@phnx-labs/agents-cli 1.22.84 → 1.22.86

package/dist/commands/versions.js

@@ -7,22 +7,27 @@ import { AGENTS, MANAGED_AGENT_IDS, accountOrgBadge, getAccountEmail, getAccount
 import { formatUsageSummary, getUsageInfoForIdentity, getUsageInfoByIdentity, getUsageLookupKey, isUsageHeadlessScopeError, } from '../lib/accounting/usage.js';
 import { resolveConfiguredModel, formatAgentIdentity } from '../lib/models.js';
 import { readManifest, writeManifest, createDefaultManifest } from '../lib/manifest.js';
-import { installVersion, removeVersion, listInstalledVersions, isVersionInstalled, isLatestInstalled, isOldestInstalled, getGlobalDefault, setGlobalDefault, markVersionIsolated, setIsolatedDefault, isVersionIsolated, getVersionHomePath, getVersionDir, syncResourcesToVersion, parseAgentSpec, promptResourceSelection, promptNewResourceSelection, getAvailableResources, getActuallySyncedResources, getNewResources, getProjectOnlyResources, hasNewResources, printTrashFooter, } from '../lib/installations/versions.js';
+import { installVersion, removeVersion, listInstalledVersions, isVersionInstalled, isLatestInstalled, isOldestInstalled, getGlobalDefault, setGlobalDefault, markVersionIsolated, setIsolatedDefault, isVersionIsolated, getVersionHomePath, getVersionDir, resolveManagedInstallation, ensureHarnessInstallation, MANAGED_INSTALLATION_LABEL, syncResourcesToVersion, parseAgentSpec, promptResourceSelection, promptNewResourceSelection, getAvailableResources, getActuallySyncedResources, getNewResources, getProjectOnlyResources, hasNewResources, printTrashFooter, } from '../lib/installations/versions.js';
+import { supportsPinnedUpdate, updateInstallation } from '../lib/installations/index.js';
 import { carryForwardSettings } from '../lib/settings-manifest.js';
 import { createShim, createVersionedAlias, supportsIsolatedInstall, isIsolationProtected, CONFIG_ENV_ISOLATED_AGENTS, removeShim, shimExists, getShimsDir, getShimPath, getPathShadowingExecutable, isShimsInPath, getPathSetupInstructions, addShimsToPath, switchConfigSymlink, switchHomeFileSymlinks, } from '../lib/installations/shims.js';
 import { isInteractiveTerminal, isPromptCancelled, requireInteractiveSelection } from './utils.js';
+import { redactSecrets } from '../lib/redact.js';
 import { tryAutoPullSystemRepo } from '../lib/git.js';
 import { getAgentsDir, getTrashVersionsDir } from '../lib/state.js';
 import { setHelpSections } from '../lib/help.js';
 import { updateSessionFilePaths } from '../lib/session/db.js';
-import { connectSupported } from '../lib/accounts/connect.js';
-/** Bare installs reuse an account home; explicit labels keep their expert semantics. */
-export function planAccountFirstInstall(input) {
-    if (!input.supported || input.isolated || input.spec.includes('@'))
-        return {};
-    const existingLabel = input.defaultLabel && input.labels.includes(input.defaultLabel)
-        ? input.defaultLabel : input.labels[0];
-    return existingLabel ? { existingLabel } : { installationLabel: 'main' };
+/**
+ * What `agents add <spec>` does with the harness's ONE managed installation
+ * (PHNX-3940): with no managed install it installs one (label `main`); with
+ * one, a bare spec reuses it and an explicit `@<release>` pins that same
+ * install — exactly `agents update <agent> --to <release>`. A second home is
+ * only ever an `--isolated` copy, which bypasses this plan entirely.
+ */
+export function planManagedAdd(input) {
+    if (!input.managedInstalled)
+        return 'install';
+    return input.explicitPin ? 'pin' : 'reuse';
 }
 /**
  * After removeVersion soft-deletes a version dir to trash, rewrite session
@@ -305,28 +310,30 @@ export function registerVersionsCommands(program) {
         .option('-y, --yes', 'Auto-accept defaults without prompting (useful for scripts and CI)');
     setHelpSections(addCmd, {
         examples: `
-      # Install the latest version of an agent
-      agents add claude@latest
-
-      # Install the oldest published version of an agent
-      agents add claude@oldest
+      # Install the one managed installation of an agent
+      agents add claude
 
