@phnx-labs/agents-cli 1.22.46 → 1.22.49

package/dist/commands/accounts.js

@@ -1,12 +1,15 @@
+import * as fs from 'fs';
+import * as path from 'path';
 import chalk from 'chalk';
-import { password } from '@inquirer/prompts';
+import { password, select } from '@inquirer/prompts';
+import { resolveClaudeSetupToken } from '../lib/claude-account-token.js';
 import { setHelpSections } from '../lib/help.js';
 import { readMeta, updateMeta } from '../lib/state.js';
 import { ALL_AGENT_IDS, getAccountInfo, resolveAgentName } from '../lib/agents.js';
-import { getVersionHomePath, listInstalledVersions } from '../lib/installations/versions.js';
+import { getGlobalDefault, getVersionHomePath, listInstalledVersions } from '../lib/installations/versions.js';
 import { assertNativeAccountNameable, nativeAccountCapability, nativeIdentityKey } from '../lib/account-capabilities.js';
 import { collectRunCandidates } from '../lib/accounting/rotate.js';
-import { isInteractiveTerminal } from './utils.js';
+import { isInteractiveTerminal, isPromptCancelled, requireInteractiveSelection } from './utils.js';
 import { buildSwitchAccountChoices, formatAccountLimits, pickSwitchAccount } from './run-account-picker.js';
 import { profileExists, readProfile } from '../lib/profiles.js';
 import { pushBundleToHost } from '../lib/secrets/push.js';
@@ -16,7 +19,10 @@ import { runDevicesAccounts } from './ssh.js';
 import { discoverNativeAccounts } from '../lib/account-catalog.js';
 import { readAndResolveBundleEnv } from '../lib/secrets/bundles.js';
 import { getAccountProvider, listAccountProviders } from '../lib/account-provider-registry.js';
-import { accountBindings, addAccount, addNativeAccount, bindAccount, findAccount, findUnifiedAccount, inspectAccount, listNativeAccounts, readAccountRegistry, removeAccount, renameAccount, setAccountSecret, unbindAccount } from '../lib/account-registry.js';
+import { accountBindings, addAccount, addNativeAccount, bindAccount, findAccount, findUnifiedAccount, inspectAccount, labelNativeAccount, listNativeAccounts, readAccountRegistry, removeAccount, renameAccount, setAccountSecret, unbindAccount } from '../lib/account-registry.js';
+function cleanCommandError(command, err) {
+    command.error(err instanceof Error ? err.message : String(err), { exitCode: 1, code: 'accounts.error' });
+}
 function parseInstallation(raw) {
     const at = raw.lastIndexOf('@');
     if (at < 1 || at === raw.length - 1)
@@ -63,6 +69,33 @@ export function classifyAttachTarget(target) {
         return { kind: 'device-agent', agent };
     throw new Error(`Unknown attach target '${target}'. Expected an installed <agent>@<version>, a harness id, or an existing custom harness profile.`);
 }
+/**
+ * Persist the attached setup-token to a per-version `.oauth_token` file so an
+ * INTERACTIVE Claude launch on a keychain-less Linux worker can authenticate from it.
+ * Headless runs inject the token via `buildExecEnv`, but an interactive launch defers to
+ * the per-version login (`claudeAdapter.applyExecConfigEnv`), and the shim's Linux fallback
+ * (`claudeAdapter.shimConfigEnvBash`) reads exactly this file. Without writing it, a
+ * freshly-attached setup-token was invisible to interactive runs on a worker. macOS keeps
+ * the credential in the keychain, so `resolveClaudeSetupToken` returns null there and this
+ * is a no-op off Linux.
+ */
+export function writeClaudeInteractiveOauthToken(target, targetAgent) {
+    if (process.platform !== 'linux' || targetAgent !== 'claude' || target.kind !== 'installation')
+        return;
+    const versionHome = getVersionHomePath('claude', target.version);
+    const tokenPath = path.join(versionHome, '.claude', '.oauth_token');
+    const token = resolveClaudeSetupToken(versionHome);
+    // A re-point (attach B over A, or a detach) can leave no setup-token resolving for
+    // this version — B's may not be minted yet. A leftover file from the previous binding
+    // would silently authenticate interactive runs as the OLD account (the shim's Linux
+    // fallback reads it), so clear it rather than leave it stale.
+    if (!token) {
+        fs.rmSync(tokenPath, { force: true });
+        return;
+    }
+    fs.mkdirSync(path.dirname(tokenPath), { recursive: true });
+    fs.writeFileSync(tokenPath, token, { mode: 0o600 });
+}
 export function parseBundleKey(raw) {
     const colon = raw.indexOf(':');
     if (colon < 1 || colon === raw.length - 1)
@@ -90,18 +123,59 @@ async function printAccounts(json, fleet = false) {
         console.log(JSON.stringify([...records.map(account => publicAccount(inspectAccount(account.name))), ...native], null, 2));
         return;
     }
-    console.log(chalk.bold('Provider account bundles\n'));
-    if (!records.length)
-        console.log(chalk.gray("  None. Add one with 'agents accounts add <name> --provider <provider> --auth <type>'."));
-    for (const account of records) {
-        const present = inspectAccount(account.name).secretPresent ? chalk.green('ready') : chalk.red('missing on this device');
