@phnx-labs/agents-cli 1.22.44 → 1.22.45

package/dist/lib/menubar/MenubarHelper.app/Contents/_CodeSignature/CodeResources

@@ -3,9 +3,22 @@
 <plist version="1.0">
 <dict>
 	<key>files</key>
-	<dict/>
+	<dict>
+		<key>Resources/AppIcon.icns</key>
+		<data>
+		jOjZVimcFRHoP2VPzgn8uM8mjkA=
+		</data>
+	</dict>
 	<key>files2</key>
-	<dict/>
+	<dict>
+		<key>Resources/AppIcon.icns</key>
+		<dict>
+			<key>hash2</key>
+			<data>
+			GFvSLeNYJ3ASxW3OzcuiB4aID0gZUBkpozmWZkbTFNw=
+			</data>
+		</dict>
+	</dict>
 	<key>rules</key>
 	<dict>
 		<key>^Resources/</key>

package/dist/lib/startup/command-registry.d.ts

@@ -30,7 +30,8 @@ export declare const KNOWN_TOP_LEVEL_COMMANDS: ReadonlySet<string>;
  * read-only local web companion + `--control` anchor) was removed with the
  * unshipped iOS Fleet Cockpit it existed for (RUSH-3001). `apply` nested under
  * `agents fleet apply` / `agents devices apply`. `beta` nested under
- * `agents setup beta` (RUSH-2981).
+ * `agents setup beta` (RUSH-2981). `auth` and `org` (the Prix-coupled account
+ * layer) were removed pending the Phoenix-backed replacement (RUSH-2581).
  */
 export declare const RETIRED_TOP_LEVEL_COMMANDS: ReadonlySet<string>;
 export declare function isKnownTopLevelCommand(name: string): boolean;

package/dist/lib/startup/command-registry.js

@@ -1,5 +1,5 @@
 const LOADED_COMMAND_NAMES = [
-    'accounts', 'auth', 'org', 'view', 'inspect', 'feedback', 'commands', 'hooks', 'skills', 'rules', 'memory',
+    'accounts', 'view', 'inspect', 'feedback', 'commands', 'hooks', 'skills', 'rules', 'memory',
     'permissions', 'mcp', 'clis', 'subagents', 'plugins', 'workflows', 'add', 'use', 'list',
     'remove', 'rm', 'purge', 'update', 'prune', 'import', 'registry', 'search', 'install',
     'routines', 'monitors', 'projects', 'run', 'open', 'reconnect', 'fork', 'config',
@@ -50,10 +50,13 @@ export const KNOWN_TOP_LEVEL_COMMANDS = new Set([
  * read-only local web companion + `--control` anchor) was removed with the
  * unshipped iOS Fleet Cockpit it existed for (RUSH-3001). `apply` nested under
  * `agents fleet apply` / `agents devices apply`. `beta` nested under
- * `agents setup beta` (RUSH-2981).
+ * `agents setup beta` (RUSH-2981). `auth` and `org` (the Prix-coupled account
+ * layer) were removed pending the Phoenix-backed replacement (RUSH-2581).
  */
 export const RETIRED_TOP_LEVEL_COMMANDS = new Set([
     'webhook',
+    'auth',
+    'org',
     'serve',
     'login',
     'logout',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@phnx-labs/agents-cli",
-  "version": "1.22.44",
+  "version": "1.22.45",
   "description": "One CLI for all your AI coding agents - versions, config, cloud dispatch, sessions, and teams (now with first-class Grok Build CLI support)",
   "type": "module",
   "main": "dist/index.js",

package/dist/commands/auth.d.ts

@@ -1,9 +0,0 @@
-import type { Command } from 'commander';
-/**
- * `agents auth login` — RFC 8628 device-code flow against the already-shipped
- * `/api/v1/auth/device/*` routes. If the live API rejects the request shape
- * (a route this spec missed, or the endpoint moved), this fails loud with the
- * `rush login` fallback rather than silently stubbing a fake session.
- */
-export declare function runAuthLogin(): Promise<void>;
-export declare function registerAuthCommand(program: Command): void;