-      # Install a specific version (reproducibility)
+      # Pin that same installation to a specific release (same as 'agents update claude --to 2.1.112')
       agents add claude@2.1.112
 
+      # Move it back to tracking the latest release
+      agents add claude@latest
+
       # Install multiple agents at once
-      agents add claude@latest codex@0.116.0
+      agents add claude codex
 
-      # Lock a version to this project only (won't affect global default)
-      agents add claude@2.1.100 --project
+      # Lock this project to the managed installation (won't affect global default)
+      agents add claude --project
 
       # Install a clean, separate copy that leaves your existing setup alone
       agents add claude@2.1.112 --isolated
     `,
         notes: `
+      - One managed installation per harness: bare 'agents add <harness>' installs it (as <harness>@main) or reuses the one already there.
+      - '<harness>@<release>' pins that SAME installation — it is 'agents update <harness> --to <release>', not a second home. A second, separate copy requires --isolated.
+      - Add another account with 'agents accounts add <harness> [name]'.
       - The first version you install becomes the default automatically.
       - 'add' does NOT change the default if a default already exists. Use 'agents use' to switch.
-      - Bare Claude/Codex installs reuse your existing home. Connect another account with 'agents accounts connect <agent> [name]'.
       - --isolated installs a self-contained copy: it never sets the default, never creates the bare '<agent>' shim, and never backs up or symlinks your real ~/.<agent>. Run it with 'agents run <agent>@<version>' and remove it with 'agents remove <agent>@<version> --isolated'. Mutually exclusive with --project.
     `,
     });
@@ -382,40 +389,77 @@ export function registerVersionsCommands(program) {
                 console.log(chalk.yellow(`${agentLabel(agentConfig.id)} has no npm package. Install manually.`));
                 continue;
             }
-            // Check if already installed (resolve 'latest'/'oldest' against npm first)
-            let alreadyInstalled = false;
+            // One managed installation per harness (PHNX-3940): bare `agents add`
+            // installs it (label `main`) or reuses the one already there, and
+            // `<harness>@<release>` pins that SAME install — exactly
+            // `agents update <harness> --to <release>`. A second home exists only
+            // as an --isolated copy, which keeps its own release-labelled flow.
             let installedAsVersion = version;
-            const accountInstall = planAccountFirstInstall({
-                spec, supported: connectSupported(agent), isolated: !!isIsolated,
-                labels: listInstalledVersions(agent).filter(label => !isVersionIsolated(agent, label)),
-                defaultLabel: getGlobalDefault(agent),
-            });
-            if (accountInstall.existingLabel) {
-                alreadyInstalled = true;
-                installedAsVersion = accountInstall.existingLabel;
-            }
-            else if (accountInstall.installationLabel) {
-                // A fresh managed home has a stable label, independent of npm's release.
-            }
-            else if (version === 'latest') {
-                const latestCheck = await isLatestInstalled(agent);
-                if (latestCheck.installed && latestCheck.version) {
-                    alreadyInstalled = true;
-                    installedAsVersion = latestCheck.version;
+            const managed = isIsolated ? null : resolveManagedInstallation(agent);
+            // `<harness>@main` (or @<the managed label>) names the installation
+            // itself, not a release: it reads as the bare form — reuse when
+            // present, install latest into `main` when absent — never an
+            // `npm install <pkg>@main` guessing at a registry tag.
+            const namesManagedLabel = version === MANAGED_INSTALLATION_LABEL || (managed !== null && version === managed.label);
+            const addPlan = planManagedAdd({ explicitPin: spec.includes('@') && !namesManagedLabel, managedInstalled: managed !== null });
+            if (addPlan === 'pin' && managed) {
+                if (version !== 'latest' && !supportsPinnedUpdate(agent)) {
+                    // Fail loud at the boundary rather than updating to the current
+                    // release and reporting it as the pin that was asked for.
+                    console.log(chalk.red(`${agentLabel(agentConfig.id)} is a single self-updating binary with no pinnable releases — drop the @${version}, or use @latest.`));
+                    process.exitCode = 1;
+                    continue;
                 }
-            }
-            else if (version === 'oldest') {
-                const oldestCheck = await isOldestInstalled(agent);