-        console.log(`  ${chalk.cyan(account.name)}  ${account.provider}  ${account.auth}  ${present}`);
+    console.log(renderAccountList(records, native));
+}
+/** Pure text renderer for `agents accounts list` — grouped, column-aligned, labels first-class. */
+export function renderAccountList(records, native) {
+    const out = [];
+    // Native logins, grouped by harness — the selection surface for `<harness>#<label>`.
+    out.push(chalk.bold('Native logins') + chalk.gray('     ') + chalk.gray('run <harness>#<label>'));
+    if (!native.length) {
+        out.push(chalk.gray('  No signed-in native accounts found.'));
     }
-    console.log(chalk.bold('\nNative harness logins\n'));
-    if (!native.length)
-        console.log(chalk.gray('  No signed-in native accounts found.'));
-    for (const account of native)
-        console.log(`  ${account.name ? `${chalk.cyan(account.name)} · ` : ''}${account.display}  ${account.agent}  ${account.versions.join(', ')}`);
+    else {
+        const byHarness = new Map();
+        for (const acct of native) {
+            const list = byHarness.get(acct.agent) ?? [];
+            list.push(acct);
+            byHarness.set(acct.agent, list);
+        }
+        const harnessW = Math.max(6, ...[...byHarness.keys()].map(h => h.length));
+        const labelW = Math.max(6, ...native.map(a => (a.name ?? '—').length));
+        const idW = Math.max(8, ...native.map(a => a.display.length));
+        let sawDefault = false;
+        for (const [harness, list] of [...byHarness.entries()].sort((a, b) => a[0].localeCompare(b[0]))) {
+            const defaultVersion = getGlobalDefault(harness);
+            list.forEach((acct, i) => {
+                const harnessCell = chalk.gray((i === 0 ? harness : '').padEnd(harnessW));
+                const rawLabel = acct.name ?? '—';
+                const labelCell = acct.name ? chalk.cyan(rawLabel.padEnd(labelW)) : chalk.gray(rawLabel.padEnd(labelW));
+                const isDefault = defaultVersion ? acct.versions.includes(defaultVersion) : false;
+                if (isDefault)
+                    sawDefault = true;
+                const marker = isDefault ? chalk.green('*') : ' ';
+                out.push(`  ${harnessCell}  ${labelCell}${marker} ${acct.display.padEnd(idW)}  ${chalk.gray(acct.versions.join(', '))}`);
+            });
+        }
+        if (sawDefault)
+            out.push(chalk.gray('\n  * default account for that harness (used when you pass neither @version nor #label)'));
+    }
+    // Provider bundles — the durable API-key/setup-token accounts, selected with `--account <name>`.
+    out.push('');
+    out.push(chalk.bold('Provider bundles') + chalk.gray('  run <harness> --account <name>'));
+    if (!records.length) {
+        out.push(chalk.gray("  None. Add one with 'agents accounts add <name> --provider <provider> --auth <type>'."));
+    }
+    else {
+        const nameW = Math.max(4, ...records.map(a => a.name.length));
+        const provW = Math.max(8, ...records.map(a => a.provider.length));
+        const authW = Math.max(10, ...records.map(a => a.auth.length));
+        for (const account of records) {
+            const present = inspectAccount(account.name).secretPresent ? chalk.green('ready') : chalk.red('missing on this device');
+            out.push(`  ${chalk.cyan(account.name.padEnd(nameW))}  ${account.provider.padEnd(provW)}  ${account.auth.padEnd(authW)}  ${present}`);
+        }
+    }
+    return out.join('\n');
 }
 function parseAuth(raw) {
     if (raw === 'api-key' || raw === 'setup-token' || raw === 'bearer-token')
@@ -113,6 +187,107 @@ function parseHarness(agentRaw) {
         throw new Error(`Unknown agent '${agentRaw}'.`);
     return agentRaw;
 }
+/**
+ * Fold signed-in run candidates into distinct identities — the unit a label
+ * binds to. The same account signed into several versions is ONE row, so a
+ * multi-version single-account harness never demands a selector. Candidates
+ * with no stable identity (no accountKey, no email) are dropped: there is
+ * nothing durable for a label to bind to. Default-version identity first.
+ */
+export function groupLabelIdentities(candidates, defaultVersion) {
+    const byKey = new Map();
+    for (const candidate of candidates) {
+        const key = candidate.accountKey ?? candidate.email?.toLowerCase();
+        if (!key)
+            continue;
+        const row = byKey.get(key) ?? { identityKey: key, email: null, versions: [], isDefault: false };
+        row.email ??= candidate.email;
+        row.versions.push(candidate.version);
+        if (candidate.version === defaultVersion)
+            row.isDefault = true;
+        byKey.set(key, row);
+    }
+    return [...byKey.values()].sort((a, b) => a.isDefault !== b.isDefault ? (a.isDefault ? -1 : 1) : (a.email ?? a.identityKey).localeCompare(b.email ?? b.identityKey));
+}
+/**
+ * Resolve which signed-in login a bare-harness `accounts label` call means.
