@phnx-labs/agents-cli 1.22.44 → 1.22.46

package/CHANGELOG.md

@@ -1,5 +1,37 @@
 # Changelog
 
+## 1.22.46
+
+- **`agents auth` returns, against Phoenix ID instead of a sibling product's backend (RUSH-2581).** 1.22.45 removed the account layer that authenticated against Rush's `api.prix.dev`. It comes back pointed at **Phoenix ID** (`phnx-labs/phoenix-id`), agents-cli's own account service: `agents auth login` runs a device-code flow whose browser page is Phoenix-branded and Google-only, `agents auth whoami` reports the signed-in account, `agents auth logout` clears **this machine** and nothing else, and the team surface nests as `agents auth space` (`list`/`create`/`members`/`invite`/`role`/`remove`). Everything goes through one new seam, `lib/identity/` — one base URL (`PHOENIX_ID_BASE`), one session file, one HTTP funnel, one error type — replacing the shape that had the backend URL hardcoded in five files and the session token re-read by seven separate functions. agents-cli reads no other product's credentials: there is no `~/.rush/user.yaml` fallback. Source: `apps/cli/src/lib/identity/{client,index}.ts`, `apps/cli/src/commands/auth.ts`.
+
+- **`agents auth` points at the deployed Phoenix ID service (RUSH-2581).** The `PHOENIX_ID_BASE` default shipped naming `id.phnx.sh`, a domain that was never registered, so every `agents auth login` would have failed DNS with nothing behind it. It now defaults to the live service (a `workers.dev` URL until a custom hostname is attached). Override it with `PHOENIX_ID_BASE` to point at a local backend. Source: `apps/cli/src/lib/identity/client.ts`.
+
+- **The menu-bar prepack gate hard-fails on an unstapled or thin helper on any OS (RUSH-3031).** `verify-menubar-helper.sh`'s notarization check used to silently no-op when `xcrun` was absent — the exact case a Linux attestation-producer box hits — which let 1.22.44 ship a Dev-ID-signed but un-stapled, thin (single-arch) `MenubarHelper.app` that Gatekeeper rejected on every Mac. The gate now hard-fails when the stapled ticket (`Contents/CodeResources`) is missing and `xcrun` is unavailable, and hard-fails when the bundled executable is not a universal (fat) Mach-O binary, checked portably with `od` on any platform. Source: `apps/cli/scripts/verify-menubar-helper.sh`.
+- **The release-attestation producer no longer arms the real-`~/.agents` hermeticity guards it needs to get vitest's extended timeout profile (RUSH-3007).** `CI=true` used to control both the vitest hookTimeout/ignore-pool-error profile AND `tests/setup.ts`'s leak tripwires against the real developer home — so a producer run on a box with a live daemon (e.g. mac-mini) false-failed 129/129 test files on a fully green, 12,559/12,559-test suite. `release-attestation-produce.sh` now sets `AGENTS_ATTEST_PRODUCER=1` (and unsets any ambient `CI`) to opt into the timeout profile without arming the guards; a genuine CI runner's behavior is unchanged. Source: `apps/cli/scripts/release-attestation-produce.sh`, `apps/cli/tests/hermetic-guards.ts`, `apps/cli/tests/setup.ts`, `apps/cli/vitest.config.ts`.
+
+- **Rotation remembers a tokens/credits-exhausted account instead of re-picking it every launch (RUSH-3018).**
+  A rate limit resets on a clock; running *out of credits / hitting a spend cap*
+  does not — yet the two were conflated. A billing refusal (`out of usage credits`,
+  `monthly spend limit`) was detected only to trigger one failover and then
+  forgotten, so balanced rotation re-picked the dead account on the next launch,
+  it refused again, failed over again — burning a launch each time. It now
+  persists a clock-less `out_of_credits` marker per account
+  (`noteClaudeOutOfCredits`), which the rotation eligibility gate treats as
+  blocking until a later **successful** run on that account clears it
+  (`clearClaudeAccountRefusal`) — never a timestamp. Session/rate limits are
