@phnx-labs/agents-cli 1.22.69 → 1.22.71

package/dist/commands/sessions-export.js

@@ -27,8 +27,11 @@ import { listLocalTranscripts, objectKey, SYNC_AGENTS } from '../lib/session/syn
 import { machineId } from '../lib/machine-id.js';
 import { getHistoryDir } from '../lib/state.js';
 import { isSyncConfigured, loadR2Config } from '../lib/session/sync/config.js';
-import { resolveSyncEncKey, generateSyncEncKey } from '../lib/session/sync/transcript-crypto.js';
+import { resolveSyncEncKey, generateSyncEncKey, isTranscriptEnvelope, } from '../lib/session/sync/transcript-crypto.js';
 import { R2Client } from '../lib/session/sync/r2.js';
+import { resolveSessionsBackend } from '../lib/session/sync/backend.js';
+import { SessionsHttpClient } from '../lib/session/sync/net-client.js';
+import { resolveManagedBackupKey } from '../lib/session/sync/managed-key.js';
 import { buildRecord, makeHeader, mergeRecords, serializeBundle, writeBundleFile, specForAgent, } from '../lib/session/bundle.js';
 import { knownSecretValuesFromEnv } from '../lib/redact.js';
 import { pullBundlesFromHosts } from '../lib/session/remote-bundle.js';
@@ -42,7 +45,8 @@ export function registerSessionsExportCommand(sessionsCmd) {
         .option('-o, --output <path>', 'Write the bundle to this file')
         .option('--stdout', 'Write the bundle to stdout (for piping into `sessions import -`)')
         .option('--encrypt', 'Seal each transcript body with AES-256-GCM before writing')
-        .option('--to-r2', 'Back the selected sessions up to Cloudflare R2 (requires the r2.backups bundle) instead of a local file');
+        .option('--to-r2', 'Back the selected sessions up off-box (managed Phoenix store when signed in; your own r2.backups bucket with --byo) instead of a local file')
+        .option('--byo', 'With --to-r2: force your own r2.backups bucket instead of the managed Phoenix store');
     setHelpSections(cmd, {
         examples: `# Bundle the last week of sessions to a file
 agents sessions export --since 7d -o week.bundle
@@ -53,17 +57,22 @@ agents sessions export 4f8a2b1c 9d3e7a55 -o pair.bundle
 # Encrypt + pipe straight into another machine over SSH
 agents sessions export --since 7d --stdout --encrypt | agents ssh boxB 'agents sessions import - --decrypt <key>'
 
-# Back the last month up off-box to Cloudflare R2 (encrypted with the shared key)
-agents sessions export --since 30d --to-r2`,
+# Back the last month up off-box (managed Phoenix store — no bucket to set up)
+agents sessions export --since 30d --to-r2
+
+# Or to your own r2.backups bucket (R2_SYNC_ENC_KEY keeps it zero-knowledge)
+agents sessions export --since 30d --to-r2 --byo`,
         notes: `Selection uses the same flags as 'agents sessions' (--since, -n/--limit, --all,
 -a/--agent, --no-redact). Bundles are self-describing NDJSON: a header line + one
 line per transcript file. Secrets are redacted by default. Dir-shaped sessions
 (Kimi) carry all their files. Restore with 'agents sessions import'.
 