package/dist/commands/auth.js

@@ -1,112 +0,0 @@
-import chalk from 'chalk';
-import { setHelpSections } from '../lib/help.js';
-import { runOrDie } from '../lib/format.js';
-import { clearPrixSession, fetchWhoAmI, pollDeviceToken, PrixApiError, readPrixSession, resolvePrixToken, startDeviceAuthorization, writePrixSession, } from '../lib/prix-account.js';
-import { registerAuthSpaceCommand } from './org.js';
-function sleep(ms) {
-    return new Promise(resolve => setTimeout(resolve, ms));
-}
-/**
- * `agents auth login` — RFC 8628 device-code flow against the already-shipped
- * `/api/v1/auth/device/*` routes. If the live API rejects the request shape
- * (a route this spec missed, or the endpoint moved), this fails loud with the
- * `rush login` fallback rather than silently stubbing a fake session.
- */
-export async function runAuthLogin() {
-    let authorization;
-    try {
-        authorization = await startDeviceAuthorization();
-    }
-    catch (err) {
-        const message = err instanceof Error ? err.message : String(err);
-        const existing = resolvePrixToken();
-        if (existing?.source === 'rush') {
-            console.log(chalk.yellow(`Device login is unavailable right now (${message}), but you're already signed in via 'rush login'.`));
-            console.log("Run 'agents auth whoami' to confirm.");
-            return;
-        }
-        throw new Error(`Device login is unavailable right now (${message}). Run 'rush login' instead, then 'agents auth whoami' to confirm.`);
-    }
-    console.log(`To sign in, open:\n\n  ${chalk.cyan(authorization.verification_uri_complete)}\n`);
-    console.log(chalk.gray(`(code: ${authorization.user_code})`));
-    const deadline = Date.now() + authorization.expires_in * 1000;
-    let interval = Math.max(authorization.interval, 1) * 1000;
-    while (Date.now() < deadline) {
-        await sleep(interval);
-        const poll = await pollDeviceToken(authorization.device_code);
-        if (poll.status === 'pending')
-            continue;
-        if (poll.status === 'slow_down') {
-            interval += 1000;
-            continue;
-        }
-        if (poll.status === 'expired')
-            throw new Error('Login code expired. Run `agents auth login` again.');
-        if (poll.status === 'denied')
-            throw new Error('Login was denied.');
-        writePrixSession({
-            access_token: poll.access_token,
-            refresh_token: poll.refresh_token,
-            expires_at: poll.expires_in ? Date.now() + poll.expires_in * 1000 : undefined,
-            email: poll.user.email,
-            userId: poll.user.id,
-        });
-        console.log(chalk.green(`Signed in as ${poll.user.email}.`));
-        return;
-    }
-    throw new Error('Login code expired. Run `agents auth login` again.');
-}
-async function runAuthWhoami(json) {
-    const resolved = resolvePrixToken();
-    if (!resolved)
-        throw new Error("Not signed in. Run 'agents auth login' first.");
-    let who;
-    try {
-        who = await fetchWhoAmI(resolved.token);
-    }
-    catch (err) {
-        if (err instanceof PrixApiError && err.status === 401) {
-            throw new Error(`Signed-in token is no longer valid (${resolved.source === 'agents' ? "run 'agents auth login'" : "run 'rush login'"} again).`);
-        }
-        throw err;
-    }
-    if (json) {
-        console.log(JSON.stringify({ ...who, source: resolved.source }, null, 2));
-        return;
-    }
-    console.log(`${chalk.bold(who.email)}  ${chalk.gray(who.userId)}`);
-    console.log(chalk.gray(`signed in via ${resolved.source === 'agents' ? "'agents auth login'" : "'rush login' (shared session)"}`));
-}
-function runAuthLogout() {
-    const cleared = clearPrixSession();
-    const rushRemains = resolvePrixToken()?.source === 'rush';
-    if (!cleared && !readPrixSession()) {
-        console.log(chalk.gray('Not signed in via `agents auth login` — nothing to clear.'));
-    }
-    else {
-        console.log(chalk.green('Signed out.'));
-    }
-    if (rushRemains) {
-        console.log(chalk.gray("You're still signed in via `rush login` — `agents auth whoami` will use that session. Run `rush logout` to clear it too."));
-    }
-}
-export function registerAuthCommand(program) {
-    const auth = program.command('auth').description('Sign in to your Prix account (spaces, paid tiers)');
-    auth.command('login').description('Sign in via the device-code flow').action(() => runOrDie(() => runAuthLogin()));
-    auth.command('whoami').description('Show the signed-in account').option('--json', 'Machine-readable output')
-        .action((o, command) => {
-        const json = !!(o.json || command.optsWithGlobals().json);
-        return runOrDie(() => runAuthWhoami(json), { json });
-    });
-    auth.command('logout').description('Clear the local `agents auth login` session').action(() => runOrDie(() => runAuthLogout()));
-    registerAuthSpaceCommand(auth);
-    setHelpSections(auth, {
-        examples: `agents auth login
-agents auth whoami
-agents auth whoami --json
-agents auth logout
-agents auth space create acme-team
-agents auth space invite dev@example.com --role admin`,
-        notes: "`agents auth login` writes its own session, separate from \`rush login\`'s \`~/.rush/user.yaml\` — \`agents auth logout\` never signs you out of \`rush\`. If you're already signed in via \`rush login\`, \`agents auth whoami\`/\`agents auth space\` use that session automatically; no separate login is required. \`agents org\` is a deprecated alias of \`agents auth space\`.",
-    });
-}

