@phnx-labs/agents-cli 1.22.43 → 1.22.44

package/dist/lib/staleness/writers/mcp.js

@@ -1,5 +1,14 @@
+/**
+ * MCP writer — thin dispatcher into `installMcpServers` from `lib/mcp.ts`.
+ *
+ * The per-agent format handling (Claude CLI, Codex TOML, Cursor JSON, etc.)
+ * lives in lib/mcp.ts; we keep it there to avoid the import cycle with
+ * `versions.ts`. The writer simply hands the selection to that function.
+ */
+import * as fs from 'fs';
 import { capableAgents } from '../../capabilities.js';
 import { installMcpServers } from '../../mcp.js';
+import { getMcpConfigPathForHome } from '../../agents.js';
 import { lazyAgentMap } from './lazy-map.js';
 function buildMcpWriter(agent) {
     return {
@@ -9,7 +18,13 @@ function buildMcpWriter(agent) {
             const r = installMcpServers(agent, version, versionHome, selection, { cwd });
             // Forward r.errors: dropping them is what let a harness with no config
             // writer report a clean sync while writing nothing (RUSH-2677).
-            return { synced: r.applied, ...(r.errors.length ? { errors: r.errors } : {}) };
+            // All applied servers land in the one canonical config file — that file
+            // is the artifact whose deletion must read as stale (#2398). Recorded
+            // only when it verifiably exists after the write, so an agent whose CLI
+            // wrote elsewhere can never produce a perpetually-stale manifest.
+            const configPath = getMcpConfigPathForHome(agent, versionHome);
+            const paths = r.applied.length > 0 && fs.existsSync(configPath) ? [configPath] : [];
+            return { synced: r.applied, paths, ...(r.errors.length ? { errors: r.errors } : {}) };
         },
     };
 }

package/dist/lib/staleness/writers/rules.js

@@ -43,7 +43,7 @@ function buildRulesWriter(agent) {
             }
             catch { /* destination did not exist */ }
             fs.writeFileSync(destFile, composed.content);
-            return { synced: [targetName] };
+            return { synced: [targetName], paths: [destFile] };
         },
     };
 }

package/dist/lib/staleness/writers/skills.js

@@ -56,6 +56,7 @@ function buildSkillsWriter(agent) {
             catch { /* does not exist yet */ }
             fs.mkdirSync(skillsTarget, { recursive: true });
             const synced = [];
+            const paths = [];
             for (const skill of selection) {
                 const srcDir = resolveSkillSource(skill, { agent });
                 if (!srcDir)
@@ -64,8 +65,9 @@ function buildSkillsWriter(agent) {
                 removePath(destDir);
                 copyDir(srcDir, destDir);
                 synced.push(skill);
+                paths.push(destDir);
             }
-            return { synced };
+            return { synced, paths };
         },
         remove({ versionHome, name }) {
             const agentDir = path.join(versionHome, agentConfigDirName(agent));

package/dist/lib/staleness/writers/subagents.d.ts

@@ -1,12 +1,3 @@
-/**
- * Subagents writer. Every agent's on-disk layout (target dir, file/dir shape,
- * transform) is declared once in the subagent registry; this writer is generic
- * and iterates the registry instead of a per-agent `else if` chain.
- *
- * Source-side discovery is `listInstalledSubagents` from lib/subagents.ts —
- * it reads user + system layers only (project layer excluded for the same
- * defense as commands/skills/hooks).
- */
 import type { AgentId } from '../../types.js';
 import type { ResourceWriter } from './types.js';
 export declare const subagentsWriters: Partial<Record<AgentId, ResourceWriter<string[]>>>;