---to-r2 uploads each session to the r2.backups bucket instead of a local file,
-one encrypted object per transcript keyed by machine/agent/session. Bodies are
-sealed with the shared R2_SYNC_ENC_KEY when present. Restore on any box on the
-same bundle with 'agents sessions import --from-r2'.`,
+--to-r2 backs each session up off-box, one encrypted object per transcript keyed
+by machine/agent/session. When you are signed in ('agents auth login') it uploads
+to the MANAGED Phoenix store — no Cloudflare or r2.backups bucket to set up — and
+every body is sealed with a per-account key (mandatory; never plaintext). --byo
+forces your own r2.backups bucket instead; with R2_SYNC_ENC_KEY, neither Phoenix
+nor the storage provider can decrypt it. Restore with 'agents sessions import --from-r2'.`,
     });
     cmd.action(async (selectors, _options, command) => {
         await runExport(selectors, command);
@@ -71,13 +80,42 @@ same bundle with 'agents sessions import --from-r2'.`,
 }
 async function runExport(selectors, command) {
     const g = command.optsWithGlobals();
-    // --to-r2 preflight: reject the impossible --host combo and fail loud when the
-    // backup target is not configured, rather than silently producing a local file.
-    // isSyncConfigured() is consulted only on the --to-r2 path (it reads the keychain).
+    // --to-r2 preflight. MANAGED-FIRST: a signed-in user backs up to the managed
+    // Phoenix store with no bucket to set up; --byo (or an unauthenticated user
+    // with an r2.backups bundle) uses their own bucket. isSyncConfigured() is
+    // consulted ONLY on the BYO path (it reads the keychain); the managed path
+    // authenticates with the Phoenix session and skips it entirely.
+    let sessionsClient;
+    let managedClient;
+    let managedBackupUserId;
+    if (g.byo && !g.toR2) {
+        process.stderr.write(chalk.red('--byo is only valid with --to-r2.\n'));
+        process.exit(1);
+    }
     if (g.toR2) {
-        const gateErr = r2ExportGateError(g, isSyncConfigured());
-        if (gateErr) {
-            process.stderr.write(chalk.red(gateErr + '\n'));
+        if (g.host && g.host.length > 0) {
+            process.stderr.write(chalk.red("--to-r2 backs up THIS machine's sessions; it cannot be combined with --device.\n"));
+            process.exit(1);
+        }
+        try {
+            const backend = resolveSessionsBackend({ byo: g.byo });
+            if (backend.kind === 'managed') {
+                managedClient = new SessionsHttpClient({ baseUrl: backend.baseUrl, userId: backend.userId, token: backend.token });
+                sessionsClient = managedClient;
+                managedBackupUserId = backend.userId;
+            }
+            else {
+                // Preserve the explicit BYO gate used by the on-demand backup path and
+                // daemon sync cycle. resolveSessionsBackend already loaded the bundle,
+                // so this is a cached, non-prompting verification.
+                const gateErr = r2ExportGateError(g, isSyncConfigured());
+                if (gateErr)
+                    throw new Error(gateErr);
+                sessionsClient = new R2Client(backend.r2);
+            }
+        }
+        catch (err) {
+            process.stderr.write(chalk.red(`Session backup: ${err.message}\n`));
             process.exit(1);
         }
     }
@@ -142,9 +180,23 @@ async function runExport(selectors, command) {
         process.exit(1);
     }
     // 4. Resolve encryption key (opt-in) + redaction (default on via parent --no-redact).
-    //    An R2 backup uses the fleet-shared R2_SYNC_ENC_KEY (an ephemeral key would be
