@phnx-labs/agents-cli 1.22.44 → 1.22.45

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 1.22.45
+
+- **BREAKING: the Prix-coupled account layer is removed — `agents auth`, `agents org`, and the plan-tier gates (RUSH-2581).** 1.22.42 shipped `agents auth login/whoami/logout` and `agents org` against the Rush product's backend (`api.prix.dev`), with `entitlement.ts` reading the Rush billing tier to cap accounts at 3-per-harness on free and to gate the `agents insights` friction sections. agents-cli's identity must not ride a separate product's login and database, so all of it is removed: `auth` and `org` are retired top-level names (they fail loudly, no auto-correct), account registration is uncapped again, `agents accounts` output drops the `dormant` field/suffix, and `agents insights` renders the full report with no `plan`/`notice` JSON fields. The Rush *feature* integrations are untouched (`cloud/rush.ts` dispatch, the opt-in secrets sync driver, the owner-notify transport). The replacement — agents-cli's own account backend with Phoenix branding, built for later Phoenix-ID consolidation — is tracked in RUSH-2581. Source: `apps/cli/src/lib/{prix-account,entitlement}.ts` (deleted), `apps/cli/src/commands/{auth,org}.ts` (deleted), `apps/cli/src/commands/{accounts,insights}.ts`, `apps/cli/src/{bootstrap.ts,cli/command-registry.ts,lib/startup/command-registry.ts}`.
+
+- **The menubar prepack gate fails closed off-Mac when the bundle has no stapled notarization ticket (RUSH-3026).** 1.22.44 was packed on a Linux box where the gate's codesign/xcrun checks silently no-op'd, so an un-stapled dev bundle shipped and Gatekeeper rejected it on every Mac ("not notarized/valid; skipping launch") — the menu bar died until a rollback to 1.22.43. `stapler staple` writes the ticket as a plain file (`Contents/CodeResources`), so its absence is provable anywhere: the gate now hard-fails the pack when it is missing and no xcrun is available, turning that failure into a pack error instead of a shipped regression. Source: `apps/cli/scripts/verify-menubar-helper.sh`.
+
+- **A Linux box can now produce the pretested release tarball — the attestation producer seeds the already-signed helper apps (RUSH-3026).** `release-attestation-produce.sh` runs in a fresh worktree whose `bin/` is empty (the signed `.app` helpers are untracked), so on any non-Mac box `npm pack` died at the prepack gates and attestation production — and therefore every release — stayed chained to a Mac. Off a macOS signing box the producer now seeds `bin/Agents CLI.app` and `bin/MenubarHelper.app` copy-if-absent from the caller checkout; the prepack gates still verify them (keychain sha pin, menubar presence), so a wrong or tampered seed fails the pack exactly as before. A Darwin producer's freshly signed apps are never overwritten. Source: `apps/cli/scripts/release-attestation-produce.sh`.
+
 ## 1.22.44
 
 - **Browser domain-skill discovery is layer-aware (RUSH-2497).** `agents browser start --url <url>` auto-loads a site-specific SKILL.md, but the lookup only ever searched the user layer (`~/.agents/skills/browser/domain-skills`), so a skill shipped in the system layer (`~/.agents/.system/skills/browser/domain-skills`) — or a project's `.agents/` — was silently invisible: the browser just opened without the guide. `resolveDomainSkill` now searches project > user > system > extra repos, first layer with a match wins, mirroring `resolveResource` precedence; `$AGENTS_BROWSER_DOMAIN_SKILLS_DIR` stays a single-root override for tests. The project layer resolves from the calling process's cwd — the shared browser daemon does not yet receive the CLI caller's cwd over IPC, so there the project layer follows the daemon's own cwd until RUSH-2996 threads it through. A miss still never breaks browser start, but now logs the roots searched at debug level (`AGENTS_DEBUG`/`DEBUG`) — the total silence is what hid this. Source: `apps/cli/src/lib/browser/domain-skills.ts`.

package/dist/bootstrap.js

@@ -264,12 +264,7 @@ Observe (read the fleet — no store merge):
   sync status                     Sync/drift only (not the live fleet snapshot)
   devices snapshot                One-process inventory + active sessions poll
 
-Identity (Prix account — shared with paid tiers):
-  auth login                      Sign in via the device-code flow
-  auth whoami                     Show the signed-in Prix user
-  auth space                      Create and manage a space (invite collaborators)
-
-Credentials (harness keys, not your Prix user):
+Credentials (harness keys):
   harness                         Custom (host CLI + model + auth) harnesses; replaces former profiles command
   secrets                         Keychain-backed env bundles; synced vault: secrets vault unlock|lock
   accounts                        Provider credentials + native OAuth logout