+  unchanged (still recover on their reset). Source:
+  `apps/cli/src/lib/accounting/usage.ts`, `apps/cli/src/lib/exec.ts`.
+
+- **Harness capability probes can no longer leak grandchild processes (RUSH-3028).** The version probe behind `agents view` (`<cli> --version`) and the async manifest `check:` runner executed third-party binaries whose own forked children could outlive the probe — the GitHub Copilot npm wrapper forks a platform-binary downloader into `~/Library/Caches/copilot`, and under a redirected test HOME that survivor raced teardown `rm` (the dominant residual ENOTEMPTY suite flake after RUSH-3021). Probes now run in their own process group via `probeCapture`, and the whole group is reaped when the probe settles — on clean exit, on timeout, and on parent death (a `process.on('exit')` hook covers the CLI's hard-exit SIGINT path). On win32, where process groups don't apply, the direct child is killed on settle, matching the old `execFile` timeout behavior. Source: `apps/cli/src/lib/probe.ts`, `apps/cli/src/lib/agent-spec/agents.ts`, `apps/cli/src/lib/cli-resources.ts`.
+
+## 1.22.45
+
+- **BREAKING: the Prix-coupled account layer is removed — `agents auth`, `agents org`, and the plan-tier gates (RUSH-2581).** 1.22.42 shipped `agents auth login/whoami/logout` and `agents org` against the Rush product's backend (`api.prix.dev`), with `entitlement.ts` reading the Rush billing tier to cap accounts at 3-per-harness on free and to gate the `agents insights` friction sections. agents-cli's identity must not ride a separate product's login and database, so all of it is removed: `auth` and `org` are retired top-level names (they fail loudly, no auto-correct), account registration is uncapped again, `agents accounts` output drops the `dormant` field/suffix, and `agents insights` renders the full report with no `plan`/`notice` JSON fields. The Rush *feature* integrations are untouched (`cloud/rush.ts` dispatch, the opt-in secrets sync driver, the owner-notify transport). The replacement — agents-cli's own account backend with Phoenix branding, built for later Phoenix-ID consolidation — is tracked in RUSH-2581. Source: `apps/cli/src/lib/{prix-account,entitlement}.ts` (deleted), `apps/cli/src/commands/{auth,org}.ts` (deleted), `apps/cli/src/commands/{accounts,insights}.ts`, `apps/cli/src/{bootstrap.ts,cli/command-registry.ts,lib/startup/command-registry.ts}`.
+
+- **The menubar prepack gate fails closed off-Mac when the bundle has no stapled notarization ticket (RUSH-3026).** 1.22.44 was packed on a Linux box where the gate's codesign/xcrun checks silently no-op'd, so an un-stapled dev bundle shipped and Gatekeeper rejected it on every Mac ("not notarized/valid; skipping launch") — the menu bar died until a rollback to 1.22.43. `stapler staple` writes the ticket as a plain file (`Contents/CodeResources`), so its absence is provable anywhere: the gate now hard-fails the pack when it is missing and no xcrun is available, turning that failure into a pack error instead of a shipped regression. Source: `apps/cli/scripts/verify-menubar-helper.sh`.
+
+- **A Linux box can now produce the pretested release tarball — the attestation producer seeds the already-signed helper apps (RUSH-3026).** `release-attestation-produce.sh` runs in a fresh worktree whose `bin/` is empty (the signed `.app` helpers are untracked), so on any non-Mac box `npm pack` died at the prepack gates and attestation production — and therefore every release — stayed chained to a Mac. Off a macOS signing box the producer now seeds `bin/Agents CLI.app` and `bin/MenubarHelper.app` copy-if-absent from the caller checkout; the prepack gates still verify them (keychain sha pin, menubar presence), so a wrong or tampered seed fails the pack exactly as before. A Darwin producer's freshly signed apps are never overwritten. Source: `apps/cli/scripts/release-attestation-produce.sh`.
+
 ## 1.22.44
 
