@phnx-labs/agents-cli 1.22.42 → 1.22.44

package/dist/commands/apply.d.ts

@@ -1,25 +1,22 @@
 /**
- * `agents apply` (alias `ag apply`) — reconcile the whole fleet to a declared
- * profile in one command: install agents-cli + agents and sync config. Native
+ * `agents fleet apply` / `agents devices apply` — reconcile the whole fleet
+ * to a declared profile: install agents-cli + agents and sync config. Native
  * harness logins remain device-local; portable provider credentials move only
  * through explicit `agents accounts sync`.
  *
  * The manifest is the `fleet:` block of any `-f` file (default `agents.yaml`).
+ * Top-level `agents apply` is retired (RUSH-2981).
  */
 import { Command } from 'commander';
 /** padEnd on the visible width, ignoring chalk color codes. Exported for tests. */
 export declare function stripPad(s: string, width: number): string;
 /**
- * Attach the reconcile options + action to a command node. Shared by the
- * top-level `agents apply` and its `agents fleet apply` alias so the two can
- * never drift — identical flags, identical engine.
+ * Attach the reconcile options + action to a command node.
  */
 export declare function configureApplyCommand(cmd: Command): Command;
-export declare function registerApplyCommand(program: Command): void;
 /**
- * Surface `agents apply` under the fleet command tree as `agents fleet apply`
- * (and `agents devices apply`). Same reconcile engine as the top-level command —
- * a discoverability alias for users who reach for `fleet` as the verb. Kept in
- * lockstep via {@link configureApplyCommand}.
+ * Canonical surface: `agents fleet apply` / `agents devices apply`.
+ * Top-level `agents apply` is retired (RUSH-2981) — not a noun, already nested
+ * here. Same reconcile engine, kept in lockstep via {@link configureApplyCommand}.
  */
 export declare function registerFleetApplyAlias(devicesCmd: Command): void;

package/dist/commands/apply.js

@@ -1,10 +1,11 @@
 /**
- * `agents apply` (alias `ag apply`) — reconcile the whole fleet to a declared
- * profile in one command: install agents-cli + agents and sync config. Native
+ * `agents fleet apply` / `agents devices apply` — reconcile the whole fleet
+ * to a declared profile: install agents-cli + agents and sync config. Native
  * harness logins remain device-local; portable provider credentials move only
  * through explicit `agents accounts sync`.
  *
  * The manifest is the `fleet:` block of any `-f` file (default `agents.yaml`).
+ * Top-level `agents apply` is retired (RUSH-2981).
  */
 import * as fs from 'fs';
 import * as path from 'path';
@@ -12,7 +13,7 @@ import { fileURLToPath } from 'url';
 import chalk from 'chalk';
 import { setHelpSections } from '../lib/help.js';
 import { machineId } from '../lib/session/sync/config.js';
-import { loadDevices, isControlDevice } from '../lib/devices/registry.js';
+import { loadDevices } from '../lib/devices/registry.js';
 import { isHostPinned, managedKnownHostsPath } from '../lib/devices/known-hosts.js';
 import { ensureDevicesRegistered } from '../lib/devices/sync.js';
 import { readFleetFile, resolveDesired } from '../lib/fleet/manifest.js';
@@ -163,10 +164,7 @@ async function runApply(opts) {
         }
     }
     const registry = await loadDevices();
-    // Control devices (a cockpit) never run agents — exclude them from the
-    // reconcile set entirely so `agents apply` doesn't try to install/sync/login
-    // onto a paired phone.
-    const all = Object.values(registry).filter((d) => !isControlDevice(d));
+    const all = Object.values(registry);
     const online = all.filter((d) => d.tailscale?.online === true).map((d) => d.name);
     const registered = all.map((d) => d.name);
     // Unresolved names are skipped (surfaced above), never fatal — a manifest
@@ -290,9 +288,7 @@ function reportResults(results) {
     console.log(chalk.green('Fleet reconciled.'));
 }
 /**
- * Attach the reconcile options + action to a command node. Shared by the
- * top-level `agents apply` and its `agents fleet apply` alias so the two can
- * never drift — identical flags, identical engine.
+ * Attach the reconcile options + action to a command node.
  */
 export function configureApplyCommand(cmd) {
     return cmd
@@ -317,32 +313,10 @@ export function configureApplyCommand(cmd) {
         }
     });
 }
-export function registerApplyCommand(program) {
-    const applyCmd = configureApplyCommand(program.command('apply'));
-    setHelpSections(applyCmd, {
-        examples: `
-      # Preview what would change across the fleet
-      agents apply --plan -f agents.yaml
-
-      # Bring every device to the profile (installs + config sync; native login stays local)
-      ag apply -f agents.yaml
-
-      # One device only
-      agents apply --device yosemite-s1 -y
-
-      # Replicate every claude version on this machine onto a fresh box
-      agents apply --agent claude@all --device yosemite-s0 -y
-
-      # Install a specific pinned version on one device
-      agents apply --agent claude@2.1.207 --device yosemite-s0
-    `,
-    });
-}
 /**
- * Surface `agents apply` under the fleet command tree as `agents fleet apply`
- * (and `agents devices apply`). Same reconcile engine as the top-level command —
- * a discoverability alias for users who reach for `fleet` as the verb. Kept in
- * lockstep via {@link configureApplyCommand}.
+ * Canonical surface: `agents fleet apply` / `agents devices apply`.
+ * Top-level `agents apply` is retired (RUSH-2981) — not a noun, already nested
+ * here. Same reconcile engine, kept in lockstep via {@link configureApplyCommand}.
  */
 export function registerFleetApplyAlias(devicesCmd) {
     const sub = configureApplyCommand(devicesCmd.command('apply'));
@@ -353,6 +327,12 @@ export function registerFleetApplyAlias(devicesCmd) {
 
