@phnx-labs/agents-cli 1.22.43 → 1.22.45

package/dist/lib/staleness/writers/mcp.js

@@ -1,5 +1,14 @@
+/**
+ * MCP writer — thin dispatcher into `installMcpServers` from `lib/mcp.ts`.
+ *
+ * The per-agent format handling (Claude CLI, Codex TOML, Cursor JSON, etc.)
+ * lives in lib/mcp.ts; we keep it there to avoid the import cycle with
+ * `versions.ts`. The writer simply hands the selection to that function.
+ */
+import * as fs from 'fs';
 import { capableAgents } from '../../capabilities.js';
 import { installMcpServers } from '../../mcp.js';
+import { getMcpConfigPathForHome } from '../../agents.js';
 import { lazyAgentMap } from './lazy-map.js';
 function buildMcpWriter(agent) {
     return {
@@ -9,7 +18,13 @@ function buildMcpWriter(agent) {
             const r = installMcpServers(agent, version, versionHome, selection, { cwd });
             // Forward r.errors: dropping them is what let a harness with no config
             // writer report a clean sync while writing nothing (RUSH-2677).
-            return { synced: r.applied, ...(r.errors.length ? { errors: r.errors } : {}) };
+            // All applied servers land in the one canonical config file — that file
+            // is the artifact whose deletion must read as stale (#2398). Recorded
+            // only when it verifiably exists after the write, so an agent whose CLI
+            // wrote elsewhere can never produce a perpetually-stale manifest.
+            const configPath = getMcpConfigPathForHome(agent, versionHome);
+            const paths = r.applied.length > 0 && fs.existsSync(configPath) ? [configPath] : [];
+            return { synced: r.applied, paths, ...(r.errors.length ? { errors: r.errors } : {}) };
         },
     };
 }

package/dist/lib/staleness/writers/rules.js

@@ -43,7 +43,7 @@ function buildRulesWriter(agent) {
             }
             catch { /* destination did not exist */ }
             fs.writeFileSync(destFile, composed.content);
-            return { synced: [targetName] };
+            return { synced: [targetName], paths: [destFile] };
         },
     };
 }

package/dist/lib/staleness/writers/skills.js

@@ -56,6 +56,7 @@ function buildSkillsWriter(agent) {
             catch { /* does not exist yet */ }
             fs.mkdirSync(skillsTarget, { recursive: true });
             const synced = [];
+            const paths = [];
             for (const skill of selection) {
                 const srcDir = resolveSkillSource(skill, { agent });
                 if (!srcDir)
@@ -64,8 +65,9 @@ function buildSkillsWriter(agent) {
                 removePath(destDir);
                 copyDir(srcDir, destDir);
                 synced.push(skill);
+                paths.push(destDir);
             }
-            return { synced };
+            return { synced, paths };
         },
         remove({ versionHome, name }) {
             const agentDir = path.join(versionHome, agentConfigDirName(agent));

package/dist/lib/staleness/writers/subagents.d.ts

@@ -1,12 +1,3 @@
-/**
- * Subagents writer. Every agent's on-disk layout (target dir, file/dir shape,
- * transform) is declared once in the subagent registry; this writer is generic
- * and iterates the registry instead of a per-agent `else if` chain.
- *
- * Source-side discovery is `listInstalledSubagents` from lib/subagents.ts —
- * it reads user + system layers only (project layer excluded for the same
- * defense as commands/skills/hooks).
- */
 import type { AgentId } from '../../types.js';
 import type { ResourceWriter } from './types.js';
 export declare const subagentsWriters: Partial<Record<AgentId, ResourceWriter<string[]>>>;

