@phnx-labs/agents-cli 1.22.43 → 1.22.45

package/CHANGELOG.md

@@ -1,5 +1,90 @@
 # Changelog
 
+## 1.22.45
+
+- **BREAKING: the Prix-coupled account layer is removed — `agents auth`, `agents org`, and the plan-tier gates (RUSH-2581).** 1.22.42 shipped `agents auth login/whoami/logout` and `agents org` against the Rush product's backend (`api.prix.dev`), with `entitlement.ts` reading the Rush billing tier to cap accounts at 3-per-harness on free and to gate the `agents insights` friction sections. agents-cli's identity must not ride a separate product's login and database, so all of it is removed: `auth` and `org` are retired top-level names (they fail loudly, no auto-correct), account registration is uncapped again, `agents accounts` output drops the `dormant` field/suffix, and `agents insights` renders the full report with no `plan`/`notice` JSON fields. The Rush *feature* integrations are untouched (`cloud/rush.ts` dispatch, the opt-in secrets sync driver, the owner-notify transport). The replacement — agents-cli's own account backend with Phoenix branding, built for later Phoenix-ID consolidation — is tracked in RUSH-2581. Source: `apps/cli/src/lib/{prix-account,entitlement}.ts` (deleted), `apps/cli/src/commands/{auth,org}.ts` (deleted), `apps/cli/src/commands/{accounts,insights}.ts`, `apps/cli/src/{bootstrap.ts,cli/command-registry.ts,lib/startup/command-registry.ts}`.
+
+- **The menubar prepack gate fails closed off-Mac when the bundle has no stapled notarization ticket (RUSH-3026).** 1.22.44 was packed on a Linux box where the gate's codesign/xcrun checks silently no-op'd, so an un-stapled dev bundle shipped and Gatekeeper rejected it on every Mac ("not notarized/valid; skipping launch") — the menu bar died until a rollback to 1.22.43. `stapler staple` writes the ticket as a plain file (`Contents/CodeResources`), so its absence is provable anywhere: the gate now hard-fails the pack when it is missing and no xcrun is available, turning that failure into a pack error instead of a shipped regression. Source: `apps/cli/scripts/verify-menubar-helper.sh`.
+
+- **A Linux box can now produce the pretested release tarball — the attestation producer seeds the already-signed helper apps (RUSH-3026).** `release-attestation-produce.sh` runs in a fresh worktree whose `bin/` is empty (the signed `.app` helpers are untracked), so on any non-Mac box `npm pack` died at the prepack gates and attestation production — and therefore every release — stayed chained to a Mac. Off a macOS signing box the producer now seeds `bin/Agents CLI.app` and `bin/MenubarHelper.app` copy-if-absent from the caller checkout; the prepack gates still verify them (keychain sha pin, menubar presence), so a wrong or tampered seed fails the pack exactly as before. A Darwin producer's freshly signed apps are never overwritten. Source: `apps/cli/scripts/release-attestation-produce.sh`.
+
+## 1.22.44
+
+- **Browser domain-skill discovery is layer-aware (RUSH-2497).** `agents browser start --url <url>` auto-loads a site-specific SKILL.md, but the lookup only ever searched the user layer (`~/.agents/skills/browser/domain-skills`), so a skill shipped in the system layer (`~/.agents/.system/skills/browser/domain-skills`) — or a project's `.agents/` — was silently invisible: the browser just opened without the guide. `resolveDomainSkill` now searches project > user > system > extra repos, first layer with a match wins, mirroring `resolveResource` precedence; `$AGENTS_BROWSER_DOMAIN_SKILLS_DIR` stays a single-root override for tests. The project layer resolves from the calling process's cwd — the shared browser daemon does not yet receive the CLI caller's cwd over IPC, so there the project layer follows the daemon's own cwd until RUSH-2996 threads it through. A miss still never breaks browser start, but now logs the roots searched at debug level (`AGENTS_DEBUG`/`DEBUG`) — the total silence is what hid this. Source: `apps/cli/src/lib/browser/domain-skills.ts`.
+
+- **`agents artifacts share list/update/delete` (and the `unshare` alias) had a silently-dropped `--json`/`--github-user` (RUSH-2687).** Commander resolves an option's long name against the WHOLE ancestor chain, not per-command — `share <file>` (the parent) already declares `--json`/`--github-user` for its own publish-time use, so the same-named flag on `list`/`update`/`delete` was swallowed at parse time even when passed alone (`--help` still showed it registered, which made it easy to miss). `agents artifacts share list --json | jq …`, the exact example in `docs/share.md`, never emitted JSON. Fixed by renaming the colliding options — `--list-json`/`--for-user` (list), `--update-json` (update), `--delete-json`/`--for-user` (delete/unshare) — matching the precedent `share revisions` already set (`--revisions-json`/`--for-user`, RUSH-2683). A CLI-wide `enablePositionalOptions()` fix was evaluated and reverted: commander copies that setting onto every command created via `.command()`, so enabling it on the root program broke `sessions backfill tools/resources --since … --json …`, which relies on a parent command's options staying visible to leaf subcommands via `optsWithGlobals()`. Source: `apps/cli/src/commands/share.ts`, `apps/cli/src/lib/startup/root-command.ts`.
+
+- **`agents artifacts share` publishes with a partial `share:` config (RUSH-2837).** `status` and publish both used to treat a missing/empty `accountId` as "not set up", even when `baseUrl` and `WRITE_TOKEN` were present — so a fleet rewrite that blanked `accountId` (or a partial `writeMeta` that dropped `share:`) silently killed PR evidence uploads. Publish now requires only `baseUrl` + the write token; `status` reports the endpoint and names an empty account id instead of pretending nothing is configured; `writeShareConfig` will not persist `accountId: ""` over a stored id; `serializeCentral` no longer deletes `share:` just because a write omitted the key. Source: `apps/cli/src/lib/share/config.ts`, `apps/cli/src/lib/state.ts`, `apps/cli/src/commands/share.ts`.
+
+- **Pick a device-local account after fleet placement (RUSH-2961).** `agents run <harness>@` now composes with `--device <name|auto>`: the device resolves first, then the interactive picker lists that peer's installed versions/accounts and pins the selection for this run. Automatic picker placement prefers a ready account, retains signed-out/revoked login targets, and excludes devices whose picker would contain only rate-limited or out-of-credit rows. `agents view --json` exposes each version's cached `authVerdict` so remote and local placement apply the same revoked-token gate. Source: `apps/cli/src/commands/{exec,view}.ts`, `apps/cli/src/lib/{smart-launch,hosts/dispatch,hosts/ready}.ts`.