package/dist/commands/org.d.ts

@@ -1,11 +0,0 @@
-import type { Command } from 'commander';
-/** `--role` defaults to member when omitted; anything present must be a real role — never silently coerced. */
-export declare function resolveInviteRole(raw: string | undefined): 'admin' | 'member';
-/** Validate a role argument before any network call — same rule the backend enforces server-side. */
-export declare function parseRole(raw: string): 'admin' | 'member';
-/** One-line deprecation for the leftover top-level `agents org` spelling. */
-export declare function printOrgDeprecation(): void;
-/** Canonical home: `agents auth space …`. */
-export declare function registerAuthSpaceCommand(auth: Command): void;
-/** Leftover top-level spelling — same tree, deprecation on every path. */
-export declare function registerOrgCommand(program: Command): void;

package/dist/commands/org.js

@@ -1,228 +0,0 @@
-import chalk from 'chalk';
-import { setHelpSections } from '../lib/help.js';
-import { runOrDie } from '../lib/format.js';
-import { createSpace, createSpaceInvite, fetchWhoAmI, listSpaceMembers, listSpaces, removeSpaceMember, resolveMemberFromList, resolvePrixToken, resolveSpaceFromList, slugify, updateSpaceMemberRole, } from '../lib/prix-account.js';
-/** Every `agents org` subcommand needs a token up front — one place to say so. */
-function requireToken() {
-    if (!resolvePrixToken())
-        throw new Error("Not signed in. Run 'agents auth login' first.");
-}
-async function resolveSpace(explicit) {
-    const spaces = await listSpaces();
-    return resolveSpaceFromList(spaces, explicit);
-}
-function printSpace(space) {
-    console.log(`${chalk.bold(space.name)}  ${chalk.gray(space.slug)}  ${chalk.gray(space.id)}`);
-    console.log(`  role: ${space.user_role}${space.organization_id ? `  org: ${space.organization_id}` : ''}`);
-}
-function printMembers(members) {
-    if (!members.length) {
-        console.log(chalk.gray('  No members.'));
-        return;
-    }
-    for (const m of members)
-        console.log(`  ${chalk.cyan(m.email)}  ${m.role}  ${chalk.gray(m.user_id)}`);
-}
-async function runCreate(name, o) {
-    requireToken();
-    const space = await createSpace({ name, slug: o.slug ?? slugify(name), description: o.description });
-    if (o.json) {
-        console.log(JSON.stringify(space, null, 2));
-        return;
-    }
-    console.log(chalk.green(`Created space '${space.name}' (${space.slug}).`));
-    printSpace(space);
-}
-async function runList(o) {
-    requireToken();
-    const spaces = await listSpaces();
-    if (o.json) {
-        console.log(JSON.stringify(spaces, null, 2));
-        return;
-    }
-    if (!spaces.length) {
-        console.log(chalk.gray("No spaces. Create one with 'agents auth space create <name>'."));
-        return;
-    }
-    for (const space of spaces)
-        printSpace(space);
-}
-async function runView(spaceArg, o) {
-    requireToken();
-    const space = await resolveSpace(spaceArg);
-    if (o.json) {
-        console.log(JSON.stringify(space, null, 2));
-        return;
-    }
-    printSpace(space);
-}
-/** `--role` defaults to member when omitted; anything present must be a real role — never silently coerced. */
-export function resolveInviteRole(raw) {
-    return raw === undefined ? 'member' : parseRole(raw);
-}
-async function runInvite(email, o) {
-    requireToken();
-    const role = resolveInviteRole(o.role);
-    const space = await resolveSpace(o.space);
-    const result = await createSpaceInvite(space.id, email, role);
-    if (o.json) {
-        console.log(JSON.stringify(result, null, 2));
-        return;
-    }
-    if (result.member_added)
-        console.log(chalk.green(`Added ${email} to '${space.name}' as ${role}.`));
-    else
-        console.log(chalk.green(`Invited ${email} to '${space.name}' as ${role}. They'll get an email.`));