package/dist/lib/staleness/writers/subagents.js

@@ -1,3 +1,13 @@
+/**
+ * Subagents writer. Every agent's on-disk layout (target dir, file/dir shape,
+ * transform) is declared once in the subagent registry; this writer is generic
+ * and iterates the registry instead of a per-agent `else if` chain.
+ *
+ * Source-side discovery is `listInstalledSubagents` from lib/subagents.ts —
+ * it reads user + system layers only (project layer excluded for the same
+ * defense as commands/skills/hooks).
+ */
+import * as fs from 'fs';
 import { capableAgents } from '../../capabilities.js';
 import { listInstalledSubagents } from '../../subagents.js';
 import { subagentTarget } from '../../subagents-registry.js';
@@ -14,6 +24,7 @@ function buildSubagentsWriter(agent) {
             const map = new Map(all.map(s => [s.name, s]));
             const dir = target.dir(versionHome);
             const synced = [];
+            const paths = [];
             for (const name of selection) {
                 const sub = map.get(name);
                 if (!sub)
@@ -21,10 +32,16 @@ function buildSubagentsWriter(agent) {
                 try {
                     target.write(dir, sub);
                     synced.push(sub.name);
+                    // The registry owns the layout — record the artifact paths this
+                    // write occupies so a later deletion reads as stale (#2398).
+                    for (const entry of target.occupied(dir, sub.name)) {
+                        if (fs.existsSync(entry.path))
+                            paths.push(entry.path);
+                    }
                 }
                 catch { /* per-item sync failure: skip */ }
             }
-            return { synced };
+            return { synced, paths };
         },
     };
 }

package/dist/lib/staleness/writers/types.d.ts

@@ -28,6 +28,16 @@ export interface WriteArgs<Sel> {
 export interface WriteResult {
     /** Names actually written. Empty array = write produced nothing (not an error). */
     synced: string[];
+    /**
+     * Absolute on-disk paths of the artifacts this write materialized (a file or
+     * a dir root per resource, per the agent's layout). Recorded into the sync
+     * manifest as `writtenTargets` so `isStale` can flag a deleted artifact as
+     * stale with one existsSync per path (#2398) — no content reads, keeping the
+     * fast-guard budget (RUSH-2320). Optional: a writer whose artifact path is
+     * not cheaply known (goose recipe YAML, plugins) may omit entries; absence
+     * means "not verified", never a false stale.
+     */
+    paths?: string[];
     /**
      * Per-item failures the writer could not complete, as user-facing sentences.
      *

package/dist/lib/startup/command-registry.d.ts

@@ -24,7 +24,14 @@ export declare const KNOWN_TOP_LEVEL_COMMANDS: ReadonlySet<string>;
  * use `agents feed --filter updates` (RUSH-2692). `status` moved under
  * `agents sync status` (RUSH-2864). `tickets` was removed — use `linear`
  * (linear-cli) (RUSH-2932). `alias` moved under `agents setup alias` (RUSH-2965).
- * `inbox` was a pure alias of `agents feed` (RUSH-2984).
+ * `inbox` was a pure alias of `agents feed` (RUSH-2984). `unshare` nested under
+ * `agents artifacts unshare` (RUSH-2989). `audit` nested under `agents events audit`.
+ * `trends` nested under `agents insights mix` / `insights trends`. `serve` (the
+ * read-only local web companion + `--control` anchor) was removed with the
+ * unshipped iOS Fleet Cockpit it existed for (RUSH-3001). `apply` nested under
+ * `agents fleet apply` / `agents devices apply`. `beta` nested under
+ * `agents setup beta` (RUSH-2981). `auth` and `org` (the Prix-coupled account
+ * layer) were removed pending the Phoenix-backed replacement (RUSH-2581).
  */
 export declare const RETIRED_TOP_LEVEL_COMMANDS: ReadonlySet<string>;
 export declare function isKnownTopLevelCommand(name: string): boolean;