 - **Browser domain-skill discovery is layer-aware (RUSH-2497).** `agents browser start --url <url>` auto-loads a site-specific SKILL.md, but the lookup only ever searched the user layer (`~/.agents/skills/browser/domain-skills`), so a skill shipped in the system layer (`~/.agents/.system/skills/browser/domain-skills`) — or a project's `.agents/` — was silently invisible: the browser just opened without the guide. `resolveDomainSkill` now searches project > user > system > extra repos, first layer with a match wins, mirroring `resolveResource` precedence; `$AGENTS_BROWSER_DOMAIN_SKILLS_DIR` stays a single-root override for tests. The project layer resolves from the calling process's cwd — the shared browser daemon does not yet receive the CLI caller's cwd over IPC, so there the project layer follows the daemon's own cwd until RUSH-2996 threads it through. A miss still never breaks browser start, but now logs the roots searched at debug level (`AGENTS_DEBUG`/`DEBUG`) — the total silence is what hid this. Source: `apps/cli/src/lib/browser/domain-skills.ts`.

package/README.md

@@ -81,6 +81,7 @@ Also available as `ag` -- all commands work with both `agents` and `ag`.
 - [Plugins](#plugins)
 - [Make it yours](#make-it-yours)
 - [Browser](#browser)
+- [Sign in](#sign-in)
 - [Accounts](#accounts)
 - [Secrets](#secrets)
 - [Routines](#routines)
@@ -1002,6 +1003,29 @@ agents browser profiles create cloud \
 
 ---
 
+## Sign in
+
+`agents auth` signs this machine in to **Phoenix ID** — the Phoenix Labs account layer that spaces and plan tiers hang off. Sign-in is Google-only and runs a device-code flow: the CLI shows a code, your browser confirms it, and the CLI picks the session up.
+
+```bash
+agents auth login                        # shows a code, opens a Phoenix-branded page
+agents auth whoami                       # who this machine is signed in as (--json)
+agents auth logout                       # clears THIS machine; no other device is touched
+
+agents auth space create "Design Team"   # spaces are the team primitive
+agents auth space list                   # spaces you belong to
+agents auth space invite ada@example.com --role member
+agents auth space members                # who is in it
+agents auth space role ada@example.com admin
+agents auth space remove ada@example.com # or remove yourself to leave
+```
+
+The session lives in this machine's agents state dir, so `logout` here signs out nothing else. `whoami` and every `space` subcommand take `--json`. `PHOENIX_ID_BASE` points the CLI at a different account service (a local one, for instance); it defaults to the deployed Phoenix ID service.
+
+Distinct from **Accounts** below: this is *your human identity*; those are the *harness credentials* an agent runs under.
+
+---
+
 ## Accounts
 
 Give a provider credential a durable name once, reuse it everywhere -- across harnesses, across machines.

package/dist/bootstrap.js

@@ -264,12 +264,7 @@ Observe (read the fleet — no store merge):
   sync status                     Sync/drift only (not the live fleet snapshot)
   devices snapshot                One-process inventory + active sessions poll
 
-Identity (Prix account — shared with paid tiers):
-  auth login                      Sign in via the device-code flow
-  auth whoami                     Show the signed-in Prix user
-  auth space                      Create and manage a space (invite collaborators)
-
-Credentials (harness keys, not your Prix user):
+Credentials (harness keys):
   harness                         Custom (host CLI + model + auth) harnesses; replaces former profiles command
   secrets                         Keychain-backed env bundles; synced vault: secrets vault unlock|lock
   accounts                        Provider credentials + native OAuth logout

package/dist/cli/command-registry.d.ts

@@ -91,7 +91,6 @@ export declare const loadHumans: ModuleLoader;
 export declare const loadAccounts: ModuleLoader;
 export declare const loadDaemon: ModuleLoader;
 export declare const loadAuth: ModuleLoader;
-export declare const loadOrg: ModuleLoader;
 /**
  * Commands whose modules pull in the SQLite-backed session/cloud stack. They are
  * registered AFTER `applyGlobalHelpConventions` (mirroring main's order: help