-}
-async function runMembers(spaceArg, o) {
-    requireToken();
-    const space = await resolveSpace(spaceArg);
-    const members = await listSpaceMembers(space.id);
-    if (o.json) {
-        console.log(JSON.stringify(members, null, 2));
-        return;
-    }
-    console.log(chalk.bold(`${space.name} (${members.length} member${members.length === 1 ? '' : 's'})`));
-    printMembers(members);
-}
-/** Validate a role argument before any network call — same rule the backend enforces server-side. */
-export function parseRole(raw) {
-    if (raw === 'admin' || raw === 'member')
-        return raw;
-    throw new Error(`role must be 'admin' or 'member', got '${raw}'.`);
-}
-async function runRole(email, roleRaw, o) {
-    requireToken();
-    const role = parseRole(roleRaw);
-    const space = await resolveSpace(o.space);
-    const members = await listSpaceMembers(space.id);
-    const member = resolveMemberFromList(members, email);
-    const result = await updateSpaceMemberRole(space.id, member.user_id, role);
-    if (o.json) {
-        console.log(JSON.stringify(result, null, 2));
-        return;
-    }
-    console.log(chalk.green(`${email} is now ${role} in '${space.name}'.`));
-}
-async function runRemove(email, o) {
-    requireToken();
-    const space = await resolveSpace(o.space);
-    const members = await listSpaceMembers(space.id);
-    const member = resolveMemberFromList(members, email);
-    await removeSpaceMember(space.id, member.user_id);
-    if (o.json) {
-        console.log(JSON.stringify({ removed: email, space: space.slug }, null, 2));
-        return;
-    }
-    console.log(chalk.green(`Removed ${email} from '${space.name}'.`));
-}
-async function runLeave(spaceArg, o) {
-    requireToken();
-    const resolved = resolvePrixToken();
-    if (!resolved)
-        throw new Error("Not signed in. Run 'agents auth login' first.");
-    const who = await fetchWhoAmI(resolved.token);
-    const space = await resolveSpace(spaceArg);
-    if (space.owner_user_id === who.userId) {
-        throw new Error(`You own '${space.name}'. Transfer ownership or delete the space instead of leaving it.`);
-    }
-    await removeSpaceMember(space.id, who.userId);
-    if (o.json) {
-        console.log(JSON.stringify({ left: space.slug }, null, 2));
-        return;
-    }
-    console.log(chalk.green(`Left '${space.name}'.`));
-}
-/** One-line deprecation for the leftover top-level `agents org` spelling. */
-export function printOrgDeprecation() {
-    console.error(chalk.yellow('agents org is deprecated — use `agents auth space`.'));
-}
-/** Shared space CRUD tree — canonical under `auth space`, leftover under `org`. */
-function attachSpaceCommands(parent, opts) {
-    const before = () => {
-        if (opts.deprecated)
-            printOrgDeprecation();
-    };
-    const jsonFlag = (o, command) => !!(o.json || command.optsWithGlobals().json);
-    parent.command('create <name>').description('Create a space (free tier: 1 owned space)')
-        .option('--slug <slug>', 'Override the derived slug')
-        .option('--description <text>', 'Optional description')
-        .option('--json', 'Machine-readable output')
-        .action((name, o, command) => {
-        before();
-        const json = jsonFlag(o, command);
-        return runOrDie(() => runCreate(name, { ...o, json }), { json });
-    });
-    parent.command('list').description('List spaces you own or belong to').option('--json', 'Machine-readable output')
-        .action((o, command) => {
-        before();
-        const json = jsonFlag(o, command);
-        return runOrDie(() => runList({ json }), { json });
-    });
-    parent.command('view [space]').description('Show one space (defaults to your only space)').option('--json', 'Machine-readable output')
