@phnx-labs/agents-cli 1.22.43 → 1.22.44

package/dist/commands/beta.js

@@ -1,5 +1,6 @@
 import chalk from 'chalk';
 import { ALL_BETA_FEATURES, getBetaConfigLocation, getEnabledBetaFeatures, setBetaEnabled, } from '../lib/beta.js';
+import { setHelpSections } from '../lib/help.js';
 const BETA_DESCRIPTIONS = {
     factory: 'Cloud-based agent dispatch via Rush Factory',
 };
@@ -20,16 +21,22 @@ function parseFeatures(values) {
     }
     return values.filter((v) => valid.has(v));
 }
-export function registerBetaCommands(program) {
-    const beta = program
+/** Register `agents setup beta` under the parent `setup` command. */
+export function registerBetaCommands(setupCmd) {
+    const beta = setupCmd
         .command('beta')
-        .description('Enable or disable preview features like factory.')
-        .addHelpText('after', `
-Examples:
-  agents beta list
-  agents beta enable factory
-  agents beta disable factory
-`);
+        .description('Enable or disable preview features like factory.');
+    setHelpSections(beta, {
+        examples: `
+      agents setup beta list
+      agents setup beta enable factory
+      agents setup beta disable factory
+    `,
+        notes: `
+      Writes the enabled set to ~/.agents/agents.yaml (beta.enabled). Top-level
+      \`agents beta\` is gone — use this group.
+    `,
+    });
     beta
         .command('list')
         .description('Show available beta features and whether they are enabled.')

package/dist/commands/commands.js

@@ -392,7 +392,7 @@ Examples:
         }
         else {
             console.log(chalk.green(`\nRemoved ${removed} command(s) from version homes.`));
-            console.log(chalk.gray('Central source unchanged. Commands will re-sync on next agent launch.'));
+            console.log(chalk.gray("Central source unchanged. Restore any target with 'agents sync <agent>@<version> --yes'."));
         }
     });
     // `commands prune` moved to the top-level `agents prune cleanup` command.

package/dist/commands/doctor.js

@@ -2,7 +2,7 @@ import { IsolationBoundaryError } from '../lib/installations/shims.js';
 import { explainIsolationBoundary } from '../lib/isolation-boundary-report.js';
 import { addHostOption } from '../lib/hosts/option.js';
 import { buildRemoteAgentsInvocation } from '../lib/hosts/remote-cmd.js';
-import { loadDevices, isControlDevice } from '../lib/devices/registry.js';
+import { loadDevices } from '../lib/devices/registry.js';
 import { fanOutDevices, planFleetTargets, remoteFleetTargets } from '../lib/devices/fleet.js';
 import { enterDoctorOverviewGate, invalidateDoctorOverviewCache, writeDoctorOverviewCache } from '../lib/devices/doctor-overview-cache.js';
 import { fleetDialTarget } from '../lib/devices/connect.js';
@@ -183,9 +183,6 @@ async function resolveFleetTargets(opts) {
         // Normalize names so zion/ZION/zion.local all match machineId() and we never
         // self-SSH the local box during fleet probes (RUSH-2114).
         .filter((d) => normalizeHost(d.name) !== localName)
-        // Control devices (a cockpit) never run agents — skip them in the fleet
-        // fan-out (an explicit --device <name> still resolves above).
-        .filter((d) => !isControlDevice(d))
         .map((d) => ({
         name: d.name,
         sshTarget: d.name,

package/dist/commands/events.d.ts

@@ -7,7 +7,7 @@
  * (per-session activity: plans, PRs, worktrees, sub-agents, artifacts). Run-dispatch
  * outcomes land here as `run.dispatched` (readable via `--include runs`).
  *
- * `agents audit` and `agents logs` are thin aliases of this command.
+ * `agents events audit` and `agents logs` are thin aliases of this command.
  *
  * Filter with sessions-style `--include` / `--exclude` families (ops, activity,
  * commands, runs, security) plus field filters (`--module`, `--event`, …).
@@ -49,7 +49,7 @@ export interface EventsOptions {
 }
 /** Add the one canonical event-reader option surface to a command or alias. */
 export declare function addEventsReadOptions(command: Command, includeAuditFlag?: boolean): Command;
-/** Canonical reader used by `agents events`, `agents audit`, and `agents logs`. */
+/** Canonical reader used by `agents events`, `agents events audit`, and `agents logs`. */
 export declare function runEventsCommand(options: EventsOptions, forceAudit?: boolean): Promise<void>;
 /** Shared by `events stats` and the `logs stats` alias. */
 export declare function runEventsStats(opts: {

