@phnx-labs/agents-cli 1.22.69 → 1.22.70

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## 1.22.70
+
+- **`agents browser stop --profile` is now gated by the remote-control consent gate (PHNX-3317).** `stop --profile <name>` (no `--task`) is handled entirely by `bindTask`'s early return in `ipc.ts`, so it never reached `resolveOrCreateTask` — the one chokepoint every other page/close/attach verb's `assertRemoteControlAllowedForRequest` gate runs through — and `case 'stop'` called `BrowserService.stopProfile()` directly with no consent check at all. That left one destructive fleet-remote path (kills the profile's browser process, clears its runtime dir) reachable from `browser --device <device> stop --profile` even with `remote-control off` on the target. `stopProfile()` now takes the same `{ fleetRemote, actor }` opts as `start`/`showUrl`/`resolveOrCreateTask` and asserts the gate first; a local (non-fleet-remote) call is unaffected. Source: `cli/src/lib/browser/service.ts`, `cli/src/lib/browser/ipc.ts`.
+
+- **The PHNX-2939 headless-account regression test now genuinely exercises the headless path (PHNX-3352).** The real-macOS-keychain test in `account-registry.keychain.test.ts` set `AGENTS_RUNTIME='test-headless-account-launch'`, a made-up value `isHeadlessSecretsContext()` never matches — its set is exactly `headless`/`teams`/`terminal` — so the resolve never entered the headless keychain guard and the test passed identically with OR without the PHNX-2939 biometry-ACL fix, reproducing nothing. It now sets `AGENTS_RUNTIME='headless'` and asserts `isHeadlessSecretsContext()` is `true` before resolving, so the test fails against the pre-fix code (a direct `getKeychainToken` read of the policy-`never`, no-ACL account item is rejected as if it required Touch ID) and passes only because the fix routes through the bundle path that attests `silentNoAcl`. Source: `cli/src/lib/account-registry.keychain.test.ts`.
+
+- **`agents daemon stop` reclaims a stale `browser.sock` when the daemon vanishes mid-stop (PHNX-3618).** `stopDaemonLocked` captured the browser IPC socket's inode ONLY when a live pid resolved (`pid !== null && browserSock ? …`). If the daemon died in the window between the CLI liveness precheck (`isDaemonRunning()` was true) and the locked read, `resolveLiveDaemonPid()` returned null, so the owner was never captured — and the socket the daemon's ungraceful death left on disk hit the else branch, was reported "browser IPC socket ownership could not be verified", and was left behind, so the next daemon start raced a dead binding. The socket inode is now captured **independently of the pid**, and the stale binding is reclaimed once no live daemon — the signalled target OR any successor for this state dir — is proven to own it. PHNX-3607's never-delete-a-successor invariant is preserved: a successor that rebinds during the stop gets a new inode (identity no longer matches) or shows up as a survivor, and in either case its socket is left untouched. Source: `cli/src/lib/daemon/daemon.ts`.
+
+- **`agents run --cloud` no longer rejects a non-expiring Phoenix bearer (PHNX-3645).** A Rush session stores `expires_at: 0` for an opaque Phoenix `pid_` bearer, which by contract means NON-EXPIRING. Three freshness checks read that `0` as an absolute timestamp — `new Date(0)` = 1970-01-01 — and refused a valid, fresh session with `Rush session expired at 1970-01-01`, so no Phoenix-authed box could dispatch a cloud run, push/pull secrets over Rush, or list cloud sessions. The `expires_at === 0` (and missing) special-case now lives in one place, `isRushSessionExpired` (`cli/src/lib/rush-session.ts`), which cloud dispatch, the secrets Rush driver, and the cloud session source all route through — mirroring rush/cli's own `isFresh` (RUSH-1310, PHNX-3637). Source: `cli/src/lib/rush-session.ts`, `cli/src/lib/cloud/rush.ts`, `cli/src/lib/secrets/drivers/rush.ts`, `cli/src/lib/session/cloud.ts`.
+
+- **Owner alerts now render per destination — Slack gets tappable links, iMessage stays plain (PHNX-3698).** `agents notify` / `agents send --to owner` (and an important `feed post` that fans out to the owner) resolve every channel in `owner.policy.normal` and composed ONE plain string for all of them, so a Slack owner destination received a wall of prose with no `<url|label>` links and no tappable session crumb — the labeled-link support already in `composeBroadcastMessage` never fired on the path the owner actually uses. The owner fan-out (`sendToOwner`) now re-renders the body PER destination, keyed on each channel's resolved provider (the same `notify.transports` remap delivery uses): a Slack destination turns every `TEAM-N` key the post names into `<https://linear.app/<ws>/issue/<KEY>|<KEY>>` and the `Sent from claude/<id> on <host>` crumb into `<https://prix.dev/console/sessions/<full-id>|claude/<id>>` (the 8-char crumb upgraded to the full indexed id first), while iMessage / owner-scoped rush / desktop / `command:` sinks stay the plain human sentence with no URLs. Each delivery echoes the exact body it sent, so `agents notify --dry-run --json` now shows the two different bodies. Source: `cli/src/lib/notify.ts`, `cli/src/lib/owner-message.ts`, `cli/src/lib/sink-format.ts`, `cli/src/lib/feed-broadcast.ts`, `cli/src/lib/channels/send.ts`, `cli/src/commands/send.ts`.
+
+- **A release no longer starves waiting for the tip of `main` to be attested (PHNX-3705).** `release.sh` phase 2 required an attestation for `origin/main`'s tree *as of the instant the release ran*, but `attest-main.yml` produces that by running the full suite — minutes of work. On a repo where agents merge continuously, main advances faster than attestation completes, so every release lost the race and died at `missing exact attestation key`. Measured 2026-09-01: six merges to `main` in ~30 minutes with attest-main runs still pending or superseded; the tip was never attested long enough to release from, which also makes the R2 bar (ordinary release under 60s) unreachable by construction. The release does not need *the tip* — it needs a green base to cut the release commit from and derive the release-tree attestation against (PHNX-3696), and any attested **ancestor** serves. Phase 2 now requires an attestation for the tree it is **actually releasing from** (`$BASE_SHA`) rather than the live remote tip, and `derive_release_attestation` inherits from that same commit — the release commit's real parent — instead of the tip. New `cli/scripts/release-attested-base.sh` resolves the newest attested commit at or below `origin/<default>` (bounded lookback, fails closed when none is found), `release-worktree.sh` cuts the release worktree from it and says so on stderr when it is behind the tip, and `release.sh`'s base check now requires an *ancestor* of the remote tip rather than the tip exactly. The supply-chain guarantee is unchanged: the published tarball is still bound to a tree whose suite passed, and `derive`'s allowlist still fails closed on any code file — the release simply ships from a slightly older tree than the tip, which was always true of an attested tree. Source: `cli/scripts/release-attested-base.sh`, `cli/scripts/release-worktree.sh`, `cli/scripts/release.sh`.
+
+- **Docs: sign-in unlocks managed sharing, not only team spaces; `traces setup` marked advanced/self-host.** The README said signing in unlocks "the one thing" — team spaces — which predated managed, private-by-default sharing; it now names both hosted surfaces (team spaces AND `agents artifacts share`/`agents traces sync` on our storage with zero Cloudflare setup, private by default when signed in). The `agents traces setup` command description no longer reads as a normal user step — it is now labeled advanced/self-host, since `agents auth login` syncs to the managed endpoint with no setup. Source: `README.md`, `cli/src/commands/traces.ts`, `cli/docs/command-index.{md,json}`.
+
 ## 1.22.69
 
