@phnx-labs/agents-cli 1.22.52 → 1.22.54

package/dist/commands/sessions.js

@@ -18,7 +18,7 @@ import { sanitizeForTerminal, redactSecrets } from '../lib/redact.js';
 import { resolveProjectKey } from '../lib/project-key.js';
 import { listProjectDefs, resolveProjectNameForCwd } from '../lib/projects.js';
 import ora from 'ora';
-import { SESSION_AGENTS, isAgentTmuxAlias } from '../lib/session/types.js';
+import { SESSION_AGENTS, isAgentTmuxAlias, sessionDisplayAgent } from '../lib/session/types.js';
 import { discoverArtifacts, readArtifact, resolveArtifact } from '../lib/session/artifacts.js';
 import { looksLikePath, toComparablePath, homeDir, needsWindowsShell, composeWin32CommandLine } from '../lib/platform/index.js';
 import { getActiveSessions, describeActiveDiscoveryHealth, sessionProcessIsLocal, backfillActiveRowsFromIndex, isRunningLiveSession, serializeActiveSessionsForJson, serializeSessionsJson, shortIdFromName } from '../lib/session/active.js';
@@ -233,9 +233,10 @@ async function renderArtifactsForSession(session, listAll, name) {
         console.log(chalk.gray('No file-write artifacts found in this session.'));
         return;
     }
-    const agentColor = colorAgent(session.agent);
+    const shown = sessionDisplayAgent(session);
+    const agentColor = colorAgent(shown);
     console.log('');
-    console.log(agentColor(session.agent) +
+    console.log(agentColor(shown) +
         chalk.gray(` · ${session.shortId} · ${formatRelativeTime(session.timestamp)}`));
     console.log(chalk.gray('─'.repeat(72)));
     for (const a of artifacts) {
@@ -726,7 +727,8 @@ function fitCell(content, room) {
  */
 export function renderActiveRowLines(s, indent, termW) {
     const idCol = chalk.dim(padToWidth((s.sessionId?.slice(0, 8)) ?? '-', ROW_ID_W));
-    const kindCol = colorAgent(s.kind)(padToWidth(truncateToWidth(s.kind, ROW_AGENT_W), ROW_AGENT_W + 1));
+    const shownKind = sessionDisplayAgent({ agent: s.kind, harness: s.harness });
+    const kindCol = colorAgent(shownKind)(padToWidth(truncateToWidth(shownKind, ROW_AGENT_W), ROW_AGENT_W + 1));
     const versionCol = chalk.gray(padToWidth(truncateToWidth(s.version ?? '', ROW_VERSION_W), ROW_VERSION_W + 1));
     const statusCol = statusColor(s.status)(padToWidth(truncateToWidth(activityLabel(s), ROW_STATUS_W - 1), ROW_STATUS_W));
     const ownerCol = chalk.cyan(padToWidth(truncateToWidth(ownerLabel(s), ROW_OWNER_W - 1), ROW_OWNER_W));
@@ -1010,6 +1012,7 @@ export function serializeResolvedSessionsJson(sessions) {
         id: session.id,
         shortId: session.shortId,
         agent: session.agent,
+        harness: session.harness,
         origin: session.origin,
         timestamp: session.timestamp,
         lastActivity: session.lastActivity,
@@ -1805,7 +1808,8 @@ function runOutcomeDetail(meta) {
 /** Compact per-session metadata line under a linked session row. */
 function linkedSessionMeta(session) {
     const parts = [];
-    parts.push(session.version ? `${session.agent} v${session.version}` : session.agent);
+    const shown = sessionDisplayAgent(session);
+    parts.push(session.version ? `${shown} v${session.version}` : shown);
     if (session.account)
         parts.push(session.account);
     if (session.model)
@@ -1974,7 +1978,7 @@ export async function renderSessionPreview(query, scope) {
     if (outcome.kind !== 'resolved'
         && (!scope.hosts?.length || shouldIncludeLocal(scope.hosts, machineId()))) {
         const discovered = applyScopeFilters(await discoverSessions({ all: true, cwd: process.cwd(), limit: 5000, waitForScan: true }), scope);
-        const localMatches = resolveSessionQuery(discovered, query, { indexFallback: false }).matches
+        const localMatches = resolveSessionQuery(discovered, query, { indexFallback: false, scope }).matches
             .map(session => ({ ...session, machine: session.machine || machineId() }));
         const exact = localMatches.find(session => selectorAllowsEarlyExit(query)
             && session.id.toLowerCase() === query.trim().toLowerCase());
@@ -2670,7 +2674,11 @@ limitSource) {
         if (toolEvidenceMode) {
             const self = toolSelf;
             const selectedSessions = searchQuery
-                ? filterSessionsByQuery(sessions, searchQuery)
+                ? filterSessionsByQuery(sessions, searchQuery, {
+                    agent: options.agent,
+                    project: options.project,
+                    routine: options.routine,
+                })
                 : sessions;
             const localSessions = selectedSessions;
             const mayFanOut = options.local !== true && process.env[NO_FANOUT_ENV] !== '1';
@@ -2767,7 +2775,9 @@ limitSource) {
             // that merely MENTIONS the id, defeating exact remote resolution. A genuine
             // search phrase keeps the ranked metadata+content path.
