@phnx-labs/agents-cli 1.22.43 → 1.22.44

package/CHANGELOG.md

@@ -1,5 +1,82 @@
 # Changelog
 
+## 1.22.44
+
+- **Browser domain-skill discovery is layer-aware (RUSH-2497).** `agents browser start --url <url>` auto-loads a site-specific SKILL.md, but the lookup only ever searched the user layer (`~/.agents/skills/browser/domain-skills`), so a skill shipped in the system layer (`~/.agents/.system/skills/browser/domain-skills`) — or a project's `.agents/` — was silently invisible: the browser just opened without the guide. `resolveDomainSkill` now searches project > user > system > extra repos, first layer with a match wins, mirroring `resolveResource` precedence; `$AGENTS_BROWSER_DOMAIN_SKILLS_DIR` stays a single-root override for tests. The project layer resolves from the calling process's cwd — the shared browser daemon does not yet receive the CLI caller's cwd over IPC, so there the project layer follows the daemon's own cwd until RUSH-2996 threads it through. A miss still never breaks browser start, but now logs the roots searched at debug level (`AGENTS_DEBUG`/`DEBUG`) — the total silence is what hid this. Source: `apps/cli/src/lib/browser/domain-skills.ts`.
+
+- **`agents artifacts share list/update/delete` (and the `unshare` alias) had a silently-dropped `--json`/`--github-user` (RUSH-2687).** Commander resolves an option's long name against the WHOLE ancestor chain, not per-command — `share <file>` (the parent) already declares `--json`/`--github-user` for its own publish-time use, so the same-named flag on `list`/`update`/`delete` was swallowed at parse time even when passed alone (`--help` still showed it registered, which made it easy to miss). `agents artifacts share list --json | jq …`, the exact example in `docs/share.md`, never emitted JSON. Fixed by renaming the colliding options — `--list-json`/`--for-user` (list), `--update-json` (update), `--delete-json`/`--for-user` (delete/unshare) — matching the precedent `share revisions` already set (`--revisions-json`/`--for-user`, RUSH-2683). A CLI-wide `enablePositionalOptions()` fix was evaluated and reverted: commander copies that setting onto every command created via `.command()`, so enabling it on the root program broke `sessions backfill tools/resources --since … --json …`, which relies on a parent command's options staying visible to leaf subcommands via `optsWithGlobals()`. Source: `apps/cli/src/commands/share.ts`, `apps/cli/src/lib/startup/root-command.ts`.
+
+- **`agents artifacts share` publishes with a partial `share:` config (RUSH-2837).** `status` and publish both used to treat a missing/empty `accountId` as "not set up", even when `baseUrl` and `WRITE_TOKEN` were present — so a fleet rewrite that blanked `accountId` (or a partial `writeMeta` that dropped `share:`) silently killed PR evidence uploads. Publish now requires only `baseUrl` + the write token; `status` reports the endpoint and names an empty account id instead of pretending nothing is configured; `writeShareConfig` will not persist `accountId: ""` over a stored id; `serializeCentral` no longer deletes `share:` just because a write omitted the key. Source: `apps/cli/src/lib/share/config.ts`, `apps/cli/src/lib/state.ts`, `apps/cli/src/commands/share.ts`.
+
+- **Pick a device-local account after fleet placement (RUSH-2961).** `agents run <harness>@` now composes with `--device <name|auto>`: the device resolves first, then the interactive picker lists that peer's installed versions/accounts and pins the selection for this run. Automatic picker placement prefers a ready account, retains signed-out/revoked login targets, and excludes devices whose picker would contain only rate-limited or out-of-credit rows. `agents view --json` exposes each version's cached `authVerdict` so remote and local placement apply the same revoked-token gate. Source: `apps/cli/src/commands/{exec,view}.ts`, `apps/cli/src/lib/{smart-launch,hosts/dispatch,hosts/ready}.ts`.
+
+- **BREAKING: nest `agents beta` under `agents setup beta`; retire top-level `agents apply`; drop `harness login`/`logout` (RUSH-2981).** Enabling a preview feature is setup, not its own noun — `agents setup beta list/enable/disable` keep the same `~/.agents/agents.yaml` `beta.enabled` write path. Fleet reconcile is already `agents fleet apply` / `agents devices apply`; top-level `apply` is gone (unknown command, retired from distance-1 auto-correct). Harness credentials live on `agents accounts` — `harness login`/`logout` are removed. Does not touch org/auth/trends/audit/unshare (sibling session 01a02234). Source: `apps/cli/src/commands/{beta,setup,apply,harness}.ts`, `apps/cli/src/lib/startup/command-registry.ts`.
+
+- **Nest leftover top-level aliases; keep `agents org` as a deprecated spelling (RUSH-2989).**
+  `agents unshare` moves under `agents artifacts unshare` (same takedown as
+  `artifacts share delete`; the top-level name is retired). `agents audit` moves
+  under `agents events audit` (still `events --include runs`, plus `verify` for
+  the legacy hash-chain). Former top-level `agents trends` is `agents insights mix`
+  (also `agents insights trends`). `agents org` still works and prints a deprecation
+  line; the canonical tree is `agents auth space`. Prix login stays off
+  `agents accounts` (that noun is harness keys). Source:
+  `apps/cli/src/commands/{auth,org,artifacts,share,events,audit,insights}.ts`,
+  `apps/cli/src/lib/analytics/mix-commands.ts`.
