@phnx-labs/agents-cli 1.22.40 → 1.22.41

package/CHANGELOG.md

@@ -1,5 +1,27 @@
 # Changelog
 
+## 1.22.41
+
+- **BREAKING: the top-level `agents timeline` command is removed — use `agents feed --filter updates` (RUSH-2692).** `timeline` was a pure alias of `agents feed --filter updates` (its own description said so), a second door to one stream against the CLI-surface convention of one owned noun with no duplicated surface. It is gone entirely, not deprecated: `agents timeline` now reports `unknown command`, and `timeline` is retired from distance-1 auto-correct so a stale invocation fails loudly instead of running a neighbouring command. `agents feed --filter updates` is unchanged, and the sibling observe aliases `agents inbox` and `agents roster` are unaffected. Source: `apps/cli/src/commands/feed.ts`, `apps/cli/src/lib/observe-aliases.ts`, `apps/cli/src/lib/startup/command-registry.ts`, `apps/cli/src/bootstrap.ts`.
+
+- **Session preview leads with the title and wraps the last response to the pane (RUSH-2757).** `agents sessions preview` now opens its header with the session's title (`session.label` — an agent-generated name / `/rename` / the `--name` launch handle) instead of burying it, and the agent's last response is wrapped to the terminal width rather than running off the right edge as one long line. Wrapping measures visible width (ANSI-aware), so coloured output is not miscounted, and lines that already fit keep their rendered-markdown indentation. Source: `apps/cli/src/commands/sessions-picker.ts`, `apps/cli/src/lib/wrap.ts`.
+
+- **`release-manifest.sh` helper digests are keyed by path relative to `--repo-root`, and `release-attestation-produce.sh` now writes the helper manifest it needs (RUSH-2766).** `hash_tree` used to bake the ABSOLUTE file path into every helper's `input-digest`, so a digest recorded in one worktree could never match the same recomputation elsewhere — `require_helpers` structurally could not pass for any release, and v1.22.40 was finished only by hand-recomputing the manifest inside a fixed-path worktree on `mac-mini` and re-uploading it to the GitHub release. Paths are now hashed relative to the repo root, so the same digest reproduces across machines and worktrees (demonstrated: identical `sha256:` for all three helpers computed from two independent checkouts). Separately, `release.sh` has always consumed `release-manifest.json` (`require` at :231, `upload_release_proof` at :976) with no producer writing it — the same consumer-without-producer gap RUSH-2749 fixed for the attestation itself. `release-attestation-produce.sh` now writes/updates it alongside `ATTEST.json`: an unchanged helper carries its prior record forward, `keychain`/`menubar` are re-recorded from the fresh signed assets this script's own Darwin block builds, and a drifted `computer-mac` digest with no prior record fails the producer closed rather than shipping a stale or missing helper record. Source: `apps/cli/scripts/release-manifest.sh`, `apps/cli/scripts/release-attestation-produce.sh`, `apps/cli/docs/release.md`.
+
+- **BREAKING: `agents secrets` no longer prints bundle values — the plaintext export and bundle-key `get` are removed; run commands under `agents secrets exec` instead (RUSH-2774).** The `eval "$(agents secrets export <bundle> --plaintext)"` one-liner put every value of a bundle onto stdout, which inside a coding-agent session means the model's context and the synced session transcript — and agents copied it reflexively from the CLI's own help and scripts. `secrets export` is now transfer-only (`--device`, `--to-1password`, `--to-file`; anything else refuses, naming the alternatives); `secrets get <bundle> <KEY>` refuses, naming `agents secrets exec <bundle> -- printenv <KEY>`; `secrets view --reveal` refuses inside an agent session (`AGENTS_RUNTIME`/`AGENT_SESSION_ID`/`CLAUDECODE` markers) and its non-TTY `--reveal --plaintext` escape is gone; the raw-item `secrets get <item>` stays available everywhere — fleet shell hooks running inside sessions capture single ad-hoc tokens into their own variables, the accepted narrower residual. The SSH remote resolve behind `secrets exec --device` and `run --secrets <b>@<host>` still works: it rides a hidden, marker-gated transport (`AGENTS_SECRETS_REMOTE_TRANSPORT`), so a newer CLI keeps resolving from an older remote during a fleet rollout, while an older CLI against a newer remote fails loud with an upgrade hint. First-party scripts (`sandbox.sh`, both `release.sh`) now re-enter themselves under `agents secrets exec`, so values ride the child environment and never touch stdout. Migration for eval scripts: `agents secrets exec <bundle> -- <your command>`, or `VAR="$(agents secrets exec <bundle> -- printenv KEY)"` for a single value. Spec: SEC-9/SEC-9b/SEC-9c, SEC-GAP-10. Source: `apps/cli/src/commands/secrets.ts`, `apps/cli/src/lib/secrets/{headless,remote}.ts`, `apps/cli/scripts/{sandbox,release}.sh`, `apps/ext/scripts/release.sh`.
+
+- **Fix a publish crash on any non-latin1 label, meta value, or repo name (RUSH-2784).** `fetch` encodes header values as a ByteString, so a title containing an ellipsis, a curly quote, an emoji, or CJK text threw `TypeError: Cannot convert argument to a ByteString` mid-publish — an unhandled stack trace after the body had already been read and the OG cover uploaded. Every free-text header (`x-share-label`, `x-share-repo`, `x-share-host`, `x-share-meta`, and the provenance set) now goes through `toHeaderValue()`, which transliterates common typographic punctuation to ASCII and drops the rest of the non-latin1 range. Still lossy for a title in a non-latin script, which publishes as `(unnamed)`; full Unicode needs percent-encoding plus a matching Worker decode, tracked as RUSH-2786. Source: `apps/cli/src/lib/share/publish.ts`.