-        .action((space, o, command) => {
-        before();
-        const json = jsonFlag(o, command);
-        return runOrDie(() => runView(space, { json }), { json });
-    });
-    parent.command('invite <email>').description('Invite (or directly add) a member')
-        .option('--role <role>', 'admin | member', 'member')
-        .option('--space <id-or-slug>', 'Space to invite into (defaults to your only space)')
-        .option('--json', 'Machine-readable output')
-        .action((email, o, command) => {
-        before();
-        const json = jsonFlag(o, command);
-        return runOrDie(() => runInvite(email, { ...o, json }), { json });
-    });
-    parent.command('members [space]').description("List a space's members").option('--json', 'Machine-readable output')
-        .action((space, o, command) => {
-        before();
-        const json = jsonFlag(o, command);
-        return runOrDie(() => runMembers(space, { json }), { json });
-    });
-    parent.command('role <email> <role>').description("Change a member's role (owner-only for admin)")
-        .option('--space <id-or-slug>', 'Space to change (defaults to your only space)')
-        .option('--json', 'Machine-readable output')
-        .action((email, role, o, command) => {
-        before();
-        const json = jsonFlag(o, command);
-        return runOrDie(() => runRole(email, role, { ...o, json }), { json });
-    });
-    parent.command('remove <email>').description('Remove a member from a space')
-        .option('--space <id-or-slug>', 'Space to remove from (defaults to your only space)')
-        .option('--json', 'Machine-readable output')
-        .action((email, o, command) => {
-        before();
-        const json = jsonFlag(o, command);
-        return runOrDie(() => runRemove(email, { ...o, json }), { json });
-    });
-    parent.command('leave [space]').description('Leave a space you do not own').option('--json', 'Machine-readable output')
-        .action((space, o, command) => {
-        before();
-        const json = jsonFlag(o, command);
-        return runOrDie(() => runLeave(space, { json }), { json });
-    });
-    setHelpSections(parent, {
-        examples: `${opts.prefix} create acme-team
-${opts.prefix} list
-${opts.prefix} view acme-team
-${opts.prefix} invite dev@example.com --role admin
-${opts.prefix} members
-${opts.prefix} role dev@example.com admin
-${opts.prefix} remove dev@example.com
-${opts.prefix} leave acme-team`,
-        notes: opts.deprecated
-            ? 'Deprecated alias of `agents auth space`. Maps to the Rush backend\'s /api/v1/spaces (the free-tier team primitive), not /api/v1/orgs. Free tier: 1 owned space, 3 members per space. Every command needs `agents auth login` (or a `rush login` session) first. `--space` is only needed once you belong to more than one space.'
-            : 'Maps to the Rush backend\'s /api/v1/spaces (the free-tier team primitive), not /api/v1/orgs. Free tier: 1 owned space, 3 members per space. Every command needs `agents auth login` (or a `rush login` session) first. `--space` is only needed once you belong to more than one space. The leftover `agents org` spelling still works and prints a deprecation line.',
-    });
-}
-/** Canonical home: `agents auth space …`. */
-export function registerAuthSpaceCommand(auth) {
-    const space = auth.command('space').description('Create and manage a Prix space (invite collaborators)');
-    attachSpaceCommands(space, { prefix: 'agents auth space' });
-}
-/** Leftover top-level spelling — same tree, deprecation on every path. */
-export function registerOrgCommand(program) {
-    const org = program.command('org').description('Deprecated alias of `agents auth space` — create and manage a Prix space');
-    attachSpaceCommands(org, { prefix: 'agents org', deprecated: true });
-}

