@phnx-labs/agents-cli 1.22.98 → 1.22.99

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 1.22.99
+
+- **`agents setup secrets` installs the published secrets CLI instead of only printing a hint (PHNX-3989).** A missing `secrets` binary tries `agents clis install secrets` then a pinned `npm i -g @phnx-labs/secrets-cli@0.1.2`, then hands off to `secrets migrate`. Docs point at the standalone engine; the broker is `secrets _agent-run` on macOS, not the agents daemon. Source: `cli/src/commands/setup-secrets.ts`, `cli/docs/secrets.md`.
+
+- `agents accounts list` / `agents view` no longer report a signed-in account slot as `MISSING`. A slot's STATE now comes from a live read of the slot's own credential and from the daemon's auth probe, which now covers account slots (`slot:<accountId>` rows) as well as version homes. Before, a slot's verdict was written only by `accounts add/login`, the daemon never re-derived it, and `signedIn` was read from an unrelated version home — so a slot re-materialized as `unconfigured` while the device doc was unreadable (a duplicate YAML key from a shared-repo autostash merge) stayed `MISSING` forever even though `agents run` used its login fine.
+
 ## 1.22.98
 
 - `agents run codex#<account>` on macOS now runs as that account. The SUN_LEN short-home relocation keyed `CODEX_HOME` by version alone, so an account slot (long enough to overflow too) was silently redirected to the default version's `~/.agents/.codex-homes/<version>/.codex` and its login — `agents run codex#getrush` opened the gmail session while the banner still said `getrush`. The short home is now keyed by the origin (`a-<account id>` for a slot). A version/account reinstall that recreates a fresh `.codex` adopts its existing short home (which holds the login) instead of failing, and a slot mis-linked onto a foreign home by the old layout is repointed to its own home rather than run as the wrong account.

package/README.md

@@ -1228,19 +1228,28 @@ replacement (`add` / `login` / `default` / `run <harness>#<name>`).
 
 ## Secrets
 
-> **Platform:** `agents secrets` requires macOS Keychain or Linux libsecret.
-> On Windows (non-WSL), use environment variables or a `.env` file instead.
+Secrets are the standalone **`secrets` CLI** (`@phnx-labs/secrets-cli`). agi-cli does not ship the engine. `agents secrets` is a passthrough to the same binary.
 
 ```bash
-# API keys in Keychain, not in .env files.
-agents secrets create prod-stripe
-agents secrets add prod-stripe STRIPE_SECRET_KEY     # Prompts, stores in Keychain
-agents secrets add prod-stripe TEST_CARD --value "4242..."
+# Install (pick one — no extra env vars)
+agents clis install secrets
+# or
+npm i -g @phnx-labs/secrets-cli@0.1.2
+# or, after agents is installed:
+agents setup secrets
+```
 
-# Injected at run time. Bundle definitions live in the Keychain, not on disk.
+```bash
+# API keys in Keychain, not in .env files.
+secrets create prod-stripe
+secrets add prod-stripe STRIPE_SECRET_KEY     # Prompts, stores in Keychain
 agents run claude "charge a test card" --secrets prod-stripe
 ```
 
+> **Platform:** macOS Keychain, Linux libsecret / file store. On Windows (non-WSL), use environment variables or a `.env` file instead.
+
+The macOS broker is **not** the agents daemon. It is `secrets _agent-run` (started by `secrets start` or on first unlock), socket under `$SECRETS_HOME/.cache/helpers/secrets-agent/` (`~/.agents` when you go through `agents secrets`). Linux has no broker. `agents daemon` never hosts it.
+
 <p align="center">
   <img src="assets/secrets.svg" alt="How agi-cli secrets work: bundle definitions live in the macOS Keychain alongside their values, agi-cli resolves at runtime and injects the env into the child process" width="100%" />
 </p>

