@phnx-labs/agents-cli 1.22.47 → 1.22.50

package/dist/commands/projects.js

@@ -461,6 +461,44 @@ warnWorkspaces = []) {
     if (!detail)
         console.log('');
 }
+/**
+ * Merge `--device a b` (variadic) and `--devices a,b,c` (comma list) into one
+ * deduped device filter; undefined when neither was given (= whole fleet).
+ */
+export function resolveDeviceFilter(device, devices) {
+    const merged = [
+        ...(device ?? []),
+        ...(devices ? devices.split(',').map((s) => s.trim()).filter(Boolean) : []),
+    ];
+    return merged.length ? [...new Set(merged)] : undefined;
+}
+/** Print the YAML-side fields that sit under the shared card in `view` mode. */
+export function printProjectDefinition(def, name) {
+    console.log();
+    if (def.root)
+        console.log(`  ${chalk.dim('root')}     ${def.root}`);
+    if (def.defaultPath)
+        console.log(`  ${chalk.dim('path')}     ${def.defaultPath}`);
+    for (const rp of def.repos ?? []) {
+        const where = [rp.subpath ? `subpath ${rp.subpath}` : undefined, rp.path].filter(Boolean).join(' · ');
+        console.log(`  ${chalk.dim('repo')}     ${rp.slug}${where ? chalk.dim(`  (${where})`) : ''}`);
+    }
+    for (const g of def.goals ?? [])
+        console.log(`  ${chalk.dim('goal')}     ${g.objective}${g.measure ? chalk.dim(`  · ${g.measure}`) : ''}`);
+    for (const c of def.contexts ?? [])
+        console.log(`  ${chalk.dim('context')}  ${chalk.cyan(c.path)} ${chalk.dim('—')} ${c.purpose}`);
+    for (const ig of def.integrations ?? []) {
+        console.log(`  ${chalk.dim(ig.kind.padEnd(8))} ${ig.url}${ig.label ? chalk.dim(`  (${ig.label})`) : ''}`);
+    }
+    if (def.linear?.url || def.linear?.projectId || def.linear?.name) {
+        const ref = def.linear.url ?? def.linear.projectId;
+        const label = def.linear.name ? chalk.cyan(def.linear.name) : '';
+        console.log(`  ${chalk.dim('linear')}   ${[label, ref && chalk.dim(ref)].filter(Boolean).join('  ')}`);
+    }
+    for (const d of def.docs ?? [])
+        console.log(`  ${chalk.dim('doc')}      ${d}`);
+    console.log(chalk.gray(`  ${projectDefPath(name)}`));
+}
 export function registerProjectsCommands(program) {
     const projects = program
         .command('projects')
@@ -476,9 +514,9 @@ export function registerProjectsCommands(program) {
       agents projects list --with-agents   # opt-in local active counts
       agents projects list --json          # machine-readable defs (AGI EXT uses this)
       echo '{...}' | agents projects save --json  # create/update one def from stdin
-      agents projects rm rush --json       # machine-readable delete
+      agents projects remove rush --json   # machine-readable removal
       agents projects status              # every project, across the whole fleet
-      agents projects status rush         # one project (same body as view/show)
+      agents projects status rush         # one project (same body as view)
       agents projects view rush           # alias of status <name>
       agents projects status --device s0  # scope to one device (or --devices a,b,c)
       agents projects link rush --linear  # bind the Linear project (auto-suggest)
@@ -607,44 +645,6 @@ export function registerProjectsCommands(program) {
         for (const r of def.repos ?? [])
             console.log(chalk.gray(`  dir  ${r.path}  ·  ${r.slug}`));
     });
-    /** Merge `--device a b` (variadic) and `--devices a,b,c` (comma list) into one
-     *  deduped device filter; undefined when neither was given (= whole fleet). */
-    function resolveDeviceFilter(device, devices) {
-        const merged = [
-            ...(device ?? []),
-            ...(devices ? devices.split(',').map((s) => s.trim()).filter(Boolean) : []),
-        ];
-        return merged.length ? [...new Set(merged)] : undefined;
-    }
-    /** Print the YAML-side fields that sit under the shared card in `view` mode. */
-    function printProjectDefinition(def, name) {
-        console.log();
-        if (def.root)
-            console.log(`  ${chalk.dim('root')}     ${def.root}`);
-        if (def.defaultPath)
-            console.log(`  ${chalk.dim('path')}     ${def.defaultPath}`);
-        for (const rp of def.repos ?? []) {
-            const where = [rp.subpath ? `subpath ${rp.subpath}` : undefined, rp.path].filter(Boolean).join(' · ');
-            console.log(`  ${chalk.dim('repo')}     ${rp.slug}${where ? chalk.dim(`  (${where})`) : ''}`);
-        }
-        for (const g of def.goals ?? [])
-            console.log(`  ${chalk.dim('goal')}     ${g.objective}${g.measure ? chalk.dim(`  · ${g.measure}`) : ''}`);
-        for (const c of def.contexts ?? [])
-            console.log(`  ${chalk.dim('context')}  ${chalk.cyan(c.path)} ${chalk.dim('—')} ${c.purpose}`);
-        for (const ig of def.integrations ?? []) {
-            console.log(`  ${chalk.dim(ig.kind.padEnd(8))} ${ig.url}${ig.label ? chalk.dim(`  (${ig.label})`) : ''}`);
-        }
-        if (def.linear?.url || def.linear?.projectId || def.linear?.name) {
-            // Lead with the board's own name — the id/url answers "which project",
-            // but the name is what a reader (or an agent) calls the work.
-            const ref = def.linear.url ?? def.linear.projectId;
-            const label = def.linear.name ? chalk.cyan(def.linear.name) : '';