-                if (oldestCheck.installed && oldestCheck.version) {
-                    alreadyInstalled = true;
-                    installedAsVersion = oldestCheck.version;
+                console.log(chalk.gray(`${agentLabel(agentConfig.id)} has one managed installation (${agent}@${managed.label}, release ${managed.releaseVersion}); pinning it to ${version} — the same as 'agents update ${agent} --to ${version}'.`));
+                console.log(chalk.gray(`  A second, separate copy is the expert path: agents add ${agent}@${version} --isolated`));
+                try {
+                    const outcome = await updateInstallation(managed, {
+                        to: version,
+                        updatePolicy: version === 'latest' ? 'latest' : 'pinned',
+                        onProgress: (message) => console.log(chalk.gray(`  ${message}`)),
+                    });
+                    if (outcome.deferred) {
+                        console.log(chalk.yellow(`${agent}@${managed.label}: ${outcome.deferred} Still on release ${outcome.installation.releaseVersion}.`));
+                        continue;
+                    }
+                    console.log(outcome.unchanged
+                        ? chalk.gray(`${agent}@${managed.label} is already on release ${outcome.toRelease}.`)
+                        : chalk.green(`Pinned ${agent}@${managed.label}: release ${outcome.fromRelease} -> ${outcome.toRelease}`));
+                }
+                catch (err) {
+                    console.log(chalk.red(redactSecrets(err.message)));
+                    process.exitCode = 1;
+                    continue;
                 }
+                installedAsVersion = managed.label;
             }
-            else {
-                alreadyInstalled = isVersionInstalled(agent, version);
+            else if (addPlan === 'reuse' && managed) {
+                console.log(chalk.gray(`${agentLabel(agentConfig.id)} is already installed. Your account home is unchanged.`));
+                console.log(chalk.gray(`  Accounts: agents view ${agent}. Update now: agents update ${agent}.`));
+                installedAsVersion = managed.label;
+                // Ensure shim exists (in case it was deleted or needs updating)
+                createShim(agent);
             }
-            if (alreadyInstalled) {
-                if (isIsolated) {
+            else if (isIsolated) {
+                let alreadyInstalled = false;
+                if (version === 'latest') {
+                    const latestCheck = await isLatestInstalled(agent);
+                    if (latestCheck.installed && latestCheck.version) {
+                        alreadyInstalled = true;
+                        installedAsVersion = latestCheck.version;
+                    }
+                }
+                else if (version === 'oldest') {
+                    const oldestCheck = await isOldestInstalled(agent);
+                    if (oldestCheck.installed && oldestCheck.version) {
+                        alreadyInstalled = true;
+                        installedAsVersion = oldestCheck.version;
+                    }
+                }
+                else {
+                    alreadyInstalled = isVersionInstalled(agent, version);
+                }
+                if (alreadyInstalled) {
                     if (!isVersionIsolated(agent, installedAsVersion)) {
                         // A normal and an isolated install of the SAME version share one
                         // on-disk dir, so they can't coexist. Refuse rather than silently
@@ -428,37 +472,45 @@ export function registerVersionsCommands(program) {
                     finalizeIsolatedInstall(agent, installedAsVersion);
                     continue;
                 }
-                console.log(chalk.gray(accountInstall.existingLabel
-                    ? `${agentLabel(agentConfig.id)} is already installed. Your account home is unchanged.`
-                    : `${agentLabel(agentConfig.id)}@${installedAsVersion} already installed`));
-                if (accountInstall.existingLabel) {
-                    console.log(chalk.gray(`  Accounts: agents view ${agent}. Update now: agents update ${agent}.`));
-                }
-                // Ensure shim exists (in case it was deleted or needs updating)
-                createShim(agent);
-            }
-            else {
                 const spinner = ora(`Installing ${agentLabel(agentConfig.id)}@${version}...`).start();
                 const result = await installVersion(agent, version, (msg) => {
                     spinner.text = msg;
-                }, accountInstall.installationLabel ? { installationLabel: accountInstall.installationLabel } : undefined);
-                if (result.success) {
-                    const installedVer = result.installedVersion || version;