package/dist/lib/staleness/writers/subagents.js

@@ -1,3 +1,13 @@
+/**
+ * Subagents writer. Every agent's on-disk layout (target dir, file/dir shape,
+ * transform) is declared once in the subagent registry; this writer is generic
+ * and iterates the registry instead of a per-agent `else if` chain.
+ *
+ * Source-side discovery is `listInstalledSubagents` from lib/subagents.ts —
+ * it reads user + system layers only (project layer excluded for the same
+ * defense as commands/skills/hooks).
+ */
+import * as fs from 'fs';
 import { capableAgents } from '../../capabilities.js';
 import { listInstalledSubagents } from '../../subagents.js';
 import { subagentTarget } from '../../subagents-registry.js';
@@ -14,6 +24,7 @@ function buildSubagentsWriter(agent) {
             const map = new Map(all.map(s => [s.name, s]));
             const dir = target.dir(versionHome);
             const synced = [];
+            const paths = [];
             for (const name of selection) {
                 const sub = map.get(name);
                 if (!sub)
@@ -21,10 +32,16 @@ function buildSubagentsWriter(agent) {
                 try {
                     target.write(dir, sub);
                     synced.push(sub.name);
+                    // The registry owns the layout — record the artifact paths this
+                    // write occupies so a later deletion reads as stale (#2398).
+                    for (const entry of target.occupied(dir, sub.name)) {
+                        if (fs.existsSync(entry.path))
+                            paths.push(entry.path);
+                    }
                 }
                 catch { /* per-item sync failure: skip */ }
             }
-            return { synced };
+            return { synced, paths };
         },
     };
 }

package/dist/lib/staleness/writers/types.d.ts

@@ -28,6 +28,16 @@ export interface WriteArgs<Sel> {
 export interface WriteResult {
     /** Names actually written. Empty array = write produced nothing (not an error). */
     synced: string[];
+    /**
+     * Absolute on-disk paths of the artifacts this write materialized (a file or
+     * a dir root per resource, per the agent's layout). Recorded into the sync
+     * manifest as `writtenTargets` so `isStale` can flag a deleted artifact as
+     * stale with one existsSync per path (#2398) — no content reads, keeping the
+     * fast-guard budget (RUSH-2320). Optional: a writer whose artifact path is
+     * not cheaply known (goose recipe YAML, plugins) may omit entries; absence
+     * means "not verified", never a false stale.
+     */
+    paths?: string[];
     /**
      * Per-item failures the writer could not complete, as user-facing sentences.
      *

package/dist/lib/startup/command-registry.d.ts

@@ -24,7 +24,13 @@ export declare const KNOWN_TOP_LEVEL_COMMANDS: ReadonlySet<string>;
  * use `agents feed --filter updates` (RUSH-2692). `status` moved under
  * `agents sync status` (RUSH-2864). `tickets` was removed — use `linear`
  * (linear-cli) (RUSH-2932). `alias` moved under `agents setup alias` (RUSH-2965).
- * `inbox` was a pure alias of `agents feed` (RUSH-2984).
+ * `inbox` was a pure alias of `agents feed` (RUSH-2984). `unshare` nested under
+ * `agents artifacts unshare` (RUSH-2989). `audit` nested under `agents events audit`.
+ * `trends` nested under `agents insights mix` / `insights trends`. `serve` (the
+ * read-only local web companion + `--control` anchor) was removed with the
+ * unshipped iOS Fleet Cockpit it existed for (RUSH-3001). `apply` nested under
+ * `agents fleet apply` / `agents devices apply`. `beta` nested under
+ * `agents setup beta` (RUSH-2981).
  */
 export declare const RETIRED_TOP_LEVEL_COMMANDS: ReadonlySet<string>;
 export declare function isKnownTopLevelCommand(name: string): boolean;