+
+- **BREAKING: nest `agents beta` under `agents setup beta`; retire top-level `agents apply`; drop `harness login`/`logout` (RUSH-2981).** Enabling a preview feature is setup, not its own noun — `agents setup beta list/enable/disable` keep the same `~/.agents/agents.yaml` `beta.enabled` write path. Fleet reconcile is already `agents fleet apply` / `agents devices apply`; top-level `apply` is gone (unknown command, retired from distance-1 auto-correct). Harness credentials live on `agents accounts` — `harness login`/`logout` are removed. Does not touch org/auth/trends/audit/unshare (sibling session 01a02234). Source: `apps/cli/src/commands/{beta,setup,apply,harness}.ts`, `apps/cli/src/lib/startup/command-registry.ts`.
+
+- **Nest leftover top-level aliases; keep `agents org` as a deprecated spelling (RUSH-2989).**
+  `agents unshare` moves under `agents artifacts unshare` (same takedown as
+  `artifacts share delete`; the top-level name is retired). `agents audit` moves
+  under `agents events audit` (still `events --include runs`, plus `verify` for
+  the legacy hash-chain). Former top-level `agents trends` is `agents insights mix`
+  (also `agents insights trends`). `agents org` still works and prints a deprecation
+  line; the canonical tree is `agents auth space`. Prix login stays off
+  `agents accounts` (that noun is harness keys). Source:
+  `apps/cli/src/commands/{auth,org,artifacts,share,events,audit,insights}.ts`,
+  `apps/cli/src/lib/analytics/mix-commands.ts`.
+
+- **`agents view` shows Claude usage again — the daemon auth-health probe no longer hammers `/oauth/usage` into a permanent 429 (RUSH-2998).** The daemon's fleet auth-health probe (`probeLocalFleetAuth` → `probeClaudeStatus`) hit the rate-limited `/api/oauth/usage` endpoint every ~3 minutes on **every** device. Across the fleet that drove one per-account request quota to a persistent `429`; the shared `Retry-After` backoff then parked usage fleet-wide and the usage cache froze (windows stale-zeroed → `agents view` rendered `S: 0% (now) W: 0% (now)` for weeks). The periodic tick now re-probes the endpoint at most every 20 minutes (`AUTH_PROBE_MAX_AGE_MS`) and reuses the last real verdict in between — a ~5x cut in endpoint traffic. Fleet status still publishes every tick (it does not ride that endpoint), and every device keeps a **real** auth verdict, so `agents devices ping --strict` and the run auth-preflight keep detecting revocation on every host. `agents devices ping` forces a genuinely live probe (never the throttled cached verdict). Source: `apps/cli/src/lib/daemon-ticks.ts` (`AUTH_PROBE_MAX_AGE_MS`, `isCachedFleetAuthProbeFresh`, `refreshLocalFleetAuthState` `force`), `apps/cli/src/commands/ssh.ts` (`runFleetPing`).
+
+- **BREAKING: remove `agents serve`, its `--control` anchor, and `agents devices pair-ios` (RUSH-3001).**
+  The read-only local web companion (`agents serve`) duplicated what `agents sessions`,
+  `agents teams status`, and the AGI EXT Fleet panel already show, and its `--control`
+  mode existed only to anchor the unshipped iOS Fleet Cockpit prototype (`apps/ios`,
+  untouched since 2026-07-16, no Xcode project) — both are gone, and so is the prototype
+  itself. `agents devices pair-ios` (the only writer of the device registry's `control`
+  role) is removed with it; with no writer left, the `control`-only dial-exclusion
+  filters (`isControlDevice`) are removed too, across `doctor`, `apply`, `fleet status`,
+  `fleet-capture`, `smart-launch`, the devices host provider, session fan-out, and
+  remote login detection. `agents serve` now reports `unknown command` and is retired
+  from distance-1 auto-correct; `agents devices pair-ios` is rejected by `devices` as an
+  unexpected argument.
+  **Migration —** if you previously ran `agents devices pair-ios`, that phone or tablet is
+  still in your device registry with `role: control`, and the key is now ignored rather
+  than honoured: it becomes an ordinary fleet target. `agents fleet status`,
+  `agents fleet update/run`, `agents apply`, `agents doctor --check --devices`,
+  `agents insights output --all-hosts`, and any `--device all` passthrough will dial it and
+  wait out a ConnectTimeout; `agents hosts list` shows it as dispatchable; `--device auto`
+  can place an agent on it when no device is marked `worker`; and routine fleet placement
+  can schedule a recurring job onto it, since an `unknown`-platform device sorts ahead of a
+  real worker alphabetically. Failures are loud, not silent. Remove it with
+  `agents devices rm <name>`; the stale `role` key is dropped anyway on that device's next
+  `agents devices sync`. Session fan-out is unaffected — it still gates on a
+  `windows`/`linux`/`macos` platform.
+  Source: `apps/cli/src/commands/{serve,ssh}.ts`,
+  `apps/cli/src/lib/devices/{registry,fleet,pool,discovery-policy}.ts`,
+  `apps/cli/src/lib/{smart-launch,remote-agents-json,device-config}.ts`,
+  `apps/cli/src/lib/hosts/{registry,providers/devices}.ts`,
+  `apps/cli/src/lib/session/{watch,remote-list}.ts`, `apps/cli/src/lib/fleet/remote-login.ts`,
+  `apps/cli/src/cli/command-registry.ts`, `apps/cli/src/lib/startup/command-registry.ts`.