+
+- **`agents sessions share <id>` publishes a session as a link (RUSH-2784).** Sharing a session took three commands and a detour through the external artifacts-cli, so nobody ran it — every piece already existed (`sessions render` produces a redacted transcript, and the R2-backed share Worker has served artifacts for a month), but nothing wired them together. One verb now renders the session as a self-contained branded HTML page and publishes it: `agents sessions share a1b2c3d4` prints `https://share.agents-cli.sh/<you>/session-a1b2c3d4`. **Unlisted by default**, unlike `agents artifacts share` — a transcript carries file paths, command output, and error text, so it stays out of the public gallery until `--public` asks for it (the URL is still world-readable: unlisted is a capability URL, not a secret). The page is escaped rather than passed through, so a session that merely printed a `<script>` tag does not ship an executable one. Publishing inherits the existing email/credential scan and the 30d default expiry; `--reasoning fold` keeps the model's reasoning in collapsible sections, `--expire never` opts out of decay. Source: `apps/cli/src/commands/sessions-share.ts`, `apps/cli/src/lib/session/share-html.ts`, `apps/cli/src/lib/share/publish.ts`.
+
+- **`agents browser use [name]` is the one command for choosing this machine's default browser profile (RUSH-2820).** A name writes the existing device-scoped `browser.profile` config key; a bare interactive invocation opens a picker over configured profiles and installed browsers, while a headless invocation prints the current default and usage. `--unset` and `auto` restore auto-detect. `agents browser profiles use` is an alias, and the hidden `profiles set-default` compatibility alias now points users to `browser use`. Source: `apps/cli/src/commands/browser.ts`.
+
+- **Claude workspace trust now carries across pinned version homes (#2776).** Every pinned claude version gets an isolated home, and workspace trust (`projects[<path>].hasTrustDialogAccepted` in `.claude.json`) never carried into a new one — so the first interactive launch of each newly pinned version re-showed the workspace-trust dialog once per project, complete with the "this folder pre-approves N tool permissions" warning on repos trusted for months (headless runs skip the dialog, so the re-prompt could surface weeks after pinning and read as a trust regression). `agents add` / `agents use` now carry trust via a new `claude-trust` manifest strategy that projects ONLY the accepted trust flags out of the source `.claude.json` — the login (`oauthAccount`) and per-session stats stay per-version, same posture as the removed `.codex/auth.json` carry. A target entry's stamped-default `false` is promoted (Claude Code never persists a decline), all its other keys are preserved, the target is backed up before modification, and the write is atomic (a running Claude session rewrites this exact file). Codex was already covered: `projects.*.trust_level` rides along in `config.toml`. Source: `apps/cli/src/lib/settings-manifest.ts`.
+
+- **Arc is a recognized browser type, and `agents browser` now refuses to drive it with a clear error instead of crashing it (#2779, #2778).** `arc` joins the Chromium-family `BrowserType` (detected at `/Applications/Arc.app`, macOS-only; `agents browser profiles seed` creates an `arc-local` profile). But Arc answers `Browser.getVersion` while exposing **zero** CDP page targets and **crashing** the moment a new tab is requested (`Target.createTarget`), so it is not actually drivable. Every tab-creating path now routes through one guard (`createPageTarget`) that throws an actionable "use Comet/Chrome/Chromium/Brave" error for an Arc profile rather than crashing the user's Arc window. The browser skill documents this and teaches showing a review doc/plan/report via `agents browser navigate --url file://<path>` (one reused tab, refreshed in place) instead of a raw `open <file>` that spawns a duplicate tab every call. Source: `apps/cli/src/lib/browser/service.ts`, `apps/cli/src/lib/browser/chrome.ts`, `apps/cli/src/lib/browser/cdp.ts`, `skills/browser/SKILL.md`.
+
+- **Slack can now trigger an agent on your box and reply in-thread.** The signed webhook receiver (`agents webhooks serve` and the daemon `webhook-receiver`) accepts a third source, `POST /hooks/slack`: it verifies Slack's `v0` request signature with a 5-minute replay guard, answers the one-time `url_verification` handshake, and parses both slash commands (`/agents AGI: …`) and `app_mention` events. A matching `~/.agents/webhooks/*.yml` handler with `source: slack` (and optional `command`/`channel` filters) runs an agent scoped to the project named in the message — a handler may now template `project`/`cwd` from the delivery (`project: "{{slack.project}}"`), with the new `{{slack.*}}` namespace exposing `prompt`, `project`, `channel`, `thread_ts`, `user`, `text`, and `command`. The agent replies into the same thread through the existing `agents send --channel slack --to <channel> --thread <ts>` — no new outbound code. The receiver bundle gains `SLACK_SIGNING_SECRET` (and `SLACK_BOT_TOKEN` when the reply uses the Slack Web API). Setup, a ready-to-paste app manifest, and an example handler are in `docs/routines.md` and `docs/examples/slack/`. Source: `apps/cli/src/lib/triggers/webhook.ts`, `apps/cli/src/lib/triggers/handlers.ts`, `apps/cli/src/lib/daemon-webhooks.ts`, `apps/cli/src/commands/webhook.ts`.
+
 ## 1.22.40
 