-            console.log(`  ${chalk.dim('linear')}   ${[label, ref && chalk.dim(ref)].filter(Boolean).join('  ')}`);
-        }
-        for (const d of def.docs ?? [])
-            console.log(`  ${chalk.dim('doc')}      ${d}`);
-        console.log(chalk.gray(`  ${projectDefPath(name)}`));
-    }
     async function runProjectCard(name, opts, mode) {
         const detail = mode === 'view';
         const all = listProjectDefs();
@@ -681,7 +681,7 @@ export function registerProjectsCommands(program) {
             const [probeRes, activeRes] = await Promise.all([
                 fleetTargets.length > 0
                     ? gatherRemoteAgentsJson({
-                        args: ['projects', 'probe', '--json', ...fleetTargets],
+                        args: ['projects', 'probe', ...fleetTargets],
                         noFanoutEnv: PROJECTS_NO_FANOUT_ENV,
                         hosts: opts.deviceFilter,
                         parse: parseRemoteProbe,
@@ -765,8 +765,7 @@ export function registerProjectsCommands(program) {
     projects
         .command('status [name]')
         .alias('view')
-        .alias('show')
-        .description('Progress card for every project across the whole fleet, or one named project (aliases: view, show). Named form also prints every milestone and the stored definition.')
+        .description('Progress card for every project across the whole fleet, or one named project (alias: view). Named form also prints every milestone and the stored definition.')
         .option('--json', 'Machine-readable output')
         .option('--window <days>', 'Window for merged PRs, artifacts, and focus areas', '7')
         .option('--no-remote', 'Skip the GitHub and Linear lookups; faster, offline')
@@ -774,8 +773,8 @@ export function registerProjectsCommands(program) {
         .option('--devices <names>', 'Scope fleet status to a comma-separated list of devices')
         .action(async (name, rawOpts) => {
         // Named invocation = `view` depth (all milestones + definition). Unnamed
-        // stays the scannable multi-project rollup. `view`/`show` are commander
-        // aliases of this same command, so there is only one implementation.
+        // stays the scannable multi-project rollup. `view` is a commander alias
+        // of this same command, so there is only one implementation.
         // Fleet is dialled by default; --device/--devices narrows it to a subset.
         const opts = {
             json: rawOpts.json,
@@ -806,7 +805,6 @@ export function registerProjectsCommands(program) {
     projects
         .command('probe [paths...]', { hidden: true })
         .description('Probe workspace repos (presence, branch, drift, dirtiness) and print JSON. Answers for this machine only.')
-        .option('--json', 'Machine-readable output (the only output format)')
         .action((paths) => {
         // Never fans out — the recursion guard env is set by the parent fan-out,
         // and this command has no remote code path either way.
@@ -817,7 +815,6 @@ export function registerProjectsCommands(program) {
         .command('pull-local', { hidden: true })
         .description('Fast-forward workspace repos (default-branch only) and print JSON. Answers for this machine only.')
         .requiredOption('--targets <json>', 'JSON array of {path, expectedSlug} targets, from the orchestrating `pull`')
-        .option('--json', 'Machine-readable output (the only output format)')
         .action(async (opts) => {
         // Never fans out — this is the peer half of the fleet fan-out.
         //
@@ -1158,9 +1155,9 @@ export function registerProjectsCommands(program) {
     });
     // ---- rm ----
     projects
-        .command('rm <name>')
-        .alias('remove')
-        .description('Delete a project definition. Never touches the repo.')
+        .command('remove <name>')
+        .alias('rm')
+        .description('Remove a project definition. Never touches the repo.')
         .option('--json', 'Machine-readable success / error')
         .action((name, opts) => {
         if (!isSafeProjectName(name)) {
@@ -1172,22 +1169,19 @@ export function registerProjectsCommands(program) {
             }
             process.exit(1);
         }
-        if (removeProjectDef(name)) {
-            if (opts.json) {
-                console.log(JSON.stringify({ ok: true, name, removed: true }));
-            }
-            else {
-                console.log(chalk.green(`Removed project "${name}"`));
-            }
+        const removed = removeProjectDef(name);
+        if (opts.json) {
+            console.log(JSON.stringify(removed
+                ? { ok: true, name, removed: true }
+                : { ok: false, name, error: `No project named "${name}"` }));
+        }
+        else if (removed) {
+            console.log(chalk.green(`Removed project "${name}"`));
         }
         else {
-            if (opts.json) {
-                console.log(JSON.stringify({ ok: false, name, error: `No project named "${name}"` }));
-            }
-            else {
-                console.error(chalk.red(`No project named "${name}".`));
-            }
-            process.exit(1);
+            console.error(chalk.red(`No project named "${name}".`));
         }
+        if (!removed)
+            process.exit(1);
     });
 }