package/dist/lib/startup/command-registry.js

@@ -3,13 +3,13 @@ const LOADED_COMMAND_NAMES = [
     'permissions', 'mcp', 'clis', 'subagents', 'plugins', 'workflows', 'add', 'use', 'list',
     'remove', 'rm', 'purge', 'update', 'prune', 'import', 'registry', 'search', 'install',
     'routines', 'monitors', 'projects', 'run', 'open', 'reconnect', 'fork', 'config',
-    'models', 'modes', 'trash', 'restore', 'doctor', 'apply',
-    'route', 'harness', 'harnesses', 'secrets', 'menubar', 'beta', 'sync',
-    'refresh-rules', 'factory', 'usage', 'insights', 'perf', 'trends',
+    'models', 'modes', 'trash', 'restore', 'doctor',
+    'route', 'harness', 'harnesses', 'secrets', 'menubar', 'sync',
+    'refresh-rules', 'factory', 'usage', 'insights', 'perf',
     'pty', 'tmux', 'watchdog', 'browser', 'computer', 'logs', 'events',
     'ssh', 'devices', 'fleet', 'repos', 'repo', 'setup', 'uninstall', 'upgrade', 'sessions',
     'teams', 'cloud', 'message', 'send', 'notify', 'feed',
-    'mailboxes', 'mailbox', 'serve', 'artifacts', 'unshare', 'audit', 'webhooks',
+    'mailboxes', 'mailbox', 'artifacts', 'webhooks',
     'humans', 'daemon',
 ];
 const INLINE_COMMAND_NAMES = [
@@ -44,10 +44,17 @@ export const KNOWN_TOP_LEVEL_COMMANDS = new Set([
  * use `agents feed --filter updates` (RUSH-2692). `status` moved under
  * `agents sync status` (RUSH-2864). `tickets` was removed — use `linear`
  * (linear-cli) (RUSH-2932). `alias` moved under `agents setup alias` (RUSH-2965).
- * `inbox` was a pure alias of `agents feed` (RUSH-2984).
+ * `inbox` was a pure alias of `agents feed` (RUSH-2984). `unshare` nested under
+ * `agents artifacts unshare` (RUSH-2989). `audit` nested under `agents events audit`.
+ * `trends` nested under `agents insights mix` / `insights trends`. `serve` (the
+ * read-only local web companion + `--control` anchor) was removed with the
+ * unshipped iOS Fleet Cockpit it existed for (RUSH-3001). `apply` nested under
+ * `agents fleet apply` / `agents devices apply`. `beta` nested under
+ * `agents setup beta` (RUSH-2981).
  */
 export const RETIRED_TOP_LEVEL_COMMANDS = new Set([
     'webhook',
+    'serve',
     'login',
     'logout',
     'budget',
@@ -67,6 +74,11 @@ export const RETIRED_TOP_LEVEL_COMMANDS = new Set([
     'tickets',
     'alias',
     'inbox',
+    'unshare',
+    'audit',
+    'trends',
+    'apply',
+    'beta',
 ]);
 export function isKnownTopLevelCommand(name) {
     return KNOWN_TOP_LEVEL_COMMANDS.has(name);

package/dist/lib/startup/root-command.d.ts

@@ -1,3 +1,20 @@
 import type { Command } from 'commander';
-/** Configure the public root surface shared by the live CLI and reference generator. */
+/**
+ * Configure the public root surface shared by the live CLI and reference generator.
+ *
+ * Does NOT call `enablePositionalOptions()` — tried for RUSH-2687 (a subcommand
+ * option whose long name collides with an ancestor's is silently dropped at
+ * parse time) and reverted. Commander's `copyInheritedSettings()` copies
+ * `_enablePositionalOptions` onto every command created via `.command()` from
+ * that point on, so setting it here cascades to all ~552 registered commands,
+ * not just the root's own scan. That broke a real, load-bearing pattern used
+ * elsewhere in the tree: a parent command (e.g. `sessions`, which owns
+ * `--since`/`--json`/`--local`) whose LEAF subcommands declare none of their
+ * own options and read them back via `command.optsWithGlobals()` (e.g.
+ * `sessions backfill tools --since 7d --json --local`) — positional options
+ * makes the parent stop scanning at the first subcommand-shaped token, so it
+ * never sees the flags typed after it, and the leaf sees `unknown option`
+ * instead of a silent drop. RUSH-2687 was fixed per-surface in share.ts
+ * instead (renaming the colliding options), not with this global flag.
+ */
 export declare function configureRootCommand(program: Command, name: string, version: string): Command;