-                    const installedModel = resolveConfiguredModel(agentConfig.id, installedVer)?.model;
-                    const installedIdentity = formatAgentIdentity(`${agentLabel(agentConfig.id)}@${result.installedVersion}`, installedModel ? chalk.yellow(installedModel) : null);
+                });
+                if (!result.success) {
+                    spinner.fail(`Failed to install ${agentLabel(agentConfig.id)}@${version}`);
+                    console.error(chalk.gray(redactSecrets(result.error || 'Unknown error')));
+                    continue;
+                }
+                // Isolated installs stop here: no bare shim, no settings carry-over,
+                // no resource sync, no default switch, no PATH edits. Just a
+                // launchable versioned alias + the isolated marker, leaving the
+                // user's real ~/.<agent> and default untouched.
+                finalizeIsolatedInstall(agent, result.installedVersion || version);
+                continue;
+            }
+            else {
+                const installRelease = namesManagedLabel ? 'latest' : version;
+                const spinner = ora(`Installing ${agentLabel(agentConfig.id)}@${installRelease}...`).start();
+                let ensured;
+                try {
+                    ensured = await ensureHarnessInstallation(agent, {
+                        release: installRelease,
+                        onProgress: (msg) => { spinner.text = msg; },
+                    });
+                }
+                catch (err) {
+                    spinner.fail(`Failed to install ${agentLabel(agentConfig.id)}@${installRelease}`);
+                    console.error(chalk.gray(redactSecrets(err.message)));
+                    continue;
+                }
+                {
+                    const installedVersion = ensured.installation.label;
+                    const installedModel = resolveConfiguredModel(agentConfig.id, ensured.installation.releaseVersion)?.model;
+                    const installedIdentity = formatAgentIdentity(`${agentLabel(agentConfig.id)}@${installedVersion}`, installedModel ? chalk.yellow(installedModel) : null);
                     spinner.succeed(`Installed ${installedIdentity}`);
-                    const installedVersion = result.installedVersion || version;
-                    // Track the concrete version so a `--project` pin records it instead
-                    // of the `latest`/`oldest` alias.
+                    // The project pin below names the installation, never the release
+                    // inside it — the release moves on update, the label is frozen.
                     installedAsVersion = installedVersion;
-                    // Isolated installs stop here: no bare shim, no settings carry-over,
-                    // no resource sync, no default switch, no PATH edits. Just a
-                    // launchable versioned alias + the isolated marker, leaving the
-                    // user's real ~/.<agent> and default untouched.
-                    if (isIsolated) {
-                        finalizeIsolatedInstall(agent, installedVersion);
-                        continue;
-                    }
                     // Create shim if first install
                     if (!shimExists(agent)) {
                         createShim(agent);
@@ -601,11 +653,6 @@ export function registerVersionsCommands(program) {
                         }
                     }
                 }
-                else {
-                    spinner.fail(`Failed to install ${agentLabel(agentConfig.id)}@${version}`);
-                    console.error(chalk.gray(result.error || 'Unknown error'));
-                    continue;
-                }
             }
             // Update project manifest if -p flag
             if (isProject) {
@@ -618,11 +665,12 @@ export function registerVersionsCommands(program) {
                     ? readManifest(process.cwd()) || createDefaultManifest()
                     : createDefaultManifest();
                 manifest.agents = manifest.agents || {};
-                manifest.agents[agent] = (version === 'latest' || version === 'oldest')
-                    ? installedAsVersion
-                    : version;
+                // A project pin names the installation (its frozen label), never the
+                // release inside it — the release moves on update, the label is what
+                // every resolver reads back.
+                manifest.agents[agent] = installedAsVersion;
                 writeManifest(process.cwd(), manifest);
-                console.log(chalk.green(`  Pinned ${agentLabel(agentConfig.id)}@${version} in .agents/agents.yaml`));
+                console.log(chalk.green(`  Pinned ${agentLabel(agentConfig.id)}@${installedAsVersion} in .agents/agents.yaml`));
             }
         }
     });