             const filtered = searchQuery
-                ? resolveSessionQuery(sessions, searchQuery).matches
+                ? resolveSessionQuery(sessions, searchQuery, {
+                    scope: { agent: options.agent, project: options.project, routine: options.routine },
+                }).matches
                 : sessions;
             // JSON is the canonical picker contract: enrich the durable rows once
             // from the shared live cache so every consumer gets lifecycle/recovery
@@ -2876,7 +2886,7 @@ limitSource) {
             const message = pathFilter
                 ? `Search sessions (${path.basename(pathFilter)}):`
                 : formatSearchMessage(options);
-            const picked = await pickSessionInteractive(sessions, message, searchQuery, hiddenCount);
+            const picked = await pickSessionInteractive(sessions, message, searchQuery, hiddenCount, undefined, { agent: options.agent, project: options.project, routine: options.routine });
             if (picked) {
                 await handlePickedSession(picked);
                 return;
@@ -2884,7 +2894,13 @@ limitSource) {
             return;
         }
         // Non-interactive fallback (piped output) or --flat/--tree.
-        const filtered = searchQuery ? filterSessionsByQuery(sessions, searchQuery) : sessions;
+        const filtered = searchQuery
+            ? filterSessionsByQuery(sessions, searchQuery, {
+                agent: options.agent,
+                project: options.project,
+                routine: options.routine,
+            })
+            : sessions;
         const liveIndex = await maybeLiveIndex(options);
         printSessionTable(filtered, hiddenCount, options.tree === true, liveIndex);
         // Every listing path must say what it dropped — a hidden default that stays
@@ -2996,7 +3012,8 @@ function timeCell(age, topicSlack) {
  * when `showTicket` — otherwise a listing with no refs would waste a column of
  * dashes and needlessly truncate the topic. Worktree stays a trailing badge. */
 export function flatSessionRow(session, live, showTicket = false, cols = {}, bookmarked = false) {
-    const agentColor = colorAgent(session.agent);
+    const shown = sessionDisplayAgent(session);
+    const agentColor = colorAgent(shown);
     const age = sessionAgeParts(session.timestamp, session.lastActivity);
     const project = session.project || '-';
     const tag = originTag(session) || teamTag(session);
@@ -3045,7 +3062,7 @@ export function flatSessionRow(session, live, showTicket = false, cols = {}, boo
     const topicW = Math.max(MIN_TOPIC_W, width - fixedW - modelW - when.extraW);
     return (bookmarkCell +
         chalk.white(padToWidth(truncateToWidth(session.shortId, 9), 10)) +
-        agentColor(padToWidth(truncateToWidth(session.agent, 8), 9)) +
+        agentColor(padToWidth(truncateToWidth(shown, 8), 9)) +
         chalk.yellow(padToWidth(truncateToWidth(session.version || '-', 7), 8)) +
         (modelW ? chalk.yellow(padToWidth(truncateToWidth(modelLabel(session.model), modelW - 1), modelW)) : '') +
         machineCell +
@@ -3060,7 +3077,8 @@ export function flatSessionRow(session, live, showTicket = false, cols = {}, boo
 }
 /** One tree-mode row (grouped under a dir header): id · agent · badges · topic · time. No version/project column. */
 function treeSessionRow(session, live) {
-    const agentColor = colorAgent(session.agent);
+    const shown = sessionDisplayAgent(session);
+    const agentColor = colorAgent(shown);
     const age = sessionAgeParts(session.timestamp, session.lastActivity);
     const tag = originTag(session) || teamTag(session);
     const label = session.label;
@@ -3082,7 +3100,7 @@ function treeSessionRow(session, live) {
     const topicW = Math.max(12, baseTopicW - when.extraW);
     return ('  ' +
         chalk.dim(padToWidth(session.shortId, 9)) +
-        agentColor(padToWidth(truncateToWidth(session.agent, 7), 8)) +
+        agentColor(padToWidth(truncateToWidth(shown, 7), 8)) +
         (badges ? badges + ' ' : '') +
         (glyph ? glyph + ' ' : '') +
         statusCell +
@@ -3246,7 +3264,8 @@ const TEAM_HANDLE_W = 16;
  * identity the `--teams` view exists to show (RUSH-1997).