package/dist/commands/setup-secrets.d.ts

@@ -1,22 +1,29 @@
 /**
- * `agents setup secrets` — install guidance for the standalone `secrets` CLI,
- * then a pass-through to its own `secrets migrate` onboarding (PHNX-3989).
+ * `agents setup secrets` — install the standalone `secrets` CLI if missing,
+ * then hand off to its own `secrets migrate` onboarding (PHNX-3989).
  *
- * The wizard that used to pick a default backend/policy and delegate imports
- * lived entirely against the in-repo secrets engine. That engine is extracted
- * to `@phnx-labs/secrets-cli`, which owns its own interactive onboarding
- * (`secrets migrate`) — agents-cli never rebundles it (DIST-1), so there is no
- * in-process fallback when it isn't installed: this command names the install
- * command and stops.
+ * The engine lives in `@phnx-labs/secrets-cli`. agents-cli never rebundles it
+ * (DIST-1). A missing binary is a routine install, not a fatal gap: try
+ * `agents clis install secrets` (system `clis/secrets.yaml`) then a pinned
+ * `npm i -g`. Users do not set extra env vars.
  */
 import type { Command } from 'commander';
+export declare const SECRETS_CLI_PACKAGE = "@phnx-labs/secrets-cli@0.1.2";
+export declare const INSTALL_HINT = "agents clis install secrets   # or: npm i -g @phnx-labs/secrets-cli@0.1.2";
 export declare function setupSecretsPrefsPath(): string;
 /** True when the standalone `secrets` executable resolves ($SECRETS_BIN or PATH). */
 export declare function isSecretsCliInstalled(): boolean;
 /**
- * Print install guidance when the standalone is missing, else hand off to its
- * own interactive `secrets migrate`. Returns whether setup is now complete
- * (installed, and — when it ran — `migrate` exited 0).
+ * Install the published secrets CLI. Prefers the host-CLI manifest
+ * (`clis/secrets.yaml` in the system repo) so doctor/clis stay one path.
+ * Falls back to a pinned npm global install. Returns whether `secrets` is
+ * on PATH afterwards. Never writes an `agents secrets` shim.
+ */
+export declare function installSecretsCli(): boolean;
+/**
+ * Install the standalone if missing, then hand off to `secrets migrate`.
+ * Returns whether setup is now complete (installed, and migrate exited 0
+ * when it ran).
  */
 export declare function runSecretsSetupWizard(): Promise<boolean>;
 /** Register `agents setup secrets` under the parent `setup` command. */