+
+- **Menu-bar helper restarts after a bundle swap; one-time TCC migration; `agents menubar doctor` (RUSH-3019).** `installMenubarLaunchAgentOnUpgrade()` swapped the installed bundle on an upgrade but never restarted the running helper — verified live: a helper pid started 21:44:16 kept running while the bundle under it was replaced at 21:53:46, so it kept requesting Accessibility under the OLD code identity and the grant never stuck. The heal now kickstarts the launchd job (`launchctl kickstart -k`) after a real content swap (a version bump or the ad-hoc -> Developer ID transition — a plist-only interpreter repoint, RUSH-3005's churn, does not trigger this) and falls back to ending the specific pid(s) still running the old binary when `kickstart -k` can't reach the GUI launchd domain from a non-Aqua shell context, so launchd's `KeepAlive` relaunches from the swapped binary. Separately, a machine that transitioned ad-hoc -> Developer ID (6fa36f73a) now gets a one-time `tccutil reset Accessibility com.phnx-labs.agents-menubar` to clear the dead grant recorded against the old identity, stamped so it never re-runs. The "Paste needs Accessibility" notification now opens System Settings' Accessibility pane on click and names the actual running bundle path. New read-only `agents menubar doctor` reports install path, installed vs CLI version, signing identity stability, and whether a live helper pid predates the on-disk bundle (the stale-process bug this fixes). Source: `apps/cli/src/lib/menubar/install-menubar.ts`, `apps/cli/src/commands/menubar.ts`, `apps/cli/menubar/Sources/MenubarHelper/Clip.swift`.
+
+- **Daemon autostart no longer fires under a redirected (sandbox/test) HOME (RUSH-3021).** #2860 gated service-manager registration on `isolatedHomeSuffix()` but left `ensureDaemonStarted()`'s detached spawn ungated, so a test-spawned CLI could fork a daemon into the test's temp HOME; the child outlived the test and raced its recursive teardown `rm` (the `ENOTEMPTY` flake that cost most full-suite attestation rolls on shared boxes). The launch path now refuses under a redirected HOME via the same `serviceManagerRegistrationAllowed()` signal and `AGENTS_SERVICE_MANAGER_ALLOW_REDIRECTED_HOME` test seam; reporting an already-running daemon is untouched, and `agents daemon start` remains the operator override. Source: `apps/cli/src/lib/daemon/daemon.ts` (`ensureDaemonStarted`), regression test in `apps/cli/src/lib/daemon/daemon.registry.test.ts`.
+
+- **The npm tarball no longer bundles the version-stamped signed CLI binary — releases publish from any OS (RUSH-3026).** `dist/bin/agents` (the Developer-ID-signed arm64 Mach-O, #315) embedded the release version, so every release forced a fresh Mac build + sign even when nothing native changed — chaining publishing to a single provisioned Mac (`mac-mini`), whose downtime stranded merged fixes unshippable. The binary is dropped from `package.json` `files` and the `prepack` gates; `postinstall`'s existing run-probe falls back to the JS entrypoint when the binary is absent, so macOS installs keep working (it returns as a per-release GitHub asset in a follow-up). `release.sh`'s home-base phase — already promote-only (download attested tarball, verify, install-smoke, `npm publish`) — drops its vestigial macOS gate, and a new `assert_promote_home_base` preflight (npm token + gh auth, via `scripts/promote-home-base-probe.sh`) runs BEFORE the release's first mutation, fixing the tagged-but-unpublished failure shape: the old signing preflight was defined but never invoked. The two `.app` helpers (keychain, menubar) remain bundled and manifest-reused — unchanged helpers are never rebuilt. Source: `apps/cli/package.json`, `apps/cli/scripts/release.sh`, `apps/cli/scripts/promote-home-base-probe.sh`.
+
+- **`agents sync` restores a resource deleted from a version home — no `--force` needed (#2398, #2397).** The staleness fast-guard decided sync-ness from source fingerprints alone, so a managed artifact deleted from the version home (a subagent, command, skill, hook, MCP config, or rules file) read as "Already in sync" and only `--force` restored it. The sync manifest now records the artifact paths the last full sync wrote (`writtenTargets`, reported by each resource writer), and `isStale` treats a missing path as stale — one `existsSync` per path, no content reads, so the fast-guard budget holds. A manifest written by an older agents-cli lacks the field and reads as stale once; that full sync establishes the baseline. Relatedly, four commands (`agents commands/skills/hooks/subagents remove`) claimed a removed resource "will re-sync on next agent launch" — the shim's launch hook (`agents sync --launch`) is project-scoped only and deliberately skips version-home reconciliation, so the messages now name the real recovery: `agents sync <agent>@<version> --yes`. `agents doctor --fix` was already immune (it heals from the live-home diff, not the manifest). Source: `apps/cli/src/lib/staleness/{index,types}.ts`, `apps/cli/src/lib/staleness/writers/{types,commands,skills,hooks,mcp,subagents,rules}.ts`, `apps/cli/src/lib/installations/versions.ts`, `apps/cli/src/commands/{commands,skills,hooks,subagents,prune}.ts`.
+
+- **`agents devices list` no longer serves fossilized load/mem numbers (#2666).** The
+  fleet stats cache (`.fleet-stats.json`) had no age bound and — since RUSH-2061
+  removed the daemon's N² fleet warm — no background writer, so the load/mem columns
+  froze at the last manual `--refresh` and re-rendered as current fleet state
+  indefinitely (observed: a 9-day-old row reporting an idle Mac at 1058% load). Cached
+  rows are now bounded by `STATS_STALE_MS` (3 minutes, the same window as the
+  agent-count mirror): a row past the bound is treated like a missing one — re-probed
+  live this call and rewritten — so the default `devices list` / `devices status` read
+  is itself the cache's writer and a stale value can never be presented as current.
+  This cache feeds the fleet scheduler, `--device auto` affinity, and the
+  session-start fleet banner. Source: `apps/cli/src/lib/devices/stats-cache.ts`,
+  `apps/cli/src/commands/ssh.ts`.
+
 ## 1.22.43
 
 - **Rush Cloud no longer has a helper that reads the interactive Claude login (RUSH-2359 / incident #1767).** Dispatch already sends an email-only account manifest (SING-1b) and never uploaded a token; the leftover `readClaudeCredentialsBlob` still read Keychain / `.credentials.json` — the exact shape that captured a `claude setup-token` TTY banner as an Authorization header. That helper is deleted. `--lease` SING-1b detection now reads the wrapped rotating blob itself and ignores anything that is not `{ claudeAiOauth.accessToken }`. Source: `apps/cli/src/lib/cloud/rush.ts`, `apps/cli/src/lib/crabbox/runtimes.ts`.

package/README.md

@@ -188,6 +188,8 @@ agents run claude "summarize recent commits" --strategy balanced
 # Or choose one account/version interactively for only this run.
 agents run claude@
 agents run codex@ "review this branch"
+agents run claude@ --device auto        # pick the device, then choose there
+agents run claude@ --device yosemite-s0 # choose from one device's accounts
 ```
 
 `--strategy balanced` spreads work across available versions of the same agent -- useful when you have multiple accounts and want to avoid burning through one. When a Claude run reports a session limit, agents-cli records the stated reset time, shows `session-limited` in `agents view`, and excludes that account until the reset. When every account is rate-limited, the run exits nonzero naming each excluded account and the earliest window reset (use `--strategy pinned` to force the default) -- it never launches into an exhausted account.