-    //    unrecoverable on a fresh box), so it never takes the resolveExportKey path.
-    const encryptKey = g.toR2 ? resolveR2BackupKey() : g.encrypt ? resolveExportKey() : null;
+    //    A BYO R2 backup uses the fleet-shared R2_SYNC_ENC_KEY (an ephemeral key would
+    //    be unrecoverable on a fresh box). A MANAGED backup resolves a per-account DEK
+    //    that is MANDATORY and never null — the managed path never uploads plaintext —
+    //    minting + escrowing one on first use so a fresh box recovers it with zero setup.
+    let encryptKey;
+    if (g.toR2 && managedBackupUserId) {
+        encryptKey = await resolveManagedBackupKey(managedClient, managedBackupUserId);
+    }
+    else if (g.toR2) {
+        encryptKey = resolveR2BackupKey();
+    }
+    else if (g.encrypt) {
+        encryptKey = resolveExportKey();
+    }
+    else {
+        encryptKey = null;
+    }
     const redact = g.redact !== false;
     // Value-aware redaction: mask live credential values already in the
     // environment (e.g. an injected secrets bundle) verbatim, whatever their
@@ -172,7 +224,7 @@ async function runExport(selectors, command) {
         records,
     });
     if (g.toR2) {
-        await uploadToR2(header, records);
+        await uploadToR2(header, records, sessionsClient);
         return;
     }
     emitBundle(header, records, g);
@@ -205,13 +257,28 @@ export function r2ExportGateError(g, isConfigured) {
     }
     return null;
 }
-export async function uploadToR2(header, records) {
+export async function uploadToR2(header, records, resolvedClient) {
+    // The resolved client (managed HTTP or BYO R2) is passed in by the command.
+    // The no-client overload preserves the original BYO-only signature for the
+    // direct unit test (loadR2Config() from the r2.backups bundle).
     let client;
-    try {
-        client = new R2Client(loadR2Config());
+    if (resolvedClient) {
+        client = resolvedClient;
+    }
+    else {
+        try {
+            client = new R2Client(loadR2Config());
+        }
+        catch (err) {
+            process.stderr.write(chalk.red(`R2 backup: ${err.message}\n`));
+            process.exit(1);
+        }
     }
-    catch (err) {
-        process.stderr.write(chalk.red(`R2 backup: ${err.message}\n`));
+    const encryptionError = client.kind === 'managed'
+        ? managedUploadEncryptionError(header, records)
+        : null;
+    if (encryptionError) {
+        process.stderr.write(chalk.red(`${encryptionError}\n`));
         process.exit(1);
     }
     let uploaded = 0;
@@ -234,7 +301,16 @@ export async function uploadToR2(header, records) {
         uploaded++;
     }
     process.stderr.write(chalk.green(`Backed up ${header.sessions} session${header.sessions === 1 ? '' : 's'} ` +
-        `(${uploaded} object${uploaded === 1 ? '' : 's'}${header.encrypted ? ', encrypted' : ', UNENCRYPTED'}) → R2.\n`));
+        `(${uploaded} object${uploaded === 1 ? '' : 's'}${header.encrypted ? ', encrypted' : ', UNENCRYPTED'}) → ` +
+        `${client.kind === 'managed' ? 'managed Phoenix store' : 'R2'}.\n`));
+}
+/** Fail-closed guard at the managed transport boundary, not only at record construction. */
+export function managedUploadEncryptionError(header, records) {
+    if (!header.encrypted ||
+        records.some(record => !record.encrypted || !isTranscriptEnvelope(record.body))) {
+        return 'Managed session backups require AES-256-GCM envelopes; refusing to upload plaintext.';
+    }
+    return null;
 }
 /** R2 object key for one record — dir-shaped agents key by relKey, file-shaped by session. */
 export function r2KeyForRecord(rec) {