package/dist/lib/startup/command-registry.js

@@ -1,15 +1,15 @@
 const LOADED_COMMAND_NAMES = [
-    'accounts', 'auth', 'org', 'view', 'inspect', 'feedback', 'commands', 'hooks', 'skills', 'rules', 'memory',
+    'accounts', 'view', 'inspect', 'feedback', 'commands', 'hooks', 'skills', 'rules', 'memory',
     'permissions', 'mcp', 'clis', 'subagents', 'plugins', 'workflows', 'add', 'use', 'list',
     'remove', 'rm', 'purge', 'update', 'prune', 'import', 'registry', 'search', 'install',
     'routines', 'monitors', 'projects', 'run', 'open', 'reconnect', 'fork', 'config',
-    'models', 'modes', 'trash', 'restore', 'doctor', 'apply',
-    'route', 'harness', 'harnesses', 'secrets', 'menubar', 'beta', 'sync',
-    'refresh-rules', 'factory', 'usage', 'insights', 'perf', 'trends',
+    'models', 'modes', 'trash', 'restore', 'doctor',
+    'route', 'harness', 'harnesses', 'secrets', 'menubar', 'sync',
+    'refresh-rules', 'factory', 'usage', 'insights', 'perf',
     'pty', 'tmux', 'watchdog', 'browser', 'computer', 'logs', 'events',
     'ssh', 'devices', 'fleet', 'repos', 'repo', 'setup', 'uninstall', 'upgrade', 'sessions',
     'teams', 'cloud', 'message', 'send', 'notify', 'feed',
-    'mailboxes', 'mailbox', 'serve', 'artifacts', 'unshare', 'audit', 'webhooks',
+    'mailboxes', 'mailbox', 'artifacts', 'webhooks',
     'humans', 'daemon',
 ];
 const INLINE_COMMAND_NAMES = [
@@ -44,10 +44,20 @@ export const KNOWN_TOP_LEVEL_COMMANDS = new Set([
  * use `agents feed --filter updates` (RUSH-2692). `status` moved under
  * `agents sync status` (RUSH-2864). `tickets` was removed — use `linear`
  * (linear-cli) (RUSH-2932). `alias` moved under `agents setup alias` (RUSH-2965).
- * `inbox` was a pure alias of `agents feed` (RUSH-2984).
+ * `inbox` was a pure alias of `agents feed` (RUSH-2984). `unshare` nested under
+ * `agents artifacts unshare` (RUSH-2989). `audit` nested under `agents events audit`.
+ * `trends` nested under `agents insights mix` / `insights trends`. `serve` (the
+ * read-only local web companion + `--control` anchor) was removed with the
+ * unshipped iOS Fleet Cockpit it existed for (RUSH-3001). `apply` nested under
+ * `agents fleet apply` / `agents devices apply`. `beta` nested under
+ * `agents setup beta` (RUSH-2981). `auth` and `org` (the Prix-coupled account
+ * layer) were removed pending the Phoenix-backed replacement (RUSH-2581).
  */
 export const RETIRED_TOP_LEVEL_COMMANDS = new Set([
     'webhook',
+    'auth',
+    'org',
+    'serve',
     'login',
     'logout',
     'budget',
@@ -67,6 +77,11 @@ export const RETIRED_TOP_LEVEL_COMMANDS = new Set([
     'tickets',
     'alias',
     'inbox',
+    'unshare',
+    'audit',
+    'trends',
+    'apply',
+    'beta',
 ]);
 export function isKnownTopLevelCommand(name) {
     return KNOWN_TOP_LEVEL_COMMANDS.has(name);

package/dist/lib/startup/root-command.d.ts

@@ -1,3 +1,20 @@
 import type { Command } from 'commander';
-/** Configure the public root surface shared by the live CLI and reference generator. */
+/**
+ * Configure the public root surface shared by the live CLI and reference generator.
+ *
+ * Does NOT call `enablePositionalOptions()` — tried for RUSH-2687 (a subcommand
+ * option whose long name collides with an ancestor's is silently dropped at
+ * parse time) and reverted. Commander's `copyInheritedSettings()` copies
+ * `_enablePositionalOptions` onto every command created via `.command()` from
+ * that point on, so setting it here cascades to all ~552 registered commands,
+ * not just the root's own scan. That broke a real, load-bearing pattern used
+ * elsewhere in the tree: a parent command (e.g. `sessions`, which owns
+ * `--since`/`--json`/`--local`) whose LEAF subcommands declare none of their
+ * own options and read them back via `command.optsWithGlobals()` (e.g.
+ * `sessions backfill tools --since 7d --json --local`) — positional options
+ * makes the parent stop scanning at the first subcommand-shaped token, so it
+ * never sees the flags typed after it, and the leaf sees `unknown option`
+ * instead of a silent drop. RUSH-2687 was fixed per-surface in share.ts
+ * instead (renaming the colliding options), not with this global flag.
+ */
 export declare function configureRootCommand(program: Command, name: string, version: string): Command;