+
+- **`agents view` shows Claude usage again — the daemon auth-health probe no longer hammers `/oauth/usage` into a permanent 429 (RUSH-2998).** The daemon's fleet auth-health probe (`probeLocalFleetAuth` → `probeClaudeStatus`) hit the rate-limited `/api/oauth/usage` endpoint every ~3 minutes on **every** device. Across the fleet that drove one per-account request quota to a persistent `429`; the shared `Retry-After` backoff then parked usage fleet-wide and the usage cache froze (windows stale-zeroed → `agents view` rendered `S: 0% (now) W: 0% (now)` for weeks). The periodic tick now re-probes the endpoint at most every 20 minutes (`AUTH_PROBE_MAX_AGE_MS`) and reuses the last real verdict in between — a ~5x cut in endpoint traffic. Fleet status still publishes every tick (it does not ride that endpoint), and every device keeps a **real** auth verdict, so `agents devices ping --strict` and the run auth-preflight keep detecting revocation on every host. `agents devices ping` forces a genuinely live probe (never the throttled cached verdict). Source: `apps/cli/src/lib/daemon-ticks.ts` (`AUTH_PROBE_MAX_AGE_MS`, `isCachedFleetAuthProbeFresh`, `refreshLocalFleetAuthState` `force`), `apps/cli/src/commands/ssh.ts` (`runFleetPing`).
+
+- **BREAKING: remove `agents serve`, its `--control` anchor, and `agents devices pair-ios` (RUSH-3001).**
+  The read-only local web companion (`agents serve`) duplicated what `agents sessions`,
+  `agents teams status`, and the AGI EXT Fleet panel already show, and its `--control`
+  mode existed only to anchor the unshipped iOS Fleet Cockpit prototype (`apps/ios`,
+  untouched since 2026-07-16, no Xcode project) — both are gone, and so is the prototype
+  itself. `agents devices pair-ios` (the only writer of the device registry's `control`
+  role) is removed with it; with no writer left, the `control`-only dial-exclusion
+  filters (`isControlDevice`) are removed too, across `doctor`, `apply`, `fleet status`,
+  `fleet-capture`, `smart-launch`, the devices host provider, session fan-out, and
+  remote login detection. `agents serve` now reports `unknown command` and is retired
+  from distance-1 auto-correct; `agents devices pair-ios` is rejected by `devices` as an
+  unexpected argument.
+  **Migration —** if you previously ran `agents devices pair-ios`, that phone or tablet is
+  still in your device registry with `role: control`, and the key is now ignored rather
+  than honoured: it becomes an ordinary fleet target. `agents fleet status`,
+  `agents fleet update/run`, `agents apply`, `agents doctor --check --devices`,
+  `agents insights output --all-hosts`, and any `--device all` passthrough will dial it and
+  wait out a ConnectTimeout; `agents hosts list` shows it as dispatchable; `--device auto`
+  can place an agent on it when no device is marked `worker`; and routine fleet placement
+  can schedule a recurring job onto it, since an `unknown`-platform device sorts ahead of a
+  real worker alphabetically. Failures are loud, not silent. Remove it with
+  `agents devices rm <name>`; the stale `role` key is dropped anyway on that device's next
+  `agents devices sync`. Session fan-out is unaffected — it still gates on a
+  `windows`/`linux`/`macos` platform.
+  Source: `apps/cli/src/commands/{serve,ssh}.ts`,
+  `apps/cli/src/lib/devices/{registry,fleet,pool,discovery-policy}.ts`,
+  `apps/cli/src/lib/{smart-launch,remote-agents-json,device-config}.ts`,
+  `apps/cli/src/lib/hosts/{registry,providers/devices}.ts`,
+  `apps/cli/src/lib/session/{watch,remote-list}.ts`, `apps/cli/src/lib/fleet/remote-login.ts`,
+  `apps/cli/src/cli/command-registry.ts`, `apps/cli/src/lib/startup/command-registry.ts`.
+
+- **Menu-bar helper restarts after a bundle swap; one-time TCC migration; `agents menubar doctor` (RUSH-3019).** `installMenubarLaunchAgentOnUpgrade()` swapped the installed bundle on an upgrade but never restarted the running helper — verified live: a helper pid started 21:44:16 kept running while the bundle under it was replaced at 21:53:46, so it kept requesting Accessibility under the OLD code identity and the grant never stuck. The heal now kickstarts the launchd job (`launchctl kickstart -k`) after a real content swap (a version bump or the ad-hoc -> Developer ID transition — a plist-only interpreter repoint, RUSH-3005's churn, does not trigger this) and falls back to ending the specific pid(s) still running the old binary when `kickstart -k` can't reach the GUI launchd domain from a non-Aqua shell context, so launchd's `KeepAlive` relaunches from the swapped binary. Separately, a machine that transitioned ad-hoc -> Developer ID (6fa36f73a) now gets a one-time `tccutil reset Accessibility com.phnx-labs.agents-menubar` to clear the dead grant recorded against the old identity, stamped so it never re-runs. The "Paste needs Accessibility" notification now opens System Settings' Accessibility pane on click and names the actual running bundle path. New read-only `agents menubar doctor` reports install path, installed vs CLI version, signing identity stability, and whether a live helper pid predates the on-disk bundle (the stale-process bug this fixes). Source: `apps/cli/src/lib/menubar/install-menubar.ts`, `apps/cli/src/commands/menubar.ts`, `apps/cli/menubar/Sources/MenubarHelper/Clip.swift`.
+
+- **Daemon autostart no longer fires under a redirected (sandbox/test) HOME (RUSH-3021).** #2860 gated service-manager registration on `isolatedHomeSuffix()` but left `ensureDaemonStarted()`'s detached spawn ungated, so a test-spawned CLI could fork a daemon into the test's temp HOME; the child outlived the test and raced its recursive teardown `rm` (the `ENOTEMPTY` flake that cost most full-suite attestation rolls on shared boxes). The launch path now refuses under a redirected HOME via the same `serviceManagerRegistrationAllowed()` signal and `AGENTS_SERVICE_MANAGER_ALLOW_REDIRECTED_HOME` test seam; reporting an already-running daemon is untouched, and `agents daemon start` remains the operator override. Source: `apps/cli/src/lib/daemon/daemon.ts` (`ensureDaemonStarted`), regression test in `apps/cli/src/lib/daemon/daemon.registry.test.ts`.