package/dist/commands/setup-secrets.js

@@ -1,21 +1,21 @@
 /**
- * `agents setup secrets` — install guidance for the standalone `secrets` CLI,
- * then a pass-through to its own `secrets migrate` onboarding (PHNX-3989).
+ * `agents setup secrets` — install the standalone `secrets` CLI if missing,
+ * then hand off to its own `secrets migrate` onboarding (PHNX-3989).
  *
- * The wizard that used to pick a default backend/policy and delegate imports
- * lived entirely against the in-repo secrets engine. That engine is extracted
- * to `@phnx-labs/secrets-cli`, which owns its own interactive onboarding
- * (`secrets migrate`) — agents-cli never rebundles it (DIST-1), so there is no
- * in-process fallback when it isn't installed: this command names the install
- * command and stops.
+ * The engine lives in `@phnx-labs/secrets-cli`. agents-cli never rebundles it
+ * (DIST-1). A missing binary is a routine install, not a fatal gap: try
+ * `agents clis install secrets` (system `clis/secrets.yaml`) then a pinned
+ * `npm i -g`. Users do not set extra env vars.
  */
 import chalk from 'chalk';
 import * as fs from 'fs';
 import * as path from 'path';
 import { spawnSync } from 'node:child_process';
 import { getHistoryDir } from '../lib/state.js';
-import { resolveSecretsBin, invocation, SecretsClientError } from '../lib/secrets-client.js';
-const INSTALL_HINT = 'npm i -g @phnx-labs/secrets-cli';
+import { resolveSecretsBin, invocation, SecretsClientError, _resetSecretsClientForTest } from '../lib/secrets-client.js';
+import { installCli, resolveCliManifest } from '../lib/cli-resources.js';
+export const SECRETS_CLI_PACKAGE = '@phnx-labs/secrets-cli@0.1.2';
+export const INSTALL_HINT = `agents clis install secrets   # or: npm i -g ${SECRETS_CLI_PACKAGE}`;
 export function setupSecretsPrefsPath() {
     return path.join(getHistoryDir(), 'setup', 'secrets.json');
 }
@@ -37,16 +37,48 @@ function recordSetupComplete() {
     fs.writeFileSync(file, JSON.stringify({ updatedAt: new Date().toISOString() }, null, 2) + '\n', { mode: 0o600 });
 }
 /**
- * Print install guidance when the standalone is missing, else hand off to its
- * own interactive `secrets migrate`. Returns whether setup is now complete
- * (installed, and — when it ran — `migrate` exited 0).
+ * Install the published secrets CLI. Prefers the host-CLI manifest
+ * (`clis/secrets.yaml` in the system repo) so doctor/clis stay one path.
+ * Falls back to a pinned npm global install. Returns whether `secrets` is
+ * on PATH afterwards. Never writes an `agents secrets` shim.
+ */
+export function installSecretsCli() {
+    if (isSecretsCliInstalled())
+        return true;
+    const manifest = resolveCliManifest('secrets');
+    if (manifest) {
+        console.log(chalk.gray(`Installing ${manifest.name} via agents clis…`));
+        const result = installCli(manifest);
+        _resetSecretsClientForTest();
+        if (result.installed)
+            return true;
+        if (result.error)
+            console.error(chalk.gray(result.error));
+    }
+    console.log(chalk.gray(`Installing ${SECRETS_CLI_PACKAGE}…`));
+    const r = spawnSync('npm', ['install', '-g', SECRETS_CLI_PACKAGE], { stdio: 'inherit' });
+    _resetSecretsClientForTest();
+    if (r.error) {
+        console.error(chalk.red(`npm install failed: ${r.error.message}`));
+        return false;
+    }
+    if ((r.status ?? 1) !== 0)
+        return false;
+    return isSecretsCliInstalled();
+}
+/**
+ * Install the standalone if missing, then hand off to `secrets migrate`.
+ * Returns whether setup is now complete (installed, and migrate exited 0
+ * when it ran).
  */
 export async function runSecretsSetupWizard() {
     if (!isSecretsCliInstalled()) {
-        console.log(chalk.yellow('The standalone `secrets` CLI is not installed.'));
-        console.log(chalk.gray('Install it, then re-run `agents setup secrets`:'));
-        console.log(chalk.cyan(`  ${INSTALL_HINT}`));
-        return false;
+        if (!installSecretsCli()) {
+            console.log(chalk.yellow('The standalone `secrets` CLI is not installed.'));
+            console.log(chalk.gray('Install it, then re-run `agents setup secrets`:'));
+            console.log(chalk.cyan(`  ${INSTALL_HINT}`));
+            return false;
+        }
     }
     const bin = resolveSecretsBin();
     const { command, prefix } = invocation(bin);
@@ -60,7 +92,7 @@ export async function runSecretsSetupWizard() {
 export function registerSetupSecretsCommand(setupCmd) {
     setupCmd
         .command('secrets')
-        .description('Install guidance for the standalone `secrets` CLI, then run its own `secrets migrate` onboarding.')
+        .description('Install the standalone `secrets` CLI if missing, then run its `secrets migrate` onboarding.')
         .action(async () => {
         if (!(await runSecretsSetupWizard()))
             process.exitCode = 1;

package/dist/lib/account-catalog.js

@@ -8,7 +8,7 @@ import { readSlots } from './accounts/slots.js';
 import { harnessWorkerIsPerDevice } from './harness-auth-capabilities.js';
 import { hasKeychainTokenSync, isSecretsTransportError } from './secrets-client.js';
 import { isLaunchableSignedIn as isCredentialLaunchable } from './accounting/rotate.js';
-import { authCacheKey, readAuthHealthCache } from './auth-health.js';
+import { authCacheKey, readAuthHealthCache, slotAuthVersionKey } from './auth-health.js';
 import { readFleetSharedDeviceStates } from './fleet-shared-state.js';
 import { machineId } from './machine-id.js';
 import { isHeadedDeviceRole, selfConfiguredDeviceRole } from './device-config.js';
@@ -245,9 +245,21 @@ export async function loadAccountCatalog() {
         const localHome = row.installations.find((home) => home.label === row.home)
             ?? row.installations.find((home) => home.signedIn)
             ?? row.installations[0];
-        const cached = localHome ? auth[authCacheKey(host, row.agent, localHome.label)] : undefined;
         const slot = row.id ? localSlots[row.id] : undefined;
-        const observation = resolveLocalAccountObservation(slot, cached, localHome?.signedIn === true);
+        // A slot account's local truth is the SLOT — its own credential file and its
+        // own daemon probe row (keyed `slot:<id>`) — never the version home its label
+        // happens to match. Reading the version home here is what rendered a
+        // signed-in slot MISSING: the slot record held ensureSlot's `unconfigured`
+        // default, the daemon never probed the slot, and `signedIn` came from an
+        // unrelated home.
+        const slotSignedIn = slot
+            ? await getAccountInfo(row.agent, slot.slotDir)
+                .then((info) => isLaunchableSignedIn(row.agent, slot.slotDir, info))
+                .catch(() => false)
+            : false;
+        const cached = (slot && row.id ? auth[authCacheKey(host, row.agent, slotAuthVersionKey(row.id))] : undefined)
+            ?? (localHome ? auth[authCacheKey(host, row.agent, localHome.label)] : undefined);
+        const observation = resolveLocalAccountObservation(slot, cached, slot ? slotSignedIn : localHome?.signedIn === true);
         const local = {
             device: host,
             authMode: observation.authMode
@@ -529,8 +541,12 @@ export function listDevicesWithoutAccountVerdicts(userAgentsDir) {
     return out.sort((a, b) => a.localeCompare(b));
 }
 function normalizeAuthVerdict(verdict, signedIn) {
+    // `unconfigured` is the slot record's DEFAULT (ensureSlot), not a probe
+    // result — the daemon never publishes it (probeLocalFleetAuth drops those
+    // rows). So it says nothing about the credential on disk; the live signedIn
+    // read of the slot decides, exactly as it does when no verdict exists at all.
     if (verdict === 'unconfigured')
-        return 'missing';
+        return signedIn ? 'unverified' : 'missing';
     if (verdict === 'error')
         return signedIn ? 'unverified' : 'missing';
     return verdict ?? (signedIn ? 'unverified' : 'missing');

package/dist/lib/accounts/slots.d.ts

@@ -3,6 +3,25 @@ export type { DeviceAccountSlot };
 export declare function slotDir(harness: AgentId, accountId: string): string;
 export declare function readSlots(meta: Pick<Meta, 'deviceAccounts'>): Record<string, DeviceAccountSlot>;
 export declare function recordSlot(accountId: string, slot: DeviceAccountSlot): void;
+export interface SlotProjection {
+    accountId: string;
+    /** Account name as registered (`agents accounts list`). */
+    name: string;
+    slotDir: string;
+    /** The version home the slot was projected from. */
+    from: string;
+    /** `<kind>/<name>` artifacts removed because the source no longer has them. */
+    pruned: string[];
+}
+/**
+ * Re-project settings and resources into every account slot this device holds
+ * for `harness`, from the harness's default version home. `ensureSlot` does
+ * this once at `agents accounts add`; every reconcile calls this so a slot
+ * never lags the version home it was cloned from (PHNX-3940). Credentials are
+ * never touched: `carryForwardSettings` and the resource writers exclude them.
+ * A slot whose directory is gone is skipped, not recreated.
+ */
+export declare function projectAccountSlots(harness: AgentId): SlotProjection[];
 /**
  * Create the HOME-shaped slot dir and project settings/resources from the
  * managed install. Does not copy credentials (carryForwardSettings excludes

package/dist/lib/accounts/slots.js

@@ -17,7 +17,7 @@ import { agentConfigDirName } from '../agents.js';
 import { harnessAuth, harnessWorkerIsPerDevice } from '../harness-auth-capabilities.js';
 import { getGlobalDefault, getVersionHomePath, listInstalledVersions } from '../installations/store.js';
 import { carryForwardSettings } from '../settings-manifest.js';
-import { getHistoryDir, updateMeta } from '../state.js';
+import { getHistoryDir, readMeta, updateMeta } from '../state.js';
 import { ALL_RESOURCE_KINDS, getDetector, getWriter, kindToCapability } from '../staleness/registry.js';
 import { supports } from '../capabilities.js';
 import { isAgentId } from '../types.js';
@@ -72,6 +72,66 @@ function projectResources(harness, version, destHome, fromHome) {
         writer.write({ version, versionHome: destHome, selection: names, cwd });
     }
 }
+/**
+ * Remove slot artifacts whose source name is gone. Only the name-keyed kinds
+ * that implement `remove` (commands, skills, hooks) are pruned; wholesale kinds
+ * (rules, permissions) are rewritten by the projection itself.
+ */
+function pruneSlotResources(harness, version, slotHome, fromHome) {
+    const cwd = process.cwd();
+    const pruned = [];
+    for (const kind of ALL_RESOURCE_KINDS) {
+        if (!supports(harness, kindToCapability(kind), version).ok)
+            continue;
+        const writer = getWriter(kind, harness);
+        const detector = getDetector(kind, harness);
+        if (!writer?.remove || !detector)
+            continue;
+        const source = new Set(detector.list({ version, versionHome: fromHome, cwd }));
+        for (const name of detector.list({ version, versionHome: slotHome, cwd })) {
+            if (source.has(name))
+                continue;
+            if (writer.remove({ version, versionHome: slotHome, name, cwd }).removed)
+                pruned.push(`${kind}/${name}`);
+        }
+    }
+    return pruned;
+}
+/**
+ * Re-project settings and resources into every account slot this device holds
+ * for `harness`, from the harness's default version home. `ensureSlot` does
+ * this once at `agents accounts add`; every reconcile calls this so a slot
+ * never lags the version home it was cloned from (PHNX-3940). Credentials are
+ * never touched: `carryForwardSettings` and the resource writers exclude them.
+ * A slot whose directory is gone is skipped, not recreated.
+ */
+export function projectAccountSlots(harness) {
+    const version = sourceVersion(harness);
+    if (!version)
+        return [];
+    const fromHome = getVersionHomePath(harness, version);
+    if (!fs.existsSync(fromHome))
+        return [];
+    const meta = readMeta();
+    const slots = readSlots(meta);
+    const native = { ...meta.accounts?.native, ...meta.deviceAccounts?.native };
+    const projected = [];
+    for (const account of Object.values(native)) {
+        if (account.agent !== harness)
+            continue;
+        // The slot record is device-local and written after identity capture; a
+        // slot dir minted by an earlier build, or an add that stopped short of
+        // recording, is still the HOME an account run uses — project it too.
+        const dir = slots[account.id]?.slotDir ?? slotDir(harness, account.id);
+        if (!fs.existsSync(path.join(dir, agentConfigDirName(harness))))
+            continue;
+        carryForwardSettings(harness, fromHome, dir);
+        const pruned = pruneSlotResources(harness, version, dir, fromHome);
+        projectResources(harness, version, dir, fromHome);
+        projected.push({ accountId: account.id, name: account.name, slotDir: dir, from: version, pruned });
+    }
+    return projected;
+}
 /**
  * Create the HOME-shaped slot dir and project settings/resources from the
  * managed install. Does not copy credentials (carryForwardSettings excludes