 ---

package/README.md

@@ -285,6 +285,9 @@ agents sessions a1b2c3d4 --markdown
 # Render a shareable, redacted Markdown transcript with the session preview on top
 agents sessions render a1b2c3d4 -o session.md
 
+# Or publish it as a link in one step (unlisted + redacted by default)
+agents sessions share a1b2c3d4
+
 # Just the last 3 turns, user messages only
 agents sessions a1b2c3d4 --last 3 --include user
 
@@ -369,6 +372,8 @@ Landing on a session cold? `agents sessions <id>` prints a catch-up digest: an i
 
 Sharing a session uses `agents sessions render <id> -o session.md`, not the raw harness JSONL. The document starts with that same preview, then presents user and assistant turns, fenced commands, structured tool arguments, and bounded tool output. Credential-shaped values and local home paths are redacted by default; `--no-redact` is for local-only inspection.
 
+`agents sessions share <id>` goes one step further and publishes that document as a self-contained web page on your own share endpoint, printing the link. It is **unlisted** unless you pass `--public` — a transcript carries file paths, command output, and error text that a plan does not, so it stays out of your public gallery by default, and emails are masked on top of the render's own redaction. The slug is `session-<shortId>`, so re-sharing one session updates one URL.
+
 ### Resume anywhere — and stay resumed
 
 Pick up any past conversation and drop it back into a terminal:

package/dist/bootstrap.js

@@ -258,7 +258,6 @@ Run and dispatch:
 
 Observe (read the fleet — no store merge; aliases point at the real readers):
   feed / inbox                    Needs-you inbox (open blocks waiting on you)
-  timeline                        Agent progress stream (= feed --filter updates)
   sessions --active               Live agents (who is running right now)
   events                          Unified ops + activity event trail
   audit                           Tamper-evident run-dispatch log (not events)

package/dist/cli/command-registry.js

@@ -218,9 +218,8 @@ export const COMMAND_LOADERS = {
     send: [loadSend],
     notify: [loadSend],
     feed: [loadFeed],
-    // Observe-umbrella aliases of feed / feed --filter updates.
+    // Observe-umbrella alias of feed (the `timeline` alias was removed in RUSH-2692).
     inbox: [loadFeed],
-    timeline: [loadFeed],
     mailboxes: [loadMailboxes],
     mailbox: [loadMailboxes],
     serve: [loadServe],

package/dist/commands/browser.d.ts

@@ -1,3 +1,18 @@
 import { Command } from 'commander';
+import { type BrowserProfile } from '../lib/browser/profiles.js';
+import { listInstalledBrowsers } from '../lib/browser/chrome.js';
 export declare function registerBrowserCommand(program: Command): void;
 export declare function registerBrowserSubcommands(program: Command): void;
+interface BrowserUseOptions {
+    unset?: boolean;
+}
+interface BrowserUseChoice {
+    name: string;
+    value: {
+        name: string;
+        installed?: ReturnType<typeof listInstalledBrowsers>[number];
+    };
+}
+export declare function buildBrowserUseChoices(profiles: BrowserProfile[], installed: ReturnType<typeof listInstalledBrowsers>, current?: string): BrowserUseChoice[];
+export declare function runBrowserUse(name: string | undefined, opts: BrowserUseOptions, interactive?: boolean): Promise<boolean>;
+export {};

package/dist/commands/browser.js

@@ -6,7 +6,7 @@ import { resolveActor } from '../lib/actor.js';
 import { loginsForProfile, profilesLoggedInto, serviceForUrl, loginsWithAccountsForProfile, accountsForProfile, credKeysForService, AUTH_SIGNATURES, } from '../lib/browser/login-detection.js';
 import { parseSecretRef } from '../lib/browser/secret-ref.js';
 import { readAndResolveBundleEnv, bundleExists, readBundle, describeBundle } from '../lib/secrets/bundles.js';
-import { findBrowserPath, getPortOccupant, isLauncherScript } from '../lib/browser/chrome.js';
+import { findBrowserPath, getPortOccupant, isLauncherScript, listInstalledBrowsers } from '../lib/browser/chrome.js';
 import { listProfileCacheDirs, removeProfileCache, listAllProfileSnapshots, buildProfilePrunePlan, pruneProfiles, PRUNE_REASON_TEXT, } from '../lib/browser/runtime-state.js';
 import { DEFAULT_VIEWPORT } from '../lib/browser/devices.js';
 import { runBrowserSessionsCommand } from './browser-sessions-picker.js';
@@ -49,7 +49,7 @@ const TASK_OPTION_DESC = 'Task name (defaults to $AGENTS_BROWSER_TASK, else the
 // instead of an alphabetical dump. Everything not listed falls into a
 // trailing "Other commands" section automatically.
 const BROWSER_HELP_GROUPS = [
-    { title: 'Session lifecycle', names: ['start', 'done', 'status', 'gc'] },
+    { title: 'Session lifecycle', names: ['use', 'start', 'done', 'status', 'gc'] },
     { title: 'Fast action loop', names: ['stream'] },
     {
         title: 'Drive the page',
@@ -105,22 +105,104 @@ export function registerBrowserCommand(program) {
       Most agent workflows should use the 'browser' skill instead of raw subcommands.
       The skill wraps profile selection, snapshotting, and tunneling.
 