package/dist/commands/sessions-import.d.ts

@@ -1,4 +1,5 @@
 import type { Command } from 'commander';
+import { type SessionsBackupClient } from '../lib/session/sync/net-client.js';
 import { type ParsedBundle } from '../lib/session/bundle.js';
 export declare function registerSessionsImportCommand(sessionsCmd: Command): void;
 /**
@@ -16,4 +17,4 @@ export declare function registerSessionsImportCommand(sessionsCmd: Command): voi
  * the command and its test drive the same decision.
  */
 export declare function r2ImportGateError(fromR2: boolean, isConfigured: boolean): string | null;
-export declare function pullFromR2(): Promise<ParsedBundle>;
+export declare function pullFromR2(resolvedClient?: SessionsBackupClient): Promise<ParsedBundle>;

package/dist/commands/sessions-import.js

@@ -11,9 +11,12 @@
 import * as fs from 'fs';
 import chalk from 'chalk';
 import { isSyncConfigured, loadR2Config } from '../lib/session/sync/config.js';
-import { resolveSyncEncKey } from '../lib/session/sync/transcript-crypto.js';
+import { isTranscriptEnvelope, resolveSyncEncKey } from '../lib/session/sync/transcript-crypto.js';
 import { R2Client } from '../lib/session/sync/r2.js';
 import { SESSIONS_PREFIX } from '../lib/session/sync/agents.js';
+import { resolveSessionsBackend } from '../lib/session/sync/backend.js';
+import { SessionsHttpClient } from '../lib/session/sync/net-client.js';
+import { resolveManagedBackupKey } from '../lib/session/sync/managed-key.js';
 import { parseBundle, planImport, writeImport, mergeRecords, makeHeader, } from '../lib/session/bundle.js';
 import { pullBundlesFromHosts } from '../lib/session/remote-bundle.js';
 import { setHelpSections } from '../lib/help.js';
@@ -25,7 +28,8 @@ export function registerSessionsImportCommand(sessionsCmd) {
         .option('--overwrite', 'Replace local files that differ from the bundle (default: keep local)')
         .option('--decrypt [key]', 'Decrypt an encrypted bundle (key optional if the r2.backups sync key is configured)')
         .option('--from-host <target...>', 'Pull sessions live from remote peer(s) over SSH instead of a file (repeatable)')
-        .option('--from-r2', 'Restore session backups from Cloudflare R2 (requires the r2.backups bundle)');
+        .option('--from-r2', 'Restore session backups from the off-box store (managed Phoenix store when signed in; your own r2.backups bucket with --byo)')
+        .option('--byo', 'With --from-r2: restore from your own r2.backups bucket instead of the managed Phoenix store');
     setHelpSections(cmd, {
         examples: `# Preview what a bundle would restore
 agents sessions import week.bundle --dry-run
@@ -46,9 +50,12 @@ they show up in 'agents sessions' tagged with that machine and never overwrite
 your own local sessions. Byte-exact duplicates are skipped. --from-host reuses
 the same SSH transport as the cross-machine listing (no R2, no daemon).
 