package/dist/lib/startup/root-command.js

@@ -1,4 +1,21 @@
-/** Configure the public root surface shared by the live CLI and reference generator. */
+/**
+ * Configure the public root surface shared by the live CLI and reference generator.
+ *
+ * Does NOT call `enablePositionalOptions()` — tried for RUSH-2687 (a subcommand
+ * option whose long name collides with an ancestor's is silently dropped at
+ * parse time) and reverted. Commander's `copyInheritedSettings()` copies
+ * `_enablePositionalOptions` onto every command created via `.command()` from
+ * that point on, so setting it here cascades to all ~552 registered commands,
+ * not just the root's own scan. That broke a real, load-bearing pattern used
+ * elsewhere in the tree: a parent command (e.g. `sessions`, which owns
+ * `--since`/`--json`/`--local`) whose LEAF subcommands declare none of their
+ * own options and read them back via `command.optsWithGlobals()` (e.g.
+ * `sessions backfill tools --since 7d --json --local`) — positional options
+ * makes the parent stop scanning at the first subcommand-shaped token, so it
+ * never sees the flags typed after it, and the leaf sees `unknown option`
+ * instead of a silent drop. RUSH-2687 was fixed per-surface in share.ts
+ * instead (renaming the colliding options), not with this global flag.
+ */
 export function configureRootCommand(program, name, version) {
     return program
         .name(name)

package/dist/lib/state.js

@@ -955,6 +955,13 @@ function serializeCentral(central) {
         // config data-loss bug). A known device key lingering in the synced file is
         // still removed — it belongs in the per-machine file, not here.
         if (!(k in central) && KNOWN_META_KEYS.has(k)) {
+            // RUSH-2837: a partial writeMeta (reconstructed Meta missing `share`)
+            // deleted the share endpoint from agents.yaml and synced that deletion
+            // fleet-wide. `share` is restored only by setup/join — never drop it
+            // just because this write omitted the key. Explicit `share: null` still
+            // goes through doc.set above.
+            if (k === 'share')
+                continue;
             doc.delete(k);
             changed = true;
         }

package/dist/lib/teams/placement-probe.js

@@ -7,9 +7,9 @@
  *
  *   - reachability + headroom + load  ← {@link probeFleetStats} (one parallel
  *     SSH fan-out over the pool; the local box is measured directly).
- *   - requested agent installed + signed in (when known) ← a one-shot readiness
- *     probe per remote device ({@link buildReadyProbeCommand} → `agents view`),
- *     the local box via {@link checkCliAvailable}/{@link checkCliSignedIn}.
+ *   - requested agent installed + account eligibility (when known) ← a one-shot
+ *     readiness probe per remote device ({@link buildReadyProbeCommand} →
+ *     `agents view`), with the same candidate-readiness gate evaluated locally.
  *
  * The result is cached briefly per (pool, agent-or-any) so a `teams start` wave that
  * places N teammates probes the pool ONCE, not N times — the roster-count part
@@ -25,10 +25,11 @@ import { execFile } from 'child_process';
 import { probeFleetStats, headroom } from '../devices/health.js';
 import { loadDevicesSync } from '../devices/registry.js';
 import { buildSshInvocation, writeAskpassShim } from '../devices/connect.js';
-import { buildReadyProbeCommand, parseReadyProbe, viewAgentSignedIn, viewHasAgent, } from '../hosts/ready.js';
+import { buildReadyProbeCommand, parseReadyProbe, viewAgentAccountEligibility, viewHasAgent, } from '../hosts/ready.js';
+import { collectRunCandidates, isSignInRecoverable, readinessFromCandidate, } from '../accounting/rotate.js';