package/dist/cli/command-registry.d.ts

@@ -90,8 +90,6 @@ export declare const loadWebhooks: ModuleLoader;
 export declare const loadHumans: ModuleLoader;
 export declare const loadAccounts: ModuleLoader;
 export declare const loadDaemon: ModuleLoader;
-export declare const loadAuth: ModuleLoader;
-export declare const loadOrg: ModuleLoader;
 /**
  * Commands whose modules pull in the SQLite-backed session/cloud stack. They are
  * registered AFTER `applyGlobalHelpConventions` (mirroring main's order: help

package/dist/cli/command-registry.js

@@ -93,8 +93,6 @@ export const loadWebhooks = async () => (await import('../commands/webhook.js'))
 export const loadHumans = async () => (await import('../commands/humans.js')).registerHumansCommands;
 export const loadAccounts = async () => (await import('../commands/accounts.js')).registerAccountsCommand;
 export const loadDaemon = async () => (await import('../commands/daemon.js')).registerDaemonCommand;
-export const loadAuth = async () => (await import('../commands/auth.js')).registerAuthCommand;
-export const loadOrg = async () => (await import('../commands/org.js')).registerOrgCommand;
 /**
  * Commands whose modules pull in the SQLite-backed session/cloud stack. They are
  * registered AFTER `applyGlobalHelpConventions` (mirroring main's order: help
@@ -126,8 +124,6 @@ export const LAZY_COMMAND_NAMES = new Set([
  */
 export const COMMAND_LOADERS = {
     accounts: [loadAccounts],
-    auth: [loadAuth],
-    org: [loadOrg],
     view: [loadView],
     inspect: [loadInspect],
     feedback: [loadFeedback],

package/dist/commands/accounts.d.ts

@@ -30,16 +30,8 @@ export declare function parseBundleKey(raw: string): {
     bundle: string;
     key: string;
 };
-/**
- * Named accounts that `set-default` / `switch` can pin for this harness —
- * capped to the caller's plan tier (RUSH-2424). Downgrading never deletes a
- * credential: an over-cap account simply falls out of this list (see
- * {@link dormantAccountsForHarness}) and stops being a switch/rotation target
- * until the plan is upgraded.
- */
+/** Named accounts that `set-default` / `switch` can pin for this harness. */
 export declare function listSwitchableAccounts(agent: AgentId): Promise<UnifiedAccount[]>;
-/** Accounts registered for this harness beyond the plan's cap — kept, never deleted, excluded from switch/rotation, reactivated by an upgrade. */
-export declare function dormantAccountsForHarness(agent: AgentId): Promise<UnifiedAccount[]>;
 /**
  * Pin the per-harness default. Shared by `accounts set-default` and `accounts switch`.
  * Provider accounts must authenticate the harness; native accounts must belong to it.