  */
 function teamMemberRow(session, live) {
-    const agentColor = colorAgent(session.agent);
+    const shown = sessionDisplayAgent(session);
+    const agentColor = colorAgent(shown);
     const origin = session.teamOrigin;
     const age = sessionAgeParts(session.timestamp, session.lastActivity);
     const handle = safeTeamText(origin?.handle) ?? session.shortId;
@@ -3267,7 +3286,7 @@ function teamMemberRow(session, live) {
     const topicW = Math.max(12, baseTopicW - when.extraW);
     return ('  ' +
         chalk.dim(padToWidth(session.shortId, 9)) +
-        agentColor(padToWidth(truncateToWidth(session.agent, 7), 8)) +
+        agentColor(padToWidth(truncateToWidth(shown, 7), 8)) +
         chalk.yellow(padToWidth(truncateToWidth(mode || '-', TEAM_MODE_W), TEAM_MODE_W + 1)) +
         (badges ? badges + ' ' : '') +
         (glyph ? glyph + ' ' : '') +
@@ -3444,13 +3463,14 @@ function renderArchivedSession(session, mode, options = {}) {
         }, null, 2));
         return;
     }
-    const agentColor = colorAgent(session.agent);
+    const shown = sessionDisplayAgent(session);
+    const agentColor = colorAgent(shown);
     const absTime = formatAbsoluteTime(session.timestamp);
     const title = session.label || session.topic;
     console.log('');
     if (title)
         console.log(chalk.bold.white(title));
-    console.log(agentColor(session.agent) +
+    console.log(agentColor(shown) +
         (session.version ? chalk.yellow(` ${session.version}`) : '') +
         (session.project ? chalk.cyan(`  ${session.project}`) : '') +
         chalk.gray(`  ${absTime} (${formatRelativeTime(session.timestamp)})`) +
@@ -3481,7 +3501,7 @@ async function renderSession(session, mode, filters, options = {}) {
         console.log(chalk.yellow('Session transcript not available (file no longer exists).'));
         console.log(chalk.gray(`Path: ${session.filePath}`));
         if (session.version)
-            console.log(chalk.gray(`Version: ${session.agent} ${session.version}`));
+            console.log(chalk.gray(`Version: ${sessionDisplayAgent(session)} ${session.version}`));
         if (session.project)
             console.log(chalk.gray(`Project: ${session.project}`));
         if (session.account)
@@ -3489,11 +3509,12 @@ async function renderSession(session, mode, filters, options = {}) {
         console.log(chalk.gray(`Time: ${session.timestamp}`));
         return;
     }
-    const spinner = ora(`Parsing ${session.agent} session...`).start();
+    const spinner = ora(`Parsing ${sessionDisplayAgent(session)} session...`).start();
     const parsedEvents = parseSession(session.filePath, session.agent);
     spinner.stop();
     let events = filterEvents(parsedEvents, filters);
-    const agentColor = colorAgent(session.agent);
+    const shown = sessionDisplayAgent(session);
+    const agentColor = colorAgent(shown);
     console.log('');
     if (mode === 'summary') {
         const stats = computeSummaryStats(events);
@@ -3507,7 +3528,7 @@ async function renderSession(session, mode, filters, options = {}) {
             const badges = signalBadges(metaSignals(session));
             console.log(chalk.bold.white(title) + (badges ? '  ' + badges : ''));
         }
-        console.log(agentColor(session.agent) +
+        console.log(agentColor(shown) +
             (session.version ? chalk.yellow(` ${session.version}`) : '') +
             modelStr +
             (session.project ? chalk.cyan(`  ${session.project}`) + branchStr : branchStr) +
@@ -3521,7 +3542,7 @@ async function renderSession(session, mode, filters, options = {}) {
         return;
     }
     if (mode === 'markdown') {
-        console.log(agentColor(session.agent) +
+        console.log(agentColor(shown) +
             (session.version ? chalk.yellow(` ${session.version}`) : '') +
             (session.project ? chalk.cyan(` ${session.project}`) : '') +
             chalk.gray(` ${formatRelativeTime(session.timestamp)}`) +
@@ -3662,7 +3683,8 @@ export function liveHostLabel(a) {
     return viewer && viewer !== a.host ? `${a.host}→${viewer}` : a.host;
 }
 export function formatPickerLabel(s, query, cols = {}, ssh, host = '', bookmarked = false, live) {
-    const agentColor = colorAgent(s.agent);
+    const shown = sessionDisplayAgent(s);
+    const agentColor = colorAgent(shown);
     const age = sessionAgeParts(s.timestamp, s.lastActivity);
     const project = s.project || '-';
     // SSH-launch origin (live rows only): mirrors the flat listing's `ssh←<device>`
@@ -3727,7 +3749,7 @@ export function formatPickerLabel(s, query, cols = {}, ssh, host = '', bookmarke
         // live row with no session id is named by its pid or cloud task, which can
         // run past the column and shunt every later column out of alignment.