package/dist/commands/events.js

@@ -7,7 +7,7 @@
  * (per-session activity: plans, PRs, worktrees, sub-agents, artifacts). Run-dispatch
  * outcomes land here as `run.dispatched` (readable via `--include runs`).
  *
- * `agents audit` and `agents logs` are thin aliases of this command.
+ * `agents events audit` and `agents logs` are thin aliases of this command.
  *
  * Filter with sessions-style `--include` / `--exclude` families (ops, activity,
  * commands, runs, security) plus field filters (`--module`, `--event`, …).
@@ -19,6 +19,7 @@ import { readUnifiedEvents } from '../lib/event-stream.js';
 import { parseFamilyList, EVENT_FAMILIES } from '../lib/event-families.js';
 import { ingestBatch } from '../lib/events-ingest.js';
 import { setHelpSections } from '../lib/help.js';
+import { registerAuditCommands } from './audit.js';
 /**
  * Resolve `--limit` into a record cap. `0` means "no cap" — without it there is
  * no way to read the whole stream, and any aggregation (group-by failure, count
@@ -215,7 +216,7 @@ export function addEventsReadOptions(command, includeAuditFlag = true) {
     }
     return command;
 }
-/** Canonical reader used by `agents events`, `agents audit`, and `agents logs`. */
+/** Canonical reader used by `agents events`, `agents events audit`, and `agents logs`. */
 export async function runEventsCommand(options, forceAudit = false) {
     if (options.follow) {
         await followLog();
@@ -356,9 +357,8 @@ Examples:
   agents events -f                       Live tail (operational)
   agents events stats
   agents events rotate --days 7
-
-  agents audit                           Alias of: events --include runs
-  agents logs                            Alias of: events`)
+  agents events audit                    Alias of: events --include runs
+  agents logs                            Run log viewer (also aliases events audit/stats/rotate)`)
         .action((_options, command) => runEventsCommand(command.optsWithGlobals()));
     // `events` both reads (its own action, above) and writes (this subcommand) —
     // the same shape as `feed` / `feed post`.
@@ -375,6 +375,7 @@ Examples:
         .option('--days <n>', 'Retention period in days (default 7)', '7')
         .option('--max-mb <n>', 'Total event storage ceiling in MiB (default 50)', '50')
         .action((opts) => runEventsRotate(opts));
+    registerAuditCommands(events);
 }
 /** Shared by `events rotate` and the `logs rotate` alias. */
 export function runEventsRotate(opts) {

package/dist/commands/exec.d.ts

@@ -15,7 +15,6 @@ export interface RunAccountPickerRequest {
 }
 /** Distinguish a terminal account-picker marker from an explicit @version pin. */
 export declare function parseRunAccountPickerRequest(agentSpec: string): RunAccountPickerRequest;
-/** Return every option whose routing semantics conflict with a local account choice. */
 /**
  * The `--device` alias family — the flags that mean "dispatch this run to another
  * machine over SSH". `--device` is canonical; `--on`/`--computer` are hidden
@@ -30,6 +29,7 @@ export declare function hostTargetGiven(options: {
     on?: string;
     computer?: string;
 }): string[];
+/** Return every option whose selection semantics conflict with an account choice. */
 export declare function runAccountPickerConflicts(options: {
     resume?: string | boolean;
     strategy?: string;