       # Reconcile every device to the profile
       agents fleet apply -y
+
+      # One device only
+      agents fleet apply --device yosemite-s1 -y
+
+      # Replicate every claude version on this machine onto a fresh box
+      agents fleet apply --agent claude@all --device yosemite-s0 -y
     `,
     });
 }

package/dist/commands/artifacts.js

@@ -34,7 +34,7 @@ export function registerArtifactsCommands(program) {
 
       # What's live in your namespace, and taking one down
       agents artifacts share list
-      agents unshare my-plan-a1b2
+      agents artifacts unshare my-plan-a1b2
 
       # Endpoint health, and pushing a new Worker template to it
       agents artifacts share status
@@ -47,12 +47,11 @@ export function registerArtifactsCommands(program) {
   --account/--token/--domain/--analytics-token, or run non-interactively, and it
   provisions directly with what you named.
 
-  agents unshare <targets...> stays a top-level alias of
-  agents artifacts share delete.
+  agents artifacts unshare <targets...> is the nested alias of
+  agents artifacts share delete. Top-level \`agents unshare\` is gone.
 
   Full reference: apps/cli/docs/share.md.
     `,
     });
-    // Top-level, deliberately: see registerUnshareCommand in commands/share.ts.
-    registerUnshareCommand(program);
+    registerUnshareCommand(artifactsCmd);
 }

package/dist/commands/audit.d.ts

@@ -1,14 +1,14 @@
 /**
- * `agents audit` — thin alias of `agents events --include runs`.
+ * `agents events audit` — thin alias of `agents events --include runs`.
  *
  * New run-dispatch outcomes land in the unified event stream as `run.dispatched`
  * (see lib/audit/log.ts::recordDispatchedRun). This command does not own a
  * separate store or query path — it only sets the default family filter.
  *
- *   agents audit              ≡ agents events --include runs
- *   agents audit list         ≡ same
- *   agents audit verify       walks the legacy hash-chain file if present
- *                             (pre-unification history only)
+ *   agents events audit              ≡ agents events --include runs
+ *   agents events audit list         ≡ same
+ *   agents events audit verify       walks the legacy hash-chain file if present
+ *                                    (pre-unification history only)
  */
 import type { Command } from 'commander';
-export declare function registerAuditCommands(program: Command): void;
+export declare function registerAuditCommands(events: Command): void;