+ * `collect` is injectable (the `resolveRunVersion` pattern) so tests drive the
+ * real selection path against fixture candidates.
+ */
+export async function resolveLabelIdentity(agent, accountSelector, collect = collectRunCandidates) {
+    const candidates = (await collect(agent)).filter(candidate => candidate.signedIn);
+    const identities = groupLabelIdentities(candidates, getGlobalDefault(agent));
+    if (identities.length === 0)
+        throw new Error(`No signed-in ${agent} account with a stable identity. Run the harness and complete its login first.`);
+    const needle = accountSelector?.toLowerCase();
+    if (needle) {
+        const match = identities.find(identity => identity.email?.toLowerCase() === needle || identity.identityKey.toLowerCase() === needle);
+        if (!match)
+            throw new Error(`Unknown ${agent} account '${accountSelector}'.`);
+        return { kind: 'selected', identity: match };
+    }
+    if (identities.length === 1)
+        return { kind: 'selected', identity: identities[0] };
+    return { kind: 'ambiguous', identities };
+}
+/**
+ * Body of `accounts label`, exported with the injectable candidate collector
+ * so tests exercise everything but the TTY prompt itself.
+ */
+export async function runAccountsLabel(source, label, opts, collect = collectRunCandidates) {
+    if (source.includes('@')) {
+        // <harness>@<version> pins the login by where it is signed in, so a
+        // second selector can only contradict it.
+        if (opts.account)
+            throw new Error(`'${source}' already selects one login; drop --account.`);
+        const identity = await nativeIdentityFromSource(source);
+        const account = labelNativeAccount(identity.agent, identity.identityKey, identity.identityLabel, label, identity.scope);
+        console.log(chalk.green(`Labeled ${identity.agent} account ${identity.identityLabel ?? identity.identityKey} as '${account.name}'.`));
+        return;
+    }
+    const agent = parseHarness(source);
+    assertNativeAccountNameable(agent);
+    const selection = await resolveLabelIdentity(agent, opts.account, collect);
+    let selected;
+    if (selection.kind === 'selected') {
+        selected = selection.identity;
+    }
+    else {
+        if (!isInteractiveTerminal()) {
+            requireInteractiveSelection(`Selecting the ${agent} login to label`, [
+                `agents accounts label ${agent} ${label ?? '<label>'} --account <email|id>`,
+                `agents accounts label ${agent}@<version> ${label ?? '<label>'}`,
+            ]);
+        }
+        const picked = await pickLabelIdentity(agent, selection.identities);
+        if (!picked)
+            return;
+        selected = picked;
+    }
+    const account = labelNativeAccount(agent, selected.identityKey, selected.email ?? undefined, label, nativeAccountCapability(agent).scope);
+    console.log(chalk.green(`Labeled ${agent} account ${selected.email ?? selected.identityKey} as '${account.name}'.`));
+}
+/** Prompt for the login a label should bind to. A cancelled picker writes nothing. */
+async function pickLabelIdentity(agent, identities) {
+    const idW = Math.max(0, ...identities.map(identity => (identity.email ?? identity.identityKey).length));
+    const choices = identities.map(identity => ({
+        name: [
+            (identity.email ?? identity.identityKey).padEnd(idW),
+            identity.isDefault ? chalk.green('default') : '       ',
+            chalk.gray(identity.versions.join(', ')),
+        ].join('  '),
+        value: identity.identityKey,
+    }));
+    try {
+        const key = await select({ message: `Select the ${agent} login to label:`, choices, loop: false });
+        return identities.find(identity => identity.identityKey === key) ?? null;
+    }
+    catch (err) {
+        if (isPromptCancelled(err))
+            return null;
+        throw err;
+    }
+}
 function providerAuthenticatesHarness(provider, auth, agent) {
     try {
         getAccountProvider(provider).envFor(agent, auth);
@@ -273,12 +448,35 @@ export function registerAccountsCommand(program) {
     });
     accounts.command('name <source> <name>')
         .description('Name a signed-in native installation without copying its OAuth credentials')
-        .action(async (source, name) => {
-        const identity = await nativeIdentityFromSource(source);
-        const account = addNativeAccount(name, identity.agent, identity.identityKey, identity.identityLabel, identity.scope);
-        console.log(chalk.green(`Named ${source} as ${account.name}.`));
-        if (account.scope === 'device')
-            console.log(chalk.gray(`${identity.agent} authentication is device-scoped; attach '${account.name}' to '${identity.agent}', not an individual version.`));
+        .action(async (source, name, _o, command) => {
+        try {
+            const identity = await nativeIdentityFromSource(source);