+
+- **The npm tarball no longer bundles the version-stamped signed CLI binary — releases publish from any OS (RUSH-3026).** `dist/bin/agents` (the Developer-ID-signed arm64 Mach-O, #315) embedded the release version, so every release forced a fresh Mac build + sign even when nothing native changed — chaining publishing to a single provisioned Mac (`mac-mini`), whose downtime stranded merged fixes unshippable. The binary is dropped from `package.json` `files` and the `prepack` gates; `postinstall`'s existing run-probe falls back to the JS entrypoint when the binary is absent, so macOS installs keep working (it returns as a per-release GitHub asset in a follow-up). `release.sh`'s home-base phase — already promote-only (download attested tarball, verify, install-smoke, `npm publish`) — drops its vestigial macOS gate, and a new `assert_promote_home_base` preflight (npm token + gh auth, via `scripts/promote-home-base-probe.sh`) runs BEFORE the release's first mutation, fixing the tagged-but-unpublished failure shape: the old signing preflight was defined but never invoked. The two `.app` helpers (keychain, menubar) remain bundled and manifest-reused — unchanged helpers are never rebuilt. Source: `apps/cli/package.json`, `apps/cli/scripts/release.sh`, `apps/cli/scripts/promote-home-base-probe.sh`.
+
+- **`agents sync` restores a resource deleted from a version home — no `--force` needed (#2398, #2397).** The staleness fast-guard decided sync-ness from source fingerprints alone, so a managed artifact deleted from the version home (a subagent, command, skill, hook, MCP config, or rules file) read as "Already in sync" and only `--force` restored it. The sync manifest now records the artifact paths the last full sync wrote (`writtenTargets`, reported by each resource writer), and `isStale` treats a missing path as stale — one `existsSync` per path, no content reads, so the fast-guard budget holds. A manifest written by an older agents-cli lacks the field and reads as stale once; that full sync establishes the baseline. Relatedly, four commands (`agents commands/skills/hooks/subagents remove`) claimed a removed resource "will re-sync on next agent launch" — the shim's launch hook (`agents sync --launch`) is project-scoped only and deliberately skips version-home reconciliation, so the messages now name the real recovery: `agents sync <agent>@<version> --yes`. `agents doctor --fix` was already immune (it heals from the live-home diff, not the manifest). Source: `apps/cli/src/lib/staleness/{index,types}.ts`, `apps/cli/src/lib/staleness/writers/{types,commands,skills,hooks,mcp,subagents,rules}.ts`, `apps/cli/src/lib/installations/versions.ts`, `apps/cli/src/commands/{commands,skills,hooks,subagents,prune}.ts`.
+
+- **`agents devices list` no longer serves fossilized load/mem numbers (#2666).** The
+  fleet stats cache (`.fleet-stats.json`) had no age bound and — since RUSH-2061
+  removed the daemon's N² fleet warm — no background writer, so the load/mem columns
+  froze at the last manual `--refresh` and re-rendered as current fleet state
+  indefinitely (observed: a 9-day-old row reporting an idle Mac at 1058% load). Cached
+  rows are now bounded by `STATS_STALE_MS` (3 minutes, the same window as the
+  agent-count mirror): a row past the bound is treated like a missing one — re-probed
+  live this call and rewritten — so the default `devices list` / `devices status` read
+  is itself the cache's writer and a stale value can never be presented as current.
+  This cache feeds the fleet scheduler, `--device auto` affinity, and the
+  session-start fleet banner. Source: `apps/cli/src/lib/devices/stats-cache.ts`,
+  `apps/cli/src/commands/ssh.ts`.
+
 ## 1.22.43
 
 - **Rush Cloud no longer has a helper that reads the interactive Claude login (RUSH-2359 / incident #1767).** Dispatch already sends an email-only account manifest (SING-1b) and never uploaded a token; the leftover `readClaudeCredentialsBlob` still read Keychain / `.credentials.json` — the exact shape that captured a `claude setup-token` TTY banner as an Authorization header. That helper is deleted. `--lease` SING-1b detection now reads the wrapped rotating blob itself and ignores anything that is not `{ claudeAiOauth.accessToken }`. Source: `apps/cli/src/lib/cloud/rush.ts`, `apps/cli/src/lib/crabbox/runtimes.ts`.

package/README.md

@@ -188,6 +188,8 @@ agents run claude "summarize recent commits" --strategy balanced
 # Or choose one account/version interactively for only this run.
 agents run claude@
 agents run codex@ "review this branch"
+agents run claude@ --device auto        # pick the device, then choose there
+agents run claude@ --device yosemite-s0 # choose from one device's accounts
 ```
 
 `--strategy balanced` spreads work across available versions of the same agent -- useful when you have multiple accounts and want to avoid burning through one. When a Claude run reports a session limit, agents-cli records the stated reset time, shows `session-limited` in `agents view`, and excludes that account until the reset. When every account is rate-limited, the run exits nonzero naming each excluded account and the earliest window reset (use `--strategy pinned` to force the default) -- it never launches into an exhausted account.