package/dist/lib/auth-health.d.ts

@@ -1,5 +1,5 @@
 import { type AccountInfo } from './agents.js';
-import type { AgentId } from './types.js';
+import type { AgentId, Meta } from './types.js';
 import { type ProviderProbe } from './accounting/usage.js';
 /**
  * - `live`        — completed an authenticated request (200).
@@ -134,6 +134,28 @@ export declare function formatCheckedAge(checkedAt: number, now?: number): strin
 export declare function authAccountLabel(info: Pick<AccountInfo, 'email' | 'accountId' | 'userId'> | null | undefined): string | undefined;
 /** Cache key: one entry per install — (host, agent, version). Unique per token. */
 export declare function authCacheKey(host: string, agent: AgentId | string, version: string): string;
+/**
+ * The `version` slot an account SLOT occupies in the auth cache and the probe
+ * rows: `slot:<accountId>`. A slot is a HOME-shaped dir, not an installed
+ * version, so it needs its own key or its verdict would collide with (or be
+ * silently dropped in favor of) whichever version home the account's label
+ * happened to match.
+ */
+export declare function slotAuthVersionKey(accountId: string): string;
+/** One account slot on this device that the auth probe must cover. */
+export interface SlotAuthInstall extends FleetAuthInstall {
+    home: string;
+    accountId: string;
+}
+/**
+ * Every registered account's slot on this device (PHNX-3940 T1), as probe
+ * targets. Before this the probe walked `listInstalledVersions` only, so a
+ * slot's verdict was never re-derived after `accounts add/login` wrote it —
+ * a slot re-materialized as `unconfigured` while the device doc was unreadable
+ * stayed MISSING forever even though its login was live. A slot whose dir is
+ * gone is skipped: there is nothing to probe and the row would only say so.
+ */
+export declare function enumerateSlotInstalls(meta: Pick<Meta, 'accounts' | 'deviceAccounts'>, agentIds: readonly AgentId[]): SlotAuthInstall[];
 /** Read the whole cache (best-effort; a corrupt/missing file yields an empty map). */
 export declare function readAuthHealthCache(): Record<string, AuthHealth>;
 /** Read one entry, or null. */

package/dist/lib/auth-health.js

@@ -19,6 +19,8 @@
 import * as fs from 'fs';
 import * as path from 'path';
 import { ALL_AGENT_IDS, getAccountInfo } from './agents.js';
+import { listNativeAccounts } from './account-registry.js';
+import { readSlots } from './accounts/slots.js';
 import { getCacheDir } from './state.js';
 import { probeClaudeStatus, probeDroidStatus, probeKimiStatus, USAGE_HEADLESS_SCOPE_MARKER, readClaudeUsageCache, } from './accounting/usage.js';
 import { getVersionHomePath, listInstalledVersions } from './installations/versions.js';
@@ -218,6 +220,37 @@ export function authAccountLabel(info) {
 export function authCacheKey(host, agent, version) {
     return `${host}:${agent}:${version}`;
 }
+/**
+ * The `version` slot an account SLOT occupies in the auth cache and the probe
+ * rows: `slot:<accountId>`. A slot is a HOME-shaped dir, not an installed
+ * version, so it needs its own key or its verdict would collide with (or be
+ * silently dropped in favor of) whichever version home the account's label
+ * happened to match.
+ */
+export function slotAuthVersionKey(accountId) {
+    return `slot:${accountId}`;
+}
+/**
+ * Every registered account's slot on this device (PHNX-3940 T1), as probe
+ * targets. Before this the probe walked `listInstalledVersions` only, so a
+ * slot's verdict was never re-derived after `accounts add/login` wrote it —
+ * a slot re-materialized as `unconfigured` while the device doc was unreadable
+ * stayed MISSING forever even though its login was live. A slot whose dir is
+ * gone is skipped: there is nothing to probe and the row would only say so.
+ */
+export function enumerateSlotInstalls(meta, agentIds) {
+    const byId = new Map(listNativeAccounts(meta).map((account) => [account.id, account]));
+    const out = [];
+    for (const [accountId, slot] of Object.entries(readSlots(meta))) {
+        const account = byId.get(accountId);
+        if (!account || !agentIds.includes(account.agent))
+            continue;
+        if (!fs.existsSync(slot.slotDir))
+            continue;
+        out.push({ agent: account.agent, version: slotAuthVersionKey(accountId), home: slot.slotDir, account: undefined, accountId });
+    }
+    return out;
+}
 function cacheFilePath() {
     return path.join(getCacheDir(), '.auth-health.json');
 }
@@ -410,26 +443,31 @@ export function groupFleetAuthInstalls(installs, isMergeable = () => true) {
  */
 export async function probeLocalFleetAuth(opts) {
     const agentIds = opts?.agents ?? ALL_AGENT_IDS;
-    // Enumerate every install, then resolve its account label. getAccountInfo is a
-    // local credential-file read (no network), so this fan-out is cheap and cannot
-    // contribute to the rate limit the probe grouping below exists to avoid.
+    // Enumerate every install AND every account slot on this device, then resolve
+    // each one's account label. getAccountInfo is a local credential-file read
+    // (no network), so this fan-out is cheap and cannot contribute to the rate
+    // limit the probe grouping below exists to avoid.
+    const [{ readMeta }, { findNativeAccountByIdentity }] = await Promise.all([
+        import('./state.js'),
+        import('./account-registry.js'),
+    ]);
+    const meta = readMeta();
     const installs = [];
     for (const agent of agentIds) {
         for (const version of listInstalledVersions(agent)) {
             installs.push({ agent, version, home: getVersionHomePath(agent, version), info: null, account: undefined });
         }
     }
+    for (const slot of enumerateSlotInstalls(meta, agentIds)) {
+        installs.push({ ...slot, info: null });
+    }
     await Promise.all(installs.map(async (inst) => {
         inst.info = await getAccountInfo(inst.agent, inst.home).catch(() => null);
         inst.account = authAccountLabel(inst.info);
     }));
-    const [{ readMeta }, { findNativeAccountByIdentity }] = await Promise.all([
-        import('./state.js'),
-        import('./account-registry.js'),
-    ]);
-    const meta = readMeta();
     for (const inst of installs) {
-        inst.accountId = findNativeAccountByIdentity(meta, inst.agent, inst.info)?.id;
+        // A slot already knows its account; a version home is joined by identity.
+        inst.accountId ??= findNativeAccountByIdentity(meta, inst.agent, inst.info)?.id;
     }
     // Probe once per (agent, account) — but only for the network-probing agents
     // that can actually 429; best-effort agents stay per-install (see

package/dist/lib/helper-versions.js

@@ -36,7 +36,7 @@
  * helper release now, off this table entirely.
  */
 export const HELPER_RELEASES = {
-    menubar: { tagPrefix: 'menubar', floor: '1.1.1' },
+    menubar: { tagPrefix: 'menubar', floor: '1.1.2' },
     'computer-mac': { tagPrefix: 'computer-mac', floor: '1.0.0' },
     // The Windows helper is a bare .exe, not an .app bundle, so it does not share
     // helper-download.ts's zip/codesign/notarize machinery -- but it has the same

package/dist/lib/reconcile-and-repair.d.ts

@@ -18,6 +18,7 @@
  */
 import type { AgentId } from './types.js';
 import { type HealResult } from './heal.js';
+import { type SlotProjection } from './accounts/slots.js';
 import { type HookRuntimeRepairReport } from './hooks/install.js';
 import { type RemediateStaleInstallsResult, type FindAgentsCliInstallsOptions } from './self-update.js';
 export interface HookRewireResult {
@@ -36,6 +37,13 @@ export interface RepairAfterSyncReport {
     hookRuntimeRepair: HookRuntimeRepairReport;
     /** Only populated on the umbrella (no-agent) path; null otherwise. */
     staleInstallPurge: RemediateStaleInstallsResult | null;
+    /**
+     * Account slots re-projected from their harness's default version home
+     * (PHNX-3940): one entry per slot, with the artifacts pruned because the
+     * source no longer carries them. Errors are per-harness sentences.
+     */
+    slotProjection: SlotProjection[];
+    slotProjectionErrors: string[];
 }
 /**
  * Test/override hook that scopes the destructive stale-CLI purge to injected

package/dist/lib/reconcile-and-repair.js

@@ -1,6 +1,7 @@
 import { AGENTS, ALL_AGENT_IDS } from './agents.js';
 import chalk from 'chalk';
 import { heal, healChangedAnything } from './heal.js';
+import { projectAccountSlots } from './accounts/slots.js';
 import { checkVersionHookWiring, registerHooksToSettings, repairManagedHookRuntimeArtifacts, } from './hooks/install.js';
 import { getVersionHomePath, listInstalledVersions, isVersionIsolated, } from './installations/versions.js';
 import { invalidateDoctorOverviewCache } from './devices/doctor-overview-cache.js';
@@ -126,11 +127,27 @@ export async function repairAfterSync(opts) {
     const staleInstallPurge = (!opts.agent && opts.pruneClis === true)
         ? purgeStaleAgentsCliCopies(opts.purgeInjection)
         : null;
+    // Account slots follow the version home (PHNX-3940). `agents accounts add`
+    // projects a slot once; without this every later sync would update the
+    // version home and leave each slot on the resources it was cloned with.
+    const slotProjection = [];
+    const slotProjectionErrors = [];
+    const slotAgents = opts.agent ? [opts.agent] : ALL_AGENT_IDS.filter((a) => listInstalledVersions(a).length > 0);
+    for (const agent of slotAgents) {
+        try {
+            slotProjection.push(...projectAccountSlots(agent));
+        }
+        catch (err) {
+            slotProjectionErrors.push(`${agent}: ${err.message}`);
+        }
+    }
     const report = {
         heal: healResult,
         hookRewire,
         hookRuntimeRepair,
         staleInstallPurge,
+        slotProjection,
+        slotProjectionErrors,
     };
     if (repairChangedAnything(report))
         invalidateDoctorOverviewCache();
@@ -142,7 +159,9 @@ export function repairChangedAnything(report) {
         report.hookRewire.some((r) => r.rewired > 0 || r.remaining > 0 || r.failure !== undefined) ||
         report.hookRuntimeRepair.attempts.length > 0 ||
         (report.staleInstallPurge !== null &&
-            (report.staleInstallPurge.removed.length > 0 || report.staleInstallPurge.failed.length > 0)));
+            (report.staleInstallPurge.removed.length > 0 || report.staleInstallPurge.failed.length > 0)) ||
+        report.slotProjection.length > 0 ||
+        report.slotProjectionErrors.length > 0);
 }
 /**
  * True when the RECONCILE repair left a per-version problem a human must fix — an
@@ -174,6 +193,8 @@ export function repairAfterSyncJson(report) {
         hookRewire: report.hookRewire,
         hookRuntimeRepair: report.hookRuntimeRepair,
         staleInstallPurge: report.staleInstallPurge,
+        slotProjection: report.slotProjection,
+        slotProjectionErrors: report.slotProjectionErrors,
         hadFailures: repairHadFailures(report),
     };
 }
@@ -264,4 +285,14 @@ export function renderRepairAfterSync(report, log = (s) => console.log(s)) {
     renderHookRuntimeRepairText(report.hookRuntimeRepair, log);
     if (report.staleInstallPurge)
         renderStaleInstallPurgeText(report.staleInstallPurge, log);
+    renderSlotProjectionText(report, log);
+}
+function renderSlotProjectionText(report, log) {
+    for (const slot of report.slotProjection) {
+        const pruned = slot.pruned.length > 0 ? chalk.gray(` — removed ${slot.pruned.join(', ')}`) : '';
+        log(`  ${chalk.green('slot')}    account ${chalk.bold(slot.name)} ${chalk.gray(`← ${slot.from}`)}${pruned}`);
+    }
+    for (const err of report.slotProjectionErrors) {
+        log(`  ${chalk.yellow('slot')}    ${err}`);
+    }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@phnx-labs/agents-cli",
-  "version": "1.22.98",
+  "version": "1.22.99",
   "description": "One CLI for all your AI coding agents - versions, config, cloud dispatch, sessions, and teams (now with first-class Grok Build CLI support)",
   "type": "module",
   "main": "dist/index.js",