+            const account = addNativeAccount(name, identity.agent, identity.identityKey, identity.identityLabel, identity.scope);
+            console.log(chalk.green(`Named ${source} as ${account.name}.`));
+            if (account.scope === 'device')
+                console.log(chalk.gray(`${identity.agent} authentication is device-scoped; attach '${account.name}' to '${identity.agent}', not an individual version.`));
+        }
+        catch (err) {
+            cleanCommandError(command, err);
+        }
+    });
+    const labelCmd = accounts.command('label <source> [label]')
+        .description('Label a native login by harness or <harness>@<version>; the label binds to the account identity, not the version')
+        .option('--account <email-or-id>', 'Native identity to label when the harness has multiple logins')
+        .action(async (source, label, o, command) => {
+        try {
+            await runAccountsLabel(source, label, o);
+        }
+        catch (err) {
+            cleanCommandError(command, err);
+        }
+    });
+    setHelpSections(labelCmd, {
+        examples: `agents accounts label codex work
+agents accounts label codex@0.146.0 personal
+agents accounts label codex work --account you@example.com
+agents run codex#work`,
+        notes: 'The label binds to the signed-in account identity, not the version — codex#work keeps selecting that account after it moves to a newer install. One signed-in login needs no selector; with several, an interactive terminal opens a picker, while scripts pass --account or <harness>@<version>.',
     });
     accounts.command('attach <account> <target>')
         .description('Attach a named account to a native installation or custom harness')
@@ -317,27 +515,46 @@ export function registerAccountsCommand(program) {
             getAccountProvider(account.provider).envFor(targetAgent, account.auth);
         }
         bindAccount(name, target);
+        writeClaudeInteractiveOauthToken(t, targetAgent);
         console.log(chalk.green(`Attached ${account.name} to ${target}.`));
     });
     accounts.command('detach <account> <target>')
         .description('Remove one account attachment')
         .action((name, target) => {
         unbindAccount(name, target);
+        // With the binding gone, no setup-token resolves for this version home, so this
+        // clears any .oauth_token the attach left behind (else interactive runs would keep
+        // authenticating as the just-detached account).
+        try {
+            const t = classifyAttachTarget(target);
+            writeClaudeInteractiveOauthToken(t, t.kind === 'profile' ? t.profile.host.agent : t.agent);
+        }
+        catch { /* an unresolvable target has no version home to clean */ }
         console.log(chalk.green(`Detached ${name} from ${target}.`));
     });
     accounts.command('rename <old> <new>').description('Rename an account without changing its stable id').action((oldName, newName) => renameAccount(oldName, newName));
     accounts.command('remove <name>').description('Remove an account and its device-local credential').action((name) => removeAccount(name));
     accounts.command('set-default <agent> <name>')
         .description('Use this account for a harness when --account is omitted')
-        .action((agentRaw, name) => {
-        const { agent, account } = setDefaultAccount(agentRaw, name);
-        console.log(chalk.green(`${agent} now uses account '${account.name}' unless --account overrides it.`));
+        .action((agentRaw, name, _o, command) => {
+        try {
+            const { agent, account } = setDefaultAccount(agentRaw, name);
+            console.log(chalk.green(`${agent} now uses account '${account.name}' unless --account overrides it.`));
+        }
+        catch (err) {
+            cleanCommandError(command, err);
+        }
     });
     const switchCmd = accounts.command('switch <harness> [account]')
         .description('Pick the default account for a harness')
         .option('--json', 'Machine-readable account list or the resulting default')
         .action(async (harness, account, o, command) => {
-        await runAccountsSwitch(harness, account, { json: !!(o.json || command.optsWithGlobals().json) });
+        try {
+            await runAccountsSwitch(harness, account, { json: !!(o.json || command.optsWithGlobals().json) });
+        }
+        catch (err) {
+            cleanCommandError(command, err);
+        }
     });
     accounts.command('clear-default <agent>')
         .description('Return a harness to native login or balanced account selection')
@@ -425,6 +642,7 @@ agents run claude`,
 agents accounts add openrouter-work --provider openrouter --auth api-key --from-secrets openrouter.ai:OPENROUTER_API_KEY
 agents accounts set-key work
 agents accounts name claude@2.1.220 work
+agents accounts label codex@0.146.0 personal
 agents accounts attach work claude@2.1.225
 agents accounts view work --json
 agents accounts switch claude