@@ -205,7 +207,7 @@ agents run auto --device yosemite-s0 "fix the flaky test"   # pin the host layer
 
 A trailing `@` opens an account picker before either an interactive or prompt-based run. Each installed version shows its account identity, exact version, login state, plan, and every available session, weekly, or monthly limit. Logged-out, rate-limited, and out-of-credit accounts remain visible with the reason they cannot be selected; signed-in accounts whose provider does not expose quota data stay selectable and say `limits unavailable`. The choice pins only that run and does not change your default version.
 
-Account selection is available for Claude, Codex, Gemini, Cursor, Antigravity, Grok, Kimi, Droid, and OpenCode. It requires a terminal and cannot be combined with `--resume`, `--strategy`/`--balanced`, `--lease`, or `--device`; profiles and workflows must use their concrete host agent instead.
+Account selection is available for Claude, Codex, Gemini, Cursor, Antigravity, Grok, Kimi, Droid, and OpenCode. It requires a terminal and cannot be combined with `--resume`, `--strategy`/`--balanced`, `--lease`, or a warm-box lease. Device routing is resolved first, then the picker is populated from the selected device. Profiles and workflows must use their concrete host agent instead.
 
 ### Chain agents
 
@@ -454,7 +456,7 @@ A stalled session whose tail shows a hard account limit ("You've hit your weekly
 ## Sync the fleet
 
 <p align="center">
-  <img src="assets/fleet-sync.svg" alt="agents apply: reconcile every device to one profile from agents.yaml — install missing agents and sync config. Native logins stay on the machine that minted them." width="100%" />
+  <img src="assets/fleet-sync.svg" alt="agents fleet apply: reconcile every device to one profile from agents.yaml — install missing agents and sync config. Native logins stay on the machine that minted them." width="100%" />
 </p>
 
 
@@ -471,14 +473,14 @@ fleet:
 ```
 
 ```bash
-agents apply --plan                 # device x dimension matrix; changes nothing
-agents apply                        # reconcile the fleet (confirms first; -y to skip)
-agents apply --device yosemite-s0   # scope to one device
-agents apply --only agents,config   # limit dimensions (agents, config, login)
-agents apply --no-login             # skip login propagation
+agents fleet apply --plan                 # device x dimension matrix; changes nothing
+agents fleet apply                        # reconcile the fleet (confirms first; -y to skip)
+agents fleet apply --device yosemite-s0   # scope to one device
+agents fleet apply --only agents,config   # limit dimensions (agents, config, login)
+agents fleet apply --no-login             # skip login propagation
 ```
 
-`agents apply` (`ag apply`) probes every target over the existing SSH transport, then reconciles it to the profile: installs missing agents, upgrades `agi-cli`, syncs the named config scopes, and **propagates logins** so a host signed in once seeds the fleet -- turning "6 hosts x 8 harnesses = 48 OAuth flows" into one. Portable credential files (claude, codex, grok, kimi, opencode, droid, antigravity) stream to each target over encrypted SSH stdin, never shell-interpolated, and land at `0600`. **Honest boundary:** macOS keychain-bound tokens (claude, antigravity on a Mac target) can't be extracted -- those surface as a one-time manual login, never faked. `--plan` / `--dry-run` shows the full matrix without touching anything.
+`agents fleet apply` probes every target over the existing SSH transport, then reconciles it to the profile: installs missing agents, upgrades `agi-cli`, syncs the named config scopes, and **propagates logins** so a host signed in once seeds the fleet -- turning "6 hosts x 8 harnesses = 48 OAuth flows" into one. Portable credential files (claude, codex, grok, kimi, opencode, droid, antigravity) stream to each target over encrypted SSH stdin, never shell-interpolated, and land at `0600`. **Honest boundary:** macOS keychain-bound tokens (claude, antigravity on a Mac target) can't be extracted -- those surface as a one-time manual login, never faked. `--plan` / `--dry-run` shows the full matrix without touching anything.
 
 See [docs/fleet.md](apps/cli/docs/fleet.md) for the manifest schema and reconcile semantics.
 
@@ -670,7 +672,7 @@ age (`updated 2m ago — pass --refresh (--live) for a live probe`).
 `agents fleet status` answers "is my fleet OK?" at a glance: a one-line rollup
 (`● N online · ○ M offline`), a short **NEEDS ATTENTION** list where every item names
 the command that fixes it (offline → `check the box`, config drift or a stark CLI gap →
-`agents apply <box>`, version skew → `agents upgrade --fleet`), then quiet per-device
+`agents fleet apply --device <box>`, version skew → `agents upgrade --fleet`), then quiet per-device
 rows grouped by OS (macOS / Linux / Windows) showing just `name · capacity · load/mem ·
 version`, with this machine flagged `▸ … ← this machine`. A healthy fleet reads in a few
 lines; orphaned versions are demoted to a one-line `agents prune` nudge in the footer.
@@ -1203,7 +1205,7 @@ agents artifacts share plan.html --json                     # URL object for pla
 agents artifacts share list --agent claude                  # everything published, filterable
 agents artifacts share revisions fleet                      # prior versions kept under a slug
 agents artifacts share status                               # show the endpoint
-agents unshare fleet                                        # take a published link (+ its OG cover) down
+agents artifacts unshare fleet                              # take a published link (+ its OG cover) down
 ```
 
 `agents artifacts share` closes the loop: an agent makes work (a plan, a viz, a report),
@@ -1232,7 +1234,7 @@ Republishing an existing slug keeps the prior version as a revision by default
 (`--no-revision` to skip); `agents artifacts share revisions <slug>` shows the retained
 history, newest first.
 
-`agents artifacts share delete <targets...>` (alias `agents unshare`) takes a page down — pass a
+`agents artifacts share delete <targets...>` (alias `agents artifacts unshare`) takes a page down — pass a
 full URL, `<user>/<slug>`, or a bare slug (resolved against your own namespace); several
 targets at once are fine. It also deletes the sibling `<slug>.png` OG cover by default
 (`--keep-cover` opts out) and verifies the page actually 404s before reporting success —
@@ -1505,7 +1507,7 @@ For full transparency: `agi-cli` keeps a local event log at `~/.agents/.cache/lo
 
 macOS and Linux. Windows via WSL works but isn't first-class yet.