package/dist/commands/view.d.ts

@@ -1,11 +1,3 @@
-/**
- * View command for inspecting installed agents, versions, accounts, and resources.
- *
- * Implements `agents view` -- shows installed agent CLIs with version info,
- * account emails, usage stats, and active status. When given an agent@version
- * argument, displays a detailed breakdown of commands, skills, MCP servers,
- * rules, hooks, and promptcuts synced to that version.
- */
 import type { Command } from 'commander';
 import { accountDisplayLabel } from '../lib/agents.js';
 import type { AccountInfo } from '../lib/agents.js';
@@ -22,7 +14,7 @@ export declare function viewUsageSummaryOptions(agentId: AgentId, signedIn: bool
 export declare const accountColumnLabel: typeof accountDisplayLabel;
 /**
  * The account column with the durable native-account name folded in: when the
- * signed-in identity of `agentId` has been named via `agents accounts name`,
+ * signed-in identity of `agentId` has been named via `agents accounts add`,
  * render `work · email` instead of the bare email. Falls back to the plain
  * display label when the identity is unnamed.
  */

package/dist/commands/view.js

@@ -1,3 +1,12 @@
+/**
+ * View command for inspecting installed agents, versions, accounts, and resources.
+ *
+ * Implements `agents view` -- shows installed agent CLIs with version info,
+ * account emails, usage stats, and active status. When given an agent@version
+ * argument, displays a detailed breakdown of commands, skills, MCP servers,
+ * rules, hooks, and promptcuts synced to that version.
+ */
+import { Option } from 'commander';
 import { addHostOption } from '../lib/hosts/option.js';
 import chalk from 'chalk';
 import { termLink } from '../lib/format.js';
@@ -21,8 +30,8 @@ import { isCapable } from '../lib/capabilities.js';
 import { discoverPlugins, pluginSupportsAgent } from '../lib/plugins/plugins.js';
 import { getAgentsDir, getUserAgentsDir, getEffectivePromptcutsPath, readMergedPromptcuts, readMeta } from '../lib/state.js';
 import { findNativeAccountByIdentity } from '../lib/account-registry.js';
-import { buildNativeCatalog } from '../lib/account-catalog.js';
-import { connectSupported } from '../lib/accounts/connect.js';
+import { accountListJson, loadAccountCatalog, renderAccountRows, secretsUnavailableNote } from '../lib/account-catalog.js';
+import { addSupported } from '../lib/accounts/add.js';
 import { readInstallation } from '../lib/installations/store.js';
 import { isAutoUpdateEnabledForAgent } from '../lib/installations/update-policy.js';
 import { selectUpdateStrategy } from '../lib/installations/strategies.js';
@@ -61,7 +70,7 @@ export function viewUsageSummaryOptions(agentId, signedIn, usageInfo, maxWindows
 export const accountColumnLabel = accountDisplayLabel;
 /**
  * The account column with the durable native-account name folded in: when the
- * signed-in identity of `agentId` has been named via `agents accounts name`,
+ * signed-in identity of `agentId` has been named via `agents accounts add`,
  * render `work · email` instead of the bare email. Falls back to the plain
  * display label when the identity is unnamed.
  */
@@ -530,16 +539,13 @@ async function showInstalledVersions(filterAgentId, viewOpts) {
     };
     // Show version-managed agents
     if (versionManaged.length > 0 && !viewOpts?.versions) {
-        const catalog = buildNativeCatalog(infoResults.map(({ agentId, version, home, info }) => ({
-            agent: agentId,
-            label: version,
-            releaseVersion: displayVersion(agentId, version),
-            accountKey: info.accountKey,
-            email: info.email,
-            signedIn: isLaunchableSignedIn(info.signedIn, credentialPresence(agentId, home)),
-        })), readMeta(), (agent) => getGlobalDefault(agent) ?? getIsolatedDefault(agent));
+        const catalog = await loadAccountCatalog();
+        const note = secretsUnavailableNote(catalog);