-      Browser support: Chromium-family only (Chrome, Comet, Chromium, Brave, Edge).
+      Browser support: Chromium-family only (Chrome, Comet, Chromium, Brave, Edge, Arc).
       Safari and Firefox are not supported — they don't speak the Chrome DevTools
       Protocol the way agents browser expects. On Windows, Edge is the default
       because it's preinstalled. On macOS and Linux, Chrome is preferred when
       installed; otherwise the first Chromium-family binary on disk wins.
     `,
     });
+    registerBrowserUseCommand(browser);
     registerProfilesCommands(browser);
     registerTaskCommands(browser);
     registerCommandGroups(browser, BROWSER_HELP_GROUPS);
 }
 export function registerBrowserSubcommands(program) {
+    registerBrowserUseCommand(program);
     registerProfilesCommands(program);
     registerTaskCommands(program);
     registerCommandGroups(program, BROWSER_HELP_GROUPS);
 }
+export function buildBrowserUseChoices(profiles, installed, current) {
+    const choices = profiles.map((profile) => ({
+        name: `${profile.name}${profile.name === current ? ' (current)' : ''}`,
+        value: { name: profile.name },
+    }));
+    const known = new Set(profiles.map((profile) => profile.name));
+    for (const browser of installed) {
+        const name = `${browser.browserType}-local`;
+        if (!known.has(name)) {
+            choices.push({ name: `${name} (installed ${browser.browserType})`, value: { name, installed: browser } });
+        }
+    }
+    return choices;
+}
+export async function runBrowserUse(name, opts, interactive = isInteractiveTerminal()) {
+    if (opts.unset || name === 'auto') {
+        unsetConfigValue('browser.profile');
+        console.log('Default browser profile cleared. `agents browser start` will auto-detect an installed Chromium-family browser.');
+        return true;
+    }
+    let selectedName = name;
+    if (!selectedName) {
+        const current = getConfiguredDefaultProfileName();
+        if (!interactive) {
+            console.log(current
+                ? `Default browser profile (this machine): ${current}`
+                : 'Default browser profile (this machine): auto-detect');
+            console.log('Usage: agents browser use <name>  (or --unset)');
+            return true;
+        }
+        const choices = buildBrowserUseChoices(await listProfiles(), listInstalledBrowsers(), current);
+        if (choices.length === 0) {
+            console.error('No configured profiles or supported installed browsers found.');
+            console.error('Create one with: agents browser profiles create <name> --browser chrome');
+            return false;
+        }
+        const { select } = await import('@inquirer/prompts');
+        const selected = await select({ message: 'Select default browser profile:', choices });
+        selectedName = selected.name;
+        if (selected.installed) {
+            const freePort = await findFreeProfilePort();
+            await createProfile({
+                name: selected.name,
+                description: `Seeded ${selected.installed.browserType} profile`,
+                browser: selected.installed.browserType,
+                binary: selected.installed.binary,
+                endpoints: [`cdp://127.0.0.1:${freePort}`],
+                viewport: { width: DEFAULT_VIEWPORT.width, height: DEFAULT_VIEWPORT.height },
+            });
+        }
+    }
+    const target = await getProfile(selectedName);
+    if (!target) {
+        console.error(`Profile "${selectedName}" not found.`);
+        const all = await listProfiles();
+        if (all.length > 0)
+            console.error(`Available profiles: ${all.map((profile) => profile.name).join(', ')}`);
+        return false;
+    }
+    setConfigValue('browser.profile', selectedName);
+    const endpoint = Object.values(getEndpointPresets(target))[0]?.target ?? '';
+    console.log(`Default browser profile (this machine) is now "${selectedName}" (${target.browser}${endpoint ? `, ${endpoint}` : ''}).`);
+    console.log('Bare `agents browser start` and `--profile default` will use it.');
+    return true;
+}
+function configureBrowserUseCommand(command, deprecated = false) {
+    command
+        .description('Pick the profile `agents browser start` uses when no --profile is passed. No name opens a picker on a TTY or prints the current default headlessly.')
+        .option('--unset', 'Clear the configured default (revert to auto-detecting an installed browser)')
+        .action(async (name, opts) => {
+        if (deprecated) {
+            console.warn(chalk.yellow('Deprecation: `agents browser profiles set-default` is replaced by `agents browser use`.'));
+        }
+        if (!await runBrowserUse(name, opts))
+            process.exitCode = 1;
+    });
+}
+function registerBrowserUseCommand(browser) {
+    configureBrowserUseCommand(browser.command('use [name]'));
+}
 /**
  * Whether a profile's secrets bundle holds login creds for `service`
  * (`<PREFIX>_USERNAME` + `<PREFIX>_PASSWORD`). Reads bundle METADATA only (key