package/dist/commands/resume.js

@@ -102,7 +102,7 @@ export async function runStrictResume(sessionId, prompt, options) {
         // one re-discovers locally and marks the run AGENTS_FLEET_REMOTE, which
         // a long-lived resumed session must not inherit.
         const { runOnPeer } = await import('../lib/session/remote-list.js');
-        const rc = await runOnPeer(buildResumeRemoteArgs(outcome.session.id, prompt, options), owner, { tty: !!process.stdout.isTTY, env: { [RESUME_PINNED_ENV]: '1' } });
+        const rc = await runOnPeer(buildResumeRemoteArgs(outcome.session.id, prompt, options), owner, { tty: !!process.stdout.isTTY, env: { [RESUME_PINNED_ENV]: '1' }, sessionId: outcome.session.id });
         if (rc === 'no-target') {
             console.error(chalk.red(`Session ${outcome.session.shortId} lives on ${owner}, which isn't a reachable device right now.`));
             console.error(chalk.gray(`Register/wake it (agents devices), or run there: agents ssh ${owner}`));

package/dist/commands/route.js

@@ -243,15 +243,15 @@ export function registerRouteCommands(program) {
         console.log(chalk.green(`Router '${name}': unlinked ${harness} account '${account}'`));
     });
     routeCmd
-        .command('rm <name>')
-        .alias('remove')
-        .description('Delete a router.')
+        .command('remove <name>')
+        .alias('rm')
+        .description('Remove a router.')
         .action((name) => {
         const source = routerSource(name);
         if (source === null)
             die(`Router '${name}' not found.`);
         if (source !== 'user') {
-            die(`Router '${name}' resolves from the '${source}' layer, not 'user' -- agents route rm can only remove a user-layer router.`);
+            die(`Router '${name}' resolves from the '${source}' layer, not 'user' -- agents route remove can only remove a user-layer router.`);
         }
         const existed = deleteRouter(name);
         if (!existed)