 
-**macOS-only features:** Keychain-based secrets (`agents secrets`, `agents harness login`) require macOS. Default iCloud sync for bundles requires macOS + iCloud Keychain enabled; use `--no-icloud-sync` for device-local bundles. On Linux, use environment variables or `.env` files for API keys. Native Linux credential store support is planned.
+**macOS-only features:** Keychain-based secrets (`agents secrets`, `agents accounts add`) require macOS. Default iCloud sync for bundles requires macOS + iCloud Keychain enabled; use `--no-icloud-sync` for device-local bundles. On Linux, use environment variables or `.env` files for API keys. Native Linux credential store support is planned.
 
 Interactive tmux-backed runs require tmux 3.2 or newer.
 

package/dist/bootstrap.js

@@ -211,7 +211,7 @@ Install, configure, run, and dispatch AI coding agents from one place.
 Works with Claude, Codex, Antigravity, Cursor, OpenCode, OpenClaw, and Droid.
 
 Quick start:
-  agents setup                    First-time setup (interactive)
+  agents setup                    First-time setup (interactive); setup beta enables preview features
   agents view                     See what's installed
   agents run <agent> ["prompt"]   Run an agent (interactive without prompt, headless with)
   agents sessions                 Browse past sessions across all agents
@@ -260,11 +260,11 @@ Observe (read the fleet — no store merge):
   feed                            Needs-you inbox (open blocks waiting on you); agent posts = feed --filter updates
   sessions --active               Live agents (who is running right now)
   events                          Unified ops + activity event trail
-  audit                           Tamper-evident run-dispatch log (not events)
+  events audit                    Dispatched-run outcomes (alias of events --include runs)
   sync status                     Sync/drift only (not the live fleet snapshot)
   devices snapshot                One-process inventory + active sessions poll
 
-Credentials:
+Credentials (harness keys):
   harness                         Custom (host CLI + model + auth) harnesses; replaces former profiles command
   secrets                         Keychain-backed env bundles; synced vault: secrets vault unlock|lock
   accounts                        Provider credentials + native OAuth logout
@@ -281,9 +281,6 @@ Config sync:
   repo init --path <dir>          Scaffold your own editable repo from a template
   repo add <path|gh:user/repo>    Merge an extra repo after the system repo
 
-Beta features:
-  beta                            Enable preview features (factory and more)
-
 Automation tips:
   Pass explicit names/IDs         Avoid pickers: agents sessions <id> --markdown
   Use --yes for defaults          Auto-accept sync/default prompts on add/use/pull

package/dist/cli/command-registry.d.ts

@@ -56,19 +56,16 @@ export declare const loadPrune: ModuleLoader;
 export declare const loadTrash: ModuleLoader;
 export declare const loadRestore: ModuleLoader;
 export declare const loadDoctor: ModuleLoader;
-export declare const loadApply: ModuleLoader;
 export declare const loadRoute: ModuleLoader;
 export declare const loadHarness: ModuleLoader;
 export declare const loadSecrets: ModuleLoader;
 export declare const loadMenubar: ModuleLoader;
-export declare const loadBeta: ModuleLoader;
 export declare const loadSync: ModuleLoader;
 export declare const loadRefreshRules: ModuleLoader;
 export declare const loadFactory: ModuleLoader;
 export declare const loadUsage: ModuleLoader;
 export declare const loadInsights: ModuleLoader;
 export declare const loadPerf: ModuleLoader;
-export declare const loadTrends: ModuleLoader;
 export declare const loadPty: ModuleLoader;
 export declare const loadTmux: ModuleLoader;
 export declare const loadWatchdog: ModuleLoader;
@@ -88,15 +85,11 @@ export declare const loadMessage: ModuleLoader;
 export declare const loadSend: ModuleLoader;
 export declare const loadFeed: ModuleLoader;
 export declare const loadMailboxes: ModuleLoader;
-export declare const loadServe: ModuleLoader;
 export declare const loadArtifacts: ModuleLoader;
-export declare const loadAudit: ModuleLoader;
 export declare const loadWebhooks: ModuleLoader;
 export declare const loadHumans: ModuleLoader;
 export declare const loadAccounts: ModuleLoader;
 export declare const loadDaemon: ModuleLoader;
-export declare const loadAuth: ModuleLoader;
-export declare const loadOrg: ModuleLoader;
 /**
  * Commands whose modules pull in the SQLite-backed session/cloud stack. They are
  * registered AFTER `applyGlobalHelpConventions` (mirroring main's order: help

package/dist/cli/command-registry.js

@@ -58,20 +58,16 @@ export const loadPrune = async () => (await import('../commands/prune.js')).regi
 export const loadTrash = async () => (await import('../commands/trash.js')).registerTrashCommands;
 export const loadRestore = async () => (await import('../commands/trash.js')).registerRestoreCommand;
 export const loadDoctor = async () => (await import('../commands/doctor.js')).registerDoctorCommand;
-export const loadApply = async () => (await import('../commands/apply.js')).registerApplyCommand;
 export const loadRoute = async () => (await import('../commands/route.js')).registerRouteCommands;
 export const loadHarness = async () => (await import('../commands/harness.js')).registerHarnessCommands;
 export const loadSecrets = async () => (await import('../commands/secrets.js')).registerSecretsCommands;
 export const loadMenubar = async () => (await import('../commands/menubar.js')).registerMenubarCommands;
-export const loadBeta = async () => (await import('../commands/beta.js')).registerBetaCommands;
 export const loadSync = async () => (await import('../commands/sync.js')).registerSyncCommand;
 export const loadRefreshRules = async () => (await import('../commands/refresh-rules.js')).registerRefreshRulesCommand;
 export const loadFactory = async () => (await import('../commands/factory.js')).registerFactoryCommands;
 export const loadUsage = async () => (await import('../commands/usage.js')).registerUsageCommand;
 export const loadInsights = async () => (await import('../commands/insights.js')).registerInsightsCommand;
 export const loadPerf = async () => (await import('../commands/perf.js')).registerPerfCommand;
-// Thin deprecated alias of `agents insights mix` — no second mix implementation.