package/dist/commands/audit.js

@@ -1,28 +1,28 @@
 /**
- * `agents audit` — thin alias of `agents events --include runs`.
+ * `agents events audit` — thin alias of `agents events --include runs`.
  *
  * New run-dispatch outcomes land in the unified event stream as `run.dispatched`
  * (see lib/audit/log.ts::recordDispatchedRun). This command does not own a
  * separate store or query path — it only sets the default family filter.
  *
- *   agents audit              ≡ agents events --include runs
- *   agents audit list         ≡ same
- *   agents audit verify       walks the legacy hash-chain file if present
- *                             (pre-unification history only)
+ *   agents events audit              ≡ agents events --include runs
+ *   agents events audit list         ≡ same
+ *   agents events audit verify       walks the legacy hash-chain file if present
+ *                                    (pre-unification history only)
  */
 import chalk from 'chalk';
 import { verifyAuditChain, readAuditLog, getAuditLogPath, } from '../lib/audit/log.js';
 import { addEventsReadOptions, runEventsCommand } from './events.js';
-export function registerAuditCommands(program) {
-    const audit = addEventsReadOptions(program
+export function registerAuditCommands(events) {
+    const audit = addEventsReadOptions(events
         .command('audit')
         .description('Alias of `agents events --include runs` — dispatched-run outcomes'), false)
         .addHelpText('after', `
 Examples:
-  agents audit                         Same as: agents events --include runs
-  agents audit --since 7d --json
-  agents audit list                    Muscle-memory alias of bare audit
-  agents audit verify                  Legacy hash-chain file only (if present)
+  agents events audit                  Same as: agents events --include runs
+  agents events audit --since 7d --json
+  agents events audit list             Muscle-memory alias of bare audit
+  agents events audit verify           Legacy hash-chain file only (if present)
 `)
         .action((_options, command) => {
         const opts = command.optsWithGlobals();
@@ -33,7 +33,7 @@ Examples:
     });
     audit
         .command('list')
-        .description('Alias of `agents audit` / `agents events --include runs`')
+        .description('Alias of `agents events audit` / `agents events --include runs`')
         .action((_options, command) => {
         const parent = command.parent;
         const opts = {

package/dist/commands/auth.js

@@ -1,6 +1,8 @@
 import chalk from 'chalk';
 import { setHelpSections } from '../lib/help.js';
+import { runOrDie } from '../lib/format.js';
 import { clearPrixSession, fetchWhoAmI, pollDeviceToken, PrixApiError, readPrixSession, resolvePrixToken, startDeviceAuthorization, writePrixSession, } from '../lib/prix-account.js';
+import { registerAuthSpaceCommand } from './org.js';
 function sleep(ms) {
     return new Promise(resolve => setTimeout(resolve, ms));
 }
@@ -89,16 +91,22 @@ function runAuthLogout() {
     }
 }
 export function registerAuthCommand(program) {
-    const auth = program.command('auth').description('Sign in to your Rush account (shared by `agents org` and paid tiers)');
-    auth.command('login').description('Sign in via the device-code flow').action(async () => runAuthLogin());
+    const auth = program.command('auth').description('Sign in to your Prix account (spaces, paid tiers)');
+    auth.command('login').description('Sign in via the device-code flow').action(() => runOrDie(() => runAuthLogin()));
     auth.command('whoami').description('Show the signed-in account').option('--json', 'Machine-readable output')
-        .action((o, command) => runAuthWhoami(!!(o.json || command.optsWithGlobals().json)));
-    auth.command('logout').description('Clear the local `agents auth login` session').action(() => runAuthLogout());
+        .action((o, command) => {
+        const json = !!(o.json || command.optsWithGlobals().json);
+        return runOrDie(() => runAuthWhoami(json), { json });
+    });
+    auth.command('logout').description('Clear the local `agents auth login` session').action(() => runOrDie(() => runAuthLogout()));
+    registerAuthSpaceCommand(auth);
     setHelpSections(auth, {
         examples: `agents auth login
 agents auth whoami
 agents auth whoami --json
-agents auth logout`,
-        notes: "`agents auth login` writes its own session, separate from \`rush login\`'s \`~/.rush/user.yaml\` — \`agents auth logout\` never signs you out of \`rush\`. If you're already signed in via \`rush login\`, \`agents auth whoami\`/\`agents org\` use that session automatically; no separate login is required.",
+agents auth logout
+agents auth space create acme-team
+agents auth space invite dev@example.com --role admin`,
+        notes: "`agents auth login` writes its own session, separate from \`rush login\`'s \`~/.rush/user.yaml\` — \`agents auth logout\` never signs you out of \`rush\`. If you're already signed in via \`rush login\`, \`agents auth whoami\`/\`agents auth space\` use that session automatically; no separate login is required. \`agents org\` is a deprecated alias of \`agents auth space\`.",
     });
 }