@@ -174,43 +256,36 @@ function registerProfilesCommands(browser) {
         for (const line of formatProfilesTable(scoped, configuredDefault))
             console.log(line);
     });
-    const browserProfileDeprecation = chalk.yellow('Deprecation: `agents browser profiles set-default` is replaced by `agents config set browser.profile <name>`.');
     profiles
-        .command('set-default [name]')
-        .description('Set the profile `agents browser start` uses when no --profile is passed (also re-points an explicit `--profile default`). Device-local — each machine has its own. No name prints the current value.')
-        .option('--unset', 'Clear the configured default (revert to auto-detecting an installed browser)')
-        .action(async (name, opts) => {
-        console.warn(browserProfileDeprecation);
-        if (opts.unset) {
-            unsetConfigValue('browser.profile');
-            console.log('Default browser profile cleared. `agents browser start` will auto-detect an installed Chromium-family browser.');
-            return;
+        .command('seed')
+        .description('Create a machine-local profile for each installed browser (named <browser>-local), so you can pick or use one instead of hand-crafting each. Idempotent — existing profiles are left untouched.')
+        .action(async () => {
+        const installed = listInstalledBrowsers();
+        if (installed.length === 0) {
+            console.error('No supported browser found to seed a profile for.');
+            process.exit(1);
         }
-        if (!name) {
-            const current = getConfiguredDefaultProfileName();
-            if (current) {
-                console.log(`Default browser profile (this machine): ${current}`);
-            }
-            else {
-                console.log('No default browser profile set. `agents browser start` auto-detects an installed Chromium-family browser.');
-                console.log('Set one with: agents config set browser.profile <name>');
+        for (const { browserType, binary } of installed) {
+            const name = `${browserType}-local`;
+            if (await getProfile(name)) {
+                console.log(`= ${name} (already exists)`);
+                continue;
             }
-            return;
-        }
-        const target = await getProfile(name);
-        if (!target) {
-            console.error(`Profile "${name}" not found.`);
-            const all = await listProfiles();
-            if (all.length > 0)
-                console.error(`Available profiles: ${all.map((p) => p.name).join(', ')}`);
-            process.exit(1);
+            const freePort = await findFreeProfilePort();
+            await createProfile({
+                name,
+                description: `Seeded ${browserType} profile`,
+                browser: browserType,
+                binary,
+                endpoints: [`cdp://127.0.0.1:${freePort}`],
+                viewport: { width: DEFAULT_VIEWPORT.width, height: DEFAULT_VIEWPORT.height },
+            });
+            console.log(`+ ${name} (${browserType})`);
         }
-        setConfigValue('browser.profile', name);
-        const eps = getEndpointPresets(target);
-        const epStr = Object.values(eps)[0]?.target ?? '';
-        console.log(`Default browser profile (this machine) is now "${name}" (${target.browser}${epStr ? `, ${epStr}` : ''}).`);
-        console.log('Bare `agents browser start` and `--profile default` will use it.');
+        console.log('Pick your default with: agents browser use <name>');
     });
+    configureBrowserUseCommand(profiles.command('use [name]'));
+    configureBrowserUseCommand(profiles.command('set-default [name]', { hidden: true }), true);
     profiles
         .command('logins')
         .description('Show which login-gated services each profile has a live session for, the account signed in, and whether login creds are available in the profile\'s secrets bundle (reads cookie/username presence only, never decrypts).')
@@ -239,7 +314,7 @@ function registerProfilesCommands(browser) {
             }
         }
     });
-    const VALID_BROWSERS = ['chrome', 'comet', 'chromium', 'brave', 'edge', 'custom'];
+    const VALID_BROWSERS = ['chrome', 'comet', 'chromium', 'brave', 'edge', 'arc', 'custom'];
     profiles
         .command('create <name>')
         .description('Create a new browser profile (machine-local unless --fleet)')
@@ -439,7 +514,7 @@ function registerProfilesCommands(browser) {
             (removed > 0 ? ` (and ${removed} cache dir${removed === 1 ? '' : 's'})` : ''));
         if (getConfiguredDefaultProfileName() === name) {
             console.error(`warning: "${name}" was this machine's default browser profile; ` +
-                `\`agents browser start\` will auto-detect until you run: agents config set browser.profile <name>`);
+                `\`agents browser start\` will auto-detect until you run: agents browser use <name>`);
         }
     });
     profiles
@@ -493,7 +568,7 @@ function registerProfilesCommands(browser) {
       agents browser profiles prune
 