package/dist/commands/exec.js

@@ -36,7 +36,6 @@ export function parseRunAccountPickerRequest(agentSpec) {
         valid: !requested || (!!normalizedAgentSpec && !normalizedAgentSpec.includes('@')),
     };
 }
-/** Return every option whose routing semantics conflict with a local account choice. */
 /**
  * The `--device` alias family — the flags that mean "dispatch this run to another
  * machine over SSH". `--device` is canonical; `--on`/`--computer` are hidden
@@ -48,6 +47,7 @@ export function parseRunAccountPickerRequest(agentSpec) {
 export function hostTargetGiven(options) {
     return [options.host, options.device, options.on, options.computer].filter((v) => !!v);
 }
+/** Return every option whose selection semantics conflict with an account choice. */
 export function runAccountPickerConflicts(options) {
     const conflicts = [];
     if (options.resume !== undefined)
@@ -60,8 +60,6 @@ export function runAccountPickerConflicts(options) {
         conflicts.push('--lease');
     if (options.box)
         conflicts.push('--box');
-    if (hostTargetGiven(options).length)
-        conflicts.push('--device');
     return conflicts;
 }
 /** Type guard that narrows a string to a known AgentId. */
@@ -845,7 +843,7 @@ agents run auto --device yosemite-s0 "fix the flaky test"   # pin the device
             const conflicts = runAccountPickerConflicts(options);
             if (conflicts.length > 0) {
                 console.error(chalk.red(`Account selection with ${agentSpec} cannot be combined with ${conflicts.join(', ')}. ` +
-                    'Pick the account locally, or use an explicit agent@version target.'));
+                    'Remove the conflicting selector, or use an explicit agent@version target.'));
                 process.exit(1);
             }
         }
@@ -1450,6 +1448,11 @@ agents run auto --device yosemite-s0 "fix the flaky test"   # pin the device
                     process.exit(1);
                 }
                 const interactiveHost = options.interactive === true || (prompt === undefined && options.headless !== true);
+                if (accountPickerRequested && !interactiveHost) {
+                    console.error(chalk.red(`Account selection with ${agentSpec} requires an interactive host run. ` +
+                        `Use agents run ${runAgent}@ --device ${host.name} --interactive.`));
+                    process.exit(1);
+                }
                 if (interactiveHost) {
                     // Interactive host run: forward the local TTY over SSH and let the
                     // remote agent start its normal interactive UI (tmux on the host).
@@ -1496,6 +1499,7 @@ agents run auto --device yosemite-s0 "fix the flaky test"   # pin the device
                     const exitCode = await runInteractiveOnHost(host, {
                         agent: runAgent,
                         version: resumeId ? undefined : runVersion,
+                        accountPicker: accountPickerRequested,
                         strategy: resumeId ? undefined : runStrategy,
                         account: resumeId ? undefined : options.account,
                         fallback: options.fallback,

package/dist/commands/factory.d.ts

@@ -2,7 +2,7 @@
  * Software Factory CLI — submits Linear issues to a remote orchestrator.
  *
  * Requires FACTORY_FLOOR_URL pointing at a Factory-compatible endpoint.
- * Beta-gated; enable with `agents beta enable factory`.
+ * Beta-gated; enable with `agents setup beta enable factory`.
  */
 import type { Command } from 'commander';
 export declare function registerFactoryCommands(program: Command): void;

package/dist/commands/fleet-capture.d.ts

@@ -1,7 +1,7 @@
 /**
  * `agents fleet capture` (alias surface of `agents devices capture`) — snapshot
  * the live environment into the `fleet:` block of `agents.yaml` so a fresh
- * machine can reconstruct it with `agents apply`.
+ * machine can reconstruct it with `agents fleet apply`.
  *
  * Local-read + local-write, zero SSH. Records device NAMES only (never IPs or
  * usernames — those are re-resolved live from Tailscale at apply-time), plus the