+        if (note)
+            console.error(chalk.yellow(note));
         for (const agentId of versionManaged) {
-            const accounts = catalog.filter((row) => row.agent === agentId);
+            const accounts = catalog.native.filter((row) => row.agent === agentId);
+            const providers = catalog.provider.filter((row) => row.harnesses.includes(agentId));
             let updateLabel = 'manual updates';
             try {
                 if (selectUpdateStrategy(agentId).transactional) {
@@ -548,47 +554,33 @@ async function showInstalledVersions(filterAgentId, viewOpts) {
             }
             catch { /* unsupported updater: keep the truthful manual label */ }
             console.log(`  ${chalk.bold(agentLabel(agentId))}${chalk.gray(` · ${updateLabel}`)}`);
-            const width = Math.max(0, ...accounts.map((row) => stringWidth(nativeAccountViewLabel(row))));
-            for (const row of accounts) {
-                const source = row.installations.find((home) => home.label === row.home && home.signedIn)
-                    ?? row.installations.find((home) => home.signedIn)
-                    ?? row.installations[0];
-                const rawInfo = source ? infoMap.get(`${agentId}:${source.label}`) : undefined;
-                const info = rawInfo ? mergeCanonical(rawInfo) : undefined;
-                const usageKey = getUsageLookupKey(info);
-                const usageInfo = usageKey ? usageByKey.get(usageKey) : undefined;
-                const usage = formatUsageSummary(info?.plan ?? null, usageInfo?.snapshot ?? null, 3, viewUsageSummaryOptions(agentId, row.state === 'connected', usageInfo, usageWindowCap));
-                const connected = row.state === 'connected';
-                const model = source ? resolveConfiguredModel(agentId, source.label)?.model : null;
-                const pinned = row.installations.some((home) => readInstallation(agentId, home.label)?.updatePolicy === 'pinned');
-                const parts = [
-                    `    ${row.isDefault ? chalk.green('*') : ' '} ${chalk.cyan(padToWidth(nativeAccountViewLabel(row), width))}`,
-                    connected ? chalk.green('connected') : chalk.yellow('not connected here'),
-                    model ? chalk.yellow(model) : '',
-                    usage,
-                    formatUsageStatusBadge(info?.usageStatus),
-                    pinned ? chalk.gray('release pinned · --versions') : '',
-                ];
-                console.log(joinViewColumns(parts));
+            if (accounts.length > 0 || providers.length > 0) {
+                console.log(renderAccountRows(accounts, {
+                    heading: false,
+                    footer: false,
+                    harnessHeadings: false,
+                    providers,
+                    harness: agentId,
+                    localDevice: machineId(),
+                }));
             }
-            if (accounts.length === 0) {
+            else {
                 const localIdentity = infoResults.some((row) => row.agentId === agentId && row.info.signedIn);
-                const hint = connectSupported(agentId) ? `agents accounts connect ${agentId}` : loginHint(agentId);
+                const hint = addSupported(agentId) ? `agents accounts add ${agentId} <name>` : loginHint(agentId);
                 console.log(chalk.gray(localIdentity
                     ? '    Native login detected · account identity unavailable'
                     : `    No native login detected · ${hint}`));
             }
             const isolatedCount = listInstalledVersions(agentId).filter((label) => isVersionIsolated(agentId, label)).length;
             if (isolatedCount > 0)
-                console.log(chalk.gray(`    ${isolatedCount} isolated installation${isolatedCount === 1 ? '' : 's'} · inspect with --versions`));
+                console.log(chalk.gray(`    ${isolatedCount} isolated installation${isolatedCount === 1 ? '' : 's'}`));
             const projectVersion = getProjectVersionFromCwd(agentId);
             if (projectVersion)
-                console.log(chalk.gray('    Project installation override configured · inspect with --versions'));
+                console.log(chalk.gray('    Project installation override configured'));
             console.log();
         }
         if (filterAgentId) {
-            const connect = connectSupported(filterAgentId) ? `Connect: agents accounts connect ${filterAgentId} [name] · ` : '';
-            console.log(chalk.gray(`  ${connect}Details: agents view ${filterAgentId} --versions\n`));
+            console.log(chalk.gray(`  Add an account: agents accounts add ${filterAgentId} [name]\n`));
         }
     }
     if (versionManaged.length > 0 && viewOpts?.versions) {
@@ -1420,6 +1412,10 @@ export async function collectAgentsJson(filterAgentId, resourceSections, opts) {
     // Keep filtered native JSON consistent with the text view: custom forks are
     // not children of the native harness they execute through.
     const harnesses = filterAgentId ? [] : getHarnesses();
+    const catalog = await loadAccountCatalog();
+    const note = secretsUnavailableNote(catalog);
+    if (note)
+        console.error(chalk.yellow(note)); // stderr — never corrupts --json stdout
     const out = [];
     for (const agentId of agentsToShow) {
         const versions = byAgent.get(agentId) ?? [];
@@ -1428,15 +1424,9 @@ export async function collectAgentsJson(filterAgentId, resourceSections, opts) {
                 return a.isDefault ? -1 : 1;
             return compareVersions(b.version, a.version);
         });
-        const accounts = buildNativeCatalog(infoResults.filter((row) => row.agentId === agentId).map(({ version, home, info }) => ({
-            agent: agentId,
-            label: version,
-            releaseVersion: actualRelease(agentId, version),
-            accountKey: info.accountKey,
-            email: info.email,
-            signedIn: isLaunchableSignedIn(info.signedIn, credentialPresence(agentId, home)),
-        })), readMeta(), (agent) => getGlobalDefault(agent) ?? getIsolatedDefault(agent))
-            .filter((row) => row.agent === agentId);
+        // Project through the public JSON v2 serializer — the internal catalog row
+        // (identityKey, home, installations) is not the machine contract.
+        const accounts = accountListJson(catalog.native.filter((row) => row.agent === agentId), catalog.provider.filter((row) => row.harnesses.includes(agentId)), agentId).accounts;
         out.push({ agent: agentId, versions, accounts, harnesses: harnesses.filter((h) => h.agent === agentId) });
     }
     return out;
@@ -1834,8 +1824,8 @@ export async function viewAction(agentArg, options) {
 /** Register the `agents view` command. */
 export function registerViewCommand(program) {
     addHostOption(program.command('view [agent]'))
-        .description('Show your agents, connected accounts, and usage. Use --versions for installation diagnostics.')
-        .option('--versions', 'Show every installation, actual release, account, model, and home path.')
+        .description('Show your agents, connected accounts, and usage.')
+        .addOption(new Option('--versions', 'Show every installation, actual release, account, model, and home path (legacy diagnostic surface).').hideHelp())
         .option('--json', 'Emit machine-readable JSON (accounts plus backward-compatible installation list).')
         .option('--resources [sections]', 'In --json mode, include each version\'s resources: "all" (default) or a comma list (skills,plugins,mcp,commands,workflows,memory,hooks). Implies --json.')
         .option('--detailed', 'Include all resources in --json output (alias for --resources all). Implies --json.')
@@ -1862,9 +1852,6 @@ Examples:
   # Show accounts for one agent
   agents view claude
 