package/dist/cli/command-registry.js

@@ -94,7 +94,6 @@ export const loadHumans = async () => (await import('../commands/humans.js')).re
 export const loadAccounts = async () => (await import('../commands/accounts.js')).registerAccountsCommand;
 export const loadDaemon = async () => (await import('../commands/daemon.js')).registerDaemonCommand;
 export const loadAuth = async () => (await import('../commands/auth.js')).registerAuthCommand;
-export const loadOrg = async () => (await import('../commands/org.js')).registerOrgCommand;
 /**
  * Commands whose modules pull in the SQLite-backed session/cloud stack. They are
  * registered AFTER `applyGlobalHelpConventions` (mirroring main's order: help
@@ -126,8 +125,6 @@ export const LAZY_COMMAND_NAMES = new Set([
  */
 export const COMMAND_LOADERS = {
     accounts: [loadAccounts],
-    auth: [loadAuth],
-    org: [loadOrg],
     view: [loadView],
     inspect: [loadInspect],
     feedback: [loadFeedback],
@@ -211,6 +208,7 @@ export const COMMAND_LOADERS = {
     webhooks: [loadWebhooks],
     humans: [loadHumans],
     daemon: [loadDaemon],
+    auth: [loadAuth],
 };
 /**
  * Register every module in {@link COMMAND_LOADERS} onto one fresh program and

package/dist/commands/accounts.d.ts

@@ -30,16 +30,8 @@ export declare function parseBundleKey(raw: string): {
     bundle: string;
     key: string;
 };
-/**
- * Named accounts that `set-default` / `switch` can pin for this harness —
- * capped to the caller's plan tier (RUSH-2424). Downgrading never deletes a
- * credential: an over-cap account simply falls out of this list (see
- * {@link dormantAccountsForHarness}) and stops being a switch/rotation target
- * until the plan is upgraded.
- */
+/** Named accounts that `set-default` / `switch` can pin for this harness. */
 export declare function listSwitchableAccounts(agent: AgentId): Promise<UnifiedAccount[]>;
-/** Accounts registered for this harness beyond the plan's cap — kept, never deleted, excluded from switch/rotation, reactivated by an upgrade. */
-export declare function dormantAccountsForHarness(agent: AgentId): Promise<UnifiedAccount[]>;
 /**
  * Pin the per-harness default. Shared by `accounts set-default` and `accounts switch`.
  * Provider accounts must authenticate the harness; native accounts must belong to it.