-export const loadTrends = async () => (await import('../commands/trends.js')).registerTrendsCommand;
 export const loadPty = async () => (await import('../commands/pty.js')).registerPtyCommands;
 export const loadTmux = async () => (await import('../commands/tmux.js')).registerTmuxCommands;
 export const loadWatchdog = async () => (await import('../commands/watchdog.js')).registerWatchdogCommand;
@@ -91,17 +87,12 @@ export const loadMessage = async () => (await import('../commands/message.js')).
 export const loadSend = async () => (await import('../commands/send.js')).registerSendCommand;
 export const loadFeed = async () => (await import('../commands/feed.js')).registerFeedCommand;
 export const loadMailboxes = async () => (await import('../commands/mailboxes.js')).registerMailboxesCommand;
-export const loadServe = async () => (await import('../commands/serve.js')).registerServeCommand;
-// Registers the `artifacts` group (with `share` + `setup` under it) AND the
-// top-level `unshare` alias — see commands/artifacts.ts.
+// Registers the `artifacts` group (`share` + `setup` + nested `unshare`).
 export const loadArtifacts = async () => (await import('../commands/artifacts.js')).registerArtifactsCommands;
-export const loadAudit = async () => (await import('../commands/audit.js')).registerAuditCommands;
 export const loadWebhooks = async () => (await import('../commands/webhook.js')).registerWebhooksCommand;
 export const loadHumans = async () => (await import('../commands/humans.js')).registerHumansCommands;
 export const loadAccounts = async () => (await import('../commands/accounts.js')).registerAccountsCommand;
 export const loadDaemon = async () => (await import('../commands/daemon.js')).registerDaemonCommand;
-export const loadAuth = async () => (await import('../commands/auth.js')).registerAuthCommand;
-export const loadOrg = async () => (await import('../commands/org.js')).registerOrgCommand;
 /**
  * Commands whose modules pull in the SQLite-backed session/cloud stack. They are
  * registered AFTER `applyGlobalHelpConventions` (mirroring main's order: help
@@ -116,7 +107,6 @@ export const LAZY_COMMAND_NAMES = new Set([
     'teams',
     'cloud',
     'message',
-    'serve',
 ]);
 /**
  * User-typed top-level command name -> ordered list of module loaders to run.
@@ -134,8 +124,6 @@ export const LAZY_COMMAND_NAMES = new Set([
  */
 export const COMMAND_LOADERS = {
     accounts: [loadAccounts],
-    auth: [loadAuth],
-    org: [loadOrg],
     view: [loadView],
     inspect: [loadInspect],
     feedback: [loadFeedback],
@@ -175,20 +163,17 @@ export const COMMAND_LOADERS = {
     trash: [loadTrash],
     restore: [loadRestore],
     doctor: [loadDoctor],
-    apply: [loadApply],
     route: [loadRoute],
     harness: [loadHarness],
     harnesses: [loadHarness],
     secrets: [loadSecrets],
     menubar: [loadMenubar],
-    beta: [loadBeta],
     sync: [loadSync],
     'refresh-rules': [loadRefreshRules],
     factory: [loadFactory],
     usage: [loadUsage],
     insights: [loadInsights],
     perf: [loadPerf],
-    trends: [loadTrends],
     pty: [loadPty],
     tmux: [loadTmux],
     watchdog: [loadWatchdog],
@@ -218,12 +203,7 @@ export const COMMAND_LOADERS = {
     feed: [loadFeed],
     mailboxes: [loadMailboxes],
     mailbox: [loadMailboxes],
-    serve: [loadServe],
     artifacts: [loadArtifacts],
-    // `unshare` is a top-level convenience alias of `artifacts share delete` (see
-    // commands/share.ts) — same module, registered as its own program.command().
-    unshare: [loadArtifacts],
-    audit: [loadAudit],
     webhooks: [loadWebhooks],
     humans: [loadHumans],
     daemon: [loadDaemon],

package/dist/commands/accounts.d.ts

@@ -30,16 +30,8 @@ export declare function parseBundleKey(raw: string): {
     bundle: string;
     key: string;
 };
-/**
- * Named accounts that `set-default` / `switch` can pin for this harness —
- * capped to the caller's plan tier (RUSH-2424). Downgrading never deletes a
- * credential: an over-cap account simply falls out of this list (see
- * {@link dormantAccountsForHarness}) and stops being a switch/rotation target
- * until the plan is upgraded.
- */
+/** Named accounts that `set-default` / `switch` can pin for this harness. */
 export declare function listSwitchableAccounts(agent: AgentId): Promise<UnifiedAccount[]>;
-/** Accounts registered for this harness beyond the plan's cap — kept, never deleted, excluded from switch/rotation, reactivated by an upgrade. */
-export declare function dormantAccountsForHarness(agent: AgentId): Promise<UnifiedAccount[]>;
 /**
  * Pin the per-harness default. Shared by `accounts set-default` and `accounts switch`.
  * Provider accounts must authenticate the harness; native accounts must belong to it.