package/dist/commands/artifacts.js

@@ -20,18 +20,19 @@ import { registerArtifactsSetupCommand } from './artifacts-setup.js';
 export function registerArtifactsCommands(program) {
     const artifactsCmd = program
         .command('artifacts')
-        .description('Publish agent-made artifacts (plans, reports, visuals) to your own Cloudflare R2 and get a shareable link (~$0).');
+        .description('Publish agent-made artifacts (plans, reports, visuals) to a shareable link — managed if signed in, otherwise your Cloudflare R2.');
     registerArtifactsSetupCommand(artifactsCmd);
     registerShareCommands(artifactsCmd);
     setHelpSections(artifactsCmd, {
         examples: `
-      # One-time: provision your own endpoint (or join a teammate's)
+      # Signed in? Just publish — no Cloudflare setup
+      agents auth login
+      agents artifacts share ./out/plan.html
+
+      # Or provision your own Cloudflare endpoint (or join a teammate's)
       agents artifacts setup
       agents artifacts share join https://share.agents-cli.sh
 
-      # Publish — auto OG cover, default 30d expiry, shareable link
-      agents artifacts share ./out/plan.html
-
       # What's live in your namespace, and taking one down
       agents artifacts share list
       agents artifacts unshare my-plan-a1b2
@@ -50,7 +51,7 @@ export function registerArtifactsCommands(program) {
   agents artifacts unshare <targets...> is the nested alias of
   agents artifacts share delete. Top-level \`agents unshare\` is gone.
 
-  Full reference: apps/cli/docs/share.md.
+  Architecture: cli/docs/observability.md.
     `,
     });
     registerUnshareCommand(artifactsCmd);

package/dist/commands/attach.js

@@ -50,7 +50,7 @@ export async function attachAction(id) {
     // process on the owning machine.
     const peer = sessionRecoveryPeer(meta);
     if (peer) {
-        const routed = await runOnPeer(attachRecoveryArgs(meta), peer, { tty: true });
+        const routed = await runOnPeer(attachRecoveryArgs(meta), peer, { tty: true, sessionId: meta.id });
         if (routed === 'no-target') {
             console.error(chalk.red(`Cannot attach ${meta.shortId}: origin device ${peer} is not a registered reachable peer.`));
             process.exitCode = 1;

