve all four tiers for an (agent, version). The map is what `agents models`
- * prints and what `resolveTier` indexes into.
+ * Resolve all four tiers for an (agent, version) -- what `agents models` prints and
+ * `resolveTier` indexes. Precedence: user override -> curated ladder / auto-ranking.
  */
 export function resolveTierMap(agent, version) {
-    // Droid: curated credit-multiplier map (no live catalog).
+    let base;
+    let catalogIds;
     if (agent === 'droid') {
-        return {
-            cheap: { tier: 'cheap', model: DROID_TIERS.cheap, note: 'Droid Core 0.55x' },
-            default: { tier: 'default', model: DROID_TIERS.default, note: 'Droid Core 0.6x' },
-            best: { tier: 'best', model: DROID_TIERS.best, note: '2x' },
-            ultra: { tier: 'ultra', model: DROID_TIERS.ultra, clampedFrom: 'best', note: 'capped at 2x (4x models excluded)' },
+        // Droid: curated credit-multiplier map (no live catalog to validate against).
+        base = {
+            cheap: { tier: 'cheap', model: DROID_TIERS.cheap, note: 'Droid Core 0.55x', source: 'curated' },
+            default: { tier: 'default', model: DROID_TIERS.default, note: 'Droid Core 0.6x', source: 'curated' },
+            best: { tier: 'best', model: DROID_TIERS.best, note: '2x', source: 'curated' },
+            ultra: { tier: 'ultra', model: DROID_TIERS.ultra, clampedFrom: 'best', note: 'capped at 2x (4x excluded)', source: 'curated' },
         };
+        catalogIds = null;
     }
-    const catalog = getModelCatalog(agent, version);
-    return tierizeModels(agent, catalog?.models ?? []);
+    else {
+        const catalog = getModelCatalog(agent, version);
+        const models = catalog?.models ?? [];
+        const ladder = CURATED_LADDERS[agent];
+        base = ladder ? tierizeFromLadder(ladder, models) : tierizeModels(agent, models);
+        catalogIds = catalog ? new Set(models.map((m) => m.id)) : null;
+    }
+    const overrides = resolveTierOverride(agent, version);
+    return applyTierOverrides(overrides, `${agent}@${version}`, catalogIds, base);
+}
+/**
+ * Apply user overrides on top of the auto/curated map. Pure (takes the resolved
+ * override map, no config lookup) so it is directly testable. An overridden id is
+ * used only when the version actually ships it (or when there is no catalog to
+ * check, e.g. Droid); otherwise the tier keeps its base value with a note.
+ */
+export function applyTierOverrides(overrides, label, catalogIds, base) {
+    if (Object.keys(overrides).length === 0)
+        return base;
+    const out = { ...base };
+    for (const t of MODEL_TIERS) {
+        const id = overrides[t];
+        if (!id)
+            continue;
+        if (!catalogIds || catalogIds.has(id)) {
+            out[t] = { tier: t, model: id, source: 'override' };
+        }
+        else {
+            out[t] = { ...base[t], note: `override "${id}" not shipped by ${label}; kept the ${base[t].source ?? 'auto'} pick`, source: base[t].source ?? 'auto' };
+        }
+    }
+    return out;
 }
 /**
- * Map a harness's catalog models onto the four tiers. Pure (no catalog lookup)
- * so it is directly testable with synthetic inputs. Ranks the models, collapses
- * variants, buckets onto cheap/default/best/ultra, and clamps absent tiers down
- * to the nearest lower one. A single-model harness maps the tiers to reasoning
- * effort instead of models.
+ * Map a harness's catalog models onto the four tiers. Pure (no catalog lookup) so
+ * it is directly testable. A single-model harness maps the tiers to reasoning effort.
  */
 export function tierizeModels(agent, models) {
     const rungs = rankCatalog(agent, models);
@@ -200,28 +287,10 @@ export function tierizeModels(agent, models) {
         const only = rungs[0].id;
         const map = {};
         for (const t of MODEL_TIERS)
-            map[t] = { tier: t, model: only, effort: TIER_EFFORT[t], note: 'single model — tier maps to reasoning effort' };
-        return map;
-    }
-    const n = rungs.length;
-    const map = {};
-    if (n === 0) {
-        // Fail-safe: no catalog -> every tier null, caller drops the --model flag.
-        for (const t of MODEL_TIERS)
-            map[t] = { tier: t, model: null };
+            map[t] = { tier: t, model: only, effort: TIER_EFFORT[t], note: 'single model — tier maps to reasoning effort', source: 'auto' };
         return map;
     }
-    // Map each tier onto a rung; a tier that shares the rung of the tier below it
-    // has no distinct rung of its own, so mark it clamped for an honest display.
-    for (let i = 0; i < MODEL_TIERS.length; i++) {
-        const t = MODEL_TIERS[i];
-        const idx = rungIndexFor(i, n);
-        const shared = i > 0 && rungIndexFor(i - 1, n) === idx;
-        map[t] = shared
-            ? { tier: t, model: rungs[idx].id, clampedFrom: MODEL_TIERS[i - 1], note: `no distinct ${t} rung; using ${MODEL_TIERS[i - 1]}` }
-            : { tier: t, model: rungs[idx].id };
-    }
-    return map;
+    return bucketRungs(rungs);
 }
 /** Resolve one tier for an (agent, version). Null model => caller drops the flag. */
 export function resolveTier(agent, version, tier) {