package/dist/commands/fleet-capture.js

@@ -1,7 +1,7 @@
 /**
  * `agents fleet capture` (alias surface of `agents devices capture`) — snapshot
  * the live environment into the `fleet:` block of `agents.yaml` so a fresh
- * machine can reconstruct it with `agents apply`.
+ * machine can reconstruct it with `agents fleet apply`.
  *
  * Local-read + local-write, zero SSH. Records device NAMES only (never IPs or
  * usernames — those are re-resolved live from Tailscale at apply-time), plus the
@@ -12,7 +12,7 @@
 import * as fs from 'fs';
 import chalk from 'chalk';
 import * as yaml from 'yaml';
-import { loadDevices, isControlDevice } from '../lib/devices/registry.js';
+import { loadDevices } from '../lib/devices/registry.js';
 import { readMeta, updateMeta, getDevicePinsPath } from '../lib/state.js';
 import { machineId } from '../lib/machine-id.js';
 import { listBundles } from '../lib/secrets/bundles.js';
@@ -39,10 +39,9 @@ function agentsFromPins(names) {
 }
 async function runCapture(opts) {
     const meta = readMeta();
-    // Roster: registered, non-control device names only.
+    // Roster: every registered device name.
     const registry = await loadDevices();
     let names = Object.values(registry)
-        .filter((d) => !isControlDevice(d))
         .map((d) => d.name)
         .sort();
     if (opts.device) {
@@ -83,7 +82,7 @@ async function runCapture(opts) {
     console.log(chalk.green('Captured fleet profile') +
         chalk.gray(` — ${deviceCount} device(s), ${defaults.agents?.length ?? 0} agent(s), ` +
             `${inputs.secretsBundles?.length ?? 0} secret bundle(s), ${inputs.routines?.length ?? 0} routine(s).`));
-    console.log(chalk.gray('  Wrote agents.yaml → fleet:. Push it (`agents repo push`) and run `agents apply` on any machine.'));
+    console.log(chalk.gray('  Wrote agents.yaml → fleet:. Push it (`agents repo push`) and run `agents fleet apply` on any machine.'));
 }
 /** Attach `capture` to the `devices`/`fleet` command tree. */
 export function registerFleetCaptureCommand(devicesCmd) {

package/dist/commands/harness.js

@@ -17,8 +17,6 @@ import { listProfiles, readProfile, writeProfile, deleteProfile, profileExists,
 import { listPresets, getPreset } from '../lib/profiles-presets.js';
 import { AGENTS, ALL_AGENT_IDS, resolveAgentName } from '../lib/agents.js';
 import { findAccount } from '../lib/account-registry.js';
-import { keychainItemName, setKeychainToken, deleteKeychainToken } from '../lib/secrets/profiles.js';
-import { readStdinSync } from '../lib/format.js';
 import { runWizardSteps, createSteps, editSteps, defaultWizardIO, } from './harness-wizard.js';
 /** Short capability summary for a native harness — its supported run modes. */
 function nativeModes(id) {
@@ -567,7 +565,7 @@ Examples:
     cmd
         .command('remove <name>')
         .alias('rm')
-        .description('Delete a custom harness (keychain token is kept — use `harness logout <provider>` to remove).')
+        .description('Delete a custom harness (credentials stay on `agents accounts`; this only drops the named pin).')
         .action((name) => {
         const existed = deleteProfile(name);
         if (!existed) {
@@ -576,50 +574,4 @@ Examples:
         }
         console.log(chalk.green(`Harness '${name}' removed.`));
     });
-    cmd
-        .command('login <provider>')
-        .description('Store or rotate the API key for a provider (e.g., openrouter). Shared across harnesses using that provider.')
-        .option('--key-stdin', 'Read API key from stdin')
-        .action(async (provider, opts) => {
-        try {
-            const item = keychainItemName(provider);
-            let token;
-            if (opts.keyStdin) {
-                token = readStdinSync();
-                if (!token)
-                    throw new Error('No key received on stdin.');
-            }
-            else {
-                if (!isInteractiveTerminal()) {
-                    throw new Error('A secret is required but the shell is not interactive. Pipe the key via stdin (--key-stdin).');
-                }
-                const { password } = await import('@inquirer/prompts');
-                token = await password({ message: `Enter API key for ${provider}`, mask: true });
-            }
-            setKeychainToken(item, token);
-            console.log(chalk.green(`Stored in keychain: ${item}`));
-        }
-        catch (err) {
-            console.error(chalk.red(err.message));
-            process.exit(1);
-        }
-    });
-    cmd
-        .command('logout <provider>')
-        .description('Remove a stored provider key from keychain')
-        .action((provider) => {
-        try {
-            const item = keychainItemName(provider);
-            const existed = deleteKeychainToken(item);
-            if (!existed) {
-                console.error(chalk.yellow(`No keychain item '${item}' to remove.`));
-                process.exit(1);
-            }
-            console.log(chalk.green(`Removed keychain item: ${item}`));
-        }
-        catch (err) {
-            console.error(chalk.red(err.message));
-            process.exit(1);
-        }
-    });
 }

package/dist/commands/hooks.js

@@ -514,7 +514,7 @@ Examples:
         }
         else {
             console.log(chalk.green(`\nRemoved ${removed} hook(s) from version homes.`));
-            console.log(chalk.gray('Central source unchanged. Hooks will re-sync on next agent launch.'));
+            console.log(chalk.gray("Central source unchanged. Restore any target with 'agents sync <agent>@<version> --yes'."));
         }
     });
     // `hooks prune` moved to the top-level `agents prune cleanup` command.