package/dist/commands/routines.js

@@ -1281,7 +1281,8 @@ export function registerRoutinesCommands(program) {
         }
     });
     routinesCmd
-        .command('cleanup')
+        .command('prune')
+        .alias('cleanup')
         .description('Remove expired one-shot routines that already fired and still have a user-layer YAML file.')
         .option('--dry-run', 'Show routines that would be removed without deleting files')
         .action((options) => {
@@ -1297,7 +1298,7 @@ export function registerRoutinesCommands(program) {
             for (const job of jobs) {
                 console.log(`  ${chalk.cyan(job.name)} ${chalk.gray(scheduleLabel(job))}`);
             }
-            console.log(chalk.gray(`\nDry run. Remove with: agents routines cleanup`));
+            console.log(chalk.gray(`\nDry run. Remove with: agents routines prune`));
             return;
         }
         let removed = 0;

package/dist/commands/run-broadcast.d.ts

@@ -2,7 +2,7 @@
  * `agents run --broadcast` — run the same task/prompt across an agent × model
  * matrix (formerly `agents bench`).
  *
- * Task definitions live under apps/cli/bench/tasks/<id>/task.json.
+ * Task definitions live under cli/bench/tasks/<id>/task.json.
  */
 export interface BroadcastOpts {
     listTasks?: boolean;

package/dist/commands/run-broadcast.js

@@ -2,7 +2,7 @@
  * `agents run --broadcast` — run the same task/prompt across an agent × model
  * matrix (formerly `agents bench`).
  *
- * Task definitions live under apps/cli/bench/tasks/<id>/task.json.
+ * Task definitions live under cli/bench/tasks/<id>/task.json.
  */
 import * as fs from 'fs';
 import * as path from 'path';

package/dist/commands/sessions-picker.d.ts

@@ -69,6 +69,26 @@ export declare function buildPreview(session: SessionMeta): string;
  * machine — far too much for a pane that repaints as the cursor moves. The line
  * names the command that does report them instead.
  */
+/**
+ * The "what did this session leave running" segments of the Doing line.
+ *
+ * Prefers a DERIVED count (fresh, from the transcript the caller just parsed)
+ * and falls back to the PERSISTED column, which is what lets a remote/unindexed
+ * row — rendered from `SessionMeta` alone, with no events — show fan-out at all.
+ * That fallback is the whole reason the counts are columns (RUSH-3091/3095).
+ *
+ * A count of 0 or undefined renders NOTHING. Both are real states — "scanned,
+ * none found" and "this harness cannot report it" — and a literal "0 background
+ * shells" would assert "nothing is running" for a harness that simply does not
+ * record them.
+ *
+ * Wording is "left behind", not "running": a transcript records a start and
+ * never a death (see extractBackgroundShells).
+ */
+export declare function formatFanOut(session: SessionMeta, derived?: {
+    subAgentCount?: number;
+    backgroundShellCount?: number;
+}): string[];
 export declare function formatTeamLineage(session: SessionMeta): string;
 /**
  * The three timing facts the header reports: when the session was created, when
@@ -94,6 +114,8 @@ export interface SessionPreviewDigest {
     planFile: string;
     todos?: TodoProgress;
     subAgentCount: number;
+    /** undefined when the harness records no background-shell concept. */
+    backgroundShellCount?: number;
     toolTags: string[];
     changes: ReturnType<typeof changeCounts>;
     dirs: string[];