package/dist/lib/models.d.ts

@@ -60,6 +60,22 @@ export interface ModelSource {
  * Returns null if nothing usable is found.
  */
 export declare function locateModelSource(agent: AgentId, version: string): ModelSource | null;
+/**
+ * Extract Claude's model catalog from its bundle/binary.
+ *
+ * Bundle/binary contains:
+ *   - alias map: {opus:"claude-opus-4-7",sonnet:"claude-sonnet-4-6",haiku:"..."}
+ *   - per-cloud maps: {firstParty:"claude-opus-4-5-...",bedrock:"...",vertex:"...",...}
+ *   - constants: {OPUS_ID:"...",OPUS_NAME:"...",SONNET_ID:"...",...}
+ */
+/**
+ * Drop a bare `claude-<family>-<major>` (e.g. `claude-opus-4`) when a more specific
+ * sibling (`claude-opus-4-8`) is present. The bare form is only ever an internal
+ * `.includes("claude-opus-4")` prefix-check string in the binary, not a submittable
+ * id (issue #1892); a bare id with no sibling (e.g. `claude-sonnet-5`) is a real
+ * current model and is kept.
+ */
+export declare function dropBareLegacyIds(ids: string[]): string[];
 /**
  * Parse `grok models` stdout into a catalog. Exported for unit tests.
  *

package/dist/lib/models.js

@@ -21,7 +21,7 @@ const CACHE_PATH = getModelsCachePath();
  * Bump when the extractor logic changes shape in an incompatible way so cached
  * catalogs from older agents-cli builds are re-extracted.
  */
-const CACHE_SCHEMA_VERSION = 3;
+const CACHE_SCHEMA_VERSION = 4;
 /**
  * How long a cached 0-model extraction is trusted before we retry it. Bounds
  * the self-healing window for a transient failure (mid-install, a broken
@@ -310,6 +310,19 @@ function extractStrings(filePath, minLen = 6) {
  *   - per-cloud maps: {firstParty:"claude-opus-4-5-...",bedrock:"...",vertex:"...",...}
  *   - constants: {OPUS_ID:"...",OPUS_NAME:"...",SONNET_ID:"...",...}
  */
+/**
+ * Drop a bare `claude-<family>-<major>` (e.g. `claude-opus-4`) when a more specific
+ * sibling (`claude-opus-4-8`) is present. The bare form is only ever an internal
+ * `.includes("claude-opus-4")` prefix-check string in the binary, not a submittable
+ * id (issue #1892); a bare id with no sibling (e.g. `claude-sonnet-5`) is a real
+ * current model and is kept.
+ */
+export function dropBareLegacyIds(ids) {
+    return ids.filter((id) => {
+        const bareMajor = /^claude-[a-z]+-\d+$/.test(id);
+        return !(bareMajor && ids.some((o) => o !== id && o.startsWith(`${id}-`)));
+    });
+}
 function extractClaudeCatalog(text) {
     const aliases = {};
     const aliasMapMatch = text.match(/\{opus:"(claude-[^"]+)",sonnet:"(claude-[^"]+)",haiku:"(claude-[^"]+)"\}/);
@@ -380,8 +393,9 @@ function extractClaudeCatalog(text) {
         let sm;
         while ((sm = idRe.exec(text)) !== null)
             scanned.add(sm[0]);
-        if (scanned.size >= 2)
-            models = build(scanned);
+        const filtered = dropBareLegacyIds([...scanned]);
+        if (filtered.length >= 2)
+            models = build(filtered);
     }
     return { models, aliases };
 }

package/dist/lib/secrets/index.d.ts

@@ -91,6 +91,21 @@ export declare function setKeychainBackendForTest(b: KeychainBackend | null): Ke
  * fast-path must not engage. Always false in production (`backend` is null). */
 export declare function isKeychainBackendOverridden(): boolean;
 export declare const HMAC_KEY_ITEM = "agents-cli.hmackey";
+interface HmacKeyRecord {
+    v: number;
+    /** 64 hex chars — the raw HMAC-SHA256 key. */
+    k: string;
+    /** True once the one-time re-key has moved every cleartext-named item. */
+    migrated: boolean;
+    /** Old cleartext services whose hashed copies are verified but whose
+     * originals are not yet deleted (crash-resume list; deletes are silent). */
+    pendingDeletes?: string[];
+    /** True once this record has been re-stored no-ACL to heal a hmackey item that
+     * an OLD helper (pre the metadata/hmackey no-ACL migration fix) re-stamped with
+     * a biometry ACL. Set on the first read that heals it, so the heal runs exactly
+     * once per machine and never churns the keychain afterward. */
+    healedNoAcl?: boolean;
+}
 /** Force hashed service names on with a fixed key (test only). Pass null to
  * restore lazy production resolution. Composes with setKeychainBackendForTest
  * so unit tests exercise the exact transform production uses. */
@@ -106,6 +121,20 @@ export declare function withRawKeychainServiceNames<T>(fn: () => T): T;
  * the re-key migration and tests; runtime callers go through the primitives,
  * which apply this transparently. */
 export declare function hashedServiceName(item: string, key: Buffer): string;
+/**
+ * Heal a `hmackey` item that an OLD helper (pre the metadata/hmackey no-ACL
+ * migration fix) re-stamped with a biometry ACL. Such an item makes EVERY hashed
+ * keychain lookup pop the generic "Agents CLI needs to authenticate" sheet,
+ * because the HMAC key is read before every hashed name resolves. The migration
+ * fix stopped the re-stamping but never un-stamped an already-damaged item, and
+ * nothing else re-stores it once hashing is already active — so it prompts forever.
+ *
+ * This re-stores the record no-ACL exactly once per machine (guarded by
+ * `healedNoAcl`), turning every future read silent. The read that produced `rec`
+ * has already happened (and already prompted if it was ACL'd); this only writes.
+ * Returns true if it healed. Exported for tests. No-op when already healed.
+ */
+export declare function healHmacKeyNoAclOnce(rec: HmacKeyRecord): boolean;
 /**
  * The storage-layer service name for `item`: hashed when hashing is active,
  * the item itself otherwise. For callers that mix helper-enumerated

package/dist/lib/secrets/index.js

@@ -257,6 +257,25 @@ function writeHmacKeyRecord(rec) {
     setKeychainToken(HMAC_KEY_ITEM, JSON.stringify(rec), { noAcl: true });
     hashStateCache = null;
 }
+/**
+ * Heal a `hmackey` item that an OLD helper (pre the metadata/hmackey no-ACL
+ * migration fix) re-stamped with a biometry ACL. Such an item makes EVERY hashed
+ * keychain lookup pop the generic "Agents CLI needs to authenticate" sheet,
+ * because the HMAC key is read before every hashed name resolves. The migration
+ * fix stopped the re-stamping but never un-stamped an already-damaged item, and
+ * nothing else re-stores it once hashing is already active — so it prompts forever.
+ *
+ * This re-stores the record no-ACL exactly once per machine (guarded by
+ * `healedNoAcl`), turning every future read silent. The read that produced `rec`
+ * has already happened (and already prompted if it was ACL'd); this only writes.
+ * Returns true if it healed. Exported for tests. No-op when already healed.
+ */
+export function healHmacKeyNoAclOnce(rec) {
+    if (rec.healedNoAcl)
+        return false;
+    writeHmacKeyRecord({ ...rec, healedNoAcl: true });
+    return true;
+}
 function resolveHashState() {
     if (forcedTestKey)
         return { active: true, key: forcedTestKey, record: null };
@@ -404,6 +423,19 @@ function maybeAutoRekey() {
         return;
     const st = resolveHashState();
     if (st.active) {
+        // Heal an already-active machine whose hmackey was re-stamped ACL'd by an old
+        // helper (its read popped the generic Touch ID sheet on every hashed lookup).
+        // Runs once per machine; mutate the local so a later finishPendingDeletes write
+        // preserves the healed flag.
+        if (st.record && !st.record.healedNoAcl) {
+            try {
+                healHmacKeyNoAclOnce(st.record);
+                st.record.healedNoAcl = true;
+            }
+            catch {
+                /* next process retries */
+            }
+        }
         if (st.record?.pendingDeletes?.length) {
             try {
                 finishPendingDeletes(st.record);

package/dist/lib/secrets/mcp.js

@@ -24,7 +24,7 @@
  * unit-testable in-process.
  */
 import * as readline from 'readline';
-import { listBundles, readAndResolveBundleEnv, isHeadlessSecretsContext, readBundle, validateBundleName, } from './bundles.js';
+import { listBundles, readAndResolveBundleEnv, readBundle, validateBundleName, } from './bundles.js';
 /** MCP protocol revision this server negotiates. */
 export const MCP_PROTOCOL_VERSION = '2024-11-05';
 /** The single tool this server exposes. */
@@ -68,9 +68,13 @@ export function resolveSecret(bundle, key) {
         throw new Error(`Key '${key}' not found in bundle '${bundle}'.` +
             (available.length ? ` Available keys: ${available.join(', ')}.` : ' Bundle has no keys.'));
     }
-    // The MCP get_secret tool is typically served by a background/headless agent
-    // process; resolve broker-only there so it never raises an unwatched prompt.
-    const { env } = readAndResolveBundleEnv(bundle, { caller: 'secrets-mcp', keys: [key], keyMode: 'storage', agentOnly: isHeadlessSecretsContext() });
+    // An MCP `get_secret` tool call is a program asking for a value, never a human
+    // at a Touch ID sheet — so the read is always `agentOnly` (SEC-13: never pop
+    // biometry on its own). A `never`/no-ACL or broker-held bundle resolves
+    // silently; a locked bundle THROWS the actionable "unlock <name>" message,
+    // which propagates as the MCP tool error (the caller surfaces it) rather than
+    // popping an unanswerable prompt.
+    const { env } = readAndResolveBundleEnv(bundle, { caller: 'secrets-mcp', keys: [key], keyMode: 'storage', agentOnly: true });
     const value = env[key];
     if (value === undefined) {
         throw new Error(`Key '${key}' in bundle '${bundle}' could not be resolved.`);

package/dist/lib/session/sync/config.d.ts

@@ -29,24 +29,25 @@ export interface R2Config {
      */
     syncEncKey?: string;
 }
-/** Window after a prompt-bearing resolution failure during which we skip
- *  re-attempting (and thus re-prompting). SIGHUP / restart bypasses it. */
-export declare const RESOLVE_RETRY_COOLDOWN_MS: number;
 /** Drop the cached resolution so the next call reads the bundle fresh. Called on
  *  daemon SIGHUP (to pick up rotated credentials) and between tests. */
 export declare function clearR2ConfigCache(): void;
 /**
  * Resolve R2 credentials, reading the keychain at most once per process. The
- * first call reads (and may prompt for Touch ID); every later call returns the
- * memoized result. Throws if the bundle/keys are missing — failures are not
- * memoized, but see isSyncConfigured for the re-prompt cooldown.
+ * read is `agentOnly` (resolveR2Config), so it never prompts: a `never`/no-ACL or
+ * broker-held bundle resolves silently and is memoized; a locked `hold`/`always`
+ * bundle throws the actionable "unlock r2.backups" error. Throws (not memoized)
+ * when the bundle/keys are missing or locked — isSyncConfigured catches the throw
+ * and degrades to no-transport.
  */
 export declare function loadR2Config(): R2Config;
 /**
- * True when the sync bundle exists and resolves, without throwing. After a
- * prompt-bearing failure (e.g. a cancelled Touch ID) it returns false without
- * re-reading the keychain for RESOLVE_RETRY_COOLDOWN_MS, so a dismissed prompt
- * does not re-storm every cycle. `now` is injectable for tests.
+ * True when the sync bundle exists and resolves, without throwing. A missing OR
+ * locked bundle resolves to false (session-sync degrades to no-transport) and,
+ * because the `agentOnly` read never prompts, it is re-checked each cycle — so a
+ * later `agents secrets add` / `agents secrets unlock r2.backups` is picked up
+ * promptly with no daemon restart. `now` is accepted for a stable test signature
+ * but no longer gates a cooldown (there is no prompt-bearing failure to back off).
  */
-export declare function isSyncConfigured(now?: number): boolean;
+export declare function isSyncConfigured(_now?: number): boolean;
 export { machineId, normalizeHost } from '../../machine-id.js';