package/dist/lib/startup/root-command.js

@@ -1,4 +1,21 @@
-/** Configure the public root surface shared by the live CLI and reference generator. */
+/**
+ * Configure the public root surface shared by the live CLI and reference generator.
+ *
+ * Does NOT call `enablePositionalOptions()` — tried for RUSH-2687 (a subcommand
+ * option whose long name collides with an ancestor's is silently dropped at
+ * parse time) and reverted. Commander's `copyInheritedSettings()` copies
+ * `_enablePositionalOptions` onto every command created via `.command()` from
+ * that point on, so setting it here cascades to all ~552 registered commands,
+ * not just the root's own scan. That broke a real, load-bearing pattern used
+ * elsewhere in the tree: a parent command (e.g. `sessions`, which owns
+ * `--since`/`--json`/`--local`) whose LEAF subcommands declare none of their
+ * own options and read them back via `command.optsWithGlobals()` (e.g.
+ * `sessions backfill tools --since 7d --json --local`) — positional options
+ * makes the parent stop scanning at the first subcommand-shaped token, so it
+ * never sees the flags typed after it, and the leaf sees `unknown option`
+ * instead of a silent drop. RUSH-2687 was fixed per-surface in share.ts
+ * instead (renaming the colliding options), not with this global flag.
+ */
 export function configureRootCommand(program, name, version) {
     return program
         .name(name)

package/dist/lib/state.js

@@ -955,6 +955,13 @@ function serializeCentral(central) {
         // config data-loss bug). A known device key lingering in the synced file is
         // still removed — it belongs in the per-machine file, not here.
         if (!(k in central) && KNOWN_META_KEYS.has(k)) {
+            // RUSH-2837: a partial writeMeta (reconstructed Meta missing `share`)
+            // deleted the share endpoint from agents.yaml and synced that deletion
+            // fleet-wide. `share` is restored only by setup/join — never drop it
+            // just because this write omitted the key. Explicit `share: null` still
+            // goes through doc.set above.
+            if (k === 'share')
+                continue;
             doc.delete(k);
             changed = true;
         }

package/dist/lib/teams/placement-probe.js

@@ -7,9 +7,9 @@
  *
  *   - reachability + headroom + load  ← {@link probeFleetStats} (one parallel
  *     SSH fan-out over the pool; the local box is measured directly).
- *   - requested agent installed + signed in (when known) ← a one-shot readiness
- *     probe per remote device ({@link buildReadyProbeCommand} → `agents view`),
- *     the local box via {@link checkCliAvailable}/{@link checkCliSignedIn}.
+ *   - requested agent installed + account eligibility (when known) ← a one-shot
+ *     readiness probe per remote device ({@link buildReadyProbeCommand} →
+ *     `agents view`), with the same candidate-readiness gate evaluated locally.
  *
  * The result is cached briefly per (pool, agent-or-any) so a `teams start` wave that
  * places N teammates probes the pool ONCE, not N times — the roster-count part
@@ -25,10 +25,11 @@ import { execFile } from 'child_process';
 import { probeFleetStats, headroom } from '../devices/health.js';
 import { loadDevicesSync } from '../devices/registry.js';
 import { buildSshInvocation, writeAskpassShim } from '../devices/connect.js';
-import { buildReadyProbeCommand, parseReadyProbe, viewAgentSignedIn, viewHasAgent, } from '../hosts/ready.js';
+import { buildReadyProbeCommand, parseReadyProbe, viewAgentAccountEligibility, viewHasAgent, } from '../hosts/ready.js';
+import { collectRunCandidates, isSignInRecoverable, readinessFromCandidate, } from '../accounting/rotate.js';