---from-r2 downloads every session backup in the r2.backups bucket and restores
-it through the same placement, using the shared R2_SYNC_ENC_KEY to decrypt (or
-pass --decrypt <key>). It is the inverse of 'sessions export --to-r2'.`,
+--from-r2 downloads every session backup from the off-box store and restores it
+through the same placement. When signed in it restores from the MANAGED Phoenix
+store and decrypts with your per-account key (recovered automatically, even on a
+fresh box); --byo restores from your own r2.backups bucket with its shared
+R2_SYNC_ENC_KEY (or pass --decrypt <key>). It is the inverse of
+'sessions export --to-r2'.`,
     });
     cmd.action(async (bundlePath, options, command) => {
         const g = command.optsWithGlobals();
@@ -58,13 +65,39 @@ pass --decrypt <key>). It is the inverse of 'sessions export --to-r2'.`,
 async function runImport(bundlePath, options, g, command) {
     // 1. Obtain the bundle — from R2, remote peer(s), stdin, or a file.
     let bundle;
+    // A managed restore recovers the per-account DEK (from the local cache or the
+    // Worker escrow) and decrypts with it; BYO falls back to the r2.backups key.
+    let managedDecryptKey;
+    if (options.byo && !options.fromR2) {
+        process.stderr.write(chalk.red('--byo is only valid with --from-r2.\n'));
+        process.exit(1);
+    }
     if (options.fromR2) {
-        const gateErr = r2ImportGateError(true, isSyncConfigured());
-        if (gateErr) {
-            process.stderr.write(chalk.red(gateErr + '\n'));
+        let client;
+        let managedClient;
+        let managedUserId;
+        try {
+            const backend = resolveSessionsBackend({ byo: options.byo });
+            if (backend.kind === 'managed') {
+                managedClient = new SessionsHttpClient({ baseUrl: backend.baseUrl, userId: backend.userId, token: backend.token });
+                client = managedClient;
+                managedUserId = backend.userId;
+            }
+            else {
+                const gateErr = r2ImportGateError(true, isSyncConfigured());
+                if (gateErr)
+                    throw new Error(gateErr);
+                client = new R2Client(backend.r2);
+            }
+        }
+        catch (err) {
+            process.stderr.write(chalk.red(`R2 restore: ${err.message}\n`));
             process.exit(1);
         }
-        bundle = await pullFromR2();
+        bundle = await pullFromR2(client);
+        if (managedUserId) {
+            managedDecryptKey = await resolveManagedBackupKey(managedClient, managedUserId);
+        }
     }
     else if (options.fromHost && options.fromHost.length > 0) {
         bundle = await pullForImport(options.fromHost, bundlePath, g, command);
@@ -98,8 +131,12 @@ async function runImport(bundlePath, options, g, command) {
             process.exit(1);
         }
     }
-    // 3. Resolve the decryption key if the bundle is encrypted.
-    const decryptKey = bundle.header.encrypted ? resolveDecryptKey(options.decrypt) : null;
+    // 3. Resolve the decryption key if the bundle is encrypted. A managed restore
+    //    already recovered the per-account DEK; otherwise fall back to an explicit
+    //    --decrypt <key> or the shared r2.backups key.
+    const decryptKey = bundle.header.encrypted
+        ? (managedDecryptKey ?? resolveDecryptKey(options.decrypt))
+        : null;
     // 4. Plan.
     let plan;
     try {
@@ -193,21 +230,33 @@ export function r2ImportGateError(fromR2, isConfigured) {
     }
     return null;
 }
-export async function pullFromR2() {
+export async function pullFromR2(resolvedClient) {
+    // The resolved client (managed HTTP or BYO R2) is passed in by the command; the
+    // no-client overload preserves the original BYO-only signature (loadR2Config)
+    // for the direct unit test. The managed client's list() ignores the prefix and
+    // enumerates the whole owner namespace, so one call site serves both.
     let client;
     let bucket;
-    try {
-        const cfg = loadR2Config();
-        bucket = cfg.bucket;
-        client = new R2Client(cfg);
+    if (resolvedClient) {
+        client = resolvedClient;
+        bucket = resolvedClient.kind === 'managed' ? 'managed' : 'byo';
     }
-    catch (err) {
-        process.stderr.write(chalk.red(`R2 restore: ${err.message}\n`));
-        process.exit(1);
+    else {
+        try {
+            const cfg = loadR2Config();
+            bucket = cfg.bucket;
+            client = new R2Client(cfg);
+        }
+        catch (err) {
+            process.stderr.write(chalk.red(`R2 restore: ${err.message}\n`));
+            process.exit(1);
+        }
     }
     let keys;
     try {
-        keys = await client.list(SESSIONS_PREFIX);
+        keys = client.kind === 'managed'
+            ? await client.list()
+            : await client.list(SESSIONS_PREFIX);
     }
     catch (err) {
         process.stderr.write(chalk.red(`R2 restore: listing failed: ${err.message}\n`));
@@ -239,6 +288,19 @@ export async function pullFromR2() {
             skipped++;
             continue;
         }
+        // Managed transcripts are mandatory AES-256-GCM (SES-51). A plaintext object
+        // in the managed store is a contract violation — an older/buggy writer or
+        // tampering — so fail loud rather than importing readable plaintext. Check
+        // the header AND every record body (matching the Worker's per-record
+        // isEncryptedManagedBundle boundary guard), never just the header flag.
+        if (client.kind === 'managed') {
+            const plaintext = !parsed.header.encrypted
+                || parsed.records.some(rec => !rec.encrypted || !isTranscriptEnvelope(rec.body));
+            if (plaintext) {
+                process.stderr.write(chalk.red(`R2 restore: managed backup ${key} is not encrypted — managed transcripts are always sealed; refusing to import plaintext.\n`));
+                process.exit(1);
+            }
+        }
         records.push(...parsed.records);
         if (parsed.header.encrypted)
             encryptedAny = true;
@@ -250,7 +312,9 @@ export async function pullFromR2() {
     }
     const deduped = mergeRecords([records]);
     if (deduped.length === 0) {
-        process.stderr.write(chalk.red(`No session backups found in R2 bucket '${bucket}'.\n`));
+        process.stderr.write(chalk.red(bucket === 'managed'
+            ? 'No session backups found in the managed store.\n'
+            : `No session backups found in R2 bucket '${bucket}'.\n`));
         process.exit(1);
     }
     const header = makeHeader({