package/dist/commands/beta.d.ts

@@ -1,2 +1,8 @@
+/**
+ * `agents setup beta` — enable or disable preview features like factory.
+ * Nested under setup because opting into a preview is machine configuration,
+ * not its own noun (RUSH-2981).
+ */
 import type { Command } from 'commander';
-export declare function registerBetaCommands(program: Command): void;
+/** Register `agents setup beta` under the parent `setup` command. */
+export declare function registerBetaCommands(setupCmd: Command): void;

package/dist/commands/beta.js

@@ -1,5 +1,6 @@
 import chalk from 'chalk';
 import { ALL_BETA_FEATURES, getBetaConfigLocation, getEnabledBetaFeatures, setBetaEnabled, } from '../lib/beta.js';
+import { setHelpSections } from '../lib/help.js';
 const BETA_DESCRIPTIONS = {
     factory: 'Cloud-based agent dispatch via Rush Factory',
 };
@@ -20,16 +21,22 @@ function parseFeatures(values) {
     }
     return values.filter((v) => valid.has(v));
 }
-export function registerBetaCommands(program) {
-    const beta = program
+/** Register `agents setup beta` under the parent `setup` command. */
+export function registerBetaCommands(setupCmd) {
+    const beta = setupCmd
         .command('beta')
-        .description('Enable or disable preview features like factory.')
-        .addHelpText('after', `
-Examples:
-  agents beta list
-  agents beta enable factory
-  agents beta disable factory
-`);
+        .description('Enable or disable preview features like factory.');
+    setHelpSections(beta, {
+        examples: `
+      agents setup beta list
+      agents setup beta enable factory
+      agents setup beta disable factory
+    `,
+        notes: `
+      Writes the enabled set to ~/.agents/agents.yaml (beta.enabled). Top-level
+      \`agents beta\` is gone — use this group.
+    `,
+    });
     beta
         .command('list')
         .description('Show available beta features and whether they are enabled.')

package/dist/commands/commands.js

@@ -392,7 +392,7 @@ Examples:
         }
         else {
             console.log(chalk.green(`\nRemoved ${removed} command(s) from version homes.`));
-            console.log(chalk.gray('Central source unchanged. Commands will re-sync on next agent launch.'));
+            console.log(chalk.gray("Central source unchanged. Restore any target with 'agents sync <agent>@<version> --yes'."));
         }
     });
     // `commands prune` moved to the top-level `agents prune cleanup` command.