package/dist/commands/auth.js

@@ -3,9 +3,10 @@ import { PhoenixApiError, clearSession, createSpace, createSpaceInvite, fetchWho
 import { setHelpSections } from '../lib/help.js';
 import { runOrDie } from '../lib/format.js';
 /**
- * `agents auth` — sign in to Phoenix ID, the account layer behind teams and
- * plan tiers. Everything here goes through `lib/identity`; this file builds no
- * URLs and reads no credential files of its own.
+ * `agents auth` — sign in to Phoenix ID, the account layer behind team spaces.
+ * Signing in is optional: every local feature works with no account. Everything
+ * here goes through `lib/identity`; this file builds no URLs and reads no
+ * credential files of its own.
  */
 function sleep(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));
@@ -90,14 +91,15 @@ async function requireSpace(ref) {
 export function registerAuthCommand(program) {
     const auth = program
         .command('auth')
-        .description('Sign in to Phoenix ID — the account layer behind spaces and plan tiers');
+        .description('Sign in to Phoenix ID — the account layer behind team spaces');
     setHelpSections(auth, {
         examples: `agents auth login                         # device-code sign-in via your browser
 agents auth whoami                        # who this machine is signed in as
 agents auth space create "Design Team"    # start a space
 agents auth space invite ada@example.com  # add a teammate
 agents auth logout                        # clear this machine only`,
-        notes: `Sign-in is Google-only and opens a Phoenix-branded page; the CLI never sees a password.
+        notes: `Signing in is optional — every local feature works with no account; team spaces are what it unlocks.
+Sign-in is Google-only and opens a Phoenix-branded page; the CLI never sees a password.
 The session lives in this machine's agents state dir, so logging out here signs out nothing else.
 Point at a different backend with PHOENIX_ID_BASE (defaults to the production service).`,
     });

package/dist/commands/browser-sessions-picker.js

@@ -10,12 +10,13 @@
  * second renderer. Interactive routing and the browse loop live in
  * `sessions-picker-factory.ts` (shared with the computer twin).
  */
+import { showFile } from '../lib/open-url.js';
 import chalk from 'chalk';
 import { itemPicker } from '../lib/picker.js';
 import { isPromptCancelled } from './utils.js';
 import { buildPreview } from './sessions-picker.js';
 import { createSessionsPickerCommand } from './sessions-picker-factory.js';
-import { runBrowserSessions, buildBrowserSessionRows, matchesBrowserSessionRow, openArtifact, formatBytes, } from '../lib/browser/sessions-list.js';
+import { runBrowserSessions, buildBrowserSessionRows, matchesBrowserSessionRow, formatBytes, } from '../lib/browser/sessions-list.js';
 import { formatRelativeTime } from '../lib/session/relative-time.js';
 const KIND_LABEL = {
     screenshot: 'shots',
@@ -89,11 +90,12 @@ function formatArtifactLabel(a) {
     const age = formatRelativeTime(new Date(a.mtimeMs).toISOString());
     return `${age.padEnd(11)}  ${a.name.padEnd(34)}  ${formatBytes(a.bytes).padStart(8)}`;
 }
-/** Open one artifact in the OS default app, printing its path (matches the
- *  non-interactive `--open` behavior) and any open failure. */
-function openAndReport(a) {
+/** Open one artifact, printing its path (matches the non-interactive `--open`
+ *  behavior) and any open failure. Routes through the same viewer seam as
+ *  `--open`, so the interactive and non-interactive halves cannot diverge. */
+async function openAndReport(a) {
     console.log(a.path);
-    if (!openArtifact(a.path))
+    if ((await showFile(a.path)).via === 'none')
         console.error(`Could not open ${a.path}`);
 }
 /** Second-level picker over one row's captures, newest first. Enter opens the
@@ -136,12 +138,12 @@ const browserSessionsPicker = createSessionsPickerCommand({
             return;
         }
         if (row.artifacts.length === 1) {
-            openAndReport(row.artifacts[0]);
+            await openAndReport(row.artifacts[0]);
             return;
         }
         const artifact = await pickArtifact(row);
         if (artifact)
-            openAndReport(artifact);
+            await openAndReport(artifact);
     },
 });
 /** True when the interactive picker should open instead of the printed table: