@phnx-labs/agents-cli 1.22.97 → 1.22.99

package/CHANGELOG.md

@@ -1,9 +1,23 @@
 # Changelog
 
+## 1.22.99
+
+- **`agents setup secrets` installs the published secrets CLI instead of only printing a hint (PHNX-3989).** A missing `secrets` binary tries `agents clis install secrets` then a pinned `npm i -g @phnx-labs/secrets-cli@0.1.2`, then hands off to `secrets migrate`. Docs point at the standalone engine; the broker is `secrets _agent-run` on macOS, not the agents daemon. Source: `cli/src/commands/setup-secrets.ts`, `cli/docs/secrets.md`.
+
+- `agents accounts list` / `agents view` no longer report a signed-in account slot as `MISSING`. A slot's STATE now comes from a live read of the slot's own credential and from the daemon's auth probe, which now covers account slots (`slot:<accountId>` rows) as well as version homes. Before, a slot's verdict was written only by `accounts add/login`, the daemon never re-derived it, and `signedIn` was read from an unrelated version home — so a slot re-materialized as `unconfigured` while the device doc was unreadable (a duplicate YAML key from a shared-repo autostash merge) stayed `MISSING` forever even though `agents run` used its login fine.
+
+## 1.22.98
+
+- `agents run codex#<account>` on macOS now runs as that account. The SUN_LEN short-home relocation keyed `CODEX_HOME` by version alone, so an account slot (long enough to overflow too) was silently redirected to the default version's `~/.agents/.codex-homes/<version>/.codex` and its login — `agents run codex#getrush` opened the gmail session while the banner still said `getrush`. The short home is now keyed by the origin (`a-<account id>` for a slot). A version/account reinstall that recreates a fresh `.codex` adopts its existing short home (which holds the login) instead of failing, and a slot mis-linked onto a foreign home by the old layout is repointed to its own home rather than run as the wrong account.
+
+- **A Firefox task no longer parks the browser-task reaper, and `record` on Firefox says "recording" (PHNX-4043).** The daemon's idle reaper asks every live task for its recording status before closing it; on a Firefox (or native Arc) task that query threw a capability error, so one Firefox task failed every reap tick and the `browser-task-reap` service parked after three failures, leaving abandoned tabs open for every profile on that box. Recording status on a backend that cannot record is now a truthful "not recording". `agents browser record start`/`stop` and `start --record` on a Firefox profile still fail loud, now naming `recording` instead of `screenshot` (screenshots do work on Firefox). Source: `cli/src/lib/browser/service.ts` `recordStart`/`recordStop`/`recordStatus`.
+
 ## 1.22.97
 
 - `agents browser --help` and the `agents setup browser` install hint no longer claim Firefox is unsupported: they now state Chromium-family over CDP, Arc natively, and Firefox over WebDriver BiDi (Safari stays unsupported). `tabs --all` gains a help example and rows in the Arc and Firefox capability tables.
 
+## 1.22.96
+
 - **`agents browser tabs --all` shows every tab open in the profile browser, yours included (PHNX-4043).** Until now `tabs` listed only the task's own tabs, so an agent sharing an Arc Space, a Comet store, or a Firefox profile with you could not see what else was open. `--all` lists every top-level tab: OWNER names the agents-cli task that owns it, or `you` for a tab no task owns; `*` still marks the task's current tab. Read-only on every backend (Chromium `Target.getTargets`, the Arc Space's tabs, Firefox `browsingContext.getTree`). Source: `cli/src/lib/browser/service.ts` `profileTabs`, `cli/src/commands/browser.ts`.
 
 ## 1.22.95

package/README.md

@@ -1228,19 +1228,28 @@ replacement (`add` / `login` / `default` / `run <harness>#<name>`).
 
 ## Secrets
 
-> **Platform:** `agents secrets` requires macOS Keychain or Linux libsecret.
-> On Windows (non-WSL), use environment variables or a `.env` file instead.
+Secrets are the standalone **`secrets` CLI** (`@phnx-labs/secrets-cli`). agi-cli does not ship the engine. `agents secrets` is a passthrough to the same binary.
 
 ```bash
-# API keys in Keychain, not in .env files.
-agents secrets create prod-stripe
-agents secrets add prod-stripe STRIPE_SECRET_KEY     # Prompts, stores in Keychain
-agents secrets add prod-stripe TEST_CARD --value "4242..."
+# Install (pick one — no extra env vars)
+agents clis install secrets
+# or
+npm i -g @phnx-labs/secrets-cli@0.1.2
+# or, after agents is installed:
+agents setup secrets
+```
 
-# Injected at run time. Bundle definitions live in the Keychain, not on disk.
+```bash
+# API keys in Keychain, not in .env files.
+secrets create prod-stripe
+secrets add prod-stripe STRIPE_SECRET_KEY     # Prompts, stores in Keychain
 agents run claude "charge a test card" --secrets prod-stripe
 ```
 
+> **Platform:** macOS Keychain, Linux libsecret / file store. On Windows (non-WSL), use environment variables or a `.env` file instead.
+
+The macOS broker is **not** the agents daemon. It is `secrets _agent-run` (started by `secrets start` or on first unlock), socket under `$SECRETS_HOME/.cache/helpers/secrets-agent/` (`~/.agents` when you go through `agents secrets`). Linux has no broker. `agents daemon` never hosts it.
+
 <p align="center">
   <img src="assets/secrets.svg" alt="How agi-cli secrets work: bundle definitions live in the macOS Keychain alongside their values, agi-cli resolves at runtime and injects the env into the child process" width="100%" />
 </p>