package/dist/commands/accounts.js

@@ -17,7 +17,6 @@ import { discoverNativeAccounts } from '../lib/account-catalog.js';
 import { readAndResolveBundleEnv } from '../lib/secrets/bundles.js';
 import { getAccountProvider, listAccountProviders } from '../lib/account-provider-registry.js';
 import { accountBindings, addAccount, addNativeAccount, bindAccount, findAccount, findUnifiedAccount, inspectAccount, listNativeAccounts, readAccountRegistry, removeAccount, renameAccount, setAccountSecret, unbindAccount } from '../lib/account-registry.js';
-import { accountCapForTier, getTier } from '../lib/entitlement.js';
 function parseInstallation(raw) {
     const at = raw.lastIndexOf('@');
     if (at < 1 || at === raw.length - 1)
@@ -74,8 +73,8 @@ function secretFromBundle(raw) {
     const { bundle, key } = parseBundleKey(raw);
     return readAndResolveBundleEnv(bundle, { keys: [key], keyMode: 'storage', agentOnly: true, caller: 'accounts import' }).env[key];
 }
-function publicAccount(account, dormant) {
-    return { kind: 'provider', id: account.id, name: account.name, provider: account.provider, auth: account.auth, baseUrl: account.baseUrl, policy: account.policy, secretPresent: account.secretPresent, dormant };
+function publicAccount(account) {
+    return { kind: 'provider', id: account.id, name: account.name, provider: account.provider, auth: account.auth, baseUrl: account.baseUrl, policy: account.policy, secretPresent: account.secretPresent };
 }
 async function printAccounts(json, fleet = false) {
     if (fleet)
@@ -83,16 +82,12 @@ async function printAccounts(json, fleet = false) {
     const records = Object.values(readAccountRegistry().accounts).sort((a, b) => a.name.localeCompare(b.name));
     const discovered = await discoverNativeAccounts();
     const savedNative = listNativeAccounts(readMeta());
-    const dormantIds = new Set();
-    for (const agent of ALL_AGENT_IDS)
-        for (const account of await dormantAccountsForHarness(agent))
-            dormantIds.add(account.id);
     const native = discovered.map(row => {
         const saved = savedNative.find(account => account.agent === row.agent && account.identityKey === row.id);
-        return { ...row, name: saved?.name, id: saved?.id ?? row.id, dormant: !!saved && dormantIds.has(saved.id) };
+        return { ...row, name: saved?.name, id: saved?.id ?? row.id };
     });
     if (json) {
-        console.log(JSON.stringify([...records.map(account => publicAccount(inspectAccount(account.name), dormantIds.has(account.id))), ...native], null, 2));
+        console.log(JSON.stringify([...records.map(account => publicAccount(inspectAccount(account.name))), ...native], null, 2));
         return;
     }
     console.log(chalk.bold('Provider account bundles\n'));
@@ -100,14 +95,13 @@ async function printAccounts(json, fleet = false) {
         console.log(chalk.gray("  None. Add one with 'agents accounts add <name> --provider <provider> --auth <type>'."));
     for (const account of records) {
         const present = inspectAccount(account.name).secretPresent ? chalk.green('ready') : chalk.red('missing on this device');
-        const dormantSuffix = dormantIds.has(account.id) ? chalk.gray('  — dormant (upgrade to reactivate)') : '';
-        console.log(`  ${chalk.cyan(account.name)}  ${account.provider}  ${account.auth}  ${present}${dormantSuffix}`);
+        console.log(`  ${chalk.cyan(account.name)}  ${account.provider}  ${account.auth}  ${present}`);
     }
     console.log(chalk.bold('\nNative harness logins\n'));
     if (!native.length)
         console.log(chalk.gray('  No signed-in native accounts found.'));
     for (const account of native)
-        console.log(`  ${account.name ? `${chalk.cyan(account.name)} · ` : ''}${account.display}  ${account.agent}  ${account.versions.join(', ')}${account.dormant ? chalk.gray('  — dormant (upgrade to reactivate)') : ''}`);
+        console.log(`  ${account.name ? `${chalk.cyan(account.name)} · ` : ''}${account.display}  ${account.agent}  ${account.versions.join(', ')}`);
 }
 function parseAuth(raw) {
     if (raw === 'api-key' || raw === 'setup-token' || raw === 'bearer-token')
@@ -131,7 +125,7 @@ function providerAuthenticatesHarness(provider, auth, agent) {
         throw err;
     }
 }
-/** Every account (native + provider) registered/usable for this harness, oldest-first by name — the full set a plan-tier cap slices into active vs dormant. */
+/** Every account (native + provider) registered/usable for this harness, oldest-first by name. */
 function accountsForHarness(agent) {
     const meta = readMeta();
     const native = listNativeAccounts(meta).filter(account => account.agent === agent);
@@ -140,52 +134,9 @@ function accountsForHarness(agent) {
         .map(account => ({ ...account, kind: 'provider' }));
     return [...native, ...providers].sort((a, b) => a.name.localeCompare(b.name));
 }
-/**
- * Named accounts that `set-default` / `switch` can pin for this harness —
- * capped to the caller's plan tier (RUSH-2424). Downgrading never deletes a
- * credential: an over-cap account simply falls out of this list (see
- * {@link dormantAccountsForHarness}) and stops being a switch/rotation target
- * until the plan is upgraded.
- */
+/** Named accounts that `set-default` / `switch` can pin for this harness. */
 export async function listSwitchableAccounts(agent) {
-    const cap = accountCapForTier(await getTier());
-    return accountsForHarness(agent).slice(0, cap);
-}
-/** Accounts registered for this harness beyond the plan's cap — kept, never deleted, excluded from switch/rotation, reactivated by an upgrade. */
-export async function dormantAccountsForHarness(agent) {
-    const cap = accountCapForTier(await getTier());
-    return accountsForHarness(agent).slice(cap);
-}
-function accountCapRefusalMessage(agent, tier, cap) {
-    if (!tier.isPaid)
-        return `free plan is capped at 3 ${agent} accounts (3/3). agents upgrade — up to 10 per harness.`;
-    return `${tier.tierName} plan is capped at ${cap} ${agent} accounts (${cap}/${cap}).`;
-}
-/**
- * Refuse BEFORE any write when adding a new account would push one of
- * `harnesses` over the caller's plan cap. Returns the tier/cap/pre-add counts
- * so the caller can print the exactly-at-cap notice after a successful write.
- */
-async function assertAccountCapacityFor(harnesses) {
-    const tier = await getTier();