       # Make one the machine's default for a bare \`agents browser start\`
-      agents config set browser.profile work
+      agents browser use work
     `,
         notes: `
       Profiles are machine-local by default. A profile pins an OS-specific binary
@@ -748,7 +823,7 @@ function registerTaskCommands(browser) {
     });
     browser
         .command('start')
-        .description('Start a browser task. Pass --profile <name>; omit to use your configured default (`agents config set browser.profile <name>`), else auto-pick an installed Chromium-family browser. Page verbs (navigate/screenshot/…) create a task implicitly when none exists — start is for --profile/--url/--record/--title.')
+        .description('Start a browser task. Pass --profile <name>; omit to use your configured default (`agents browser use <name>`), else auto-pick an installed Chromium-family browser. Page verbs (navigate/screenshot/…) create a task implicitly when none exists — start is for --profile/--url/--record/--title.')
         .option('-p, --profile <name>', 'Browser profile to use (omit to use the configured default, else auto-pick an installed Chromium-family browser)')
         .option(TASK_OPTION_FLAG, 'Task name (auto-generated short id if omitted)')
         .option('--title <label>', 'Human label shown in `browser status` (defaults to first navigated host)')
@@ -808,7 +883,7 @@ function registerTaskCommands(browser) {
             if (all.length > 0) {
                 console.error(`Available profiles: ${all.map((p) => p.name).join(', ')}`);
             }
-            console.error(`Create one with: agents browser profiles create ${profileName} --browser <chrome|comet|chromium|brave|edge|custom>`);
+            console.error(`Create one with: agents browser profiles create ${profileName} --browser <chrome|comet|chromium|brave|edge|arc|custom>`);
             process.exit(1);
         }
         // Pre-check the endpoint name too — same fail-fast rationale.