package/dist/commands/computer.js

@@ -14,7 +14,7 @@ import { makeClaudeResponder, resolveApiKey, DEFAULT_CLAUDE_MODEL, DEFAULT_CLAUD
 import { TASK_PREVIEW_MAX_CHARS } from '../lib/computer/sessions-list.js';
 import { runComputerSessionsCommand } from './computer-sessions-picker.js';
 import { truncate } from '../lib/feed/events.js';
-import { namespacedServiceLabel, serviceManifestHomeEnv } from '../lib/service-manifest.js';
+import { namespacedServiceLabel, serviceManifestHomeEnv, serviceManagerRegistrationAllowed } from '../lib/service-manifest.js';
 // Help groups — mirror `agents browser` so the mental model carries over.
 const COMPUTER_HELP_GROUPS = [
     { title: 'Installation', names: ['setup'] },
@@ -564,6 +564,10 @@ export async function activateComputerHelperMacLocal() {
     const uid = process.getuid?.();
     if (typeof uid !== 'number')
         throw new Error('cannot resolve uid');
+    const reg = serviceManagerRegistrationAllowed();
+    if (!reg.allowed) {
+        throw new Error(reg.reason);
+    }
     const domain = `gui/${uid}`;
     // Render the policy file BEFORE bootstrap so the daemon reads a fresh allow
     // list at startup (fail-safe: missing/unparseable → everything denied).
@@ -843,11 +847,21 @@ function registerStopCommand(program) {
             process.exit(1);
         }
         const domain = `gui/${uid}`;
-        try {
-            execFileSync('/bin/launchctl', ['bootout', domain, plistPath], { stdio: 'pipe' });
-        }
-        catch {
-            // already gone — fine
+        // Same invariant as the start path: a redirected-HOME process must never
+        // talk to the real launchd (RUSH-2968). Stop has a local fallback — the
+        // plist/socket cleanup below — so skip the bootout with the reason
+        // rather than throwing like start does.
+        const reg = serviceManagerRegistrationAllowed();
+        if (!reg.allowed) {
+            console.warn(`skipping launchctl bootout: ${reg.reason}`);
+        }
+        else {
+            try {
+                execFileSync('/bin/launchctl', ['bootout', domain, plistPath], { stdio: 'pipe' });
+            }
+            catch {
+                // already gone — fine
+            }
         }
         // launchd unlinks the socket when the daemon exits; helper also has an
         // atexit unlink. Best-effort cleanup if either path didn't fire.

package/dist/commands/daemon.js

@@ -761,7 +761,7 @@ function runWebhooksList(json) {
         const port = hostedReceiverPort(r);
         const funnel = r.funnel ? chalk.cyan(` public :${r.funnel.publicPort}`) : chalk.gray(' localhost only');
         console.log(`  127.0.0.1:${String(port).padEnd(6)} ${chalk.gray(`bundle ${r.bundle}`)}${funnel}`);
-        console.log(chalk.gray(`    endpoints: /hooks/github, /hooks/linear · ${r.rateLimit ?? DEFAULT_WEBHOOK_RATE_LIMIT}/min per source`));
+        console.log(chalk.gray(`    endpoints: /hooks/github, /hooks/linear, /hooks/slack · ${r.rateLimit ?? DEFAULT_WEBHOOK_RATE_LIMIT}/min per source`));
     }
     console.log(chalk.gray(`\nConfig: ${getDaemonWebhooksConfigPath()}`));
     console.log(chalk.gray('Changes take effect on the next daemon restart.'));

package/dist/commands/doctor.d.ts

@@ -78,9 +78,11 @@ export type IssueSeverity = 'critical' | 'warning' | 'info';
  *
  * Severity model (agent-agnostic — applies to every agent doctor inspects):
  *   - critical (silent breakage): an unwired hook, a missing/unparseable
- *     settings.json, a MISSING resource.
+ *     settings.json, a MISSING hook or plugin.
  *   - warning (stale / drift): a source layer behind origin, a DIVERGENT resource,
- *     a stale / never-synced version.
+ *     a stale / never-synced version, a MISSING resource of any other kind
+ *     (see `missingResourceSeverity`, which reads this split from
+ *     `FINDING_SEVERITY` — RUSH-2947).
  *   - info (orphan): an EXTRA resource → `agents prune cleanup`.
  */
 export interface VerdictIssue {