 - **`agents monitors` no longer fires an action on a poll FAILURE (PHNX-3510).** An `[on-change]` monitor treated a failing poll — a `gh pr list … | jq` that intermittently printed `GraphQL: API rate limit already exceeded …` — as a value change: the empty→error→empty flap read as two changes and dispatched a full agent run each time on a premise that was false (~10 sessions burned re-verifying two already-merged PRs). A command/poll source now flags a snapshot that exited non-zero, or whose output matches a transport/auth/rate-limit error shape (caught even on exit 0, since a pipe to jq swallows the failing half's exit code), as an *observation failure*: the engine skips it, leaves watched-state untouched, does not fire, and records it as a failed check so a sustained streak escalates to the owner as a drought. `agents monitors test` labels a failed poll and reports `Would fire: no`. Note: a non-zero exit is now an observation failure rather than a watchable value — a monitor that wants to watch a command's success/failure should emit a stable token (`… && echo UP || echo DOWN`, always exit 0) so the state it cares about diffs as a value; sustained failures still reach the owner via the drought escalation. Source: `cli/src/lib/monitors/sources/failure.ts`, `cli/src/lib/monitors/sources/command.ts`, `cli/src/lib/monitors/engine.ts`, `cli/docs/automation.md`.

package/README.md

@@ -34,7 +34,6 @@
       
   <a href="https://dev.meta.ai/docs/muse-code" title="Meta Muse Code"><picture><source media="(prefers-color-scheme: dark)" srcset="assets/harnesses/muse.svg"><img src="assets/harnesses/muse-light.svg" height="32" alt="Meta Muse Code" /></picture></a>
   &nbsp;&nbsp;&nbsp;&nbsp;
-  <a href="https://omp.sh" title="Oh My Pi"><picture><source media="(prefers-color-scheme: dark)" srcset="assets/harnesses/pi.svg"><img src="assets/harnesses/pi-light.svg" height="32" alt="Oh My Pi" /></picture></a>
   &nbsp;&nbsp;&nbsp;&nbsp;
   <a href="https://docs.warp.dev/reference/cli" title="Warp Agent CLI (Oz)"><picture><source media="(prefers-color-scheme: dark)" srcset="assets/harnesses/warp.svg"><img src="assets/harnesses/warp-light.svg" height="32" alt="Warp Agent CLI" /></picture></a>
 </p>
@@ -54,7 +53,7 @@ agents setup status                    # readiness for browser, computer, fleet,
 agents run claude "explain this repo"  # run any agent on your existing subscription
 ```
 
-Everything here — and every other command in this README — is free and needs no account; the optional `agents auth login` exists only for [team spaces](#sign-in). `agents setup` is interactive and idempotent -- safe to re-run on any machine. Once core setup exists, it opens a status-aware menu for browser, computer, secrets, fleet, share, watchdog, and device preferences; each choice delegates to the same wizard available under `agents setup <capability>`. In CI or another non-TTY, bare setup prints the checklist without prompting. The `agi-cli.sh` one-liner installs this same canonical `@phnx-labs/agents-cli` package. Prefer bun? `bun install -g @phnx-labs/agents-cli` works too.
+Everything here — and every other command in this README — is free and needs no account; the optional `agents auth login` unlocks the hosted surfaces — [team spaces](#sign-in) and managed, private-by-default sharing (`agents artifacts share` / `agents traces sync` with no Cloudflare setup). `agents setup` is interactive and idempotent -- safe to re-run on any machine. Once core setup exists, it opens a status-aware menu for browser, computer, secrets, fleet, share, watchdog, and device preferences; each choice delegates to the same wizard available under `agents setup <capability>`. In CI or another non-TTY, bare setup prints the checklist without prompting. The `agi-cli.sh` one-liner installs this same canonical `@phnx-labs/agents-cli` package. Prefer bun? `bun install -g @phnx-labs/agents-cli` works too.
 
 The command surface teaches setup through `agents setup` and group-level `--help`.
 The durable system model starts at [`cli/docs/README.md`](cli/docs/README.md).
@@ -1090,7 +1089,7 @@ agents browser profiles create cloud \
 
 ## Sign in
 
-Signing in is **optional**. Every local feature — `agents run`, sessions, teams, fleet dispatch, secrets, browser, computer — works with no account. The one thing an account unlocks is **team spaces**, the hosted surface under `agents auth space`. `agents auth` signs this machine in to **Phoenix ID**, the Phoenix Labs account layer behind team spaces. Sign-in is Google-only and runs a device-code flow: the CLI shows a code, your browser confirms it, and the CLI picks the session up.
+Signing in is **optional**. Every local feature — `agents run`, sessions, teams, fleet dispatch, secrets, browser, computer — works with no account. Signing in unlocks the hosted surfaces: **team spaces** (`agents auth space`) and **managed sharing** — `agents artifacts share` and `agents traces sync` publish to our storage with **zero Cloudflare setup**, and a signed-in `agents artifacts share` is **private by default** (`me`, owner-only) unless you pass `--visibility org`/`public`. `agents auth` signs this machine in to **Phoenix ID**, the Phoenix Labs account layer behind these hosted surfaces. Sign-in is Google-only and runs a device-code flow: the CLI shows a code, your browser confirms it, and the CLI picks the session up.
 