package/dist/commands/feed.js

@@ -312,7 +312,7 @@ export async function loadSessionMetasForFeedEnrichment(load) {
 export function registerFeedCommand(program) {
     const feed = program
         .command('feed')
-        .description('Operator inbox + agent status posts (aliases: inbox = needs-you; timeline = --filter updates)')
+        .description('Operator inbox + agent status posts (alias: inbox = needs-you). Agent progress = --filter updates')
         .option('--json', 'Output as JSON (each block stamped with its outcome + ask class)')
         .option('--filter <view>', 'What to show: needs (default) · updates · all', 'needs')
         .option('--flat', 'List one block per agent instead of grouping by outcome')
@@ -647,8 +647,8 @@ export function registerFeedCommand(program) {
     registerFeedObserveAliases(program);
 }
 /**
- * `inbox` / `timeline` → feed. Loaded with the feed module so lazy COMMAND_LOADERS
- * for those names also get the real `feed` command registered for re-parse.
+ * `inbox` → feed. Loaded with the feed module so the lazy COMMAND_LOADERS entry
+ * for `inbox` also gets the real `feed` command registered for re-parse.
  */
 function registerFeedObserveAliases(program) {
     const reparse = async (alias) => {
@@ -671,14 +671,6 @@ function registerFeedObserveAliases(program) {
         .action(async () => {
         await reparse('inbox');
     });
-    program
-        .command('timeline')
-        .description('Agent progress stream (alias of `agents feed --filter updates`). What agents posted recently.')
-        .allowUnknownOption()
-        .allowExcessArguments()
-        .action(async () => {
-        await reparse('timeline');
-    });
 }
 /**
  * Mirror a written post to the configured sinks (`feed.broadcast` in