         chalk.white(padRight(truncate(s.shortId, 9), 10)) +
-        agentColor(padRight(truncate(s.agent, 8), 9)) +
+        agentColor(padRight(truncate(shown, 8), 9)) +
         chalk.yellow(padRight(truncate(versionStr, 7), 8)) +
         machineCell +
         hostCell +
@@ -3754,7 +3776,7 @@ const PICKER_TIPS = [
 export function formatPickerTip(sessions) {
     return chalk.gray(PICKER_TIPS[sessions.length % PICKER_TIPS.length]);
 }
-export async function pickSessionInteractive(sessions, message = 'Search sessions:', initialSearch, hiddenCount = 0, enterHint) {
+export async function pickSessionInteractive(sessions, message = 'Search sessions:', initialSearch, hiddenCount = 0, enterHint, scope) {
     // The hidden-session footer is console.log'd above the Inquirer prompt, so it
     // scrolls the viewport the picker can't measure; tell the picker to reserve for
     // it (see pickerPageSize) so the preview and the footer stay on screen together.
@@ -3774,7 +3796,7 @@ export async function pickSessionInteractive(sessions, message = 'Search session
                 // Typing: search the full pool.
                 if (!query.trim())
                     return sessions;
-                return filterSessionsByQuery(sessions, query);
+                return filterSessionsByQuery(sessions, query, scope);
             },
             labelFor: (s, query) => formatPickerLabel(s, query, cols),
             pageSize: PICKER_RECENT_COUNT,
@@ -4169,7 +4191,7 @@ export function resolveSessionQuery(pool, query, options = {}) {
         const matches = options.indexFallback === false ? [] : findSessionsById(normalized);
         return { matches, byId: true, completeId };
     }
-    return { matches: filterSessionsByQuery(pool, normalized), byId: false, completeId };
+    return { matches: filterSessionsByQuery(pool, normalized, options.scope), byId: false, completeId };
 }
 /** Explain an ambiguous resolution. Only a short id can be lengthened: a complete
  * id is already maximal, and a search phrase was never an id to begin with. */
@@ -4208,7 +4230,7 @@ export function fleetNotFoundMessage(query, deviceCount, unreachable) {
     return lines;
 }
 /** Filter and rank sessions by a multi-term search query across metadata and content. */
-export function filterSessionsByQuery(sessions, query) {
+export function filterSessionsByQuery(sessions, query, scope) {
     const trimmed = query?.trim().toLowerCase() || '';
     if (!trimmed)
         return sessions;
@@ -4218,7 +4240,9 @@ export function filterSessionsByQuery(sessions, query) {
         return sessions.filter((session) => session.agent === agent && session.version === version);
     }
     const terms = trimmed.split(/\s+/).filter(Boolean);
-    const contentIndex = searchContentIndex(sessions, trimmed);
+    // Hydrate FTS hits missing from the pool (PHNX-2767), then drop hits that
+    // fail --project/--agent/--routine so those flags are not undone by the union.
+    const contentIndex = scopedContentIndex(sessions, trimmed, scope);
     // If the query exactly matches a session label, short-circuit the structural
     // scorer (which would otherwise surface every session whose topic happens to
     // contain the same words) and return only the label hits.
@@ -4227,7 +4251,15 @@ export function filterSessionsByQuery(sessions, query) {
     if (exactLabelHits.length > 0) {
         return exactLabelHits.sort((a, b) => (b._bm25Score ?? 0) - (a._bm25Score ?? 0));
     }
-    return sessions
+    // The listing pool is a page of the index. FTS hits the whole index. Union
+    // so a grep-visible transcript is returned even when it missed the page
+    // (PHNX-2767).
+    const poolById = new Map(sessions.map(s => [s.id, s]));
+    for (const [id, hit] of contentIndex) {
+        if (!poolById.has(id))
+            poolById.set(id, hit);
+    }
+    return [...poolById.values()]
         .map(session => ({ session, score: scoreSessionQuery(session, terms) }))
         .filter(entry => {
         // Include if scored by topic/project/etc, or matched by content search
@@ -4304,6 +4336,11 @@ function scoreSessionQuery(session, terms) {
  * Without this, a query like "scoped search" could match sessions in BOTH
  * the project you specified AND elsewhere, producing an ambiguity error
  * even though the user already pointed at the correct scope.