package/dist/lib/session/sync/config.js

@@ -11,7 +11,7 @@
  * actually wired. Credentials come from the `r2.backups` secrets bundle (OS
  * keychain on macOS, libsecret on Linux) — never from env or disk.
  */
-import { readAndResolveBundleEnv, isHeadlessSecretsContext } from '../../secrets/bundles.js';
+import { readAndResolveBundleEnv } from '../../secrets/bundles.js';
 /** Secrets bundle holding the R2 credentials. */
 export const SYNC_BUNDLE = 'r2.backups';
 /**
@@ -20,13 +20,17 @@ export const SYNC_BUNDLE = 'r2.backups';
  * without real credentials (no silent fallback).
  */
 function resolveR2Config() {
-    // A headless caller (no TTY — e.g. a routine or SSH-dispatched command) must
-    // resolve broker-only: isHeadlessSecretsContext() true means a broker miss
-    // can never pop an unattended Touch ID sheet on the user's screen (the same
-    // broker-only-when-headless rationale the secrets readers use). Using the
-    // shared predicate rather than a literal keeps it consistent with the other
-    // callers and lets any interactive caller of loadR2Config still prompt.
-    const { env } = readAndResolveBundleEnv(SYNC_BUNDLE, { caller: 'session-transport', agentOnly: isHeadlessSecretsContext() });
+    // Session-sync is a BACKGROUND read: the daemon's ~90s cycle (and the ~2-min
+    // watchdog) resolve this on their own, never at a human's request — so it must
+    // NEVER pop a Touch ID sheet, on the interactive launcher included (SEC-13: an
+    // agent launch never raises biometry on its own). The read is always
+    // `agentOnly`: a `never`/no-ACL or broker-held `r2.backups` bundle resolves
+    // silently; a locked `hold`/`always` bundle THROWS the actionable "unlock
+    // r2.backups" message instead of prompting. isSyncConfigured catches that throw
+    // and degrades to no-transport (sync disabled) with no prompt and no crash —
+    // unlock once (`agents secrets unlock r2.backups`) or set it no-ACL
+    // (`agents secrets policy r2.backups never`) for silent zero-friction sync.
+    const { env } = readAndResolveBundleEnv(SYNC_BUNDLE, { caller: 'session-transport', agentOnly: true });
     const accountId = env.R2_ACCOUNT_ID?.trim();
     const bucket = env.R2_BUCKET_NAME?.trim();
     const accessKeyId = env.R2_ACCESS_KEY_ID?.trim();
@@ -55,31 +59,32 @@ function resolveR2Config() {
     };
 }
 // ── Resolution cache ────────────────────────────────────────────────────────
-// The daemon calls isSyncConfigured() + syncSessions() every ~90s, and each used
-// to trigger a fresh read of the biometry-gated `r2.backups` keychain items —
-// one Touch ID prompt per gated item, every cycle, forever. We instead resolve
-// at most once per process: a success is memoized for the process lifetime
-// (cleared on daemon SIGHUP via clearR2ConfigCache), so subsequent cycles never
-// touch the keychain again. A *prompt-bearing* failure (cancelled Touch ID, etc.)
-// starts a cooldown so a dismissed prompt is not re-issued every cycle. A simply
-// absent bundle never prompts, so it is re-checked each cycle (fast pickup when
-// the user later adds credentials).
+// The daemon calls isSyncConfigured() + syncSessions() every ~90s. The read is
+// now `agentOnly` (resolveR2Config) so it can NEVER pop Touch ID — a locked bundle
+// throws a cheap, deterministic "unlock r2.backups" error instead. We still resolve
+// at most once per process: a success is memoized for the process lifetime (cleared
+// on daemon SIGHUP via clearR2ConfigCache), so subsequent cycles never touch the