package/dist/commands/accounts.js

@@ -17,7 +17,6 @@ import { discoverNativeAccounts } from '../lib/account-catalog.js';
 import { readAndResolveBundleEnv } from '../lib/secrets/bundles.js';
 import { getAccountProvider, listAccountProviders } from '../lib/account-provider-registry.js';
 import { accountBindings, addAccount, addNativeAccount, bindAccount, findAccount, findUnifiedAccount, inspectAccount, listNativeAccounts, readAccountRegistry, removeAccount, renameAccount, setAccountSecret, unbindAccount } from '../lib/account-registry.js';
-import { accountCapForTier, getTier } from '../lib/entitlement.js';
 function parseInstallation(raw) {
     const at = raw.lastIndexOf('@');
     if (at < 1 || at === raw.length - 1)
@@ -74,8 +73,8 @@ function secretFromBundle(raw) {
     const { bundle, key } = parseBundleKey(raw);
     return readAndResolveBundleEnv(bundle, { keys: [key], keyMode: 'storage', agentOnly: true, caller: 'accounts import' }).env[key];
 }
-function publicAccount(account, dormant) {
-    return { kind: 'provider', id: account.id, name: account.name, provider: account.provider, auth: account.auth, baseUrl: account.baseUrl, policy: account.policy, secretPresent: account.secretPresent, dormant };
+function publicAccount(account) {
+    return { kind: 'provider', id: account.id, name: account.name, provider: account.provider, auth: account.auth, baseUrl: account.baseUrl, policy: account.policy, secretPresent: account.secretPresent };
 }
 async function printAccounts(json, fleet = false) {
     if (fleet)
@@ -83,16 +82,12 @@ async function printAccounts(json, fleet = false) {
     const records = Object.values(readAccountRegistry().accounts).sort((a, b) => a.name.localeCompare(b.name));
     const discovered = await discoverNativeAccounts();
     const savedNative = listNativeAccounts(readMeta());
-    const dormantIds = new Set();
-    for (const agent of ALL_AGENT_IDS)
-        for (const account of await dormantAccountsForHarness(agent))
-            dormantIds.add(account.id);
     const native = discovered.map(row => {
         const saved = savedNative.find(account => account.agent === row.agent && account.identityKey === row.id);
-        return { ...row, name: saved?.name, id: saved?.id ?? row.id, dormant: !!saved && dormantIds.has(saved.id) };
+        return { ...row, name: saved?.name, id: saved?.id ?? row.id };
     });
     if (json) {
-        console.log(JSON.stringify([...records.map(account => publicAccount(inspectAccount(account.name), dormantIds.has(account.id))), ...native], null, 2));
+        console.log(JSON.stringify([...records.map(account => publicAccount(inspectAccount(account.name))), ...native], null, 2));
         return;
     }
     console.log(chalk.bold('Provider account bundles\n'));
@@ -100,14 +95,13 @@ async function printAccounts(json, fleet = false) {
         console.log(chalk.gray("  None. Add one with 'agents accounts add <name> --provider <provider> --auth <type>'."));
     for (const account of records) {
         const present = inspectAccount(account.name).secretPresent ? chalk.green('ready') : chalk.red('missing on this device');
-        const dormantSuffix = dormantIds.has(account.id) ? chalk.gray('  — dormant (upgrade to reactivate)') : '';
-        console.log(`  ${chalk.cyan(account.name)}  ${account.provider}  ${account.auth}  ${present}${dormantSuffix}`);
+        console.log(`  ${chalk.cyan(account.name)}  ${account.provider}  ${account.auth}  ${present}`);
     }
     console.log(chalk.bold('\nNative harness logins\n'));
     if (!native.length)
         console.log(chalk.gray('  No signed-in native accounts found.'));
     for (const account of native)
-        console.log(`  ${account.name ? `${chalk.cyan(account.name)} · ` : ''}${account.display}  ${account.agent}  ${account.versions.join(', ')}${account.dormant ? chalk.gray('  — dormant (upgrade to reactivate)') : ''}`);
+        console.log(`  ${account.name ? `${chalk.cyan(account.name)} · ` : ''}${account.display}  ${account.agent}  ${account.versions.join(', ')}`);
 }
 function parseAuth(raw) {
     if (raw === 'api-key' || raw === 'setup-token' || raw === 'bearer-token')
@@ -131,7 +125,7 @@ function providerAuthenticatesHarness(provider, auth, agent) {
         throw err;
     }
 }
-/** Every account (native + provider) registered/usable for this harness, oldest-first by name — the full set a plan-tier cap slices into active vs dormant. */