package/dist/commands/insights.d.ts

@@ -31,7 +31,7 @@
  * the coaching prose by piping the AGGREGATE (never raw transcripts) through a headless
  * `claude -p`.
  *
- * `agents trends` is a thin deprecated alias of the mix tree only (see commands/trends.ts).
+ * Former top-level `agents trends` is `agents insights mix` / `agents insights trends`.
  */
 import type { Command } from 'commander';
 export declare function registerInsightsCommand(program: Command): void;

package/dist/commands/insights.js

@@ -31,7 +31,7 @@
  * the coaching prose by piping the AGGREGATE (never raw transcripts) through a headless
  * `claude -p`.
  *
- * `agents trends` is a thin deprecated alias of the mix tree only (see commands/trends.ts).
+ * Former top-level `agents trends` is `agents insights mix` / `agents insights trends`.
  */
 import * as fs from 'fs';
 import chalk from 'chalk';
@@ -651,7 +651,8 @@ function configureInsightsCommand(cmd) {
         \`agents insights mix\`      — cheap counters from sessions.db + usage.db
       Latency is \`agents perf\` (not mix). Quota is \`agents usage\`. Spend is
       \`agents insights cost\`; shipped output is \`agents insights output\`. Skill/slash popularity
-      is \`agents sessions stats\`. \`agents trends\` is a deprecated alias of the mix tree.
+      is \`agents sessions stats\`. Former top-level \`agents trends\` is \`agents insights mix\`
+      (also \`agents insights trends\`).
 
       The behavioural report parses in-scope transcripts once and caches facets; later runs
       re-read only files that changed. \`--refresh\` forces a full re-read.

package/dist/commands/menubar.js

@@ -8,7 +8,7 @@
  */
 import chalk from 'chalk';
 import { setHelpSections } from '../lib/help.js';
-import { enableMenubarService, disableMenubarService, getMenubarStatus, runMenubarSetup, } from '../lib/menubar/install-menubar.js';
+import { enableMenubarService, disableMenubarService, getMenubarStatus, runMenubarSetup, buildMenubarDoctorReport, } from '../lib/menubar/install-menubar.js';
 function notMac() {
     if (process.platform !== 'darwin') {
         console.log(chalk.yellow('AGI Menu is macOS only.'));
@@ -77,6 +77,32 @@ function printSetupResult(r) {
         console.log(chalk.red('AGI Menu not fully configured.') + chalk.gray('  See the failed step above.'));
     }
 }
+function printDoctorReport(r) {
+    console.log(chalk.bold('AGI Menu doctor\n'));
+    console.log(`  install path       ${r.installPath ? chalk.gray(r.installPath) : chalk.red('not installed')}`);
+    console.log(`  installed version  ${r.installedVersion ? chalk.gray(r.installedVersion) : chalk.gray('unknown')}`);
+    console.log(`  CLI version        ${chalk.gray(r.currentVersion)}${r.versionMatches ? '' : chalk.yellow('  (mismatch — `agents menubar setup` updates it)')}`);
+    const identity = r.signingIdentity === 'developer-id'
+        ? chalk.green('Developer ID (update-stable)')
+        : r.signingIdentity === 'ad-hoc'
+            ? chalk.red('ad-hoc (unstable — Accessibility grant breaks on every update)')
+            : chalk.gray('unknown (nothing installed)');
+    console.log(`  signing identity   ${identity}`);
+    console.log(`  running            ${r.running ? chalk.green('yes') : chalk.gray('no')}`);
+    if (r.staleRunningProcess.length > 0) {
+        for (const p of r.staleRunningProcess) {
+            const mark = p.stale
+                ? chalk.red('started BEFORE the on-disk bundle — running the OLD binary')
+                : chalk.green('matches the on-disk bundle');
+            console.log(`  pid ${String(p.pid).padEnd(10)} ${mark}`);
+        }
+    }
+    if (r.accessibilityHintNeeded) {
+        console.log(chalk.yellow('\n  Accessibility grant may not be trusted for the current binary.'));
+        console.log(chalk.gray('  Run `agents menubar setup` to reinstall + restart the helper, then grant access:'));
+        console.log(chalk.gray('  open "x-apple.systempreferences:com.apple.preference.security?Privacy_Accessibility"'));
+    }
+}
 export function registerMenubarCommands(program) {
     const menubar = program
         .command('menubar')
@@ -184,6 +210,37 @@ export function registerMenubarCommands(program) {
         }
         printStatus(s);
     });
+    const doctor = menubar
+        .command('doctor')
+        .description('Diagnose AGI Menu: install path, version skew, signing identity, stale process')
+        .option('--json', 'Emit machine-readable JSON')
+        .action((options) => {
+        const r = buildMenubarDoctorReport();
+        if (options.json) {
+            process.stdout.write(JSON.stringify(r) + '\n');
+            return;
+        }
+        if (r.platform !== 'darwin') {
+            console.log(chalk.yellow('AGI Menu is macOS only.'));
+            return;
+        }
+        printDoctorReport(r);
+    });
+    setHelpSections(doctor, {
+        examples: `
+      # Why did Accessibility ask again after an update?
+      agents menubar doctor
+    `,
+        notes: `
+      Read-only — never installs, restarts, or resets anything. Reports the
+      installed bundle's signing identity (ad-hoc signing breaks the
+      Accessibility grant on every update; Developer ID is stable across
+      updates) and whether a live helper pid started before the on-disk
+      bundle's last write — the sign that a running process is still the
+      binary an update just replaced. \`agents menubar setup\` is the fix for
+      anything this flags.
+    `,
+    });
     // Bare `agents menubar` -> status.
     menubar.action(() => {
         const s = getMenubarStatus();