-    const cap = accountCapForTier(tier);
-    const existing = new Map();
-    for (const harness of harnesses)
-        existing.set(harness, accountsForHarness(harness).length);
-    const capped = harnesses.find(harness => (existing.get(harness) ?? 0) >= cap);
-    if (capped)
-        throw new Error(accountCapRefusalMessage(capped, tier, cap));
-    return { tier, cap, existing };
-}
-/** One-line, non-blocking notice for every harness a free-tier add just brought to exactly its cap. */
-function printCapNoticesFor(harnesses, tier, cap, existing) {
-    if (tier.isPaid)
-        return;
-    for (const harness of harnesses) {
-        if ((existing.get(harness) ?? 0) + 1 === cap) {
-            console.log(chalk.yellow(`${cap}/${cap} ${harness} accounts on the free plan. agents upgrade — up to 10 per harness.`));
-        }
-    }
+    return accountsForHarness(agent);
 }
 /**
  * Pin the per-harness default. Shared by `accounts set-default` and `accounts switch`.
@@ -279,16 +230,10 @@ export function registerAccountsCommand(program) {
         const provider = getAccountProvider(o.provider);
         if (!provider.authKinds.includes(auth))
             throw new Error(`Provider '${provider.provider}' does not support ${auth}. Supported: ${provider.authKinds.join(', ')}.`);
-        // A provider account may authenticate more than one harness (e.g. openrouter);
-        // it counts toward every harness it can authenticate, so refuse before any
-        // write if adding it would push ANY of those harnesses over the plan cap.
-        const harnesses = ALL_AGENT_IDS.filter(h => providerAuthenticatesHarness(provider.provider, auth, h));
-        const { tier, cap, existing } = await assertAccountCapacityFor(harnesses);
         const secret = o.fromSecrets ? secretFromBundle(o.fromSecrets) : await password({ message: `Enter ${provider.provider} ${auth} for '${name}':` });
         const account = addAccount(name, provider.provider, auth, secret, undefined, { baseUrl: o.baseUrl });
         console.log(chalk.green(`Added ${account.provider} ${account.auth} account '${account.name}'.`));
         console.log(chalk.gray(`Secret bundle '${account.name}' is the account and uses policy never, so agent launches never request Touch ID.`));
-        printCapNoticesFor(harnesses, tier, cap, existing);
     });
     accounts.command('set-key <name>')
         .description('Rotate an account credential without changing its identity')
@@ -306,22 +251,12 @@ export function registerAccountsCommand(program) {
         const unified = findUnifiedAccount(name, meta);
         if (!unified)
             throw new Error(`Unknown account '${name}'.`);
-        const harnesses = unified.kind === 'provider'
-            ? ALL_AGENT_IDS.filter(h => providerAuthenticatesHarness(unified.provider, unified.auth, h))
-            : [unified.agent];
-        let dormant = false;
-        for (const harness of harnesses) {
-            if ((await dormantAccountsForHarness(harness)).some(a => a.id === unified.id)) {
-                dormant = true;
-                break;
-            }
-        }
         const account = unified.kind === 'provider'
-            ? { ...publicAccount(inspectAccount(unified.name), dormant), custody: 'agents secrets (policy never)', attached: accountBindings(unified.id, meta) }
-            : { ...unified, dormant, custody: `${unified.agent} (not stored by agents-cli)`, attached: accountBindings(unified.id, meta) };
+            ? { ...publicAccount(inspectAccount(unified.name)), custody: 'agents secrets (policy never)', attached: accountBindings(unified.id, meta) }
+            : { ...unified, custody: `${unified.agent} (not stored by agents-cli)`, attached: accountBindings(unified.id, meta) };
         if (o.json || command.optsWithGlobals().json)
             return console.log(JSON.stringify(account, null, 2));
-        console.log(chalk.bold(account.name) + (account.dormant ? chalk.gray('  — dormant (upgrade to reactivate)') : ''));
+        console.log(chalk.bold(account.name));
         console.log(`  kind: ${account.kind}`);
         console.log(`  id: ${account.id}`);
         console.log(`  custody: ${account.custody}`);
@@ -340,12 +275,10 @@ export function registerAccountsCommand(program) {
         .description('Name a signed-in native installation without copying its OAuth credentials')
         .action(async (source, name) => {
         const identity = await nativeIdentityFromSource(source);
-        const { tier, cap, existing } = await assertAccountCapacityFor([identity.agent]);
         const account = addNativeAccount(name, identity.agent, identity.identityKey, identity.identityLabel, identity.scope);
         console.log(chalk.green(`Named ${source} as ${account.name}.`));
         if (account.scope === 'device')
             console.log(chalk.gray(`${identity.agent} authentication is device-scoped; attach '${account.name}' to '${identity.agent}', not an individual version.`));
-        printCapNoticesFor([identity.agent], tier, cap, existing);
     });
     accounts.command('attach <account> <target>')
         .description('Attach a named account to a native installation or custom harness')
@@ -383,17 +316,6 @@ export function registerAccountsCommand(program) {
             // Provider account: it must be able to authenticate the target's harness.
             getAccountProvider(account.provider).envFor(targetAgent, account.auth);
         }
-        // Defense-in-depth cap check: by the point we get here `account` already
-        // authenticates/belongs to `targetAgent` (validated above), so it is
-        // already counted in accountsForHarness(targetAgent) from its `add`/`name`
-        // time — this can only refuse if that invariant is ever violated, never a
-        // normal re-attach of an account the harness is already at cap with.
-        const tier = await getTier();
-        const cap = accountCapForTier(tier);
-        const alreadyCounted = accountsForHarness(targetAgent).some(existing => existing.id === account.id);
-        const otherCount = accountsForHarness(targetAgent).length - (alreadyCounted ? 1 : 0);
-        if (otherCount >= cap)
-            throw new Error(accountCapRefusalMessage(targetAgent, tier, cap));
         bindAccount(name, target);
         console.log(chalk.green(`Attached ${account.name} to ${target}.`));
     });