+ *
+ * PHNX-2767 hydrates FTS hits missing from the listing pool *after* this
+ * runs, so callers that search must also pass the same scope into
+ * `filterSessionsByQuery` / `scopedContentIndex` or the union
+ * reintroduces the rows this function just dropped.
  */
 export function applyScopeFilters(sessions, scope) {
     let filtered = sessions;
@@ -4340,6 +4377,23 @@ export function applyScopeFilters(sessions, scope) {
     }
     return filtered;
 }
+/**
+ * PHNX-2767 hydrates FTS hits missing from the listing pool. That union is
+ * unscoped on purpose (cwd/limit are a page of the index, not a filter).
+ * `--project` / `--agent` / `--routine` ARE filters: drop hydrated hits that
+ * fail them so content search cannot undo a scope the user already set.
+ */
+function scopedContentIndex(sessions, query, scope) {
+    const hits = searchContentIndex(sessions, query);
+    if (!scope || (!scope.agent && !scope.project && !scope.routine))
+        return hits;
+    const kept = new Map();
+    for (const [id, session] of hits) {
+        if (applyScopeFilters([session], scope).length > 0)
+            kept.set(id, session);
+    }
+    return kept;
+}
 export function artifactLookupScope(agent, project, routine) {
     return { agent, project, routine };
 }
@@ -4355,7 +4409,7 @@ async function renderArtifactsGlobal(query, listAll, name, scope) {
         });
         tracker.stop();
         const allSessions = applyScopeFilters(discovered, scope);
-        const { matches: queryMatches, byId, completeId } = resolveSessionQuery(allSessions, query);
+        const { matches: queryMatches, byId, completeId } = resolveSessionQuery(allSessions, query, { scope });
         if (queryMatches.length === 0) {
             spinner.stop();
             if (byId)
@@ -4452,7 +4506,7 @@ async function renderOneSession(query, mode, scope) {
         tracker.stop();
         const allSessions = applyScopeFilters(discovered, scope);
         let session;
-        const resolution = resolveSessionQuery(allSessions, query);
+        const resolution = resolveSessionQuery(allSessions, query, { scope });
         let queryMatches = resolution.matches;
         let byId = resolution.byId;
         const completeId = resolution.completeId;
@@ -4464,7 +4518,7 @@ async function renderOneSession(query, mode, scope) {
         // echoes the id in a resume prompt. Gate on looksLikeSessionId, not just
         // completeId, so a short id resolves to "no match" rather than fuzzy content.
         if (queryMatches.length === 0 && !looksLikeSessionId(query)) {
-            const contentResults = searchContentIndex(allSessions, query);
+            const contentResults = scopedContentIndex(allSessions, query, scope);
             if (contentResults.size > 0) {
                 const matchedSessions = Array.from(contentResults.values())
                     .sort((a, b) => (b._bm25Score ?? 0) - (a._bm25Score ?? 0));
@@ -4659,16 +4713,16 @@ export function fleetCandidatesByQuery(rows, query, trustResolvedRows = false) {
     });
 }
 /** Resolve through the canonical metadata+content union used by keyword search. */
-function resolveIndexedMetadataRows(indexed, selector) {
+function resolveIndexedMetadataRows(indexed, selector, scope) {
     const alias = resolveSessionAlias(selector);
     if (alias.kind === 'resolved') {
-        return resolveSessionQuery(indexed, alias.sessionId, { indexFallback: false }).matches;
+        return resolveSessionQuery(indexed, alias.sessionId, { indexFallback: false, scope }).matches;
     }
     if (alias.kind === 'ambiguous') {
         const ids = new Set(alias.sessionIds.map(id => id.toLowerCase()));
         return indexed.filter(session => ids.has(session.id.toLowerCase()));
     }
-    return resolveSessionQuery(indexed, selector, { indexFallback: false }).matches;
+    return resolveSessionQuery(indexed, selector, { indexFallback: false, scope }).matches;
 }
 /**
  * ID-shaped selectors go straight to SQLite's primary-key/short-id lookup.