package/dist/commands/doctor.js

@@ -2,7 +2,7 @@ import { IsolationBoundaryError } from '../lib/installations/shims.js';
 import { explainIsolationBoundary } from '../lib/isolation-boundary-report.js';
 import { addHostOption } from '../lib/hosts/option.js';
 import { buildRemoteAgentsInvocation } from '../lib/hosts/remote-cmd.js';
-import { loadDevices, isControlDevice } from '../lib/devices/registry.js';
+import { loadDevices } from '../lib/devices/registry.js';
 import { fanOutDevices, planFleetTargets, remoteFleetTargets } from '../lib/devices/fleet.js';
 import { enterDoctorOverviewGate, invalidateDoctorOverviewCache, writeDoctorOverviewCache } from '../lib/devices/doctor-overview-cache.js';
 import { fleetDialTarget } from '../lib/devices/connect.js';
@@ -183,9 +183,6 @@ async function resolveFleetTargets(opts) {
         // Normalize names so zion/ZION/zion.local all match machineId() and we never
         // self-SSH the local box during fleet probes (RUSH-2114).
         .filter((d) => normalizeHost(d.name) !== localName)
-        // Control devices (a cockpit) never run agents — skip them in the fleet
-        // fan-out (an explicit --device <name> still resolves above).
-        .filter((d) => !isControlDevice(d))
         .map((d) => ({
         name: d.name,
         sshTarget: d.name,
@@ -669,6 +666,19 @@ const AUTO_FIXABLE_CATEGORIES = new Set([
 export function verdictIsAutoFixable(v) {
     return v.issues.some((i) => AUTO_FIXABLE_CATEGORIES.has(i.category));
 }
+/**
+ * Missing-resource severity for one `DoctorKind`, read from `FINDING_SEVERITY`
+ * (the fleet-mode rubric) so target mode agrees with it kind by kind instead of
+ * re-hardcoding its own. Hooks and plugins map to their dedicated critical
+ * finding kinds; every other kind maps to the generic 'missing-resource' warning.
+ */
+function missingResourceSeverity(kind) {
+    if (kind === 'hooks')
+        return FINDING_SEVERITY['missing-hook'];
+    if (kind === 'plugins')
+        return FINDING_SEVERITY['missing-plugin'];
+    return FINDING_SEVERITY['missing-resource'];
+}
 /**
  * Fold a version report's divergences into a triaged verdict — one severity-tagged
  * finding per unwired hook, missing/divergent/extra resource, and behind-origin
@@ -718,16 +728,18 @@ export function computeVerdict(report) {
             });
         }
     }
-    // ── critical: missing resources (declared in sources, absent from home) ──
+    // ── missing resources (declared in sources, absent from home) — severity
+    // follows FINDING_SEVERITY: hooks/plugins are critical, everything else warns ──
     for (const kind of DOCTOR_ALL_KINDS) {
         for (const r of report.kinds[kind]) {
             if (r.status !== 'missing')
                 continue;
+            const severity = missingResourceSeverity(kind);
             issues.push({
-                severity: 'critical', category: 'missing', subject: r.name,
+                severity, category: 'missing', subject: r.name,
                 impact: `declared in sources but absent from the version home (${kind})`,
                 fix: fixCmd,
-                text: `${r.name} missing`, color: 'red',
+                text: `${r.name} missing`, color: severity === 'critical' ? 'red' : 'yellow',
             });
         }
     }
@@ -1739,10 +1751,10 @@ export function registerDoctorCommand(program) {
                 console.log(line);
             }
             // Point at the interactive reconcile when anything is out of sync — each
-            // finding carries its own fix, but `agents status` is the one place that
+            // finding carries its own fix, but `agents sync status` is the one place that
             // reviews and applies them together (opt-in, never auto-fires here).
             if (syncRows.some((r) => r.status !== 'fresh' || (r.unwiredHooks ?? 0) > 0) || repoBehindMarkers.some((m) => m.behind > 0)) {
-                console.log(chalk.gray('\nRun `agents status` to review and sync what has drifted.'));
+                console.log(chalk.gray('\nRun `agents sync status` to review and sync what has drifted.'));
             }
             // A routine runs on exactly one device. Each of these named several and
             // used to fire once per device — duplicate agent runs on every schedule.