package/dist/commands/insights.js

@@ -49,24 +49,7 @@ import { terminalWidth, truncateToWidth, stringWidth, padToWidth } from '../lib/
 import { registerMixCommands } from '../lib/analytics/mix-commands.js';
 import { registerCostCommand } from './cost.js';
 import { registerOutputCommand } from './output.js';
-import { getTier } from '../lib/entitlement.js';
 const execFileAsync = promisify(execFile);
-/**
- * Plan-tier gate for the behavioural report (RUSH-2424). Free keeps top-line
- * counts and the harness mix (and `insights mix` / `agents perf`, which never
- * enter this file's gating since they're separate command trees); the
- * friction/correction-signal sections, grouping `--by account`, and
- * `--narrative` are paid. `insights mix`/`cost`/`output` are unaffected — this
- * gate applies only to the default behavioural report.
- */
-const PAID_PLAN_NOTICE = 'Friction and account-split analysis are on the paid plan.';
-function resolveInsightsGate(tier, dim) {
-    return {
-        tier,
-        groupGated: !tier.isPaid && dim === 'account',
-        frictionGated: !tier.isPaid,
-    };
-}
 function collectAgent(value, previous) {
     return [...previous, value];
 }
@@ -225,7 +208,7 @@ function renderHours(hours, out) {
     out.push(`  ${chalk.cyan(spark)}`);
     out.push(`  ${chalk.gray('0h'.padEnd(6))}${chalk.gray('6h'.padEnd(6))}${chalk.gray('12h'.padEnd(6))}${chalk.gray('18h'.padEnd(5))}${chalk.gray('23h')}`);
 }
-function renderReport(groups, dim, meta, actions, harnesses, gate) {
+function renderReport(groups, dim, meta, actions, harnesses) {
     const out = [];
     const scope = meta.since ? `last ${meta.since}` : 'all time';
     out.push(chalk.bold('Insights') + chalk.gray(`  ${scope} · ${meta.analyzed} of ${meta.scanned} sessions`));
@@ -235,44 +218,28 @@ function renderReport(groups, dim, meta, actions, harnesses, gate) {
         console.log(out.join('\n'));
         return;
     }
-    let noticePrinted = false;
-    const printPlanNotice = () => {
-        if (noticePrinted)
-            return;
-        noticePrinted = true;
-        out.push('');
-        out.push(chalk.gray(`  ${PAID_PLAN_NOTICE}`));
-    };
     // Per-group table — the headline, and the thing no sibling command produces.
     // Includes silent-stall counts so harness/account laziness is visible without --json.
-    // Gated on the free plan when grouped `--by account` (the default) — see resolveInsightsGate.
-    if (gate.groupGated) {
-        printPlanNotice();
-    }
-    else {
-        out.push('');
-        out.push(chalk.bold(`By ${dim}`));
-        const labelW = Math.min(Math.max(...groups.map((g) => stringWidth(g.label)), 5), Math.max(16, terminalWidth() - 58));
-        const sessW = Math.max(...groups.map((g) => String(g.sessions).length), 3);
-        // Friction-derived — never shown on the free plan, even when grouping by
-        // something other than account (gate.groupGated only covers `--by account`).
-        const stallOf = (g) => Object.entries(g.facets.frictionSignals)
-            .filter(([k]) => k.startsWith('silent stall:'))
-            .reduce((n, [, c]) => n + c, 0);
-        const resumeOf = (g) => g.facets.correctionSignals['resume after silent stall'] ?? 0;
-        const stallW = gate.frictionGated ? 6 : Math.max(...groups.map((g) => String(stallOf(g)).length), 5);
-        out.push(chalk.gray(`  ${padToWidth('', labelW)}  ${''.padStart(sessW)}       ` +
-            `${''.padStart(9)}  ${''.padStart(8)}  ${gate.frictionGated ? ''.padStart(stallW) : 'stalls'.padStart(stallW)}  ${gate.frictionGated ? '' : 'resume'}`));
-        for (const g of groups) {
-            const cost = g.costUsd > 0 ? formatUsd(g.costUsd) : '—';
-            const dur = g.durationMs > 0 ? formatDuration(g.durationMs) : '—';
-            const stalls = gate.frictionGated ? '—' : String(stallOf(g));
-            const resumes = gate.frictionGated ? '' : String(resumeOf(g));
-            out.push(`  ${padToWidth(truncateToWidth(g.label, labelW), labelW)}  ` +
-                `${chalk.gray(String(g.sessions).padStart(sessW))} ${chalk.gray('sess')}  ` +
-                `${chalk.green(padToWidth(cost, 9))}  ${chalk.gray(padToWidth(dur, 8))}  ` +
-                `${chalk.cyan(stalls.padStart(stallW))}  ${chalk.cyan(resumes)}`);
-        }
+    out.push('');
+    out.push(chalk.bold(`By ${dim}`));
+    const labelW = Math.min(Math.max(...groups.map((g) => stringWidth(g.label)), 5), Math.max(16, terminalWidth() - 58));