 import { localMachineId } from '../origin-machine.js';
 import { normalizeHost } from '../machine-id.js';
-import { checkCliAvailable, checkCliSignedIn } from './agents.js';
+import { checkCliAvailable } from './agents.js';
 /** Per-remote readiness probe budget — matches the health probe's short window
  * (`agents view` on a warm box is sub-second; a wedged one degrades to unknown). */
 export const READY_PROBE_TIMEOUT_MS = 8_000;
@@ -61,19 +62,22 @@ function probeRemoteReadiness(device, agent) {
         ({ args, env } = buildSshInvocation(device, [cmd], shim, {}, { agentOnly: true }));
     }
     catch {
-        return Promise.resolve({ installed: undefined, signedIn: undefined });
+        return Promise.resolve({ installed: undefined, signedIn: undefined, pickerEligible: undefined });
     }
     return new Promise((resolve) => {
         execFile('ssh', args, { encoding: 'utf-8', env: { ...process.env, ...env }, timeout: READY_PROBE_TIMEOUT_MS }, (err, stdout) => {
             if (err || !stdout)
-                return resolve({ installed: undefined, signedIn: undefined });
+                return resolve({ installed: undefined, signedIn: undefined, pickerEligible: undefined });
             const probe = parseReadyProbe(stdout);
             if (!probe.reachable)
-                return resolve({ installed: undefined, signedIn: undefined });
+                return resolve({ installed: undefined, signedIn: undefined, pickerEligible: undefined });
             if (!probe.version)
-                return resolve({ installed: false, signedIn: false });
+                return resolve({ installed: false, signedIn: false, pickerEligible: false });
             const installed = viewHasAgent(probe.view, agent);
-            resolve({ installed, signedIn: installed ? viewAgentSignedIn(probe.view, agent) : false });
+            const eligibility = installed
+                ? viewAgentAccountEligibility(probe.view, agent)
+                : { signedIn: false, pickerEligible: false };
+            resolve({ installed, ...eligibility });
         });
     });
 }
@@ -108,8 +112,18 @@ export async function probePoolSignals(pool, agent, opts = {}) {
             const isSelf = normalizeHost(d.name) === self;
             if (isSelf) {
                 const inst = checkCliAvailable(agent)[0];
-                const signedIn = inst ? await checkCliSignedIn(agent) : undefined;
-                return [d.name, { installed: inst, signedIn }];
+                if (!inst)
+                    return [d.name, { installed: false, signedIn: false, pickerEligible: false }];
+                const candidates = await collectRunCandidates(agent).catch(() => null);
+                if (!candidates) {
+                    return [d.name, { installed: true, signedIn: undefined, pickerEligible: undefined }];
+                }
+                const readiness = candidates.map(readinessFromCandidate);
+                return [d.name, {
+                        installed: true,
+                        signedIn: readiness.some((candidate) => candidate.ready),
+                        pickerEligible: readiness.some((candidate) => candidate.ready || isSignInRecoverable(candidate)),
+                    }];
             }
             return [d.name, await probeRemoteReadiness(d, agent)];
         }))
@@ -128,6 +142,7 @@ export async function probePoolSignals(pool, agent, opts = {}) {
             memPercent: s?.memPercent,
             installed: inst?.installed,
             signedIn: inst?.signedIn,
+            pickerEligible: inst?.pickerEligible,
         });
     }
     cache.set(key, { at: now, signals });