 import { localMachineId } from '../origin-machine.js';
 import { normalizeHost } from '../machine-id.js';
-import { checkCliAvailable, checkCliSignedIn } from './agents.js';
+import { checkCliAvailable } from './agents.js';
 /** Per-remote readiness probe budget — matches the health probe's short window
  * (`agents view` on a warm box is sub-second; a wedged one degrades to unknown). */
 export const READY_PROBE_TIMEOUT_MS = 8_000;
@@ -61,19 +62,22 @@ function probeRemoteReadiness(device, agent) {
         ({ args, env } = buildSshInvocation(device, [cmd], shim, {}, { agentOnly: true }));
     }
     catch {
-        return Promise.resolve({ installed: undefined, signedIn: undefined });
+        return Promise.resolve({ installed: undefined, signedIn: undefined, pickerEligible: undefined });
     }
     return new Promise((resolve) => {
         execFile('ssh', args, { encoding: 'utf-8', env: { ...process.env, ...env }, timeout: READY_PROBE_TIMEOUT_MS }, (err, stdout) => {
             if (err || !stdout)
-                return resolve({ installed: undefined, signedIn: undefined });
+                return resolve({ installed: undefined, signedIn: undefined, pickerEligible: undefined });
             const probe = parseReadyProbe(stdout);
             if (!probe.reachable)
-                return resolve({ installed: undefined, signedIn: undefined });
+                return resolve({ installed: undefined, signedIn: undefined, pickerEligible: undefined });
             if (!probe.version)
-                return resolve({ installed: false, signedIn: false });
+                return resolve({ installed: false, signedIn: false, pickerEligible: false });
             const installed = viewHasAgent(probe.view, agent);
-            resolve({ installed, signedIn: installed ? viewAgentSignedIn(probe.view, agent) : false });
+            const eligibility = installed
+                ? viewAgentAccountEligibility(probe.view, agent)
+                : { signedIn: false, pickerEligible: false };
+            resolve({ installed, ...eligibility });
         });
     });
 }
@@ -108,8 +112,18 @@ export async function probePoolSignals(pool, agent, opts = {}) {
             const isSelf = normalizeHost(d.name) === self;
             if (isSelf) {
                 const inst = checkCliAvailable(agent)[0];
-                const signedIn = inst ? await checkCliSignedIn(agent) : undefined;
-                return [d.name, { installed: inst, signedIn }];
+                if (!inst)
+                    return [d.name, { installed: false, signedIn: false, pickerEligible: false }];
+                const candidates = await collectRunCandidates(agent).catch(() => null);
+                if (!candidates) {
+                    return [d.name, { installed: true, signedIn: undefined, pickerEligible: undefined }];
+                }
+                const readiness = candidates.map(readinessFromCandidate);
+                return [d.name, {
+                        installed: true,
+                        signedIn: readiness.some((candidate) => candidate.ready),
+                        pickerEligible: readiness.some((candidate) => candidate.ready || isSignInRecoverable(candidate)),
+                    }];
             }
             return [d.name, await probeRemoteReadiness(d, agent)];
         }))
@@ -128,6 +142,7 @@ export async function probePoolSignals(pool, agent, opts = {}) {
             memPercent: s?.memPercent,
             installed: inst?.installed,
             signedIn: inst?.signedIn,
+            pickerEligible: inst?.pickerEligible,
         });
     }
     cache.set(key, { at: now, signals });