+/** Every account (native + provider) registered/usable for this harness, oldest-first by name. */
 function accountsForHarness(agent) {
     const meta = readMeta();
     const native = listNativeAccounts(meta).filter(account => account.agent === agent);
@@ -140,52 +134,9 @@ function accountsForHarness(agent) {
         .map(account => ({ ...account, kind: 'provider' }));
     return [...native, ...providers].sort((a, b) => a.name.localeCompare(b.name));
 }
-/**
- * Named accounts that `set-default` / `switch` can pin for this harness —
- * capped to the caller's plan tier (RUSH-2424). Downgrading never deletes a
- * credential: an over-cap account simply falls out of this list (see
- * {@link dormantAccountsForHarness}) and stops being a switch/rotation target
- * until the plan is upgraded.
- */
+/** Named accounts that `set-default` / `switch` can pin for this harness. */
 export async function listSwitchableAccounts(agent) {
-    const cap = accountCapForTier(await getTier());
-    return accountsForHarness(agent).slice(0, cap);
-}
-/** Accounts registered for this harness beyond the plan's cap — kept, never deleted, excluded from switch/rotation, reactivated by an upgrade. */
-export async function dormantAccountsForHarness(agent) {
-    const cap = accountCapForTier(await getTier());
-    return accountsForHarness(agent).slice(cap);
-}
-function accountCapRefusalMessage(agent, tier, cap) {
-    if (!tier.isPaid)
-        return `free plan is capped at 3 ${agent} accounts (3/3). agents upgrade — up to 10 per harness.`;
-    return `${tier.tierName} plan is capped at ${cap} ${agent} accounts (${cap}/${cap}).`;
-}
-/**
- * Refuse BEFORE any write when adding a new account would push one of
- * `harnesses` over the caller's plan cap. Returns the tier/cap/pre-add counts
- * so the caller can print the exactly-at-cap notice after a successful write.
- */
-async function assertAccountCapacityFor(harnesses) {
-    const tier = await getTier();
-    const cap = accountCapForTier(tier);
-    const existing = new Map();
-    for (const harness of harnesses)
-        existing.set(harness, accountsForHarness(harness).length);
-    const capped = harnesses.find(harness => (existing.get(harness) ?? 0) >= cap);
-    if (capped)
-        throw new Error(accountCapRefusalMessage(capped, tier, cap));
-    return { tier, cap, existing };
-}
-/** One-line, non-blocking notice for every harness a free-tier add just brought to exactly its cap. */
-function printCapNoticesFor(harnesses, tier, cap, existing) {
-    if (tier.isPaid)
-        return;
-    for (const harness of harnesses) {
-        if ((existing.get(harness) ?? 0) + 1 === cap) {
-            console.log(chalk.yellow(`${cap}/${cap} ${harness} accounts on the free plan. agents upgrade — up to 10 per harness.`));
-        }
-    }
+    return accountsForHarness(agent);
 }
 /**
  * Pin the per-harness default. Shared by `accounts set-default` and `accounts switch`.
@@ -279,16 +230,10 @@ export function registerAccountsCommand(program) {
         const provider = getAccountProvider(o.provider);
         if (!provider.authKinds.includes(auth))
             throw new Error(`Provider '${provider.provider}' does not support ${auth}. Supported: ${provider.authKinds.join(', ')}.`);
-        // A provider account may authenticate more than one harness (e.g. openrouter);
-        // it counts toward every harness it can authenticate, so refuse before any
-        // write if adding it would push ANY of those harnesses over the plan cap.
-        const harnesses = ALL_AGENT_IDS.filter(h => providerAuthenticatesHarness(provider.provider, auth, h));
-        const { tier, cap, existing } = await assertAccountCapacityFor(harnesses);
         const secret = o.fromSecrets ? secretFromBundle(o.fromSecrets) : await password({ message: `Enter ${provider.provider} ${auth} for '${name}':` });
         const account = addAccount(name, provider.provider, auth, secret, undefined, { baseUrl: o.baseUrl });
         console.log(chalk.green(`Added ${account.provider} ${account.auth} account '${account.name}'.`));
         console.log(chalk.gray(`Secret bundle '${account.name}' is the account and uses policy never, so agent launches never request Touch ID.`));
-        printCapNoticesFor(harnesses, tier, cap, existing);
     });
     accounts.command('set-key <name>')
         .description('Rotate an account credential without changing its identity')