package/dist/commands/sessions-picker.js

@@ -22,7 +22,7 @@ import { terminalWidth, stringWidth } from '../lib/session/width.js';
 import { itemPicker } from '../lib/picker.js';
 import { createMemoryCache } from '../lib/memory-cache.js';
 import { classifyFileChanges, changeCounts, toolHistogram, detectTestResult } from '../lib/session/digest.js';
-import { extractArtifacts, extractHooks, extractLinks, extractRepos, extractSkills } from '../lib/session/highlights.js';
+import { extractArtifacts, extractHooks, extractLinks, extractRepos, extractSkills, harnessTracksBackgroundShells, isBackgroundShellStart, isSubAgentTool, } from '../lib/session/highlights.js';
 import { getSessionPlugins, readSessionPreviewCache, writeSessionPreviewCache, readSessionContent, readArchivedSessionPreview } from '../lib/session/db.js';
 /** A session whose transcript FILE is on another machine (folded in over the
  * live cross-machine fan-out): its `filePath` is on that peer's disk, so the
@@ -222,6 +222,10 @@ export function sanitizeRemoteDigest(raw) {
         planFile: str(d.planFile),
         todos,
         subAgentCount: num(d.subAgentCount),
+        // optNum, not num: a peer's JSON is untrusted, and the undefined-vs-0
+        // distinction is load-bearing here — num() would coerce a malformed value
+        // to 0, which reads as "scanned, none running".
+        backgroundShellCount: optNum(d.backgroundShellCount),
         toolTags: strList(d.toolTags),
         changes,
         dirs: strList(d.dirs),
@@ -472,6 +476,37 @@ function formatHeader(session, events) {
  * machine — far too much for a pane that repaints as the cursor moves. The line
  * names the command that does report them instead.
  */
+/**
+ * The "what did this session leave running" segments of the Doing line.
+ *
+ * Prefers a DERIVED count (fresh, from the transcript the caller just parsed)
+ * and falls back to the PERSISTED column, which is what lets a remote/unindexed
+ * row — rendered from `SessionMeta` alone, with no events — show fan-out at all.
+ * That fallback is the whole reason the counts are columns (RUSH-3091/3095).
+ *
+ * A count of 0 or undefined renders NOTHING. Both are real states — "scanned,
+ * none found" and "this harness cannot report it" — and a literal "0 background
+ * shells" would assert "nothing is running" for a harness that simply does not
+ * record them.
+ *
+ * Wording is "left behind", not "running": a transcript records a start and
+ * never a death (see extractBackgroundShells).
+ */
+export function formatFanOut(session, derived) {
+    // DERIVED wins when the caller has one. It is computed from the transcript as
+    // it stands right now, whereas the persisted column is only as fresh as the
+    // last scan — for a live session those disagree within seconds. The persisted
+    // value is the fallback that makes a remote/unindexed row (no events, so no
+    // derived value) render at all, which is the whole reason it is a column.
+    const subAgents = derived?.subAgentCount ?? session.subAgentCount ?? 0;
+    const shells = derived?.backgroundShellCount ?? session.backgroundShellCount ?? 0;
+    const out = [];
+    if (subAgents > 0)
+        out.push(chalk.gray(`${subAgents} sub-agent${subAgents === 1 ? '' : 's'}`));
+    if (shells > 0)
+        out.push(chalk.gray(`${shells} background shell${shells === 1 ? '' : 's'}`));
+    return out;
+}
 export function formatTeamLineage(session) {
     const origin = session.teamOrigin;
     if (origin) {
@@ -505,7 +540,7 @@ function formatMetaOnlyBody(session) {
     }
     const compact = formatTodoCompact(session.todos);
     const teamLine = formatTeamLineage(session);
-    const doing = [compact ? chalk.white(compact) : '', teamLine].filter(Boolean);
+    const doing = [compact ? chalk.white(compact) : '', teamLine, ...formatFanOut(session)].filter(Boolean);
     if (doing.length) {
         lines.push(verbLabel('Doing') + doing.join(DOT));
     }
@@ -630,6 +665,12 @@ export function buildSessionPreviewDigest(events, session) {
     /** Latest checklist from the transcript (Claude TodoWrite / Codex update_plan). */
     let latestTodos;
     let subAgentCount = 0;
+    // undefined, not 0, when the harness records no background-shell concept —
+    // formatFanOut renders absence for both, but conflating them here would let a
+    // later consumer read "0 shells" as a positive "none running" claim.
+    let backgroundShellCount = harnessTracksBackgroundShells(session.agent)
+        ? 0
+        : undefined;
     const toolTags = new Set();
     // usedBrowser/usedComputer are computed at scan time from a sessionId-scoped
     // events-log read (session/db.ts detectToolUsage), NOT a transcript regex —
@@ -658,6 +699,8 @@ export function buildSessionPreviewDigest(events, session) {
             }
             if (isSubAgentTool(tool, command))
                 subAgentCount++;
+            if (backgroundShellCount !== undefined && isBackgroundShellStart(event))
+                backgroundShellCount++;
             const p = event.path || event.args?.file_path || event.args?.path || '';
             if (['Read', 'read_file', 'view_file', 'cat_file', 'get_file'].includes(tool) && p) {
                 filesRead.add(p);
@@ -700,6 +743,7 @@ export function buildSessionPreviewDigest(events, session) {
         planFile,
         todos,
         subAgentCount,
+        backgroundShellCount,
         toolTags: [...toolTags],
         changes: chg,
         dirs: directoriesTouched(session, events, changes),
@@ -722,7 +766,7 @@ function verbLabel(v) {
     return chalk.cyan(v.padEnd(VERB_GUTTER)) + ' ';
 }
 function formatCompactPreview(digest, session, events) {
-    const { firstUser, lastAssistant, filesRead, toolCalls, planFile, todos, subAgentCount, toolTags, changes: chg, dirs, repos, artifacts, skills, plugins, hooks, links, errorCount, firstError, toolHistogram: hist, test, } = digest;
+    const { firstUser, lastAssistant, filesRead, toolCalls, planFile, todos, subAgentCount, backgroundShellCount, toolTags, changes: chg, dirs, repos, artifacts, skills, plugins, hooks, links, errorCount, firstError, toolHistogram: hist, test, } = digest;
     const lines = [];
     const termWidth = process.stdout.columns || 80;
     const valueWidth = termWidth - VERB_GUTTER - 5;
@@ -740,7 +784,7 @@ function formatCompactPreview(digest, session, events) {
     const doing = [
         compact ? chalk.white(compact) : '',
         teamLine,
-        subAgentCount ? chalk.gray(`${subAgentCount} sub-agent${subAgentCount === 1 ? '' : 's'}`) : '',
+        ...formatFanOut(session, { subAgentCount, backgroundShellCount }),
     ].filter(Boolean);
     if (doing.length) {
         lines.push(verbLabel('Doing') + doing.join(DOT));
@@ -854,11 +898,6 @@ function classifySessionTool(tool, command) {
         tags.push('computer');
     return tags;
 }
-function isSubAgentTool(tool, command) {
-    if (/^(Agent|Task)$/i.test(tool))
-        return true;
-    return /\b(?:agents|ag)\b[^\n;&|]*\b(?:run|cloud\s+run|teams\s+(?:add|start))\b/.test(command);
-}
 /**
  * Unique directories the session touched, compact and human-readable.
  * Prefer `session.recentDirectoriesTouched` — the scan records it on the row, so