package/dist/commands/accounts.js

@@ -17,7 +17,6 @@ import { discoverNativeAccounts } from '../lib/account-catalog.js';
 import { readAndResolveBundleEnv } from '../lib/secrets/bundles.js';
 import { getAccountProvider, listAccountProviders } from '../lib/account-provider-registry.js';
 import { accountBindings, addAccount, addNativeAccount, bindAccount, findAccount, findUnifiedAccount, inspectAccount, listNativeAccounts, readAccountRegistry, removeAccount, renameAccount, setAccountSecret, unbindAccount } from '../lib/account-registry.js';
-import { accountCapForTier, getTier } from '../lib/entitlement.js';
 function parseInstallation(raw) {
     const at = raw.lastIndexOf('@');
     if (at < 1 || at === raw.length - 1)
@@ -74,8 +73,8 @@ function secretFromBundle(raw) {
     const { bundle, key } = parseBundleKey(raw);
     return readAndResolveBundleEnv(bundle, { keys: [key], keyMode: 'storage', agentOnly: true, caller: 'accounts import' }).env[key];
 }
-function publicAccount(account, dormant) {
-    return { kind: 'provider', id: account.id, name: account.name, provider: account.provider, auth: account.auth, baseUrl: account.baseUrl, policy: account.policy, secretPresent: account.secretPresent, dormant };
+function publicAccount(account) {
+    return { kind: 'provider', id: account.id, name: account.name, provider: account.provider, auth: account.auth, baseUrl: account.baseUrl, policy: account.policy, secretPresent: account.secretPresent };
 }
 async function printAccounts(json, fleet = false) {
     if (fleet)
@@ -83,16 +82,12 @@ async function printAccounts(json, fleet = false) {
     const records = Object.values(readAccountRegistry().accounts).sort((a, b) => a.name.localeCompare(b.name));
     const discovered = await discoverNativeAccounts();
     const savedNative = listNativeAccounts(readMeta());
-    const dormantIds = new Set();
-    for (const agent of ALL_AGENT_IDS)
-        for (const account of await dormantAccountsForHarness(agent))
-            dormantIds.add(account.id);
     const native = discovered.map(row => {
         const saved = savedNative.find(account => account.agent === row.agent && account.identityKey === row.id);
-        return { ...row, name: saved?.name, id: saved?.id ?? row.id, dormant: !!saved && dormantIds.has(saved.id) };
+        return { ...row, name: saved?.name, id: saved?.id ?? row.id };
     });
     if (json) {
-        console.log(JSON.stringify([...records.map(account => publicAccount(inspectAccount(account.name), dormantIds.has(account.id))), ...native], null, 2));
+        console.log(JSON.stringify([...records.map(account => publicAccount(inspectAccount(account.name))), ...native], null, 2));
         return;
     }
     console.log(chalk.bold('Provider account bundles\n'));
@@ -100,14 +95,13 @@ async function printAccounts(json, fleet = false) {
         console.log(chalk.gray("  None. Add one with 'agents accounts add <name> --provider <provider> --auth <type>'."));
     for (const account of records) {
         const present = inspectAccount(account.name).secretPresent ? chalk.green('ready') : chalk.red('missing on this device');
-        const dormantSuffix = dormantIds.has(account.id) ? chalk.gray('  — dormant (upgrade to reactivate)') : '';
-        console.log(`  ${chalk.cyan(account.name)}  ${account.provider}  ${account.auth}  ${present}${dormantSuffix}`);
+        console.log(`  ${chalk.cyan(account.name)}  ${account.provider}  ${account.auth}  ${present}`);
     }
     console.log(chalk.bold('\nNative harness logins\n'));
     if (!native.length)
         console.log(chalk.gray('  No signed-in native accounts found.'));
     for (const account of native)
-        console.log(`  ${account.name ? `${chalk.cyan(account.name)} · ` : ''}${account.display}  ${account.agent}  ${account.versions.join(', ')}${account.dormant ? chalk.gray('  — dormant (upgrade to reactivate)') : ''}`);
+        console.log(`  ${account.name ? `${chalk.cyan(account.name)} · ` : ''}${account.display}  ${account.agent}  ${account.versions.join(', ')}`);
 }
 function parseAuth(raw) {
     if (raw === 'api-key' || raw === 'setup-token' || raw === 'bearer-token')
@@ -131,7 +125,7 @@ function providerAuthenticatesHarness(provider, auth, agent) {
         throw err;
     }
 }
-/** Every account (native + provider) registered/usable for this harness, oldest-first by name — the full set a plan-tier cap slices into active vs dormant. */
+/** Every account (native + provider) registered/usable for this harness, oldest-first by name. */
 function accountsForHarness(agent) {
     const meta = readMeta();
     const native = listNativeAccounts(meta).filter(account => account.agent === agent);
@@ -140,52 +134,9 @@ function accountsForHarness(agent) {
         .map(account => ({ ...account, kind: 'provider' }));
     return [...native, ...providers].sort((a, b) => a.name.localeCompare(b.name));
 }
-/**
- * Named accounts that `set-default` / `switch` can pin for this harness —
- * capped to the caller's plan tier (RUSH-2424). Downgrading never deletes a
- * credential: an over-cap account simply falls out of this list (see
- * {@link dormantAccountsForHarness}) and stops being a switch/rotation target
- * until the plan is upgraded.
- */
+/** Named accounts that `set-default` / `switch` can pin for this harness. */
 export async function listSwitchableAccounts(agent) {
-    const cap = accountCapForTier(await getTier());
-    return accountsForHarness(agent).slice(0, cap);
-}
-/** Accounts registered for this harness beyond the plan's cap — kept, never deleted, excluded from switch/rotation, reactivated by an upgrade. */
-export async function dormantAccountsForHarness(agent) {
-    const cap = accountCapForTier(await getTier());
-    return accountsForHarness(agent).slice(cap);
-}
-function accountCapRefusalMessage(agent, tier, cap) {
-    if (!tier.isPaid)
-        return `free plan is capped at 3 ${agent} accounts (3/3). agents upgrade — up to 10 per harness.`;
-    return `${tier.tierName} plan is capped at ${cap} ${agent} accounts (${cap}/${cap}).`;
-}
-/**
- * Refuse BEFORE any write when adding a new account would push one of
- * `harnesses` over the caller's plan cap. Returns the tier/cap/pre-add counts
- * so the caller can print the exactly-at-cap notice after a successful write.
- */
-async function assertAccountCapacityFor(harnesses) {
-    const tier = await getTier();
-    const cap = accountCapForTier(tier);
-    const existing = new Map();
-    for (const harness of harnesses)
-        existing.set(harness, accountsForHarness(harness).length);
-    const capped = harnesses.find(harness => (existing.get(harness) ?? 0) >= cap);
-    if (capped)
-        throw new Error(accountCapRefusalMessage(capped, tier, cap));
-    return { tier, cap, existing };
-}
-/** One-line, non-blocking notice for every harness a free-tier add just brought to exactly its cap. */
-function printCapNoticesFor(harnesses, tier, cap, existing) {
-    if (tier.isPaid)
-        return;
-    for (const harness of harnesses) {
-        if ((existing.get(harness) ?? 0) + 1 === cap) {
-            console.log(chalk.yellow(`${cap}/${cap} ${harness} accounts on the free plan. agents upgrade — up to 10 per harness.`));
-        }
-    }
+    return accountsForHarness(agent);
 }
 /**
  * Pin the per-harness default. Shared by `accounts set-default` and `accounts switch`.
@@ -279,16 +230,10 @@ export function registerAccountsCommand(program) {
         const provider = getAccountProvider(o.provider);
         if (!provider.authKinds.includes(auth))
             throw new Error(`Provider '${provider.provider}' does not support ${auth}. Supported: ${provider.authKinds.join(', ')}.`);
-        // A provider account may authenticate more than one harness (e.g. openrouter);
-        // it counts toward every harness it can authenticate, so refuse before any
-        // write if adding it would push ANY of those harnesses over the plan cap.