@@ -306,22 +251,12 @@ export function registerAccountsCommand(program) {
         const unified = findUnifiedAccount(name, meta);
         if (!unified)
             throw new Error(`Unknown account '${name}'.`);
-        const harnesses = unified.kind === 'provider'
-            ? ALL_AGENT_IDS.filter(h => providerAuthenticatesHarness(unified.provider, unified.auth, h))
-            : [unified.agent];
-        let dormant = false;
-        for (const harness of harnesses) {
-            if ((await dormantAccountsForHarness(harness)).some(a => a.id === unified.id)) {
-                dormant = true;
-                break;
-            }
-        }
         const account = unified.kind === 'provider'
-            ? { ...publicAccount(inspectAccount(unified.name), dormant), custody: 'agents secrets (policy never)', attached: accountBindings(unified.id, meta) }
-            : { ...unified, dormant, custody: `${unified.agent} (not stored by agents-cli)`, attached: accountBindings(unified.id, meta) };
+            ? { ...publicAccount(inspectAccount(unified.name)), custody: 'agents secrets (policy never)', attached: accountBindings(unified.id, meta) }
+            : { ...unified, custody: `${unified.agent} (not stored by agents-cli)`, attached: accountBindings(unified.id, meta) };
         if (o.json || command.optsWithGlobals().json)
             return console.log(JSON.stringify(account, null, 2));
-        console.log(chalk.bold(account.name) + (account.dormant ? chalk.gray('  — dormant (upgrade to reactivate)') : ''));
+        console.log(chalk.bold(account.name));
         console.log(`  kind: ${account.kind}`);
         console.log(`  id: ${account.id}`);
         console.log(`  custody: ${account.custody}`);
@@ -340,12 +275,10 @@ export function registerAccountsCommand(program) {
         .description('Name a signed-in native installation without copying its OAuth credentials')
         .action(async (source, name) => {
         const identity = await nativeIdentityFromSource(source);
-        const { tier, cap, existing } = await assertAccountCapacityFor([identity.agent]);
         const account = addNativeAccount(name, identity.agent, identity.identityKey, identity.identityLabel, identity.scope);
         console.log(chalk.green(`Named ${source} as ${account.name}.`));
         if (account.scope === 'device')
             console.log(chalk.gray(`${identity.agent} authentication is device-scoped; attach '${account.name}' to '${identity.agent}', not an individual version.`));
-        printCapNoticesFor([identity.agent], tier, cap, existing);
     });
     accounts.command('attach <account> <target>')
         .description('Attach a named account to a native installation or custom harness')
@@ -383,17 +316,6 @@ export function registerAccountsCommand(program) {
             // Provider account: it must be able to authenticate the target's harness.
             getAccountProvider(account.provider).envFor(targetAgent, account.auth);
         }
-        // Defense-in-depth cap check: by the point we get here `account` already
-        // authenticates/belongs to `targetAgent` (validated above), so it is
-        // already counted in accountsForHarness(targetAgent) from its `add`/`name`
-        // time — this can only refuse if that invariant is ever violated, never a
-        // normal re-attach of an account the harness is already at cap with.
-        const tier = await getTier();
-        const cap = accountCapForTier(tier);
-        const alreadyCounted = accountsForHarness(targetAgent).some(existing => existing.id === account.id);
-        const otherCount = accountsForHarness(targetAgent).length - (alreadyCounted ? 1 : 0);
-        if (otherCount >= cap)
-            throw new Error(accountCapRefusalMessage(targetAgent, tier, cap));
         bindAccount(name, target);
         console.log(chalk.green(`Attached ${account.name} to ${target}.`));
     });

package/dist/commands/auth.d.ts

@@ -1,9 +1,2 @@
 import type { Command } from 'commander';
-/**
- * `agents auth login` — RFC 8628 device-code flow against the already-shipped
- * `/api/v1/auth/device/*` routes. If the live API rejects the request shape
- * (a route this spec missed, or the endpoint moved), this fails loud with the
- * `rush login` fallback rather than silently stubbing a fake session.
- */
-export declare function runAuthLogin(): Promise<void>;
 export declare function registerAuthCommand(program: Command): void;