package/dist/lib/teams/scheduler.d.ts

@@ -18,8 +18,10 @@ export interface DevicePlacementSignal {
     memPercent?: number;
     /** Requested agent installed on the device. `false` → excluded (can't run). */
     installed?: boolean;
-    /** Requested agent signed in (best-effort). Ranks a signed-in device first. */
+    /** Requested agent has at least one launch-ready account. Ranks a ready device first. */
     signedIn?: boolean;
+    /** Requested agent has at least one row the interactive account picker can launch. */
+    pickerEligible?: boolean;
 }
 /** Team fields the placement cascade reads (a subset of TeamMeta). */
 export interface PlacementTeam {

package/dist/lib/types.d.ts

@@ -80,7 +80,7 @@ export interface BudgetConfig {
      */
     require_confirm_over?: number;
 }
-/** Preview features that users can opt into via `agents beta`. */
+/** Preview features that users can opt into via `agents setup beta`. */
 export type BetaFeatureName = 'factory';
 /** Subset of chalk color names used for agent-specific terminal output. */
 export type ChalkColor = 'magenta' | 'green' | 'blue' | 'cyan' | 'yellowBright' | 'redBright' | 'whiteBright' | 'blueBright' | 'greenBright' | 'magentaBright' | 'cyanBright';

package/dist/lib/view-types.d.ts

@@ -1,6 +1,7 @@
 import type { ConfiguredModelSource } from './models.js';
 import type { ProfileSummary } from './profiles.js';
 import type { AgentId } from './types.js';
+import type { AuthVerdict } from './auth-health.js';
 export type SyncState = 'synced' | 'new' | 'modified' | 'deleted';
 export interface ViewJsonVersion {
     version: string;
@@ -8,6 +9,8 @@ export interface ViewJsonVersion {
     isolated: boolean;
     isIsolatedDefault: boolean;
     signedIn: boolean;
+    /** Live cached authentication verdict for this installed version. */
+    authVerdict: AuthVerdict | null;
     email: string | null;
     accountId?: string | null;
     organizationType?: string | null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@phnx-labs/agents-cli",
-  "version": "1.22.43",
+  "version": "1.22.44",
   "description": "One CLI for all your AI coding agents - versions, config, cloud dispatch, sessions, and teams (now with first-class Grok Build CLI support)",
   "type": "module",
   "main": "dist/index.js",
@@ -25,7 +25,6 @@
     "dist/**/*.d.ts",
     "dist/**/*.json",
     "dist/**/*.sh",
-    "dist/bin/**",
     "dist/lib/secrets/Agents CLI.app/**",
     "dist/lib/menubar/MenubarHelper.app/**",
     "scripts/postinstall.js",
@@ -49,7 +48,7 @@
     "build": "tsc && rm -rf 'dist/lib/secrets/AgentsKeychain.app' 'dist/lib/secrets/Agents CLI.app' 'dist/lib/menubar/MenubarHelper.app' && ([ -d 'bin/Agents CLI.app' ] && cp -R 'bin/Agents CLI.app' 'dist/lib/secrets/Agents CLI.app' || true) && ([ -d 'bin/MenubarHelper.app' ] && mkdir -p 'dist/lib/menubar' && cp -R 'bin/MenubarHelper.app' 'dist/lib/menubar/MenubarHelper.app' || true) && ([ -f 'bin/agents-macos' ] && mkdir -p dist/bin && cp -f 'bin/agents-macos' 'dist/bin/agents' && chmod 755 'dist/bin/agents' || true)",
     "build:bin": "scripts/build-bin.sh",
     "prepare": "npm run build",
-    "prepack": "cp ../../README.md README.md && scripts/verify-keychain-helper.sh && scripts/verify-menubar-helper.sh && scripts/verify-cli-binary.sh",
+    "prepack": "cp ../../README.md README.md && scripts/verify-keychain-helper.sh && scripts/verify-menubar-helper.sh",
     "postinstall": "node scripts/postinstall.js",
     "dev": "tsx src/index.ts",
     "changelog": "bun scripts/gen-changelog.ts",

package/dist/commands/serve.d.ts

@@ -1,10 +0,0 @@
-/**
- * `agents serve` — read-only local web companion.
- *
- * Boots a localhost-only (127.0.0.1) HTTP + SSE server that renders a live
- * dashboard of team status + per-worktree diffs, scheduled routines, and cloud
- * tasks. Everything is a viewer over data other commands already own — there
- * are no mutation endpoints. See src/lib/serve/.
- */
-import type { Command } from 'commander';
-export declare function registerServeCommand(program: Command): void;