 ```bash
 agents auth login                        # shows a code, opens a Phoenix-branded page
@@ -1602,7 +1601,6 @@ Which DotAgents resources each agent CLI can load. Source of truth: [src/lib/age
 | OpenCode | yes | no | yes | >= 1.1.1 | yes | yes | no | no | `AGENTS.md` | no |
 | Copilot | yes | no | yes | no | yes | yes | no | no | `AGENTS.md` | no |
 | Amp | yes | no | yes | no | yes | yes | no | no | `AGENTS.md` | no |
-| Kiro | yes | no | yes | >= 2.8.0 | yes | yes | no | >= 1.23.0 | `AGENTS.md` | no |
 | Goose | yes | no | yes | no | no | no | no | no | `AGENTS.md` | no |
 | Roo Code | yes | no | yes | no | yes | yes | no | no | `AGENTS.md` | no |
 | Droid | yes | yes | yes | >= 0.57.5 | >= 0.26.0 | yes | yes | yes | `AGENTS.md` | no |
@@ -1623,17 +1621,14 @@ Which DotAgents resources each agent CLI can load. Source of truth: [src/lib/age
 | Antigravity | -- | yes | -- |
 | Copilot | -- | -- | yes |
 | OpenClaw, Amp, Goose, Roo | -- | -- | -- |
-| Kiro | -- | -- | -- |
 
 ### Version-gated sync
 
 | Capability | Agent | Gate |
 |------------|-------|------|
 | Hooks | Codex | >= 0.116.0 |
-| Subagents | Kiro | >= 1.23.0 |
 | Skills | Droid | >= 0.26.0 |
 | Permissions | Droid | >= 0.57.5 |
-| Permissions | Kiro | >= 2.8.0 |
 | File-based commands | Codex | < 0.117.0 (0.117+ uses command-as-skill) |
 | Plugins | Codex | >= 0.128.0 |
 
@@ -1649,7 +1644,7 @@ Claude Code, Codex CLI, Antigravity, Grok Build, and others each have their own
 
 ### Is it free?
 
-Yes — every feature, with no account and no signup. `agents run`, sessions, teams, fleet dispatch, secrets, browser, and computer automation all work the moment you install. The optional `agents auth login` exists only to unlock hosted team spaces (`agents auth space`); there are no paid tiers. This developer tool is entirely free because we believe developers should have the best tools — fast and robust — so they can create the best products for their users.
+Yes — every feature, with no account and no signup. `agents run`, sessions, teams, fleet dispatch, secrets, browser, and computer automation all work the moment you install. The optional `agents auth login` unlocks the hosted surfaces — team spaces (`agents auth space`) and managed, private-by-default sharing (`agents artifacts share` / `agents traces sync`, no Cloudflare setup); there are no paid tiers. This developer tool is entirely free because we believe developers should have the best tools — fast and robust — so they can create the best products for their users.
 