+// keychain again. A failure (absent bundle, or a LOCKED `hold`/`always` bundle) is
+// NOT memoized and never prompts, so it is re-checked each cycle — session-sync
+// degrades to no-transport until the bundle is added / unlocked, then picks it up
+// promptly with no restart.
+//
+// The historical prompt-backoff cooldown (a cancelled Touch ID sheet) is gone: with
+// agentOnly there is no sheet to cancel, so no failure is prompt-bearing and none
+// needs a backoff.
 let cachedConfig = null;
-let lastPromptFailureAt = 0;
-/** Window after a prompt-bearing resolution failure during which we skip
- *  re-attempting (and thus re-prompting). SIGHUP / restart bypasses it. */
-export const RESOLVE_RETRY_COOLDOWN_MS = 30 * 60 * 1000; // 30 minutes
 /** Drop the cached resolution so the next call reads the bundle fresh. Called on
  *  daemon SIGHUP (to pick up rotated credentials) and between tests. */
 export function clearR2ConfigCache() {
     cachedConfig = null;
-    lastPromptFailureAt = 0;
 }
 /**
  * Resolve R2 credentials, reading the keychain at most once per process. The
- * first call reads (and may prompt for Touch ID); every later call returns the
- * memoized result. Throws if the bundle/keys are missing — failures are not
- * memoized, but see isSyncConfigured for the re-prompt cooldown.
+ * read is `agentOnly` (resolveR2Config), so it never prompts: a `never`/no-ACL or
+ * broker-held bundle resolves silently and is memoized; a locked `hold`/`always`
+ * bundle throws the actionable "unlock r2.backups" error. Throws (not memoized)
+ * when the bundle/keys are missing or locked — isSyncConfigured catches the throw
+ * and degrades to no-transport.
  */
 export function loadR2Config() {
     if (cachedConfig)
@@ -88,26 +93,23 @@ export function loadR2Config() {
     return cachedConfig;
 }
 /**
- * True when the sync bundle exists and resolves, without throwing. After a
- * prompt-bearing failure (e.g. a cancelled Touch ID) it returns false without
- * re-reading the keychain for RESOLVE_RETRY_COOLDOWN_MS, so a dismissed prompt
- * does not re-storm every cycle. `now` is injectable for tests.
+ * True when the sync bundle exists and resolves, without throwing. A missing OR
+ * locked bundle resolves to false (session-sync degrades to no-transport) and,
+ * because the `agentOnly` read never prompts, it is re-checked each cycle — so a
+ * later `agents secrets add` / `agents secrets unlock r2.backups` is picked up
+ * promptly with no daemon restart. `now` is accepted for a stable test signature
+ * but no longer gates a cooldown (there is no prompt-bearing failure to back off).
  */
-export function isSyncConfigured(now = Date.now()) {
+export function isSyncConfigured(_now = Date.now()) {
     if (cachedConfig)
         return true;
-    if (lastPromptFailureAt && now - lastPromptFailureAt < RESOLVE_RETRY_COOLDOWN_MS)
-        return false;
     try {
         loadR2Config();
         return true;
     }
-    catch (err) {
-        // A missing bundle never prompts, so keep re-checking it each cycle (so a
-        // later `agents secrets add` is picked up quickly). Any other failure may
-        // have cost a prompt (cancelled Touch ID, keychain error) — back off.
-        if (!/not found/i.test(err.message))
-            lastPromptFailureAt = now;
+    catch {
+        // Absent or locked bundle — never prompted (agentOnly), so no backoff: keep
+        // re-checking each cycle for fast pickup once the bundle is added / unlocked.
         return false;
     }
 }