-  # Inspect installation labels, current releases, models, and paths
-  agents view claude --versions
-
   # Describe one custom harness (host, model, provider, auth, path)
   agents view deepseek-flash
 
@@ -1904,7 +1891,6 @@ Output:
   - Without arguments: table of all agents with accounts, connection state, usage,
     then one block per custom harness (see 'agents harness')
   - With agent name: one row per native identity, showing the default account
-  - With --versions: every retained installation, actual release, model, and home
   - With a custom harness name: that harness's host, model, provider, and auth
   - With agent@version: detailed breakdown of resources synced to that version
   - With --json: structured JSON with version, isDefault, signedIn, authVerdict,

package/dist/commands/webhook.js

@@ -1,7 +1,7 @@
 import * as path from 'path';
 import chalk from 'chalk';
-import { readAndResolveBundleEnv } from '../lib/secrets/bundles.js';
-import { closeServerBounded } from '../lib/secrets/agent.js';
+import { readAndResolveBundleEnv } from '../lib/secrets-client.js';
+import { closeServerBounded } from '../lib/net-close.js';
 import { createFileDeliveryStore, startWebhookServer, waitForListening } from '../lib/triggers/webhook.js';
 import { getRuntimeStateDir } from '../lib/state.js';
 const DEFAULT_HOST = '127.0.0.1';
@@ -10,8 +10,8 @@ function positiveInt(value, fallback) {
     const parsed = Number.parseInt(value ?? '', 10);
     return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
 }
-function readWebhookSecrets(bundleName) {
-    const { env } = readAndResolveBundleEnv(bundleName, {
+async function readWebhookSecrets(bundleName) {
+    const { env } = await readAndResolveBundleEnv(bundleName, {
         caller: 'webhooks serve',
         // `webhooks serve` is a long-running background server started to receive
         // signed webhooks, not a human at a Touch ID sheet — so the read is always
@@ -54,7 +54,7 @@ export function registerWebhooksCommand(program) {
         .action(async (opts) => {
         let secrets;
         try {
-            secrets = readWebhookSecrets(opts.secretsBundle);
+            secrets = await readWebhookSecrets(opts.secretsBundle);
         }
         catch (err) {
             console.error(chalk.red(err.message));

package/dist/commands/workflows.js

@@ -8,7 +8,8 @@ import { select, checkbox } from '@inquirer/prompts';
 import { resolveAgentName, agentLabel } from '../lib/agents.js';
 import { capableAgents } from '../lib/capabilities.js';
 import { cloneRepo } from '../lib/git.js';
-import { discoverWorkflowsFromRepo, installWorkflowCentrally, removeWorkflow, listInstalledWorkflows, listWorkflowsForAgent, removeWorkflowFromVersion, iterWorkflowsCapableVersions, } from '../lib/workflows.js';
+import { discoverWorkflowsFromRepo, installWorkflowCentrally, removeWorkflow, listInstalledWorkflows, iterWorkflowsCapableVersions, } from '../lib/workflows.js';
+import { listWorkflowsForAgent, removeWorkflowFromVersion } from '../lib/workflows-registry.js';
 import { getVersionHomePath, getGlobalDefault, syncResourcesToVersion, promptAgentVersionSelection, } from '../lib/installations/versions.js';
 import { recordVersionResources, getUserWorkflowsDir } from '../lib/state.js';
 import { isPromptCancelled, isInteractiveTerminal, requireInteractiveSelection, printWithPager, promptRemovalTargets, parseCommaSeparatedList, resolveAgentTargetsAutoInstalling, resolveListFilterOrExit, } from './utils.js';

package/dist/index.d.ts

@@ -2,25 +2,25 @@
 /**
  * CLI entry point for agents-cli.
  *
- * Slim shell (RUSH-2335): only the leaf `lib/secrets/sync-commands.js` is a
- * static import, so the argv fast paths below can answer without evaluating the
- * commander + self-update + command-registry graph that used to be hoisted
- * above every intercept (~140ms of cold bootstrap per synchronous secrets-
- * broker read). The full CLI loads via `await import('./bootstrap.js')` once
- * none of the fast paths match.
+ * Slim shell (RUSH-2335): no static imports at all, so the argv fast paths
+ * below can answer without evaluating the commander + self-update +
+ * command-registry graph. The full CLI loads via `await import('./bootstrap.js')`
+ * once none of the fast paths match.
  *
  * Fast paths (must stay above the bootstrap import — ESM does not hoist dynamic
  * `import()`, but any static import here would still evaluate first):
- *   - `__vault-age-helper`
- *   - `__secrets-get` / `__secrets-ping` / `__secrets-lock` (SYNC_* tokens)
+ *   - `__launch-lease`
  *   - `__shim`
+ *   - `__gh`
  *   - `__claude-statusline`
  *   - `__usage-ingest` / `__usage-export`
+ *   - `__harness-update-run`
  *   - `__daemon-run`
  *
- * The tokens are imported from the leaf module sync-commands.ts — the SAME
- * bindings the clients spawn with, so this dispatch and those spawns cannot
- * drift apart. It is a leaf precisely so binding them here is free: importing
- * agent.js would pull the whole secrets graph into every invocation.
+ * The synchronous secrets-broker fast paths (`__secrets-get` / `__secrets-ping`
+ * / `__secrets-lock`) and `__vault-age-helper` moved out of this CLI entirely
+ * with the standalone `secrets` engine (PHNX-3989) — agents-cli now talks to
+ * it only through the bounded process client (`lib/secrets-client.ts`), never
+ * through a hidden subcommand of its own.
  */
 export {};