package/dist/commands/setup-secrets.d.ts

@@ -1,22 +1,29 @@
 /**
- * `agents setup secrets` — install guidance for the standalone `secrets` CLI,
- * then a pass-through to its own `secrets migrate` onboarding (PHNX-3989).
+ * `agents setup secrets` — install the standalone `secrets` CLI if missing,
+ * then hand off to its own `secrets migrate` onboarding (PHNX-3989).
  *
- * The wizard that used to pick a default backend/policy and delegate imports
- * lived entirely against the in-repo secrets engine. That engine is extracted
- * to `@phnx-labs/secrets-cli`, which owns its own interactive onboarding
- * (`secrets migrate`) — agents-cli never rebundles it (DIST-1), so there is no
- * in-process fallback when it isn't installed: this command names the install
- * command and stops.
+ * The engine lives in `@phnx-labs/secrets-cli`. agents-cli never rebundles it
+ * (DIST-1). A missing binary is a routine install, not a fatal gap: try
+ * `agents clis install secrets` (system `clis/secrets.yaml`) then a pinned
+ * `npm i -g`. Users do not set extra env vars.
  */
 import type { Command } from 'commander';
+export declare const SECRETS_CLI_PACKAGE = "@phnx-labs/secrets-cli@0.1.2";
+export declare const INSTALL_HINT = "agents clis install secrets   # or: npm i -g @phnx-labs/secrets-cli@0.1.2";
 export declare function setupSecretsPrefsPath(): string;
 /** True when the standalone `secrets` executable resolves ($SECRETS_BIN or PATH). */
 export declare function isSecretsCliInstalled(): boolean;
 /**
- * Print install guidance when the standalone is missing, else hand off to its
- * own interactive `secrets migrate`. Returns whether setup is now complete
- * (installed, and — when it ran — `migrate` exited 0).
+ * Install the published secrets CLI. Prefers the host-CLI manifest
+ * (`clis/secrets.yaml` in the system repo) so doctor/clis stay one path.
+ * Falls back to a pinned npm global install. Returns whether `secrets` is
+ * on PATH afterwards. Never writes an `agents secrets` shim.
+ */
+export declare function installSecretsCli(): boolean;
+/**
+ * Install the standalone if missing, then hand off to `secrets migrate`.
+ * Returns whether setup is now complete (installed, and migrate exited 0
+ * when it ran).
  */
 export declare function runSecretsSetupWizard(): Promise<boolean>;
 /** Register `agents setup secrets` under the parent `setup` command. */

package/dist/commands/setup-secrets.js

@@ -1,21 +1,21 @@
 /**
- * `agents setup secrets` — install guidance for the standalone `secrets` CLI,
- * then a pass-through to its own `secrets migrate` onboarding (PHNX-3989).
+ * `agents setup secrets` — install the standalone `secrets` CLI if missing,
+ * then hand off to its own `secrets migrate` onboarding (PHNX-3989).
  *
- * The wizard that used to pick a default backend/policy and delegate imports
- * lived entirely against the in-repo secrets engine. That engine is extracted
- * to `@phnx-labs/secrets-cli`, which owns its own interactive onboarding
- * (`secrets migrate`) — agents-cli never rebundles it (DIST-1), so there is no
- * in-process fallback when it isn't installed: this command names the install
- * command and stops.
+ * The engine lives in `@phnx-labs/secrets-cli`. agents-cli never rebundles it
+ * (DIST-1). A missing binary is a routine install, not a fatal gap: try
+ * `agents clis install secrets` (system `clis/secrets.yaml`) then a pinned
+ * `npm i -g`. Users do not set extra env vars.
  */
 import chalk from 'chalk';
 import * as fs from 'fs';
 import * as path from 'path';
 import { spawnSync } from 'node:child_process';
 import { getHistoryDir } from '../lib/state.js';
-import { resolveSecretsBin, invocation, SecretsClientError } from '../lib/secrets-client.js';
-const INSTALL_HINT = 'npm i -g @phnx-labs/secrets-cli';
+import { resolveSecretsBin, invocation, SecretsClientError, _resetSecretsClientForTest } from '../lib/secrets-client.js';
+import { installCli, resolveCliManifest } from '../lib/cli-resources.js';
+export const SECRETS_CLI_PACKAGE = '@phnx-labs/secrets-cli@0.1.2';
+export const INSTALL_HINT = `agents clis install secrets   # or: npm i -g ${SECRETS_CLI_PACKAGE}`;
 export function setupSecretsPrefsPath() {
     return path.join(getHistoryDir(), 'setup', 'secrets.json');
 }
@@ -37,16 +37,48 @@ function recordSetupComplete() {
     fs.writeFileSync(file, JSON.stringify({ updatedAt: new Date().toISOString() }, null, 2) + '\n', { mode: 0o600 });
 }
 /**
- * Print install guidance when the standalone is missing, else hand off to its
- * own interactive `secrets migrate`. Returns whether setup is now complete
- * (installed, and — when it ran — `migrate` exited 0).
+ * Install the published secrets CLI. Prefers the host-CLI manifest
+ * (`clis/secrets.yaml` in the system repo) so doctor/clis stay one path.
+ * Falls back to a pinned npm global install. Returns whether `secrets` is
+ * on PATH afterwards. Never writes an `agents secrets` shim.
+ */
+export function installSecretsCli() {
+    if (isSecretsCliInstalled())
+        return true;
+    const manifest = resolveCliManifest('secrets');
+    if (manifest) {
+        console.log(chalk.gray(`Installing ${manifest.name} via agents clis…`));
+        const result = installCli(manifest);
+        _resetSecretsClientForTest();
+        if (result.installed)
+            return true;
+        if (result.error)
+            console.error(chalk.gray(result.error));
+    }
+    console.log(chalk.gray(`Installing ${SECRETS_CLI_PACKAGE}…`));
+    const r = spawnSync('npm', ['install', '-g', SECRETS_CLI_PACKAGE], { stdio: 'inherit' });
+    _resetSecretsClientForTest();
+    if (r.error) {
+        console.error(chalk.red(`npm install failed: ${r.error.message}`));
+        return false;
+    }
+    if ((r.status ?? 1) !== 0)
+        return false;
+    return isSecretsCliInstalled();
+}
+/**
+ * Install the standalone if missing, then hand off to `secrets migrate`.
+ * Returns whether setup is now complete (installed, and migrate exited 0
+ * when it ran).
  */
 export async function runSecretsSetupWizard() {
     if (!isSecretsCliInstalled()) {
-        console.log(chalk.yellow('The standalone `secrets` CLI is not installed.'));
-        console.log(chalk.gray('Install it, then re-run `agents setup secrets`:'));
-        console.log(chalk.cyan(`  ${INSTALL_HINT}`));
-        return false;
+        if (!installSecretsCli()) {
+            console.log(chalk.yellow('The standalone `secrets` CLI is not installed.'));
+            console.log(chalk.gray('Install it, then re-run `agents setup secrets`:'));
+            console.log(chalk.cyan(`  ${INSTALL_HINT}`));
+            return false;
+        }
     }
     const bin = resolveSecretsBin();
     const { command, prefix } = invocation(bin);
@@ -60,7 +92,7 @@ export async function runSecretsSetupWizard() {
 export function registerSetupSecretsCommand(setupCmd) {
     setupCmd
         .command('secrets')
-        .description('Install guidance for the standalone `secrets` CLI, then run its own `secrets migrate` onboarding.')
+        .description('Install the standalone `secrets` CLI if missing, then run its `secrets migrate` onboarding.')
         .action(async () => {
         if (!(await runSecretsSetupWizard()))
             process.exitCode = 1;

package/dist/lib/account-catalog.js

@@ -8,7 +8,7 @@ import { readSlots } from './accounts/slots.js';
 import { harnessWorkerIsPerDevice } from './harness-auth-capabilities.js';
 import { hasKeychainTokenSync, isSecretsTransportError } from './secrets-client.js';
 import { isLaunchableSignedIn as isCredentialLaunchable } from './accounting/rotate.js';
-import { authCacheKey, readAuthHealthCache } from './auth-health.js';
+import { authCacheKey, readAuthHealthCache, slotAuthVersionKey } from './auth-health.js';
 import { readFleetSharedDeviceStates } from './fleet-shared-state.js';
 import { machineId } from './machine-id.js';
 import { isHeadedDeviceRole, selfConfiguredDeviceRole } from './device-config.js';
@@ -245,9 +245,21 @@ export async function loadAccountCatalog() {
         const localHome = row.installations.find((home) => home.label === row.home)
             ?? row.installations.find((home) => home.signedIn)
             ?? row.installations[0];
-        const cached = localHome ? auth[authCacheKey(host, row.agent, localHome.label)] : undefined;
         const slot = row.id ? localSlots[row.id] : undefined;
-        const observation = resolveLocalAccountObservation(slot, cached, localHome?.signedIn === true);
+        // A slot account's local truth is the SLOT — its own credential file and its
+        // own daemon probe row (keyed `slot:<id>`) — never the version home its label
+        // happens to match. Reading the version home here is what rendered a
+        // signed-in slot MISSING: the slot record held ensureSlot's `unconfigured`
+        // default, the daemon never probed the slot, and `signedIn` came from an
+        // unrelated home.
+        const slotSignedIn = slot
+            ? await getAccountInfo(row.agent, slot.slotDir)
+                .then((info) => isLaunchableSignedIn(row.agent, slot.slotDir, info))
+                .catch(() => false)
+            : false;
+        const cached = (slot && row.id ? auth[authCacheKey(host, row.agent, slotAuthVersionKey(row.id))] : undefined)
+            ?? (localHome ? auth[authCacheKey(host, row.agent, localHome.label)] : undefined);
+        const observation = resolveLocalAccountObservation(slot, cached, slot ? slotSignedIn : localHome?.signedIn === true);
         const local = {
             device: host,
             authMode: observation.authMode
@@ -529,8 +541,12 @@ export function listDevicesWithoutAccountVerdicts(userAgentsDir) {
     return out.sort((a, b) => a.localeCompare(b));
 }
 function normalizeAuthVerdict(verdict, signedIn) {
+    // `unconfigured` is the slot record's DEFAULT (ensureSlot), not a probe
+    // result — the daemon never publishes it (probeLocalFleetAuth drops those
+    // rows). So it says nothing about the credential on disk; the live signedIn
+    // read of the slot decides, exactly as it does when no verdict exists at all.
     if (verdict === 'unconfigured')
-        return 'missing';
+        return signedIn ? 'unverified' : 'missing';
     if (verdict === 'error')
         return signedIn ? 'unverified' : 'missing';
     return verdict ?? (signedIn ? 'unverified' : 'missing');

package/dist/lib/accounts/slots.d.ts

@@ -3,6 +3,25 @@ export type { DeviceAccountSlot };
 export declare function slotDir(harness: AgentId, accountId: string): string;
 export declare function readSlots(meta: Pick<Meta, 'deviceAccounts'>): Record<string, DeviceAccountSlot>;
 export declare function recordSlot(accountId: string, slot: DeviceAccountSlot): void;
+export interface SlotProjection {
+    accountId: string;
+    /** Account name as registered (`agents accounts list`). */
+    name: string;
+    slotDir: string;
+    /** The version home the slot was projected from. */
+    from: string;
+    /** `<kind>/<name>` artifacts removed because the source no longer has them. */
+    pruned: string[];
+}
+/**
+ * Re-project settings and resources into every account slot this device holds
+ * for `harness`, from the harness's default version home. `ensureSlot` does
+ * this once at `agents accounts add`; every reconcile calls this so a slot
+ * never lags the version home it was cloned from (PHNX-3940). Credentials are
+ * never touched: `carryForwardSettings` and the resource writers exclude them.
+ * A slot whose directory is gone is skipped, not recreated.
+ */
+export declare function projectAccountSlots(harness: AgentId): SlotProjection[];
 /**
  * Create the HOME-shaped slot dir and project settings/resources from the
  * managed install. Does not copy credentials (carryForwardSettings excludes

package/dist/lib/accounts/slots.js

@@ -17,7 +17,7 @@ import { agentConfigDirName } from '../agents.js';
 import { harnessAuth, harnessWorkerIsPerDevice } from '../harness-auth-capabilities.js';
 import { getGlobalDefault, getVersionHomePath, listInstalledVersions } from '../installations/store.js';
 import { carryForwardSettings } from '../settings-manifest.js';
-import { getHistoryDir, updateMeta } from '../state.js';
+import { getHistoryDir, readMeta, updateMeta } from '../state.js';
 import { ALL_RESOURCE_KINDS, getDetector, getWriter, kindToCapability } from '../staleness/registry.js';
 import { supports } from '../capabilities.js';
 import { isAgentId } from '../types.js';
@@ -72,6 +72,66 @@ function projectResources(harness, version, destHome, fromHome) {
         writer.write({ version, versionHome: destHome, selection: names, cwd });
     }
 }
+/**
+ * Remove slot artifacts whose source name is gone. Only the name-keyed kinds
+ * that implement `remove` (commands, skills, hooks) are pruned; wholesale kinds
+ * (rules, permissions) are rewritten by the projection itself.
+ */
+function pruneSlotResources(harness, version, slotHome, fromHome) {
+    const cwd = process.cwd();
+    const pruned = [];
+    for (const kind of ALL_RESOURCE_KINDS) {
+        if (!supports(harness, kindToCapability(kind), version).ok)
+            continue;
+        const writer = getWriter(kind, harness);
+        const detector = getDetector(kind, harness);
+        if (!writer?.remove || !detector)
+            continue;
+        const source = new Set(detector.list({ version, versionHome: fromHome, cwd }));
+        for (const name of detector.list({ version, versionHome: slotHome, cwd })) {
+            if (source.has(name))
+                continue;
+            if (writer.remove({ version, versionHome: slotHome, name, cwd }).removed)
+                pruned.push(`${kind}/${name}`);
+        }
+    }
+    return pruned;
+}
+/**
+ * Re-project settings and resources into every account slot this device holds
+ * for `harness`, from the harness's default version home. `ensureSlot` does
+ * this once at `agents accounts add`; every reconcile calls this so a slot
+ * never lags the version home it was cloned from (PHNX-3940). Credentials are
+ * never touched: `carryForwardSettings` and the resource writers exclude them.
+ * A slot whose directory is gone is skipped, not recreated.
+ */
+export function projectAccountSlots(harness) {
+    const version = sourceVersion(harness);
+    if (!version)
+        return [];
+    const fromHome = getVersionHomePath(harness, version);
+    if (!fs.existsSync(fromHome))
+        return [];
+    const meta = readMeta();
+    const slots = readSlots(meta);
+    const native = { ...meta.accounts?.native, ...meta.deviceAccounts?.native };
+    const projected = [];
+    for (const account of Object.values(native)) {
+        if (account.agent !== harness)
+            continue;
+        // The slot record is device-local and written after identity capture; a
+        // slot dir minted by an earlier build, or an add that stopped short of
+        // recording, is still the HOME an account run uses — project it too.
+        const dir = slots[account.id]?.slotDir ?? slotDir(harness, account.id);
+        if (!fs.existsSync(path.join(dir, agentConfigDirName(harness))))
+            continue;
+        carryForwardSettings(harness, fromHome, dir);
+        const pruned = pruneSlotResources(harness, version, dir, fromHome);
+        projectResources(harness, version, dir, fromHome);
+        projected.push({ accountId: account.id, name: account.name, slotDir: dir, from: version, pruned });
+    }
+    return projected;
+}
 /**
  * Create the HOME-shaped slot dir and project settings/resources from the
  * managed install. Does not copy credentials (carryForwardSettings excludes

package/dist/lib/auth-health.d.ts

@@ -1,5 +1,5 @@
 import { type AccountInfo } from './agents.js';
-import type { AgentId } from './types.js';
+import type { AgentId, Meta } from './types.js';
 import { type ProviderProbe } from './accounting/usage.js';
 /**
  * - `live`        — completed an authenticated request (200).
@@ -134,6 +134,28 @@ export declare function formatCheckedAge(checkedAt: number, now?: number): strin
 export declare function authAccountLabel(info: Pick<AccountInfo, 'email' | 'accountId' | 'userId'> | null | undefined): string | undefined;
 /** Cache key: one entry per install — (host, agent, version). Unique per token. */
 export declare function authCacheKey(host: string, agent: AgentId | string, version: string): string;
+/**
+ * The `version` slot an account SLOT occupies in the auth cache and the probe
+ * rows: `slot:<accountId>`. A slot is a HOME-shaped dir, not an installed
+ * version, so it needs its own key or its verdict would collide with (or be
+ * silently dropped in favor of) whichever version home the account's label
+ * happened to match.
+ */
+export declare function slotAuthVersionKey(accountId: string): string;
+/** One account slot on this device that the auth probe must cover. */
+export interface SlotAuthInstall extends FleetAuthInstall {
+    home: string;
+    accountId: string;
+}
+/**
+ * Every registered account's slot on this device (PHNX-3940 T1), as probe
+ * targets. Before this the probe walked `listInstalledVersions` only, so a
+ * slot's verdict was never re-derived after `accounts add/login` wrote it —
+ * a slot re-materialized as `unconfigured` while the device doc was unreadable
+ * stayed MISSING forever even though its login was live. A slot whose dir is
+ * gone is skipped: there is nothing to probe and the row would only say so.
+ */
+export declare function enumerateSlotInstalls(meta: Pick<Meta, 'accounts' | 'deviceAccounts'>, agentIds: readonly AgentId[]): SlotAuthInstall[];
 /** Read the whole cache (best-effort; a corrupt/missing file yields an empty map). */
 export declare function readAuthHealthCache(): Record<string, AuthHealth>;
 /** Read one entry, or null. */

package/dist/lib/auth-health.js

@@ -19,6 +19,8 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import { ALL_AGENT_IDS, getAccountInfo } from './agents.js';
+import { listNativeAccounts } from './account-registry.js';
+import { readSlots } from './accounts/slots.js';
 import { getCacheDir } from './state.js';
 import { probeClaudeStatus, probeDroidStatus, probeKimiStatus, USAGE_HEADLESS_SCOPE_MARKER, readClaudeUsageCache, } from './accounting/usage.js';
 import { getVersionHomePath, listInstalledVersions } from './installations/versions.js';
@@ -218,6 +220,37 @@ export function authAccountLabel(info) {
 export function authCacheKey(host, agent, version) {
     return `${host}:${agent}:${version}`;
 }
+/**
+ * The `version` slot an account SLOT occupies in the auth cache and the probe
+ * rows: `slot:<accountId>`. A slot is a HOME-shaped dir, not an installed
+ * version, so it needs its own key or its verdict would collide with (or be
+ * silently dropped in favor of) whichever version home the account's label
+ * happened to match.
+ */
+export function slotAuthVersionKey(accountId) {
+    return `slot:${accountId}`;
+}
+/**
+ * Every registered account's slot on this device (PHNX-3940 T1), as probe
+ * targets. Before this the probe walked `listInstalledVersions` only, so a
+ * slot's verdict was never re-derived after `accounts add/login` wrote it —
+ * a slot re-materialized as `unconfigured` while the device doc was unreadable
+ * stayed MISSING forever even though its login was live. A slot whose dir is
+ * gone is skipped: there is nothing to probe and the row would only say so.
+ */
+export function enumerateSlotInstalls(meta, agentIds) {
+    const byId = new Map(listNativeAccounts(meta).map((account) => [account.id, account]));
+    const out = [];
+    for (const [accountId, slot] of Object.entries(readSlots(meta))) {
+        const account = byId.get(accountId);
+        if (!account || !agentIds.includes(account.agent))
+            continue;
+        if (!fs.existsSync(slot.slotDir))
+            continue;
+        out.push({ agent: account.agent, version: slotAuthVersionKey(accountId), home: slot.slotDir, account: undefined, accountId });
+    }
+    return out;
+}
 function cacheFilePath() {
     return path.join(getCacheDir(), '.auth-health.json');
 }
@@ -410,26 +443,31 @@ export function groupFleetAuthInstalls(installs, isMergeable = () => true) {
  */
 export async function probeLocalFleetAuth(opts) {
     const agentIds = opts?.agents ?? ALL_AGENT_IDS;
-    // Enumerate every install, then resolve its account label. getAccountInfo is a
-    // local credential-file read (no network), so this fan-out is cheap and cannot
-    // contribute to the rate limit the probe grouping below exists to avoid.
+    // Enumerate every install AND every account slot on this device, then resolve
+    // each one's account label. getAccountInfo is a local credential-file read
+    // (no network), so this fan-out is cheap and cannot contribute to the rate
+    // limit the probe grouping below exists to avoid.
+    const [{ readMeta }, { findNativeAccountByIdentity }] = await Promise.all([
+        import('./state.js'),
+        import('./account-registry.js'),
+    ]);
+    const meta = readMeta();
     const installs = [];
     for (const agent of agentIds) {
         for (const version of listInstalledVersions(agent)) {
             installs.push({ agent, version, home: getVersionHomePath(agent, version), info: null, account: undefined });
         }
     }
+    for (const slot of enumerateSlotInstalls(meta, agentIds)) {
+        installs.push({ ...slot, info: null });
+    }
     await Promise.all(installs.map(async (inst) => {
         inst.info = await getAccountInfo(inst.agent, inst.home).catch(() => null);
         inst.account = authAccountLabel(inst.info);
     }));
-    const [{ readMeta }, { findNativeAccountByIdentity }] = await Promise.all([
-        import('./state.js'),
-        import('./account-registry.js'),
-    ]);
-    const meta = readMeta();
     for (const inst of installs) {
-        inst.accountId = findNativeAccountByIdentity(meta, inst.agent, inst.info)?.id;
+        // A slot already knows its account; a version home is joined by identity.
+        inst.accountId ??= findNativeAccountByIdentity(meta, inst.agent, inst.info)?.id;
     }
     // Probe once per (agent, account) — but only for the network-probing agents
     // that can actually 429; best-effort agents stay per-install (see

package/dist/lib/browser/service.js

@@ -1592,7 +1592,7 @@ export class BrowserService {
             throw new Error(`Task "${taskId}" is already recording. Call record stop first.`);
         }
         const { conn, task, key: runtimeKey } = await this.findTask(taskId);
-        requireCdp(conn, 'screenshot');
+        requireCdp(conn, 'recording');
         const shortId = tabHint ? await this.resolveTabHint(conn, task, tabHint) : this.resolveCurrentTab(task);
         const cdpTargetId = this.getCdpTargetId(task, shortId);
         const target = await this.getTarget(conn, cdpTargetId);
@@ -1796,7 +1796,7 @@ export class BrowserService {
     async recordStop(taskId, reason = 'manual') {
         const activeTask = await this.findTask(taskId).catch(() => undefined);
         if (activeTask)
-            requireCdp(activeTask.conn, 'screenshot');
+            requireCdp(activeTask.conn, 'recording');
         const rec = this.recordings.get(taskId);
         if (!rec) {
             throw new Error(`Task "${taskId}" is not currently recording`);
@@ -1883,9 +1883,12 @@ export class BrowserService {
         // not route an already-live task through findTask(), which stamps it as
         // active and defeats idle detection. A cold daemon may still rehydrate for
         // an explicit user query.
+        // A status query, not an action: a backend that cannot record (Arc native,
+        // Firefox BiDi) is truthfully "not recording". Throwing here took the
+        // idle reaper down with it — one Firefox task parked reaping for every task.
         const live = this.findTaskByHandle(taskId) ?? await this.findTask(taskId).catch(() => undefined);
-        if (live)
-            requireCdp(live.conn, 'screenshot');
+        if (live && (live.conn.backend === 'arc-native' || live.conn.backend === 'bidi'))
+            return { recording: false };
         const rec = this.recordings.get(taskId);
         if (!rec)
             return { recording: false };

package/dist/lib/codex-home.d.ts

@@ -8,24 +8,56 @@ export declare const CODEX_CONTROL_SOCKET_SUFFIX = "/app-server-control/app-serv
  */
 export declare function codexHomeOverflowsSunLen(home: string): boolean;
 /**
- * The short, per-version codex home used when the versioned home overflows.
- * `~/.agents/.codex-homes/<version>/.codex` keeps the socket path well under
- * SUN_LEN while staying stable across reboots (unlike $TMPDIR) and per-version
- * isolated.
+ * The short codex home used when an origin home overflows.
+ * `~/.agents/.codex-homes/<key>/.codex` keeps the socket path well under
+ * SUN_LEN while staying stable across reboots (unlike $TMPDIR) and isolated
+ * per origin.
  */
-export declare function shortCodexHome(agentsUserDir: string, version: string): string;
+export declare function shortCodexHome(agentsUserDir: string, key: string): string;
 /**
- * Resolve a macOS SUN_LEN-safe CODEX_HOME for the given versioned home,
- * migrating the home to a short real path (once, idempotently) when needed.
+ * The short-home key for a codex config home: the version for a version home,
+ * `a-<accountId prefix>` for an account slot under `<historyDir>/accounts/codex/`.
+ * Twelve hex characters keep the socket path under SUN_LEN for any home dir
+ * (`~/.agents/.codex-homes/a-XXXXXXXXXXXX/.codex` + suffix = 99 bytes on a
+ * `/Users/<user>` prefix); the origin-link check in {@link resolveCodexHome}
+ * is what rules out two accounts sharing a prefix.
+ */
+export declare function codexShortKey(home: string, version: string, historyDir: string): string;
+/**
+ * Resolve a macOS SUN_LEN-safe CODEX_HOME for the given origin home, migrating
+ * the home to a short real path (once, idempotently) when needed. `key` is the
+ * short-home key from {@link codexShortKey} — it uniquely identifies the origin
+ * (the version for a version home, `a-<accountId>` for a slot), so
+ * `.codex-homes/<key>` can only ever be THIS origin's own short home. Two
+ * different origins never map to one key, which is what makes every branch
+ * below safe without guessing whose login a short home holds.
  *
- * On non-darwin platforms, or when the versioned home already fits, the
- * versioned home is returned unchanged. If migration fails for any reason the
- * versioned home is returned (no worse than the pre-fix behavior).
+ * On non-darwin platforms, or when the origin already fits, the origin is
+ * returned unchanged. Otherwise the short home is authoritative for `key`, and
+ * the origin is made a symlink onto it:
+ *  - already linked onto it → return it (healthy, the common path).
+ *  - linked onto a DIFFERENT target (a pre-fix layout where a slot's `.codex`
+ *    was captured into a foreign version short home) → REPOINT to this key's own
+ *    short home and warn; the foreign login is never run. The account may need a
+ *    re-login, which is correct — its login was never isolated.
+ *  - a real directory with the short home ALREADY present → a version/account
+ *    reinstall recreated a fresh `.codex`; adopt the short home (which holds the
+ *    real login), backing the fresh dir aside so freshly-synced resources are
+ *    not lost. This is the case the earlier refuse-and-throw broke
+ *    (`agents remove codex@x && agents add codex@x` then `agents run`).
+ *  - a real directory with no short home yet → first migration: rename it into
+ *    the short home and leave a symlink.
+ *  - absent → create/adopt the short home and link the origin to it.
+ * If any filesystem step fails the origin is returned (no worse than the pre-fix
+ * behavior).
  */
-export declare function resolveCodexHome(versionedHome: string, agentsUserDir: string, version: string, platform?: NodeJS.Platform): string;
+export declare function resolveCodexHome(originHome: string, agentsUserDir: string, key: string, platform?: NodeJS.Platform): string;
 /**
  * Emit the bash block that a generated codex shim uses to export a
- * SUN_LEN-safe CODEX_HOME. Mirrors {@link resolveCodexHome}.
+ * SUN_LEN-safe CODEX_HOME. Mirrors {@link resolveCodexHome} for the one origin
+ * a shim ever sees, the version home: an account-slot launch reaches the shim
+ * with CODEX_HOME already pinned by `buildExecEnv`, and the block below keeps a
+ * caller-provided CODEX_HOME, so the slot key never has to be derived in bash.
  *
  * @param homeExpr      shell expression for the versioned codex home
  *                      (e.g. `$VERSION_DIR/home/.codex`)

package/dist/lib/codex-home.js

@@ -25,6 +25,14 @@
  * the TS resolver for `agents run`/`agents exec`; `shims.ts` emits the bash
  * equivalent (`codexHomeShimBash`) into the generated codex shims. Keep the two
  * in lockstep.
+ *
+ * The short home is keyed by the ORIGIN it relocates, never by the version
+ * alone. An account slot (`~/.agents/.history/accounts/codex/<id>/.codex`) is
+ * long enough to overflow too, and keying it by version handed every
+ * `agents run codex#<account>` on macOS the default version's short home —
+ * whichever login that happened to hold. `codexShortKey` derives the key; a
+ * short home that is not the resolved link target of its origin is refused
+ * rather than reused.
  */
 import * as fs from 'fs';
 import * as path from 'path';
@@ -40,59 +48,137 @@ export function codexHomeOverflowsSunLen(home) {
     return home.length + CODEX_CONTROL_SOCKET_SUFFIX.length > SUN_LEN;
 }
 /**
- * The short, per-version codex home used when the versioned home overflows.
- * `~/.agents/.codex-homes/<version>/.codex` keeps the socket path well under
- * SUN_LEN while staying stable across reboots (unlike $TMPDIR) and per-version
- * isolated.
+ * The short codex home used when an origin home overflows.
+ * `~/.agents/.codex-homes/<key>/.codex` keeps the socket path well under
+ * SUN_LEN while staying stable across reboots (unlike $TMPDIR) and isolated
+ * per origin.
  */
-export function shortCodexHome(agentsUserDir, version) {
-    return path.join(agentsUserDir, '.codex-homes', version, '.codex');
+export function shortCodexHome(agentsUserDir, key) {
+    return path.join(agentsUserDir, '.codex-homes', key, '.codex');
+}
+/**
+ * The short-home key for a codex config home: the version for a version home,
+ * `a-<accountId prefix>` for an account slot under `<historyDir>/accounts/codex/`.
+ * Twelve hex characters keep the socket path under SUN_LEN for any home dir
+ * (`~/.agents/.codex-homes/a-XXXXXXXXXXXX/.codex` + suffix = 99 bytes on a
+ * `/Users/<user>` prefix); the origin-link check in {@link resolveCodexHome}
+ * is what rules out two accounts sharing a prefix.
+ */
+export function codexShortKey(home, version, historyDir) {
+    const slotsRoot = path.resolve(historyDir, 'accounts', 'codex');
+    const resolved = path.resolve(home);
+    if (!resolved.startsWith(slotsRoot + path.sep))
+        return version;
+    const accountId = resolved.slice(slotsRoot.length + 1).split(path.sep)[0] ?? '';
+    if (!accountId)
+        return version;
+    return `a-${accountId.slice(0, 12)}`;
+}
+function realpathOrNull(p) {
+    try {
+        return fs.realpathSync(p);
+    }
+    catch {
+        return null;
+    }
+}
+function isSymlinkOnto(link, target) {
+    try {
+        if (!fs.lstatSync(link).isSymbolicLink())
+            return false;
+        const t = realpathOrNull(target);
+        return t !== null && realpathOrNull(link) === t;
+    }
+    catch {
+        return false;
+    }
 }
 /**
- * Resolve a macOS SUN_LEN-safe CODEX_HOME for the given versioned home,
- * migrating the home to a short real path (once, idempotently) when needed.
+ * Resolve a macOS SUN_LEN-safe CODEX_HOME for the given origin home, migrating
+ * the home to a short real path (once, idempotently) when needed. `key` is the
+ * short-home key from {@link codexShortKey} — it uniquely identifies the origin
+ * (the version for a version home, `a-<accountId>` for a slot), so
+ * `.codex-homes/<key>` can only ever be THIS origin's own short home. Two
+ * different origins never map to one key, which is what makes every branch
+ * below safe without guessing whose login a short home holds.
  *
- * On non-darwin platforms, or when the versioned home already fits, the
- * versioned home is returned unchanged. If migration fails for any reason the
- * versioned home is returned (no worse than the pre-fix behavior).
+ * On non-darwin platforms, or when the origin already fits, the origin is
+ * returned unchanged. Otherwise the short home is authoritative for `key`, and
+ * the origin is made a symlink onto it:
+ *  - already linked onto it → return it (healthy, the common path).
+ *  - linked onto a DIFFERENT target (a pre-fix layout where a slot's `.codex`
+ *    was captured into a foreign version short home) → REPOINT to this key's own
+ *    short home and warn; the foreign login is never run. The account may need a
+ *    re-login, which is correct — its login was never isolated.
+ *  - a real directory with the short home ALREADY present → a version/account
+ *    reinstall recreated a fresh `.codex`; adopt the short home (which holds the
+ *    real login), backing the fresh dir aside so freshly-synced resources are
+ *    not lost. This is the case the earlier refuse-and-throw broke
+ *    (`agents remove codex@x && agents add codex@x` then `agents run`).
+ *  - a real directory with no short home yet → first migration: rename it into
+ *    the short home and leave a symlink.
+ *  - absent → create/adopt the short home and link the origin to it.
+ * If any filesystem step fails the origin is returned (no worse than the pre-fix
+ * behavior).
  */
-export function resolveCodexHome(versionedHome, agentsUserDir, version, platform = process.platform) {
+export function resolveCodexHome(originHome, agentsUserDir, key, platform = process.platform) {
     if (platform !== 'darwin')
-        return versionedHome;
-    if (!codexHomeOverflowsSunLen(versionedHome))
-        return versionedHome;
-    const short = shortCodexHome(agentsUserDir, version);
+        return originHome;
+    if (!codexHomeOverflowsSunLen(originHome))
+        return originHome;
+    const short = shortCodexHome(agentsUserDir, key);
+    if (isSymlinkOnto(originHome, short))
+        return short;
+    const origin = fs.lstatSync(originHome, { throwIfNoEntry: false });
     try {
-        if (!fs.existsSync(short)) {
-            fs.mkdirSync(path.dirname(short), { recursive: true });
-            const st = fs.lstatSync(versionedHome, { throwIfNoEntry: false });
-            if (st && st.isDirectory() && !st.isSymbolicLink()) {
-                // Migrate the existing deep home so config/auth/state stay intact,
-                // then leave a symlink so anything referencing the versioned path
-                // still resolves.
-                fs.renameSync(versionedHome, short);
-                fs.symlinkSync(short, versionedHome);
-            }
-            else if (!st) {
-                // Fresh install: create the short home and link the versioned path to it.
+        fs.mkdirSync(path.dirname(short), { recursive: true });
+        if (origin?.isSymbolicLink()) {
+            // Mis-linked onto a foreign target (pre-fix bug): never run that identity.
+            // Repoint onto this key's own short home, creating it if absent.
+            process.stderr.write(`[codex] ${originHome} was linked to a foreign home; repointing to ${short} `
+                + `(this account may need to log in again).\n`);
+            if (!fs.existsSync(short))
                 fs.mkdirSync(short, { recursive: true });
-                fs.symlinkSync(short, versionedHome);
+            fs.rmSync(originHome); // removes the symlink only, never its target
+            fs.symlinkSync(short, originHome);
+        }
+        else if (origin?.isDirectory()) {
+            if (fs.existsSync(short)) {
+                // Reinstall: the fresh real `.codex` has re-derivable resources but no
+                // login; the short home holds the real login. Adopt the short home and
+                // set the fresh dir aside (non-destructive) rather than lose either.
+                const superseded = `${originHome}.superseded-${Date.now()}`;
+                fs.renameSync(originHome, superseded);
+                fs.symlinkSync(short, originHome);
             }
-            // If versionedHome is already a symlink (migrated by a prior run or the
-            // shim), leave it; `short` will be populated below.
+            else {
+                // First migration: relocate the deep home so config/auth/state stay
+                // intact, then leave a symlink behind so anything referencing the origin
+                // path still resolves (session discovery, the slot record, the shim).
+                fs.renameSync(originHome, short);
+                fs.symlinkSync(short, originHome);
+            }
+        }
+        else {
+            // Fresh origin: create (or adopt) the short home and link the origin to it.
+            fs.mkdirSync(short, { recursive: true });
+            fs.mkdirSync(path.dirname(originHome), { recursive: true });
+            fs.symlinkSync(short, originHome);
         }
     }
     catch {
-        // Migration lost a race or hit a permission error. Fall back to the
-        // versioned home rather than crash the invocation.
-        if (!fs.existsSync(short))
-            return versionedHome;
+        // A filesystem step lost a race or hit a permission error. Fall back to the
+        // origin rather than crash the invocation.
+        return originHome;
     }
-    return fs.existsSync(short) ? short : versionedHome;
+    return isSymlinkOnto(originHome, short) ? short : originHome;
 }
 /**
  * Emit the bash block that a generated codex shim uses to export a
- * SUN_LEN-safe CODEX_HOME. Mirrors {@link resolveCodexHome}.
+ * SUN_LEN-safe CODEX_HOME. Mirrors {@link resolveCodexHome} for the one origin
+ * a shim ever sees, the version home: an account-slot launch reaches the shim
+ * with CODEX_HOME already pinned by `buildExecEnv`, and the block below keeps a
+ * caller-provided CODEX_HOME, so the slot key never has to be derived in bash.
  *
  * @param homeExpr      shell expression for the versioned codex home
  *                      (e.g. `$VERSION_DIR/home/.codex`)

package/dist/lib/harness/adapters/codex.js

@@ -1,7 +1,7 @@
 import * as os from 'os';
 import * as path from 'path';
 import { getHistoryDir } from '../../state.js';
-import { resolveCodexHome, codexHomeShimBash } from '../../codex-home.js';
+import { codexHomeShimBash, codexShortKey, resolveCodexHome } from '../../codex-home.js';
 import { codexEditWritableRoots, codexPolicyArgs } from '../../codex-policy.js';
 import { stripForeignConfigDir } from '../adapter.js';
 /**
@@ -20,9 +20,12 @@ export const codexAdapter = {
             // On macOS the deep versioned home overflows the Unix-socket SUN_LEN
             // limit for codex's app-server control socket; resolve to a short,
             // SUN_LEN-safe home (migrating once if needed). See codex-home.ts.
-            const versionedHome = path.join(ctx.versionHome, '.codex');
-            const agentsUserDir = path.dirname(getHistoryDir());
-            result.CODEX_HOME = resolveCodexHome(versionedHome, agentsUserDir, ctx.version);
+            // ctx.versionHome is the account slot on a `codex#<account>` launch, so
+            // the short home is keyed by that origin, never by the version alone.
+            const originHome = path.join(ctx.versionHome, '.codex');
+            const historyDir = getHistoryDir();
+            const agentsUserDir = path.dirname(historyDir);
+            result.CODEX_HOME = resolveCodexHome(originHome, agentsUserDir, codexShortKey(originHome, ctx.version, historyDir));
         }
         stripForeignConfigDir(result, ['CODEX_HOME']);
     },

package/dist/lib/helper-versions.js

@@ -36,7 +36,7 @@
  * helper release now, off this table entirely.
  */
 export const HELPER_RELEASES = {
-    menubar: { tagPrefix: 'menubar', floor: '1.1.1' },
+    menubar: { tagPrefix: 'menubar', floor: '1.1.2' },
     'computer-mac': { tagPrefix: 'computer-mac', floor: '1.0.0' },
     // The Windows helper is a bare .exe, not an .app bundle, so it does not share
     // helper-download.ts's zip/codesign/notarize machinery -- but it has the same

package/dist/lib/reconcile-and-repair.d.ts

@@ -18,6 +18,7 @@
  */
 import type { AgentId } from './types.js';
 import { type HealResult } from './heal.js';
+import { type SlotProjection } from './accounts/slots.js';
 import { type HookRuntimeRepairReport } from './hooks/install.js';
 import { type RemediateStaleInstallsResult, type FindAgentsCliInstallsOptions } from './self-update.js';
 export interface HookRewireResult {
@@ -36,6 +37,13 @@ export interface RepairAfterSyncReport {
     hookRuntimeRepair: HookRuntimeRepairReport;
     /** Only populated on the umbrella (no-agent) path; null otherwise. */
     staleInstallPurge: RemediateStaleInstallsResult | null;
+    /**
+     * Account slots re-projected from their harness's default version home
+     * (PHNX-3940): one entry per slot, with the artifacts pruned because the
+     * source no longer carries them. Errors are per-harness sentences.
+     */
+    slotProjection: SlotProjection[];
+    slotProjectionErrors: string[];
 }
 /**
  * Test/override hook that scopes the destructive stale-CLI purge to injected

package/dist/lib/reconcile-and-repair.js

@@ -1,6 +1,7 @@
 import { AGENTS, ALL_AGENT_IDS } from './agents.js';
 import chalk from 'chalk';
 import { heal, healChangedAnything } from './heal.js';
+import { projectAccountSlots } from './accounts/slots.js';
 import { checkVersionHookWiring, registerHooksToSettings, repairManagedHookRuntimeArtifacts, } from './hooks/install.js';
 import { getVersionHomePath, listInstalledVersions, isVersionIsolated, } from './installations/versions.js';
 import { invalidateDoctorOverviewCache } from './devices/doctor-overview-cache.js';
@@ -126,11 +127,27 @@ export async function repairAfterSync(opts) {
     const staleInstallPurge = (!opts.agent && opts.pruneClis === true)
         ? purgeStaleAgentsCliCopies(opts.purgeInjection)
         : null;
+    // Account slots follow the version home (PHNX-3940). `agents accounts add`
+    // projects a slot once; without this every later sync would update the
+    // version home and leave each slot on the resources it was cloned with.
+    const slotProjection = [];
+    const slotProjectionErrors = [];
+    const slotAgents = opts.agent ? [opts.agent] : ALL_AGENT_IDS.filter((a) => listInstalledVersions(a).length > 0);
+    for (const agent of slotAgents) {
+        try {
+            slotProjection.push(...projectAccountSlots(agent));
+        }
+        catch (err) {
+            slotProjectionErrors.push(`${agent}: ${err.message}`);
+        }
+    }
     const report = {
         heal: healResult,
         hookRewire,
         hookRuntimeRepair,
         staleInstallPurge,
+        slotProjection,
+        slotProjectionErrors,
     };
     if (repairChangedAnything(report))
         invalidateDoctorOverviewCache();
@@ -142,7 +159,9 @@ export function repairChangedAnything(report) {
         report.hookRewire.some((r) => r.rewired > 0 || r.remaining > 0 || r.failure !== undefined) ||
         report.hookRuntimeRepair.attempts.length > 0 ||
         (report.staleInstallPurge !== null &&
-            (report.staleInstallPurge.removed.length > 0 || report.staleInstallPurge.failed.length > 0)));
+            (report.staleInstallPurge.removed.length > 0 || report.staleInstallPurge.failed.length > 0)) ||
+        report.slotProjection.length > 0 ||
+        report.slotProjectionErrors.length > 0);
 }
 /**
  * True when the RECONCILE repair left a per-version problem a human must fix — an
@@ -174,6 +193,8 @@ export function repairAfterSyncJson(report) {
         hookRewire: report.hookRewire,
         hookRuntimeRepair: report.hookRuntimeRepair,
         staleInstallPurge: report.staleInstallPurge,
+        slotProjection: report.slotProjection,
+        slotProjectionErrors: report.slotProjectionErrors,
         hadFailures: repairHadFailures(report),
     };
 }
@@ -264,4 +285,14 @@ export function renderRepairAfterSync(report, log = (s) => console.log(s)) {
     renderHookRuntimeRepairText(report.hookRuntimeRepair, log);
     if (report.staleInstallPurge)
         renderStaleInstallPurgeText(report.staleInstallPurge, log);
+    renderSlotProjectionText(report, log);
+}
+function renderSlotProjectionText(report, log) {
+    for (const slot of report.slotProjection) {
+        const pruned = slot.pruned.length > 0 ? chalk.gray(` — removed ${slot.pruned.join(', ')}`) : '';
+        log(`  ${chalk.green('slot')}    account ${chalk.bold(slot.name)} ${chalk.gray(`← ${slot.from}`)}${pruned}`);
+    }
+    for (const err of report.slotProjectionErrors) {
+        log(`  ${chalk.yellow('slot')}    ${err}`);
+    }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@phnx-labs/agents-cli",
-  "version": "1.22.97",
+  "version": "1.22.99",
   "description": "One CLI for all your AI coding agents - versions, config, cloud dispatch, sessions, and teams (now with first-class Grok Build CLI support)",
   "type": "module",
   "main": "dist/index.js",