 ### Is this like `nvm` / `mise` / `asdf` for AI agents?
 

package/dist/commands/accounts.js

@@ -336,7 +336,10 @@ export async function listSwitchableAccounts(agent) {
  */
 export function setDefaultAccount(agentRaw, name) {
     const agent = parseHarness(agentRaw);
-    const account = findUnifiedAccount(name, readMeta());
+    // Scope to the harness this default is FOR: a bare identity (`<email>`) matches
+    // every harness that identity is signed into, so an un-scoped lookup resolved
+    // the wrong row and then rejected it as "is a <other> login" just below.
+    const account = findUnifiedAccount(name, readMeta(), undefined, agent);
     if (!account)
         throw new Error(`Unknown account '${name}'.`);
     if (account.kind === 'provider') {
@@ -519,14 +522,19 @@ agents run codex#work`,
         .action(async (name, target, _o, command) => {
         await runAccountsAction(command, async () => {
             const meta = readMeta();
-            const account = findUnifiedAccount(name, meta);
+            // Validate the target exists before mutating any binding — and resolve it
+            // FIRST so the account lookup can be scoped to the harness being attached
+            // to. `identityLabel` defaults to the login's email, so a bare identity
+            // (`muqsitnawaz@gmail.com`) matches every harness that identity is signed
+            // into; un-scoped this resolved whichever row the store ordered first and
+            // then rejected it below as "is a <other> login".
+            const t = classifyAttachTarget(target);
+            const targetAgent = t.kind === 'profile' ? t.profile.host.agent : t.agent;
+            const account = findUnifiedAccount(name, meta, undefined, targetAgent);
             if (!account)
                 throw new Error(`Unknown account '${name}'.`);
             if (account.kind === 'native')
                 assertNativeAccountNameable(account.agent);
-            // Validate the target exists before mutating any binding.
-            const t = classifyAttachTarget(target);
-            const targetAgent = t.kind === 'profile' ? t.profile.host.agent : t.agent;
             if (account.kind === 'native') {
                 // A provider-backed profile injects provider env at spawn, which would run
                 // under a different credential than the native identity claims — refuse it.
@@ -572,7 +580,7 @@ agents run codex#work`,
                 // Provider account: it must be able to authenticate the target's harness.
                 getAccountProvider(account.provider).envFor(targetAgent, account.auth);
             }
-            bindAccount(name, target);
+            bindAccount(name, target, targetAgent);
             writeClaudeInteractiveOauthToken(t, targetAgent, account.kind === 'native' && account.agent === 'claude' ? account.identityLabel : undefined);
             console.log(chalk.green(`Attached ${account.name} to ${target}.`));
         });
@@ -581,7 +589,15 @@ agents run codex#work`,
         .description('Remove one account attachment')
         .action(async (name, target, _o, command) => {
         await runAccountsAction(command, () => {
-            unbindAccount(name, target);
+            // Classify the target first so the unbind is scoped to the right harness
+            // for a colliding identity selector (same as the attach path).
+            let targetAgent;
+            try {
+                const t = classifyAttachTarget(target);
+                targetAgent = t.kind === 'profile' ? t.profile.host.agent : t.agent;
+            }
+            catch { /* an unresolvable target still unbinds by whatever row matches */ }
+            unbindAccount(name, target, targetAgent);
             // With the binding gone, no setup-token resolves for this version home, so this
             // clears any .oauth_token the attach left behind (else interactive runs would keep
             // authenticating as the just-detached account).

package/dist/commands/exec.js

@@ -2244,7 +2244,7 @@ agents run auto --device yosemite-s0 "fix the flaky test"   # pin the device
             const { pickSessionInteractive } = await import('./sessions.js');
             const { buildContinuePrompt } = await import('../lib/loop.js');
             // Freshen the index for this agent before any lookup (incremental, cached).
-            // AgentId is wider than SessionAgentId (amp/kiro/goose/copilot keep no transcripts);
+            // AgentId is wider than SessionAgentId (amp/goose/copilot keep no transcripts);
             // those simply yield no matches and fall through to the not-found error.
             const sessionAgent = agent;
             if (!resolvedResumeSource)
@@ -2723,7 +2723,7 @@ agents run auto --device yosemite-s0 "fix the flaky test"   # pin the device
             process.exit(1);
         }
         // Default CLI mode is the generic 'plan'. Agents without a read-only
-        // mode (antigravity, kiro, …) degrade via resolveMode to their
+        // mode (antigravity, …) degrade via resolveMode to their
         // safest native mode (modes[0], typically edit). That covers both the
         // implicit default and an explicit `--mode plan`, so multi-agent
         // scripts can pass a uniform plan flag without per-agent branching.

package/dist/commands/import.js

@@ -56,7 +56,7 @@ async function runImport(agentArg, opts) {
     if (!opts.isolated) {
         assertIsolationBoundary(agentId, 'adopt your existing install');
     }
-    // installScript-based agents (Grok, Antigravity, Cursor, Kiro, Goose, Roo)
+    // installScript-based agents (Grok, Antigravity, Cursor, Goose, Roo)
     // don't have an npm package; their binary lives wherever the curl/brew
     // installer dropped it. We adopt by symlinking that PATH binary directly
     // into the version's `node_modules/.bin/`. No package.json walk.
@@ -345,7 +345,7 @@ When to use:
   pointing at the existing install — nothing is copied or moved (except the
   agent's config dir, which is moved into the version's home). Works for both
   npm-style packages (claude, codex, opencode, openclaw) and
-  installScript-based agents (grok, antigravity, cursor, kiro, goose).
+  installScript-based agents (grok, antigravity, cursor, goose).
 `)
         .action((...args) => withIsolationBoundary(() => runImport(...args)));
 }

package/dist/commands/models.js

@@ -18,13 +18,13 @@ import { terminalWidth, truncateToWidth, stringWidth } from '../lib/session/widt
 import { wrapJoined } from './inspect.js';
 import { setHelpSections } from '../lib/help.js';
 import { formatRunDefaultEntry, listRunDefaults, parseRunDefaultSelector, setRunDefault, } from '../lib/run-defaults.js';
-const MODEL_CAPABLE_AGENTS = ['claude', 'codex', 'opencode', 'cursor', 'openclaw', 'antigravity', 'kimi', 'grok', 'droid', 'pi'];
+const MODEL_CAPABLE_AGENTS = ['claude', 'codex', 'opencode', 'cursor', 'openclaw', 'antigravity', 'kimi', 'grok', 'droid'];
 /**
  * Agents that don't necessarily install under ~/.agents/versions (cursor ships
  * via a curl script). For these, fall back to the PATH binary and synthesize
  * a version label from the install path so cache keys stay stable.
  */
-const PATH_ONLY_AGENTS = new Set(['cursor', 'pi']);
+const PATH_ONLY_AGENTS = new Set(['cursor']);
 /** Derive a version label from the PATH-installed binary location for agents without managed versions. */
 function fallbackPathVersion(agent) {
     const src = locateModelSource(agent, 'unresolved');

package/dist/commands/permissions.js

@@ -377,8 +377,8 @@ Examples:
             //
             // This used to hardcode `.json`/`.jsonc`/`.toml` plus a `.claude`/
             // `.opencode`/`.codex` substring, which excluded the ten other harnesses
-            // the CLI writes -- and excluded kiro/hermes twice over, since
-            // their configs are YAML. The registry already answers this by matching
+            // the CLI writes -- and excluded hermes twice over, since
+            // its config is YAML. The registry already answers this by matching
             // each harness's own declared path, so ask it (RUSH-2676).
             const isAgentConfig = detectPermissionAgentFromPath(localPath) !== null;
             if (isAgentConfig) {

package/dist/commands/rules.js

@@ -52,7 +52,7 @@ Project rules & @-imports:
   @path imports inside AGENTS.md/CLAUDE.md are resolved at session start by the agent
   itself, not by agents-cli. Support is per-agent:
     Inlined natively:  claude
-    Literal text:      codex, cursor, opencode, copilot, amp, kiro, goose
+    Literal text:      codex, cursor, opencode, copilot, amp, goose
 