@@ -4779,7 +4833,7 @@ export async function computeLocalMetadataMatches(selector, scope, deps = {}) {
     const includeLocal = !scope.hosts?.length || shouldIncludeLocal(scope.hosts, localMachine);
     if (!includeLocal)
         return [];
-    const indexed = resolveIndexedMetadataRows(indexedRowsForSelector(selector, scope), selector);
+    const indexed = resolveIndexedMetadataRows(indexedRowsForSelector(selector, scope), selector, scope);
     if (indexed.length > 0 || !looksLikeSessionId(selector)) {
         return indexed.map(session => ({ ...session, machine: session.machine || localMachine }));
     }
@@ -4796,7 +4850,7 @@ export async function computeLocalMetadataMatches(selector, scope, deps = {}) {
  */
 export async function liveMetadataMatches(selector, scope, self, deps = {}) {
     const load = deps.loadActive ?? loadLocalActiveSessions;
-    const match = (metas) => resolveIndexedMetadataRows(applyScopeFilters(metas, scope), selector);
+    const match = (metas) => resolveIndexedMetadataRows(applyScopeFilters(metas, scope), selector, scope);
     try {
         const cached = liveSessionMetas((await load()).sessions, self, Date.now());
         const hit = match(cached);
@@ -5013,7 +5067,7 @@ export function registerSessionsCommands(program) {
         .option('--preview', 'With a session id/query: print a compact preview and exit (no pager)');
     setHelpSections(sessionsCmd, {
         examples: `
-      # Search prior sessions in this project by topic, file path, or command
+      # Search indexed transcripts by topic, file path, or command
       agents sessions "add auth middleware"
 
       # Read a session as markdown (user + assistant + thinking + tools)

package/dist/commands/setup-accounts.d.ts

@@ -0,0 +1,8 @@
+/**
+ * `agents setup accounts` — mint a Claude setup-token so unattended usage/probe
+ * is not stuck on "usage pending". Delegates to the same mint engine as
+ * `agents accounts mint` / `agents auth mint`.
+ */
+import type { Command } from 'commander';
+export declare function runAccountsSetupWizard(): Promise<void>;
+export declare function registerSetupAccountsCommand(setupCmd: Command): void;

package/dist/commands/setup-accounts.js

@@ -0,0 +1,47 @@
+import chalk from 'chalk';
+import { confirm } from '@inquirer/prompts';
+import { isInteractiveTerminal, isPromptCancelled } from './utils.js';
+import { hasMintedSetupToken, mintAndSeed } from '../lib/auth-mint.js';
+export async function runAccountsSetupWizard() {
+    const status = hasMintedSetupToken();
+    if (status.ready) {
+        console.log(chalk.green(`Setup-token already minted (${status.detail}).`));
+        console.log(chalk.gray('Re-mint with: agents accounts mint claude'));
+        return;
+    }
+    if (!isInteractiveTerminal()) {
+        console.log(chalk.yellow('No Claude setup-token on this machine.'));
+        console.log(chalk.gray('Mint one with: agents accounts mint claude'));
+        console.log(chalk.gray('Already have a token: agents accounts mint claude --token-stdin'));
+        process.exitCode = 1;
+        return;
+    }
+    const proceed = await confirm({
+        message: 'Mint a Claude setup-token now? (opens a browser; seeds a named account + the reserved auth bundle)',
+        default: true,
+    });
+    if (!proceed) {
+        console.log(chalk.gray('Skipped. Run `agents accounts mint claude` when ready.'));
+        return;
+    }
+    const result = await mintAndSeed({ harness: 'claude' });
+    console.log(chalk.green(`Minted account '${result.account}' for ${result.email}.`));
+}
+export function registerSetupAccountsCommand(setupCmd) {
+    setupCmd
+        .command('accounts')
+        .description('Mint a Claude setup-token into a named account (unattended usage/probe).')
+        .action(async () => {
+        try {
+            await runAccountsSetupWizard();
+        }
+        catch (err) {
+            if (isPromptCancelled(err)) {
+                console.log(chalk.yellow('\nCancelled'));
+                return;
+            }
+            console.error(chalk.red(err instanceof Error ? err.message : String(err)));
+            process.exitCode = 1;
+        }
+    });
+}

package/dist/commands/setup.d.ts

@@ -31,7 +31,7 @@ export declare function ensureInitialized(program: Command): Promise<void>;
  * wizard. Never throws — a cancel or an optional wizard's error just skips the
  * rest and lets core setup complete.