package/dist/commands/events.d.ts

@@ -7,7 +7,7 @@
  * (per-session activity: plans, PRs, worktrees, sub-agents, artifacts). Run-dispatch
  * outcomes land here as `run.dispatched` (readable via `--include runs`).
  *
- * `agents audit` and `agents logs` are thin aliases of this command.
+ * `agents events audit` and `agents logs` are thin aliases of this command.
  *
  * Filter with sessions-style `--include` / `--exclude` families (ops, activity,
  * commands, runs, security) plus field filters (`--module`, `--event`, …).
@@ -49,7 +49,7 @@ export interface EventsOptions {
 }
 /** Add the one canonical event-reader option surface to a command or alias. */
 export declare function addEventsReadOptions(command: Command, includeAuditFlag?: boolean): Command;
-/** Canonical reader used by `agents events`, `agents audit`, and `agents logs`. */
+/** Canonical reader used by `agents events`, `agents events audit`, and `agents logs`. */
 export declare function runEventsCommand(options: EventsOptions, forceAudit?: boolean): Promise<void>;
 /** Shared by `events stats` and the `logs stats` alias. */
 export declare function runEventsStats(opts: {

package/dist/commands/events.js

@@ -7,7 +7,7 @@
  * (per-session activity: plans, PRs, worktrees, sub-agents, artifacts). Run-dispatch
  * outcomes land here as `run.dispatched` (readable via `--include runs`).
  *
- * `agents audit` and `agents logs` are thin aliases of this command.
+ * `agents events audit` and `agents logs` are thin aliases of this command.
  *
  * Filter with sessions-style `--include` / `--exclude` families (ops, activity,
  * commands, runs, security) plus field filters (`--module`, `--event`, …).
@@ -19,6 +19,7 @@ import { readUnifiedEvents } from '../lib/event-stream.js';
 import { parseFamilyList, EVENT_FAMILIES } from '../lib/event-families.js';
 import { ingestBatch } from '../lib/events-ingest.js';
 import { setHelpSections } from '../lib/help.js';
+import { registerAuditCommands } from './audit.js';
 /**
  * Resolve `--limit` into a record cap. `0` means "no cap" — without it there is
  * no way to read the whole stream, and any aggregation (group-by failure, count
@@ -215,7 +216,7 @@ export function addEventsReadOptions(command, includeAuditFlag = true) {
     }
     return command;
 }
-/** Canonical reader used by `agents events`, `agents audit`, and `agents logs`. */
+/** Canonical reader used by `agents events`, `agents events audit`, and `agents logs`. */
 export async function runEventsCommand(options, forceAudit = false) {
     if (options.follow) {
         await followLog();
@@ -356,9 +357,8 @@ Examples:
   agents events -f                       Live tail (operational)
   agents events stats
   agents events rotate --days 7
-
-  agents audit                           Alias of: events --include runs
-  agents logs                            Alias of: events`)
+  agents events audit                    Alias of: events --include runs
+  agents logs                            Run log viewer (also aliases events audit/stats/rotate)`)
         .action((_options, command) => runEventsCommand(command.optsWithGlobals()));
     // `events` both reads (its own action, above) and writes (this subcommand) —
     // the same shape as `feed` / `feed post`.
@@ -375,6 +375,7 @@ Examples:
         .option('--days <n>', 'Retention period in days (default 7)', '7')
         .option('--max-mb <n>', 'Total event storage ceiling in MiB (default 50)', '50')
         .action((opts) => runEventsRotate(opts));
+    registerAuditCommands(events);
 }
 /** Shared by `events rotate` and the `logs rotate` alias. */
 export function runEventsRotate(opts) {

package/dist/commands/exec.d.ts

@@ -15,7 +15,6 @@ export interface RunAccountPickerRequest {
 }
 /** Distinguish a terminal account-picker marker from an explicit @version pin. */
 export declare function parseRunAccountPickerRequest(agentSpec: string): RunAccountPickerRequest;
-/** Return every option whose routing semantics conflict with a local account choice. */
 /**
  * The `--device` alias family — the flags that mean "dispatch this run to another
  * machine over SSH". `--device` is canonical; `--on`/`--computer` are hidden
@@ -30,6 +29,7 @@ export declare function hostTargetGiven(options: {
     on?: string;
     computer?: string;
 }): string[];
+/** Return every option whose selection semantics conflict with an account choice. */
 export declare function runAccountPickerConflicts(options: {
     resume?: string | boolean;
     strategy?: string;