   For rules that need to work across all agents, inline the content rather than using
   @-imports — the second group will load '@path/to/file.md' as a literal string.

package/dist/commands/send.js

@@ -3,7 +3,7 @@ import { die } from '../lib/format.js';
 import { setHelpSections } from '../lib/help.js';
 import { readMeta } from '../lib/state.js';
 import { sendMessage, isOwnerAlias } from '../lib/channels/send.js';
-import { composeOwnerMessage } from '../lib/owner-message.js';
+import { ownerMessageComposer } from '../lib/owner-message.js';
 import { fireTraceSyncInBackground } from '../lib/run-trace-sync.js';
 function mergeAttachments(opts) {
     const list = [...(opts.attach ?? []), ...(opts.attachment ?? [])];
@@ -30,6 +30,7 @@ async function runSend(positionalText, opts, ownerMode) {
     // the SAME composer as an important `feed post` (PHNX-3698): short-shaped body,
     // TEAM-N keys linkified, session crumb as a tappable console URL — instead of a
     // raw dump. A non-owner send (explicit --channel/--to) is delivered verbatim.
+    let ownerCompose;
     if (ownerMode || isOwnerAlias(opts.to)) {
         const flagged = opts.text?.trim() ?? '';
         const positional = (positionalText ?? '').trim();
@@ -38,7 +39,12 @@ async function runSend(positionalText, opts, ownerMode) {
         // loud with the "pass the message once" error rather than composing a guess.
         const bothDiffer = flagged !== '' && positional !== '' && flagged !== positional;
         if (raw && !bothDiffer) {
-            input = { ...input, text: composeOwnerMessage(raw), positionalText: undefined };
+            // Resolve the context once, then let each owner destination render its own
+            // format: the envelope carries the plain default (for --json and dry-run
+            // display), while ownerCompose hands sendToOwner the mrkdwn variant for a
+            // Slack owner destination and plain for iMessage (PHNX-3698).
+            ownerCompose = ownerMessageComposer(raw);
+            input = { ...input, text: ownerCompose('plain'), positionalText: undefined };
             // The console URL in the composed body only resolves once this session's
             // trace shard is uploaded; fire that now so the tapped link isn't a 404.
             // A --dry-run resolves + composes but MUST NOT act (its documented contract),
@@ -46,7 +52,7 @@ async function runSend(positionalText, opts, ownerMode) {
             fireTraceSyncInBackground({ disabled: Boolean(opts.dryRun) });
         }
     }
-    const out = await sendMessage(input, meta);
+    const out = await sendMessage(input, meta, ownerCompose);
     if ('error' in out) {
         die(out.error);
     }

package/dist/commands/traces.js

@@ -182,7 +182,7 @@ export function registerTracesCommands(program) {
         .description("Sync this device's derived, redacted trajectories to your Phoenix account");
     const setupCmd = tracesCmd
         .command('setup')
-        .description('Provision the private Cloudflare Worker and R2 bucket for traces')
+        .description('(advanced) Provision a self-hosted Cloudflare Worker + R2 bucket for traces — NOT required; `agents auth login` syncs to the managed endpoint with zero setup')
         .option('--bundle <name>', 'secrets bundle holding the Cloudflare API token', DEFAULT_CF_BUNDLE)
         .option('--worker <name>', 'Worker name', DEFAULT_WORKER_NAME)
         .option('--bucket <name>', 'R2 bucket name', DEFAULT_BUCKET_NAME)

package/dist/lib/account-capabilities.js

@@ -35,10 +35,8 @@ export const NATIVE_ACCOUNT_CAPABILITIES = {
     copilot: { inspection: 'none', scope: 'unsupported', status: 'unsupported' },
     openclaw: { inspection: 'none', scope: 'unsupported', status: 'unsupported' },
     amp: { inspection: 'none', scope: 'unsupported', status: 'unsupported' },
-    kiro: { inspection: 'none', scope: 'unsupported', status: 'unsupported' },
     goose: { inspection: 'none', scope: 'unsupported', status: 'unsupported' },
     hermes: { inspection: 'none', scope: 'unsupported', status: 'unsupported' },
-    pi: { inspection: 'none', scope: 'unsupported', status: 'unsupported' },
     warp: { inspection: 'none', scope: 'unsupported', status: 'unsupported' },
 };
 export function nativeAccountCapability(agent) {