  */
-export type SetupPhase = 'browser' | 'computer' | 'share' | 'secrets' | 'fleet' | 'watchdog' | 'preferences';
+export type SetupPhase = 'browser' | 'computer' | 'share' | 'secrets' | 'accounts' | 'fleet' | 'watchdog' | 'preferences';
 export type SetupStatusState = 'ready' | 'missing' | 'n/a';
 export interface SetupStatusRow {
     phase: 'core' | SetupPhase;

package/dist/commands/setup.js

@@ -24,7 +24,9 @@ import { runShareWizard } from './artifacts-setup.js';
 import { registerSetupMineCommand } from './setup-mine.js';
 import { registerSetupSecretsCommand } from './setup-secrets.js';
 import { registerSetupFleetCommand } from './setup-fleet.js';
+import { registerSetupAccountsCommand, runAccountsSetupWizard } from './setup-accounts.js';
 import { registerSetupWatchdogCommand, runWatchdogSetupWizard } from './setup-watchdog.js';
+import { hasMintedSetupToken } from '../lib/auth-mint.js';
 import { registerAliasCommand } from './alias.js';
 import { registerBetaCommands } from './beta.js';
 import { runPreferencesStep } from './setup-preferences.js';
@@ -276,6 +278,7 @@ export async function getSetupStatus() {
     const devices = await loadDevices();
     const coreReady = isGitRepo(getAgentsDir());
     const secretsReady = fs.existsSync(setupSecretsPrefsPath());
+    const minted = hasMintedSetupToken();
     const shareConfig = readShareConfig();
     const watchdogEnabled = getConfigValue('watchdog.enabled').value === true;
     const interactiveHost = getConfigValue('interactive.host').value;
@@ -285,6 +288,7 @@ export async function getSetupStatus() {
         { phase: 'browser', state: browserReady ? 'ready' : 'missing', detail: browserReady ? `profile ${browserProfile.name}` : browserProfile ? `profile ${browserProfile.name} cannot launch here` : installedBrowsers.length ? 'no default profile' : 'no supported browser found' },
         { phase: 'computer', state: computerState, detail: computerState === 'ready' ? 'helper trusted' : computerState === 'n/a' ? 'macOS local setup only' : 'helper not running or not trusted' },
         { phase: 'secrets', state: secretsReady ? 'ready' : 'missing', detail: secretsReady ? 'defaults chosen' : 'defaults not chosen' },
+        { phase: 'accounts', state: minted.ready ? 'ready' : 'missing', detail: minted.detail },
         { phase: 'fleet', state: Object.keys(devices).length ? 'ready' : 'missing', detail: Object.keys(devices).length ? `${Object.keys(devices).length} device${Object.keys(devices).length === 1 ? '' : 's'} registered` : 'no devices registered' },
         { phase: 'share', state: shareConfig ? 'ready' : 'missing', detail: shareConfig?.baseUrl ?? 'endpoint not configured' },
         { phase: 'watchdog', state: watchdogEnabled ? 'ready' : 'missing', detail: watchdogEnabled ? 'enabled on this device' : 'disabled on this device' },
@@ -308,6 +312,8 @@ async function runSetupPhase(phase) {
         await runShareWizard();
     else if (phase === 'secrets')
         await import('./setup-secrets.js').then((m) => m.runSecretsSetupWizard());
+    else if (phase === 'accounts')
+        await runAccountsSetupWizard();
     else if (phase === 'fleet')
         await import('./setup-fleet.js').then((m) => m.runFleetSetupWizard());
     else if (phase === 'watchdog')
@@ -364,19 +370,20 @@ export function registerSetupCommand(program) {
         .description('Set up agents-cli, or re-open the capability onboarding hub.')
         .option('-f, --force', 'Re-run setup even if ~/.agents/.system/ already exists (use with caution)')
         .option('--no-system-repo', 'Skip cloning the system repo (you must populate ~/.agents/.system/ yourself)');
-    // Capability subcommands: `agents setup browser|computer|mine|secrets|fleet|alias|beta`.
+    // Capability subcommands: `agents setup browser|computer|mine|secrets|accounts|fleet|alias|beta`.
     // Share/artifact publishing is set up by `agents artifacts setup` (RUSH-2580);
     // the hub below still offers it as a phase via runShareWizard.
     registerSetupBrowserCommand(setupCmd);
     registerSetupComputerCommand(setupCmd);
     registerSetupMineCommand(setupCmd);
     registerSetupSecretsCommand(setupCmd);
+    registerSetupAccountsCommand(setupCmd);
     registerSetupFleetCommand(setupCmd);
     registerSetupWatchdogCommand(setupCmd);
     registerAliasCommand(setupCmd);
     registerBetaCommands(setupCmd);
     setupCmd.command('status')
-        .description('Show setup readiness for core, browser, computer, secrets, fleet, share, watchdog, and preferences.')
+        .description('Show setup readiness for core, browser, computer, secrets, accounts, fleet, share, watchdog, and preferences.')