package/dist/commands/sessions-trace.js

@@ -267,7 +267,7 @@ Three or more selectors, and --tree with more than one selector, fail loud.`,
                 return;
             }
             // HTML.
-            const html = renderLineageHtml(lineage);
+            const html = renderLineageHtml(lineage, redact);
             if (options.output) {
                 fs.writeFileSync(options.output, html, { mode: 0o600 });
                 process.stdout.write(`${path.resolve(options.output)}\n`);

package/dist/commands/sessions.js

@@ -3853,6 +3853,7 @@ export async function resumeOnOwnerIfRemote(session) {
     const rc = await runOnPeer(['sessions', 'resume', session.id], owner, {
         tty: true,
         env: { [RESUME_PINNED_ENV]: '1' },
+        sessionId: session.id,
     });
     if (rc === 'no-target')
         warnNoPeerTarget(owner, session);

package/dist/commands/setup-secrets.js

@@ -61,6 +61,27 @@ function applySecretsDefaults(backend, policy) {
 function backendArgs(backend) {
     return backend === 'vault' ? ['--synced'] : ['--backend', backend];
 }
+/**
+ * Provision the signed macOS keychain broker on the explicit onboarding path.
+ * This is the async, download-capable trigger the hot sync `getKeychainHelperPath()`
+ * fails loud toward: with a bundled `.app` it is a local copy (no network); on a
+ * tarball that lacks the bundle it fetches the verified release asset. Best-effort
+ * — the wizard's saved prefs must survive an offline provision failure; the next
+ * secret op re-points here.
+ */
+async function maybeProvisionKeychainHelper(backend) {
+    if (backend !== 'keychain' || process.platform !== 'darwin')
+        return;
+    const { ensureKeychainHelperInstalledAsync } = await import('../lib/secrets/install-helper.js');
+    try {
+        await ensureKeychainHelperInstalledAsync();
+        console.log(chalk.gray('keychain helper: installed the signed broker for this version.'));
+    }
+    catch (err) {
+        console.error(chalk.yellow(`keychain helper not installed: ${err.message}\n` +
+            'Re-run `agents setup secrets` once online, or reinstall agents-cli.'));
+    }
+}
 function printBackendNotes(backend) {
     if (backend === 'keychain') {
         console.log(chalk.gray('backend: keychain — macOS reads may ask for Touch ID or the device password.'));
@@ -189,6 +210,8 @@ export async function runSecretsSetupWizard(opts = {}) {
         defaultPolicy: policy,
         updatedAt: new Date().toISOString(),
     });
+    // Provision the signed keychain broker before any import subprocess reads it.
+    await maybeProvisionKeychainHelper(backend);
     await maybeImportSecrets(importSource, {
         bundle: opts.bundle,
         vault: opts.vault,