@@ -205,7 +207,7 @@ agents run auto --device yosemite-s0 "fix the flaky test"   # pin the host layer
 
 A trailing `@` opens an account picker before either an interactive or prompt-based run. Each installed version shows its account identity, exact version, login state, plan, and every available session, weekly, or monthly limit. Logged-out, rate-limited, and out-of-credit accounts remain visible with the reason they cannot be selected; signed-in accounts whose provider does not expose quota data stay selectable and say `limits unavailable`. The choice pins only that run and does not change your default version.
 
-Account selection is available for Claude, Codex, Gemini, Cursor, Antigravity, Grok, Kimi, Droid, and OpenCode. It requires a terminal and cannot be combined with `--resume`, `--strategy`/`--balanced`, `--lease`, or `--device`; profiles and workflows must use their concrete host agent instead.
+Account selection is available for Claude, Codex, Gemini, Cursor, Antigravity, Grok, Kimi, Droid, and OpenCode. It requires a terminal and cannot be combined with `--resume`, `--strategy`/`--balanced`, `--lease`, or a warm-box lease. Device routing is resolved first, then the picker is populated from the selected device. Profiles and workflows must use their concrete host agent instead.
 
 ### Chain agents
 
@@ -454,7 +456,7 @@ A stalled session whose tail shows a hard account limit ("You've hit your weekly
 ## Sync the fleet
 
 <p align="center">
-  <img src="assets/fleet-sync.svg" alt="agents apply: reconcile every device to one profile from agents.yaml — install missing agents and sync config. Native logins stay on the machine that minted them." width="100%" />
+  <img src="assets/fleet-sync.svg" alt="agents fleet apply: reconcile every device to one profile from agents.yaml — install missing agents and sync config. Native logins stay on the machine that minted them." width="100%" />
 </p>
 
 
@@ -471,14 +473,14 @@ fleet:
 ```
 
 ```bash
-agents apply --plan                 # device x dimension matrix; changes nothing
-agents apply                        # reconcile the fleet (confirms first; -y to skip)
-agents apply --device yosemite-s0   # scope to one device
-agents apply --only agents,config   # limit dimensions (agents, config, login)
-agents apply --no-login             # skip login propagation
+agents fleet apply --plan                 # device x dimension matrix; changes nothing
+agents fleet apply                        # reconcile the fleet (confirms first; -y to skip)
+agents fleet apply --device yosemite-s0   # scope to one device
+agents fleet apply --only agents,config   # limit dimensions (agents, config, login)
+agents fleet apply --no-login             # skip login propagation
 ```
 
-`agents apply` (`ag apply`) probes every target over the existing SSH transport, then reconciles it to the profile: installs missing agents, upgrades `agi-cli`, syncs the named config scopes, and **propagates logins** so a host signed in once seeds the fleet -- turning "6 hosts x 8 harnesses = 48 OAuth flows" into one. Portable credential files (claude, codex, grok, kimi, opencode, droid, antigravity) stream to each target over encrypted SSH stdin, never shell-interpolated, and land at `0600`. **Honest boundary:** macOS keychain-bound tokens (claude, antigravity on a Mac target) can't be extracted -- those surface as a one-time manual login, never faked. `--plan` / `--dry-run` shows the full matrix without touching anything.
+`agents fleet apply` probes every target over the existing SSH transport, then reconciles it to the profile: installs missing agents, upgrades `agi-cli`, syncs the named config scopes, and **propagates logins** so a host signed in once seeds the fleet -- turning "6 hosts x 8 harnesses = 48 OAuth flows" into one. Portable credential files (claude, codex, grok, kimi, opencode, droid, antigravity) stream to each target over encrypted SSH stdin, never shell-interpolated, and land at `0600`. **Honest boundary:** macOS keychain-bound tokens (claude, antigravity on a Mac target) can't be extracted -- those surface as a one-time manual login, never faked. `--plan` / `--dry-run` shows the full matrix without touching anything.
 
 See [docs/fleet.md](apps/cli/docs/fleet.md) for the manifest schema and reconcile semantics.
 
@@ -670,7 +672,7 @@ age (`updated 2m ago — pass --refresh (--live) for a live probe`).
 `agents fleet status` answers "is my fleet OK?" at a glance: a one-line rollup
 (`● N online · ○ M offline`), a short **NEEDS ATTENTION** list where every item names
 the command that fixes it (offline → `check the box`, config drift or a stark CLI gap →
-`agents apply <box>`, version skew → `agents upgrade --fleet`), then quiet per-device
+`agents fleet apply --device <box>`, version skew → `agents upgrade --fleet`), then quiet per-device
 rows grouped by OS (macOS / Linux / Windows) showing just `name · capacity · load/mem ·
 version`, with this machine flagged `▸ … ← this machine`. A healthy fleet reads in a few
 lines; orphaned versions are demoted to a one-line `agents prune` nudge in the footer.
@@ -1203,7 +1205,7 @@ agents artifacts share plan.html --json                     # URL object for pla
 agents artifacts share list --agent claude                  # everything published, filterable
 agents artifacts share revisions fleet                      # prior versions kept under a slug
 agents artifacts share status                               # show the endpoint
-agents unshare fleet                                        # take a published link (+ its OG cover) down
+agents artifacts unshare fleet                              # take a published link (+ its OG cover) down
 ```
 
 `agents artifacts share` closes the loop: an agent makes work (a plan, a viz, a report),
@@ -1232,7 +1234,7 @@ Republishing an existing slug keeps the prior version as a revision by default
 (`--no-revision` to skip); `agents artifacts share revisions <slug>` shows the retained
 history, newest first.