package/dist/commands/traces.js

@@ -182,7 +182,7 @@ export function registerTracesCommands(program) {
         .description("Sync this device's derived, redacted trajectories to your Phoenix account");
     const setupCmd = tracesCmd
         .command('setup')
-        .description('Provision the private Cloudflare Worker and R2 bucket for traces')
+        .description('(advanced) Provision a self-hosted Cloudflare Worker + R2 bucket for traces — NOT required; `agents auth login` syncs to the managed endpoint with zero setup')
         .option('--bundle <name>', 'secrets bundle holding the Cloudflare API token', DEFAULT_CF_BUNDLE)
         .option('--worker <name>', 'Worker name', DEFAULT_WORKER_NAME)
         .option('--bucket <name>', 'R2 bucket name', DEFAULT_BUCKET_NAME)

package/dist/lib/account-capabilities.js

@@ -35,10 +35,8 @@ export const NATIVE_ACCOUNT_CAPABILITIES = {
     copilot: { inspection: 'none', scope: 'unsupported', status: 'unsupported' },
     openclaw: { inspection: 'none', scope: 'unsupported', status: 'unsupported' },
     amp: { inspection: 'none', scope: 'unsupported', status: 'unsupported' },
-    kiro: { inspection: 'none', scope: 'unsupported', status: 'unsupported' },
     goose: { inspection: 'none', scope: 'unsupported', status: 'unsupported' },
     hermes: { inspection: 'none', scope: 'unsupported', status: 'unsupported' },
-    pi: { inspection: 'none', scope: 'unsupported', status: 'unsupported' },
     warp: { inspection: 'none', scope: 'unsupported', status: 'unsupported' },
 };
 export function nativeAccountCapability(agent) {

package/dist/lib/account-registry.d.ts

@@ -54,12 +54,12 @@ export declare function listNativeAccounts(meta: Pick<Meta, 'accounts' | 'device
  * running before the body, so callers that only need a native lookup must be
  * able to omit it.
  */
-export declare function findUnifiedAccount(nameOrId: string, meta: Pick<Meta, 'accounts' | 'deviceAccounts'>, doc?: AccountRegistryDocument): UnifiedAccount | null;
+export declare function findUnifiedAccount(nameOrId: string, meta: Pick<Meta, 'accounts' | 'deviceAccounts'>, doc?: AccountRegistryDocument, preferAgent?: AgentId): UnifiedAccount | null;
 export declare function addNativeAccount(name: string, agent: AgentId, identityKey: string, identityLabel: string | undefined, scope: 'version' | 'device'): NativeAccount;
 /** Create or replace the version-independent label for one native identity. */
 export declare function labelNativeAccount(agent: AgentId, identityKey: string, identityLabel: string | undefined, label: string | undefined, scope: 'version' | 'device'): NativeAccount;
-export declare function bindAccount(nameOrId: string, target: string): UnifiedAccount;
-export declare function unbindAccount(nameOrId: string, target: string): void;
+export declare function bindAccount(nameOrId: string, target: string, preferAgent?: AgentId): UnifiedAccount;
+export declare function unbindAccount(nameOrId: string, target: string, preferAgent?: AgentId): void;
 /** Every target bound to `accountId`: this box's device-doc bindings merged over
  * the fleet-shared central bindings (PHNX-3315). */
 export declare function accountBindings(accountId: string, meta: Pick<Meta, 'accounts' | 'deviceAccounts'>): string[];