package/dist/commands/serve.js

@@ -1,68 +0,0 @@
-import chalk from 'chalk';
-import { startServeServer, DEFAULT_SERVE_PORT, SERVE_HOST } from '../lib/serve/server.js';
-import { startControlServer } from '../lib/serve/control.js';
-import { ensureControlToken } from '../lib/serve/token.js';
-export function registerServeCommand(program) {
-    program
-        .command('serve')
-        .description('Read-only local web companion: team diffs, routines, and cloud status (binds 127.0.0.1 only).')
-        .option('-p, --port <n>', `Port to bind on ${SERVE_HOST}`, String(DEFAULT_SERVE_PORT))
-        .option('--interval <ms>', 'SSE refresh cadence in milliseconds', '3000')
-        .option('--control', 'Authenticated control mode (RUSH-1731): adds bearer-gated POST /api/run and /api/session/:id/message so the iOS cockpit can dispatch + steer. Enables binding beyond loopback — pair a device with `agents devices pair-ios`.', false)
-        .option('--bind <addr>', 'Address to bind in --control mode (e.g. your tailnet IP, or 0.0.0.0). Ignored without --control; read-only serve is always loopback.', SERVE_HOST)
-        .action(async (opts) => {
-        const port = parseInt(opts.port ?? '', 10) || DEFAULT_SERVE_PORT;
-        const intervalMs = parseInt(opts.interval ?? '', 10) || 3000;
-        try {
-            if (opts.control) {
-                const bind = opts.bind || SERVE_HOST;
-                const minted = ensureControlToken('default');
-                const { server, port: bound } = await startControlServer(port, bind, {
-                    cwd: process.cwd(),
-                    intervalMs,
-                });
-                const url = `http://${bind}:${bound}`;
-                console.log(`${chalk.green('agents serve --control')} ${chalk.dim('→')} ${chalk.cyan(url)}`);
-                if (minted.created) {
-                    console.log(chalk.yellow('New control token (shown once — store it in the cockpit now):'));
-                    console.log(`  ${chalk.bold(minted.token)}  ${chalk.dim(`(id ${minted.id})`)}`);
-                }
-                else {
-                    console.log(chalk.dim('Using existing control token(s). Issue another with `agents devices pair-ios`.'));
-                }
-                if (bind !== SERVE_HOST) {
-                    console.log(chalk.dim('bearer-gated · bind beyond loopback — keep this on the tailnet, never public Funnel · Ctrl-C to stop'));
-                }
-                else {
-                    console.log(chalk.dim('bearer-gated · loopback (pass --bind <tailnet-ip> to reach it from the phone) · Ctrl-C to stop'));
-                }
-                const shutdown = () => server.close(() => process.exit(0));
-                process.on('SIGINT', shutdown);
-                process.on('SIGTERM', shutdown);
-                return;
-            }
-            const { server, port: bound } = await startServeServer(port, {
-                cwd: process.cwd(),
-                intervalMs,
-            });
-            const url = `http://${SERVE_HOST}:${bound}`;
-            console.log(`${chalk.green('agents serve')} ${chalk.dim('→')} ${chalk.cyan(url)}`);
-            console.log(chalk.dim('read-only · localhost only · Ctrl-C to stop'));
-            const shutdown = () => {
-                server.close(() => process.exit(0));
-            };
-            process.on('SIGINT', shutdown);
-            process.on('SIGTERM', shutdown);
-        }
-        catch (err) {
-            const msg = String(err?.message ?? err);
-            if (msg.includes('EADDRINUSE')) {
-                console.error(chalk.red(`Port ${port} is already in use. Pass --port <n> to pick another.`));
-            }
-            else {
-                console.error(chalk.red(`Could not start serve: ${msg}`));
-            }
-            process.exit(1);
-        }
-    });
-}

package/dist/commands/trends.d.ts

@@ -1,10 +0,0 @@
-/**
- * Deprecated top-level spelling of the counter-mix tree.
- *
- * Implementation lives under `agents insights mix` (see
- * `lib/analytics/mix-commands.ts`). This file only registers the thin alias so
- * old scripts and agent briefs keep working while printing one deprecation line
- * — no second recipe implementation.
- */
-import type { Command } from 'commander';
-export declare function registerTrendsCommand(program: Command): void;

package/dist/commands/trends.js

@@ -1,12 +0,0 @@
-/**
- * Deprecated top-level spelling of the counter-mix tree.
- *
- * Implementation lives under `agents insights mix` (see
- * `lib/analytics/mix-commands.ts`). This file only registers the thin alias so
- * old scripts and agent briefs keep working while printing one deprecation line
- * — no second recipe implementation.
- */
-import { registerDeprecatedTrendsAlias } from '../lib/analytics/mix-commands.js';
-export function registerTrendsCommand(program) {
-    registerDeprecatedTrendsAlias(program);
-}

package/dist/lib/serve/control.d.ts

@@ -1,95 +0,0 @@
-/**
- * Authenticated `agents serve --control` server — the "anchor" the iOS/iPadOS
- * cockpit talks to (RUSH-1731).
- *
- * It is the read-only {@link handleServeGet} surface plus a small mutation API,
- * gated by a bearer token ({@link verifyControlToken}) on EVERY request because,
- * unlike plain `agents serve`, this variant may bind beyond loopback (a tailnet
- * address) so the phone can reach it. It adds no new execution machinery: a run
- * request re-invokes the same `agents run` the CLI uses (inheriting host
- * offload, secrets, detached dispatch), and a message re-invokes `agents
- * message`. The server generates the run's session id so the run is immediately
- * addressable for streaming (Phase 2) and steering.
- *
- * Both side-effecting operations are behind DI seams ({@link ControlOptions})
- * so tests drive them without spawning real agents — mirroring the `snapshot`
- * seam on the read-only server.
- */
-import type http from 'http';
-import type { StdioOptions } from 'child_process';
-import { type ServeOptions } from './server.js';
-/** A request to start an agent run on this anchor (local or offloaded). */
-export interface RunRequest {
-    /** Agent to run: 'claude' | 'codex' | 'gemini' | … */
-    agent: string;
-    /** Headless prompt. */
-    prompt: string;
-    /** Permission mode: plan | edit | auto | skip. Defaults to the CLI default. */
-    mode?: string;
-    /** Offload onto a registered device / host (the executor). Omit → run on the anchor. */
-    host?: string;
-    /** Working directory (on the host when `host` is set). */
-    cwd?: string;
-}
-/** Identifiers by which the started run can later be streamed / messaged. */
-export interface RunResult {
-    /** Addressable session id (a UUID for claude; otherwise equals `name`). */
-    sessionId: string;
-    /** Durable run name seeded into the session label. */
-    name: string;
-}
-/** Starts a run and returns its addressable ids. */
-export type RunDispatcher = (req: RunRequest) => Promise<RunResult>;
-/** Delivers a message to a running/parked agent by id. */
-export type Messenger = (id: string, text: string, from?: string) => Promise<void>;
-export interface ControlOptions extends ServeOptions {
-    /** Bearer verifier. Defaults to {@link verifyControlToken}. */
-    verifyToken?: (presented: string | undefined) => boolean;
-    /** Run starter. Defaults to spawning `agents run …` detached. */
-    runner?: RunDispatcher;
-    /** Message sender. Defaults to spawning `agents message …`. */
-    messenger?: Messenger;
-    /** Poll cadence (ms) for the session event stream. Defaults to 300. */
-    streamPollMs?: number;
-    /** Resolve a session id to its NDJSON capture file. Defaults to {@link streamLogPath}. */
-    streamLogPathFor?: (sessionId: string) => string;
-}
-/**
- * SSE stream of a session's normalized NDJSON events, offset-tailed from its
- * capture file. Resumes from `?offset=<bytes>` or the `Last-Event-ID` header
- * (each event's `id:` is its exact byte offset, so resume neither loses nor
- * duplicates). Closes when a terminal (`result`/`error`) event is seen or the
- * client disconnects. A not-yet-created file simply yields nothing until the
- * run starts writing — the phone can open the stream the instant it dispatches.
- */
-export declare function startSessionStream(file: string, req: http.IncomingMessage, res: http.ServerResponse, pollMs: number): void;
-/**
- * Spawn a detached child and settle once it has either successfully spawned or
- * failed to. Attaching an `'error'` listener is mandatory: a `ChildProcess` is
- * an `EventEmitter`, so an `'error'` event (e.g. ENOENT from a stale/missing
- * `agents` binary — a real condition `validateDaemonBinary` guards against)
- * with no listener throws and would take down the whole anchor process, not
- * just the one request. Mirrors the `once('spawn') / once('error')` pattern in
- * `teams/agents.ts`. The `'error'` listener registered by `once` survives after
- * a successful spawn, so a later error is absorbed rather than crashing.
- */
-export declare function spawnDetached(command: string, args: string[], stdio?: StdioOptions): Promise<void>;
-/**
- * Default run dispatcher: re-invoke `agents run` with a server-minted id so the
- * run is addressable, detached so it outlives this request (and the anchor
- * process). Local runs detach here; `--device` runs detach on the executor via
- * the existing dispatch path.
- */
-export declare const defaultRunner: RunDispatcher;
-/** Default messenger: re-invoke `agents message <id> <text>` and await its exit. */
-export declare const defaultMessenger: Messenger;
-/**
- * Create (but do not start) the authenticated control server. Caller invokes
- * `.listen(port, bind)`.
- */
-export declare function createControlServer(opts?: ControlOptions): http.Server;
-/** Start the control server on `port`, bound to `bind`. Resolves the bound port. */
-export declare function startControlServer(port: number, bind: string, opts?: ControlOptions): Promise<{
-    server: http.Server;
-    port: number;
-}>;