 
-`agents artifacts share delete <targets...>` (alias `agents unshare`) takes a page down — pass a
+`agents artifacts share delete <targets...>` (alias `agents artifacts unshare`) takes a page down — pass a
 full URL, `<user>/<slug>`, or a bare slug (resolved against your own namespace); several
 targets at once are fine. It also deletes the sibling `<slug>.png` OG cover by default
 (`--keep-cover` opts out) and verifies the page actually 404s before reporting success —
@@ -1505,7 +1507,7 @@ For full transparency: `agi-cli` keeps a local event log at `~/.agents/.cache/lo
 
 macOS and Linux. Windows via WSL works but isn't first-class yet.
 
-**macOS-only features:** Keychain-based secrets (`agents secrets`, `agents harness login`) require macOS. Default iCloud sync for bundles requires macOS + iCloud Keychain enabled; use `--no-icloud-sync` for device-local bundles. On Linux, use environment variables or `.env` files for API keys. Native Linux credential store support is planned.
+**macOS-only features:** Keychain-based secrets (`agents secrets`, `agents accounts add`) require macOS. Default iCloud sync for bundles requires macOS + iCloud Keychain enabled; use `--no-icloud-sync` for device-local bundles. On Linux, use environment variables or `.env` files for API keys. Native Linux credential store support is planned.
 
 Interactive tmux-backed runs require tmux 3.2 or newer.
 

package/dist/bootstrap.js

@@ -211,7 +211,7 @@ Install, configure, run, and dispatch AI coding agents from one place.
 Works with Claude, Codex, Antigravity, Cursor, OpenCode, OpenClaw, and Droid.
 
 Quick start:
-  agents setup                    First-time setup (interactive)
+  agents setup                    First-time setup (interactive); setup beta enables preview features
   agents view                     See what's installed
   agents run <agent> ["prompt"]   Run an agent (interactive without prompt, headless with)
   agents sessions                 Browse past sessions across all agents
@@ -260,11 +260,16 @@ Observe (read the fleet — no store merge):
   feed                            Needs-you inbox (open blocks waiting on you); agent posts = feed --filter updates
   sessions --active               Live agents (who is running right now)
   events                          Unified ops + activity event trail
-  audit                           Tamper-evident run-dispatch log (not events)
+  events audit                    Dispatched-run outcomes (alias of events --include runs)
   sync status                     Sync/drift only (not the live fleet snapshot)
   devices snapshot                One-process inventory + active sessions poll
 
-Credentials:
+Identity (Prix account — shared with paid tiers):
+  auth login                      Sign in via the device-code flow
+  auth whoami                     Show the signed-in Prix user
+  auth space                      Create and manage a space (invite collaborators)
+
+Credentials (harness keys, not your Prix user):
   harness                         Custom (host CLI + model + auth) harnesses; replaces former profiles command
   secrets                         Keychain-backed env bundles; synced vault: secrets vault unlock|lock
   accounts                        Provider credentials + native OAuth logout
@@ -281,9 +286,6 @@ Config sync:
   repo init --path <dir>          Scaffold your own editable repo from a template
   repo add <path|gh:user/repo>    Merge an extra repo after the system repo
 
-Beta features:
-  beta                            Enable preview features (factory and more)
-
 Automation tips:
   Pass explicit names/IDs         Avoid pickers: agents sessions <id> --markdown
   Use --yes for defaults          Auto-accept sync/default prompts on add/use/pull

package/dist/cli/command-registry.d.ts

@@ -56,19 +56,16 @@ export declare const loadPrune: ModuleLoader;
 export declare const loadTrash: ModuleLoader;
 export declare const loadRestore: ModuleLoader;
 export declare const loadDoctor: ModuleLoader;
-export declare const loadApply: ModuleLoader;
 export declare const loadRoute: ModuleLoader;
 export declare const loadHarness: ModuleLoader;
 export declare const loadSecrets: ModuleLoader;
 export declare const loadMenubar: ModuleLoader;
-export declare const loadBeta: ModuleLoader;
 export declare const loadSync: ModuleLoader;
 export declare const loadRefreshRules: ModuleLoader;
 export declare const loadFactory: ModuleLoader;
 export declare const loadUsage: ModuleLoader;
 export declare const loadInsights: ModuleLoader;
 export declare const loadPerf: ModuleLoader;
-export declare const loadTrends: ModuleLoader;
 export declare const loadPty: ModuleLoader;
 export declare const loadTmux: ModuleLoader;
 export declare const loadWatchdog: ModuleLoader;
@@ -88,9 +85,7 @@ export declare const loadMessage: ModuleLoader;
 export declare const loadSend: ModuleLoader;
 export declare const loadFeed: ModuleLoader;
 export declare const loadMailboxes: ModuleLoader;
-export declare const loadServe: ModuleLoader;
 export declare const loadArtifacts: ModuleLoader;
-export declare const loadAudit: ModuleLoader;
 export declare const loadWebhooks: ModuleLoader;
 export declare const loadHumans: ModuleLoader;
 export declare const loadAccounts: ModuleLoader;

package/dist/cli/command-registry.js

@@ -58,20 +58,16 @@ export const loadPrune = async () => (await import('../commands/prune.js')).regi
 export const loadTrash = async () => (await import('../commands/trash.js')).registerTrashCommands;
 export const loadRestore = async () => (await import('../commands/trash.js')).registerRestoreCommand;
 export const loadDoctor = async () => (await import('../commands/doctor.js')).registerDoctorCommand;
-export const loadApply = async () => (await import('../commands/apply.js')).registerApplyCommand;
 export const loadRoute = async () => (await import('../commands/route.js')).registerRouteCommands;
 export const loadHarness = async () => (await import('../commands/harness.js')).registerHarnessCommands;
 export const loadSecrets = async () => (await import('../commands/secrets.js')).registerSecretsCommands;
 export const loadMenubar = async () => (await import('../commands/menubar.js')).registerMenubarCommands;
-export const loadBeta = async () => (await import('../commands/beta.js')).registerBetaCommands;
 export const loadSync = async () => (await import('../commands/sync.js')).registerSyncCommand;
 export const loadRefreshRules = async () => (await import('../commands/refresh-rules.js')).registerRefreshRulesCommand;
 export const loadFactory = async () => (await import('../commands/factory.js')).registerFactoryCommands;
 export const loadUsage = async () => (await import('../commands/usage.js')).registerUsageCommand;
 export const loadInsights = async () => (await import('../commands/insights.js')).registerInsightsCommand;
 export const loadPerf = async () => (await import('../commands/perf.js')).registerPerfCommand;
-// Thin deprecated alias of `agents insights mix` — no second mix implementation.
-export const loadTrends = async () => (await import('../commands/trends.js')).registerTrendsCommand;
 export const loadPty = async () => (await import('../commands/pty.js')).registerPtyCommands;
 export const loadTmux = async () => (await import('../commands/tmux.js')).registerTmuxCommands;
 export const loadWatchdog = async () => (await import('../commands/watchdog.js')).registerWatchdogCommand;
@@ -91,11 +87,8 @@ export const loadMessage = async () => (await import('../commands/message.js')).
 export const loadSend = async () => (await import('../commands/send.js')).registerSendCommand;
 export const loadFeed = async () => (await import('../commands/feed.js')).registerFeedCommand;
 export const loadMailboxes = async () => (await import('../commands/mailboxes.js')).registerMailboxesCommand;
-export const loadServe = async () => (await import('../commands/serve.js')).registerServeCommand;
-// Registers the `artifacts` group (with `share` + `setup` under it) AND the
-// top-level `unshare` alias — see commands/artifacts.ts.
+// Registers the `artifacts` group (`share` + `setup` + nested `unshare`).
 export const loadArtifacts = async () => (await import('../commands/artifacts.js')).registerArtifactsCommands;
-export const loadAudit = async () => (await import('../commands/audit.js')).registerAuditCommands;
 export const loadWebhooks = async () => (await import('../commands/webhook.js')).registerWebhooksCommand;
 export const loadHumans = async () => (await import('../commands/humans.js')).registerHumansCommands;
 export const loadAccounts = async () => (await import('../commands/accounts.js')).registerAccountsCommand;
@@ -116,7 +109,6 @@ export const LAZY_COMMAND_NAMES = new Set([
     'teams',
     'cloud',
     'message',
-    'serve',
 ]);
 /**
  * User-typed top-level command name -> ordered list of module loaders to run.
@@ -175,20 +167,17 @@ export const COMMAND_LOADERS = {
     trash: [loadTrash],
     restore: [loadRestore],
     doctor: [loadDoctor],
-    apply: [loadApply],
     route: [loadRoute],
     harness: [loadHarness],
     harnesses: [loadHarness],
     secrets: [loadSecrets],
     menubar: [loadMenubar],
-    beta: [loadBeta],
     sync: [loadSync],
     'refresh-rules': [loadRefreshRules],
     factory: [loadFactory],
     usage: [loadUsage],
     insights: [loadInsights],
     perf: [loadPerf],
-    trends: [loadTrends],
     pty: [loadPty],
     tmux: [loadTmux],
     watchdog: [loadWatchdog],
@@ -218,12 +207,7 @@ export const COMMAND_LOADERS = {
     feed: [loadFeed],
     mailboxes: [loadMailboxes],
     mailbox: [loadMailboxes],
-    serve: [loadServe],
     artifacts: [loadArtifacts],
-    // `unshare` is a top-level convenience alias of `artifacts share delete` (see
-    // commands/share.ts) — same module, registered as its own program.command().
-    unshare: [loadArtifacts],
-    audit: [loadAudit],
     webhooks: [loadWebhooks],
     humans: [loadHumans],
     daemon: [loadDaemon],

package/dist/commands/apply.d.ts

@@ -1,25 +1,22 @@
 /**
- * `agents apply` (alias `ag apply`) — reconcile the whole fleet to a declared
- * profile in one command: install agents-cli + agents and sync config. Native
+ * `agents fleet apply` / `agents devices apply` — reconcile the whole fleet
+ * to a declared profile: install agents-cli + agents and sync config. Native
  * harness logins remain device-local; portable provider credentials move only
  * through explicit `agents accounts sync`.
  *
  * The manifest is the `fleet:` block of any `-f` file (default `agents.yaml`).
+ * Top-level `agents apply` is retired (RUSH-2981).
  */
 import { Command } from 'commander';
 /** padEnd on the visible width, ignoring chalk color codes. Exported for tests. */
 export declare function stripPad(s: string, width: number): string;
 /**
- * Attach the reconcile options + action to a command node. Shared by the
- * top-level `agents apply` and its `agents fleet apply` alias so the two can
- * never drift — identical flags, identical engine.
+ * Attach the reconcile options + action to a command node.
  */
 export declare function configureApplyCommand(cmd: Command): Command;
-export declare function registerApplyCommand(program: Command): void;
 /**
- * Surface `agents apply` under the fleet command tree as `agents fleet apply`
- * (and `agents devices apply`). Same reconcile engine as the top-level command —
- * a discoverability alias for users who reach for `fleet` as the verb. Kept in
- * lockstep via {@link configureApplyCommand}.
+ * Canonical surface: `agents fleet apply` / `agents devices apply`.
+ * Top-level `agents apply` is retired (RUSH-2981) — not a noun, already nested
+ * here. Same reconcile engine, kept in lockstep via {@link configureApplyCommand}.
  */
 export declare function registerFleetApplyAlias(devicesCmd: Command): void;

package/dist/commands/apply.js

@@ -1,10 +1,11 @@
 /**
- * `agents apply` (alias `ag apply`) — reconcile the whole fleet to a declared
- * profile in one command: install agents-cli + agents and sync config. Native
+ * `agents fleet apply` / `agents devices apply` — reconcile the whole fleet
+ * to a declared profile: install agents-cli + agents and sync config. Native
  * harness logins remain device-local; portable provider credentials move only
  * through explicit `agents accounts sync`.
  *
  * The manifest is the `fleet:` block of any `-f` file (default `agents.yaml`).
+ * Top-level `agents apply` is retired (RUSH-2981).
  */
 import * as fs from 'fs';
 import * as path from 'path';
@@ -12,7 +13,7 @@ import { fileURLToPath } from 'url';
 import chalk from 'chalk';
 import { setHelpSections } from '../lib/help.js';
 import { machineId } from '../lib/session/sync/config.js';
-import { loadDevices, isControlDevice } from '../lib/devices/registry.js';
+import { loadDevices } from '../lib/devices/registry.js';
 import { isHostPinned, managedKnownHostsPath } from '../lib/devices/known-hosts.js';
 import { ensureDevicesRegistered } from '../lib/devices/sync.js';
 import { readFleetFile, resolveDesired } from '../lib/fleet/manifest.js';
@@ -163,10 +164,7 @@ async function runApply(opts) {
         }
     }
     const registry = await loadDevices();
-    // Control devices (a cockpit) never run agents — exclude them from the
-    // reconcile set entirely so `agents apply` doesn't try to install/sync/login
-    // onto a paired phone.
-    const all = Object.values(registry).filter((d) => !isControlDevice(d));
+    const all = Object.values(registry);
     const online = all.filter((d) => d.tailscale?.online === true).map((d) => d.name);
     const registered = all.map((d) => d.name);
     // Unresolved names are skipped (surfaced above), never fatal — a manifest
@@ -290,9 +288,7 @@ function reportResults(results) {
     console.log(chalk.green('Fleet reconciled.'));
 }
 /**
- * Attach the reconcile options + action to a command node. Shared by the
- * top-level `agents apply` and its `agents fleet apply` alias so the two can
- * never drift — identical flags, identical engine.
+ * Attach the reconcile options + action to a command node.
  */
 export function configureApplyCommand(cmd) {
     return cmd
@@ -317,32 +313,10 @@ export function configureApplyCommand(cmd) {
         }
     });
 }
-export function registerApplyCommand(program) {
-    const applyCmd = configureApplyCommand(program.command('apply'));
-    setHelpSections(applyCmd, {
-        examples: `
-      # Preview what would change across the fleet
-      agents apply --plan -f agents.yaml
-
-      # Bring every device to the profile (installs + config sync; native login stays local)
-      ag apply -f agents.yaml
-
-      # One device only
-      agents apply --device yosemite-s1 -y
-
-      # Replicate every claude version on this machine onto a fresh box
-      agents apply --agent claude@all --device yosemite-s0 -y
-
-      # Install a specific pinned version on one device
-      agents apply --agent claude@2.1.207 --device yosemite-s0
-    `,
-    });
-}
 /**
- * Surface `agents apply` under the fleet command tree as `agents fleet apply`
- * (and `agents devices apply`). Same reconcile engine as the top-level command —
- * a discoverability alias for users who reach for `fleet` as the verb. Kept in
- * lockstep via {@link configureApplyCommand}.
+ * Canonical surface: `agents fleet apply` / `agents devices apply`.
+ * Top-level `agents apply` is retired (RUSH-2981) — not a noun, already nested
+ * here. Same reconcile engine, kept in lockstep via {@link configureApplyCommand}.
  */
 export function registerFleetApplyAlias(devicesCmd) {
     const sub = configureApplyCommand(devicesCmd.command('apply'));
@@ -353,6 +327,12 @@ export function registerFleetApplyAlias(devicesCmd) {
 
       # Reconcile every device to the profile
       agents fleet apply -y
+
+      # One device only
+      agents fleet apply --device yosemite-s1 -y
+
+      # Replicate every claude version on this machine onto a fresh box
+      agents fleet apply --agent claude@all --device yosemite-s0 -y
     `,
     });
 }

package/dist/commands/artifacts.js

@@ -34,7 +34,7 @@ export function registerArtifactsCommands(program) {
 
       # What's live in your namespace, and taking one down
       agents artifacts share list
-      agents unshare my-plan-a1b2
+      agents artifacts unshare my-plan-a1b2
 
       # Endpoint health, and pushing a new Worker template to it
       agents artifacts share status
@@ -47,12 +47,11 @@ export function registerArtifactsCommands(program) {
   --account/--token/--domain/--analytics-token, or run non-interactively, and it
   provisions directly with what you named.
 
-  agents unshare <targets...> stays a top-level alias of
-  agents artifacts share delete.
+  agents artifacts unshare <targets...> is the nested alias of
+  agents artifacts share delete. Top-level \`agents unshare\` is gone.
 
   Full reference: apps/cli/docs/share.md.
     `,
     });
-    // Top-level, deliberately: see registerUnshareCommand in commands/share.ts.
-    registerUnshareCommand(program);
+    registerUnshareCommand(artifactsCmd);
 }

package/dist/commands/audit.d.ts

@@ -1,14 +1,14 @@
 /**
- * `agents audit` — thin alias of `agents events --include runs`.
+ * `agents events audit` — thin alias of `agents events --include runs`.
  *
  * New run-dispatch outcomes land in the unified event stream as `run.dispatched`
  * (see lib/audit/log.ts::recordDispatchedRun). This command does not own a
  * separate store or query path — it only sets the default family filter.