+    const sessW = Math.max(...groups.map((g) => String(g.sessions).length), 3);
+    const stallOf = (g) => Object.entries(g.facets.frictionSignals)
+        .filter(([k]) => k.startsWith('silent stall:'))
+        .reduce((n, [, c]) => n + c, 0);
+    const resumeOf = (g) => g.facets.correctionSignals['resume after silent stall'] ?? 0;
+    const stallW = Math.max(...groups.map((g) => String(stallOf(g)).length), 5);
+    out.push(chalk.gray(`  ${padToWidth('', labelW)}  ${''.padStart(sessW)}       ` +
+        `${''.padStart(9)}  ${''.padStart(8)}  ${'stalls'.padStart(stallW)}  resume`));
+    for (const g of groups) {
+        const cost = g.costUsd > 0 ? formatUsd(g.costUsd) : '—';
+        const dur = g.durationMs > 0 ? formatDuration(g.durationMs) : '—';
+        const stalls = String(stallOf(g));
+        const resumes = String(resumeOf(g));
+        out.push(`  ${padToWidth(truncateToWidth(g.label, labelW), labelW)}  ` +
+            `${chalk.gray(String(g.sessions).padStart(sessW))} ${chalk.gray('sess')}  ` +
+            `${chalk.green(padToWidth(cost, 9))}  ${chalk.gray(padToWidth(dur, 8))}  ` +
+            `${chalk.cyan(stalls.padStart(stallW))}  ${chalk.cyan(resumes)}`);
     }
     // Everything below is the whole scope folded together; per-group detail is in --json.
     const all = newFacetAccumulator();
@@ -281,64 +248,54 @@ function renderReport(groups, dim, meta, actions, harnesses, gate) {
     renderCounts('Top tools', topEntries(all.toolCounts, 8), out);
     renderCounts('Languages', topEntries(all.languages, 6), out);
     renderCounts('Models', topEntries(all.models, 6), out);
-    // Friction — the section that earns the command. Paid plan only (RUSH-2424);
-    // top-line counts and harness mix above/below stay free.
-    if (gate.frictionGated) {
-        printPlanNotice();
+    // Friction — the section that earns the command.
+    renderCounts('Silent stalls by model', topEntries(all.silentStallsByModel ?? {}, 8), out);
+    const gaps = all.responseGaps;
+    const silentStalls = Object.entries(all.frictionSignals)
+        .filter(([k]) => k.startsWith('silent stall:'))
+        .reduce((n, [, c]) => n + c, 0);
+    const resumeNudges = all.correctionSignals['resume after silent stall'] ?? 0;
+    out.push('');
+    out.push(chalk.bold('Friction'));
+    out.push(`  ${padToWidth('interruptions', 18)}  ${chalk.cyan(String(all.interruptions))}` +
+        chalk.gray('   turns you cut short'));
+    out.push(`  ${padToWidth('tool errors', 18)}  ${chalk.cyan(String(all.errorCount))}`);
+    if (gaps.length > 0) {
+        // Same timestamps as silent stalls; this line is the distribution. Silent
+        // stalls (below) are the agent-attributed long gaps after the model stopped.
+        out.push(`  ${padToWidth('gap until next msg', 18)}  ` +
+            chalk.cyan(`p50 ${Math.round(percentile(gaps, 50))}s`) + chalk.gray(` · p90 ${Math.round(percentile(gaps, 90))}s`) +
+            chalk.gray('   after assistant last spoke'));
     }
-    else {
-        renderCounts('Silent stalls by model', topEntries(all.silentStallsByModel ?? {}, 8), out);
-        const gaps = all.responseGaps;
-        const silentStalls = Object.entries(all.frictionSignals)
-            .filter(([k]) => k.startsWith('silent stall:'))
-            .reduce((n, [, c]) => n + c, 0);
-        const resumeNudges = all.correctionSignals['resume after silent stall'] ?? 0;
-        out.push('');
-        out.push(chalk.bold('Friction'));
-        out.push(`  ${padToWidth('interruptions', 18)}  ${chalk.cyan(String(all.interruptions))}` +
-            chalk.gray('   turns you cut short'));
-        out.push(`  ${padToWidth('tool errors', 18)}  ${chalk.cyan(String(all.errorCount))}`);
-        if (gaps.length > 0) {
-            // Same timestamps as silent stalls; this line is the distribution. Silent
-            // stalls (below) are the agent-attributed long gaps after the model stopped.
-            out.push(`  ${padToWidth('gap until next msg', 18)}  ` +
-                chalk.cyan(`p50 ${Math.round(percentile(gaps, 50))}s`) + chalk.gray(` · p90 ${Math.round(percentile(gaps, 90))}s`) +
-                chalk.gray('   after assistant last spoke'));
-        }
-        if (silentStalls > 0) {
-            out.push(`  ${padToWidth('silent stalls', 18)}  ${chalk.cyan(String(silentStalls))}` +
-                chalk.gray('   agent idle ≥5m until you resumed (also in By ' + dim + ' table)'));
-        }
-        if (resumeNudges > 0) {