package/dist/commands/share.d.ts

@@ -1,8 +1,9 @@
-import type { Command } from 'commander';
+import { type Command } from 'commander';
 import { type ShareConfig } from '../lib/share/config.js';
 import { type CloudflareRequester } from '../lib/share/provision.js';
 import { type PublishResult } from '../lib/share/publish.js';
 import { deleteShare, type DeleteShareResult } from '../lib/share/delete.js';
+import type { PhoenixSession } from '../lib/identity/client.js';
 export declare function formatSharePublishResult(result: PublishResult, json?: boolean): string;
 /** Compare the configured endpoint's last-deployed template hash against the
  * hash of the CURRENT `worker-template.ts` render. A config with no recorded
@@ -61,10 +62,16 @@ export declare function parseShareListing(user: string, body: string): ShareList
  * Worker's `?format=json` route. Fails loud when share was never configured, when
  * the deployed template is known-outdated (RUSH-2449 templateHash), or when the
  * live response proves the route is absent (404 or a non-JSON 200 = the old HTML
- * gallery) — never a silent empty/wrong result. */
+ * gallery) — never a silent empty/wrong result. Signed-in users hit the managed
+ * endpoint; BYO still uses `readShareConfig()`. */
 export declare function runShareList(opts?: {
     githubUser?: string;
     config?: ShareConfig;
+    writeToken?: string;
+    byo?: boolean;
+    /** DI seam — override `readSession()`. Named `phoenixSession` because
+     * `session` is already the listing filter (session id). */
+    phoenixSession?: PhoenixSession | null;
     fetchListing?: ListingFetchFn;
     /** Only shares published by this agent/harness (case-insensitive, exact). */
     agent?: string;
@@ -111,6 +118,9 @@ export declare function parseShareRevisions(key: string, body: string): ShareRev
 export declare function runShareRevisions(target: string, opts?: {
     githubUser?: string;
     config?: ShareConfig;
+    writeToken?: string;
+    byo?: boolean;
+    session?: PhoenixSession | null;
     fetchListing?: ListingFetchFn;
 }): Promise<ShareRevisionsResult>;
 export declare function formatShareRevisions(result: ShareRevisionsResult, json?: boolean): string;
@@ -156,6 +166,8 @@ export declare function runShareProvision(opts: {
     domain?: string;
     analyticsToken?: string;
     request?: CloudflareRequester;
+    /** Bind PHOENIX_ID_BASE even when the mapped hostname is not the managed domain. */
+    managed?: boolean;
 }): Promise<void>;
 export interface ShareUpdateResult {
     updated: boolean;
@@ -167,15 +179,18 @@ export interface ShareUpdateResult {
  * current `worker-template.ts`. Reuses the existing account/worker/bucket and
  * write token from `readShareConfig()`/the `share` bundle — never creates a
  * bucket, touches routes/domains, or regenerates the token (see
- * `updateWorker` in `lib/share/provision.ts` for how the token survives the
- * re-upload). Idempotent: no-ops when the deployed hash already matches
- * unless `force`. */
+ * `updateWorker` in `lib/share/provision.ts` for how the token — and, on a
+ * managed endpoint, `PHOENIX_ID_BASE` — survives the re-upload). Idempotent:
+ * no-ops the script upload when the deployed hash already matches unless
+ * `force`; a managed endpoint still re-applies `PHOENIX_ID_BASE`. */
 export declare function runShareUpdate(opts?: {
     bundle?: string;
     account?: string;
     token?: string;
     force?: boolean;
     request?: CloudflareRequester;
+    /** Bind PHOENIX_ID_BASE even when the configured hostname is not the managed domain. */
+    managed?: boolean;
 }): Promise<ShareUpdateResult>;
 /** Join an existing share endpoint (no provisioning): prompt for the endpoint
  * details + write token and persist them. Shared by `agents artifacts share join`