  *
- *   agents audit              ≡ agents events --include runs
- *   agents audit list         ≡ same
- *   agents audit verify       walks the legacy hash-chain file if present
- *                             (pre-unification history only)
+ *   agents events audit              ≡ agents events --include runs
+ *   agents events audit list         ≡ same
+ *   agents events audit verify       walks the legacy hash-chain file if present
+ *                                    (pre-unification history only)
  */
 import type { Command } from 'commander';
-export declare function registerAuditCommands(program: Command): void;
+export declare function registerAuditCommands(events: Command): void;

package/dist/commands/audit.js

@@ -1,28 +1,28 @@
 /**
- * `agents audit` — thin alias of `agents events --include runs`.
+ * `agents events audit` — thin alias of `agents events --include runs`.
  *
  * New run-dispatch outcomes land in the unified event stream as `run.dispatched`
  * (see lib/audit/log.ts::recordDispatchedRun). This command does not own a
  * separate store or query path — it only sets the default family filter.
  *
- *   agents audit              ≡ agents events --include runs
- *   agents audit list         ≡ same
- *   agents audit verify       walks the legacy hash-chain file if present
- *                             (pre-unification history only)
+ *   agents events audit              ≡ agents events --include runs
+ *   agents events audit list         ≡ same
+ *   agents events audit verify       walks the legacy hash-chain file if present
+ *                                    (pre-unification history only)
  */
 import chalk from 'chalk';
 import { verifyAuditChain, readAuditLog, getAuditLogPath, } from '../lib/audit/log.js';
 import { addEventsReadOptions, runEventsCommand } from './events.js';
-export function registerAuditCommands(program) {
-    const audit = addEventsReadOptions(program
+export function registerAuditCommands(events) {
+    const audit = addEventsReadOptions(events
         .command('audit')
         .description('Alias of `agents events --include runs` — dispatched-run outcomes'), false)
         .addHelpText('after', `
 Examples:
-  agents audit                         Same as: agents events --include runs
-  agents audit --since 7d --json
-  agents audit list                    Muscle-memory alias of bare audit
-  agents audit verify                  Legacy hash-chain file only (if present)
+  agents events audit                  Same as: agents events --include runs
+  agents events audit --since 7d --json
+  agents events audit list             Muscle-memory alias of bare audit
+  agents events audit verify           Legacy hash-chain file only (if present)
 `)
         .action((_options, command) => {
         const opts = command.optsWithGlobals();
@@ -33,7 +33,7 @@ Examples:
     });
     audit
         .command('list')
-        .description('Alias of `agents audit` / `agents events --include runs`')
+        .description('Alias of `agents events audit` / `agents events --include runs`')
         .action((_options, command) => {
         const parent = command.parent;
         const opts = {

package/dist/commands/auth.js

@@ -2,6 +2,7 @@ import chalk from 'chalk';
 import { setHelpSections } from '../lib/help.js';
 import { runOrDie } from '../lib/format.js';
 import { clearPrixSession, fetchWhoAmI, pollDeviceToken, PrixApiError, readPrixSession, resolvePrixToken, startDeviceAuthorization, writePrixSession, } from '../lib/prix-account.js';
+import { registerAuthSpaceCommand } from './org.js';
 function sleep(ms) {
     return new Promise(resolve => setTimeout(resolve, ms));
 }
@@ -90,7 +91,7 @@ function runAuthLogout() {
     }
 }
 export function registerAuthCommand(program) {
-    const auth = program.command('auth').description('Sign in to your Rush account (shared by `agents org` and paid tiers)');
+    const auth = program.command('auth').description('Sign in to your Prix account (spaces, paid tiers)');
     auth.command('login').description('Sign in via the device-code flow').action(() => runOrDie(() => runAuthLogin()));
     auth.command('whoami').description('Show the signed-in account').option('--json', 'Machine-readable output')
         .action((o, command) => {
@@ -98,11 +99,14 @@ export function registerAuthCommand(program) {
         return runOrDie(() => runAuthWhoami(json), { json });
     });
     auth.command('logout').description('Clear the local `agents auth login` session').action(() => runOrDie(() => runAuthLogout()));
+    registerAuthSpaceCommand(auth);
     setHelpSections(auth, {
         examples: `agents auth login
 agents auth whoami
 agents auth whoami --json
-agents auth logout`,
-        notes: "`agents auth login` writes its own session, separate from \`rush login\`'s \`~/.rush/user.yaml\` — \`agents auth logout\` never signs you out of \`rush\`. If you're already signed in via \`rush login\`, \`agents auth whoami\`/\`agents org\` use that session automatically; no separate login is required.",
+agents auth logout
+agents auth space create acme-team
+agents auth space invite dev@example.com --role admin`,
+        notes: "`agents auth login` writes its own session, separate from \`rush login\`'s \`~/.rush/user.yaml\` — \`agents auth logout\` never signs you out of \`rush\`. If you're already signed in via \`rush login\`, \`agents auth whoami\`/\`agents auth space\` use that session automatically; no separate login is required. \`agents org\` is a deprecated alias of \`agents auth space\`.",
     });
 }

package/dist/commands/beta.d.ts

@@ -1,2 +1,8 @@
+/**
+ * `agents setup beta` — enable or disable preview features like factory.
+ * Nested under setup because opting into a preview is machine configuration,
+ * not its own noun (RUSH-2981).
+ */
 import type { Command } from 'commander';
-export declare function registerBetaCommands(program: Command): void;
+/** Register `agents setup beta` under the parent `setup` command. */
+export declare function registerBetaCommands(setupCmd: Command): void;