-            out.push(`  ${padToWidth('resume nudges', 18)}  ${chalk.cyan(String(resumeNudges))}` +
-                chalk.gray('   "continue"/"keep going" after a silent stall'));
-        }
-        const errs = topEntries(all.errorCategories, 6);
-        if (errs.length > 0) {
-            for (const e of errs)
-                out.push(`    ${chalk.gray('·')} ${padToWidth(e.name, 16)} ${chalk.gray(String(e.count))}`);
-        }
-        renderCounts('Friction / thrash', topEntries(all.frictionSignals, 10), out);
-        renderCounts('Dissatisfaction / corrections', topEntries(all.correctionSignals, 10), out);
+    if (silentStalls > 0) {
+        out.push(`  ${padToWidth('silent stalls', 18)}  ${chalk.cyan(String(silentStalls))}` +
+            chalk.gray('   agent idle ≥5m until you resumed (also in By ' + dim + ' table)'));
+    }
+    if (resumeNudges > 0) {
+        out.push(`  ${padToWidth('resume nudges', 18)}  ${chalk.cyan(String(resumeNudges))}` +
+            chalk.gray('   "continue"/"keep going" after a silent stall'));
+    }
+    const errs = topEntries(all.errorCategories, 6);
+    if (errs.length > 0) {
+        for (const e of errs)
+            out.push(`    ${chalk.gray('·')} ${padToWidth(e.name, 16)} ${chalk.gray(String(e.count))}`);
     }
+    renderCounts('Friction / thrash', topEntries(all.frictionSignals, 10), out);
+    renderCounts('Dissatisfaction / corrections', topEntries(all.correctionSignals, 10), out);
     renderCounts('Automatable repeats', topEntries(all.automationSignals, 10), out);
     renderCounts('Harness split', harnesses, out);
     // Actions are built from frictionSignals/correctionSignals/automationSignals
-    // together (buildInsightActions) — evidence counts, sample session ids, and
-    // the action text itself describe the same paid friction/correction
-    // categories gated above, so the whole section is paid too (RUSH-2424).
-    if (!gate.frictionGated) {
-        out.push('');
-        out.push(chalk.bold('Actions'));
-        if (actions.length === 0) {
-            out.push(chalk.gray('  No repeated action pattern met the evidence threshold in this window.'));
-        }
-        else {
-            out.push(chalk.gray('  pri     category    evidence  sample sessions  action'));
-            for (const action of actions.slice(0, 12)) {
-                out.push(`  ${padToWidth(action.priority, 7)} ${padToWidth(action.category, 11)} ` +
-                    `${String(action.evidenceCount).padStart(8)}  ${padToWidth(action.sampleSessionIds.join(', '), 25)} ${action.action}`);
-            }
+    // together (buildInsightActions).
+    out.push('');
+    out.push(chalk.bold('Actions'));
+    if (actions.length === 0) {
+        out.push(chalk.gray('  No repeated action pattern met the evidence threshold in this window.'));
+    }
+    else {
+        out.push(chalk.gray('  pri     category    evidence  sample sessions  action'));
+        for (const action of actions.slice(0, 12)) {
+            out.push(`  ${padToWidth(action.priority, 7)} ${padToWidth(action.category, 11)} ` +
+                `${String(action.evidenceCount).padStart(8)}  ${padToWidth(action.sampleSessionIds.join(', '), 25)} ${action.action}`);
         }
     }
     // Output
@@ -394,9 +351,7 @@ function renderReport(groups, dim, meta, actions, harnesses, gate) {
             out.push('');
         out.push(chalk.yellow(`  ${meta.unreadable} transcripts could not be read; their behaviour is missing from these totals.`));
     }
-    // Friction-derived (gapsOverCeiling is a PAID_FACET_KEYS entry) and names
-    // "silent stall" outright — must not render on the free plan.
-    if (!gate.frictionGated && all.gapsOverCeiling > 0) {
+    if (all.gapsOverCeiling > 0) {
         out.push(chalk.gray(`  ${all.gapsOverCeiling} gaps over an hour excluded from p50/p90 (still counted as silent stall: 1h+ when the assistant last spoke).`));
     }
     out.push('');
@@ -451,23 +406,8 @@ async function renderNarrative(payload) {
         process.exitCode = 1;
     }
 }
-/** Facet keys that belong to the paid friction/correction sections — stripped from `--json` on free (RUSH-2424). */
-const PAID_FACET_KEYS = new Set([
-    'frictionSignals', 'correctionSignals', 'silentStallsByModel',
-    'interruptions', 'errorCount', 'errorCategories', 'responseGaps', 'gapsOverCeiling',
-]);
-function freeFacetSubset(facets) {
-    const out = {};
-    for (const [key, value] of Object.entries(facets)) {
-        if (!PAID_FACET_KEYS.has(key))
-            out[key] = value;