package/dist/lib/account-registry.js

@@ -159,9 +159,18 @@ export function listNativeAccounts(meta) {
  * running before the body, so callers that only need a native lookup must be
  * able to omit it.
  */
-export function findUnifiedAccount(nameOrId, meta, doc) {
+export function findUnifiedAccount(nameOrId, meta, doc, preferAgent) {
     const needle = nameOrId.toLowerCase();
-    const native = listNativeAccounts(meta).find(account => account.id === nameOrId || account.name.toLowerCase() === needle || account.identityLabel?.toLowerCase() === needle);
+    const matches = listNativeAccounts(meta).filter(account => account.id === nameOrId || account.name.toLowerCase() === needle || account.identityLabel?.toLowerCase() === needle);
+    // `identityLabel` defaults to the login's own identifier (the email), so ONE
+    // selector legitimately matches several harnesses: `muqsitnawaz@gmail.com` is a
+    // claude login AND a codex login. Un-scoped, `.find()` returned whichever row the
+    // merged store happened to order first, so `agents run claude#<email>` died with
+    // "Account 'personal' is a codex login and cannot authenticate the claude harness"
+    // while that identity's own claude login sat right there. Prefer the harness being
+    // launched; fall back to the first match so a management lookup with no harness in
+    // hand (rename/remove/view) behaves exactly as before.
+    const native = matches.find(account => account.agent === preferAgent) ?? matches[0];
     if (native)
         return native;
     const provider = findAccount(nameOrId, doc ?? readAccountRegistry());
@@ -253,9 +262,13 @@ export function labelNativeAccount(agent, identityKey, identityLabel, label, sco
     });
     return { ...matches[0], name: resolvedLabel, identityLabel, scope: rowScope };
 }
-export function bindAccount(nameOrId, target) {
+export function bindAccount(nameOrId, target, preferAgent) {
     const meta = readMeta();
-    const account = findUnifiedAccount(nameOrId, meta);
+    // Scope to the harness being bound to: a bare identity selector matches every
+    // harness it is signed into, so without this the binding could persist against
+    // a different harness's row than the caller validated (the attach command
+    // resolves `targetAgent` and passes it here).
+    const account = findUnifiedAccount(nameOrId, meta, undefined, preferAgent);
     if (!account)
         throw new Error(`Unknown account '${nameOrId}'.`);
     // A binding follows its account: one that targets a device-scoped native login
@@ -275,9 +288,11 @@ export function bindAccount(nameOrId, target) {
     }
     return account;
 }
-export function unbindAccount(nameOrId, target) {
+export function unbindAccount(nameOrId, target, preferAgent) {
     const meta = readMeta();
-    const account = findUnifiedAccount(nameOrId, meta);
+    // Same scoping as bindAccount: detach the row on the harness the caller means,
+    // not whichever the store happened to order first for a colliding identity.
+    const account = findUnifiedAccount(nameOrId, meta, undefined, preferAgent);
     if (!account)
         throw new Error(`Unknown account '${nameOrId}'.`);
     const inCentral = meta.accounts?.bindings?.[target] === account.id;
@@ -527,7 +542,10 @@ export function resolveSpawnAccount(explicit, agent, version, meta, opts = {}) {
     const selection = resolveAccountSelection(explicit, agent, meta, { useDefault: opts.useDefault, target });
     if (!selection)
         return null;
-    const unified = findUnifiedAccount(selection.id, meta);
+    // Scope the lookup to the harness being launched: a bare identity selector
+    // (`claude#muqsitnawaz@gmail.com`) matches every harness that identity is signed
+    // into, and only this one can authenticate the spawn.
+    const unified = findUnifiedAccount(selection.id, meta, undefined, agent);
     if (!unified) {
         // A stale per-harness default is a preference, not a hard requirement: the
         // machine stays runnable by falling back to balanced rotation. Bindings and

package/dist/lib/accounting/usage-sync.d.ts

@@ -28,7 +28,7 @@ export interface PublishUsageSnapshotResult {
     path: string | null;
 }
 /** Publish this headed device's stable usage snapshot into its owned store file. */
-export declare function publishUsageSnapshotToSharedStore(options?: PublishUsageSnapshotOptions): PublishUsageSnapshotResult;
+export declare function publishUsageSnapshotToSharedStore(options?: PublishUsageSnapshotOptions): Promise<PublishUsageSnapshotResult>;
 export interface ConsumeUsageSnapshotsOptions {
     userAgentsDir?: string;
     cachePath?: string;

package/dist/lib/accounting/usage-sync.js

@@ -8,12 +8,12 @@
  * There is deliberately no device-to-device SSH in this module or its tick.
  */
 import { isHeadedDeviceRole, listConfiguredDeviceRoles, selfConfiguredDeviceRole } from '../device-config.js';
-import { readFleetSharedDeviceStates, updateFleetSharedDeviceState, } from '../fleet-shared-state.js';
+import { readFleetSharedDeviceStates, updateFleetSharedDeviceStateAsync, } from '../fleet-shared-state.js';
 import { getUserAgentsDir } from '../state.js';
 import { machineId, normalizeHost } from '../session/sync/config.js';
 import { exportClaudeUsageCacheRows, ingestPeerClaudeUsageRows, } from './usage.js';
 /** Publish this headed device's stable usage snapshot into its owned store file. */
-export function publishUsageSnapshotToSharedStore(options = {}) {
+export async function publishUsageSnapshotToSharedStore(options = {}) {
     const result = {
         published: false,
         changed: false,
@@ -32,7 +32,7 @@ export function publishUsageSnapshotToSharedStore(options = {}) {
         return result;
     }
     try {
-        const write = updateFleetSharedDeviceState(options.device ?? machineId(), { usage: { rows } }, options.userAgentsDir ?? getUserAgentsDir());
+        const write = await updateFleetSharedDeviceStateAsync(options.device ?? machineId(), { usage: { rows } }, options.userAgentsDir ?? getUserAgentsDir());
         result.published = true;
         result.changed = write.changed;
         result.path = write.path;