package/dist/commands/org.d.ts

@@ -3,4 +3,9 @@ import type { Command } from 'commander';
 export declare function resolveInviteRole(raw: string | undefined): 'admin' | 'member';
 /** Validate a role argument before any network call — same rule the backend enforces server-side. */
 export declare function parseRole(raw: string): 'admin' | 'member';
+/** One-line deprecation for the leftover top-level `agents org` spelling. */
+export declare function printOrgDeprecation(): void;
+/** Canonical home: `agents auth space …`. */
+export declare function registerAuthSpaceCommand(auth: Command): void;
+/** Leftover top-level spelling — same tree, deprecation on every path. */
 export declare function registerOrgCommand(program: Command): void;

package/dist/commands/org.js

@@ -41,7 +41,7 @@ async function runList(o) {
         return;
     }
     if (!spaces.length) {
-        console.log(chalk.gray("No spaces. Create one with 'agents org create <name>'."));
+        console.log(chalk.gray("No spaces. Create one with 'agents auth space create <name>'."));
         return;
     }
     for (const space of spaces)
@@ -133,43 +133,96 @@ async function runLeave(spaceArg, o) {
     }
     console.log(chalk.green(`Left '${space.name}'.`));
 }
-export function registerOrgCommand(program) {
-    const org = program.command('org').description('Create and manage a team (a Rush "space") you can share with `agents auth login` collaborators');
-    org.command('create <name>').description('Create a space (free tier: 1 owned space)')
+/** One-line deprecation for the leftover top-level `agents org` spelling. */
+export function printOrgDeprecation() {
+    console.error(chalk.yellow('agents org is deprecated — use `agents auth space`.'));
+}
+/** Shared space CRUD tree — canonical under `auth space`, leftover under `org`. */
+function attachSpaceCommands(parent, opts) {
+    const before = () => {
+        if (opts.deprecated)
+            printOrgDeprecation();
+    };
+    const jsonFlag = (o, command) => !!(o.json || command.optsWithGlobals().json);
+    parent.command('create <name>').description('Create a space (free tier: 1 owned space)')
         .option('--slug <slug>', 'Override the derived slug')
         .option('--description <text>', 'Optional description')
         .option('--json', 'Machine-readable output')
-        .action((name, o, command) => { const json = !!(o.json || command.optsWithGlobals().json); return runOrDie(() => runCreate(name, { ...o, json }), { json }); });
-    org.command('list').description('List spaces you own or belong to').option('--json', 'Machine-readable output')
-        .action((o, command) => { const json = !!(o.json || command.optsWithGlobals().json); return runOrDie(() => runList({ json }), { json }); });
-    org.command('view [space]').description('Show one space (defaults to your only space)').option('--json', 'Machine-readable output')
-        .action((space, o, command) => { const json = !!(o.json || command.optsWithGlobals().json); return runOrDie(() => runView(space, { json }), { json }); });
-    org.command('invite <email>').description('Invite (or directly add) a member')
+        .action((name, o, command) => {
+        before();
+        const json = jsonFlag(o, command);
+        return runOrDie(() => runCreate(name, { ...o, json }), { json });
+    });
+    parent.command('list').description('List spaces you own or belong to').option('--json', 'Machine-readable output')
+        .action((o, command) => {
+        before();
+        const json = jsonFlag(o, command);
+        return runOrDie(() => runList({ json }), { json });
+    });
+    parent.command('view [space]').description('Show one space (defaults to your only space)').option('--json', 'Machine-readable output')
+        .action((space, o, command) => {
+        before();
+        const json = jsonFlag(o, command);
+        return runOrDie(() => runView(space, { json }), { json });
+    });
+    parent.command('invite <email>').description('Invite (or directly add) a member')
         .option('--role <role>', 'admin | member', 'member')
         .option('--space <id-or-slug>', 'Space to invite into (defaults to your only space)')
         .option('--json', 'Machine-readable output')
-        .action((email, o, command) => { const json = !!(o.json || command.optsWithGlobals().json); return runOrDie(() => runInvite(email, { ...o, json }), { json }); });
-    org.command('members [space]').description('List a space\'s members').option('--json', 'Machine-readable output')
-        .action((space, o, command) => { const json = !!(o.json || command.optsWithGlobals().json); return runOrDie(() => runMembers(space, { json }), { json }); });