-        const harnesses = ALL_AGENT_IDS.filter(h => providerAuthenticatesHarness(provider.provider, auth, h));
-        const { tier, cap, existing } = await assertAccountCapacityFor(harnesses);
         const secret = o.fromSecrets ? secretFromBundle(o.fromSecrets) : await password({ message: `Enter ${provider.provider} ${auth} for '${name}':` });
         const account = addAccount(name, provider.provider, auth, secret, undefined, { baseUrl: o.baseUrl });
         console.log(chalk.green(`Added ${account.provider} ${account.auth} account '${account.name}'.`));
         console.log(chalk.gray(`Secret bundle '${account.name}' is the account and uses policy never, so agent launches never request Touch ID.`));
-        printCapNoticesFor(harnesses, tier, cap, existing);
     });
     accounts.command('set-key <name>')
         .description('Rotate an account credential without changing its identity')
@@ -306,22 +251,12 @@ export function registerAccountsCommand(program) {
         const unified = findUnifiedAccount(name, meta);
         if (!unified)
             throw new Error(`Unknown account '${name}'.`);
-        const harnesses = unified.kind === 'provider'
-            ? ALL_AGENT_IDS.filter(h => providerAuthenticatesHarness(unified.provider, unified.auth, h))
-            : [unified.agent];
-        let dormant = false;
-        for (const harness of harnesses) {
-            if ((await dormantAccountsForHarness(harness)).some(a => a.id === unified.id)) {
-                dormant = true;
-                break;
-            }
-        }
         const account = unified.kind === 'provider'
-            ? { ...publicAccount(inspectAccount(unified.name), dormant), custody: 'agents secrets (policy never)', attached: accountBindings(unified.id, meta) }
-            : { ...unified, dormant, custody: `${unified.agent} (not stored by agents-cli)`, attached: accountBindings(unified.id, meta) };
+            ? { ...publicAccount(inspectAccount(unified.name)), custody: 'agents secrets (policy never)', attached: accountBindings(unified.id, meta) }
+            : { ...unified, custody: `${unified.agent} (not stored by agents-cli)`, attached: accountBindings(unified.id, meta) };
         if (o.json || command.optsWithGlobals().json)
             return console.log(JSON.stringify(account, null, 2));
-        console.log(chalk.bold(account.name) + (account.dormant ? chalk.gray('  — dormant (upgrade to reactivate)') : ''));
+        console.log(chalk.bold(account.name));
         console.log(`  kind: ${account.kind}`);
         console.log(`  id: ${account.id}`);
         console.log(`  custody: ${account.custody}`);
@@ -340,12 +275,10 @@ export function registerAccountsCommand(program) {
         .description('Name a signed-in native installation without copying its OAuth credentials')
         .action(async (source, name) => {
         const identity = await nativeIdentityFromSource(source);
-        const { tier, cap, existing } = await assertAccountCapacityFor([identity.agent]);
         const account = addNativeAccount(name, identity.agent, identity.identityKey, identity.identityLabel, identity.scope);
         console.log(chalk.green(`Named ${source} as ${account.name}.`));
         if (account.scope === 'device')
             console.log(chalk.gray(`${identity.agent} authentication is device-scoped; attach '${account.name}' to '${identity.agent}', not an individual version.`));
-        printCapNoticesFor([identity.agent], tier, cap, existing);
     });
     accounts.command('attach <account> <target>')
         .description('Attach a named account to a native installation or custom harness')
@@ -383,17 +316,6 @@ export function registerAccountsCommand(program) {
             // Provider account: it must be able to authenticate the target's harness.
             getAccountProvider(account.provider).envFor(targetAgent, account.auth);
         }
-        // Defense-in-depth cap check: by the point we get here `account` already
-        // authenticates/belongs to `targetAgent` (validated above), so it is
-        // already counted in accountsForHarness(targetAgent) from its `add`/`name`
-        // time — this can only refuse if that invariant is ever violated, never a
-        // normal re-attach of an account the harness is already at cap with.
-        const tier = await getTier();
-        const cap = accountCapForTier(tier);
-        const alreadyCounted = accountsForHarness(targetAgent).some(existing => existing.id === account.id);
-        const otherCount = accountsForHarness(targetAgent).length - (alreadyCounted ? 1 : 0);
-        if (otherCount >= cap)
-            throw new Error(accountCapRefusalMessage(targetAgent, tier, cap));
         bindAccount(name, target);
         console.log(chalk.green(`Attached ${account.name} to ${target}.`));
     });

package/dist/commands/apply.d.ts

@@ -1,25 +1,22 @@
 /**
- * `agents apply` (alias `ag apply`) — reconcile the whole fleet to a declared
- * profile in one command: install agents-cli + agents and sync config. Native
+ * `agents fleet apply` / `agents devices apply` — reconcile the whole fleet
+ * to a declared profile: install agents-cli + agents and sync config. Native
  * harness logins remain device-local; portable provider credentials move only
  * through explicit `agents accounts sync`.
  *
  * The manifest is the `fleet:` block of any `-f` file (default `agents.yaml`).
+ * Top-level `agents apply` is retired (RUSH-2981).
  */
 import { Command } from 'commander';
 /** padEnd on the visible width, ignoring chalk color codes. Exported for tests. */
 export declare function stripPad(s: string, width: number): string;
 /**
- * Attach the reconcile options + action to a command node. Shared by the
- * top-level `agents apply` and its `agents fleet apply` alias so the two can
- * never drift — identical flags, identical engine.
+ * Attach the reconcile options + action to a command node.
  */
 export declare function configureApplyCommand(cmd: Command): Command;
-export declare function registerApplyCommand(program: Command): void;
 /**
- * Surface `agents apply` under the fleet command tree as `agents fleet apply`
- * (and `agents devices apply`). Same reconcile engine as the top-level command —
- * a discoverability alias for users who reach for `fleet` as the verb. Kept in
- * lockstep via {@link configureApplyCommand}.
+ * Canonical surface: `agents fleet apply` / `agents devices apply`.
+ * Top-level `agents apply` is retired (RUSH-2981) — not a noun, already nested
+ * here. Same reconcile engine, kept in lockstep via {@link configureApplyCommand}.
  */
 export declare function registerFleetApplyAlias(devicesCmd: Command): void;