package/dist/lib/account-registry.d.ts

@@ -54,12 +54,12 @@ export declare function listNativeAccounts(meta: Pick<Meta, 'accounts' | 'device
  * running before the body, so callers that only need a native lookup must be
  * able to omit it.
  */
-export declare function findUnifiedAccount(nameOrId: string, meta: Pick<Meta, 'accounts' | 'deviceAccounts'>, doc?: AccountRegistryDocument): UnifiedAccount | null;
+export declare function findUnifiedAccount(nameOrId: string, meta: Pick<Meta, 'accounts' | 'deviceAccounts'>, doc?: AccountRegistryDocument, preferAgent?: AgentId): UnifiedAccount | null;
 export declare function addNativeAccount(name: string, agent: AgentId, identityKey: string, identityLabel: string | undefined, scope: 'version' | 'device'): NativeAccount;
 /** Create or replace the version-independent label for one native identity. */
 export declare function labelNativeAccount(agent: AgentId, identityKey: string, identityLabel: string | undefined, label: string | undefined, scope: 'version' | 'device'): NativeAccount;
-export declare function bindAccount(nameOrId: string, target: string): UnifiedAccount;
-export declare function unbindAccount(nameOrId: string, target: string): void;
+export declare function bindAccount(nameOrId: string, target: string, preferAgent?: AgentId): UnifiedAccount;
+export declare function unbindAccount(nameOrId: string, target: string, preferAgent?: AgentId): void;
 /** Every target bound to `accountId`: this box's device-doc bindings merged over
  * the fleet-shared central bindings (PHNX-3315). */
 export declare function accountBindings(accountId: string, meta: Pick<Meta, 'accounts' | 'deviceAccounts'>): string[];

package/dist/lib/account-registry.js

@@ -159,9 +159,18 @@ export function listNativeAccounts(meta) {
  * running before the body, so callers that only need a native lookup must be
  * able to omit it.
  */
-export function findUnifiedAccount(nameOrId, meta, doc) {
+export function findUnifiedAccount(nameOrId, meta, doc, preferAgent) {
     const needle = nameOrId.toLowerCase();
-    const native = listNativeAccounts(meta).find(account => account.id === nameOrId || account.name.toLowerCase() === needle || account.identityLabel?.toLowerCase() === needle);
+    const matches = listNativeAccounts(meta).filter(account => account.id === nameOrId || account.name.toLowerCase() === needle || account.identityLabel?.toLowerCase() === needle);
+    // `identityLabel` defaults to the login's own identifier (the email), so ONE
+    // selector legitimately matches several harnesses: `muqsitnawaz@gmail.com` is a
+    // claude login AND a codex login. Un-scoped, `.find()` returned whichever row the
+    // merged store happened to order first, so `agents run claude#<email>` died with
+    // "Account 'personal' is a codex login and cannot authenticate the claude harness"
+    // while that identity's own claude login sat right there. Prefer the harness being
+    // launched; fall back to the first match so a management lookup with no harness in
+    // hand (rename/remove/view) behaves exactly as before.
+    const native = matches.find(account => account.agent === preferAgent) ?? matches[0];
     if (native)
         return native;
     const provider = findAccount(nameOrId, doc ?? readAccountRegistry());
@@ -253,9 +262,13 @@ export function labelNativeAccount(agent, identityKey, identityLabel, label, sco
     });
     return { ...matches[0], name: resolvedLabel, identityLabel, scope: rowScope };
 }
-export function bindAccount(nameOrId, target) {
+export function bindAccount(nameOrId, target, preferAgent) {
     const meta = readMeta();
-    const account = findUnifiedAccount(nameOrId, meta);
+    // Scope to the harness being bound to: a bare identity selector matches every
+    // harness it is signed into, so without this the binding could persist against
+    // a different harness's row than the caller validated (the attach command
+    // resolves `targetAgent` and passes it here).
+    const account = findUnifiedAccount(nameOrId, meta, undefined, preferAgent);
     if (!account)
         throw new Error(`Unknown account '${nameOrId}'.`);
     // A binding follows its account: one that targets a device-scoped native login
@@ -275,9 +288,11 @@ export function bindAccount(nameOrId, target) {
     }
     return account;
 }
-export function unbindAccount(nameOrId, target) {
+export function unbindAccount(nameOrId, target, preferAgent) {
     const meta = readMeta();
-    const account = findUnifiedAccount(nameOrId, meta);
+    // Same scoping as bindAccount: detach the row on the harness the caller means,
+    // not whichever the store happened to order first for a colliding identity.
+    const account = findUnifiedAccount(nameOrId, meta, undefined, preferAgent);
     if (!account)
         throw new Error(`Unknown account '${nameOrId}'.`);
     const inCentral = meta.accounts?.bindings?.[target] === account.id;
@@ -527,7 +542,10 @@ export function resolveSpawnAccount(explicit, agent, version, meta, opts = {}) {
     const selection = resolveAccountSelection(explicit, agent, meta, { useDefault: opts.useDefault, target });
     if (!selection)
         return null;
-    const unified = findUnifiedAccount(selection.id, meta);
+    // Scope the lookup to the harness being launched: a bare identity selector
+    // (`claude#muqsitnawaz@gmail.com`) matches every harness that identity is signed
+    // into, and only this one can authenticate the spawn.
+    const unified = findUnifiedAccount(selection.id, meta, undefined, agent);
     if (!unified) {
         // A stale per-harness default is a preference, not a hard requirement: the
         // machine stays runnable by falling back to balanced rotation. Bindings and

package/dist/lib/acp/client.d.ts

@@ -11,7 +11,7 @@
  */
 import { type SessionNotification } from '@zed-industries/agent-client-protocol';
 import type { AgentId } from '../types.js';
-import type { ExecMode } from '../exec.js';
+import { type ExecMode } from '../exec.js';
 export interface AcpRunOptions {
     agent: AgentId;
     prompt: string;

package/dist/lib/acp/client.js

@@ -15,6 +15,7 @@ import { promises as fs } from 'fs';
 import * as path from 'path';
 import { ClientSideConnection, ndJsonStream, } from '@zed-industries/agent-client-protocol';
 import { getAcpSpec, supportsAcp } from './harnesses.js';
+import { buildExecEnv } from '../exec.js';
 const PROTOCOL_VERSION = 1;
 /**
  * Runs a single prompt turn against an ACP-capable agent and streams updates
@@ -25,10 +26,20 @@ export async function runAcp(opts) {
         throw new Error(`Agent '${opts.agent}' does not support ACP. Use direct exec instead.`);
     }
     const spec = getAcpSpec(opts.agent);
+    // Build the harness's exec env the SAME way `agents run` does, instead of
+    // handing it a raw process.env. buildExecEnv is what injects the per-account
+    // `CLAUDE_CODE_OAUTH_TOKEN` on a worker device (gated by device role: a
+    // headed/personal box still defers to its native login). Without this, an ACP
+    // launch inherited no setup-token and fell through to the version home's
+    // copied native `.credentials.json` — which expires in ~15h and 401s once its
+    // refresh chain dies, exactly the "logged out on a worker" report (PHNX-3681).
+    // A verified precedence test shows the env token wins over a present
+    // `.credentials.json`, so injecting here is sufficient — the stale file no
+    // longer decides the session.
     const child = spawn(spec.command, spec.args, {
         cwd: opts.cwd,
         stdio: ['pipe', 'pipe', 'inherit'],
-        env: process.env,
+        env: buildExecEnv({ agent: opts.agent, cwd: opts.cwd, mode: opts.mode, effort: 'auto', interactive: true }),
     });
     const stream = ndJsonStream(Writable.toWeb(child.stdin), Readable.toWeb(child.stdout));
     const client = buildClient(opts);

package/dist/lib/acp/harnesses.js

@@ -52,7 +52,7 @@ export const ACP_HARNESSES = {
     },
     // antigravity: no documented ACP support (May 2026).
     // goose: ACP over HTTP via `goosed`, not a clean stdio subcommand.
-    // copilot, kiro: excluded for now (not installed in the reference environment,
+    // copilot: excluded for now (not installed in the reference environment,
     //                no local verification possible).
     // amp: not on the ACP agents list.
 };

package/dist/lib/add-dir.js

@@ -33,11 +33,9 @@ export const ADD_DIR_STRATEGY = {
     // No multi-root CLI surface today (single --dir / project path).
     opencode: 'none',
     gemini: 'none',
-    pi: 'none',
     openclaw: 'none',
     copilot: 'none',
     amp: 'none',
-    kiro: 'none',
     goose: 'none',
     antigravity: 'none',
     droid: 'none',

package/dist/lib/agent-cli-commands.js

@@ -14,11 +14,9 @@ export const AGENT_CLI_COMMANDS = [
     'gemini',
     'cursor-agent',
     'opencode',
-    'omp',
     'openclaw',
     'copilot',
     'amp',
-    'kiro-cli',
     'goose',
     'agy',
     'grok',

package/dist/lib/agent-spec/agents.d.ts

@@ -104,7 +104,7 @@ export declare const MANAGED_AGENT_IDS: AgentId[];
  * `curl … | sh` / `brew install` script that carries NO version token — the
  * installer can only ever fetch the *current* release, and the binary then keeps
  * itself up to date in place (droid, grok, antigravity, cursor, hermes,
- * kiro, goose). There is no semver to pin, so agents-cli must not model these as
+ * goose). There is no semver to pin, so agents-cli must not model these as
  * having multiple installable version-homes the way it does for npm-packaged
  * agents (claude, codex, kimi, …).
  *

package/dist/lib/agent-spec/agents.js

@@ -2,7 +2,7 @@
  * Core agent configuration and detection module.
  *
  * Defines the canonical registry of current and legacy AI coding agents (Claude,
- * Codex, Gemini, Cursor, OpenCode, OpenClaw, Copilot, Amp, Kiro, Goose, Grok)
+ * Codex, Gemini, Cursor, OpenCode, OpenClaw, Copilot, Amp, Goose, Grok)
  * with their CLI commands, config paths, capability flags, and MCP integration
  * points.
  *
@@ -413,52 +413,6 @@ export const AGENTS = {
         supportsHooks: true,
         capabilities: { hooks: { since: '0.3.130' }, mcp: true, mcpHttp: false, mcpHeaders: false, allowlist: { since: '1.1.1' }, skills: true, commands: true, plugins: true, subagents: true, rules: { file: 'AGENTS.md' }, workflows: false, memory: false, modes: ['plan', 'edit'], interactiveRepl: true },
     },
-    // Oh My Pi (`omp`, omp.sh) — a Bun-based, terminal-first coding agent that runs
-    // against many model providers (OpenRouter, OpenAI, Anthropic, xAI, DeepSeek,
-    // Ollama, LM Studio, …). It is Claude-compatible: it natively discovers
-    // `.claude/commands`, `.mcp.json`, and Claude-shaped subagents, and keeps its
-    // own native resources under `~/.omp/agent/` (config dir reported by
-    // `omp config path`). configDir points AT the agent dir (not `~/.omp`) so the
-    // rules file lands at `~/.omp/agent/AGENTS.md`, the user context file omp reads.
-    pi: {
-        id: 'pi',
-        name: 'Pi',
-        sessionDir: null,
-        sessionFileExt: null,
-        versionStdoutMatch: 'semver',
-        unmanagedBinary: 'path',
-        mcpRegister: 'cli',
-        mcpAddHttp: 'transport',
-        mcpAddStdio: 'simple',
-        mcpConfigWrite: 'json-mcpServers',
-        color: 'magenta',
-        cliCommand: 'omp',
-        npmPackage: '@oh-my-pi/pi-coding-agent',
-        configDir: path.join(HOME, '.omp', 'agent'),
-        commandsDir: path.join(HOME, '.omp', 'agent', 'commands'),
-        commandsSubdir: 'commands',
-        skillsDir: path.join(HOME, '.omp', 'agent', 'skills'),
-        hooksDir: 'hooks',
-        instructionsFile: 'AGENTS.md',
-        format: 'markdown',
-        variableSyntax: '$ARGUMENTS',
-        // omp hooks are per-tool JS/TS extension modules discovered from
-        // `~/.omp/agent/hooks/{pre,post}/<tool>.<ext>` (loaded as HookFactory code),
-        // NOT the event->shell-command registrations agents-cli's hook sync writes.
-        // The two models don't map, so hooks stay off (capabilities.hooks:false).
-        supportsHooks: false,
-        // MCP: omp reads `.mcp.json` with the Claude `{ "mcpServers": {...} }` schema
-        // at user scope (`~/.omp/agent/.mcp.json`) and project scope (`<root>/.mcp.json`),
-        // stdio + http + sse with headers. skills (`~/.omp/agent/skills/<name>/SKILL.md`),
-        // commands (`~/.omp/agent/commands/*.md`), and subagents (`~/.omp/agent/agents/*.md`,
-        // Claude-shaped) are all native. allowlist is OFF: omp gates approval per-TOOL
-        // only (`tools.approval` record: allow|prompt|deny) with no command/path/domain
-        // patterns, so agents-cli's granular permission format has nothing to map to.
-        // plugins are npm packages / TS modules, not the Claude marketplace manifest.
-        // interactiveRepl: true — bare `omp` runs the TUI; `omp -p` is the one-shot
-        // form that answers a prompt and exits (upstream README, "Four entry points").
-        capabilities: { hooks: false, mcp: true, mcpHttp: true, mcpHeaders: true, allowlist: false, skills: true, commands: true, plugins: false, subagents: true, rules: { file: 'AGENTS.md' }, workflows: false, memory: false, modes: ['plan', 'edit', 'skip'], interactiveRepl: true },
-    },
     openclaw: {
         id: 'openclaw',
         name: 'OpenClaw',
@@ -560,39 +514,6 @@ export const AGENTS = {
         // interactiveRepl: false — amp requires a prompt; bare invocation exits immediately.
         capabilities: { hooks: false, mcp: true, mcpHttp: false, mcpHeaders: false, allowlist: false, skills: true, commands: true, plugins: false, subagents: false, rules: { file: 'AGENTS.md' }, workflows: false, memory: false, modes: ['plan', 'edit'], interactiveRepl: false },
     },
-    kiro: {
-        id: 'kiro',
-        name: 'Kiro',
-        sessionDir: null,
-        sessionFileExt: null,
-        versionStdoutMatch: 'semver',
-        unmanagedBinary: 'path',
-        mcpRegister: 'cli',
-        mcpAddHttp: 'transport',
-        mcpAddStdio: 'simple',
-        mcpConfigWrite: 'json-mcpServers',
-        color: 'greenBright',
-        cliCommand: 'kiro-cli',
-        npmPackage: '',
-        installScript: 'brew install --cask kiro-cli',
-        configDir: path.join(HOME, '.kiro'),
-        commandsDir: path.join(HOME, '.kiro', 'commands'),
-        commandsSubdir: 'commands',
-        skillsDir: path.join(HOME, '.kiro', 'skills'),
-        // Hooks: v3 standalone files under ~/.kiro/hooks/*.json
-        // (`{ "version": "v1", "hooks": [...] }`). Fixed PreToolUse/PostToolUse
-        // firing in kiro-cli 0.10; fully stable by 2.6.1. Launch always passes
-        // --v3 (see AGENT_COMMANDS.kiro) so the standalone files actually load.
-        // See registerHooksForKiro.
-        hooksDir: 'hooks',
-        instructionsFile: 'AGENTS.md',
-        format: 'markdown',
-        variableSyntax: '$ARGUMENTS',
-        supportsHooks: true,
-        // interactiveRepl: false — kiro-cli requires a prompt for coding sessions; bare
-        // invocation does not open a persistent REPL.
-        capabilities: { hooks: { since: '0.10.0' }, mcp: true, mcpHttp: false, mcpHeaders: false, allowlist: { since: '2.8.0' }, skills: true, commands: true, plugins: false, subagents: { since: '1.23.0' }, rules: { file: 'AGENTS.md' }, workflows: false, memory: false, modes: ['edit'], interactiveRepl: false },
-    },
     goose: {
         id: 'goose',
         name: 'Goose',
@@ -1117,7 +1038,7 @@ export const MANAGED_AGENT_IDS = ALL_AGENT_IDS.filter((id) => !AGENTS[id].deprec
  * `curl … | sh` / `brew install` script that carries NO version token — the
  * installer can only ever fetch the *current* release, and the binary then keeps
  * itself up to date in place (droid, grok, antigravity, cursor, hermes,
- * kiro, goose). There is no semver to pin, so agents-cli must not model these as
+ * goose). There is no semver to pin, so agents-cli must not model these as
  * having multiple installable version-homes the way it does for npm-packaged
  * agents (claude, codex, kimi, …).
  *
@@ -3029,8 +2950,6 @@ export const AGENT_NAME_ALIASES = {
     gh: 'copilot',
     amp: 'amp',
     sourcegraph: 'amp',
-    kiro: 'kiro',
-    'kiro-cli': 'kiro',
     goose: 'goose',
     'block-goose': 'goose',
     antigravity: 'antigravity',

package/dist/lib/browser/ipc.js

@@ -736,7 +736,15 @@ export class BrowserIPCServer {
                     };
                 }
                 if (request.profile) {
-                    await this.service.stopProfile(request.profile);
+                    try {
+                        await this.service.stopProfile(request.profile, {
+                            fleetRemote: request.fleetRemote,
+                            actor: request.actor,
+                        });
+                    }
+                    catch (err) {
+                        return { ok: false, error: err instanceof Error ? err.message : String(err) };
+                    }
                     return { ok: true };
                 }
                 return {