-    org.command('role <email> <role>').description('Change a member\'s role (owner-only for admin)')
+        .action((email, o, command) => {
+        before();
+        const json = jsonFlag(o, command);
+        return runOrDie(() => runInvite(email, { ...o, json }), { json });
+    });
+    parent.command('members [space]').description("List a space's members").option('--json', 'Machine-readable output')
+        .action((space, o, command) => {
+        before();
+        const json = jsonFlag(o, command);
+        return runOrDie(() => runMembers(space, { json }), { json });
+    });
+    parent.command('role <email> <role>').description("Change a member's role (owner-only for admin)")
         .option('--space <id-or-slug>', 'Space to change (defaults to your only space)')
         .option('--json', 'Machine-readable output')
-        .action((email, role, o, command) => { const json = !!(o.json || command.optsWithGlobals().json); return runOrDie(() => runRole(email, role, { ...o, json }), { json }); });
-    org.command('remove <email>').description('Remove a member from a space')
+        .action((email, role, o, command) => {
+        before();
+        const json = jsonFlag(o, command);
+        return runOrDie(() => runRole(email, role, { ...o, json }), { json });
+    });
+    parent.command('remove <email>').description('Remove a member from a space')
         .option('--space <id-or-slug>', 'Space to remove from (defaults to your only space)')
         .option('--json', 'Machine-readable output')
-        .action((email, o, command) => { const json = !!(o.json || command.optsWithGlobals().json); return runOrDie(() => runRemove(email, { ...o, json }), { json }); });
-    org.command('leave [space]').description('Leave a space you do not own').option('--json', 'Machine-readable output')
-        .action((space, o, command) => { const json = !!(o.json || command.optsWithGlobals().json); return runOrDie(() => runLeave(space, { json }), { json }); });
-    setHelpSections(org, {
-        examples: `agents org create acme-team
-agents org list
-agents org view acme-team
-agents org invite dev@example.com --role admin
-agents org members
-agents org role dev@example.com admin
-agents org remove dev@example.com
-agents org leave acme-team`,
-        notes: 'Maps to the Rush backend\'s /api/v1/spaces (the free-tier team primitive), not /api/v1/orgs. Free tier: 1 owned space, 3 members per space. Every command needs `agents auth login` (or a `rush login` session) first. `--space` is only needed once you belong to more than one space.',
+        .action((email, o, command) => {
+        before();
+        const json = jsonFlag(o, command);
+        return runOrDie(() => runRemove(email, { ...o, json }), { json });
+    });
+    parent.command('leave [space]').description('Leave a space you do not own').option('--json', 'Machine-readable output')
+        .action((space, o, command) => {
+        before();
+        const json = jsonFlag(o, command);
+        return runOrDie(() => runLeave(space, { json }), { json });
+    });
+    setHelpSections(parent, {
+        examples: `${opts.prefix} create acme-team
+${opts.prefix} list
+${opts.prefix} view acme-team
+${opts.prefix} invite dev@example.com --role admin
+${opts.prefix} members
+${opts.prefix} role dev@example.com admin
+${opts.prefix} remove dev@example.com
+${opts.prefix} leave acme-team`,
+        notes: opts.deprecated
+            ? 'Deprecated alias of `agents auth space`. Maps to the Rush backend\'s /api/v1/spaces (the free-tier team primitive), not /api/v1/orgs. Free tier: 1 owned space, 3 members per space. Every command needs `agents auth login` (or a `rush login` session) first. `--space` is only needed once you belong to more than one space.'
+            : 'Maps to the Rush backend\'s /api/v1/spaces (the free-tier team primitive), not /api/v1/orgs. Free tier: 1 owned space, 3 members per space. Every command needs `agents auth login` (or a `rush login` session) first. `--space` is only needed once you belong to more than one space. The leftover `agents org` spelling still works and prints a deprecation line.',
     });
 }
+/** Canonical home: `agents auth space …`. */
+export function registerAuthSpaceCommand(auth) {
+    const space = auth.command('space').description('Create and manage a Prix space (invite collaborators)');
+    attachSpaceCommands(space, { prefix: 'agents auth space' });
+}
+/** Leftover top-level spelling — same tree, deprecation on every path. */
+export function registerOrgCommand(program) {
+    const org = program.command('org').description('Deprecated alias of `agents auth space` — create and manage a Prix space');
+    attachSpaceCommands(org, { prefix: 'agents org', deprecated: true });
+}