         .option('--json', 'print machine-readable JSON')
         .action(async (options) => {
         const rows = await getSetupStatus();
@@ -399,6 +406,7 @@ export function registerSetupCommand(program) {
       agents setup browser
       agents setup computer
       agents setup secrets
+      agents setup accounts
       agents setup fleet
       agents setup watchdog
       agents setup alias add teams
@@ -416,6 +424,7 @@ export function registerSetupCommand(program) {
         agents setup computer    # install the signed macOS helper + grant permissions
         agents artifacts setup   # provision or join a Cloudflare share endpoint
         agents setup secrets     # choose secrets backend/policy defaults + import
+        agents setup accounts    # mint a Claude setup-token for unattended usage/probe
         agents setup fleet       # discover Tailscale devices + configure SSH access
         agents setup watchdog    # choose which devices run the daemon watchdog pass
         agents setup alias add teams  # PATH shorthand: teams runs agents teams

package/dist/commands/share.d.ts

@@ -1,7 +1,7 @@
 import { type Command } from 'commander';
 import { type ShareConfig } from '../lib/share/config.js';
 import { type CloudflareRequester } from '../lib/share/provision.js';
-import { type PublishResult } from '../lib/share/publish.js';
+import { type PublishResult, type ShareVisibility } from '../lib/share/publish.js';
 import { deleteShare, type DeleteShareResult } from '../lib/share/delete.js';
 import type { PhoenixSession } from '../lib/identity/client.js';
 export declare function formatSharePublishResult(result: PublishResult, json?: boolean): string;
@@ -36,6 +36,9 @@ export interface ShareListItem {
     repo: string | null;
     /** Count of retained prior versions under this slug (see `share revisions`). */
     revisionCount: number;
+    /** The visibility stamped at publish time: public | unlisted | me | org.
+     * Missing on Workers that predate this field → treated as public. */
+    visibility: ShareVisibility;
     /** Arbitrary `--meta key=value` entries attached at publish time (RUSH-2683)
      * — everything that isn't a reserved provenance/label key. `{}` when none
      * were set, or when the deployed Worker predates this field. */
@@ -47,12 +50,41 @@ export interface ShareListResult {
     count: number;
     objects: ShareListItem[];
 }
-/** DI seam for tests — override the real HTTP GET of the JSON listing route. */
-export type ListingFetchFn = (url: string) => Promise<{
+/** DI seam for tests — override the real HTTP GET of the JSON listing route.
+ * The optional `headers` carry the owner bearer for hidden-visibility listings. */
+export type ListingFetchFn = (url: string, headers?: Record<string, string>) => Promise<{
     status: number;
     contentType: string;
     body: string;
 }>;
+export interface ShareEditResult {
+    ok: true;
+    url: string;
+    label: string | null;
+    meta: Record<string, string>;
+    /** The visibility the page now carries (present on Workers that support the
+     * visibility edit; absent from an older deployed template). */
+    visibility?: ShareVisibility;
+    /** The visibility the page had before this edit, when the Worker reports it. */
+    previousVisibility?: ShareVisibility;
+}
+export declare function runShareEdit(target: string, opts: {
+    githubUser?: string;
+    config?: ShareConfig;
+    writeToken?: string;
+    byo?: boolean;
+    session?: PhoenixSession | null;
+    label?: string | null;
+    meta?: Record<string, string>;
+    metaMode?: 'merge' | 'replace';
+    removeMeta?: string[];
+    /** Change the page's visibility in place (public | unlisted | me | org).
+     * A metadata-only rewrite like label/meta — the body is untouched, so no
+     * revision is created. me/org require a Phoenix session. */
+    visibility?: ShareVisibility;
+    force?: boolean;
+    fetchEdit?: typeof fetch;
+}): Promise<ShareEditResult>;
 /** Parse the Worker's listing JSON into a validated result, failing loud (with the
  * outdated-template hint) on any body that isn't the expected shape — an old Worker
  * serves the HTML gallery for a non-empty namespace, which must not be silently
@@ -79,7 +111,24 @@ export declare function runShareList(opts?: {
     session?: string;
     /** Only shares whose label contains this text (case-insensitive substring). */
     label?: string;
+    /** Only shares matching every provided `--meta key=value` entry. */
+    meta?: Record<string, string>;
+    /** Visibility filter. `public` (default) lists only public gallery pages;
+     * `unlisted`/`me`/`org` include that owner's hidden pages; `all` includes
+     * every active page. Hidden scopes send the owner's bearer and `scope=mine`. */
+    scope?: 'public' | 'unlisted' | 'me' | 'org' | 'all';
 }): Promise<ShareListResult>;
+/** Client-side filtering over an already-fetched listing (RUSH-2683) — the
+ * Worker has no query surface for this, so it narrows the fetched set instead
+ * of a second round trip. `count` reflects the FILTERED set, matching what the
+ * caller actually sees. */
+export declare function applyShareListFilters(result: ShareListResult, filters: {
+    agent?: string;
+    session?: string;
+    label?: string;
+    meta?: Record<string, string>;
+    scope?: 'public' | 'unlisted' | 'me' | 'org' | 'all';
+}): ShareListResult;
 export declare function formatShareList(result: ShareListResult, json?: boolean): string;
 /** One retained prior version of a slug, as reported by the Worker's
  * `?revisions=json` route. */