package/dist/lib/acp/client.d.ts

@@ -11,7 +11,7 @@
  */
 import { type SessionNotification } from '@zed-industries/agent-client-protocol';
 import type { AgentId } from '../types.js';
-import type { ExecMode } from '../exec.js';
+import { type ExecMode } from '../exec.js';
 export interface AcpRunOptions {
     agent: AgentId;
     prompt: string;

package/dist/lib/acp/client.js

@@ -15,6 +15,7 @@ import { promises as fs } from 'fs';
 import * as path from 'path';
 import { ClientSideConnection, ndJsonStream, } from '@zed-industries/agent-client-protocol';
 import { getAcpSpec, supportsAcp } from './harnesses.js';
+import { buildExecEnv } from '../exec.js';
 const PROTOCOL_VERSION = 1;
 /**
  * Runs a single prompt turn against an ACP-capable agent and streams updates
@@ -25,10 +26,20 @@ export async function runAcp(opts) {
         throw new Error(`Agent '${opts.agent}' does not support ACP. Use direct exec instead.`);
     }
     const spec = getAcpSpec(opts.agent);
+    // Build the harness's exec env the SAME way `agents run` does, instead of
+    // handing it a raw process.env. buildExecEnv is what injects the per-account
+    // `CLAUDE_CODE_OAUTH_TOKEN` on a worker device (gated by device role: a
+    // headed/personal box still defers to its native login). Without this, an ACP
+    // launch inherited no setup-token and fell through to the version home's
+    // copied native `.credentials.json` — which expires in ~15h and 401s once its
+    // refresh chain dies, exactly the "logged out on a worker" report (PHNX-3681).
+    // A verified precedence test shows the env token wins over a present
+    // `.credentials.json`, so injecting here is sufficient — the stale file no
+    // longer decides the session.
     const child = spawn(spec.command, spec.args, {
         cwd: opts.cwd,
         stdio: ['pipe', 'pipe', 'inherit'],
-        env: process.env,
+        env: buildExecEnv({ agent: opts.agent, cwd: opts.cwd, mode: opts.mode, effort: 'auto', interactive: true }),
     });
     const stream = ndJsonStream(Writable.toWeb(child.stdin), Readable.toWeb(child.stdout));
     const client = buildClient(opts);

package/dist/lib/acp/harnesses.js

@@ -52,7 +52,7 @@ export const ACP_HARNESSES = {
     },
     // antigravity: no documented ACP support (May 2026).
     // goose: ACP over HTTP via `goosed`, not a clean stdio subcommand.
-    // copilot, kiro: excluded for now (not installed in the reference environment,
+    // copilot: excluded for now (not installed in the reference environment,
     //                no local verification possible).
     // amp: not on the ACP agents list.
 };

package/dist/lib/add-dir.js

@@ -33,11 +33,9 @@ export const ADD_DIR_STRATEGY = {
     // No multi-root CLI surface today (single --dir / project path).
     opencode: 'none',
     gemini: 'none',
-    pi: 'none',
     openclaw: 'none',
     copilot: 'none',
     amp: 'none',
-    kiro: 'none',
     goose: 'none',
     antigravity: 'none',
     droid: 'none',

package/dist/lib/agent-cli-commands.js

@@ -14,11 +14,9 @@ export const AGENT_CLI_COMMANDS = [
     'gemini',
     'cursor-agent',
     'opencode',
-    'omp',
     'openclaw',
     'copilot',
     'amp',
-    'kiro-cli',
     'goose',
     'agy',
     'grok',

package/dist/lib/agent-spec/agents.d.ts

@@ -104,7 +104,7 @@ export declare const MANAGED_AGENT_IDS: AgentId[];
  * `curl … | sh` / `brew install` script that carries NO version token — the
  * installer can only ever fetch the *current* release, and the binary then keeps
  * itself up to date in place (droid, grok, antigravity, cursor, hermes,
- * kiro, goose). There is no semver to pin, so agents-cli must not model these as
+ * goose). There is no semver to pin, so agents-cli must not model these as
  * having multiple installable version-homes the way it does for npm-packaged
  * agents (claude, codex, kimi, …).
  *