package/dist/lib/entitlement.d.ts

@@ -1,31 +0,0 @@
-/** How long a cached tier is trusted before the next call re-fetches. */
-export declare const ENTITLEMENT_CACHE_TTL_MS: number;
-export type EntitlementSource = 'live' | 'cache' | 'offline' | 'no-session';
-export interface EntitlementTier {
-    /** The raw tier name from the backend ('free', 'admin', or a paid tier name). */
-    tierName: string;
-    /** true for 'admin' or any tier name other than 'free'. */
-    isPaid: boolean;
-    /** Where this value came from — mainly for diagnostics/tests. */
-    source: EntitlementSource;
-}
-export declare function setEntitlementUserYamlPathForTest(value: string | null): void;
-export declare function setEntitlementCachePathForTest(value: string | null): void;
-export declare function setEntitlementFetchForTest(fn: typeof globalThis.fetch): void;
-export declare function entitlementCachePath(): string;
-/**
- * The live plan tier, cache-first with a TTL.
- *
- * - No `~/.rush/user.yaml` at all → free, no network call.
- * - A fresh cache entry (within {@link ENTITLEMENT_CACHE_TTL_MS}) is returned
- *   with no network call.
- * - A stale or missing cache triggers a live fetch; on success the result is
- *   cached and returned.
- * - A failed fetch (offline, timeout, non-2xx) falls back to a stale cache if
- *   one exists — never silently drops a known-paid account to free just
- *   because the network hiccuped — and only falls back to free when there is
- *   no cache at all to fall back to.
- */
-export declare function getTier(): Promise<EntitlementTier>;
-/** Per-harness account cap for a tier: 3 on free, 10 on paid/admin. */
-export declare function accountCapForTier(tier: Pick<EntitlementTier, 'isPaid'>): number;