package/dist/lib/teams/scheduler.d.ts

@@ -18,8 +18,10 @@ export interface DevicePlacementSignal {
     memPercent?: number;
     /** Requested agent installed on the device. `false` → excluded (can't run). */
     installed?: boolean;
-    /** Requested agent signed in (best-effort). Ranks a signed-in device first. */
+    /** Requested agent has at least one launch-ready account. Ranks a ready device first. */
     signedIn?: boolean;
+    /** Requested agent has at least one row the interactive account picker can launch. */
+    pickerEligible?: boolean;
 }
 /** Team fields the placement cascade reads (a subset of TeamMeta). */
 export interface PlacementTeam {

package/dist/lib/types.d.ts

@@ -80,7 +80,7 @@ export interface BudgetConfig {
      */
     require_confirm_over?: number;
 }
-/** Preview features that users can opt into via `agents beta`. */
+/** Preview features that users can opt into via `agents setup beta`. */
 export type BetaFeatureName = 'factory';
 /** Subset of chalk color names used for agent-specific terminal output. */
 export type ChalkColor = 'magenta' | 'green' | 'blue' | 'cyan' | 'yellowBright' | 'redBright' | 'whiteBright' | 'blueBright' | 'greenBright' | 'magentaBright' | 'cyanBright';

package/dist/lib/view-types.d.ts

@@ -1,6 +1,7 @@
 import type { ConfiguredModelSource } from './models.js';
 import type { ProfileSummary } from './profiles.js';
 import type { AgentId } from './types.js';
+import type { AuthVerdict } from './auth-health.js';
 export type SyncState = 'synced' | 'new' | 'modified' | 'deleted';
 export interface ViewJsonVersion {
     version: string;
@@ -8,6 +9,8 @@ export interface ViewJsonVersion {
     isolated: boolean;
     isIsolatedDefault: boolean;
     signedIn: boolean;
+    /** Live cached authentication verdict for this installed version. */
+    authVerdict: AuthVerdict | null;
     email: string | null;
     accountId?: string | null;
     organizationType?: string | null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@phnx-labs/agents-cli",
-  "version": "1.22.43",
+  "version": "1.22.45",
   "description": "One CLI for all your AI coding agents - versions, config, cloud dispatch, sessions, and teams (now with first-class Grok Build CLI support)",
   "type": "module",
   "main": "dist/index.js",
@@ -25,7 +25,6 @@
     "dist/**/*.d.ts",
     "dist/**/*.json",
     "dist/**/*.sh",
-    "dist/bin/**",
     "dist/lib/secrets/Agents CLI.app/**",
     "dist/lib/menubar/MenubarHelper.app/**",
     "scripts/postinstall.js",
@@ -49,7 +48,7 @@
     "build": "tsc && rm -rf 'dist/lib/secrets/AgentsKeychain.app' 'dist/lib/secrets/Agents CLI.app' 'dist/lib/menubar/MenubarHelper.app' && ([ -d 'bin/Agents CLI.app' ] && cp -R 'bin/Agents CLI.app' 'dist/lib/secrets/Agents CLI.app' || true) && ([ -d 'bin/MenubarHelper.app' ] && mkdir -p 'dist/lib/menubar' && cp -R 'bin/MenubarHelper.app' 'dist/lib/menubar/MenubarHelper.app' || true) && ([ -f 'bin/agents-macos' ] && mkdir -p dist/bin && cp -f 'bin/agents-macos' 'dist/bin/agents' && chmod 755 'dist/bin/agents' || true)",
     "build:bin": "scripts/build-bin.sh",
     "prepare": "npm run build",
-    "prepack": "cp ../../README.md README.md && scripts/verify-keychain-helper.sh && scripts/verify-menubar-helper.sh && scripts/verify-cli-binary.sh",
+    "prepack": "cp ../../README.md README.md && scripts/verify-keychain-helper.sh && scripts/verify-menubar-helper.sh",
     "postinstall": "node scripts/postinstall.js",
     "dev": "tsx src/index.ts",
     "changelog": "bun scripts/gen-changelog.ts",

package/dist/commands/auth.d.ts

@@ -1,9 +0,0 @@
-import type { Command } from 'commander';
-/**
- * `agents auth login` — RFC 8628 device-code flow against the already-shipped
- * `/api/v1/auth/device/*` routes. If the live API rejects the request shape
- * (a route this spec missed, or the endpoint moved), this fails loud with the
- * `rush login` fallback rather than silently stubbing a fake session.
- */
-export declare function runAuthLogin(): Promise<void>;
-export declare function registerAuthCommand(program: Command): void;