-    }
-    return out;
-}
 async function insightsAction(options) {
     const dim = resolveGroup(options.by);
-    const tier = await getTier();
-    const gate = resolveInsightsGate(tier, dim);
     const minMessages = Number.parseInt(options.minMessages ?? '2', 10);
     if (!Number.isFinite(minMessages) || minMessages < 0) {
         console.error(chalk.red('error: --min-messages must be a non-negative integer'));
@@ -533,37 +473,31 @@ async function insightsAction(options) {
             unreadable,
             minMessages,
             by: dim,
-            plan: { tierName: tier.tierName, isPaid: tier.isPaid },
-            ...(gate.groupGated || gate.frictionGated ? { notice: PAID_PLAN_NOTICE } : {}),
             overlap,
             // Built from frictionSignals/correctionSignals/automationSignals together
             // (buildInsightActions) — same paid friction/correction data as above.
-            actions: gate.frictionGated ? null : actions,
+            actions,
             harnesses,
-            groups: gate.groupGated ? null : groups.map((g) => ({
+            groups: groups.map((g) => ({
                 key: g.key,
                 label: g.label,
                 sessions: g.sessions,
                 costUsd: g.costUsd,
                 durationMs: g.durationMs,
                 outputTokens: g.outputTokens,
-                ...(gate.frictionGated ? freeFacetSubset(g.facets) : {
+                ...{
                     ...g.facets,
                     responseGapP50: Math.round(percentile(g.facets.responseGaps, 50)),
                     responseGapP90: Math.round(percentile(g.facets.responseGaps, 90)),
                     responseGapBuckets: bucketGaps(g.facets.responseGaps),
                     // The raw sample is large and uninteresting once bucketed.
                     responseGaps: undefined,
-                }),
+                },
             })),
         };
         console.log(JSON.stringify(payload, null, 2));
-        if (options.narrative) {
-            if (!tier.isPaid)
-                console.error(chalk.gray(`  ${PAID_PLAN_NOTICE}`));
-            else
-                await renderNarrative(payload);
-        }
+        if (options.narrative)
+            await renderNarrative(payload);
         return;
     }
     renderReport(groups, dim, {
@@ -574,24 +508,18 @@ async function insightsAction(options) {
         unreadable,
         minMessages,
         overlap,
-    }, actions, harnesses, gate);
+    }, actions, harnesses);
     if (options.narrative) {
-        if (!tier.isPaid) {
-            console.log('');
-            console.log(chalk.gray(`  ${PAID_PLAN_NOTICE}`));
-        }
-        else {
-            await renderNarrative(groups.map((g) => ({
-                account: g.label, sessions: g.sessions, costUsd: g.costUsd,
-                topTools: topEntries(g.facets.toolCounts, 8),
-                languages: topEntries(g.facets.languages, 6),
-                errorCategories: topEntries(g.facets.errorCategories, 6),
-                interruptions: g.facets.interruptions,
-                linesTouchedAfter: g.facets.linesTouchedAfter, linesTouchedBefore: g.facets.linesTouchedBefore,
-                gitCommits: g.facets.gitCommits,
-                replyP50s: Math.round(percentile(g.facets.responseGaps, 50)),
-            })));
-        }
+        await renderNarrative(groups.map((g) => ({
+            account: g.label, sessions: g.sessions, costUsd: g.costUsd,
+            topTools: topEntries(g.facets.toolCounts, 8),
+            languages: topEntries(g.facets.languages, 6),
+            errorCategories: topEntries(g.facets.errorCategories, 6),
+            interruptions: g.facets.interruptions,
+            linesTouchedAfter: g.facets.linesTouchedAfter, linesTouchedBefore: g.facets.linesTouchedBefore,
+            gitCommits: g.facets.gitCommits,
+            replyP50s: Math.round(percentile(g.facets.responseGaps, 50)),
+        })));
     }
 }
 function configureInsightsCommand(cmd) {

package/dist/lib/menubar/MenubarHelper.app/Contents/Info.plist

@@ -7,7 +7,11 @@
     <key>CFBundleIdentifier</key>
     <string>com.phnx-labs.agents-menubar</string>
     <key>CFBundleName</key>
-    <string>Agents Menu Bar</string>
+    <string>AGI Menu</string>
+    <key>CFBundleDisplayName</key>
+    <string>AGI Menu</string>
+    <key>CFBundleIconFile</key>
+    <string>AppIcon</string>
     <key>CFBundlePackageType</key>
     <string>APPL</string>
     <key>CFBundleShortVersionString</key>