package/dist/lib/entitlement.js

@@ -1,137 +0,0 @@
-/**
- * Plan-tier entitlement — the one place agents-cli reads a user's live billing
- * tier for plan gates (the `agents accounts` per-harness cap, the `agents
- * insights` paid split). Fetches `GET /api/v1/billing/subscription?agent=agi-cli`
- * using the Rush session token from `~/.rush/user.yaml` (same read pattern as
- * `lib/cloud/rush.ts` / `lib/secrets/drivers/rush.ts` — this module does not
- * import either, since neither exports its token reader), caches the result on
- * disk with a TTL, and stays offline-tolerant: a stale cache is honored over a
- * failed network call rather than silently dropping a paid account to free, and
- * no session file at all resolves straight to the free tier with no request.
- */
-import * as fs from 'node:fs';
-import * as os from 'node:os';
-import * as path from 'node:path';
-import * as yaml from 'yaml';
-import { getCacheDir } from './state.js';
-import { atomicWriteFileSync, ensureLockTarget, withFileLock } from './fs-atomic.js';
-const PROXY_BASE = process.env.RUSH_PROXY_BASE ?? 'https://api.prix.dev';
-const SUBSCRIPTION_PATH = '/api/v1/billing/subscription?agent=agi-cli';
-/** How long a cached tier is trusted before the next call re-fetches. */
-export const ENTITLEMENT_CACHE_TTL_MS = 15 * 60_000;
-/** Same shape as bootstrap.ts's fetchNpmPackageMetadata — a hung connection
- * (dead peer, a firewall dropping packets silently) must not block every
- * `accounts add`/`insights` call indefinitely once the cache goes stale. */
-const FETCH_TIMEOUT_MS = 5000;
-const FREE_TIER = { tierName: 'free', isPaid: false };
-// ─── Injectable seams (tests only — the lib's own real read/write paths) ────
-let userYamlPathOverride = null;
-let cachePathOverride = null;
-let fetchImpl = globalThis.fetch;
-export function setEntitlementUserYamlPathForTest(value) {
-    userYamlPathOverride = value;
-}
-export function setEntitlementCachePathForTest(value) {
-    cachePathOverride = value;
-}
-export function setEntitlementFetchForTest(fn) {
-    fetchImpl = fn;
-}
-function userYamlPath() {
-    return userYamlPathOverride ?? path.join(os.homedir(), '.rush', 'user.yaml');
-}
-export function entitlementCachePath() {
-    return cachePathOverride ?? path.join(getCacheDir(), '.entitlement-cache.json');
-}
-function readRushToken() {
-    const file = userYamlPath();
-    if (!fs.existsSync(file))
-        return null;
-    try {
-        const data = yaml.parse(fs.readFileSync(file, 'utf-8'));
-        return data?.session?.access_token || null;
-    }
-    catch {
-        return null;
-    }
-}
-function readCache() {
-    try {
-        const parsed = JSON.parse(fs.readFileSync(entitlementCachePath(), 'utf-8'));
-        if (parsed?.version === 1 && typeof parsed.tierName === 'string' && typeof parsed.fetchedAt === 'number')
-            return parsed;
-    }
-    catch {
-        // missing or corrupt — treat as no cache
-    }
-    return null;
-}
-/** Best-effort write; a failed cache write just means the next call re-fetches. */
-function writeCache(tierName, isPaid) {
-    try {
-        const target = entitlementCachePath();
-        ensureLockTarget(target);
-        withFileLock(target, () => {
-            const entry = { version: 1, tierName, isPaid, fetchedAt: Date.now() };
-            atomicWriteFileSync(target, JSON.stringify(entry, null, 2));
-        });
-    }
-    catch {
-        // best-effort
-    }
-}
-/**
- * Only `tierName: "free"` (or an absent tier name) reads as free — every other
- * name (`admin`, or a real paid-tier name once agi-cli has a pricing manifest,
- * see the integration spec §4.4 G3) is treated as paid. Backend tier config for
- * agi-cli doesn't exist yet, so this deliberately does not lean on
- * `hasSubscription`/`needsUpgrade` nuance the backend isn't populating meaningfully
- * for this agent today.
- */
-function classifySubscription(sub) {
-    const tierName = typeof sub.tierName === 'string' && sub.tierName ? sub.tierName : 'free';
-    return { tierName, isPaid: tierName !== 'free' };
-}
-/**
- * The live plan tier, cache-first with a TTL.
- *
- * - No `~/.rush/user.yaml` at all → free, no network call.
- * - A fresh cache entry (within {@link ENTITLEMENT_CACHE_TTL_MS}) is returned
- *   with no network call.
- * - A stale or missing cache triggers a live fetch; on success the result is
- *   cached and returned.
- * - A failed fetch (offline, timeout, non-2xx) falls back to a stale cache if
- *   one exists — never silently drops a known-paid account to free just
- *   because the network hiccuped — and only falls back to free when there is
- *   no cache at all to fall back to.
- */
-export async function getTier() {
-    const token = readRushToken();
-    if (!token)
-        return { ...FREE_TIER, source: 'no-session' };
-    const cached = readCache();
-    if (cached && Date.now() - cached.fetchedAt < ENTITLEMENT_CACHE_TTL_MS) {
-        return { tierName: cached.tierName, isPaid: cached.isPaid, source: 'cache' };
-    }
-    try {
-        const res = await fetchImpl(`${PROXY_BASE}${SUBSCRIPTION_PATH}`, {
-            headers: { Authorization: `Bearer ${token}` },
-            signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
-        });
-        if (!res.ok)
-            throw new Error(`billing/subscription responded ${res.status}`);
-        const sub = (await res.json());
-        const { tierName, isPaid } = classifySubscription(sub);
-        writeCache(tierName, isPaid);
-        return { tierName, isPaid, source: 'live' };
-    }
-    catch {
-        if (cached)
-            return { tierName: cached.tierName, isPaid: cached.isPaid, source: 'offline' };
-        return { ...FREE_TIER, source: 'offline' };
-    }
-}
-/** Per-harness account cap for a tier: 3 on free, 10 on paid/admin. */
-export function accountCapForTier(tier) {
-    return tier.isPaid ? 10 : 3;
-}