package/dist/commands/auth.js

@@ -1,108 +0,0 @@
-import chalk from 'chalk';
-import { setHelpSections } from '../lib/help.js';
-import { runOrDie } from '../lib/format.js';
-import { clearPrixSession, fetchWhoAmI, pollDeviceToken, PrixApiError, readPrixSession, resolvePrixToken, startDeviceAuthorization, writePrixSession, } from '../lib/prix-account.js';
-function sleep(ms) {
-    return new Promise(resolve => setTimeout(resolve, ms));
-}
-/**
- * `agents auth login` — RFC 8628 device-code flow against the already-shipped
- * `/api/v1/auth/device/*` routes. If the live API rejects the request shape
- * (a route this spec missed, or the endpoint moved), this fails loud with the
- * `rush login` fallback rather than silently stubbing a fake session.
- */
-export async function runAuthLogin() {
-    let authorization;
-    try {
-        authorization = await startDeviceAuthorization();
-    }
-    catch (err) {
-        const message = err instanceof Error ? err.message : String(err);
-        const existing = resolvePrixToken();
-        if (existing?.source === 'rush') {
-            console.log(chalk.yellow(`Device login is unavailable right now (${message}), but you're already signed in via 'rush login'.`));
-            console.log("Run 'agents auth whoami' to confirm.");
-            return;
-        }
-        throw new Error(`Device login is unavailable right now (${message}). Run 'rush login' instead, then 'agents auth whoami' to confirm.`);
-    }
-    console.log(`To sign in, open:\n\n  ${chalk.cyan(authorization.verification_uri_complete)}\n`);
-    console.log(chalk.gray(`(code: ${authorization.user_code})`));
-    const deadline = Date.now() + authorization.expires_in * 1000;
-    let interval = Math.max(authorization.interval, 1) * 1000;
-    while (Date.now() < deadline) {
-        await sleep(interval);
-        const poll = await pollDeviceToken(authorization.device_code);
-        if (poll.status === 'pending')
-            continue;
-        if (poll.status === 'slow_down') {
-            interval += 1000;
-            continue;
-        }
-        if (poll.status === 'expired')
-            throw new Error('Login code expired. Run `agents auth login` again.');
-        if (poll.status === 'denied')
-            throw new Error('Login was denied.');
-        writePrixSession({
-            access_token: poll.access_token,
-            refresh_token: poll.refresh_token,
-            expires_at: poll.expires_in ? Date.now() + poll.expires_in * 1000 : undefined,
-            email: poll.user.email,
-            userId: poll.user.id,
-        });
-        console.log(chalk.green(`Signed in as ${poll.user.email}.`));
-        return;
-    }
-    throw new Error('Login code expired. Run `agents auth login` again.');
-}
-async function runAuthWhoami(json) {
-    const resolved = resolvePrixToken();
-    if (!resolved)
-        throw new Error("Not signed in. Run 'agents auth login' first.");
-    let who;
-    try {
-        who = await fetchWhoAmI(resolved.token);
-    }
-    catch (err) {
-        if (err instanceof PrixApiError && err.status === 401) {
-            throw new Error(`Signed-in token is no longer valid (${resolved.source === 'agents' ? "run 'agents auth login'" : "run 'rush login'"} again).`);
-        }
-        throw err;
-    }
-    if (json) {
-        console.log(JSON.stringify({ ...who, source: resolved.source }, null, 2));
-        return;
-    }
-    console.log(`${chalk.bold(who.email)}  ${chalk.gray(who.userId)}`);
-    console.log(chalk.gray(`signed in via ${resolved.source === 'agents' ? "'agents auth login'" : "'rush login' (shared session)"}`));
-}
-function runAuthLogout() {
-    const cleared = clearPrixSession();
-    const rushRemains = resolvePrixToken()?.source === 'rush';
-    if (!cleared && !readPrixSession()) {
-        console.log(chalk.gray('Not signed in via `agents auth login` — nothing to clear.'));
-    }
-    else {
-        console.log(chalk.green('Signed out.'));
-    }
-    if (rushRemains) {
-        console.log(chalk.gray("You're still signed in via `rush login` — `agents auth whoami` will use that session. Run `rush logout` to clear it too."));
-    }
-}
-export function registerAuthCommand(program) {
-    const auth = program.command('auth').description('Sign in to your Rush account (shared by `agents org` and paid tiers)');
-    auth.command('login').description('Sign in via the device-code flow').action(() => runOrDie(() => runAuthLogin()));
-    auth.command('whoami').description('Show the signed-in account').option('--json', 'Machine-readable output')
-        .action((o, command) => {
-        const json = !!(o.json || command.optsWithGlobals().json);
-        return runOrDie(() => runAuthWhoami(json), { json });
-    });
-    auth.command('logout').description('Clear the local `agents auth login` session').action(() => runOrDie(() => runAuthLogout()));
-    setHelpSections(auth, {
-        examples: `agents auth login
-agents auth whoami
-agents auth whoami --json
-agents auth logout`,
-        notes: "`agents auth login` writes its own session, separate from \`rush login\`'s \`~/.rush/user.yaml\` — \`agents auth logout\` never signs you out of \`rush\`. If you're already signed in via \`rush login\`, \`agents auth whoami\`/\`agents org\` use that session automatically; no separate login is required.",
-    });
-}

package/dist/commands/org.d.ts

@@ -1,6 +0,0 @@
-import type { Command } from 'commander';
-/** `--role` defaults to member when omitted; anything present must be a real role — never silently coerced. */
-export declare function resolveInviteRole(raw: string | undefined): 'admin' | 'member';
-/** Validate a role argument before any network call — same rule the backend enforces server-side. */
-export declare function parseRole(raw: string): 'admin' | 'member';
-export declare function registerOrgCommand(program: Command): void;