package/dist/lib/share/config.js

@@ -76,6 +76,9 @@ export function storeWriteToken(token) {
 export function readWriteTokenFromBundle() {
     const { env } = readAndResolveBundleEnv(SHARE_BUNDLE, {
         caller: 'share',
+        // Explicit `agents share` command (a human published a file): a headless agent
+        // subprocess resolves broker-only, an interactive human may unlock. This is NOT
+        // an agent LAUNCH read (that is exec.ts's --secrets injection, always agentOnly).
         agentOnly: isHeadlessSecretsContext(),
     });
     const token = env[SHARE_TOKEN_KEY];
@@ -133,6 +136,7 @@ export function readCloudflareCreds(bundle = DEFAULT_CF_BUNDLE, override) {
     }
     const { env } = readAndResolveBundleEnv(bundle, {
         caller: 'share',
+        // Explicit `agents share setup` provisioning read — not an agent launch.
         agentOnly: isHeadlessSecretsContext(),
     });
     const find = (re) => {

package/dist/lib/types.d.ts

@@ -764,6 +764,16 @@ export interface Meta {
      */
     isolatedAgents?: Partial<Record<AgentId, string>>;
     run?: RunConfig;
+    /**
+     * Cost-tier overrides for `--model cheap|default|best|ultra`. Keyed by the same
+     * `<agent>:<version>` selector run.defaults uses (`kimi:*`, `kimi:0.19.2`); each
+     * value maps a tier to a concrete model id. Written by `agents models tier set`,
+     * never hand-edited. Resolution: exact version selector wins over `<agent>:*`,
+     * which wins over the auto-ranking. See lib/model-tier-overrides.ts.
+     */
+    model?: {
+        tiers?: Record<string, Partial<Record<'cheap' | 'default' | 'best' | 'ultra', string>>>;
+    };
     /**
      * Daemon watchdog config. `rotate` (default `on`) lets the watchdog rotate a
      * rate-limited session IN PLACE onto a healthy account/harness via

package/dist/lib/versions.js

@@ -1358,6 +1358,38 @@ function relocateGrokBinaryToVersionHome(installedVersion) {
             return;
     }
 }
+/**
+ * Grok's version directory is keyed by release number alone, not by account —
+ * so two DIFFERENT accounts that both self-update to the identical upstream
+ * release ("latest") target the SAME on-disk `versions/grok/<version>/` home.
+ * When that happens, the second account's `agents add grok@latest` writes
+ * into an already-signed-in directory: grok's own auth flow treats
+ * `~/.grok/auth.json` as authoritative for whichever process invoked it, so
+ * the second account's credential record lands in a file that still names it
+ * as the first account's install everywhere else in agents-cli's bookkeeping.
+ *
+ * Refuse before that happens: if the target version's home already has a
+ * signed-in account whose identity differs from the account currently
+ * driving this update (the previous global default), fail loud instead of
+ * letting the second account silently displace the first's install.
+ */
+async function checkGrokAccountCollision(installedVersion) {
+    const targetHome = getVersionHomePath('grok', installedVersion);
+    if (!fs.existsSync(targetHome))
+        return; // fresh directory, nothing to collide with
+    const sourceVersion = getGlobalDefault('grok');
+    if (!sourceVersion || sourceVersion === installedVersion)
+        return; // same install, not a collision
+    const [targetEmail, sourceEmail] = await Promise.all([
+        getAccountEmail('grok', targetHome),
+        getAccountEmail('grok', getVersionHomePath('grok', sourceVersion)),
+    ]);
+    if (!targetEmail || !sourceEmail || targetEmail === sourceEmail)
+        return;
+    throw new Error(`grok@${installedVersion} is already installed for ${targetEmail}, but this update is running as ${sourceEmail}. ` +
+        `Grok's self-updater can't distinguish two accounts that land on the same release — sign in to ${targetEmail}'s ` +
+        `install (agents use grok@${installedVersion}) before updating it, or wait until the releases diverge.`);
+}
 /**
  * Install a specific version of an agent.
  */
@@ -1428,6 +1460,9 @@ export async function installVersion(agent, version, onProgress, opts) {
                 // install into the real version so it stops shadowing `agents view`.
                 await reconcileStaleLatestDir(agent, installedVersion);
             }
+            if (agent === 'grok') {
+                await checkGrokAccountCollision(installedVersion);
+            }
             onProgress?.(`${agentConfig.name} installed. Setting up agents-cli version home for isolation...`);
         }
         catch (err) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@phnx-labs/agents-cli",
-  "version": "1.22.4",
+  "version": "1.22.6",
   "description": "One CLI for all your AI coding agents - versions, config, cloud dispatch, sessions, and teams (now with first-class Grok Build CLI support)",
   "type": "module",
   "main": "dist/index.js",