package/dist/commands/output.js

@@ -10,7 +10,7 @@ import { formatUsd, PRICING_VERSION } from '../lib/pricing/index.js';
 import { formatDuration } from '../lib/session/render.js';
 import { terminalWidth, truncateToWidth, padToWidth } from '../lib/session/width.js';
 import { collectGitOutput } from '../lib/output/git-output.js';
-import { loadDevices, isControlDevice } from '../lib/devices/registry.js';
+import { loadDevices } from '../lib/devices/registry.js';
 import { machineId } from '../lib/session/sync/config.js';
 import { stripClixml } from '../lib/hosts/remote-cmd.js';
 const execFileAsync = promisify(execFile);
@@ -189,7 +189,7 @@ async function outputAction(options) {
     const self = machineId();
     const registry = await loadDevices();
     const remotes = Object.values(registry)
-        .filter(d => d.tailscale?.online && d.name !== self && !isControlDevice(d))
+        .filter(d => d.tailscale?.online && d.name !== self)
         .map(d => d.name);
     if (!options.json)
         console.error(chalk.gray(`Folding in ${remotes.length} online device${remotes.length !== 1 ? 's' : ''}…`));

package/dist/commands/prune.js

@@ -12,10 +12,11 @@
  *     agents-cli.
  *   - Runs: routine execution logs, keeping only the last N per job.
  *
- * Sync (additive: copy missing/changed files into version homes) is no longer
- * a user-facing verb — `syncResourcesToVersion` runs at agent launch and
- * applies adds/updates automatically. Pruning, however, is destructive, so it
- * stays explicit.
+ * Sync (additive: copy missing/changed files into version homes) is the job
+ * of `agents sync` / `agents refresh` — the shim's launch hook
+ * (`agents sync --launch`) is project-scoped only and deliberately skips
+ * version-home reconciliation. Pruning, however, is destructive, so it stays
+ * explicit.
  *
  * Default scope: each agent's currently-pinned default version for orphan
  * cleanup, plus the standard cross-agent version-dedup pass. Pass `--all`