package/dist/commands/exec.js

@@ -36,7 +36,6 @@ export function parseRunAccountPickerRequest(agentSpec) {
         valid: !requested || (!!normalizedAgentSpec && !normalizedAgentSpec.includes('@')),
     };
 }
-/** Return every option whose routing semantics conflict with a local account choice. */
 /**
  * The `--device` alias family — the flags that mean "dispatch this run to another
  * machine over SSH". `--device` is canonical; `--on`/`--computer` are hidden
@@ -48,6 +47,7 @@ export function parseRunAccountPickerRequest(agentSpec) {
 export function hostTargetGiven(options) {
     return [options.host, options.device, options.on, options.computer].filter((v) => !!v);
 }
+/** Return every option whose selection semantics conflict with an account choice. */
 export function runAccountPickerConflicts(options) {
     const conflicts = [];
     if (options.resume !== undefined)
@@ -60,8 +60,6 @@ export function runAccountPickerConflicts(options) {
         conflicts.push('--lease');
     if (options.box)
         conflicts.push('--box');
-    if (hostTargetGiven(options).length)
-        conflicts.push('--device');
     return conflicts;
 }
 /** Type guard that narrows a string to a known AgentId. */
@@ -845,7 +843,7 @@ agents run auto --device yosemite-s0 "fix the flaky test"   # pin the device
             const conflicts = runAccountPickerConflicts(options);
             if (conflicts.length > 0) {
                 console.error(chalk.red(`Account selection with ${agentSpec} cannot be combined with ${conflicts.join(', ')}. ` +
-                    'Pick the account locally, or use an explicit agent@version target.'));
+                    'Remove the conflicting selector, or use an explicit agent@version target.'));
                 process.exit(1);
             }
         }
@@ -1450,6 +1448,11 @@ agents run auto --device yosemite-s0 "fix the flaky test"   # pin the device
                     process.exit(1);
                 }
                 const interactiveHost = options.interactive === true || (prompt === undefined && options.headless !== true);
+                if (accountPickerRequested && !interactiveHost) {
+                    console.error(chalk.red(`Account selection with ${agentSpec} requires an interactive host run. ` +
+                        `Use agents run ${runAgent}@ --device ${host.name} --interactive.`));
+                    process.exit(1);
+                }
                 if (interactiveHost) {
                     // Interactive host run: forward the local TTY over SSH and let the
                     // remote agent start its normal interactive UI (tmux on the host).
@@ -1496,6 +1499,7 @@ agents run auto --device yosemite-s0 "fix the flaky test"   # pin the device
                     const exitCode = await runInteractiveOnHost(host, {
                         agent: runAgent,
                         version: resumeId ? undefined : runVersion,
+                        accountPicker: accountPickerRequested,
                         strategy: resumeId ? undefined : runStrategy,
                         account: resumeId ? undefined : options.account,
                         fallback: options.fallback,
@@ -3015,8 +3019,9 @@ agents run auto --device yosemite-s0 "fix the flaky test"   # pin the device
             let exitCode;
             let ranAgent = agent;
             let ranVersion = defaultVersion;
-            if (fallback.length > 0) {
-                // fallback requires a prompt — enforced above, narrow the type here.
+            if (fallback.length > 0 || (rotationResult !== null && prompt !== undefined && !options.interactive)) {
+                // Fallback and balanced runs need captured output so a clean-exit
+                // session-limit refusal can update account availability.
                 // The sink reports which chain entry actually executed (may differ from
                 // the primary after a rate-limit handoff) so the audit record is honest.
                 const sink = {};

package/dist/commands/factory.d.ts

@@ -2,7 +2,7 @@
  * Software Factory CLI — submits Linear issues to a remote orchestrator.
  *
  * Requires FACTORY_FLOOR_URL pointing at a Factory-compatible endpoint.
- * Beta-gated; enable with `agents beta enable factory`.
+ * Beta-gated; enable with `agents setup beta enable factory`.
  */
 import type { Command } from 'commander';
 export declare function registerFactoryCommands(program: Command): void;